Merge branch 'master' into new.pluma

doc/languages-frameworks/python.md

@@ -423,7 +423,7 @@ and in this case the `python35` interpreter is automatically used.
 ### Interpreters
 
 Versions 2.7, 3.3, 3.4, 3.5 and 3.6 of the CPython interpreter are available as
-respectively `python27`, `python33`, `python34`, `python35` and `python36`. The PyPy interpreter
+respectively `python27`, `python34`, `python35` and `python36`. The PyPy interpreter
 is available as `pypy`. The aliases `python2` and `python3` correspond to respectively `python27` and
 `python35`. The default interpreter, `python`, maps to `python2`.
 The Nix expressions for the interpreters can be found in
@@ -469,7 +469,6 @@ sets are
 
 * `pkgs.python26Packages`
 * `pkgs.python27Packages`
-* `pkgs.python33Packages`
 * `pkgs.python34Packages`
 * `pkgs.python35Packages`
 * `pkgs.python36Packages`
@@ -546,6 +545,35 @@ All parameters from `mkDerivation` function are still supported.
 * `catchConflicts` If `true`, abort package build if a package name appears more than once in dependency tree. Default is `true`.
 * `checkInputs` Dependencies needed for running the `checkPhase`. These are added to `buildInputs` when `doCheck = true`.
 
+##### Overriding Python packages
+
+The `buildPythonPackage` function has a `overridePythonPackage` method that
+can be used to override the package. In the following example we create an
+environment where we have the `blaze` package using an older version of `pandas`.
+We override first the Python interpreter and pass
+`packageOverrides` which contains the overrides for packages in the package set.
+
+```nix
+with import <nixpkgs> {};
+
+(let
+  python = let
+    packageOverrides = self: super: {
+      pandas = super.pandas.overridePythonPackage(old: rec {
+        version = "0.19.1";
+        name = "pandas-${version}";
+        src =  super.fetchPypi {
+          pname = "pandas";
+          inherit version;
+          sha256 = "08blshqj9zj1wyjhhw3kl2vas75vhhicvv72flvf1z3jvapgw295";
+        };
+      });
+    };
+  in pkgs.python3.override {inherit packageOverrides;};
+
+in python.withPackages(ps: [ps.blaze])).env
+```
+
 #### `buildPythonApplication` function
 
 The `buildPythonApplication` function is practically the same as `buildPythonPackage`.
@@ -622,7 +650,7 @@ attribute. The `shell.nix` file from the previous section can thus be also writt
 ```nix
 with import <nixpkgs> {};
 
-(python33.withPackages (ps: [ps.numpy ps.requests])).env
+(python36.withPackages (ps: [ps.numpy ps.requests])).env
 ```
 
 In contrast to `python.buildEnv`, `python.withPackages` does not support the more advanced options
@@ -755,17 +783,17 @@ In the following example we rename the `pandas` package and build it.
 ```nix
 with import <nixpkgs> {};
 
-let
+(let
   python = let
     packageOverrides = self: super: {
-      pandas = super.pandas.override {name="foo";};
+      pandas = super.pandas.overridePythonPackage(old: {name="foo";});
     };
   in pkgs.python35.override {inherit packageOverrides;};
 
-in python.pkgs.pandas
+in python.withPackages(ps: [ps.pandas])).env
 ```
-Using `nix-build` on this expression will build the package `pandas`
+Using `nix-build` on this expression will build an environment that contains the
-but with the new name `foo`.
+package `pandas` but with the new name `foo`.
 
 All packages in the package set will use the renamed package.
 A typical use case is to switch to another version of a certain package.

doc/languages-frameworks/ruby.xml

@@ -82,7 +82,7 @@ versions available from various packages.
 </para>
 
 <para>Resulting derivations for both builders also have two helpful
-attributes, <literal>env</literal> and <literal>wrapper</literal>.
+attributes, <literal>env</literal> and <literal>wrappedRuby</literal>.
 The first one allows one to quickly drop into
 <command>nix-shell</command> with the specified environment present.
 E.g. <command>nix-shell -A sensu.env</command> would give you an
@@ -110,15 +110,10 @@ the needed dependencies. For example, to make a derivation
 
 in stdenv.mkDerivation {
   name = "my-script";
-
+  buildInputs = [ env.wrappedRuby ];
-  buildInputs = [ env.wrapper ];
-
   script = ./my-script.rb;
-
   buildCommand = ''
-    mkdir -p $out/bin
     install -D -m755 $script $out/bin/my-script
-    patchShebangs $out/bin/my-script
   '';
 }]]>
 </programlisting>

lib/maintainers.nix

@@ -94,6 +94,7 @@
   campadrenalin = "Philip Horger <campadrenalin@gmail.com>";
   canndrew = "Andrew Cann <shum@canndrew.org>";
   carlsverre = "Carl Sverre <accounts@carlsverre.com>";
+  casey = "Casey Rodarmor <casey@rodarmor.net>";
   cdepillabout = "Dennis Gosnell <cdep.illabout@gmail.com>";
   cfouche = "Chaddaï Fouché <chaddai.fouche@gmail.com>";
   changlinli = "Changlin Li <mail@changlinli.com>";
@@ -292,6 +293,7 @@
   khumba = "Bryan Gardiner <bog@khumba.net>";
   KibaFox = "Kiba Fox <kiba.fox@foxypossibilities.com>";
   kierdavis = "Kier Davis <kierdavis@gmail.com>";
+  kiloreux = "Kiloreux Emperex <kiloreux@gmail.com>";
   kkallio = "Karn Kallio <tierpluspluslists@gmail.com>";
   knedlsepp = "Josef Kemetmüller <josef.kemetmueller@gmail.com>";
   konimex = "Muhammad Herdiansyah <herdiansyah@openmailbox.org>";

nixos/doc/manual/release-notes/rl-1709.xml

@@ -187,6 +187,15 @@ rmdir /var/lib/ipfs/.ipfs
       have therefore been removed.
     </para>
   </listitem>
+  <listitem>
+    <para>
+      The <option>time.timeZone</option> option now allows the value
+      <literal>null</literal> in addition to timezone strings. This value
+      allows changing the timezone of a system imperatively using
+      <command>timedatectl set-timezone</command>. The default timezone
+      is still UTC.
+    </para>
+  </listitem>
 
 </itemizedlist>
 

nixos/lib/make-disk-image.nix

@@ -39,6 +39,12 @@
 with lib;
 
 let
+  extensions = {
+    qcow2 = "qcow2";
+    vpc   = "vhd";
+    raw   = "img";
+  };
+
   # Copied from https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/installer/cd-dvd/channel.nix
   # TODO: factor out more cleanly
 
@@ -142,8 +148,8 @@ in pkgs.vmTools.runInLinuxVM (
           mv $diskImage $out/nixos.img
           diskImage=$out/nixos.img
         '' else ''
-          ${pkgs.qemu}/bin/qemu-img convert -f raw -O qcow2 $diskImage $out/nixos.qcow2
+          ${pkgs.qemu}/bin/qemu-img convert -f raw -O ${format} $diskImage $out/nixos.${extensions.${format}}
-          diskImage=$out/nixos.qcow2
+          diskImage=$out/nixos.${extensions.${format}}
         ''}
         ${postVM}
       '';

nixos/maintainers/scripts/ec2/amazon-image.nix

@@ -22,15 +22,26 @@ in {
         generated image. Glob patterns work.
       '';
     };
+
+    sizeMB = mkOption {
+      type = types.int;
+      default = if config.ec2.hvm then 2048 else 8192;
+      description = "The size in MB of the image";
+    };
+
+    format = mkOption {
+      type = types.enum [ "raw" "qcow2" "vpc" ];
+      default = "qcow2";
+      description = "The image format to output";
+    };
   };
 
   config.system.build.amazonImage = import ../../../lib/make-disk-image.nix {
     inherit lib config;
-    inherit (cfg) contents;
+    inherit (cfg) contents format;
     pkgs = import ../../../.. { inherit (pkgs) system; }; # ensure we use the regular qemu-kvm package
     partitioned = config.ec2.hvm;
-    diskSize = if config.ec2.hvm then 2048 else 8192;
+    diskSize = cfg.sizeMB;
-    format = "qcow2";
     configFile = pkgs.writeText "configuration.nix"
       ''
         {
@@ -41,5 +52,4 @@ in {
         }
       '';
   };
-
 }

nixos/modules/config/system-path.nix

@@ -118,6 +118,9 @@ in
         "/share/themes"
         "/share/vim-plugins"
         "/share/vulkan"
+        "/share/kservices5"
+        "/share/kservicetypes5"
+        "/share/kxmlgui5"
       ];
 
     system.path = pkgs.buildEnv {

nixos/modules/services/databases/influxdb.nix

@@ -68,9 +68,9 @@ let
 
     collectd = [{
       enabled = false;
-      typesdb = "${pkgs.collectd}/share/collectd/types.db";
+      typesdb = "${pkgs.collectd-data}/share/collectd/types.db";
       database = "collectd_db";
-      port = 25826;
+      bind-address = ":25826";
     }];
 
     opentsdb = [{
@@ -149,7 +149,6 @@ in
         type = types.attrs;
       };
     };
-
   };
 
 

nixos/modules/services/logging/fluentd.nix

@@ -4,6 +4,8 @@ with lib;
 
 let
   cfg = config.services.fluentd;
+
+  pluginArgs = concatStringsSep " " (map (x: "-p ${x}") cfg.plugins);
 in {
   ###### interface
 
@@ -28,6 +30,15 @@ in {
         defaultText = "pkgs.fluentd";
         description = "The fluentd package to use.";
       };
+
+      plugins = mkOption {
+        type = types.listOf types.path;
+        default = [];
+        description = ''
+          A list of plugin paths to pass into fluentd. It will make plugins defined in ruby files
+          there available in your config.
+        '';
+      };
     };
   };
 
@@ -39,7 +50,7 @@ in {
       description = "Fluentd Daemon";
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
-        ExecStart = "${cfg.package}/bin/fluentd -c ${pkgs.writeText "fluentd.conf" cfg.config}";
+        ExecStart = "${cfg.package}/bin/fluentd -c ${pkgs.writeText "fluentd.conf" cfg.config} ${pluginArgs}";
         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
       };
     };

nixos/modules/services/logging/graylog.nix

@@ -11,9 +11,7 @@ let
     password_secret = ${cfg.passwordSecret}
     root_username = ${cfg.rootUsername}
     root_password_sha2 = ${cfg.rootPasswordSha2}
-    elasticsearch_cluster_name = ${cfg.elasticsearchClusterName}
+    elasticsearch_hosts = ${concatStringsSep "," cfg.elasticsearchHosts}
-    elasticsearch_discovery_zen_ping_multicast_enabled = ${boolToString cfg.elasticsearchDiscoveryZenPingMulticastEnabled}
-    elasticsearch_discovery_zen_ping_unicast_hosts = ${cfg.elasticsearchDiscoveryZenPingUnicastHosts}
     message_journal_dir = ${cfg.messageJournalDir}
     mongodb_uri = ${cfg.mongodbUri}
     plugin_dir = /var/lib/graylog/plugins
@@ -91,22 +89,10 @@ in
         '';
       };
 
-      elasticsearchClusterName = mkOption {
+      elasticsearchHosts = mkOption {
-        type = types.str;
+        type = types.listOf types.str;
-        example = "graylog";
+        example = literalExample ''[ "http://node1:9200" "http://user:password@node2:19200" ]'';
-        description = "This must be the same as for your Elasticsearch cluster";
+        description = "List of valid URIs of the http ports of your elastic nodes. If one or more of your elasticsearch hosts require authentication, include the credentials in each node URI that requires authentication";
-      };
-
-      elasticsearchDiscoveryZenPingMulticastEnabled = mkOption {
-        type = types.bool;
-        default = false;
-        description = "Whether to use elasticsearch multicast discovery";
-      };
-
-      elasticsearchDiscoveryZenPingUnicastHosts = mkOption {
-        type = types.str;
-        default = "127.0.0.1:9300";
-        description = "Tells Graylogs Elasticsearch client how to find other cluster members. See Elasticsearch documentation for details";
       };
 
       messageJournalDir = mkOption {

nixos/modules/services/mail/postfix.nix

@@ -213,8 +213,8 @@ let
         wakeupDefined = options.wakeup.isDefined;
         wakeupUCDefined = options.wakeupUnusedComponent.isDefined;
         finalValue = toString config.wakeup
-                   + optionalString (!config.wakeupUnusedComponent) "?";
+                   + optionalString (wakeupUCDefined && !config.wakeupUnusedComponent) "?";
-      in if wakeupDefined && wakeupUCDefined then finalValue else "-";
+      in if wakeupDefined then finalValue else "-";
 
     in [
       config.name

nixos/modules/services/network-filesystems/rsyncd.nix

@@ -8,21 +8,20 @@ let
 
   motdFile = builtins.toFile "rsyncd-motd" cfg.motd;
 
-  moduleConfig = name:
+  foreach = attrs: f:
-    let module = getAttr name cfg.modules; in
+    concatStringsSep "\n" (mapAttrsToList f attrs);
-    "[${name}]\n " + (toString (
-       map
-         (key: "${key} = ${toString (getAttr key module)}\n")
-         (attrNames module)
-    ));
 
-  cfgFile = builtins.toFile "rsyncd.conf"
+  cfgFile = ''
-    ''
     ${optionalString (cfg.motd != "") "motd file = ${motdFile}"}
     ${optionalString (cfg.address != "") "address = ${cfg.address}"}
     ${optionalString (cfg.port != 873) "port = ${toString cfg.port}"}
     ${cfg.extraConfig}
-    ${toString (map moduleConfig (attrNames cfg.modules))}
+    ${foreach cfg.modules (name: module: ''
+      [${name}]
+      ${foreach module (k: v:
+        "${k} = ${v}"
+      )}
+    '')}
   '';
 in
 
@@ -84,6 +83,24 @@ in
           };
       };
 
+      user = mkOption {
+        type = types.str;
+        default = "root";
+        description = ''
+          The user to run the daemon as.
+          By default the daemon runs as root.
+        '';
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "root";
+        description = ''
+          The group to run the daemon as.
+          By default the daemon runs as root.
+        '';
+      };
+
     };
   };
 
@@ -91,16 +108,17 @@ in
 
   config = mkIf cfg.enable {
 
-    environment.etc = singleton {
+    environment.etc."rsyncd.conf".text = cfgFile;
-      source = cfgFile;
-      target = "rsyncd.conf";
-    };
 
     systemd.services.rsyncd = {
       description = "Rsync daemon";
       wantedBy = [ "multi-user.target" ];
-      serviceConfig.ExecStart = "${pkgs.rsync}/bin/rsync --daemon --no-detach";
+      restartTriggers = [ config.environment.etc."rsyncd.conf".source ];
+      serviceConfig = {
+        ExecStart = "${pkgs.rsync}/bin/rsync --daemon --no-detach";
+        User = cfg.user;
+        Group = cfg.group;
+      };
     };
-
   };
 }

nixos/modules/services/networking/dnscrypt-proxy.nix

@@ -82,14 +82,13 @@ in
       };
 
       resolverName = mkOption {
-        default = "dnscrypt.eu-nl";
+        default = "random";
+        example = "dnscrypt.eu-nl";
         type = types.nullOr types.str;
         description = ''
           The name of the DNSCrypt resolver to use, taken from
-          <filename>${resolverList}</filename>.  The default
+          <filename>${resolverList}</filename>.  The default is to
-          resolver is located in Holland, supports DNS security
+          pick a random non-logging resolver that supports DNSSEC.
-          extensions, and <emphasis>claims</emphasis> to not
-          keep logs.
         '';
       };
 

nixos/modules/services/networking/networkmanager.nix

@@ -12,6 +12,7 @@ let
   dns =
     if cfg.useDnsmasq then "dnsmasq"
     else if config.services.resolved.enable then "systemd-resolved"
+    else if config.services.unbound.enable then "unbound"
     else "default";
 
   configFile = writeText "NetworkManager.conf" ''

nixos/modules/services/networking/tinc.nix

@@ -166,12 +166,12 @@ in
         path = [ data.package ];
         serviceConfig = {
           Type = "simple";
-          PIDFile = "/run/tinc.${network}.pid";
           Restart = "always";
           RestartSec = "3";
         };
         preStart = ''
           mkdir -p /etc/tinc/${network}/hosts
+          chown tinc.${network} /etc/tinc/${network}/hosts
 
           # Determine how we should generate our keys
           if type tinc >/dev/null 2>&1; then

nixos/modules/services/networking/wireguard.nix

@@ -79,6 +79,16 @@ let
         description = "A list of commands called after shutting down the interface.";
       };
 
+      table = mkOption {
+        default = "main";
+        type = types.str;
+        description = ''The kernel routing table to add this interface's
+        associated routes to. Setting this is useful for e.g. policy routing
+        ("ip rule") or virtual routing and forwarding ("ip vrf"). Both numeric
+        table IDs and table names (/etc/rt_tables) can be used. Defaults to
+        "main".'';
+      };
+
       peers = mkOption {
         default = [];
         description = "Peers linked to the interface.";
@@ -207,9 +217,11 @@ let
 
             "${ipCommand} link set up dev ${name}"
 
-            (map (peer: (map (ip:
+            (map (peer:
-            "${ipCommand} route replace ${ip} dev ${name}"
+            (map (allowedIP:
-            ) peer.allowedIPs)) values.peers)
+            "${ipCommand} route replace ${allowedIP} dev ${name} table ${values.table}"
+            ) peer.allowedIPs)
+            ) values.peers)
 
             values.postSetup
           ]);

nixos/modules/services/web-apps/piwik-doc.xml

@@ -23,16 +23,24 @@
       and enter those credentials in your browser.
       You can use passwordless database authentication via the UNIX_SOCKET authentication plugin
       with the following SQL commands:
+
       <programlisting>
+        # For MariaDB
         INSTALL PLUGIN unix_socket SONAME 'auth_socket';
-        ALTER USER root IDENTIFIED VIA unix_socket;
         CREATE DATABASE piwik;
-        CREATE USER 'piwik'@'localhost' IDENTIFIED VIA unix_socket;
+        CREATE USER 'piwik'@'localhost' IDENTIFIED WITH unix_socket;
+        GRANT ALL PRIVILEGES ON piwik.* TO 'piwik'@'localhost';
+
+        # For MySQL
+        INSTALL PLUGIN auth_socket SONAME 'auth_socket.so';
+        CREATE DATABASE piwik;
+        CREATE USER 'piwik'@'localhost' IDENTIFIED WITH auth_socket;
         GRANT ALL PRIVILEGES ON piwik.* TO 'piwik'@'localhost';
       </programlisting>
+
       Then fill in <literal>piwik</literal> as database user and database name, and leave the password field blank.
-      This works with MariaDB and MySQL. This authentication works by allowing only the <literal>piwik</literal> unix
+      This authentication works by allowing only the <literal>piwik</literal> unix user to authenticate as the 
-      user to authenticate as <literal>piwik</literal> database (without needing a password), but no other users.
+      <literal>piwik</literal> database user (without needing a password), but no other users.
       For more information on passwordless login, see
       <link xlink:href="https://mariadb.com/kb/en/mariadb/unix_socket-authentication-plugin/" />.
     </para>

nixos/modules/services/web-servers/nginx/default.nix

@@ -130,15 +130,31 @@ let
 
   vhosts = concatStringsSep "\n" (mapAttrsToList (vhostName: vhost:
     let
-        ssl = vhost.enableSSL || vhost.forceSSL;
+        ssl = with vhost; addSSL || onlySSL || enableSSL;
-        defaultPort = if ssl then 443 else 80;
 
-        listenString = { addr, port, ... }:
+        defaultListen = with vhost;
-          "listen ${addr}:${toString (if port != null then port else defaultPort)} "
+          if listen != [] then listen
+          else if onlySSL || enableSSL then
+               singleton                          { addr = "0.0.0.0"; port = 443; ssl = true;  }
+               ++ optional enableIPv6             { addr = "[::]";    port = 443; ssl = true;  }
+          else singleton                          { addr = "0.0.0.0"; port = 80;  ssl = false; }
+               ++ optional enableIPv6             { addr = "[::]";    port = 80;  ssl = false; }
+               ++ optional addSSL                 { addr = "0.0.0.0"; port = 443; ssl = true;  }
+               ++ optional (enableIPv6 && addSSL) { addr = "[::]";    port = 443; ssl = true;  };
+
+        hostListen =
+          if !vhost.forceSSL
+            then defaultListen
+            else filter (x: x.ssl) defaultListen;
+
+        listenString = { addr, port, ssl, ... }:
+          "listen ${addr}:${toString port} "
           + optionalString ssl "ssl http2 "
-          + optionalString vhost.default "default_server"
+          + optionalString vhost.default "default_server "
           + ";";
 
+        redirectListen = filter (x: !x.ssl) defaultListen;
+
         redirectListenString = { addr, ... }:
           "listen ${addr}:80 ${optionalString vhost.default "default_server"};";
 
@@ -159,7 +175,7 @@ let
       in ''
         ${optionalString vhost.forceSSL ''
           server {
-            ${concatMapStringsSep "\n" redirectListenString vhost.listen}
+            ${concatMapStringsSep "\n" redirectListenString redirectListen}
 
             server_name ${vhost.serverName} ${concatStringsSep " " vhost.serverAliases};
             ${optionalString vhost.enableACME acmeLocation}
@@ -170,7 +186,7 @@ let
         ''}
 
         server {
-          ${concatMapStringsSep "\n" listenString vhost.listen}
+          ${concatMapStringsSep "\n" listenString hostListen}
           server_name ${vhost.serverName} ${concatStringsSep " " vhost.serverAliases};
           ${optionalString vhost.enableACME acmeLocation}
           ${optionalString (vhost.root != null) "root ${vhost.root};"}
@@ -425,6 +441,7 @@ in
         example = literalExample ''
           {
             "hydra.example.com" = {
+              addSSL = true;
               forceSSL = true;
               enableACME = true;
               locations."/" = {
@@ -441,11 +458,40 @@ in
   config = mkIf cfg.enable {
     # TODO: test user supplied config file pases syntax test
 
-    assertions = let hostOrAliasIsNull = l: l.root == null || l.alias == null; in [
+    warnings =
+    let
+      deprecatedSSL = name: config: optional config.enableSSL
+      ''
+        config.services.nginx.virtualHosts.<name>.enableSSL is deprecated,
+        use config.services.nginx.virtualHosts.<name>.onlySSL instead.
+      '';
+
+    in flatten (mapAttrsToList deprecatedSSL virtualHosts);
+
+    assertions =
+    let
+      hostOrAliasIsNull = l: l.root == null || l.alias == null;
+    in [
       {
         assertion = all (host: all hostOrAliasIsNull (attrValues host.locations)) (attrValues virtualHosts);
         message = "Only one of nginx root or alias can be specified on a location.";
       }
+
+      {
+        assertion = all (conf: with conf; !(addSSL && (onlySSL || enableSSL))) (attrValues virtualHosts);
+        message = ''
+          Options services.nginx.service.virtualHosts.<name>.addSSL and
+          services.nginx.virtualHosts.<name>.onlySSL are mutually esclusive
+        '';
+      }
+
+      {
+        assertion = all (conf: with conf; forceSSL -> addSSL) (attrValues virtualHosts);
+        message = ''
+          Option services.nginx.virtualHosts.<name>.forceSSL requires
+          services.nginx.virtualHosts.<name>.addSSL set to true.
+        '';
+      }
     ];
 
     systemd.services.nginx = {

nixos/modules/services/web-servers/nginx/vhost-options.nix

@@ -27,25 +27,21 @@ with lib;
     };
 
     listen = mkOption {
-      type = with types; listOf (submodule {
+      type = with types; listOf (submodule { options = {
-        options = {
         addr = mkOption { type = str;  description = "IP address.";  };
-          port = mkOption { type = nullOr int; description = "Port number."; };
+        port = mkOption { type = int;  description = "Port number."; default = 80; };
-        };
+        ssl  = mkOption { type = bool; description = "Enable SSL.";  default = false; };
-      });
+      }; });
-      default =
+      default = [];
-        [ { addr = "0.0.0.0"; port = null; } ]
-        ++ optional config.networking.enableIPv6
-          { addr = "[::]"; port = null; };
       example = [
-        { addr = "195.154.1.1"; port = 443; }
+        { addr = "195.154.1.1"; port = 443; ssl = true;}
-        { addr = "192.168.1.2"; port = 443; }
+        { addr = "192.154.1.1"; port = 80; }
       ];
       description = ''
         Listen addresses and ports for this virtual host.
         IPv6 addresses must be enclosed in square brackets.
-        Setting the port to <literal>null</literal> defaults
+        Note: this option overrides <literal>addSSL</literal>
-        to 80 for http and 443 for https (i.e. when enableSSL is set).
+        and <literal>onlySSL</literal>.
       '';
     };
 
@@ -70,16 +66,39 @@ with lib;
       '';
     };
 
-    enableSSL = mkOption {
+    addSSL = mkOption {
       type = types.bool;
       default = false;
-      description = "Whether to enable SSL (https) support.";
+      description = ''
+        Whether to enable HTTPS in addition to plain HTTP. This will set defaults for
+        <literal>listen</literal> to listen on all interfaces on the respective default
+        ports (80, 443).
+      '';
+    };
+
+    onlySSL = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Whether to enable HTTPS and reject plain HTTP connections. This will set
+        defaults for <literal>listen</literal> to listen on all interfaces on port 443.
+      '';
+    };
+
+    enableSSL = mkOption {
+      type = types.bool;
+      visible = false;
+      default = false;
     };
 
     forceSSL = mkOption {
       type = types.bool;
       default = false;
-      description = "Whether to always redirect to https.";
+      description = ''
+        Whether to add a separate nginx server block that permanently redirects (301)
+        all plain HTTP traffic to HTTPS. This option needs <literal>addSSL</literal>
+        to be set to true.
+      '';
     };
 
     sslCertificate = mkOption {

nixos/modules/services/x11/window-managers/xmonad.nix

@@ -29,6 +29,7 @@ in
 
       extraPackages = mkOption {
         default = self: [];
+        defaultText = "self: []";
         example = literalExample ''
           haskellPackages: [
             haskellPackages.xmonad-contrib

nixos/modules/virtualisation/cloud-image.nix

@@ -0,0 +1,44 @@
+# Usage:
+# $ NIX_PATH=`pwd`:nixos-config=`pwd`/nixpkgs/nixos/modules/virtualisation/cloud-image.nix nix-build '<nixpkgs/nixos>' -A config.system.build.cloudImage
+
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+{
+  system.build.cloudImage = import ../../lib/make-disk-image.nix {
+    inherit pkgs lib config;
+    partitioned = true;
+    diskSize = 1 * 1024;
+    configFile = pkgs.writeText "configuration.nix"
+      ''
+        { config, lib, pkgs, ... }:
+
+        with lib;
+
+        {
+          imports = [ <nixpkgs/nixos/modules/virtualisation/cloud-image.nix> ];
+        }
+      '';
+  };
+
+  imports = [ ../profiles/qemu-guest.nix ];
+
+  fileSystems."/".device = "/dev/disk/by-label/nixos";
+
+  boot = {
+    kernelParams = [ "console=ttyS0" ];
+    loader.grub.device = "/dev/vda";
+    loader.timeout = 0;
+  };
+
+  networking.hostName = mkDefault "";
+
+  services.openssh = {
+    enable = true;
+    permitRootLogin = "without-password";
+    passwordAuthentication = mkDefault false;
+  };
+
+  services.cloud-init.enable = true;
+}

nixos/tests/nginx.nix

@@ -3,7 +3,7 @@
 #      generated virtual hosts config.
 
 import ./make-test.nix ({ pkgs, ...} : {
-  name = "jenkins";
+  name = "nginx";
   meta = with pkgs.stdenv.lib.maintainers; {
     maintainers = [ mbbx6spp ];
   };

pkgs/applications/altcoins/zcash/libsnark/xbyak.nix

@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "1rc2nx8kj2lj13whxb9chhh79f4hmjjj4j1hpqsd0lbdb60jikrn";
   };
 
-  phases = ["unpackPhase" "installPhase"];
+  dontBuild = true;
 
   installPhase = ''
     mkdir -p $out/include

pkgs/applications/audio/cmus/default.nix

@@ -121,6 +121,8 @@ stdenv.mkDerivation rec {
     ++ stdenv.lib.optionals stdenv.isDarwin [ libiconv CoreAudio ]
     ++ concatMap (a: a.deps) opts;
 
+  makeFlags = [ "LD=$(CC)" ];
+
   meta = with stdenv.lib; {
     description = "Small, fast and powerful console music player for Linux and *BSD";
     homepage = https://cmus.github.io/;

pkgs/applications/editors/android-studio/packages.nix

@@ -27,9 +27,9 @@ in rec {
 
   preview = mkStudio rec {
     pname = "android-studio-preview";
-    version = "3.0.0.8"; # This is actually "Android Studio 3.0 Canary 9"
+    version = "3.0.0.9"; # This is actually "Android Studio 3.0 Beta 1"
-    build = "171.4220116";
+    build = "171.4243858";
-    sha256Hash = "02aw1m65wb5cgjq1dxm86c5m6p8b41kgjcgsl5d0h93fb4clf64b";
+    sha256Hash = "137jd4146srjigyzcfds8pf7b185q1qdkb0zp2yqc8g6bv4ccb22";
 
     meta = stable.meta // {
       description = "The Official IDE for Android (preview version)";

pkgs/applications/editors/atom/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "atom-${version}";
-  version = "1.18.0";
+  version = "1.19.0";
 
   src = fetchurl {
     url = "https://github.com/atom/atom/releases/download/v${version}/atom-amd64.deb";
-    sha256 = "07hssch8sfyp5sji91lx4v62m8zmy9j971i968p747dwfp6g0my6";
+    sha256 = "1gdasqpmbyasd05p5920aw6bf8j58crs51gxjslsgbl1azi4yfh2";
     name = "${name}.deb";
   };
 
@@ -33,6 +33,9 @@ stdenv.mkDerivation rec {
       $out/share/atom/resources/app/apm/bin/node
 
     find $out/share/atom -name "*.node" -exec patchelf --set-rpath "${atomEnv.libPath}:$out/share/atom" {} \;
+
+    paxmark m $out/share/atom/atom
+    paxmark m $out/share/atom/resources/app/apm/bin/node
   '';
 
   meta = with stdenv.lib; {

pkgs/applications/editors/emacs-modes/elpa-generated.nix

@@ -752,10 +752,10 @@
       }) {};
     exwm = callPackage ({ elpaBuild, fetchurl, lib, xelb }: elpaBuild {
         pname = "exwm";
-        version = "0.14";
+        version = "0.15";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/exwm-0.14.tar";
+          url = "https://elpa.gnu.org/packages/exwm-0.15.tar";
-          sha256 = "14hjjpbasm84p54fxy73fg7g1fdwqkvisdw8dwwgzkflmd647mkx";
+          sha256 = "1y7nqry9y0a99bsdqkk9f554vczfw4sz6raadw3138835qy697jg";
         };
         packageRequires = [ xelb ];
         meta = {
@@ -1446,10 +1446,10 @@
       }) {};
     org = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
         pname = "org";
-        version = "20170731";
+        version = "20170807";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/org-20170731.tar";
+          url = "https://elpa.gnu.org/packages/org-20170807.tar";
-          sha256 = "1vf91r4ifnjg5r82l5ikq0bwsxd5dsbgywzmwaspm6ckx49nksnl";
+          sha256 = "185pyc0v4vwzvkygqhpld14lk62ygvfb9ycz609n99m0wqlamwz3";
         };
         packageRequires = [];
         meta = {

pkgs/applications/editors/emacs-modes/melpa-stable-generated.nix

@@ -86,12 +86,12 @@
     abyss-theme = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
     melpaBuild {
         pname = "abyss-theme";
-        version = "0.5";
+        version = "0.7";
         src = fetchFromGitHub {
           owner = "mgrbyte";
           repo = "emacs-abyss-theme";
-          rev = "e860499a0b2ae0d6d2a27eab12b67dec896a7afc";
+          rev = "18791c6e8d9cc2b4815c9f08627a2e94fc0eeb14";
-          sha256 = "1yr6cqycd7ljkqzfp4prz9ilcpjq8wxg5yf645m24gy9v4w365ia";
+          sha256 = "07z0djv7h3yrv4iw9n633j6dxzxb4nnzijsqkmz22ik6fbwxg5mh";
         };
         recipeFile = fetchurl {
           url = "https://raw.githubusercontent.com/milkypostman/melpa/f390e5153b6360a27abc74983f5fef11226634f3/recipes/abyss-theme";
@@ -1136,12 +1136,12 @@
     alda-mode = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
     melpaBuild {
         pname = "alda-mode";
-        version = "0.1.0";
+        version = "0.2.0";
         src = fetchFromGitHub {
           owner = "jgkamat";
           repo = "alda-mode";
-          rev = "921b1d39ee1122c0f6935598dc17aaa904e74819";
+          rev = "97c20b1fd9ad3f138e1100e3a837d05108c4c564";
-          sha256 = "01zz3h6q3djqmb3l6s9jld8x1zx2m0x1qskxzywnyfh8hcvbqy6f";
+          sha256 = "1wsvs756cbwbxlaxij352kman7196m39684m6sqnfb685cfrwzdj";
         };
         recipeFile = fetchurl {
           url = "https://raw.githubusercontent.com/milkypostman/melpa/2612c494a2b6bd43ffbbaef88ce9ee6327779158/recipes/alda-mode";
@@ -1981,27 +1981,6 @@
           license = lib.licenses.free;
         };
       }) {};
-    aurora-config-mode = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
-    melpaBuild {
-        pname = "aurora-config-mode";
-        version = "0.0.2";
-        src = fetchFromGitHub {
-          owner = "bdd";
-          repo = "aurora-config-mode.el";
-          rev = "0a7ca7987c3a0824e25470389c7d25c337a81593";
-          sha256 = "0ns1xhpk1awbj3kv946dv11a99p84dhm54vjk72kslxwx42nia28";
-        };
-        recipeFile = fetchurl {
-          url = "https://raw.githubusercontent.com/milkypostman/melpa/7fabdb05de9b8ec18a3a566f99688b50443b6b44/recipes/aurora-config-mode";
-          sha256 = "1hpjwidqmjxanijsc1imc7ww9abbylmkin1p0846fbz1hz3a603c";
-          name = "aurora-config-mode";
-        };
-        packageRequires = [];
-        meta = {
-          homepage = "https://melpa.org/#/aurora-config-mode";
-          license = lib.licenses.free;
-        };
-      }) {};
     auth-password-store = callPackage ({ cl-lib ? null, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild, password-store, seq }:
     melpaBuild {
         pname = "auth-password-store";
@@ -2028,14 +2007,14 @@
         pname = "auto-compile";
         version = "1.4.0";
         src = fetchFromGitHub {
-          owner = "tarsius";
+          owner = "emacscollective";
           repo = "auto-compile";
           rev = "0cbebd8fd22c88a57a834797e4841900ea1bae1c";
           sha256 = "1sngafab6sssidz6w1zsxw8i6k4j13m0073lbmp7gq3ixsqdxbr7";
         };
         recipeFile = fetchurl {
-          url = "https://raw.githubusercontent.com/milkypostman/melpa/e00dcd4f8c59c748cc3c85af1607dd19b85d7813/recipes/auto-compile";
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/57a2fb9524df3fdfdc54c403112e12bd70888b23/recipes/auto-compile";
-          sha256 = "1cdv41hg71mi5ixxi4kiizyg03xai2gyhk0vz7gw59d9a7482yks";
+          sha256 = "08k9wqk4yysps8n5n50v7lpadwsnm553pv9p7m242fwbgbsgz6nf";
           name = "auto-compile";
         };
         packageRequires = [ dash emacs packed ];
@@ -3124,12 +3103,12 @@
     bshell = callPackage ({ buffer-manage, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
     melpaBuild {
         pname = "bshell";
-        version = "0.1";
+        version = "0.2";
         src = fetchFromGitHub {
           owner = "plandes";
           repo = "bshell";
-          rev = "0abd93439895851c1ad3037b0df7443e577ed1ba";
+          rev = "b25907d531d18000f68534d2a97cf4c2ffa38e68";
-          sha256 = "1frs3m44m4jjl3rxkahkyss2gnijpdpsbqvx0vwbl637gcap1slw";
+          sha256 = "04j4gkiqbfmgqs18hwsbwdb3xrzk5laqpdxx6vsj5g3pc9k6d1cv";
         };
         recipeFile = fetchurl {
           url = "https://raw.githubusercontent.com/milkypostman/melpa/cf0ed51304f752af3e1f56caf2856d1521d782a4/recipes/bshell";
@@ -3166,12 +3145,12 @@
     buffer-manage = callPackage ({ choice-program, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
     melpaBuild {
         pname = "buffer-manage";
-        version = "0.1";
+        version = "0.2";
         src = fetchFromGitHub {
           owner = "plandes";
           repo = "buffer-manage";
-          rev = "09c7e652010ce84ea43c0ac20a943e7733bea0af";
+          rev = "1110217973afa1329c47a1f7e6962aad36a90134";
-          sha256 = "0dhqx4zlqznl4kn8cqp2a4a7c8nsw58pxss2852pfaz11pyv22ma";
+          sha256 = "0hb75npk1d9bdqpgdrin8vvfn64arhgq0h69xgvhwcdlm7xjg1bf";
         };
         recipeFile = fetchurl {
           url = "https://raw.githubusercontent.com/milkypostman/melpa/28f8f376df810e6ebebba9fb2c93eabbe3526cc9/recipes/buffer-manage";
@@ -5152,12 +5131,12 @@
     company-math = callPackage ({ company, fetchFromGitHub, fetchurl, lib, math-symbol-lists, melpaBuild }:
     melpaBuild {
         pname = "company-math";
-        version = "1.2";
+        version = "1.3";
         src = fetchFromGitHub {
           owner = "vspinu";
           repo = "company-math";
-          rev = "2cb03c48f44a5b3cbbbbe05e9841b2c61bd8ed81";
+          rev = "7e7f8c71f57b12f9bcbbf01f2bbcc59343ad76d4";
-          sha256 = "1i13w1pziv8c1d9gi6pg50v60z7jyx2grpamrbnazvd6rci88paf";
+          sha256 = "0akqhhjvzsg0lbqx4bbkfkzijidwgi3bb32sxl3yxz7zfm9pbhn2";
         };
         recipeFile = fetchurl {
           url = "https://raw.githubusercontent.com/milkypostman/melpa/fadff01600d57f5b9ea9c0c47ed109e058114998/recipes/company-math";
@@ -6541,17 +6520,19 @@
           license = lib.licenses.free;
         };
       }) {};
-    deft = callPackage ({ fetchgit, fetchurl, lib, melpaBuild }: melpaBuild {
+    deft = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    melpaBuild {
         pname = "deft";
         version = "0.7";
-        src = fetchgit {
+        src = fetchFromGitHub {
-          url = "git://jblevins.org/git/deft.git";
+          owner = "jrblevin";
+          repo = "deft";
           rev = "4001a55cf5f79cdbfa00f1405e8a4645af4acd40";
           sha256 = "157c6ck6gb59i7dikbdnaq7cwlh3nnk0vqgil4v1294s2xbpp46n";
         };
         recipeFile = fetchurl {
-          url = "https://raw.githubusercontent.com/milkypostman/melpa/4327b4dd464ebb00c2acdd496274dedf912cdf92/recipes/deft";
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/1e2a0e4698d4e71ec28656594f6a83504a823490/recipes/deft";
-          sha256 = "1c9kps0lw97nl567ynlzk4w719a86a18q697rcmrbrg5imdx4y5p";
+          sha256 = "0f6z9hsigbwdsmg0abk1ddl9j19d0rpj4gzkl0d5arcpqbla26hp";
           name = "deft";
         };
         packageRequires = [];
@@ -7284,16 +7265,16 @@
     docker-compose-mode = callPackage ({ dash, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild, yaml-mode }:
     melpaBuild {
         pname = "docker-compose-mode";
-        version = "0.2.1";
+        version = "0.2.2";
         src = fetchFromGitHub {
           owner = "meqif";
           repo = "docker-compose-mode";
-          rev = "a38b64aecd037556c91d9aef29f1d04496295f2b";
+          rev = "e4cce60d4e6c6b517cb786c14fbf9ed8a13f530c";
-          sha256 = "140rbh5n1mqckjy652bp7mj08ylk8q1hr3ajl1cpyc00rniqwfds";
+          sha256 = "0fn8b9dmz911sqqlq2f6vd84qg39j2ban3ixh0wblcxbrd5wli2v";
         };
         recipeFile = fetchurl {
-          url = "https://raw.githubusercontent.com/milkypostman/melpa/9d74905aa52aa78bdc8e96aa3b791c3d2a70965f/recipes/docker-compose-mode";
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/37dd4c1fc11d22598c6faf03ccc860503a68b950/recipes/docker-compose-mode";
-          sha256 = "094r2mqxmll5dqbjhhdfg60xs9m74qn22lz475692k48ma5a7gd0";
+          sha256 = "1hldddl86h0i1ysxklkr1kyz44lzic1zr68x3vb0mha4n5d6bl5g";
           name = "docker-compose-mode";
         };
         packageRequires = [ dash emacs yaml-mode ];
@@ -7808,12 +7789,12 @@
     easy-hugo = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
     melpaBuild {
         pname = "easy-hugo";
-        version = "1.5.5";
+        version = "1.5.7";
         src = fetchFromGitHub {
           owner = "masasam";
           repo = "emacs-easy-hugo";
-          rev = "b656f1e3e1eaef01990b6c946a6f522538f76d19";
+          rev = "55bac7a4ede3e14ac38a8dc4249df0a0d3ee6c1c";
-          sha256 = "0bni2j8kcad85h2rgv8nmp5xv2mz32d5nwbmg0v9dy5m12g452md";
+          sha256 = "0j0vi3c6r8jqn4ijmg9xy55yccmjf3mza9ps8iz2s1d8qv8f2y3s";
         };
         recipeFile = fetchurl {
           url = "https://raw.githubusercontent.com/milkypostman/melpa/855ea20024b606314f8590129259747cac0bcc97/recipes/easy-hugo";
@@ -7889,22 +7870,22 @@
           license = lib.licenses.free;
         };
       }) {};
-    ebal = callPackage ({ emacs, f, fetchFromGitHub, fetchurl, ido-completing-read-plus, lib, melpaBuild }:
+    ebal = callPackage ({ emacs, f, fetchFromGitHub, fetchurl, lib, melpaBuild }:
     melpaBuild {
         pname = "ebal";
-        version = "0.2.1";
+        version = "0.3.0";
         src = fetchFromGitHub {
           owner = "mrkkrp";
           repo = "ebal";
-          rev = "2d274ee56d5a61152e846f9a759ebccd70dc8eb1";
+          rev = "7bc6c5a5e504353282848cd2d0f7c73b4bccda83";
-          sha256 = "15hygzw52w5c10hh3gq0hzs499h8zkn1ns80hb2q02cn9hyy962q";
+          sha256 = "06pn4srx00l63lkk6kyd68svlyajxkpxd9mpjlvdpgbydzh914xl";
         };
         recipeFile = fetchurl {
           url = "https://raw.githubusercontent.com/milkypostman/melpa/629aa451162a0085488caad4052a56366b7ce392/recipes/ebal";
           sha256 = "1kqnlp5n1aig1qbqdq9q50wgqkzd1l6h9wi1gv43cif8qa1kxhwg";
           name = "ebal";
         };
-        packageRequires = [ emacs f ido-completing-read-plus ];
+        packageRequires = [ emacs f ];
         meta = {
           homepage = "https://melpa.org/#/ebal";
           license = lib.licenses.free;
@@ -8970,14 +8951,14 @@
         pname = "elx";
         version = "1.1.0";
         src = fetchFromGitHub {
-          owner = "tarsius";
+          owner = "emacscollective";
           repo = "elx";
           rev = "6ce9a2f14ecf7263e71a699e058293f0343bfe4d";
           sha256 = "1i250nv416jmknb39a390bxvdsf0dlgwfjn67n5gn6sia99lgjhq";
         };
         recipeFile = fetchurl {
-          url = "https://raw.githubusercontent.com/milkypostman/melpa/91430562ecea439af020e96405ec3f21d768cf9f/recipes/elx";
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/57a2fb9524df3fdfdc54c403112e12bd70888b23/recipes/elx";
-          sha256 = "02nq66c0sds61k2p8cn2l0p2l8ysb38ibr038qn41l9hg1dq065x";
+          sha256 = "008nwa2gn3d2ayr8023pxyvph52gh9m56f77h41hp8hcw6hbdwrz";
           name = "elx";
         };
         packageRequires = [ emacs ];
@@ -11802,12 +11783,12 @@
     floobits = callPackage ({ fetchFromGitHub, fetchurl, highlight, json ? null, lib, melpaBuild }:
     melpaBuild {
         pname = "floobits";
-        version = "1.9.1";
+        version = "1.9.2";
         src = fetchFromGitHub {
           owner = "Floobits";
           repo = "floobits-emacs";
-          rev = "76c869f439c2d13028d1fe8cae486e0ef018e4b0";
+          rev = "ed5586d1bf94f36354091648e824ccb6fcaf807f";
-          sha256 = "0f0i5zzl8njrwspir1wnfyrv9q8syl2izhyn2j9j9w8wyf5w7l1b";
+          sha256 = "08m9snmkhdjmvw1pqww9l39xqas9f6yxksjxvfjjfnad8ak80x9b";
         };
         recipeFile = fetchurl {
           url = "https://raw.githubusercontent.com/milkypostman/melpa/95c859e8440049579630b4c2bcc31e7eaa13b1f1/recipes/floobits";
@@ -12324,6 +12305,27 @@
           license = lib.licenses.free;
         };
       }) {};
+    flycheck-popup-tip = callPackage ({ emacs, fetchFromGitHub, fetchurl, flycheck, lib, melpaBuild, popup }:
+    melpaBuild {
+        pname = "flycheck-popup-tip";
+        version = "0.12.1";
+        src = fetchFromGitHub {
+          owner = "flycheck";
+          repo = "flycheck-popup-tip";
+          rev = "6a857d43a1fa136e5b6715421d1b44a72170be0c";
+          sha256 = "1hglfhf1vrvrp2vf1p4b226mpab7m2napjw6w0qlw3dj72787pqw";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/9b2269ee9532bb092756ae0c0693cb44b73820e8/recipes/flycheck-popup-tip";
+          sha256 = "1j8pgljnxcbfh08qpbr9jkw56l7d6k8lmdcsjbi6jd7jmyqbqvnx";
+          name = "flycheck-popup-tip";
+        };
+        packageRequires = [ emacs flycheck popup ];
+        meta = {
+          homepage = "https://melpa.org/#/flycheck-popup-tip";
+          license = lib.licenses.free;
+        };
+      }) {};
     flycheck-pos-tip = callPackage ({ emacs, fetchFromGitHub, fetchurl, flycheck, lib, melpaBuild, pos-tip }:
     melpaBuild {
         pname = "flycheck-pos-tip";
@@ -13424,25 +13426,6 @@
           license = lib.licenses.free;
         };
       }) {};
-    fuel = callPackage ({ fetchgit, fetchurl, lib, melpaBuild }: melpaBuild {
-        pname = "fuel";
-        version = "0.96";
-        src = fetchgit {
-          url = "git://factorcode.org/git/factor.git";
-          rev = "905ec06d864537fb6be9c46ad98f1b6d101dfbf0";
-          sha256 = "0ip7azxi5nvp8vvi15ds46mgs0fmi7gq97f2iz1c7m67ml5wi2g7";
-        };
-        recipeFile = fetchurl {
-          url = "https://raw.githubusercontent.com/milkypostman/melpa/0c3633c23baa472560a489fc663a0302f082bcef/recipes/fuel";
-          sha256 = "0m24p2788r4xzm56hm9kmpzcskwh82vgbs3hqfb9xygpl4isp756";
-          name = "fuel";
-        };
-        packageRequires = [];
-        meta = {
-          homepage = "https://melpa.org/#/fuel";
-          license = lib.licenses.free;
-        };
-      }) {};
     full-ack = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
     melpaBuild {
         pname = "full-ack";
@@ -16163,12 +16146,12 @@
     helm-backup = callPackage ({ cl-lib ? null, fetchFromGitHub, fetchurl, helm, lib, melpaBuild, s }:
     melpaBuild {
         pname = "helm-backup";
-        version = "0.2.2";
+        version = "1.0.0";
         src = fetchFromGitHub {
           owner = "antham";
           repo = "helm-backup";
-          rev = "b6f930a370f6339988e79e0c85e9deee98c7b9f4";
+          rev = "3f39d296ddc77df758b812c50e3c267dd03db8bb";
-          sha256 = "0cawlad5jy6kn2mg72ivjg3gs2h6g067h910xlbir01k9wlk3mfg";
+          sha256 = "05528ajhmvkc50i65wcb3bi1w4i3y1vvr56dvq6yp7cbyw9r7b8w";
         };
         recipeFile = fetchurl {
           url = "https://raw.githubusercontent.com/milkypostman/melpa/5e6eba7b201e91211e43c39e501f6066f0afeb8b/recipes/helm-backup";
@@ -18512,22 +18495,22 @@
           license = lib.licenses.free;
         };
       }) {};
-    ido-completing-read-plus = callPackage ({ cl-lib ? null, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    ido-completing-read-plus = callPackage ({ cl-lib ? null, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild, s }:
     melpaBuild {
         pname = "ido-completing-read-plus";
-        version = "3.16";
+        version = "4.3";
         src = fetchFromGitHub {
           owner = "DarwinAwardWinner";
-          repo = "ido-ubiquitous";
+          repo = "ido-completing-read-plus";
-          rev = "2bd3a2722d8df0db9dfe25f5763f7dfaf0734624";
+          rev = "1a1f695eb8e7d4ae2035e506ea3ff5bd4e2d0533";
-          sha256 = "1zz0k5ddcwkg0wjdzihklgnxq5f6rlsxldhn7h9jzyss5bsgykhj";
+          sha256 = "15m8x3dp9m0brpap4l9hsbc47s4fgax3lppxz5v6rcwm625s0ac9";
         };
         recipeFile = fetchurl {
-          url = "https://raw.githubusercontent.com/milkypostman/melpa/4a227a6d44f1981e8a3f73b253d2c33eb18ef72f/recipes/ido-completing-read+";
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/6104efc035bcf469d133ab9a2caf42c9d4482334/recipes/ido-completing-read+";
-          sha256 = "034j1q47d57ia5bwbf1w66gw6c7aqbhscpy3dg2a71lwjzfmshwh";
+          sha256 = "0rxdv3cd0bg0p8c1bck5vichdq941dki934k23qf5p6cfgw8gw4z";
           name = "ido-completing-read-plus";
         };
-        packageRequires = [ cl-lib emacs ];
+        packageRequires = [ cl-lib emacs s ];
         meta = {
           homepage = "https://melpa.org/#/ido-completing-read+";
           license = lib.licenses.free;
@@ -18620,16 +18603,16 @@
     ido-ubiquitous = callPackage ({ cl-lib ? null, emacs, fetchFromGitHub, fetchurl, ido-completing-read-plus, lib, melpaBuild }:
     melpaBuild {
         pname = "ido-ubiquitous";
-        version = "3.16";
+        version = "4.3";
         src = fetchFromGitHub {
           owner = "DarwinAwardWinner";
-          repo = "ido-ubiquitous";
+          repo = "ido-completing-read-plus";
-          rev = "2bd3a2722d8df0db9dfe25f5763f7dfaf0734624";
+          rev = "1a1f695eb8e7d4ae2035e506ea3ff5bd4e2d0533";
-          sha256 = "1zz0k5ddcwkg0wjdzihklgnxq5f6rlsxldhn7h9jzyss5bsgykhj";
+          sha256 = "15m8x3dp9m0brpap4l9hsbc47s4fgax3lppxz5v6rcwm625s0ac9";
         };
         recipeFile = fetchurl {
-          url = "https://raw.githubusercontent.com/milkypostman/melpa/4a227a6d44f1981e8a3f73b253d2c33eb18ef72f/recipes/ido-ubiquitous";
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/6104efc035bcf469d133ab9a2caf42c9d4482334/recipes/ido-ubiquitous";
-          sha256 = "143pzpix9aqpzjy8akrxfsxmwlzc9bmaqzp9fyhjgzrhq7zchjsp";
+          sha256 = "11sdk0ymsqnsw1gycvq2wj4j0g502fp23qk6q9d95lm98nz68frz";
           name = "ido-ubiquitous";
         };
         packageRequires = [ cl-lib emacs ido-completing-read-plus ];
@@ -18872,12 +18855,12 @@
     imenu-anywhere = callPackage ({ cl-lib ? null, fetchFromGitHub, fetchurl, lib, melpaBuild }:
     melpaBuild {
         pname = "imenu-anywhere";
-        version = "1.1.3";
+        version = "1.1.4";
         src = fetchFromGitHub {
           owner = "vspinu";
           repo = "imenu-anywhere";
-          rev = "94bab9136e1264e98a10d9325ad53d735307f8f3";
+          rev = "fc7f0fd2f19e5ebee70156a99bf87393123893e3";
-          sha256 = "1ffdh0izdd22av85rizk38fidfp8f6lk6phr549fzaspn11hvd8j";
+          sha256 = "0g2gb7jrys81kphmhlvhvzwl8l75j36y6pqjawh9wmzzwad876q5";
         };
         recipeFile = fetchurl {
           url = "https://raw.githubusercontent.com/milkypostman/melpa/7fabdb05de9b8ec18a3a566f99688b50443b6b44/recipes/imenu-anywhere";
@@ -19040,12 +19023,12 @@
     importmagic = callPackage ({ emacs, epc, f, fetchFromGitHub, fetchurl, lib, melpaBuild }:
     melpaBuild {
         pname = "importmagic";
-        version = "1.0";
+        version = "1.1";
         src = fetchFromGitHub {
           owner = "anachronic";
           repo = "importmagic.el";
-          rev = "135e049d763ceb4cabd0bab068c4c71452459065";
+          rev = "c0360a8146ca65565a7fa66c6d72986edd916dd5";
-          sha256 = "1fzd3m0zwgyh3qmkhzcvgsgbnjv8nzy30brsbsa081djj5d2dagq";
+          sha256 = "0s6hp62kmhvmgj3m5jr3cfqc8yv3p8jfxk0piq8xbf2chr1hp6l5";
         };
         recipeFile = fetchurl {
           url = "https://raw.githubusercontent.com/milkypostman/melpa/855ea20024b606314f8590129259747cac0bcc97/recipes/importmagic";
@@ -20675,12 +20658,12 @@
     kill-or-bury-alive = callPackage ({ cl-lib ? null, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
     melpaBuild {
         pname = "kill-or-bury-alive";
-        version = "0.1.2";
+        version = "0.1.3";
         src = fetchFromGitHub {
           owner = "mrkkrp";
           repo = "kill-or-bury-alive";
-          rev = "b488c3dbba657bbd524402f48fde16ab6b1211db";
+          rev = "51daf55565034b8cb6aa3ca2aa0a827e31751041";
-          sha256 = "1c5al7cyfnb0p5ya2aa5afadzbrrc079jx3r6zpkr64psskrhdv5";
+          sha256 = "1qbdxjni1brhsw6m4cvd2jjaf3y8v3fkbxxf0pvsb089mkpi7mpq";
         };
         recipeFile = fetchurl {
           url = "https://raw.githubusercontent.com/milkypostman/melpa/25016ed09b6333bd79b989a8f6b7b03cd92e08b3/recipes/kill-or-bury-alive";
@@ -21459,11 +21442,11 @@
     lms = callPackage ({ emacs, fetchhg, fetchurl, lib, melpaBuild }:
     melpaBuild {
         pname = "lms";
-        version = "0.6";
+        version = "0.7";
         src = fetchhg {
           url = "https://bitbucket.com/inigoserna/lms.el";
-          rev = "5f20620f62a1";
+          rev = "f07ac3678e27";
-          sha256 = "04wi14x2y2cb8ps3nzq4g0ryvqm40jh727jm44knlqfrx15imkw9";
+          sha256 = "15l3nfrddblfzqxgvf0dmmsk4h5l80l6r2kgxcfk8s01msjka3sl";
         };
         recipeFile = fetchurl {
           url = "https://raw.githubusercontent.com/milkypostman/melpa/b8be8497494b8543a8257c9ea92444baf7674951/recipes/lms";
@@ -21692,13 +21675,13 @@
         version = "2.1";
         src = fetchFromGitHub {
           owner = "DarwinAwardWinner";
-          repo = "osx-pseudo-daemon";
+          repo = "mac-pseudo-daemon";
           rev = "4d10e327cd8ee5bb7f006d68744be21c7097c1fc";
           sha256 = "0rjdjddlkaps9cfyc23kcr3cdh08c12jfgkz7ca2j141mm89pyp2";
         };
         recipeFile = fetchurl {
-          url = "https://raw.githubusercontent.com/milkypostman/melpa/e89752e595c7cec9488e755c30af18f5f6fc1698/recipes/mac-pseudo-daemon";
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/6104efc035bcf469d133ab9a2caf42c9d4482334/recipes/mac-pseudo-daemon";
-          sha256 = "1kf677j6n7ykw8v5xsvbnnhm3hgjicl8fnf6yz9qw4whd0snrhn6";
+          sha256 = "12fwrcnwzsfms42rzv4wif5yzx3gnsz8yzdcgkpl37kkx85iy8v0";
           name = "mac-pseudo-daemon";
         };
         packageRequires = [ cl-lib ];
@@ -21924,6 +21907,27 @@
           license = lib.licenses.free;
         };
       }) {};
+    magit-imerge = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, magit, melpaBuild }:
+    melpaBuild {
+        pname = "magit-imerge";
+        version = "0.2.0";
+        src = fetchFromGitHub {
+          owner = "magit";
+          repo = "magit-imerge";
+          rev = "1cd0fa843095f4ce8aa4eae89476c116414d060c";
+          sha256 = "1h9m0miiv44az4bigg5gjgkpdgdy4hh114kavzjgjhmw5zsg6qfg";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/e78a5c27eedfc9b1d79e37e8d333c5d253f31a3c/recipes/magit-imerge";
+          sha256 = "0rycmbsi2s7rjqfpcv794vhkybav7d8ikzdaxai36szxpg9pzhj4";
+          name = "magit-imerge";
+        };
+        packageRequires = [ emacs magit ];
+        meta = {
+          homepage = "https://melpa.org/#/magit-imerge";
+          license = lib.licenses.free;
+        };
+      }) {};
     magit-popup = callPackage ({ async, dash, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
     melpaBuild {
         pname = "magit-popup";
@@ -22050,22 +22054,22 @@
           license = lib.licenses.free;
         };
       }) {};
-    magithub = callPackage ({ emacs, fetchFromGitHub, fetchurl, git-commit, lib, magit, melpaBuild, s, with-editor }:
+    magithub = callPackage ({ emacs, fetchFromGitHub, fetchurl, ghub-plus, lib, magit, melpaBuild, s }:
     melpaBuild {
         pname = "magithub";
-        version = "0.1.2";
+        version = "0.1.3";
         src = fetchFromGitHub {
           owner = "vermiculus";
           repo = "magithub";
-          rev = "283bde94b3fe5cd8f4634887812c58eaf55aef60";
+          rev = "959e7b259697c79ccf46b95827575d3e15e83d30";
-          sha256 = "0nd9q3x60pydigyrp7b00xgnw7pgb0plh6mry7pj1532z3xxz1d7";
+          sha256 = "19m7qmp5pi5l3mak1j475qxgnpr4kc4dm7qj80qc4m844bkacc4h";
         };
         recipeFile = fetchurl {
           url = "https://raw.githubusercontent.com/milkypostman/melpa/855ea20024b606314f8590129259747cac0bcc97/recipes/magithub";
           sha256 = "11par5rncsa866gazdw98d4902rvyjnnwbiwpndlyh06ak0lryab";
           name = "magithub";
         };
-        packageRequires = [ emacs git-commit magit s with-editor ];
+        packageRequires = [ emacs ghub-plus magit s ];
         meta = {
           homepage = "https://melpa.org/#/magithub";
           license = lib.licenses.free;
@@ -22669,12 +22673,12 @@
     merlin = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
     melpaBuild {
         pname = "merlin";
-        version = "3.0.1";
+        version = "3.0.2";
         src = fetchFromGitHub {
           owner = "the-lambda-church";
           repo = "merlin";
-          rev = "803dfd048c97f9fc16148d6b8ca116a281e8b537";
+          rev = "b53e4beeeb8da6d7cb035990a7e805fea5da0de6";
-          sha256 = "10ba2zrivllzp5rl77hsd06pgw7s42s7hsvfdvx01482xf22b7lb";
+          sha256 = "1lw0s78zwr8rd4q4pg34m9q8yd5swh1fff3c5p992a2qlzfb0hax";
         };
         recipeFile = fetchurl {
           url = "https://raw.githubusercontent.com/milkypostman/melpa/b1b9bfd3164e62758dc0a3362d85c6627ed7cbf8/recipes/merlin";
@@ -24119,14 +24123,14 @@
         pname = "no-littering";
         version = "0.5.9";
         src = fetchFromGitHub {
-          owner = "tarsius";
+          owner = "emacscollective";
           repo = "no-littering";
           rev = "8b689a1e16d4825d0221f4a41756b63bbc361c82";
           sha256 = "02cb5m1r5k1f6il79yv8fa5yiyz2m37awlbjjxmkv1av06kl0abn";
         };
         recipeFile = fetchurl {
-          url = "https://raw.githubusercontent.com/milkypostman/melpa/cf5d2152c91b7c5c38181b551db3287981657ce3/recipes/no-littering";
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/57a2fb9524df3fdfdc54c403112e12bd70888b23/recipes/no-littering";
-          sha256 = "129nyml8jx3nwdskcr2favbi3x6f74dblc6yw8vijw32w8z14k2l";
+          sha256 = "15w784ir48v8biiaar8ip19s9y3wn5831m815kcw02mgzy3bfjmh";
           name = "no-littering";
         };
         packageRequires = [ cl-lib ];
@@ -24638,12 +24642,12 @@
     obfusurl = callPackage ({ cl-lib ? null, fetchFromGitHub, fetchurl, lib, melpaBuild }:
     melpaBuild {
         pname = "obfusurl";
-        version = "2.0";
+        version = "2.1";
         src = fetchFromGitHub {
           owner = "davep";
           repo = "obfusurl.el";
-          rev = "fb7524fe8432bf58f0c4f637e5a12565ae81134e";
+          rev = "7a5a41905000ce2ec1fd72509a5567e5fd9f47e5";
-          sha256 = "15w8cnwl4hpcslfbmb3j81gbr2dvp0xra2z841503b26s5w91961";
+          sha256 = "0jbrxlpx0cxg8jzqrssk3y3ab7v62ymi6ys24542a8vpk522vqxk";
         };
         recipeFile = fetchurl {
           url = "https://raw.githubusercontent.com/milkypostman/melpa/201fe11682cb06b26775a52c81b6a1258b74b4d0/recipes/obfusurl";
@@ -24680,12 +24684,12 @@
     ocp-indent = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
     melpaBuild {
         pname = "ocp-indent";
-        version = "1.6.0";
+        version = "1.6.1";
         src = fetchFromGitHub {
           owner = "OCamlPro";
           repo = "ocp-indent";
-          rev = "032599b162624a4b65c82c20be06433f24b00e8f";
+          rev = "5d83bc71d12c89850cb0fdff50d4830adb705b6c";
-          sha256 = "1h9y597s3ag8w1z32zzv4dfk3ppq557s55bnlfw5a5wqwvia911f";
+          sha256 = "0rcaa11mjqka032g94wgw9llqpflyk3ywr3lr6jyxbh1rjvnipnw";
         };
         recipeFile = fetchurl {
           url = "https://raw.githubusercontent.com/milkypostman/melpa/e1af061328b15360ed25a232cc6b8fbce4a7b098/recipes/ocp-indent";
@@ -24743,12 +24747,12 @@
     olivetti = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
     melpaBuild {
         pname = "olivetti";
-        version = "1.5.6";
+        version = "1.5.7";
         src = fetchFromGitHub {
           owner = "rnkn";
           repo = "olivetti";
-          rev = "de2716cfb1f4dc82a08093cdd00200e9bb1f07ef";
+          rev = "e5153850ab626699109d93ab0afb6e3aea48f8b8";
-          sha256 = "0gfjrfhmjvq2zkyp0bgxymdv6r7p4x40aicvv1r61z29nz4dbyn2";
+          sha256 = "1bg1j8wi8smsbf4qmpcy3j3ihkg3gpnxa5bqgysbj7j9n11rjgl4";
         };
         recipeFile = fetchurl {
           url = "https://raw.githubusercontent.com/milkypostman/melpa/697334ca3cdb9630572ae267811bd5c2a67d2a95/recipes/olivetti";
@@ -24873,8 +24877,8 @@
         src = fetchFromGitHub {
           owner = "OmniSharp";
           repo = "omnisharp-emacs";
-          rev = "ad147956b936fd528d26ca88158a8af96ff5827a";
+          rev = "bf0edf7c74ddcd9976753543481a61a5607eec4e";
-          sha256 = "04vkhdp3kxba1h5mjd9jblhapb5h2x709ldz4pc078qgyh5g1kpm";
+          sha256 = "1x7bvpy2lx51j58grbc45l99mzf55wlx657icc7q5rf2vgb56k01";
         };
         recipeFile = fetchurl {
           url = "https://raw.githubusercontent.com/milkypostman/melpa/e327c483be04de32638b420c5b4e043d12a2cd01/recipes/omnisharp";
@@ -26299,13 +26303,13 @@
         version = "2.1";
         src = fetchFromGitHub {
           owner = "DarwinAwardWinner";
-          repo = "osx-pseudo-daemon";
+          repo = "mac-pseudo-daemon";
           rev = "4d10e327cd8ee5bb7f006d68744be21c7097c1fc";
           sha256 = "0rjdjddlkaps9cfyc23kcr3cdh08c12jfgkz7ca2j141mm89pyp2";
         };
         recipeFile = fetchurl {
-          url = "https://raw.githubusercontent.com/milkypostman/melpa/e89752e595c7cec9488e755c30af18f5f6fc1698/recipes/osx-pseudo-daemon";
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/6104efc035bcf469d133ab9a2caf42c9d4482334/recipes/osx-pseudo-daemon";
-          sha256 = "013h2n27r4rvj8ych5cglj8qprkdxmmmsfi51fggqqvmv7qmr2hw";
+          sha256 = "1sch7bb8hl96fji2ayw2ah5cjgsga08wj44vddjxskyway8ykf0z";
           name = "osx-pseudo-daemon";
         };
         packageRequires = [];
@@ -26655,14 +26659,14 @@
         pname = "packed";
         version = "2.0.1";
         src = fetchFromGitHub {
-          owner = "tarsius";
+          owner = "emacscollective";
           repo = "packed";
           rev = "536f4a3bda06cc09759fed1aa0cdebb068ff75a1";
           sha256 = "1ayizqkhxjd3rv3chnl51sl12gsfhxcqqnz0p6r0xbwglx4n3vzi";
         };
         recipeFile = fetchurl {
-          url = "https://raw.githubusercontent.com/milkypostman/melpa/1ee9e95c00f791010f77720068a7f3cd76133a1c/recipes/packed";
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/57a2fb9524df3fdfdc54c403112e12bd70888b23/recipes/packed";
-          sha256 = "0sw7d2l17bq471i4isrf2xf0z85nqqiciw25whw0c0chdzwzai6z";
+          sha256 = "103z6fas2fkvlhvwbv1rl6jcij5pfsv5vlqqsb4dkq1b0s7k11jd";
           name = "packed";
         };
         packageRequires = [ dash emacs ];
@@ -27277,6 +27281,26 @@
           license = lib.licenses.free;
         };
       }) {};
+    pelican-mode = callPackage ({ emacs, fetchgit, fetchurl, lib, melpaBuild }:
+    melpaBuild {
+        pname = "pelican-mode";
+        version = "20170808";
+        src = fetchgit {
+          url = "https://git.korewanetadesu.com/pelican-mode.git";
+          rev = "8b13c30c4ec38dd535eadf26e463f8616d5c089c";
+          sha256 = "0rghcyp09ga95ag0pjbk4hdxxlsnr93dr6706z0xvfgmninbn5aw";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/aede5994c2e76c7fd860661c1e3252fb741f9228/recipes/pelican-mode";
+          sha256 = "0z6w5j3qwb58pndqbmpsvy1l77w9jv90bss9qq9hicil8nlk4pvi";
+          name = "pelican-mode";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://melpa.org/#/pelican-mode";
+          license = lib.licenses.free;
+        };
+      }) {};
     per-buffer-theme = callPackage ({ cl-lib ? null, fetchhg, fetchurl, lib, melpaBuild }:
     melpaBuild {
         pname = "per-buffer-theme";
@@ -28599,12 +28623,12 @@
     protobuf-mode = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
     melpaBuild {
         pname = "protobuf-mode";
-        version = "3.3.2";
+        version = "3.4.0pre1";
         src = fetchFromGitHub {
           owner = "google";
           repo = "protobuf";
-          rev = "5532abc15b97f3489183b266b41844306052a3fa";
+          rev = "3afcded28a6aa9c44adf801ca5bff2133fcf3030";
-          sha256 = "1a2s66i3ampwa0yc2mj3b743hcryixqhk1vvskzgyzvglv048cn4";
+          sha256 = "03m1fprfz6cwxijp5fls502g6g3svyz760bwwwnbvyx4carwzmsp";
         };
         recipeFile = fetchurl {
           url = "https://raw.githubusercontent.com/milkypostman/melpa/b4e7f5f641251e17add561991d3bcf1fde23467b/recipes/protobuf-mode";
@@ -29583,6 +29607,27 @@
           license = lib.licenses.free;
         };
       }) {};
+    react-snippets = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild, yasnippet }:
+    melpaBuild {
+        pname = "react-snippets";
+        version = "0.1";
+        src = fetchFromGitHub {
+          owner = "johnmastro";
+          repo = "react-snippets.el";
+          rev = "bfc4b68b81374a6a080240592641091a7e8a6d61";
+          sha256 = "1wna4v8l3j0ppjv4nj72lhp0yh6vbka6bvl1paqqfvay300kiqjb";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/3720192fdfa45f9b83259ab39356f469c5ac85b4/recipes/react-snippets";
+          sha256 = "0chs0h41nb2fdz02hdsaynz7ma8fg66a8m1q1np0464skrsdaj73";
+          name = "react-snippets";
+        };
+        packageRequires = [ yasnippet ];
+        meta = {
+          homepage = "https://melpa.org/#/react-snippets";
+          license = lib.licenses.free;
+        };
+      }) {};
     real-auto-save = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
     melpaBuild {
         pname = "real-auto-save";
@@ -30237,12 +30282,12 @@
     rjsx-mode = callPackage ({ emacs, fetchFromGitHub, fetchurl, js2-mode, lib, melpaBuild }:
     melpaBuild {
         pname = "rjsx-mode";
-        version = "0.1.4";
+        version = "0.2.0";
         src = fetchFromGitHub {
           owner = "felipeochoa";
           repo = "rjsx-mode";
-          rev = "b41de6c1b2f6668b674f8e5bf880f697c9ffb749";
+          rev = "4a24c86a1873289538134fe431e544fa3e12e788";
-          sha256 = "1irc26kg5f22x3g48pmb1mwchivwyn41khphpgwqfjnvasz1idw9";
+          sha256 = "0yv622nnbcjnnaki49f7cz8cvrg13d0h9higadp83bl1lczhgw8j";
         };
         recipeFile = fetchurl {
           url = "https://raw.githubusercontent.com/milkypostman/melpa/b83be7efdef2457e1320fe3dec46484fbd20263c/recipes/rjsx-mode";
@@ -30447,12 +30492,12 @@
     ruby-electric = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
     melpaBuild {
         pname = "ruby-electric";
-        version = "2.2.3";
+        version = "2.3.0";
         src = fetchFromGitHub {
           owner = "knu";
           repo = "ruby-electric.el";
-          rev = "dfb4b448a63ae749c74edf6415ad569d52cab904";
+          rev = "d04313dbee42c0d1009558a7c9424e4ae8611908";
-          sha256 = "0z3whvjmxbyk7lrxl3z2lj1skacwd050b5jvpnw6gcdm2hr8mfbs";
+          sha256 = "03g6m2xjfjjm06v5gid1vxivzb6lnsdc65d1p2wjaz32j1rmb6gm";
         };
         recipeFile = fetchurl {
           url = "https://raw.githubusercontent.com/milkypostman/melpa/5fd5fa797a813e02a6433ecbe2bca1270a383753/recipes/ruby-electric";
@@ -30871,8 +30916,8 @@
         src = fetchFromGitHub {
           owner = "ensime";
           repo = "emacs-scala-mode";
-          rev = "6f49104c182ec1cc8b30314dc92d02f4752106cf";
+          rev = "56cba2903cf6e12c715dbb5c99b34c97b2679379";
-          sha256 = "0ahhhsg095rixiy9j49854mmrkd92vvmqnms0f6msrl4jgdf6vpw";
+          sha256 = "13miqdn426cw9y1wqaz5smmf0wi3bzls95z6shcxzdz8cg50zmpg";
         };
         recipeFile = fetchurl {
           url = "https://raw.githubusercontent.com/milkypostman/melpa/564aa1637485192a97803af46b3a1f8e0d042c9a/recipes/scala-mode";
@@ -30991,12 +31036,12 @@
     sekka = callPackage ({ cl-lib ? null, concurrent, fetchFromGitHub, fetchurl, lib, melpaBuild, popup }:
     melpaBuild {
         pname = "sekka";
-        version = "1.7.1";
+        version = "1.8.0";
         src = fetchFromGitHub {
           owner = "kiyoka";
           repo = "sekka";
-          rev = "b9b2ba5aca378ad12cb9e0f0ac537d695bd39937";
+          rev = "d1fd5d47aacba723631d5d374169a45ff2051c41";
-          sha256 = "1karh4pa190xmjbw1ai2f594i8nf9qa0lxybn3syif7r50ciym3c";
+          sha256 = "035rx863cj3hs1lhayff0810cpp6kv8nwc1c0y54gvdk1bb333x0";
         };
         recipeFile = fetchurl {
           url = "https://raw.githubusercontent.com/milkypostman/melpa/350bbb5761b5ba69aeb4acf6d7cdf2256dba95a6/recipes/sekka";
@@ -31558,12 +31603,12 @@
     shx = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
     melpaBuild {
         pname = "shx";
-        version = "0.0.8";
+        version = "0.0.9";
         src = fetchFromGitHub {
           owner = "riscy";
           repo = "shx-for-emacs";
-          rev = "fc98dd68f1562cf9c10a0245274c24f280f59da2";
+          rev = "8166b02ebbab43d8a33d47b8221a94b69fc63487";
-          sha256 = "16d2l0vfrsv878w908mfi0m0raab96zxi4559a1589y7lzah2nrd";
+          sha256 = "0n97iys2xyg1lzkn8bqsx0sgqpzci1pxg69v42cpzmyrz3h54bwp";
         };
         recipeFile = fetchurl {
           url = "https://raw.githubusercontent.com/milkypostman/melpa/7a2ff78ae3c4289ebf9e06cdfd8f8082c395a16f/recipes/shx";
@@ -31663,12 +31708,12 @@
     simpleclip = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
     melpaBuild {
         pname = "simpleclip";
-        version = "1.0.2";
+        version = "1.0.4";
         src = fetchFromGitHub {
           owner = "rolandwalker";
           repo = "simpleclip";
-          rev = "7deff873b79910496b4baf647cdb8dd5de63465a";
+          rev = "d461c462c237cd896553adb468cd77499d0d26ad";
-          sha256 = "12f853vm18y22sd22wmwqyzp5f5vmb67i33iiaw6mqqcp6qwbyqz";
+          sha256 = "1dfa1sa7rbadj36nbzyxbpbvkdlh1s5n0mx6hxn52psqin1ra6yn";
         };
         recipeFile = fetchurl {
           url = "https://raw.githubusercontent.com/milkypostman/melpa/7c921e27d6aafc1b82d37f6beb8407840034377a/recipes/simpleclip";
@@ -33256,12 +33301,12 @@
     suggest = callPackage ({ dash, emacs, f, fetchFromGitHub, fetchurl, lib, loop, melpaBuild, s }:
     melpaBuild {
         pname = "suggest";
-        version = "0.3";
+        version = "0.4";
         src = fetchFromGitHub {
           owner = "Wilfred";
           repo = "suggest.el";
-          rev = "26e8b0615def4f0531682b8a849f55d330616ac1";
+          rev = "5cb70e500df430cb9ffc8ae0ab67976c1d7d226f";
-          sha256 = "0ql9ab6wnpww033jnfa3iwvz73h4szbwyfjvfavjlllzwk0f38np";
+          sha256 = "1001z5zaj4ln05js08cz13lgc11dqxc6sgp1s35g19sfhip4xyim";
         };
         recipeFile = fetchurl {
           url = "https://raw.githubusercontent.com/milkypostman/melpa/b9fd27e812549587dc2ec26bb58974177ff263ff/recipes/suggest";
@@ -34514,12 +34559,12 @@
     transmission = callPackage ({ emacs, fetchFromGitHub, fetchurl, let-alist, lib, melpaBuild }:
     melpaBuild {
         pname = "transmission";
-        version = "0.10";
+        version = "0.11";
         src = fetchFromGitHub {
           owner = "holomorph";
           repo = "transmission";
-          rev = "fc0af768454f7964ba0c8b6934fc0cae24b8ebe8";
+          rev = "541f73c779e72eb6ebcc6814a75771e91679875a";
-          sha256 = "05zrdgv0b7a3y89phg66y8cfpmshm34yg7ahhc861k6wh4kvkv89";
+          sha256 = "1rjxn5pfryxbxsgfmmzidcs83azvzvzq0nnphbxmlxybp97wzimx";
         };
         recipeFile = fetchurl {
           url = "https://raw.githubusercontent.com/milkypostman/melpa/9ed7e414687c0bd82b140a1bd8044084d094d18f/recipes/transmission";
@@ -34556,12 +34601,12 @@
     treemacs = callPackage ({ ace-window, cl-lib ? null, dash, emacs, f, fetchFromGitHub, fetchurl, lib, melpaBuild, pfuture, s }:
     melpaBuild {
         pname = "treemacs";
-        version = "1.8";
+        version = "1.8.5";
         src = fetchFromGitHub {
           owner = "Alexander-Miller";
           repo = "treemacs";
-          rev = "56007723b5eeb2d01be80e4b9df471747bb0b7f4";
+          rev = "79ddef38dc06d7e22717326968d7cad403ffd8f4";
-          sha256 = "00fq88wgbj9lji4pjc2bk34d584kiirh03ydiwz8pc2f2smv61pk";
+          sha256 = "1ymddfbcpqs8ny83651jaclb0khzkk2w9djfn97lmhfyy9wx7zf1";
         };
         recipeFile = fetchurl {
           url = "https://raw.githubusercontent.com/milkypostman/melpa/a52c2770097fe8968bff7c31ac411b3d9b60972e/recipes/treemacs";
@@ -34577,12 +34622,12 @@
     treemacs-evil = callPackage ({ evil, fetchFromGitHub, fetchurl, lib, melpaBuild, treemacs }:
     melpaBuild {
         pname = "treemacs-evil";
-        version = "1.8";
+        version = "1.8.5";
         src = fetchFromGitHub {
           owner = "Alexander-Miller";
           repo = "treemacs";
-          rev = "56007723b5eeb2d01be80e4b9df471747bb0b7f4";
+          rev = "79ddef38dc06d7e22717326968d7cad403ffd8f4";
-          sha256 = "00fq88wgbj9lji4pjc2bk34d584kiirh03ydiwz8pc2f2smv61pk";
+          sha256 = "1ymddfbcpqs8ny83651jaclb0khzkk2w9djfn97lmhfyy9wx7zf1";
         };
         recipeFile = fetchurl {
           url = "https://raw.githubusercontent.com/milkypostman/melpa/a52c2770097fe8968bff7c31ac411b3d9b60972e/recipes/treemacs-evil";
@@ -35315,6 +35360,27 @@
           license = lib.licenses.free;
         };
       }) {};
+    vc-msg = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild, popup }:
+    melpaBuild {
+        pname = "vc-msg";
+        version = "0.0.4";
+        src = fetchFromGitHub {
+          owner = "redguardtoo";
+          repo = "vc-msg";
+          rev = "091f3cf15ecb35bb4dc5de1ef7229f78735d9aee";
+          sha256 = "0s129fzxhrr8pp4h0hkmxapnman67r0bdmbj8ys6r361na7h16hf";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/59ad4e80b49c78decd7b5794565313f65550384e/recipes/vc-msg";
+          sha256 = "16pgx8pg3djhkmhf1fihgjk7c6nb2nsqj58888bwg7385mlwc7g9";
+          name = "vc-msg";
+        };
+        packageRequires = [ emacs popup ];
+        meta = {
+          homepage = "https://melpa.org/#/vc-msg";
+          license = lib.licenses.free;
+        };
+      }) {};
     vcomp = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
     melpaBuild {
         pname = "vcomp";
@@ -36451,12 +36517,12 @@
     with-simulated-input = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild, s, seq }:
     melpaBuild {
         pname = "with-simulated-input";
-        version = "2.0";
+        version = "2.2";
         src = fetchFromGitHub {
           owner = "DarwinAwardWinner";
           repo = "with-simulated-input";
-          rev = "568bfb8e1d59a19cb309fd72a7ab0e9e51229e31";
+          rev = "9efeb236c8f6887a8591d6241962c37266d8e726";
-          sha256 = "1aa8ya5yzsijra7cf9rm80ffddv520kzm9rggw3nr3dj2sk03p8c";
+          sha256 = "1v8c85ahsk9pz3zndh0c9xba4c78f4b1j97hbv62jirvr75b079g";
         };
         recipeFile = fetchurl {
           url = "https://raw.githubusercontent.com/milkypostman/melpa/e4ddf16e19f5018106a423327ddc7e7499cf9248/recipes/with-simulated-input";
@@ -36532,6 +36598,27 @@
           license = lib.licenses.free;
         };
       }) {};
+    wordgen = callPackage ({ cl-lib ? null, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    melpaBuild {
+        pname = "wordgen";
+        version = "0.1.4";
+        src = fetchFromGitHub {
+          owner = "Fanael";
+          repo = "wordgen.el";
+          rev = "aacad928ae99a953e034a831dfd0ebdf7d52ac1d";
+          sha256 = "06vbc9ycz1nbjwjkg99y3lj6jwb6lnwnmkqf09yr00jjrrfhfash";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/5cfdc64a9aa79575dad8057c4cd747d2cdd460aa/recipes/wordgen";
+          sha256 = "0vlrplm3pmpwwa8p8j6lck97b875gzzm7vxxc8l9l18vs237cz1m";
+          name = "wordgen";
+        };
+        packageRequires = [ cl-lib emacs ];
+        meta = {
+          homepage = "https://melpa.org/#/wordgen";
+          license = lib.licenses.free;
+        };
+      }) {};
     wordsmith-mode = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
     melpaBuild {
         pname = "wordsmith-mode";
@@ -37015,6 +37102,27 @@
           license = lib.licenses.free;
         };
       }) {};
+    yarn-mode = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    melpaBuild {
+        pname = "yarn-mode";
+        version = "1.0";
+        src = fetchFromGitHub {
+          owner = "anachronic";
+          repo = "yarn-mode";
+          rev = "99891000efe31214b065fa9446cd5e68c5c42ed8";
+          sha256 = "0cg06ba9yfgjzprq78cvhvvl06av0p2vhnmynddzbpgjgjnwskfy";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/860fa2a8fdb22be374fa64a5277af3ab484a047a/recipes/yarn-mode";
+          sha256 = "08a3lrz670jsf531mn1hwhh7fg5dby6i749cscd6d4dyvkzpz5dg";
+          name = "yarn-mode";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://melpa.org/#/yarn-mode";
+          license = lib.licenses.free;
+        };
+      }) {};
     yascroll = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
     melpaBuild {
         pname = "yascroll";
@@ -37254,6 +37362,27 @@
           license = lib.licenses.free;
         };
       }) {};
+    zephir-mode = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    melpaBuild {
+        pname = "zephir-mode";
+        version = "0.3.3";
+        src = fetchFromGitHub {
+          owner = "sergeyklay";
+          repo = "zephir-mode";
+          rev = "243f0fb7fd1dfebf0f0bdf94046b72d1bea4f66c";
+          sha256 = "0jydy2zcbksi7db7bvfhgdh08np8k4a1yd6q2wq6m3ll2y3zd0w2";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/5bd901c93ce7f64de6082e801327adbd18fd4517/recipes/zephir-mode";
+          sha256 = "0nxm6w7z89q2vvf3bp1p6hb6f2axv9ha85jyiv4k02l46sjprf4j";
+          name = "zephir-mode";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://melpa.org/#/zephir-mode";
+          license = lib.licenses.free;
+        };
+      }) {};
     zerodark-theme = callPackage ({ all-the-icons, fetchFromGitHub, fetchurl, flycheck, lib, magit, melpaBuild }:
     melpaBuild {
         pname = "zerodark-theme";

pkgs/applications/editors/emacs-modes/org-generated.nix

@@ -1,10 +1,10 @@
 { callPackage }: {
     org = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
         pname = "org";
-        version = "20170731";
+        version = "20170807";
         src = fetchurl {
-          url = "http://orgmode.org/elpa/org-20170731.tar";
+          url = "http://orgmode.org/elpa/org-20170807.tar";
-          sha256 = "0lphzjxmk5y9g6b9rnacc9z55hbws3xmycsqdvsz56xr3aawx255";
+          sha256 = "0cpkkfw7wmz242r5zzpcnzp7gfsmja90gqqb5h20azxmq96kfzga";
         };
         packageRequires = [];
         meta = {
@@ -14,10 +14,10 @@
       }) {};
     org-plus-contrib = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
         pname = "org-plus-contrib";
-        version = "20170731";
+        version = "20170807";
         src = fetchurl {
-          url = "http://orgmode.org/elpa/org-plus-contrib-20170731.tar";
+          url = "http://orgmode.org/elpa/org-plus-contrib-20170807.tar";
-          sha256 = "1bba4m9r598f9l8wmr1j670d1qp4fcbbhzp9m4qd2md09rm3nsnw";
+          sha256 = "145j9g1lx5nj85irdh9ljhh4rhwj9ys8nnca549lyxd9a5yiav5k";
         };
         packageRequires = [];
         meta = {

pkgs/applications/editors/jetbrains/default.nix

@@ -307,12 +307,12 @@ in
 
   idea-ultimate = buildIdea rec {
     name = "idea-ultimate-${version}";
-    version = "2017.1.5";
+    version = "2017.2.1";
     description = "Integrated Development Environment (IDE) by Jetbrains, requires paid license";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/idea/ideaIU-${version}-no-jdk.tar.gz";
-      sha256 = "0gjj2g9fcrbbbp3v4clg0kj48qdw0gqcn9im4h8p3z2zscpg16ag";
+      sha256 = "0y3r82i229d7lywixyifv4kkrwivixl75flagaqbkzw3j9wklg3k";
     };
     wmClass = "jetbrains-idea";
     update-channel = "IDEA_Release";

pkgs/applications/editors/typora/default.nix

@@ -3,18 +3,18 @@
 
 stdenv.mkDerivation rec {
   name = "typora-${version}";
-  version = "0.9.29";
+  version = "0.9.31";
 
   src =
     if stdenv.system == "x86_64-linux" then
       fetchurl {
         url = "https://www.typora.io/linux/typora_${version}_amd64.deb";
-        sha256 = "1d7a02ee603be871d6f8c25b5c11069267ec11644a4f513635c0769ce46a44a7";
+        sha256 = "786b5164d9c63ecc23eb427c5ff393285ce8fd540c5bfdd5c1464655fac87a42";
       }
     else
       fetchurl {
         url = "https://www.typora.io/linux/typora_${version}_i386.deb";
-        sha256 = "79834b0ccd2257c030aec850ebc81fe115f46891b482f1ffa41fcc19c5f29659";
+        sha256 = "a8fe53f8984d9f8c4e06c14affbb616be58a91cd2b475b9681fb18a6e21930d1";
       }
     ;
 

pkgs/applications/graphics/ImageMagick/default.nix

@@ -85,7 +85,9 @@ stdenv.mkDerivation rec {
     moveToOutput "bin/*-config" "$dev"
     moveToOutput "lib/ImageMagick-*/config-Q16" "$dev" # includes configure params
     for file in "$dev"/bin/*-config; do
-      substituteInPlace "$file" --replace pkg-config \
+      substituteInPlace "$file" --replace "${pkgconfig}/bin/pkg-config -config" \
+        ${pkgconfig}/bin/pkg-config
+      substituteInPlace "$file" --replace ${pkgconfig}/bin/pkg-config \
         "PKG_CONFIG_PATH='$dev/lib/pkgconfig' '${pkgconfig}/bin/pkg-config'"
     done
   '' + lib.optionalString (ghostscript != null) ''

pkgs/applications/kde/gwenview.nix

@@ -3,7 +3,7 @@
   extra-cmake-modules, kdoctools,
   exiv2, lcms2,
   baloo, kactivities, kdelibs4support, kio, kipi-plugins, libkdcraw, libkipi,
-  phonon, qtimageformats, qtsvg, qtx11extras
+  phonon, qtimageformats, qtsvg, qtx11extras, kinit
 }:
 
 mkDerivation {
@@ -17,5 +17,5 @@ mkDerivation {
     baloo exiv2 kactivities kdelibs4support kio libkdcraw lcms2 libkipi phonon
     qtimageformats qtsvg qtx11extras
   ];
-  propagatedUserEnvPkgs = [ kipi-plugins ];
+  propagatedUserEnvPkgs = [ kipi-plugins libkipi (lib.getBin kinit) ];
 }

pkgs/applications/kde/k3b.nix

@@ -5,7 +5,7 @@
 , flac, lame, libmad, libmpcdec, libvorbis
 , libsamplerate, libsndfile, taglib
 , cdparanoia, cdrdao, cdrtools, dvdplusrwtools, libburn, libdvdcss, libdvdread, vcdimager
-, ffmpeg, libmusicbrainz2, normalize, sox, transcode, shared_mime_info
+, ffmpeg, libmusicbrainz2, normalize, sox, transcode, shared_mime_info, kinit
 }:
 
 mkDerivation {
@@ -30,6 +30,7 @@ mkDerivation {
     # others
     ffmpeg libmusicbrainz2 shared_mime_info
   ];
+  propagatedUserEnvPkgs = [ (lib.getBin kinit) ];
   postFixup =
     let k3bPath = lib.makeBinPath [
           cdrdao cdrtools dvdplusrwtools libburn normalize sox transcode

pkgs/applications/kde/konsole.nix

@@ -20,4 +20,5 @@ mkDerivation {
     kguiaddons kiconthemes kinit kio knotifications knotifyconfig kparts kpty
     kservice ktextwidgets kwidgetsaddons kwindowsystem kxmlgui qtscript
   ];
+  propagatedUserEnvPkgs = [ (lib.getBin kinit) ];
 }

pkgs/applications/kde/spectacle.nix

@@ -16,5 +16,5 @@ mkDerivation {
     kconfig kcoreaddons kdbusaddons kdeclarative kio knotifications
     kscreen kwidgetsaddons kwindowsystem kxmlgui libkipi qtx11extras
   ];
-  propagatedUserEnvPkgs = [ kipi-plugins ];
+  propagatedUserEnvPkgs = [ kipi-plugins libkipi ];
 }

pkgs/applications/misc/gpg-mdp/default.nix

@@ -19,11 +19,11 @@ in stdenv.mkDerivation {
       --replace "alias echo=/bin/echo" ""
 
     substituteInPlace ./src/config.c \
-      --replace "/usr/bin/gpg" "${gnupg}/bin/gpg2" \
+      --replace "/usr/bin/gpg" "${gnupg}/bin/gpg" \
       --replace "/usr/bin/vi" "vi"
 
     substituteInPlace ./mdp.1 \
-      --replace "/usr/bin/gpg" "${gnupg}/bin/gpg2"
+      --replace "/usr/bin/gpg" "${gnupg}/bin/gpg"
   '';
   # we add symlinks to the binary and man page with the name 'gpg-mdp', in case
   # the completely unrelated program also named 'mdp' is already installed.

pkgs/applications/misc/k3b/wrapper.nix

@@ -1,15 +0,0 @@
-{ lib, symlinkJoin, k3b-original, cdrtools, makeWrapper }:
-
-let
-  binPath = lib.makeBinPath [ cdrtools ];
-in symlinkJoin {
-  name = "k3b-${k3b-original.version}";
-
-  paths = [ k3b-original ];
-  buildInputs = [ makeWrapper ];
-
-  postBuild = ''
-    wrapProgram $out/bin/k3b \
-      --prefix PATH ':' ${binPath}
-  '';
-}

pkgs/applications/misc/xastir/default.nix

@@ -4,11 +4,9 @@
 , perl, proj, rastermagick, shapelib
 }:
 
-let
+stdenv.mkDerivation rec {
+  name = "xastir-${version}";
   version = "208";
-in
-stdenv.mkDerivation {
-  name = "xastir-"+version;
 
   src = fetchFromGitHub {
     owner = "Xastir";
@@ -17,15 +15,16 @@ stdenv.mkDerivation {
     sha256 = "1mm22vn3hws7dmg9wpaj4s0zkzb77i3aqa2ay3q6kqjkdhv25brl";
   };
 
-  buildInputs =
+  buildInputs = [
-    [ autoreconfHook
+    autoreconfHook
     curl db gdal libgeotiff
     libXpm libXt motif pcre
     perl proj rastermagick shapelib
   ];
 
-  configureFlags =
+  configureFlags = [ "--with-motif-includes=${motif}/include" ];
-    [ "--with-motif-includes=${motif}/include" ];
+
+  postPatch = "patchShebangs .";
 
   meta = with stdenv.lib; {
     description = "Graphical APRS client";

pkgs/applications/networking/browsers/chromium/common.nix

@@ -60,7 +60,10 @@ let
     in attrs: concatStringsSep " " (attrValues (mapAttrs toFlag attrs));
 
   gnSystemLibraries = [
-    "ffmpeg" "flac" "harfbuzz-ng" "libwebp" "libxslt" "yasm" "snappy" # "libpng" "libjpeg"
+    "flac" "harfbuzz-ng" "libwebp" "libxslt" "yasm" "opus" "snappy" "libpng" "zlib"
+    # "libjpeg" # fails with multiple undefined references to chromium_jpeg_*
+    # "re2" # fails with linker errors
+    # "ffmpeg" # https://crbug.com/731766
   ];
 
   opusWithCustomModes = libopus.override {
@@ -73,7 +76,7 @@ let
     libpng libcap
     xdg_utils yasm minizip libwebp
     libusb1 re2 zlib
-    ffmpeg harfbuzz libxslt harfbuzz-icu libxml2
+    ffmpeg harfbuzz-icu libxslt libxml2
   ];
 
   # build paths and release info
@@ -104,23 +107,22 @@ let
       nspr nss systemd
       utillinux alsaLib
       bison gperf kerberos
-      glib gtk2 dbus_glib
+      glib gtk2 gtk3 dbus_glib
       libXScrnSaver libXcursor libXtst mesa
       pciutils protobuf speechd libXdamage
     ] ++ optional gnomeKeyringSupport libgnome_keyring3
       ++ optionals gnomeSupport [ gnome.GConf libgcrypt ]
       ++ optionals cupsSupport [ libgcrypt cups ]
-      ++ optional pulseSupport libpulseaudio
+      ++ optional pulseSupport libpulseaudio;
-      ++ optional (versionAtLeast version "56.0.0.0") gtk3;
 
     patches = [
       ./patches/nix_plugin_paths_52.patch
+      ./patches/chromium-gn-bootstrap-r8.patch
       # To enable ChromeCast, go to chrome://flags and set "Load Media Router Component Extension" to Enabled
       # Fixes Chromecast: https://bugs.chromium.org/p/chromium/issues/detail?id=734325
       ./patches/fix_network_api_crash.patch
-      ./patches/chromium-59.0.3071.115-system_ffmpeg-1.patch
+
-    ] ++ optional (versionOlder version "57.0") ./patches/glibc-2.24.patch
+    ] ++ optional enableWideVine ./patches/widevine.patch;
-      ++ optional enableWideVine ./patches/widevine.patch;
 
     postPatch = ''
       # We want to be able to specify where the sandbox is via CHROME_DEVEL_SANDBOX
@@ -183,9 +185,14 @@ let
       enable_hotwording = enableHotwording;
       enable_widevine = enableWideVine;
       use_cups = cupsSupport;
-    } // {
+
       treat_warnings_as_errors = false;
       is_clang = false;
+      clang_use_chrome_plugins = false;
+      remove_webcore_debug_symbols = true;
+      use_gtk3 = true;
+      enable_swiftshader = false;
+      fieldtrial_testing_like_official_build = true;
 
       # Google API keys, see:
       #   http://www.chromium.org/developers/how-tos/api-keys

pkgs/applications/networking/browsers/chromium/default.nix

@@ -1,5 +1,5 @@
 { newScope, stdenv, makeWrapper, makeDesktopItem, ed
-, glib, gtk2, gtk3, gnome2, gnome3, gsettings_desktop_schemas
+, glib, gtk3, gnome3, gsettings_desktop_schemas
 
 # package customization
 , channel ? "stable"
@@ -67,9 +67,6 @@ let
 
   inherit (stdenv.lib) versionAtLeast;
 
-  gtk = if (versionAtLeast version "59.0.0.0") then gtk3 else gtk2;
-  gnome = if (versionAtLeast version "59.0.0.0") then gnome3 else gnome2;
-
 in stdenv.mkDerivation {
   name = "chromium${suffix}-${version}";
   inherit version;
@@ -78,10 +75,10 @@ in stdenv.mkDerivation {
     makeWrapper ed
 
     # needed for GSETTINGS_SCHEMAS_PATH
-    gsettings_desktop_schemas glib gtk
+    gsettings_desktop_schemas glib gtk3
 
     # needed for XDG_ICON_DIRS
-    gnome.defaultIconTheme
+    gnome3.defaultIconTheme
   ];
 
   outputs = ["out" "sandbox"];

pkgs/applications/networking/browsers/chromium/patches/chromium-59.0.3071.115-system_ffmpeg-1.patch

@@ -1,63 +0,0 @@
-Submitted By:            DJ Lucas <dj_AT_linuxfromscratch_DOT_org>
-Date:                    2017-06-25
-Initial Package Version: 57.0.2987.110
-Upstream Status:         Not submitted
-Origin:                  Gentoo: https://gitweb.gentoo.org/repo/gentoo.git/plain/www-client/chromium/files/chromium-system-ffmpeg-r4.patch
-Description:             Allows building with system provided ffmpeg. Rediffed
-                         for chromium-59.0.3071.109.
-
-diff -Naurp chromium-59.0.3071.109-orig/media/ffmpeg/ffmpeg_common.h chromium-59.0.3071.109/media/ffmpeg/ffmpeg_common.h
---- chromium-59.0.3071.109-orig/media/ffmpeg/ffmpeg_common.h	2017-06-20 17:03:19.000000000 -0500
-+++ chromium-59.0.3071.109/media/ffmpeg/ffmpeg_common.h	2017-06-23 00:21:10.551912699 -0500
-@@ -23,10 +23,6 @@
- 
- // Include FFmpeg header files.
- extern "C" {
--// Disable deprecated features which result in spammy compile warnings.  This
--// list of defines must mirror those in the 'defines' section of FFmpeg's
--// BUILD.gn file or the headers below will generate different structures!
--#define FF_API_CONVERGENCE_DURATION 0
- // Upstream libavcodec/utils.c still uses the deprecated
- // av_dup_packet(), causing deprecation warnings.
- // The normal fix for such things is to disable the feature as below,
-@@ -40,7 +36,6 @@ extern "C" {
- MSVC_PUSH_DISABLE_WARNING(4244);
- #include <libavcodec/avcodec.h>
- #include <libavformat/avformat.h>
--#include <libavformat/internal.h>
- #include <libavformat/avio.h>
- #include <libavutil/avutil.h>
- #include <libavutil/imgutils.h>
-diff -Naurp chromium-59.0.3071.109-orig/media/filters/ffmpeg_demuxer.cc chromium-59.0.3071.109/media/filters/ffmpeg_demuxer.cc
---- chromium-59.0.3071.109-orig/media/filters/ffmpeg_demuxer.cc	2017-06-20 17:03:19.000000000 -0500
-+++ chromium-59.0.3071.109/media/filters/ffmpeg_demuxer.cc	2017-06-23 00:22:56.289311692 -0500
-@@ -1223,29 +1223,6 @@ void FFmpegDemuxer::OnFindStreamInfoDone
-   // If no estimate is found, the stream entry will be kInfiniteDuration.
-   std::vector<base::TimeDelta> start_time_estimates(format_context->nb_streams,
-                                                     kInfiniteDuration);
--  const AVFormatInternal* internal = format_context->internal;
--  if (internal && internal->packet_buffer &&
--      format_context->start_time != static_cast<int64_t>(AV_NOPTS_VALUE)) {
--    struct AVPacketList* packet_buffer = internal->packet_buffer;
--    while (packet_buffer != internal->packet_buffer_end) {
--      DCHECK_LT(static_cast<size_t>(packet_buffer->pkt.stream_index),
--                start_time_estimates.size());
--      const AVStream* stream =
--          format_context->streams[packet_buffer->pkt.stream_index];
--      if (packet_buffer->pkt.pts != static_cast<int64_t>(AV_NOPTS_VALUE)) {
--        const base::TimeDelta packet_pts =
--            ConvertFromTimeBase(stream->time_base, packet_buffer->pkt.pts);
--        // We ignore kNoTimestamp here since -int64_t::min() is possible; see
--        // https://crbug.com/700501. Technically this is a valid value, but in
--        // practice shouldn't occur, so just ignore it when estimating.
--        if (packet_pts != kNoTimestamp && packet_pts != kInfiniteDuration &&
--            packet_pts < start_time_estimates[stream->index]) {
--          start_time_estimates[stream->index] = packet_pts;
--        }
--      }
--      packet_buffer = packet_buffer->next;
--    }
--  }
- 
-   std::unique_ptr<MediaTracks> media_tracks(new MediaTracks());
- 

pkgs/applications/networking/browsers/chromium/patches/chromium-gn-bootstrap-r8.patch

@@ -0,0 +1,13 @@
+Index: tools/gn/bootstrap/bootstrap.py
+diff --git a/tools/gn/bootstrap/bootstrap.py b/tools/gn/bootstrap/bootstrap.py
+index 6f2f5b1264519ea38cc36fb0b7e2cc24c378ca7a..0b03d2626b358fb90ab39d737679ee47bd60303b 100755
+--- a/tools/gn/bootstrap/bootstrap.py
++++ b/tools/gn/bootstrap/bootstrap.py
+@@ -487,6 +487,7 @@ def write_gn_ninja(path, root_gen_dir, options):
+       'base/sys_info.cc',
+       'base/task_runner.cc',
+       'base/task_scheduler/delayed_task_manager.cc',
++      'base/task_scheduler/environment_config.cc',
+       'base/task_scheduler/post_task.cc',
+       'base/task_scheduler/priority_queue.cc',
+       'base/task_scheduler/scheduler_lock_impl.cc',

pkgs/applications/networking/browsers/chromium/patches/glibc-2.24.patch

@@ -1,14 +0,0 @@
---- old/third_party/WebKit/Source/wtf/allocator/PageAllocator.cpp	2016-08-03 21:02:37.000000000 +0200
-+++ new/third_party/WebKit/Source/wtf/allocator/PageAllocator.cpp	2016-08-14 10:59:51.395354850 +0200
-@@ -41,6 +41,11 @@
- #include <errno.h>
- #include <sys/mman.h>
- 
-+#if OS(LINUX) && defined(MADV_FREE)
-+// Added in Linux 4.5, but we don't want to depend on 4.5 at runtime
-+#undef MADV_FREE
-+#endif
-+
- #ifndef MADV_FREE
- #define MADV_FREE MADV_DONTNEED
- #endif

pkgs/applications/networking/browsers/chromium/plugins.nix

@@ -94,12 +94,12 @@ let
 
   flash = stdenv.mkDerivation rec {
     name = "flashplayer-ppapi-${version}";
-    version = "26.0.0.137";
+    version = "26.0.0.151";
 
     src = fetchzip {
       url = "https://fpdownload.adobe.com/pub/flashplayer/pdc/"
           + "${version}/flash_player_ppapi_linux.x86_64.tar.gz";
-      sha256 = "0zmslmy7i7ywb2frckg5afkmfqb2lm2mahq0qs8msjzcx9jk4pyx";
+      sha256 = "0l15k2ws3256zyvbfx66j8p1liqv4k2m8hhw2jz8nzza7q6il35p";
       stripRoot = false;
     };
 

pkgs/applications/networking/browsers/chromium/upstream-info.nix

@@ -1,18 +1,18 @@
 # This file is autogenerated from update.sh in the same directory.
 {
   beta = {
-    sha256 = "086j8s8wjwk26gfb7hdqn1lsmwgr9mmw93yfi6s4wia9ra0ccwj2";
+    sha256 = "1sh3rq36sh4g7blajvqfvs06fs5sbrbdp50qq0cvcj4k3fmb4bd8";
-    sha256bin64 = "0z1dshxzyn5zhr4xg5mvrq70jxsfkwv50achq802322y4jz52f7n";
+    sha256bin64 = "1w67y4z57qm5fwniayncly7a4mjmwqir7gfd54ny8lwlf247d43m";
-    version = "60.0.3112.66";
+    version = "60.0.3112.78";
   };
   dev = {
-    sha256 = "1hbf7hv4934686dp0dbqy06vbwb2kq4wz5hjfdxrgafrzqac2j7g";
+    sha256 = "0yan2dzx1854f3xslif5682rkb82a1li6vxj12z5s5fxqijhj1jq";
-    sha256bin64 = "1gg1a3k80qncr7dpw9gycndv52396cqyq9zfmzf6c4njpn2khjfv";
+    sha256bin64 = "0ddva2rqnid2gcx3qh72p41wc15869w2w9n0rbdpn662rpl041v1";
-    version = "61.0.3153.4";
+    version = "61.0.3163.25";
   };
   stable = {
-    sha256 = "0w1i4q7w5lcajc18jrchrhhm00x0jzm846l5x7a5rcp3baawkjrp";
+    sha256 = "1rirhwvccidza4q4z1gqdwcd9v1bymh1m9r2cq8jhiabfrjpjbxl";
-    sha256bin64 = "1naq20508qjm9hlwlpj686a0lawca58rnr35ws2gh2gsyxrxnmx1";
+    sha256bin64 = "1lw349ips0sgyls3arv864yq5xykfn9jilwkalvllaq6yvdvcvlk";
-    version = "59.0.3071.115";
+    version = "60.0.3112.90";
   };
 }

pkgs/applications/networking/browsers/firefox-bin/update.nix

@@ -22,7 +22,7 @@ in writeScript "update-${name}" ''
   pushd ${basePath}
 
   HOME=`mktemp -d`
-  cat ${./firefox.key} | gpg2 --import
+  cat ${./firefox.key} | gpg --import
 
   tmpfile=`mktemp`
   url=${baseUrl}
@@ -47,7 +47,7 @@ in writeScript "update-${name}" ''
 
   curl --silent -o $HOME/shasums "$url$version/SHA512SUMS"
   curl --silent -o $HOME/shasums.asc "$url$version/SHA512SUMS.asc"
-  gpgv2 --keyring=$HOME/.gnupg/pubring.kbx $HOME/shasums.asc $HOME/shasums
+  gpgv --keyring=$HOME/.gnupg/pubring.kbx $HOME/shasums.asc $HOME/shasums
 
   # this is a list of sha512 and tarballs for both arches
   shasums=`cat $HOME/shasums`

pkgs/applications/networking/browsers/firefox/packages.nix

@@ -6,10 +6,10 @@ rec {
 
   firefox = common rec {
     pname = "firefox";
-    version = "54.0.1";
+    version = "55.0.1";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "43607c2c0af995a21dc7f0f68b24b7e5bdb3faa5ee06025901c826bfe4d169256ea1c9eb5fcc604c4d6426ced53e80787c12fc07cda014eca09199ef3df783a2";
+      sha512 = "2c15cb3e1a9f464f63ff7ac8ccf0625ed845a5cb9b186d7acf121c439cec38bcdeee93630e99dbfd336f1b7e60a7c09822a1eba59f308bba8866f155b2ed1c47";
     };
 
     meta = {
@@ -25,10 +25,10 @@ rec {
 
   firefox-esr = common rec {
     pname = "firefox-esr";
-    version = "52.2.1esr";
+    version = "52.3.0esr";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "1d79e6e4625cf7994f6d6bbdf227e483fc407bcdb20e0296ea604969e701f551b5df32f578d4669cf654b65927328c8eb0f717c7a12399bf1b02a6ac7a0cd1d3";
+      sha512 = "36da8f14b50334e36fca06e09f15583101cadd10e510268255587ea9b09b1fea918da034d6f1d439ab8c34612f6cebc409a0b8d812dddb3f997afebe64d09fe9";
     };
 
     meta = firefox.meta // {

pkgs/applications/networking/browsers/mozilla-plugins/bluejeans/default.nix

@@ -24,8 +24,6 @@ stdenv.mkDerivation rec {
     sha256 = "1fgjgzss0ghk734xpfidazyknfdn11pmyw77pc3wigl83dvx4nb2";
   };
 
-  phases = [ "unpackPhase" "installPhase" "fixupPhase" ];
-
   unpackPhase = "${dpkg}/bin/dpkg-deb -x $src .";
 
   installPhase =

pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix

@@ -73,7 +73,7 @@ let
 in
 stdenv.mkDerivation rec {
   name = "flashplayer-${version}";
-  version = "26.0.0.137";
+  version = "26.0.0.151";
 
   src = fetchurl {
     url =
@@ -84,14 +84,14 @@ stdenv.mkDerivation rec {
     sha256 =
       if debug then
         if arch == "x86_64" then
-          "1kdwprrrxbdgll05x148vhg86ph77ygr99ycfblblj8wjkcz9s0z"
+          "0dlgardgrd8a18b48b0l6xk68dqi39yndv05phrypsxzr00p23q8"
         else
-          "1ldv0fca43kdda949095r3gk1bc9p8n94z61qijkmrpv91zv5qvl"
+          "0dbvsww4v6hlqn4yhdmzs335inim5iq0ym998x8zpavilqq51y0d"
       else
         if arch == "x86_64" then
-          "0db6dcqal7p79q26kglnsbiv3ysx9r3c7rkdiynww18gzr40vwls"
+          "1yywffslh5px15w62wck1rnlp317jr6a334r409q7hxqc3x90z8l"
         else
-          "1fm6p91c63pyr0lra29vcq2dplb2c7a5114nm4r9rrrzjxakqw5w";
+          "1f1czbx14nvgr1qlzcp03nhj6c55wra8l6f4bsig691n3hfpb6hp";
   };
 
   nativeBuildInputs = [ unzip ];

pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix

@@ -55,7 +55,7 @@ let
 in
 stdenv.mkDerivation rec {
   name = "flashplayer-standalone-${version}";
-  version = "26.0.0.137";
+  version = "26.0.0.151";
 
   src = fetchurl {
     url =
@@ -65,9 +65,9 @@ stdenv.mkDerivation rec {
         "https://fpdownload.macromedia.com/pub/flashplayer/updaters/26/flash_player_sa_linux.x86_64.tar.gz";
     sha256 =
       if debug then
-        "095457h83zs6cvdyyrh01069kgg8cnhgs1by6s9xpdxgc851n8gp"
+        "0pfb217bg0v9hq0cbyndhmhkba16nhz2rasl7kk4ppxcfcjhr5pb"
       else
-        "1zw3f612cfb8lr331hwqzlpd0gn3r0139bq76pbbbahh2chq99f8";
+        "0a9ayylkpjprad1al7ddplxrpymd181a9gmw9hhk78s11v2zvwn8";
   };
 
   nativeBuildInputs = [ unzip ];

pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix

@@ -84,7 +84,7 @@ let
   fteLibPath = makeLibraryPath [ stdenv.cc.cc gmp ];
 
   # Upstream source
-  version = "7.0.3";
+  version = "7.0.4";
 
   lang = "en-US";
 
@@ -94,7 +94,7 @@ let
         "https://github.com/TheTorProject/gettorbrowser/releases/download/v${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
         "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
       ];
-      sha256 = "1p91szx60xx3295bpap9w2ydgaibj0yn9lbdyhajal35bbhjxqhc";
+      sha256 = "17hz6nv7py80zbksk1dypmj8agr5jzsfrpjncphpsrflvbqzs2bx";
     };
 
     "i686-linux" = fetchurl {
@@ -102,7 +102,7 @@ let
         "https://github.com/TheTorProject/gettorbrowser/releases/download/v${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
         "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
       ];
-      sha256 = "0p51dxiq3qxyc5n7xvh1hq039pvp7z730f6dks4h5p3sfqw6isfp";
+      sha256 = "0g8m5x891f4kdvb3fhmh98xfw569sbqd9wcadflabf9vc9bqv3al";
     };
   };
 in

pkgs/applications/networking/cluster/docker-machine/default.nix

@@ -3,7 +3,7 @@
 
 buildGoPackage rec {
   name = "machine-${version}";
-  version = "0.12.0";
+  version = "0.12.2";
 
   goPackagePath = "github.com/docker/machine";
 
@@ -11,7 +11,7 @@ buildGoPackage rec {
     rev = "v${version}";
     owner = "docker";
     repo = "machine";
-    sha256 = "08y87d0whag9sy1q5s84xrz95k12c9crh3zmdcr1ylrwqnszrn2y";
+    sha256 = "0ikgjb6x6h7f43vjabxnqgrrlq516zsz7vj945hca1w919jpdwhf";
   };
 
   postInstall = ''

pkgs/applications/networking/cluster/minikube/default.nix

@@ -14,15 +14,15 @@ let
   # instead, we download localkube ourselves and shove it into the minikube binary. The versions URL that minikube uses is
   # currently https://storage.googleapis.com/minikube/k8s_releases.json
 
-  localkube-version = "1.6.3";
+  localkube-version = "1.7.0";
   localkube-binary = fetchurl {
     url = "https://storage.googleapis.com/minikube/k8sReleases/v${localkube-version}/localkube-linux-amd64";
-    sha256 = "1fmxxjv1bxrfngc4ykfgg76b79dh8pq0k1gsbzhiy3hhrppfqylm";
+    sha256 = "1pp5bi0bpxxzrshvkv47hqs20jfx3gp1i1p3pw1rvzm5n1fn2q1a";
   };
 in buildGoPackage rec {
   pname   = "minikube";
   name    = "${pname}-${version}";
-  version = "0.20.0";
+  version = "0.21.0";
 
   goPackagePath = "k8s.io/minikube";
 
@@ -30,7 +30,7 @@ in buildGoPackage rec {
     owner  = "kubernetes";
     repo   = "minikube";
     rev    = "v${version}";
-    sha256 = "0bly2phy67x4ckcg46g6r4kqfdpjfs1cb3588a900m8b4xyavvvb";
+    sha256 = "1y72kdrpbxwfzxs9jslcrb2l3xw83z4i7raf5c7sky4wf2nx8vis";
   };
 
   # kubernetes is here only to shut up a loud warning when generating the completions below. minikube checks very eagerly

pkgs/applications/networking/dropbox/default.nix

@@ -24,15 +24,13 @@
 let
   # NOTE: When updating, please also update in current stable,
   # as older versions stop working
-  version = "31.4.25";
+  version = "32.4.23";
-  sha256 =
+  sha256 = {
-    {
+    "x86_64-linux" = "11jh3cyax652crhvjshi8gnvb8mpp7hfbgwqjx5n1q3j1rswm3d1";
-      "x86_64-linux" = "02qla89gf7zawfk0kxd3xzr7vb91khj3p83bvh456ap51h0z5wzv";
+    "i686-linux"   = "0xf0in3ywgd53v19h0v2sg69b6y2lbvr5y6jz10x3cighzr31qfp";
-      "i686-linux"   = "0sfh24qyc91q6ssn8lrzfdsv4jjy0hvgizcq3y3fk46zaa7jjxr2";
   }."${stdenv.system}" or (throw "system ${stdenv.system} not supported");
 
-  arch =
+  arch = {
-    {
     "x86_64-linux" = "x86_64";
     "i686-linux"   = "x86";
   }."${stdenv.system}" or (throw "system ${stdenv.system} not supported");
@@ -40,8 +38,7 @@ let
   # relative location where the dropbox libraries are stored
   appdir = "opt/dropbox";
 
-  libs =
+  libs = [
-    [
     dbus_libs fontconfig freetype gcc.cc glib libdrm libffi libICE libSM
     libX11 libXcomposite libXext libXmu libXrender libxcb libxml2 libxslt
     ncurses zlib
@@ -99,10 +96,10 @@ in mkDerivation {
 
     mkdir -p "$out/bin"
     RPATH="${ldpath}:$out/${appdir}"
+    chmod 755 $out/${appdir}/dropbox
     makeWrapper "$out/${appdir}/dropbox" "$out/bin/dropbox" \
       --prefix LD_LIBRARY_PATH : "$RPATH"
 
-    chmod 755 $out/${appdir}/dropbox
 
     rm $out/${appdir}/wmctrl
     ln -s ${wmctrl}/bin/wmctrl $out/${appdir}/wmctrl
@@ -141,11 +138,11 @@ in mkDerivation {
     paxmark m $out/${appdir}/dropbox
   '';
 
-  meta = {
+  meta = with lib; {
-    homepage = http://www.dropbox.com;
     description = "Online stored folders (daemon version)";
-    maintainers = with lib.maintainers; [ ttuegel ];
+    homepage    = http://www.dropbox.com;
+    maintainers = with maintainers; [ ttuegel ];
+    license     = licenses.unfree;
     platforms   = [ "i686-linux" "x86_64-linux" ];
-    license = lib.licenses.unfree;
   };
 }

pkgs/applications/networking/gns3/server.nix

@@ -0,0 +1,37 @@
+{ stdenv, python34Packages, fetchFromGitHub }:
+
+python34Packages.buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "gns3-server";
+  version = "2.0.3";
+
+  src = fetchFromGitHub {
+    owner = "GNS3";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1c7mzj1r2zh90a7vs3s17jakfp9s43b8nnj29rpamqxvl3qhbdy7";
+  };
+
+  propagatedBuildInputs = with python34Packages; [
+    aiohttp jinja2 psutil zipstream aiohttp-cors raven jsonschema
+  ];
+
+  # Requires network access
+  doCheck = false;
+
+  postInstall = ''
+    rm $out/bin/gns3loopback # For windows only
+  '';
+  meta = with stdenv.lib; {
+    description = "Graphical Network Simulator 3 server";
+    longDescription = ''
+      The GNS3 server manages emulators such as Dynamips, VirtualBox or
+      Qemu/KVM. Clients like the GNS3 GUI control the server using a HTTP REST
+      API.
+    '';
+    homepage = "https://www.gns3.com/";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ primeos ];
+  };
+}

pkgs/applications/networking/instant-messengers/discord/default.nix

@@ -1,44 +1,46 @@
-{ stdenv, fetchurl, makeDesktopItem
+{ stdenv, fetchurl, makeDesktopItem, makeWrapper
 , alsaLib, atk, cairo, cups, dbus, expat, fontconfig, freetype, gdk_pixbuf
 , glib, gnome2, gtk2, libnotify, libX11, libXcomposite, libXcursor, libXdamage
-, libXext, libXfixes, libXi, libXrandr, libXrender, libXtst, nspr, nss, pango
+, libXext, libXfixes, libXi, libXrandr, libXrender, libXtst, nspr, nss, libxcb
-, systemd, libXScrnSaver }:
+, pango, systemd, libXScrnSaver, libcxx }:
 
 stdenv.mkDerivation rec {
 
     pname = "discord";
-    version = "0.0.1";
+    version = "0.0.2";
     name = "${pname}-${version}";
 
     src = fetchurl {
         url = "https://cdn.discordapp.com/apps/linux/${version}/${pname}-${version}.tar.gz";
-        sha256 = "10m3ixvhmxdw55awd84gx13m222qjykj7gcigbjabcvsgp2z63xs";
+        sha256 = "0sb7l0rrpqxzn4fndjr50r5xfiid1f81p22gda4mz943yv37mhfz";
     };
 
+    nativeBuildInputs = [ makeWrapper ];
+
     libPath = stdenv.lib.makeLibraryPath [
         stdenv.cc.cc alsaLib atk cairo cups dbus expat fontconfig freetype
         gdk_pixbuf glib gnome2.GConf gtk2 libnotify libX11 libXcomposite
         libXcursor libXdamage libXext libXfixes libXi libXrandr libXrender
-        libXtst nspr nss pango systemd libXScrnSaver
+        libXtst nspr nss libxcb pango systemd libXScrnSaver
      ];
 
     installPhase = ''
-        mkdir -p $out/{bin,share/pixmaps}
+        mkdir -p $out/{bin,opt,share/pixmaps}
-        mv * $out
+        mv * $out/opt
 
         # Copying how adobe-reader does it,
         # see pkgs/applications/misc/adobe-reader/builder.sh
         patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-                 --set-rpath "$out:$libPath"                                   \
+                 --set-rpath "$out/opt:$libPath"                                   \
-                 $out/Discord
+                 $out/opt/Discord
 
-        paxmark m $out/Discord
+        paxmark m $out/opt/Discord
 
-        ln -s $out/Discord $out/bin/
+        wrapProgram $out/opt/Discord --prefix LD_LIBRARY_PATH : "$LD_LIBRARY_PATH:${libcxx}/lib:${systemd.lib}/lib"
-        ln -s $out/discord.png $out/share/pixmaps
+
+        ln -s $out/opt/Discord $out/bin/
+        ln -s $out/opt/discord.png $out/share/pixmaps
 
-        # Putting udev in the path won't work :(
-        ln -s ${systemd.lib}/lib/libudev.so.1 $out
         ln -s "${desktopItem}/share/applications" $out/share/
         '';
 
@@ -56,7 +58,7 @@ stdenv.mkDerivation rec {
         homepage = https://discordapp.com/;
         downloadPage = "https://github.com/crmarsh/discord-linux-bugs";
         license = licenses.unfree;
-        maintainers = [ maintainers.ldesgoui ];
+        maintainers = [ maintainers.ldesgoui maintainers.MP2E ];
         platforms = [ "x86_64-linux" ];
     };
 }

pkgs/applications/networking/mailreaders/notmuch/default.nix

@@ -48,11 +48,11 @@ stdenv.mkDerivation rec {
     find test -type f -exec \
       sed -i \
         -e "1s|#!/usr/bin/env bash|#!${bash}/bin/bash|" \
-        -e "s|gpg |${gnupg}/bin/gpg2 |" \
+        -e "s|gpg |${gnupg}/bin/gpg |" \
-        -e "s| gpg| ${gnupg}/bin/gpg2|" \
+        -e "s| gpg| ${gnupg}/bin/gpg|" \
         -e "s|gpgsm |${gnupg}/bin/gpgsm |" \
         -e "s| gpgsm| ${gnupg}/bin/gpgsm|" \
-        -e "s|crypto.gpg_path=gpg|crypto.gpg_path=${gnupg}/bin/gpg2|" \
+        -e "s|crypto.gpg_path=gpg|crypto.gpg_path=${gnupg}/bin/gpg|" \
         "{}" ";"
 
     for src in \
@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
       emacs/notmuch-crypto.el
     do
       substituteInPlace "$src" \
-        --replace \"gpg\" \"${gnupg}/bin/gpg2\"
+        --replace \"gpg\" \"${gnupg}/bin/gpg\"
     done
   '';
 

pkgs/applications/networking/seafile-client/default.nix

@@ -1,39 +1,28 @@
-{stdenv, fetchurl, writeScript, pkgconfig, cmake, qt4, seafile-shared, ccnet, makeWrapper}:
+{ stdenv, fetchurl, writeScript, pkgconfig, cmake, qtbase, qttools
+, seafile-shared, ccnet, makeWrapper }:
 
-stdenv.mkDerivation rec
+stdenv.mkDerivation rec {
-{
+  version = "6.1.0";
-  version = "5.0.7";
   name = "seafile-client-${version}";
 
-  src = fetchurl
+  src = fetchurl {
-  {
     url = "https://github.com/haiwen/seafile-client/archive/v${version}.tar.gz";
-    sha256 = "ae6975bc1adf45d09cf9f6332ceac7cf285f8191f6cf50c6291ed45f8cf4ffa5";
+    sha256 = "16rn6b9ayaccgwx8hs3yh1wb395pp8ffh8may8a8bpcc4gdry7bd";
   };
 
-  buildInputs = [ pkgconfig cmake qt4 seafile-shared makeWrapper ];
+  nativeBuildInputs = [ pkgconfig cmake makeWrapper ];
-
+  buildInputs = [ qtbase qttools seafile-shared ];
-  builder = writeScript "${name}-builder.sh" ''
-    source $stdenv/setup
-
-    tar xvfz $src
-    cd seafile-client-*
-
-    cmake -DCMAKE_BUILD_TYPE=Release -DCMAKE_SKIP_BUILD_RPATH=ON -DCMAKE_INSTALL_PREFIX="$out" .
-    make -j1
-
-    make install
 
+  postInstall = ''
     wrapProgram $out/bin/seafile-applet \
       --suffix PATH : ${stdenv.lib.makeBinPath [ ccnet seafile-shared ]}
   '';
 
-  meta =
+  meta = with stdenv.lib; {
-  {
+    homepage = https://github.com/haiwen/seafile-client;
-    homepage = https://github.com/haiwen/seafile-clients;
     description = "Desktop client for Seafile, the Next-generation Open Source Cloud Storage";
-    license = stdenv.lib.licenses.asl20;
+    license = licenses.asl20;
-    platforms = stdenv.lib.platforms.linux;
+    platforms = platforms.linux;
-    maintainers = [ stdenv.lib.maintainers.calrama ];
+    maintainers = [ maintainers.calrama ];
   };
 }

pkgs/applications/networking/sniffers/wireshark/add_missing_udpdump_pod.patch

@@ -0,0 +1,132 @@
+diff -Nur wireshark-2.4.0/doc/udpdump.pod wireshark-2.4.0-p/doc/udpdump.pod
+--- wireshark-2.4.0/doc/udpdump.pod	1970-01-01 01:00:00.000000000 +0100
++++ wireshark-2.4.0-p/doc/udpdump.pod	2017-08-01 10:48:40.551431319 +0200
+@@ -0,0 +1,128 @@
++
++=head1 NAME
++
++udpdump - Provide an UDP receiver that gets packets from network devices (like Aruba routers) and exports them in PCAP format.
++
++=head1 SYNOPSIS
++
++B<udpdump>
++S<[ B<--help> ]>
++S<[ B<--version> ]>
++S<[ B<--extcap-interfaces> ]>
++S<[ B<--extcap-dlts> ]>
++S<[ B<--extcap-interface>=E<lt>interfaceE<gt> ]>
++S<[ B<--extcap-config> ]>
++S<[ B<--capture> ]>
++S<[ B<--fifo>=E<lt>path to file or pipeE<gt> ]>
++S<[ B<--port>=E<lt>portE<gt> ]>
++S<[ B<--payload>=E<lt>typeE<gt> ]>
++
++=head1 DESCRIPTION
++
++B<udpdump> is a extcap tool that provides an UDP receiver that listens for exported datagrams coming from
++any source (like Aruba routers) and exports them in PCAP format. This provides the user two basic
++functionalities: the first one is to have a listener that prevents the localhost to send back an ICMP
++port-unreachable packet. The second one is to strip out the lower layers (layer 2, IP, UDP) that are useless
++(are used just as export vector). The format of the exported datagrams are EXPORTED_PDU, as specified in
++https://code.wireshark.org/review/gitweb?p=wireshark.git;a=blob;f=epan/exported_pdu.h;hb=refs/heads/master
++
++=head1 OPTIONS
++
++=over 4
++
++=item --help
++
++Print program arguments.
++
++=item --version
++
++Print program version.
++
++=item --extcap-interfaces
++
++List available interfaces.
++
++=item --extcap-interface=E<lt>interfaceE<gt>
++
++Use specified interfaces.
++
++=item --extcap-dlts
++
++List DLTs of specified interface.
++
++=item --extcap-config
++
++List configuration options of specified interface.
++
++=item --capture
++
++Start capturing from specified interface save saved it in place specified by --fifo.
++
++=item --fifo=E<lt>path to file or pipeE<gt>
++
++Save captured packet to file or send it through pipe.
++
++=item --port=E<lt>portE<gt>
++
++Set the listerner port. Port 5555 is the default.
++
++=item --payload=E<lt>typeE<gt>
++
++Set the payload of the exported PDU. Default: data.
++
++=back
++
++=head1 EXAMPLES
++
++To see program arguments:
++
++    udpdump --help
++
++To see program version:
++
++    udpdump --version
++
++To see interfaces:
++
++    udpdump --extcap-interfaces
++
++  Example output:
++    interface {value=udpdump}{display=UDP Listener remote capture}
++
++To see interface DLTs:
++
++    udpdump --extcap-interface=udpdump --extcap-dlts
++
++  Example output:
++    dlt {number=252}{name=udpdump}{display=Exported PDUs}
++
++To see interface configuration options:
++
++    udpdump --extcap-interface=udpdump --extcap-config
++
++  Example output:
++    arg {number=0}{call=--port}{display=Listen port}{type=unsigned}{range=1,65535}{default=5555}{tooltip=The port the receiver listens on}
++
++To capture:
++
++    udpdump --extcap-interface=randpkt --fifo=/tmp/randpkt.pcapng --capture
++
++NOTE: To stop capturing CTRL+C/kill/terminate application.
++
++=head1 SEE ALSO
++
++wireshark(1), tshark(1), dumpcap(1), extcap(4)
++
++=head1 NOTES
++
++B<udpdump> is part of the B<Wireshark> distribution.  The latest version
++of B<Wireshark> can be found at L<https://www.wireshark.org>.
++
++HTML versions of the Wireshark project man pages are available at:
++L<https://www.wireshark.org/docs/man-pages>.
++
++=head1 AUTHORS
++
++  Original Author
++  ---------------
++  Dario Lombardo             <lomato[AT]gmail.com>

pkgs/applications/networking/sniffers/wireshark/default.nix

@@ -1,6 +1,6 @@
 { stdenv, lib, fetchurl, pkgconfig, pcre, perl, flex, bison, gettext, libpcap, libnl, c-ares
 , gnutls, libgcrypt, libgpgerror, geoip, openssl, lua5, makeDesktopItem, python, libcap, glib
-, libssh, zlib, cmake, extra-cmake-modules
+, libssh, zlib, cmake, extra-cmake-modules, fetchpatch
 , withGtk ? false, gtk3 ? null, librsvg ? null, gsettings_desktop_schemas ? null, wrapGAppsHook ? null
 , withQt ? false, qt5 ? null
 , ApplicationServices, SystemConfiguration, gmp
@@ -12,17 +12,19 @@ assert withQt  -> !withGtk && qt5  != null;
 with stdenv.lib;
 
 let
-  version = "2.2.7";
+  version = "2.4.0";
   variant = if withGtk then "gtk" else if withQt then "qt" else "cli";
 
 in stdenv.mkDerivation {
   name = "wireshark-${variant}-${version}";
 
   src = fetchurl {
-    url = "http://www.wireshark.org/download/src/all-versions/wireshark-${version}.tar.bz2";
+    url = "http://www.wireshark.org/download/src/all-versions/wireshark-${version}.tar.xz";
-    sha256 = "1dfvhra5v6xhzbp097qsxi0zvirw0srbasl4v1wjf58v49idz7b8";
+    sha256 = "011vvrj76z1azkpvyy2j40b1x1z56ymld508zfc4xw3gh8dv82w9";
   };
 
+  cmakeFlags = optional withGtk "-DBUILD_wireshark_gtk=TRUE";
+
   nativeBuildInputs = [
     bison cmake extra-cmake-modules flex
   ] ++ optional withGtk wrapGAppsHook;
@@ -35,7 +37,19 @@ in stdenv.mkDerivation {
     ++ optionals stdenv.isLinux  [ libcap libnl ]
     ++ optionals stdenv.isDarwin [ SystemConfiguration ApplicationServices gmp ];
 
-  patches = [ ./wireshark-lookup-dumpcap-in-path.patch ];
+  patches = [ ./wireshark-lookup-dumpcap-in-path.patch
+
+              # Backported from master. Will probably have to be dropped during next
+              # update.
+              (fetchpatch {
+                 name = "AUTHORS_add_newline_after_bracket";
+                 url = "https://code.wireshark.org/review/gitweb?p=wireshark.git;a=patch;h=27c6b12626d6e7b8e4d7a11784c2c5e2bfb87fde";
+                 sha256 = "1x30rkrq7dzgdlwrjv2r5ibdpdgwnn5wzvki77rdf13b0547vcw3";
+               })
+              # A file is missing from distribution. This should be fixed in upcoming
+              # releases
+              ./add_missing_udpdump_pod.patch
+            ];
 
   postInstall = optionalString (withQt || withGtk) ''
     ${optionalString withGtk ''

pkgs/applications/science/chemistry/gwyddion/default.nix

@@ -0,0 +1,31 @@
+{ stdenv, fetchurl, gtk2, pkgconfig }:
+
+with stdenv.lib;
+
+stdenv.mkDerivation {
+  name = "gwyddion";
+  version = "2.48";
+  src = fetchurl {
+    url = "http://sourceforge.net/projects/gwyddion/files/gwyddion/2.48/gwyddion-2.48.tar.xz";
+    sha256 = "119iw58ac2wn4cas6js8m7r1n4gmmkga6b1y711xzcyjp9hshgwx";
+  };
+  buildInputs = [ gtk2 pkgconfig ];
+  meta = {
+    homepage = http://gwyddion.net/;
+
+    description = "Scanning probe microscopy data visualization and analysis";
+
+    longDescription = ''
+      A modular program for SPM (scanning probe microscopy) data
+      visualization and analysis. Primarily it is intended for the
+      analysis of height fields obtained by scanning probe microscopy
+      techniques (AFM, MFM, STM, SNOM/NSOM) and it supports a lot of
+      SPM data formats. However, it can be used for general height
+      field and (greyscale) image processing, for instance for the
+      analysis of profilometry data or thickness maps from imaging
+      spectrophotometry.
+    '';
+    license = stdenv.lib.licenses.gpl2;
+    platforms = stdenv.lib.platforms.linux;
+  };
+}

pkgs/applications/version-management/git-and-tools/default.nix

@@ -34,6 +34,8 @@ rec {
 
   git = appendToName "minimal" gitBase;
 
+  git-fame = callPackage ./git-fame {};
+
   # The full-featured Git.
   gitFull = gitBase.override {
     svnSupport = true;

pkgs/applications/version-management/git-and-tools/git-fame/Gemfile

@@ -0,0 +1,4 @@
+source 'https://rubygems.org'
+
+# Specify your gem's dependencies in git_fame.gemspec
+gem "git_fame"

pkgs/applications/version-management/git-and-tools/git-fame/Gemfile.lock

@@ -0,0 +1,26 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    git_fame (2.5.2)
+      hirb (~> 0.7.3)
+      memoist (~> 0.14.0)
+      method_profiler (~> 2.0.1)
+      progressbar (~> 0.21.0)
+      scrub_rb (~> 1.0.1)
+      trollop (~> 2.1.2)
+    hirb (0.7.3)
+    memoist (0.14.0)
+    method_profiler (2.0.1)
+      hirb (>= 0.6.0)
+    progressbar (0.21.0)
+    scrub_rb (1.0.1)
+    trollop (2.1.2)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  git_fame
+
+BUNDLED WITH
+   1.14.6

pkgs/applications/version-management/git-and-tools/git-fame/default.nix

@@ -0,0 +1,19 @@
+{ stdenv, bundlerEnv, ruby, fetchFromGitHub, makeWrapper, bundler }:
+
+bundlerEnv rec {
+  inherit ruby;
+
+  pname = "git_fame";
+
+  gemdir = ./.;
+
+  meta = with stdenv.lib; {
+    description = ''
+      A command-line tool that helps you summarize and pretty-print collaborators based on contributions
+      '';
+    homepage    = http://oleander.io/git-fame-rb;
+    license     = licenses.mit;
+    maintainers = with maintainers; [ expipiplus1 ];
+    platforms   = platforms.unix;
+  };
+}

pkgs/applications/version-management/git-and-tools/git-fame/gemset.nix

@@ -0,0 +1,60 @@
+{
+  git_fame = {
+    dependencies = ["hirb" "memoist" "method_profiler" "progressbar" "scrub_rb" "trollop"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "02k5ls5zyif8skdbnym6zw9y76whlnksw2m94jsh2n1ygk98izdd";
+      type = "gem";
+    };
+    version = "2.5.2";
+  };
+  hirb = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0mzch3c2lvmf8gskgzlx6j53d10j42ir6ik2dkrl27sblhy76cji";
+      type = "gem";
+    };
+    version = "0.7.3";
+  };
+  memoist = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "03d3h6kp16bf0crqg1cxdgp1d2iyzn53d3phbmjh4pjybqls0gcm";
+      type = "gem";
+    };
+    version = "0.14.0";
+  };
+  method_profiler = {
+    dependencies = ["hirb"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1ax04qrrv7fqp5ayxaxhn72660pybdkpkvmgiwbg7bs7x5ijjzd8";
+      type = "gem";
+    };
+    version = "2.0.1";
+  };
+  progressbar = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "17haw9c6c9q6imsn83pii32jnihpg76jgd09x7y4hjqq45n3qcdh";
+      type = "gem";
+    };
+    version = "0.21.0";
+  };
+  scrub_rb = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0dwg33w83w17aiij9kcbi7irj7lh045nh9prjgkzjya3f1j60d3x";
+      type = "gem";
+    };
+    version = "1.0.1";
+  };
+  trollop = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0415y63df86sqj43c0l82and65ia5h64if7n0znkbrmi6y0jwhl8";
+      type = "gem";
+    };
+    version = "2.1.2";
+  };
+}

pkgs/applications/version-management/git-and-tools/git-radar/default.nix

@@ -4,10 +4,6 @@ stdenv.mkDerivation rec {
   name = "git-radar-${version}";
   version = "0.5";
 
-  phases = [ "unpackPhase" "installPhase" ];
-
-  dontInstallSrc = true;
-
   src = fetchFromGitHub {
     owner = "michaeldfallen";
     repo = "git-radar";
@@ -15,6 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1915aqx8bfc4xmvhx2gfxv72p969a6rn436kii9w4yi38hibmqv9";
   };
 
+  dontBuild = true;
+
   installPhase = ''
     mkdir -p $out/bin
     cp git-radar fetch.sh prompt.bash prompt.zsh radar-base.sh $out

pkgs/applications/version-management/git-and-tools/git/default.nix

@@ -12,7 +12,7 @@
 }:
 
 let
-  version = "2.14.0";
+  version = "2.14.1";
   svn = subversionClient.override { perlBindings = true; };
 in
 
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "0xarcp0m7jbncic0g3ahz8l2d6b27h0g9ndgrhy9abkx61m6wgpr";
+    sha256 = "1iic3wiihxp3l3k6d4z886v3869c3dzgddjxnd5124wy1rnlqwkg";
   };
 
   hardeningDisable = [ "format" ];

pkgs/applications/version-management/mercurial/default.nix

@@ -4,7 +4,7 @@
 
 let
   # if you bump version, update pkgs.tortoisehg too or ping maintainer
-  version = "4.1.1";
+  version = "4.3.1";
   name = "mercurial-${version}";
   inherit (python2Packages) docutils hg-git dulwich python;
 in python2Packages.buildPythonApplication {
@@ -13,7 +13,7 @@ in python2Packages.buildPythonApplication {
 
   src = fetchurl {
     url = "https://mercurial-scm.org/release/${name}.tar.gz";
-    sha256 = "17imsf4haqgw364p1z9i416jinmfxfia537b84hcg0rg43hinmv3";
+    sha256 = "18hq6vvjsrjsnbs15bvyyfrss35bgc0hgw4wxksdyaj578pg04ib";
   };
 
   inherit python; # pass it so that the same version can be used in hg2git

pkgs/applications/version-management/subversion/default.nix

@@ -104,12 +104,12 @@ let
 
 in {
   subversion18 = common {
-    version = "1.8.17";
+    version = "1.8.18";
-    sha256 = "1450fkj1jmxyphqn6cd95z1ykwsabajm9jw4i412qpwss8w9a4fy";
+    sha256 = "19lpqdrl86mjfdpayhn3f9rkmpb6zs2iny38cnxq6wcj7snh0sz5";
   };
 
   subversion19 = common {
-    version = "1.9.5";
+    version = "1.9.6";
-    sha256 = "1ramwly6p74jhb2rdm5ygxjri7jds940cilyvnsdq60xzy5cckwa";
+    sha256 = "06dfram53lyfyyqgz1r7c5323qqc6mjcpwi1j402y21lnqgwbjyv";
   };
 }

pkgs/applications/video/mkvtoolnix/default.nix

@@ -10,13 +10,13 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "mkvtoolnix-${version}";
-  version = "13.0.0";
+  version = "14.0.0";
 
   src = fetchFromGitHub {
     owner = "mbunkus";
     repo = "mkvtoolnix";
     rev = "release-${version}";
-    sha256 = "0dz86fzv19wknd8p31nnx2imj80v7m944ssapp8fmq9hkc36m777";
+    sha256 = "1ygc2qrd074vz2yw4iqml5ir31kkvkv7pz3hcfy423p9s06xi1k2";
   };
 
   nativeBuildInputs = [ pkgconfig autoconf automake gettext drake ruby docbook_xsl libxslt ];

pkgs/applications/virtualization/lkl/default.nix

@@ -1,8 +1,8 @@
 { stdenv, fetchFromGitHub, bc, python, fuse, libarchive }:
 
 stdenv.mkDerivation rec {
-  name = "lkl-2017-06-27";
+  name = "lkl-2017-08-09";
-  rev  = "0d91d102b046eec535a6d67df9829b80b24e9ce9";
+  rev  = "083cdeece0577635d523244dcf0da86074e23e4e";
 
   outputs = [ "dev" "lib" "out" ];
 
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     inherit rev;
     owner  = "lkl";
     repo   = "linux";
-    sha256 = "1sc18fik2dm0hnsb5q4srvwbf6wgv27zlf3qa7x39g4vbj1jqgas";
+    sha256 = "1fyh0p54jgsqywswj40zbw64jbqx2w10wax1k3j2szzlhjrv9x1a";
   };
 
   # Fix a /usr/bin/env reference in here that breaks sandboxed builds

pkgs/build-support/cc-wrapper/add-flags.sh

@@ -1,28 +1,88 @@
+# N.B. It may be a surprise that the derivation-specific variables are exported,
+# since this is just sourced by the wrapped binaries---the end consumers. This
+# is because one wrapper binary may invoke another (e.g. cc invoking ld). In
+# that case, it is cheaper/better to not repeat this step and let the forked
+# wrapped binary just inherit the work of the forker's wrapper script.
+
+var_templates=(
+    NIX_CC_WRAPPER+START_HOOK
+    NIX_CC_WRAPPER+EXEC_HOOK
+    NIX_LD_WRAPPER+START_HOOK
+    NIX_LD_WRAPPER+EXEC_HOOK
+
+    NIX+CFLAGS_COMPILE
+    NIX+CFLAGS_LINK
+    NIX+CXXSTDLIB_COMPILE
+    NIX+CXXSTDLIB_LINK
+    NIX+GNATFLAGS_COMPILE
+    NIX+IGNORE_LD_THROUGH_GCC
+    NIX+LDFLAGS
+    NIX+LDFLAGS_BEFORE
+    NIX+LDFLAGS_AFTER
+    NIX+LDFLAGS_HARDEN
+
+    NIX+SET_BUILD_ID
+    NIX+DONT_SET_RPATH
+    NIX+ENFORCE_NO_NATIVE
+)
+
+# Accumulate infixes for taking in the right input parameters. See setup-hook
+# for details.
+declare -a role_infixes=()
+if [ "${NIX_CC_WRAPPER_@infixSalt@_TARGET_BUILD:-}" ]; then
+    role_infixes+=(_BUILD_)
+fi
+if [ "${NIX_CC_WRAPPER_@infixSalt@_TARGET_HOST:-}" ]; then
+    role_infixes+=(_)
+fi
+if [ "${NIX_CC_WRAPPER_@infixSalt@_TARGET_TARGET:-}" ]; then
+    role_infixes+=(_TARGET_)
+fi
+
+# We need to mangle names for hygiene, but also take parameters/overrides
+# from the environment.
+for var in "${var_templates[@]}"; do
+    outputVar="${var/+/_@infixSalt@_}"
+    export ${outputVar}+=''
+    # For each role we serve, we accumulate the input parameters into our own
+    # cc-wrapper-derivation-specific environment variables.
+    for infix in "${role_infixes[@]}"; do
+        inputVar="${var/+/${infix}}"
+        if [ -v "$inputVar" ]; then
+            export ${outputVar}+="${!outputVar:+ }${!inputVar}"
+        fi
+    done
+done
+
 # `-B@out@/bin' forces cc to use ld-wrapper.sh when calling ld.
-export NIX_CFLAGS_COMPILE="-B@out@/bin/ $NIX_CFLAGS_COMPILE"
+NIX_@infixSalt@_CFLAGS_COMPILE="-B@out@/bin/ $NIX_@infixSalt@_CFLAGS_COMPILE"
+
+# Export and assign separately in order that a failing $(..) will fail
+# the script.
 
 if [ -e @out@/nix-support/libc-cflags ]; then
-    export NIX_CFLAGS_COMPILE="$(cat @out@/nix-support/libc-cflags) $NIX_CFLAGS_COMPILE"
+    NIX_@infixSalt@_CFLAGS_COMPILE="$(< @out@/nix-support/libc-cflags) $NIX_@infixSalt@_CFLAGS_COMPILE"
 fi
 
 if [ -e @out@/nix-support/cc-cflags ]; then
-    export NIX_CFLAGS_COMPILE="$(cat @out@/nix-support/cc-cflags) $NIX_CFLAGS_COMPILE"
+    NIX_@infixSalt@_CFLAGS_COMPILE="$(< @out@/nix-support/cc-cflags) $NIX_@infixSalt@_CFLAGS_COMPILE"
 fi
 
 if [ -e @out@/nix-support/gnat-cflags ]; then
-    export NIX_GNATFLAGS_COMPILE="$(cat @out@/nix-support/gnat-cflags) $NIX_GNATFLAGS_COMPILE"
+    NIX_@infixSalt@_GNATFLAGS_COMPILE="$(< @out@/nix-support/gnat-cflags) $NIX_@infixSalt@_GNATFLAGS_COMPILE"
 fi
 
 if [ -e @out@/nix-support/libc-ldflags ]; then
-    export NIX_LDFLAGS+=" $(cat @out@/nix-support/libc-ldflags)"
+    NIX_@infixSalt@_LDFLAGS+=" $(< @out@/nix-support/libc-ldflags)"
 fi
 
 if [ -e @out@/nix-support/cc-ldflags ]; then
-    export NIX_LDFLAGS+=" $(cat @out@/nix-support/cc-ldflags)"
+    NIX_@infixSalt@_LDFLAGS+=" $(< @out@/nix-support/cc-ldflags)"
 fi
 
 if [ -e @out@/nix-support/libc-ldflags-before ]; then
-    export NIX_LDFLAGS_BEFORE="$(cat @out@/nix-support/libc-ldflags-before) $NIX_LDFLAGS_BEFORE"
+    NIX_@infixSalt@_LDFLAGS_BEFORE="$(< @out@/nix-support/libc-ldflags-before) $NIX_@infixSalt@_LDFLAGS_BEFORE"
 fi
 
-export NIX_CC_WRAPPER_FLAGS_SET=1
+# That way forked processes will not extend these environment variables again.
+export NIX_CC_WRAPPER_@infixSalt@_FLAGS_SET=1

pkgs/build-support/cc-wrapper/add-hardening.sh

@@ -1,53 +1,69 @@
 hardeningFlags=(fortify stackprotector pic strictoverflow format relro bindnow)
-hardeningFlags+=("${hardeningEnable[@]}")
+# Intentionally word-split in case 'hardeningEnable' is defined in
+# Nix. Also, our bootstrap tools version of bash is old enough that
+# undefined arrays trip `set -u`.
+if [[ -v hardeningEnable[@] ]]; then
+  hardeningFlags+=(${hardeningEnable[@]})
+fi
 hardeningCFlags=()
 hardeningLDFlags=()
-hardeningDisable=${hardeningDisable:-""}
 
-hardeningDisable+=" @hardening_unsupported_flags@"
+declare -A hardeningDisableMap
 
-if [[ -n "$NIX_DEBUG" ]]; then echo HARDENING: Value of '$hardeningDisable': $hardeningDisable >&2; fi
+# Intentionally word-split in case 'hardeningDisable' is defined in Nix.
+for flag in ${hardeningDisable[@]:-IGNORED_KEY} @hardening_unsupported_flags@
+do
+  hardeningDisableMap[$flag]=1
+done
 
-if [[ ! $hardeningDisable =~ "all" ]]; then
+if [[ -n "${NIX_DEBUG:-}" ]]; then
-  if [[ -n "$NIX_DEBUG" ]]; then echo 'HARDENING: Is active (not completely disabled with "all" flag)' >&2; fi
+  printf 'HARDENING: disabled flags:' >&2
+  (( "${#hardeningDisableMap[@]}" )) && printf ' %q' "${!hardeningDisableMap[@]}" >&2
+  echo >&2
+fi
+
+if [[ -z "${hardeningDisableMap[all]:-}" ]]; then
+  if [[ -n "${NIX_DEBUG:-}" ]]; then
+    echo 'HARDENING: Is active (not completely disabled with "all" flag)' >&2;
+  fi
   for flag in "${hardeningFlags[@]}"
   do
-    if [[ ! "${hardeningDisable}" =~ "$flag" ]]; then
+    if [[ -z "${hardeningDisableMap[$flag]:-}" ]]; then
       case $flag in
         fortify)
-          if [[ -n "$NIX_DEBUG" ]]; then echo HARDENING: enabling fortify >&2; fi
+          if [[ -n "${NIX_DEBUG:-}" ]]; then echo HARDENING: enabling fortify >&2; fi
           hardeningCFlags+=('-O2' '-D_FORTIFY_SOURCE=2')
           ;;
         stackprotector)
-          if [[ -n "$NIX_DEBUG" ]]; then echo HARDENING: enabling stackprotector >&2; fi
+          if [[ -n "${NIX_DEBUG:-}" ]]; then echo HARDENING: enabling stackprotector >&2; fi
-          hardeningCFlags+=('-fstack-protector-strong' '--param ssp-buffer-size=4')
+          hardeningCFlags+=('-fstack-protector-strong' '--param' 'ssp-buffer-size=4')
           ;;
         pie)
-          if [[ -n "$NIX_DEBUG" ]]; then echo HARDENING: enabling CFlags -fPIE >&2; fi
+          if [[ -n "${NIX_DEBUG:-}" ]]; then echo HARDENING: enabling CFlags -fPIE >&2; fi
           hardeningCFlags+=('-fPIE')
           if [[ ! ("$*" =~ " -shared " || "$*" =~ " -static ") ]]; then
-            if [[ -n "$NIX_DEBUG" ]]; then echo HARDENING: enabling LDFlags -pie >&2; fi
+            if [[ -n "${NIX_DEBUG:-}" ]]; then echo HARDENING: enabling LDFlags -pie >&2; fi
             hardeningLDFlags+=('-pie')
           fi
           ;;
         pic)
-          if [[ -n "$NIX_DEBUG" ]]; then echo HARDENING: enabling pic >&2; fi
+          if [[ -n "${NIX_DEBUG:-}" ]]; then echo HARDENING: enabling pic >&2; fi
           hardeningCFlags+=('-fPIC')
           ;;
         strictoverflow)
-          if [[ -n "$NIX_DEBUG" ]]; then echo HARDENING: enabling strictoverflow >&2; fi
+          if [[ -n "${NIX_DEBUG:-}" ]]; then echo HARDENING: enabling strictoverflow >&2; fi
           hardeningCFlags+=('-fno-strict-overflow')
           ;;
         format)
-          if [[ -n "$NIX_DEBUG" ]]; then echo HARDENING: enabling format >&2; fi
+          if [[ -n "${NIX_DEBUG:-}" ]]; then echo HARDENING: enabling format >&2; fi
           hardeningCFlags+=('-Wformat' '-Wformat-security' '-Werror=format-security')
           ;;
         relro)
-          if [[ -n "$NIX_DEBUG" ]]; then echo HARDENING: enabling relro >&2; fi
+          if [[ -n "${NIX_DEBUG:-}" ]]; then echo HARDENING: enabling relro >&2; fi
           hardeningLDFlags+=('-z' 'relro')
           ;;
         bindnow)
-          if [[ -n "$NIX_DEBUG" ]]; then echo HARDENING: enabling bindnow >&2; fi
+          if [[ -n "${NIX_DEBUG:-}" ]]; then echo HARDENING: enabling bindnow >&2; fi
           hardeningLDFlags+=('-z' 'now')
           ;;
         *)

pkgs/build-support/cc-wrapper/cc-wrapper.sh

@@ -1,15 +1,22 @@
-#! @shell@ -e
+#! @shell@
+set -eu -o pipefail
+shopt -s nullglob
+
 path_backup="$PATH"
-if [ -n "@coreutils_bin@" ]; then
+
+# That @-vars are substituted separately from bash evaluation makes
+# shellcheck think this, and others like it, are useless conditionals.
+# shellcheck disable=SC2157
+if [[ -n "@coreutils_bin@" && -n "@gnugrep_bin@" ]]; then
     PATH="@coreutils_bin@/bin:@gnugrep_bin@/bin"
 fi
 
-if [ -n "$NIX_CC_WRAPPER_START_HOOK" ]; then
+if [ -z "${NIX_CC_WRAPPER_@infixSalt@_FLAGS_SET:-}" ]; then
-    source "$NIX_CC_WRAPPER_START_HOOK"
+    source @out@/nix-support/add-flags.sh
 fi
 
-if [ -z "$NIX_CC_WRAPPER_FLAGS_SET" ]; then
+if [ -n "$NIX_CC_WRAPPER_@infixSalt@_START_HOOK" ]; then
-    source @out@/nix-support/add-flags.sh
+    source "$NIX_CC_WRAPPER_@infixSalt@_START_HOOK"
 fi
 
 source @out@/nix-support/utils.sh
@@ -19,16 +26,17 @@ source @out@/nix-support/utils.sh
 # For instance, figure out if linker flags should be passed.
 # GCC prints annoying warnings when they are not needed.
 dontLink=0
-getVersion=0
 nonFlagArgs=0
+# shellcheck disable=SC2193
 [[ "@prog@" = *++ ]] && isCpp=1 || isCpp=0
 cppInclude=1
 
 expandResponseParams "$@"
-n=0
+declare -i n=0
-while [ $n -lt ${#params[*]} ]; do
+nParams=${#params[@]}
+while [ "$n" -lt "$nParams" ]; do
     p=${params[n]}
-    p2=${params[$((n+1))]}
+    p2=${params[n+1]:-} # handle `p` being last one
     if [ "$p" = -c ]; then
         dontLink=1
     elif [ "$p" = -S ]; then
@@ -55,10 +63,10 @@ while [ $n -lt ${#params[*]} ]; do
         nonFlagArgs=1
     elif [ "$p" = -m32 ]; then
         if [ -e @out@/nix-support/dynamic-linker-m32 ]; then
-            NIX_LDFLAGS+=" -dynamic-linker $(cat @out@/nix-support/dynamic-linker-m32)"
+            NIX_@infixSalt@_LDFLAGS+=" -dynamic-linker $(< @out@/nix-support/dynamic-linker-m32)"
         fi
     fi
-    n=$((n + 1))
+    n+=1
 done
 
 # If we pass a flag like -Wl, then gcc will call the linker unless it
@@ -71,39 +79,40 @@ if [ "$nonFlagArgs" = 0 ]; then
 fi
 
 # Optionally filter out paths not refering to the store.
-if [ "$NIX_ENFORCE_PURITY" = 1 -a -n "$NIX_STORE" ]; then
+if [[ "${NIX_ENFORCE_PURITY:-}" = 1 && -n "$NIX_STORE" ]]; then
     rest=()
-    n=0
+    nParams=${#params[@]}
-    while [ $n -lt ${#params[*]} ]; do
+    declare -i n=0
+    while [ "$n" -lt "$nParams" ]; do
         p=${params[n]}
-        p2=${params[$((n+1))]}
+        p2=${params[n+1]:-} # handle `p` being last one
         if [ "${p:0:3}" = -L/ ] && badPath "${p:2}"; then
-            skip $p
+            skip "${p:2}"
         elif [ "$p" = -L ] && badPath "$p2"; then
-            n=$((n + 1)); skip $p2
+            n+=1; skip "$p2"
         elif [ "${p:0:3}" = -I/ ] && badPath "${p:2}"; then
-            skip $p
+            skip "${p:2}"
         elif [ "$p" = -I ] && badPath "$p2"; then
-            n=$((n + 1)); skip $p2
+            n+=1; skip "$p2"
         elif [ "$p" = -isystem ] && badPath "$p2"; then
-            n=$((n + 1)); skip $p2
+            n+=1; skip "$p2"
         else
             rest+=("$p")
         fi
-        n=$((n + 1))
+        n+=1
     done
     params=("${rest[@]}")
 fi
 
 
 # Clear march/mtune=native -- they bring impurity.
-if [ "$NIX_ENFORCE_NO_NATIVE" = 1 ]; then
+if [ "$NIX_@infixSalt@_ENFORCE_NO_NATIVE" = 1 ]; then
     rest=()
-    for i in "${params[@]}"; do
+    for p in "${params[@]}"; do
-        if [[ "$i" = -m*=native ]]; then
+        if [[ "$p" = -m*=native ]]; then
-            skip $i
+            skip "$p"
         else
-            rest+=("$i")
+            rest+=("$p")
         fi
     done
     params=("${rest[@]}")
@@ -111,37 +120,36 @@ fi
 
 if [[ "$isCpp" = 1 ]]; then
     if [[ "$cppInclude" = 1 ]]; then
-        NIX_CFLAGS_COMPILE+=" ${NIX_CXXSTDLIB_COMPILE-@default_cxx_stdlib_compile@}"
+        NIX_@infixSalt@_CFLAGS_COMPILE+=" ${NIX_@infixSalt@_CXXSTDLIB_COMPILE-@default_cxx_stdlib_compile@}"
     fi
-    NIX_CFLAGS_LINK+=" $NIX_CXXSTDLIB_LINK"
+    NIX_@infixSalt@_CFLAGS_LINK+=" $NIX_@infixSalt@_CXXSTDLIB_LINK"
 fi
 
-LD=@ldPath@/ld
 source @out@/nix-support/add-hardening.sh
 
 # Add the flags for the C compiler proper.
-extraAfter=($NIX_CFLAGS_COMPILE ${hardeningCFlags[@]})
+extraAfter=($NIX_@infixSalt@_CFLAGS_COMPILE "${hardeningCFlags[@]}")
 extraBefore=()
 
 if [ "$dontLink" != 1 ]; then
 
     # Add the flags that should only be passed to the compiler when
     # linking.
-    extraAfter+=($NIX_CFLAGS_LINK ${hardeningLDFlags[@]})
+    extraAfter+=($NIX_@infixSalt@_CFLAGS_LINK "${hardeningLDFlags[@]}")
 
     # Add the flags that should be passed to the linker (and prevent
-    # `ld-wrapper' from adding NIX_LDFLAGS again).
+    # `ld-wrapper' from adding NIX_@infixSalt@_LDFLAGS again).
-    for i in $NIX_LDFLAGS_BEFORE; do
+    for i in $NIX_@infixSalt@_LDFLAGS_BEFORE; do
-        extraBefore=(${extraBefore[@]} "-Wl,$i")
+        extraBefore+=("-Wl,$i")
     done
-    for i in $NIX_LDFLAGS; do
+    for i in $NIX_@infixSalt@_LDFLAGS; do
         if [ "${i:0:3}" = -L/ ]; then
             extraAfter+=("$i")
         else
             extraAfter+=("-Wl,$i")
         fi
     done
-    export NIX_LDFLAGS_SET=1
+    export NIX_@infixSalt@_LDFLAGS_SET=1
 fi
 
 # As a very special hack, if the arguments are just `-v', then don't
@@ -154,24 +162,21 @@ if [ "$*" = -v ]; then
 fi
 
 # Optionally print debug info.
-if [ -n "$NIX_DEBUG" ]; then
+if [ -n "${NIX_DEBUG:-}" ]; then
+    set +u # Old bash workaround, see ld-wrapper for explanation.
+    echo "extra flags before to @prog@:" >&2
+    printf "  %q\n" "${extraBefore[@]}"  >&2
     echo "original flags to @prog@:" >&2
-  for i in "${params[@]}"; do
+    printf "  %q\n" "${params[@]}" >&2
-      echo "  $i" >&2
+    echo "extra flags after to @prog@:" >&2
-  done
+    printf "  %q\n" "${extraAfter[@]}" >&2
-  echo "extraBefore flags to @prog@:" >&2
+    set -u
-  for i in ${extraBefore[@]}; do
-      echo "  $i" >&2
-  done
-  echo "extraAfter flags to @prog@:" >&2
-  for i in ${extraAfter[@]}; do
-      echo "  $i" >&2
-  done
 fi
 
-if [ -n "$NIX_CC_WRAPPER_EXEC_HOOK" ]; then
+if [ -n "$NIX_CC_WRAPPER_@infixSalt@_EXEC_HOOK" ]; then
-    source "$NIX_CC_WRAPPER_EXEC_HOOK"
+    source "$NIX_CC_WRAPPER_@infixSalt@_EXEC_HOOK"
 fi
 
 PATH="$path_backup"
-exec @prog@ ${extraBefore[@]} "${params[@]}" "${extraAfter[@]}"
+set +u # Old bash workaround, see above.
+exec @prog@ "${extraBefore[@]}" "${params[@]}" "${extraAfter[@]}"

pkgs/build-support/cc-wrapper/default.nix

@@ -53,42 +53,13 @@ let
     "-isystem $(echo -n ${cc.gcc}/include/c++/*) -isystem $(echo -n ${cc.gcc}/include/c++/*)/$(${cc.gcc}/bin/gcc -dumpmachine)";
 
   dashlessTarget = stdenv.lib.replaceStrings ["-"] ["_"] targetPlatform.config;
-  # TODO(@Ericson2314) Make unconditional
-  infixSalt  = stdenv.lib.optionalString (targetPlatform != hostPlatform) dashlessTarget;
-  infixSalt_ = stdenv.lib.optionalString (targetPlatform != hostPlatform) (dashlessTarget + "_");
-  _infixSalt = stdenv.lib.optionalString (targetPlatform != hostPlatform) ("_" + dashlessTarget);
 
-  # We want to prefix all NIX_ flags with the target triple
+  # The "infix salt" is a arbitrary string added in the middle of env vars
-  preWrap = textFile:
+  # defined by cc-wrapper's hooks so that multiple cc-wrappers can be used
-    # TODO: Do even when not cross on next mass-rebuild
+  # without interfering. For the moment, it is defined as the target triple,
-    # TODO: use @target_tripple@ for consistency
+  # adjusted to be a valid bash identifier. This should be considered an
-    if targetPlatform == hostPlatform
+  # unstable implementation detail, however.
-    then textFile
+  infixSalt = dashlessTarget;
-    else runCommand "sed-nix-env-vars" {} (''
-      cp --no-preserve=mode ${textFile} $out
-
-      sed -i $out \
-        -e 's^NIX_^NIX_${infixSalt_}^g' \
-        -e 's^addCVars^addCVars${_infixSalt}^g' \
-        -e 's^\[ -z "\$crossConfig" \]^\[\[ "${builtins.toString (targetPlatform != hostPlatform)}" || -z "$crossConfig" \]\]^g'
-
-      # NIX_ things which we don't both use and define, we revert them
-      #asymmetric=$(
-      #  for pre in "" "\\$"
-      #  do
-      #    grep -E -ho $pre'NIX_[a-zA-Z_]*' ./* | sed 's/\$//' | sort | uniq
-      #  done | sort | uniq -c | sort -nr | sed -n 's/^1 NIX_//gp')
-
-      # hard-code for now
-      asymmetric=("CXXSTDLIB_COMPILE" "CC")
-
-      # The ([^a-zA-Z_]|$) bussiness is to ensure environment variables that
-      # begin with `NIX_CC` don't also get blacklisted.
-      for var in "''${asymmetric[@]}"
-      do
-        sed -i $out -E -e "s~NIX_${infixSalt_}$var([^a-zA-Z_]|$)~NIX_$var\1~g"
-      done
-    '');
 
   # The dynamic linker has different names on different platforms. This is a
   # shell glob that ought to match it.
@@ -129,20 +100,21 @@ stdenv.mkDerivation {
   gnugrep_bin = if nativeTools then "" else gnugrep;
 
   binPrefix = prefix;
+  inherit infixSalt;
 
   passthru = {
     inherit libc nativeTools nativeLibc nativePrefix isGNU isClang default_cxx_stdlib_compile
-            prefix infixSalt infixSalt_ _infixSalt;
+            prefix;
 
     emacsBufferSetup = pkgs: ''
       ; We should handle propagation here too
       (mapc (lambda (arg)
         (when (file-directory-p (concat arg "/include"))
-          (setenv "NIX_${infixSalt_}CFLAGS_COMPILE" (concat (getenv "NIX_${infixSalt_}CFLAGS_COMPILE") " -isystem " arg "/include")))
+          (setenv "NIX_${infixSalt}_CFLAGS_COMPILE" (concat (getenv "NIX_${infixSalt}_CFLAGS_COMPILE") " -isystem " arg "/include")))
         (when (file-directory-p (concat arg "/lib"))
-          (setenv "NIX_${infixSalt_}LDFLAGS" (concat (getenv "NIX_${infixSalt_}LDFLAGS") " -L" arg "/lib")))
+          (setenv "NIX_${infixSalt}_LDFLAGS" (concat (getenv "NIX_${infixSalt}_LDFLAGS") " -L" arg "/lib")))
         (when (file-directory-p (concat arg "/lib64"))
-          (setenv "NIX_${infixSalt_}LDFLAGS" (concat (getenv "NIX_${infixSalt_}LDFLAGS") " -L" arg "/lib64")))) '(${concatStringsSep " " (map (pkg: "\"${pkg}\"") pkgs)}))
+          (setenv "NIX_${infixSalt}_LDFLAGS" (concat (getenv "NIX_${infixSalt}_LDFLAGS") " -L" arg "/lib64")))) '(${concatStringsSep " " (map (pkg: "\"${pkg}\"") pkgs)}))
     '';
   };
 
@@ -268,7 +240,7 @@ stdenv.mkDerivation {
       # Solaris needs an additional ld wrapper.
       ldPath="${nativePrefix}/bin"
       exec="$ldPath/${prefix}ld"
-      wrap ld-solaris ${preWrap ./ld-solaris-wrapper.sh}
+      wrap ld-solaris ${./ld-solaris-wrapper.sh}
     '')
 
     + ''
@@ -282,7 +254,6 @@ stdenv.mkDerivation {
     '' + (if !useMacosReexportHack then ''
       wrap ${prefix}ld ${./ld-wrapper.sh} ''${ld:-$ldPath/${prefix}ld}
     '' else ''
-      export binPrefix=${prefix}
       ldInner="${prefix}ld-reexport-delegate"
       wrap "$ldInner" ${./macos-sierra-reexport-hack.bash} ''${ld:-$ldPath/${prefix}ld}
       wrap "${prefix}ld" ${./ld-wrapper.sh} "$out/bin/$ldInner"
@@ -290,11 +261,11 @@ stdenv.mkDerivation {
     '') + ''
 
       if [ -e ${binutils_bin}/bin/${prefix}ld.gold ]; then
-        wrap ${prefix}ld.gold ${preWrap ./ld-wrapper.sh} ${binutils_bin}/bin/${prefix}ld.gold
+        wrap ${prefix}ld.gold ${./ld-wrapper.sh} ${binutils_bin}/bin/${prefix}ld.gold
       fi
 
       if [ -e ${binutils_bin}/bin/ld.bfd ]; then
-        wrap ${prefix}ld.bfd ${preWrap ./ld-wrapper.sh} ${binutils_bin}/bin/${prefix}ld.bfd
+        wrap ${prefix}ld.bfd ${./ld-wrapper.sh} ${binutils_bin}/bin/${prefix}ld.bfd
       fi
 
       # We export environment variables pointing to the wrapped nonstandard
@@ -306,49 +277,49 @@ stdenv.mkDerivation {
       export default_cxx_stdlib_compile="${default_cxx_stdlib_compile}"
 
       if [ -e $ccPath/${prefix}gcc ]; then
-        wrap ${prefix}gcc ${preWrap ./cc-wrapper.sh} $ccPath/${prefix}gcc
+        wrap ${prefix}gcc ${./cc-wrapper.sh} $ccPath/${prefix}gcc
         ln -s ${prefix}gcc $out/bin/${prefix}cc
         export named_cc=${prefix}gcc
         export named_cxx=${prefix}g++
       elif [ -e $ccPath/clang ]; then
-        wrap ${prefix}clang ${preWrap ./cc-wrapper.sh} $ccPath/clang
+        wrap ${prefix}clang ${./cc-wrapper.sh} $ccPath/clang
         ln -s ${prefix}clang $out/bin/${prefix}cc
         export named_cc=${prefix}clang
         export named_cxx=${prefix}clang++
       fi
 
       if [ -e $ccPath/${prefix}g++ ]; then
-        wrap ${prefix}g++ ${preWrap ./cc-wrapper.sh} $ccPath/${prefix}g++
+        wrap ${prefix}g++ ${./cc-wrapper.sh} $ccPath/${prefix}g++
         ln -s ${prefix}g++ $out/bin/${prefix}c++
       elif [ -e $ccPath/clang++ ]; then
-        wrap ${prefix}clang++ ${preWrap ./cc-wrapper.sh} $ccPath/clang++
+        wrap ${prefix}clang++ ${./cc-wrapper.sh} $ccPath/clang++
         ln -s ${prefix}clang++ $out/bin/${prefix}c++
       fi
 
       if [ -e $ccPath/cpp ]; then
-        wrap ${prefix}cpp ${preWrap ./cc-wrapper.sh} $ccPath/cpp
+        wrap ${prefix}cpp ${./cc-wrapper.sh} $ccPath/cpp
       fi
     ''
 
     + optionalString cc.langFortran or false ''
-      wrap ${prefix}gfortran ${preWrap ./cc-wrapper.sh} $ccPath/${prefix}gfortran
+      wrap ${prefix}gfortran ${./cc-wrapper.sh} $ccPath/${prefix}gfortran
       ln -sv ${prefix}gfortran $out/bin/${prefix}g77
       ln -sv ${prefix}gfortran $out/bin/${prefix}f77
     ''
 
     + optionalString cc.langJava or false ''
-      wrap ${prefix}gcj ${preWrap ./cc-wrapper.sh} $ccPath/${prefix}gcj
+      wrap ${prefix}gcj ${./cc-wrapper.sh} $ccPath/${prefix}gcj
     ''
 
     + optionalString cc.langGo or false ''
-      wrap ${prefix}gccgo ${preWrap ./cc-wrapper.sh} $ccPath/${prefix}gccgo
+      wrap ${prefix}gccgo ${./cc-wrapper.sh} $ccPath/${prefix}gccgo
     ''
 
     + optionalString cc.langAda or false ''
-      wrap ${prefix}gnatgcc ${preWrap ./cc-wrapper.sh} $ccPath/${prefix}gnatgcc
+      wrap ${prefix}gnatgcc ${./cc-wrapper.sh} $ccPath/${prefix}gnatgcc
-      wrap ${prefix}gnatmake ${preWrap ./gnat-wrapper.sh} $ccPath/${prefix}gnatmake
+      wrap ${prefix}gnatmake ${./gnat-wrapper.sh} $ccPath/${prefix}gnatmake
-      wrap ${prefix}gnatbind ${preWrap ./gnat-wrapper.sh} $ccPath/${prefix}gnatbind
+      wrap ${prefix}gnatbind ${./gnat-wrapper.sh} $ccPath/${prefix}gnatbind
-      wrap ${prefix}gnatlink ${preWrap ./gnatlink-wrapper.sh} $ccPath/${prefix}gnatlink
+      wrap ${prefix}gnatlink ${./gnatlink-wrapper.sh} $ccPath/${prefix}gnatlink
     ''
 
     + optionalString cc.langVhdl or false ''
@@ -356,7 +327,7 @@ stdenv.mkDerivation {
     ''
 
     + ''
-      substituteAll ${preWrap ./setup-hook.sh} $out/nix-support/setup-hook.tmp
+      substituteAll ${./setup-hook.sh} $out/nix-support/setup-hook.tmp
       cat $out/nix-support/setup-hook.tmp >> $out/nix-support/setup-hook
       rm $out/nix-support/setup-hook.tmp
 
@@ -375,9 +346,9 @@ stdenv.mkDerivation {
     ''
 
     + ''
-      substituteAll ${preWrap ./add-flags.sh} $out/nix-support/add-flags.sh
+      substituteAll ${./add-flags.sh} $out/nix-support/add-flags.sh
-      substituteAll ${preWrap ./add-hardening.sh} $out/nix-support/add-hardening.sh
+      substituteAll ${./add-hardening.sh} $out/nix-support/add-hardening.sh
-      substituteAll ${preWrap ./utils.sh} $out/nix-support/utils.sh
+      substituteAll ${./utils.sh} $out/nix-support/utils.sh
     ''
     + extraBuildCommands;
 

pkgs/build-support/cc-wrapper/gnat-wrapper.sh

@@ -1,15 +1,24 @@
-#! @shell@ -e
+#! @shell@
+set -eu -o pipefail
+shopt -s nullglob
+
+# N.B. Gnat is not used during bootstrapping, so we don't need to
+# worry about the old bash empty array `set -u` workarounds.
+
 path_backup="$PATH"
+
+# phase separation makes this look useless
+# shellcheck disable=SC2157
 if [ -n "@coreutils_bin@" ]; then
     PATH="@coreutils_bin@/bin"
 fi
 
-if [ -n "$NIX_GNAT_WRAPPER_START_HOOK" ]; then
+if [ -z "${NIX_@infixSalt@_GNAT_WRAPPER_FLAGS_SET:-}" ]; then
-    source "$NIX_GNAT_WRAPPER_START_HOOK"
+    source @out@/nix-support/add-flags.sh
 fi
 
-if [ -z "$NIX_GNAT_WRAPPER_FLAGS_SET" ]; then
+if [ -n "$NIX_@infixSalt@_GNAT_WRAPPER_START_HOOK" ]; then
-    source @out@/nix-support/add-flags.sh
+    source "$NIX_@infixSalt@_GNAT_WRAPPER_START_HOOK"
 fi
 
 source @out@/nix-support/utils.sh
@@ -18,7 +27,6 @@ source @out@/nix-support/utils.sh
 # Figure out if linker flags should be passed.  GCC prints annoying
 # warnings when they are not needed.
 dontLink=0
-getVersion=0
 nonFlagArgs=0
 
 for i in "$@"; do
@@ -30,7 +38,7 @@ for i in "$@"; do
         nonFlagArgs=1
     elif [ "$i" = -m32 ]; then
         if [ -e @out@/nix-support/dynamic-linker-m32 ]; then
-            NIX_LDFLAGS="$NIX_LDFLAGS -dynamic-linker $(cat @out@/nix-support/dynamic-linker-m32)"
+            NIX_@infixSalt@_LDFLAGS+=" -dynamic-linker $(< @out@/nix-support/dynamic-linker-m32)"
         fi
     fi
 done
@@ -47,37 +55,33 @@ fi
 
 # Optionally filter out paths not refering to the store.
 params=("$@")
-if [ "$NIX_ENFORCE_PURITY" = 1 -a -n "$NIX_STORE" ]; then
+if [[ "${NIX_ENFORCE_PURITY:-}" = 1 && -n "$NIX_STORE" ]]; then
     rest=()
-    n=0
+    for p in "${params[@]}"; do
-    while [ $n -lt ${#params[*]} ]; do
-        p=${params[n]}
-        p2=${params[$((n+1))]}
         if [ "${p:0:3}" = -L/ ] && badPath "${p:2}"; then
-            skip $p
+            skip "${p:2}"
         elif [ "${p:0:3}" = -I/ ] && badPath "${p:2}"; then
-            skip $p
+            skip "${p:2}"
         elif [ "${p:0:4}" = -aI/ ] && badPath "${p:3}"; then
-            skip $p
+            skip "${p:2}"
         elif [ "${p:0:4}" = -aO/ ] && badPath "${p:3}"; then
-            skip $p
+            skip "${p:2}"
         else
             rest+=("$p")
         fi
-        n=$((n + 1))
     done
     params=("${rest[@]}")
 fi
 
 
 # Clear march/mtune=native -- they bring impurity.
-if [ "$NIX_ENFORCE_NO_NATIVE" = 1 ]; then
+if [ "$NIX_@infixSalt@_ENFORCE_NO_NATIVE" = 1 ]; then
     rest=()
-    for i in "${params[@]}"; do
+    for p in "${params[@]}"; do
-        if [[ "$i" = -m*=native ]]; then
+        if [[ "$p" = -m*=native ]]; then
-            skip $i
+            skip "$p"
         else
-            rest+=("$i")
+            rest+=("$p")
         fi
     done
     params=("${rest[@]}")
@@ -85,38 +89,42 @@ fi
 
 
 # Add the flags for the GNAT compiler proper.
-extraAfter=($NIX_GNATFLAGS_COMPILE)
+extraAfter=($NIX_@infixSalt@_GNATFLAGS_COMPILE)
 extraBefore=()
 
-if [ "`basename $0`x" = "gnatmakex" ]; then
+if [ "$(basename "$0")x" = "gnatmakex" ]; then
-  extraBefore=("--GNATBIND=@out@/bin/gnatbind --GNATLINK=@out@/bin/gnatlink ")
+  extraBefore=("--GNATBIND=@out@/bin/gnatbind" "--GNATLINK=@out@/bin/gnatlink ")
 fi
 
-# Add the flags that should be passed to the linker (and prevent
+#if [ "$dontLink" != 1 ]; then
-# `ld-wrapper' from adding NIX_LDFLAGS again).
+#    # Add the flags that should be passed to the linker (and prevent
-#for i in $NIX_LDFLAGS_BEFORE; do
+#    # `ld-wrapper' from adding NIX_@infixSalt@_LDFLAGS again).
-#    extraBefore=(${extraBefore[@]} "-largs $i")
+#    for i in $NIX_@infixSalt@_LDFLAGS_BEFORE; do
-#done
+#        extraBefore+=("-largs" "$i")
+#    done
+#    for i in $NIX_@infixSalt@_LDFLAGS; do
+#        if [ "${i:0:3}" = -L/ ]; then
+#            extraAfter+=("$i")
+#        else
+#            extraAfter+=("-largs" "$i")
+#        fi
+#    done
+#    export NIX_@infixSalt@_LDFLAGS_SET=1
+#fi
 
 # Optionally print debug info.
-if [ -n "$NIX_DEBUG" ]; then
+if [ -n "${NIX_DEBUG:-}" ]; then
+    echo "extra flags before to @prog@:" >&2
+    printf "  %q\n" "${extraBefore[@]}"  >&2
     echo "original flags to @prog@:" >&2
-  for i in "${params[@]}"; do
+    printf "  %q\n" "${params[@]}" >&2
-      echo "  $i" >&2
+    echo "extra flags after to @prog@:" >&2
-  done
+    printf "  %q\n" "${extraAfter[@]}" >&2
-  echo "extraBefore flags to @prog@:" >&2
-  for i in ${extraBefore[@]}; do
-      echo "  $i" >&2
-  done
-  echo "extraAfter flags to @prog@:" >&2
-  for i in ${extraAfter[@]}; do
-      echo "  $i" >&2
-  done
 fi
 
-if [ -n "$NIX_GNAT_WRAPPER_EXEC_HOOK" ]; then
+if [ -n "$NIX_@infixSalt@_GNAT_WRAPPER_EXEC_HOOK" ]; then
-    source "$NIX_GNAT_WRAPPER_EXEC_HOOK"
+    source "$NIX_@infixSalt@_GNAT_WRAPPER_EXEC_HOOK"
 fi
 
 PATH="$path_backup"
-exec @prog@ ${extraBefore[@]} "${params[@]}" ${extraAfter[@]}
+exec @prog@ "${extraBefore[@]}" "${params[@]}" "${extraAfter[@]}"

pkgs/build-support/cc-wrapper/gnatlink-wrapper.sh

@@ -1,33 +1,40 @@
-#! @shell@ -e
+#! @shell@
+set -eu -o pipefail
+shopt -s nullglob
+
+# N.B. Gnat is not used during bootstrapping, so we don't need to
+# worry about the old bash empty array `set -u` workarounds.
 
 # Add the flags for the GNAT compiler proper.
-extraAfter="--GCC=@out@/bin/gcc"
+extraAfter=("--GCC=@out@/bin/gcc")
 extraBefore=()
 
-# Add the flags that should be passed to the linker (and prevent
+## Add the flags that should be passed to the linker (and prevent
-# `ld-wrapper' from adding NIX_LDFLAGS again).
+## `ld-wrapper' from adding NIX_@infixSalt@_LDFLAGS again).
-#for i in $NIX_LDFLAGS_BEFORE; do
+#for i in $NIX_@infixSalt@_LDFLAGS_BEFORE; do
-#    extraBefore=(${extraBefore[@]} "-largs $i")
+#    extraBefore+=("-largs" "$i")
 #done
+#for i in $NIX_@infixSalt@_LDFLAGS; do
+#    if [ "${i:0:3}" = -L/ ]; then
+#        extraAfter+=("$i")
+#    else
+#        extraAfter+=("-largs" "$i")
+#    fi
+#done
+#export NIX_@infixSalt@_LDFLAGS_SET=1
 
 # Optionally print debug info.
-if [ -n "$NIX_DEBUG" ]; then
+if [ -n "${NIX_DEBUG:-}" ]; then
+    echo "extra flags before to @prog@:" >&2
+    printf "  %q\n" "${extraBefore[@]}"  >&2
     echo "original flags to @prog@:" >&2
-  for i in "$@"; do
+    printf "  %q\n" "$@" >&2
-      echo "  $i" >&2
+    echo "extra flags after to @prog@:" >&2
-  done
+    printf "  %q\n" "${extraAfter[@]}" >&2
-  echo "extraBefore flags to @prog@:" >&2
-  for i in ${extraBefore[@]}; do
-      echo "  $i" >&2
-  done
-  echo "extraAfter flags to @prog@:" >&2
-  for i in ${extraAfter[@]}; do
-      echo "  $i" >&2
-  done
 fi
 
-if [ -n "$NIX_GNAT_WRAPPER_EXEC_HOOK" ]; then
+if [ -n "$NIX_@infixSalt@_GNAT_WRAPPER_EXEC_HOOK" ]; then
-    source "$NIX_GNAT_WRAPPER_EXEC_HOOK"
+    source "$NIX_@infixSalt@_GNAT_WRAPPER_EXEC_HOOK"
 fi
 
-exec @prog@ ${extraBefore[@]} "$@" ${extraAfter[@]}
+exec @prog@ "${extraBefore[@]}" "$@" "${extraAfter[@]}"

pkgs/build-support/cc-wrapper/ld-solaris-wrapper.sh

@@ -1,40 +1,25 @@
 #!@shell@
+set -eu -o pipefail
+shopt -s nullglob
 
-set -e
+declare -a args=("$@")
-set -u
-
 # I've also tried adding -z direct and -z lazyload, but it gave too many problems with C++ exceptions :'(
 # Also made sure libgcc would not be lazy-loaded, as suggested here: https://www.illumos.org/issues/2534#note-3
 #   but still no success.
-cmd="@ld@ -z ignore"
+declare -a argsBefore=(-z ignore) argsAfter=()
-
-args=("$@");
 
 # This loop makes sure all -L arguments are before -l arguments, or ld may complain it cannot find a library.
 # GNU binutils does not have this problem:
 #   http://stackoverflow.com/questions/5817269/does-the-order-of-l-and-l-options-in-the-gnu-linker-matter
-i=0;
+while (( $# )); do
-while [[ $i -lt $# ]]; do
     case "${args[$i]}" in
-        -L)  cmd="$cmd ${args[$i]} ${args[($i+1)]}"; i=($i+1); ;;
+        -L)   argsBefore+=("$1" "$2"); shift ;;
-        -L*) cmd="$cmd ${args[$i]}" ;;
+        -L?*) argsBefore+=("$1") ;;
-        *)   ;;
+        *)    argsAfter+=("$1") ;;
     esac
-    i=($i+1);
+    shift
-done
-
-i=0;
-while [[ $i -lt $# ]]; do
-    case "${args[$i]}" in
-        -L)  i=($i+1); ;;
-        -L*) ;;
-        *)   cmd="$cmd ${args[$i]}" ;;
-    esac
-    i=($i+1);
 done
 
 # Trace:
 set -x
-exec $cmd
+exec "@ld@" "${argsBefore[@]}" "${argsAfter[@]}"
-
-exit 0

pkgs/build-support/cc-wrapper/ld-wrapper.sh

@@ -1,16 +1,21 @@
-#! @shell@ -e
+#! @shell@
+set -eu -o pipefail
 shopt -s nullglob
+
 path_backup="$PATH"
+
+# phase separation makes this look useless
+# shellcheck disable=SC2157
 if [ -n "@coreutils_bin@" ]; then
     PATH="@coreutils_bin@/bin"
 fi
 
-if [ -n "$NIX_LD_WRAPPER_START_HOOK" ]; then
+if [ -z "${NIX_CC_WRAPPER_@infixSalt@_FLAGS_SET:-}" ]; then
-    source "$NIX_LD_WRAPPER_START_HOOK"
+    source @out@/nix-support/add-flags.sh
 fi
 
-if [ -z "$NIX_CC_WRAPPER_FLAGS_SET" ]; then
+if [ -n "$NIX_LD_WRAPPER_@infixSalt@_START_HOOK" ]; then
-    source @out@/nix-support/add-flags.sh
+    source "$NIX_LD_WRAPPER_@infixSalt@_START_HOOK"
 fi
 
 source @out@/nix-support/utils.sh
@@ -18,14 +23,14 @@ source @out@/nix-support/utils.sh
 
 # Optionally filter out paths not refering to the store.
 expandResponseParams "$@"
-if [ "$NIX_ENFORCE_PURITY" = 1 -a -n "$NIX_STORE" \
+if [[ "${NIX_ENFORCE_PURITY:-}" = 1 && -n "${NIX_STORE:-}"
-        -a \( -z "$NIX_IGNORE_LD_THROUGH_GCC" -o -z "$NIX_LDFLAGS_SET" \) ]; then
+        && ( -z "$NIX_@infixSalt@_IGNORE_LD_THROUGH_GCC" || -z "${NIX_@infixSalt@_LDFLAGS_SET:-}" ) ]]; then
     rest=()
     nParams=${#params[@]}
     declare -i n=0
-    while [ $n -lt $nParams ]; do
+    while [ "$n" -lt "$nParams" ]; do
         p=${params[n]}
-        p2=${params[$((n+1))]}
+        p2=${params[n+1]:-} # handle `p` being last one
         if [ "${p:0:3}" = -L/ ] && badPath "${p:2}"; then
             skip "${p:2}"
         elif [ "$p" = -L ] && badPath "$p2"; then
@@ -49,27 +54,30 @@ if [ "$NIX_ENFORCE_PURITY" = 1 -a -n "$NIX_STORE" \
     params=("${rest[@]}")
 fi
 
-LD=@prog@
 source @out@/nix-support/add-hardening.sh
 
-extra=("${hardeningLDFlags[@]}")
+extraAfter=("${hardeningLDFlags[@]}")
 extraBefore=()
 
-if [ -z "$NIX_LDFLAGS_SET" ]; then
+if [ -z "${NIX_@infixSalt@_LDFLAGS_SET:-}" ]; then
-    extra+=($NIX_LDFLAGS)
+    extraAfter+=($NIX_@infixSalt@_LDFLAGS)
-    extraBefore+=($NIX_LDFLAGS_BEFORE)
+    extraBefore+=($NIX_@infixSalt@_LDFLAGS_BEFORE)
 fi
 
-extra+=($NIX_LDFLAGS_AFTER $NIX_LDFLAGS_HARDEN)
+extraAfter+=($NIX_@infixSalt@_LDFLAGS_AFTER $NIX_@infixSalt@_LDFLAGS_HARDEN)
 
 declare -a libDirs
 declare -A libs
 relocatable=
 
 # Find all -L... switches for rpath, and relocatable flags for build id.
-if [ "$NIX_DONT_SET_RPATH" != 1 ] || [ "$NIX_SET_BUILD_ID" = 1 ]; then
+if [ "$NIX_@infixSalt@_DONT_SET_RPATH" != 1 ] || [ "$NIX_@infixSalt@_SET_BUILD_ID" = 1 ]; then
     prev=
-    for p in "${params[@]}" "${extra[@]}"; do
+    # Old bash thinks empty arrays are undefined, ugh, so temporarily disable
+    # `set -u`.
+    set +u
+    for p in "${extraBefore[@]}" "${params[@]}" "${extraAfter[@]}"; do
+        set -u
         case "$prev" in
             -L)
                 libDirs+=("$p")
@@ -88,7 +96,7 @@ if [ "$NIX_DONT_SET_RPATH" != 1 ] || [ "$NIX_SET_BUILD_ID" = 1 ]; then
                     -l?*)
                         libs["lib${p:2}.so"]=1
                         ;;
-                    "$NIX_STORE"/*.so | "$NIX_STORE"/*.so.*)
+                    "${NIX_STORE:-}"/*.so | "${NIX_STORE:-}"/*.so.*)
                         # This is a direct reference to a shared library.
                         libDirs+=("${p%/*}")
                         libs["${p##*/}"]=1
@@ -104,7 +112,7 @@ fi
 
 
 # Add all used dynamic libraries to the rpath.
-if [ "$NIX_DONT_SET_RPATH" != 1 ]; then
+if [ "$NIX_@infixSalt@_DONT_SET_RPATH" != 1 ]; then
     # For each directory in the library search path (-L...),
     # see if it contains a dynamic library used by a -l... flag.  If
     # so, add the directory to the rpath.
@@ -115,20 +123,23 @@ if [ "$NIX_DONT_SET_RPATH" != 1 ]; then
         if [[ "$dir" =~ [/.][/.] ]] && dir2=$(readlink -f "$dir"); then
             dir="$dir2"
         fi
-        if [ "${rpaths[$dir]}" ] || [[ "$dir" != "$NIX_STORE"/* ]]; then
+        if [ -n "${rpaths[$dir]:-}" ] || [[ "$dir" != "${NIX_STORE:-}"/* ]]; then
             # If the path is not in the store, don't add it to the rpath.
             # This typically happens for libraries in /tmp that are later
             # copied to $out/lib.  If not, we're screwed.
             continue
         fi
-        for path in "$dir"/lib*.so; do
+        for path in "$dir"/*; do
             file="${path##*/}"
-            if [ "${libs[$file]}" ]; then
+            if [ "${libs[$file]:-}" ]; then
-                libs["$file"]=
+                # This library may have been provided by a previous directory,
-                if [ ! "${rpaths[$dir]}" ]; then
+                # but if that library file is inside an output of the current
+                # derivation, it can be deleted after this compilation and
+                # should be found in a later directory, so we add all
+                # directories that contain any of the libraries to rpath.
                 rpaths["$dir"]=1
-                    extra+=(-rpath "$dir")
+                extraAfter+=(-rpath "$dir")
-                fi
+                break
             fi
         done
     done
@@ -137,22 +148,27 @@ fi
 
 # Only add --build-id if this is a final link. FIXME: should build gcc
 # with --enable-linker-build-id instead?
-if [ "$NIX_SET_BUILD_ID" = 1 ] && [ ! "$relocatable" ]; then
+if [ "$NIX_@infixSalt@_SET_BUILD_ID" = 1 ] && [ ! "$relocatable" ]; then
-    extra+=(--build-id)
+    extraAfter+=(--build-id)
 fi
 
 
 # Optionally print debug info.
-if [ -n "$NIX_DEBUG" ]; then
+if [ -n "${NIX_DEBUG:-}" ]; then
+    set +u # Old bash workaround, see above.
+    echo "extra flags before to @prog@:" >&2
+    printf "  %q\n" "${extraBefore[@]}"  >&2
     echo "original flags to @prog@:" >&2
     printf "  %q\n" "${params[@]}" >&2
-    echo "extra flags to @prog@:" >&2
+    echo "extra flags after to @prog@:" >&2
-    printf "  %q\n" "${extraBefore[@]}" "${extra[@]}" >&2
+    printf "  %q\n" "${extraAfter[@]}" >&2
+    set -u
 fi
 
-if [ -n "$NIX_LD_WRAPPER_EXEC_HOOK" ]; then
+if [ -n "$NIX_LD_WRAPPER_@infixSalt@_EXEC_HOOK" ]; then
-    source "$NIX_LD_WRAPPER_EXEC_HOOK"
+    source "$NIX_LD_WRAPPER_@infixSalt@_EXEC_HOOK"
 fi
 
 PATH="$path_backup"
-exec @prog@ "${extraBefore[@]}" "${params[@]}" "${extra[@]}"
+set +u # Old bash workaround, see above.
+exec @prog@ "${extraBefore[@]}" "${params[@]}" "${extraAfter[@]}"

pkgs/build-support/cc-wrapper/setup-hook.sh

@@ -1,51 +1,142 @@
-addCVars () {
+# CC Wrapper hygiene
-    if [ -d $1/include ]; then
+#
-        export NIX_CFLAGS_COMPILE+=" ${ccIncludeFlag:--isystem} $1/include"
+# For at least cross compilation, we need to depend on multiple cc-wrappers at
+# once---specifically up to one per sort of dependency. This follows from having
+# different tools targeting different platforms, and different flags for those
+# tools. For example:
+#
+#   # Flags for compiling (whether or not linking) C code for the...
+#   NIX_BUILD_CFLAGS_COMPILE  # ...build platform
+#   NIX_CFLAGS_COMPILE        # ...host platform
+#   NIX_TARGET_CFLAGS_COMPILE # ...target platform
+#
+# Notice that these platforms are the 3 *relative* to the package using
+# cc-wrapper, not absolute like `x86_64-pc-linux-gnu`.
+#
+# The simplest solution would be to have separate cc-wrappers per (3 intended
+# use-cases * n absolute concrete platforms). For the use-case axis, we would
+# @-splice in 'BUILD_' '' 'TARGET_' to use the write environment variables when
+# building the cc-wrapper, and likewise prefix the binaries' names so they didn't
+# clobber each other on the PATH. But the need for 3x cc-wrappers, along with
+# non-standard name prefixes, is annoying and liable to break packages' build
+# systems.
+#
+# Instead, we opt to have just one cc-wrapper per absolute platform. Matching
+# convention, the binaries' names can just be prefixed with their target
+# platform. On the other hand, that means packages will depend on not just
+# multiple cc-wrappers, but the exact same cc-wrapper derivation multiple ways.
+# That means the exact same cc-wrapper derivation must be able to avoid
+# conflicting with itself, despite the fact that `setup-hook.sh`, the `addCvars`
+# function, and `add-flags.sh` are all communicating with each other with
+# environment variables. Yuck.
+#
+# The basic strategy is:
+#
+#  - Everyone exclusively *adds information* to relative-platform-specific
+#    environment variables, like `NIX_TARGET_CFLAGS_COMPILE`, to communicate
+#    with the wrapped binaries.
+#
+#  - The wrapped binaries will exclusively *read* cc-wrapper-derivation-specific
+#    environment variables distinguished with with `infixSalt`, like
+#    `NIX_@infixSalt@_CFLAGS_COMPILE`.
+#
+#  - `add-flags`, beyond its old task of reading extra flags stuck inside the
+#    cc-wrapper derivation, will convert the relative-platform-specific
+#    variables to cc-wrapper-derivation-specific variables. This conversion is
+#    the only time all but one of the cc-wrapper-derivation-specific variables
+#    are set.
+#
+# This ensures the flow of information is exclusive from
+# relative-platform-specific variables to cc-wrapper-derivation-specific
+# variables. This allows us to support the general case of a many--many relation
+# between relative platforms and cc-wrapper derivations.
+#
+# For more details, read the individual files where the mechanisms used to
+# accomplish this will be individually documented.
+
+
+# It's fine that any other cc-wrapper will redefine this. Bash functions close
+# over no state, and there's no @-substitutions within, so any redefined
+# function is guaranteed to be exactly the same.
+ccWrapper_addCVars () {
+    # The `depOffset` describes how the platforms of the dependencies are slid
+    # relative to the depending package. It is brought into scope of the
+    # environment hook defined as the role of the dependency being applied.
+    case $depOffset in
+        -1) local role='BUILD_' ;;
+        0)  local role='' ;;
+        1)  local role='TARGET_' ;;
+        *)  echo "cc-wrapper: Error: Cannot be used with $depOffset-offset deps, " >2;
+            return 1 ;;
+    esac
+
+    if [[ -d "$1/include" ]]; then
+        export NIX_${role}CFLAGS_COMPILE+=" ${ccIncludeFlag:--isystem} $1/include"
     fi
 
-    if [ -d $1/lib64 -a ! -L $1/lib64 ]; then
+    if [[ -d "$1/lib64" && ! -L "$1/lib64" ]]; then
-        export NIX_LDFLAGS+=" -L$1/lib64"
+        export NIX_${role}LDFLAGS+=" -L$1/lib64"
     fi
 
-    if [ -d $1/lib ]; then
+    if [[ -d "$1/lib" ]]; then
-        export NIX_LDFLAGS+=" -L$1/lib"
+        export NIX_${role}LDFLAGS+=" -L$1/lib"
     fi
 
-    if test -d $1/Library/Frameworks; then
+    if [[ -d "$1/Library/Frameworks" ]]; then
-        export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -F$1/Library/Frameworks"
+        export NIX_${role}CFLAGS_COMPILE+=" -F$1/Library/Frameworks"
     fi
 }
 
-envHooks+=(addCVars)
+# Since the same cc-wrapper derivation can be depend on in multiple ways, we
+# need to accumulate *each* role (i.e. target platform relative the depending
+# derivation) in which the cc-wrapper derivation is used.
+# `NIX_CC_WRAPPER_@infixSalt@_TARGET_*` tracks this (needs to be an exported env
+# var so can't use fancier data structures).
+#
+# We also need to worry about what role is being added on *this* invocation of
+# setup-hook, which `role` tracks.
+if [ -n "${crossConfig:-}" ]; then
+    export NIX_CC_WRAPPER_@infixSalt@_TARGET_BUILD=1
+    role="BUILD_"
+else
+    export NIX_CC_WRAPPER_@infixSalt@_TARGET_HOST=1
+    role=""
+fi
 
-# Note: these come *after* $out in the PATH (see setup.sh).
+# Eventually the exact sort of env-hook we create will depend on the role. This
+# is because based on what relative platform we are targeting, we use different
+# dependencies.
+envHooks+=(ccWrapper_addCVars)
 
+# Note 1: these come *after* $out in the PATH (see setup.sh).
+# Note 2: phase separation makes this look useless to shellcheck.
+
+# shellcheck disable=SC2157
 if [ -n "@cc@" ]; then
     addToSearchPath _PATH @cc@/bin
 fi
 
+# shellcheck disable=SC2157
 if [ -n "@binutils_bin@" ]; then
     addToSearchPath _PATH @binutils_bin@/bin
 fi
 
+# shellcheck disable=SC2157
 if [ -n "@libc_bin@" ]; then
     addToSearchPath _PATH @libc_bin@/bin
 fi
 
+# shellcheck disable=SC2157
 if [ -n "@coreutils_bin@" ]; then
     addToSearchPath _PATH @coreutils_bin@/bin
 fi
 
-if [ -z "$crossConfig" ]; then
+# Export tool environment variables so various build systems use the right ones.
-  ENV_PREFIX=""
-else
-  ENV_PREFIX="BUILD_"
-fi
 
-export NIX_${ENV_PREFIX}CC=@out@
+export NIX_${role}CC=@out@
 
-export ${ENV_PREFIX}CC=@named_cc@
+export ${role}CC=@named_cc@
-export ${ENV_PREFIX}CXX=@named_cxx@
+export ${role}CXX=@named_cxx@
 
 for CMD in \
     cpp \
@@ -54,9 +145,9 @@ do
     if
         PATH=$_PATH type -p "@binPrefix@$CMD" > /dev/null
     then
-        export "${ENV_PREFIX}$(echo "$CMD" | tr "[:lower:]" "[:upper:]")=@binPrefix@${CMD}";
+        export "${role}$(echo "$CMD" | tr "[:lower:]" "[:upper:]")=@binPrefix@${CMD}";
     fi
 done
 
-# No local scope available for sourced files
+# No local scope in sourced file
-unset ENV_PREFIX
+unset role

pkgs/build-support/cc-wrapper/utils.sh

@@ -1,5 +1,5 @@
 skip () {
-    if [ -n "$NIX_DEBUG" ]; then
+    if [ -n "${NIX_DEBUG:-}" ]; then
         echo "skipping impure path $1" >&2
     fi
 }
@@ -24,11 +24,15 @@ badPath() {
 }
 
 expandResponseParams() {
-    params=("$@")
+    declare -g params=("$@")
     local arg
     for arg in "$@"; do
         if [[ "$arg" == @* ]]; then
+            # phase separation makes this look useless
+            # shellcheck disable=SC2157
             if [ -n "@expandResponseParams@" ]; then
+                # params is used by caller
+                #shellcheck disable=SC2034
                 readarray -d '' params < <("@expandResponseParams@" "$@")
                 return 0
             else

pkgs/build-support/setup-hooks/die.sh

@@ -0,0 +1,21 @@
+# Exit with backtrace and error message
+#
+# Usage: die "Error message"
+die() {
+    # Let us be a little sloppy with errors, because otherwise the final
+    # invocation of `caller` below will cause the script to exit.
+    set +e
+
+    # Print our error message
+    printf "\nBuilder called die: %b\n" "$*"
+    printf "Backtrace:\n"
+
+    # Print a backtrace.
+    local frame=0
+    while caller $frame; do
+        ((frame++));
+    done
+    printf "\n"
+
+    exit 1
+}

pkgs/build-support/setup-hooks/make-wrapper.sh

@@ -1,3 +1,12 @@
+# Assert that FILE exists and is executable
+#
+# assertExecutable FILE
+assertExecutable() {
+    local file="$1"
+    [[ -f "${file}" && -x "${file}" ]] || \
+        die "Cannot wrap ${file} because it is not an executable file"
+}
+
 # construct an executable file that wraps the actual executable
 # makeWrapper EXECUTABLE ARGS
 
@@ -24,6 +33,8 @@ makeWrapper() {
     local params varName value command separator n fileNames
     local argv0 flagsBefore flags
 
+    assertExecutable "${original}"
+
     mkdir -p "$(dirname "$wrapper")"
 
     echo "#! $SHELL -e" > "$wrapper"
@@ -32,26 +43,20 @@ makeWrapper() {
     for ((n = 2; n < ${#params[*]}; n += 1)); do
         p="${params[$n]}"
 
-        if test "$p" = "--set"; then
+        if [[ "$p" == "--set" ]]; then
             varName="${params[$((n + 1))]}"
             value="${params[$((n + 2))]}"
             n=$((n + 2))
             echo "export $varName=\"$value\"" >> "$wrapper"
-        fi
+        elif [[ "$p" == "--unset" ]]; then
-
-        if test "$p" = "--unset"; then
             varName="${params[$((n + 1))]}"
             n=$((n + 1))
             echo "unset $varName" >> "$wrapper"
-        fi
+        elif [[ "$p" == "--run" ]]; then
-
-        if test "$p" = "--run"; then
             command="${params[$((n + 1))]}"
             n=$((n + 1))
             echo "$command" >> "$wrapper"
-        fi
+        elif [[ ("$p" == "--suffix") || ("$p" == "--prefix") ]]; then
-
-        if test "$p" = "--suffix" -o "$p" = "--prefix"; then
             varName="${params[$((n + 1))]}"
             separator="${params[$((n + 2))]}"
             value="${params[$((n + 3))]}"
@@ -63,9 +68,7 @@ makeWrapper() {
                     echo "export $varName=$value\${$varName:+$separator}\$$varName" >> "$wrapper"
                 fi
             fi
-        fi
+        elif [[ "$p" == "--suffix-each" ]]; then
-
-        if test "$p" = "--suffix-each"; then
             varName="${params[$((n + 1))]}"
             separator="${params[$((n + 2))]}"
             values="${params[$((n + 3))]}"
@@ -73,9 +76,7 @@ makeWrapper() {
             for value in $values; do
                 echo "export $varName=\$$varName\${$varName:+$separator}$value" >> "$wrapper"
             done
-        fi
+        elif [[ ("$p" == "--suffix-contents") || ("$p" == "--prefix-contents") ]]; then
-
-        if test "$p" = "--suffix-contents" -o "$p" = "--prefix-contents"; then
             varName="${params[$((n + 1))]}"
             separator="${params[$((n + 2))]}"
             fileNames="${params[$((n + 3))]}"
@@ -87,17 +88,15 @@ makeWrapper() {
                     echo "export $varName=$(cat "$fileName")\${$varName:+$separator}\$$varName" >> "$wrapper"
                 fi
             done
-        fi
+        elif [[ "$p" == "--add-flags" ]]; then
-
-        if test "$p" = "--add-flags"; then
             flags="${params[$((n + 1))]}"
             n=$((n + 1))
             flagsBefore="$flagsBefore $flags"
-        fi
+        elif [[ "$p" == "--argv0" ]]; then
-
-        if test "$p" = "--argv0"; then
             argv0="${params[$((n + 1))]}"
             n=$((n + 1))
+        else
+            die "makeWrapper doesn't understand the arg $p"
         fi
     done
 
@@ -131,6 +130,9 @@ filterExisting() {
 wrapProgram() {
     local prog="$1"
     local hidden
+
+    assertExecutable "${prog}"
+
     hidden="$(dirname "$prog")/.$(basename "$prog")"-wrapped
     while [ -e "$hidden" ]; do
       hidden="${hidden}_"
@@ -138,5 +140,5 @@ wrapProgram() {
     mv "$prog" "$hidden"
     # Silence warning about unexpanded $0:
     # shellcheck disable=SC2016
-    makeWrapper "$hidden" "$prog" --argv0 '$0' "$@"
+    makeWrapper "$hidden" "$prog" --argv0 '$0' "${@:2}"
 }

pkgs/build-support/setup-hooks/wrap-gapps-hook.sh

@@ -39,7 +39,7 @@ wrapGAppsHook() {
     targetDirs=( "${prefix}/bin" "${prefix}/libexec" )
     for targetDir in "${targetDirs[@]}"; do
       if [[ -d "${targetDir}" ]]; then
-        find "${targetDir}" -type f -executable -print0 \
+        find -L "${targetDir}" -type f -executable -print0 \
           | while IFS= read -r -d '' file; do
           echo "Wrapping program ${file}"
           wrapProgram "${file}" "${gappsWrapperArgs[@]}"

pkgs/data/fonts/andagii/default.nix

@@ -1,22 +1,18 @@
 { stdenv, fetchzip }:
 
-stdenv.mkDerivation rec {
+let
-  name = "andagii-${version}";
   version = "1.0.2";
+in fetchzip {
+  name = "andagii-${version}";
 
-  src = fetchzip {
   url = http://www.i18nguy.com/unicode/andagii.zip;
-    sha256 = "0a0c43y1fd5ksj50axhng7p00kgga0i15p136g68p35wj7kh5g2k";
-    stripRoot = false;
   curlOpts = "--user-agent 'Mozilla/5.0'";
-  };
+  postFetch = ''
-
+    unzip $downloadedFile
-  phases = [ "unpackPhase" "installPhase" ];
-
-  installPhase = ''
     mkdir -p $out/share/fonts/truetype
     cp -v ANDAGII_.TTF $out/share/fonts/truetype/andagii.ttf
   '';
+  sha256 = "0j5kf2fmyqgnf5ji6h0h79lq9n9d85hkfrr4ya8hqj4gwvc0smb2";
 
   # There are multiple claims that the font is GPL, so I include the
   # package; but I cannot find the original source, so use it on your

pkgs/data/fonts/anonymous-pro/default.nix

@@ -1,23 +1,17 @@
-{ stdenv, fetchurl, unzip }:
+{ stdenv, fetchzip }:
 
-stdenv.mkDerivation rec {
+let
-  name = "anonymousPro-${version}";
   version = "1.002";
+in fetchzip rec {
+  name = "anonymousPro-${version}";
 
-  src = fetchurl {
   url = "http://www.marksimonson.com/assets/content/fonts/AnonymousPro-${version}.zip";
-    sha256 = "1asj6lykvxh46czbal7ymy2k861zlcdqpz8x3s5bbpqwlm3mhrl6";
+  postFetch = ''
-  };
+    mkdir -p $out/share/{doc,fonts}
-
+    unzip -j $downloadedFile \*.ttf                           -d $out/share/fonts/truetype
-  nativeBuildInputs = [ unzip ];
+    unzip -j $downloadedFile \*.txt                           -d "$out/share/doc/${name}"
-  phases = [ "unpackPhase" "installPhase" ];
-
-  installPhase = ''
-    mkdir -p $out/share/fonts/truetype
-    mkdir -p $out/share/doc/${name}
-    find . -name "*.ttf" -exec cp -v {} $out/share/fonts/truetype \;
-    find . -name "*.txt" -exec cp -v {} $out/share/doc/${name} \;
   '';
+  sha256 = "05rgzag38qc77b31sm5i2vwwrxbrvwzfsqh3slv11skx36pz337f";
 
   meta = with stdenv.lib; {
     homepage = http://www.marksimonson.com/fonts/view/anonymous-pro;

pkgs/data/fonts/arkpandora/default.nix

@@ -1,21 +1,23 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, unzip }:
-stdenv.mkDerivation rec {
+
-  name = "arkpandora-${version}";
+let
-  version = "2.04";
+  version = "2.04";
+in fetchurl {
+  name = "arkpandora-${version}";
 
-  src = fetchurl {
   urls = [
-      "ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/distfiles/ttf-arkpandora-${version}.tgz"
     "http://distcache.FreeBSD.org/ports-distfiles/ttf-arkpandora-${version}.tgz"
+    "ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/distfiles/ttf-arkpandora-${version}.tgz"
     "http://www.users.bigpond.net.au/gavindi/ttf-arkpandora-${version}.tgz"
   ];
-    sha256 = "16mfxwlgn6vs3xn00hha5dnmz6bhjiflq138y4zcq3yhk0y9bz51";
+  downloadToTemp = true;
-  };
+  recursiveHash = true;
-
+  postFetch = ''
-  installPhase = ''
+    tar -xzvf $downloadedFile --strip-components=1
     mkdir -p $out/share/fonts/truetype
     cp *.ttf $out/share/fonts/truetype
   '';
+  sha256 = "177k0fbs0787al0snkl8w68d2qkg7snnnq6qp28j9s98vaabs04k";
 
   meta = {
     description = "Font, metrically identical to Arial and Times New Roman";

pkgs/data/fonts/arphic/default.nix

@@ -1,27 +1,23 @@
-{ stdenv, fetchurl, mkfontscale, mkfontdir }:
+{ stdenv, fetchzip, mkfontscale, mkfontdir }:
 
-{
+let
-  arphic-ukai = stdenv.mkDerivation rec {
+  version = "0.2.20080216.2";
+in {
+  arphic-ukai = fetchzip {
     name = "arphic-ukai-${version}";
 
-    version = "0.2.20080216.2";
-
-    src = fetchurl {
     url = "http://archive.ubuntu.com/ubuntu/pool/main/f/fonts-arphic-ukai/fonts-arphic-ukai_${version}.orig.tar.bz2";
-      sha256 = "1lp3i9m6x5wrqjkh1a8vpyhmsrhvsa2znj2mx13qfkwza5rqv5ml";
-    };
 
-    buildInputs = [ mkfontscale mkfontdir ];
+    postFetch = ''
-
+      tar -xjvf $downloadedFile --strip-components=1
-    phases = [ "unpackPhase" "installPhase" ];
-
-    installPhase = ''
       install -D -v ukai.ttc $out/share/fonts/truetype/arphic-ukai.ttc
       cd $out/share/fonts
-      mkfontdir
+      ${mkfontdir}/bin/mkfontdir
-      mkfontscale
+      ${mkfontscale}/bin/mkfontscale
     '';
 
+    sha256 = "0xi5ycm7ydzpn7cqxv1kcj9vd70nr9wn8v27hmibyjc25y2qdmzl";
+
     meta = with stdenv.lib; {
       description = "CJK Unicode font Kai style";
       homepage = https://www.freedesktop.org/wiki/Software/CJKUnifonts/;
@@ -32,27 +28,21 @@
     };
   };
 
-  arphic-uming = stdenv.mkDerivation rec {
+  arphic-uming = fetchzip {
     name = "arphic-uming-${version}";
 
-    version = "0.2.20080216.2";
-
-    src = fetchurl {
     url = "http://archive.ubuntu.com/ubuntu/pool/main/f/fonts-arphic-uming/fonts-arphic-uming_${version}.orig.tar.bz2";
-      sha256 = "1ny11n380vn7sryvy1g3a83y3ll4h0jf9wgnrx55nmksx829xhg3";
-    };
 
-    buildInputs = [ mkfontscale mkfontdir ];
+    postFetch = ''
-
+      tar -xjvf $downloadedFile --strip-components=1
-    phases = [ "unpackPhase" "installPhase" ];
-
-    installPhase = ''
       install -D -v uming.ttc $out/share/fonts/truetype/arphic-uming.ttc
       cd $out/share/fonts
-      mkfontdir
+      ${mkfontdir}/bin/mkfontdir
-      mkfontscale
+      ${mkfontscale}/bin/mkfontscale
     '';
 
+    sha256 = "16jybvj1cxamm682caj6nsm6l5c60x9mgchp1l2izrw2rvc8x38d";
+
     meta = with stdenv.lib; {
       description = "CJK Unicode font Ming style";
       homepage = https://www.freedesktop.org/wiki/Software/CJKUnifonts/;

pkgs/data/fonts/aurulent-sans/default.nix

@@ -1,21 +1,14 @@
-{stdenv, fetchgit}:
+{stdenv, fetchzip}:
 
-stdenv.mkDerivation rec {
+fetchzip rec {
   name = "aurulent-sans-0.1";
 
-  src = fetchgit {
+  url = "https://github.com/deepfire/hartke-aurulent-sans/archive/${name}.zip";
-    url = "https://github.com/deepfire/hartke-aurulent-sans.git";
+  postFetch = ''
-    rev = "refs/tags/${name}";
+    mkdir -p $out/share/fonts
-    sha256 = "01hvpvbrks40g9k1xr2f1gxnd5wd0sxidgfbwrm94pdi1a36xxrk";
+    unzip -j $downloadedFile \*.otf -d $out/share/fonts/opentype
-  };
-
-  dontBuild = true;
-
-  installPhase = ''
-    fontDir=$out/share/fonts/opentype
-    mkdir -p $fontDir
-    cp *.otf $fontDir
   '';
+  sha256 = "1l60psfv9x0x9qx9vp1qnhmck7a7kks385m5ycrd3d91irz1j5li";
 
   meta = {
     description = "Aurulent Sans";

pkgs/data/fonts/babelstone-han/default.nix

@@ -1,22 +1,16 @@
-{stdenv, fetchurl, unzip}:
+{stdenv, fetchzip}:
 
-stdenv.mkDerivation rec {
+let
+  version = "10.0.0";
+in fetchzip {
   name = "babelstone-han-${version}";
-  version = "9.0.2";
 
-  src = fetchurl {
+  url = http://www.babelstone.co.uk/Fonts/0816/BabelStoneHan.zip;
-    url = "http://www.babelstone.co.uk/Fonts/8672/BabelStoneHan.zip";
+  postFetch = ''
-    sha256 = "09zlrp3mqdsbxpq4sssd8gj5isnxfbr56pcdp7mnr27nv4pvp6ha";
-  };
-
-  buildInputs = [ unzip ];
-
-  sourceRoot = ".";
-
-  installPhase = ''
     mkdir -p $out/share/fonts/truetype
-    cp -v *.ttf $out/share/fonts/truetype
+    unzip $downloadedFile '*.ttf' -d $out/share/fonts/truetype
   '';
+  sha256 = "0648hv5c1hq3bq7mlk7bnmflzzqj4wh137bjqyrwj5hy3nqzvl5r";
 
   meta = with stdenv.lib; {
     description = "Unicode CJK font with over 32600 Han characters";

pkgs/data/fonts/baekmuk-ttf/default.nix

@@ -1,24 +1,16 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchzip }:
 
-stdenv.mkDerivation rec {
+fetchzip rec {
   name = "baekmuk-ttf-2.2";
 
-  src = fetchurl {
   url = "http://kldp.net/baekmuk/release/865-${name}.tar.gz";
-    sha256 = "10hqspl70h141ywz1smlzdanlx9vwgsp1qrcjk68fn2xnpzpvaq8";
+  postFetch = ''
-  };
+    tar -xzvf $downloadedFile --strip-components=1
-
+    mkdir -p $out/share/fonts $out/share/doc/${name}
-  dontBuild = true;
+    cp ttf/*.ttf  $out/share/fonts
-
+    cp COPYRIGHT* $out/share/doc/${name}
-  installPhase = let
-    fonts_dir = "$out/share/fonts";
-    doc_dir = "$out/share/doc/${name}";
-  in ''
-    mkdir -pv ${fonts_dir}
-    mkdir -pv ${doc_dir}
-    cp ttf/*.ttf ${fonts_dir}
-    cp COPYRIGHT* ${doc_dir}
   '';
+  sha256 = "1jgsvack1l14q8lbcv4qhgbswi30mf045k37rl772hzcmx0r206g";
 
   meta = {
     description = "Korean font";

pkgs/data/fonts/bakoma-ttf/default.nix

@@ -1,20 +1,18 @@
-{stdenv, fetchurl}:
+{stdenv, fetchzip}:
 
-stdenv.mkDerivation {
+fetchzip {
   name = "bakoma-ttf";
 
-  src = fetchurl {
+  url = http://tarballs.nixos.org/sha256/1j1y3cq6ys30m734axc0brdm2q9n2as4h32jws15r7w5fwr991km;
-    url = http://tarballs.nixos.org/bakoma-ttf.tar.bz2;
-    sha256 = "1j1y3cq6ys30m734axc0brdm2q9n2as4h32jws15r7w5fwr991km";
-  };
 
-  dontBuild = true;
+  postFetch = ''
-
+    tar xjvf $downloadedFile --strip-components=1
-  installPhase = ''
     mkdir -p $out/share/fonts/truetype
     cp ttf/*.ttf $out/share/fonts/truetype
   '';
 
+  sha256 = "0g7i723n00cqx2va05z1h6v3a2ar69gqw4hy6pjj7m0ml906rngc";
+
   meta = {
     description = "TrueType versions of the Computer Modern and AMS TeX Fonts";
     homepage = http://www.ctan.org/tex-archive/fonts/cm/ps-type1/bakoma/ttf/;

pkgs/data/fonts/cabin/default.nix

@@ -1,22 +1,18 @@
-{ stdenv, fetchFromGitHub }:
+{ stdenv, fetchzip }:
 
-stdenv.mkDerivation rec {
+fetchzip rec {
   name = "cabin-1.005";
 
-  src = fetchFromGitHub {
+  url = https://github.com/impallari/Cabin/archive/982839c790e9dc57c343972aa34c51ed3b3677fd.zip;
-    owner = "impallari";
-    repo = "Cabin";
-    rev = "982839c790e9dc57c343972aa34c51ed3b3677fd";
-    sha256 = "16v7spviphvdh2rrr8klv11lc9hxphg12ddf0qs7xdx801ri0ppn";
-  };
 
-  installPhase = ''
+  postFetch = ''
-    mkdir -p $out/share/fonts/opentype
+    mkdir -p $out/share/{doc,fonts}
-    mkdir -p $out/share/doc/${name}
+    unzip -j $downloadedFile \*.otf                    -d $out/share/fonts/opentype
-    cp -v "fonts/OTF/"*.otf $out/share/fonts/opentype/
+    unzip -j $downloadedFile \*README.md \*FONTLOG.txt -d "$out/share/doc/${name}"
-    cp -v README.md FONTLOG.txt $out/share/doc/${name}
   '';
 
+  sha256 = "1ax5c2iab48qsk9zn3gjvqaib2lnlm25f1wr0aysf5ngw0y0jkrd";
+
   meta = with stdenv.lib; {
     description = "A humanist sans with 4 weights and true italics";
     longDescription = ''

pkgs/data/fonts/caladea/default.nix

@@ -1,22 +1,19 @@
-{stdenv, fetchurl}:
+{stdenv, fetchzip}:
 
-stdenv.mkDerivation rec {
+let
-  name = "caladea-${version}";
   version = "20130214";
+in fetchzip rec {
+  name = "caladea-${version}";
 
-  src = fetchurl {
   url = "https://commondatastorage.googleapis.com/chromeos-localmirror/distfiles/crosextrafonts-${version}.tar.gz";
-    sha256 = "02addvvkbvf3bn21kfyj10j9w1c8hdxxld4wjmnc1j8ksqpir3f4";
+  postFetch = ''
-  };
+    tar -xzvf $downloadedFile --strip-components=1
-
-  phases = ["unpackPhase" "installPhase"];
-
-  installPhase = ''
     mkdir -p $out/etc/fonts/conf.d
     mkdir -p $out/share/fonts/truetype
     cp -v *.ttf $out/share/fonts/truetype
     cp -v ${./cambria-alias.conf} $out/etc/fonts/conf.d/30-cambria.conf
   '';
+  sha256 = "0kwm42ggr8kvcn3554cpmv90xzam1sdncx7x3zs3bzp88mxrnv1z";
 
   meta = with stdenv.lib; {
     # This font doesn't appear to have any official web site but this

pkgs/data/fonts/camingo-code/default.nix

@@ -1,22 +1,19 @@
-{ stdenv, fetchurl, unzip }:
+{ stdenv, fetchzip }:
 
-stdenv.mkDerivation rec {
+let
-  name = "camingo-code-${version}";
   version = "1.0";
+in fetchzip rec {
+  name = "camingo-code-${version}";
 
-  src = fetchurl {
   url = https://github.com/chrissimpkins/codeface/releases/download/font-collection/codeface-fonts.zip;
-    sha256 = "1gbpfa5mqyhi5yrb6dl708pggiwp002b532fn3axiagb0cxxf02s";
+  postFetch = ''
-  };
+    unzip $downloadedFile
-
-  buildInputs = [ unzip ];
-
-  installPhase = ''
     mkdir -p $out/share/fonts/truetype
     mkdir -p $out/share/doc/${name}
-    cp -v camingo-code/*.ttf $out/share/fonts/truetype/
+    cp -v fonts/camingo-code/*.ttf $out/share/fonts/truetype/
-    cp -v camingo-code/*.txt $out/share/doc/${name}/
+    cp -v fonts/camingo-code/*.txt $out/share/doc/${name}/
   '';
+  sha256 = "035z2k6lwwy2bysw27pirn3vjxnj2h23nyx8jr213rb2bl0m21x1";
 
   meta = with stdenv.lib; {
     homepage = https://www.myfonts.com/fonts/jan-fromm/camingo-code/;

pkgs/data/fonts/cantarell-fonts/default.nix

@@ -10,6 +10,10 @@ stdenv.mkDerivation rec {
     sha256 = "0zvkd8cm1cg2919v1js9qmzwa02sjl7qajj3gcvgqvai1fm2i8hl";
   };
 
+  outputHashAlgo = "sha256";
+  outputHashMode = "recursive";
+  outputHash = "13w5qj1lx4vk875yna35v9lnc80cwmphcafnmp0d5grg4d98cry2";
+
   meta = {
     description = "Default typeface used in the user interface of GNOME since version 3.0";
     platforms = stdenv.lib.platforms.all;