Merge remote-tracking branch 'upstream/master' into hardened-stdenv

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,15 +1,18 @@
 ###### Things done:
-- [ ] Tested via `nix.useChroot`.
+
-- [ ] Built on platform(s): .
+- [ ] Tested using sandboxing (`nix-build --option build-use-chroot true` or [nix.useChroot](http://nixos.org/nixos/manual/options.html#opt-nix.useChroot) on NixOS)
-- [ ] Tested compilation of all pkgs that depend on this change.
+- [ ] Built on platform(s): NixOS / OSX / Linux
-- [ ] Tested execution of binary products.
+- [ ] Tested compilation of all pkgs that depend on this change using `nix-shell -p nox --run "nox-review wip"`
+- [ ] Tested execution of all binary files (usually in `./result/bin/`)
 - [ ] Fits [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/.github/CONTRIBUTING.md).
 
-###### Extra
+###### More
-Fixes # .
+
+Fixes issue #<insert id>
+
+cc @<maintainer>
 
-cc @ .
 
 ---
 
-_Please note, that points are not mandatory._
+_Please note, that points are not mandatory, but rather desired._

lib/maintainers.nix

@@ -179,6 +179,7 @@
   lassulus = "Lassulus <lassulus@gmail.com>";
   layus = "Guillaume Maudoux <layus.on@gmail.com>";
   lebastr = "Alexander Lebedev <lebastr@gmail.com>";
+  leenaars = "Michiel Leenaars <ml.software@leenaa.rs>";
   leonardoce = "Leonardo Cecchi <leonardo.cecchi@gmail.com>";
   lethalman = "Luca Bruno <lucabru@src.gnome.org>";
   lewo = "Antoine Eiche <lewo@abesis.fr>";

maintainers/scripts/travis-nox-review-pr.sh

@@ -11,11 +11,7 @@ if [[ $1 == nix ]]; then
 
     # Make sure we can use hydra's binary cache
     sudo mkdir /etc/nix
-    sudo tee /etc/nix/nix.conf <<EOF >/dev/null
+    sudo echo "build-max-jobs = 4" > /etc/nix/nix.conf
-binary-caches = http://cache.nixos.org http://hydra.nixos.org
-trusted-binary-caches = http://hydra.nixos.org
-build-max-jobs = 4
-EOF
 
     # Verify evaluation
     echo "=== Verifying that nixpkgs evaluates..."

nixos/default.nix

@@ -1,20 +1,12 @@
 { configuration ? import ./lib/from-env.nix "NIXOS_CONFIG" <nixos-config>
 , system ? builtins.currentSystem
-, extraModules ? []
-  # This attribute is used to specify a different nixos version, a different
-  # system or additional modules which might be set conditionally.
-, reEnter ? false
 }:
 
 let
-  reEnterModule = {
-    config.nixos.path = with (import ../lib); mkIf reEnter (mkForce null);
-    config.nixos.configuration = configuration;
-  };
 
   eval = import ./lib/eval-config.nix {
     inherit system;
-    modules = [ configuration reEnterModule ] ++ extraModules;
+    modules = [ configuration ];
   };
 
   inherit (eval) pkgs;
@@ -22,14 +14,14 @@ let
   # This is for `nixos-rebuild build-vm'.
   vmConfig = (import ./lib/eval-config.nix {
     inherit system;
-    modules = [ configuration reEnterModule ./modules/virtualisation/qemu-vm.nix ] ++ extraModules;
+    modules = [ configuration ./modules/virtualisation/qemu-vm.nix ];
   }).config;
 
   # This is for `nixos-rebuild build-vm-with-bootloader'.
   vmWithBootLoaderConfig = (import ./lib/eval-config.nix {
     inherit system;
     modules =
-      [ configuration reEnterModule
+      [ configuration
         ./modules/virtualisation/qemu-vm.nix
         { virtualisation.useBootLoader = true; }
       ];
@@ -38,7 +30,7 @@ let
 in
 
 {
-  inherit (eval.config.nixos.reflect) config options;
+  inherit (eval) config options;
 
   system = eval.config.system.build.toplevel;
 

nixos/doc/manual/configuration/configuration.xml

@@ -28,7 +28,6 @@ effect after you run <command>nixos-rebuild</command>.</para>
 <xi:include href="postgresql.xml" />
 <xi:include href="gitlab.xml" />
 <xi:include href="acme.xml" />
-<xi:include href="nixos.xml" />
 
 <!-- Apache; libvirtd virtualisation -->
 

nixos/doc/manual/default.nix

@@ -58,7 +58,6 @@ let
       cp ${../../modules/services/databases/postgresql.xml} configuration/postgresql.xml
       cp ${../../modules/services/misc/gitlab.xml} configuration/gitlab.xml
       cp ${../../modules/security/acme.xml} configuration/acme.xml
-      cp ${../../modules/misc/nixos.xml} configuration/nixos.xml
       ln -s ${optionsDocBook} options-db.xml
       echo "${version}" > version
     '';

nixos/doc/manual/release-notes/rl-unstable.xml

@@ -11,19 +11,6 @@ has the following highlights:</para>
 
 <itemizedlist>
 
-  <listitem>
-    <para>You can now pin a specific version of NixOS in your <filename>configuration.nix</filename>
-    by setting:
-
-<programlisting>
-nixos.path = ./nixpkgs-unstable-2015-12-06/nixos;
-</programlisting>
-
-    This will make NixOS re-evaluate your configuration with the modules of
-    the specified NixOS version at the given path.  For more details, see
-    <xref linkend="module-misc-nixos" /></para>
-  </listitem>
-
   <listitem>
     <para>Firefox and similar browsers are now <emphasis>wrapped by default</emphasis>.
     The package and attribute names are plain <literal>firefox</literal>
@@ -239,6 +226,27 @@ programs.ibus.plugins = with pkgs; [ ibus-anthy mozc ];
     was removed. Please review the currently available options.</para>
   </listitem>
 
+  <listitem>
+    <para>
+    The option <option>services.nsd.zones.&lt;name&gt;.data</option> no
+    longer interpret the dollar sign ($) as a shell variable, as such it
+    should not be escaped anymore.  Thus the following zone data:
+    </para>
+    <programlisting>
+\$ORIGIN example.com.
+\$TTL 1800
+@       IN      SOA     ns1.vpn.nbp.name.      admin.example.com. (
+    </programlisting>
+    <para>
+    Should modified to look like the actual file expected by nsd:
+    </para>
+    <programlisting>
+$ORIGIN example.com.
+$TTL 1800
+@       IN      SOA     ns1.vpn.nbp.name.      admin.example.com. (
+    </programlisting>
+  </listitem>
+
 </itemizedlist>
 
 

nixos/modules/config/gtk-exe-env.nix

@@ -1,41 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-{
-  imports = [
-  ];
-
-  options = {
-    gtkPlugins = lib.mkOption {
-      type = lib.types.listOf lib.types.path;
-      default = [];
-      description = ''
-        Plugin packages for GTK+ such as input methods.
-      '';
-    };
-  };
-
-  config = {
-    environment.variables = if builtins.length config.gtkPlugins > 0
-      then
-        let
-          paths = [ pkgs.gtk2 pkgs.gtk3 ] ++ config.gtkPlugins;
-          env = pkgs.buildEnv {
-            name = "gtk-exe-env";
-
-            inherit paths;
-
-            postBuild = lib.concatStringsSep "\n"
-              (map (d: d.gtkExeEnvPostBuild or "") paths);
-
-            ignoreCollisions = true;
-          };
-        in {
-          GTK_EXE_PREFIX = builtins.toString env;
-          GTK_PATH = [
-            "${env}/lib/gtk-2.0"
-            "${env}/lib/gtk-3.0"
-          ];
-        }
-      else {};
-  };
-}

nixos/modules/config/qt-plugin-env.nix

@@ -1,37 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-{
-  imports = [
-  ];
-
-  options = {
-    qtPlugins = lib.mkOption {
-      type = lib.types.listOf lib.types.path;
-      default = [];
-      description = ''
-        Plugin packages for Qt such as input methods.
-      '';
-    };
-  };
-
-  config = {
-    environment.variables = if builtins.length config.qtPlugins > 0
-      then
-        let
-          paths = [ pkgs.qt48 ] ++ config.qtPlugins;
-          env = pkgs.buildEnv {
-            name = "qt-plugin-env";
-
-            inherit paths;
-
-            postBuild = lib.concatStringsSep "\n"
-              (map (d: d.qtPluginEnvPostBuild or "") paths);
-
-            ignoreCollisions = true;
-          };
-        in {
-          QT_PLUGIN_PATH = [ (builtins.toString env) ];
-        }
-      else {};
-  };
-}

nixos/modules/config/vpnc.nix

@@ -17,16 +17,16 @@ in
       services = mkOption {
        type = types.attrsOf types.str;
        default = {};
-       example = {
+       example = literalExample ''
-         test = 
+         { test = '''
-          ''
              IPSec gateway 192.168.1.1
              IPSec ID someID
              IPSec secret secretKey
              Xauth username name
              Xauth password pass
+           ''';
+         }
        '';
-       };
        description = 
          ''
            The names of cisco VPNs and their associated definitions

nixos/modules/i18n/inputMethod/fcitx.nix

@@ -18,10 +18,14 @@ in
         type    = with types; listOf fcitxEngine;
         default = [];
         example = literalExample "with pkgs.fcitx-engines; [ mozc hangul ]";
-        description = ''
+        description =
-          Enabled Fcitx engines.
+          let
-          Available engines can be found by running `nix-env "<nixpkgs>" . -qaP -A fcitx-engines`.
+            engines =
-        '';
+              lib.concatStringsSep ", "
+              (map (name: "<literal>${name}</literal>")
+               (lib.attrNames pkgs.fcitx-engines));
+          in
+            "Enabled Fcitx engines. Available engines are: ${engines}.";
       };
     };
 
@@ -29,8 +33,6 @@ in
 
   config = mkIf (config.i18n.inputMethod.enabled == "fcitx") {
     environment.systemPackages = [ fcitxPackage ];
-    gtkPlugins = [ fcitxPackage ];
-    qtPlugins  = [ fcitxPackage ];
 
     environment.variables = {
       GTK_IM_MODULE = "fcitx";

nixos/modules/i18n/inputMethod/nabi.nix

@@ -4,7 +4,6 @@ with lib;
 {
   config = mkIf (config.i18n.inputMethod.enabled == "nabi") {
     environment.systemPackages = [ pkgs.nabi ];
-    qtPlugins  = [ pkgs.nabi ];
 
     environment.variables = {
       GTK_IM_MODULE = "nabi";

nixos/modules/i18n/inputMethod/uim.nix

@@ -23,8 +23,6 @@ in
 
   config = mkIf (config.i18n.inputMethod.enabled == "uim") {
     environment.systemPackages = [ pkgs.uim ];
-    gtkPlugins = [ pkgs.uim ];
-    qtPlugins  = [ pkgs.uim ];
 
     environment.variables = {
       GTK_IM_MODULE = "uim";

nixos/modules/misc/locate.nix

@@ -67,7 +67,9 @@ in {
   };
 
   config = {
-    warnings = let opt = options.services.locate.period; in optional opt.isDefined "The `period` definition in ${showFiles opt.files} has been removed; please replace it with `interval`, using the new systemd.time interval specifier.";
+    warnings =
+      let opt = options.services.locate.period; in
+      optional opt.isDefined "The ‘services.locate.period’ option in ${showFiles opt.files} has been removed; please replace it with ‘services.locate.interval’, using the systemd.time(7) calendar event format.";
 
     systemd.services.update-locatedb =
       { description = "Update Locate Database";

nixos/modules/misc/nixos.nix

@@ -1,82 +0,0 @@
-{ config, options, lib, ... }:
-
-# This modules is used to inject a different NixOS version as well as its
-# argument such that one can pin a specific version with the versionning
-# system of the configuration.
-let
-  nixosReentry = import config.nixos.path {
-    inherit (config.nixos) configuration extraModules;
-    inherit (config.nixpkgs) system;
-    reEnter = true;
-  };
-in
-
-with lib;
-
-{
-  options = {
-    nixos.path = mkOption {
-      default = null;
-      example = literalExample "./nixpkgs-15.09/nixos";
-      type = types.nullOr types.path;
-      description = ''
-        This option give the ability to evaluate the current set of modules
-        with a different version of NixOS. This option can be used version
-        the version of NixOS with the configuration without relying on the
-        <literal>NIX_PATH</literal> environment variable.
-      '';
-    };
-
-    nixos.system = mkOption {
-      example = "i686-linux";
-      type = types.uniq types.str;
-      description = ''
-        Name of the system used to compile NixOS.
-      '';
-    };
-
-    nixos.extraModules = mkOption {
-      default = [];
-      example = literalExample "[ ./sshd-config.nix ]";
-      type = types.listOf (types.either (types.submodule ({...}:{options={};})) types.path);
-      description = ''
-        Define additional modules which would be loaded to evaluate the
-        configuration.
-      '';
-    };
-
-    nixos.configuration = mkOption {
-      type = types.unspecified;
-      internal = true;
-      description = ''
-        Option used by <filename>nixos/default.nix</filename> to re-inject
-        the same configuration module as the one used for the current
-        execution.
-      '';
-    };
-
-    nixos.reflect = mkOption {
-      default = { inherit config options; };
-      type = types.unspecified;
-      internal = true;
-      description = ''
-        Provides <literal>config</literal> and <literal>options</literal>
-        computed by the module system and given as argument to all
-        modules. These are used for introspection of options and
-        configuration by tools such as <literal>nixos-option</literal>.
-      '';
-    };
-  };
-
-  config = mkMerge [
-    (mkIf (config.nixos.path != null) (mkForce {
-      system.build.toplevel = nixosReentry.system;
-      system.build.vm = nixosReentry.vm;
-      nixos.reflect = { inherit (nixosReentry) config options; };
-    }))
-
-    { meta.maintainers = singleton lib.maintainers.pierron;
-      meta.doc = ./nixos.xml;
-    }
-  ];
-}

nixos/modules/misc/nixos.xml

@@ -1,84 +0,0 @@
-<chapter xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="module-misc-nixos">
-
-<title>NixOS Reentry</title>
-
-<!-- FIXME: render nicely -->
-
-<!-- FIXME: source can be added automatically -->
-<para><emphasis>Source:</emphasis> <filename>modules/misc/nixos.nix</filename></para>
-
-<!-- FIXME: more stuff, like maintainer? -->
-
-<para>NixOS reentry can be used for both pinning the evaluation to a
-specific version of NixOS, and to dynamically add additional modules into
-the Module evaluation.</para>
-
-<section><title>NixOS Version Pinning</title>
-
-<para>To pin a specific version of NixOS, you need a version that you can
-either clone localy, or that you can fetch remotely.</para>
-
-<para>If you already have a cloned version of NixOS in the directory
-<filename>/etc/nixos/nixpkgs-16-03</filename>, then you can specify the
-<option>nixos.path</option> with either the path or the relative path of
-your NixOS clone. For example, you can add the following to your
-<filename>/etc/nixos/configuration.nix</filename> file:
-
-<programlisting>
-nixos.path = ./nixpkgs-16-03/nixos;
-</programlisting>
-</para>
-
-<para>Another option is to fetch a specific version of NixOS, with either
-the <literal>fetchTarball</literal> builtin, or the
-<literal>pkgs.fetchFromGitHub</literal> function and use the result as an
-input.
-
-<programlisting>
-nixos.path = "${builtins.fetchTarball https://github.com/NixOS/nixpkgs/archive/1f27976e03c15183191d1b4aa1a40d1f14666cd2.tar.gz}/nixos";
-</programlisting>
-</para>
-
-</section>
-
-
-<section><title>Adding Module Dynamically</title>
-
-<para>To add additional module, the recommended way is to use statically
-known modules in the list of imported arguments as described in <xref
-linkend="sec-modularity" />.  Unfortunately, this recommended method has
-limitation, such that the list of imported files cannot be selected based on
-the content of the configuration.
-
-Fortunately, NixOS reentry system can be used as an alternative to register
-new imported modules based on the content of the configuration. To do so,
-one should define both <option>nixos.path</option> and
-<option>nixos.extraModules</option> options.
-
-<programlisting>
-nixos.path = &lt;nixos&gt;;
-nixos.extraModules =
-  if config.networking.hostName == "server" then
-    [ ./server.nix ] else [ ./client.nix ];
-</programlisting>
-
-Also note, that the above can be reimplemented in a different way which is
-not as expensive, by using <literal>mkIf</literal> at the top each
-configuration if both modules are present on the file system (see <xref
-linkend="sec-option-definitions" />) and by always inmporting both
-modules.</para>
-
-</section>
-
-<section><title>Options</title>
-
-<para>FIXME: auto-generated list of module options.</para>
-
-</section>
-
-
-</chapter>

nixos/modules/module-list.nix

@@ -7,7 +7,6 @@
   ./config/fonts/fonts.nix
   ./config/fonts/ghostscript.nix
   ./config/gnu.nix
-  ./config/gtk-exe-env.nix
   ./config/i18n.nix
   ./config/krb5.nix
   ./config/ldap.nix
@@ -16,7 +15,6 @@
   ./config/nsswitch.nix
   ./config/power-management.nix
   ./config/pulseaudio.nix
-  ./config/qt-plugin-env.nix
   ./config/shells-environment.nix
   ./config/swap.nix
   ./config/sysctl.nix
@@ -58,7 +56,6 @@
   ./misc/lib.nix
   ./misc/locate.nix
   ./misc/meta.nix
-  ./misc/nixos.nix
   ./misc/nixpkgs.nix
   ./misc/passthru.nix
   ./misc/version.nix
@@ -80,7 +77,6 @@
   ./programs/shell.nix
   ./programs/ssh.nix
   ./programs/ssmtp.nix
-  ./programs/uim.nix
   ./programs/venus.nix
   ./programs/wvdial.nix
   ./programs/xfs_quota.nix

nixos/modules/programs/freetds.nix

@@ -17,14 +17,14 @@ in
     environment.freetds = mkOption {
       type = types.attrsOf types.str;
       default = {};
-      example = {
+      example = literalExample ''
-        MYDATABASE = 
+        { MYDATABASE = '''
-          ''
             host = 10.0.2.100
             port = 1433
             tds version = 7.2
+          ''';
+        }
       '';
-      };
       description = 
         ''
         Configure freetds database entries. Each attribute denotes

nixos/modules/programs/ssh.nix

@@ -36,6 +36,7 @@ in
 
       askPassword = mkOption {
         type = types.str;
+        default = "${pkgs.x11_ssh_askpass}/libexec/x11-ssh-askpass";
         description = ''Program used by SSH to ask for passwords.'';
       };
 
@@ -226,7 +227,5 @@ in
 
     environment.variables.SSH_ASKPASS = optionalString config.services.xserver.enable askPassword;
 
-    programs.ssh.askPassword = mkDefault "${pkgs.x11_ssh_askpass}/libexec/x11-ssh-askpass";
-
   };
 }

nixos/modules/programs/uim.nix

@@ -1,31 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-with lib;
-
-let
-  cfg = config.uim;
-in
-{
-  options = {
-
-    uim = {
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        example = true;
-        description = "Enable UIM input method";
-      };
-    };
-
-  };
-
-  config = mkIf cfg.enable {
-    environment.systemPackages = [ pkgs.uim ];
-    gtkPlugins = [ pkgs.uim ];
-    qtPlugins = [ pkgs.uim ];
-    environment.variables.GTK_IM_MODULE = "uim";
-    environment.variables.QT_IM_MODULE = "uim";
-    environment.variables.XMODIFIERS = "@im=uim";
-    services.xserver.displayManager.sessionCommands = "uim-xim &";
-  };
-}

nixos/modules/programs/venus.nix

@@ -99,6 +99,7 @@ in
       };
 
       outputTheme = mkOption {
+        default = "${pkgs.venus}/themes/classic_fancy";
         type = types.path;
         description = ''
           Directory containing a config.ini file which is merged with this one.
@@ -168,7 +169,5 @@ in
         startAt = cfg.dates;
       };
 
-    services.venus.outputTheme = mkDefault "${pkgs.venus}/themes/classic_fancy";
-
   };
 }

nixos/modules/security/ca.nix

@@ -35,7 +35,8 @@ in
     security.pki.certificates = mkOption {
       type = types.listOf types.str;
       default = [];
-      example = singleton ''
+      example = literalExample ''
+        [ '''
             NixOS.org
             =========
             -----BEGIN CERTIFICATE-----
@@ -43,6 +44,8 @@ in
             TDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0
             ...
             -----END CERTIFICATE-----
+          '''
+        ]
       '';
       description = ''
         A list of trusted root certificates in PEM format.

nixos/modules/services/amqp/activemq/default.nix

@@ -32,6 +32,7 @@ in {
         '';
       };
       configurationDir = mkOption {
+        default = "${activemq}/conf";
         description = ''
           The base directory for ActiveMQ's configuration.
           By default, this directory is searched for a file named activemq.xml,
@@ -125,8 +126,6 @@ in {
       '';
     };
 
-    services.activemq.configurationDir = mkDefault "${activemq}/conf";
-
   };
 
 }

nixos/modules/services/misc/bepasty.nix

@@ -103,9 +103,13 @@ in
           after = [ "network.target" ];
           restartIfChanged = true;
 
-          environment = {
+          environment = let
+            penv = python.buildEnv.override {
+              extraLibs = [ bepasty gevent ];
+            };
+          in {
             BEPASTY_CONFIG = "${server.workDir}/bepasty-${name}.conf";
-            PYTHONPATH= "${bepasty}/lib/${python.libPrefix}/site-packages:${gevent}/lib/${python.libPrefix}/site-packages";
+            PYTHONPATH= "${penv}/${python.sitePackages}/";
           };
 
           serviceConfig = {

nixos/modules/services/misc/nixos-manual.nix

@@ -17,16 +17,32 @@ let
       nixpkgs.system = config.nixpkgs.system;
     };
 
-  eval = evalModules {
+  /* For the purpose of generating docs, evaluate options with each derivation
-    modules = [ versionModule ] ++ baseModules;
+    in `pkgs` (recursively) replaced by a fake with path "\${pkgs.attribute.path}".
-    args = (config._module.args) // { modules = [ ]; };
+    It isn't perfect, but it seems to cover a vast majority of use cases.
-  };
+    Caveat: even if the package is reached by a different means,
-
+    the path above will be shown and not e.g. `${config.services.foo.package}`. */
   manual = import ../../../doc/manual {
     inherit pkgs;
     version = config.system.nixosVersion;
     revision = config.system.nixosRevision;
-    options = eval.options;
+    options =
+      let
+        scrubbedEval = evalModules {
+          modules = [ versionModule ] ++ baseModules;
+          args = (config._module.args) // { modules = [ ]; };
+          specialArgs = { pkgs = scrubDerivations "pkgs" pkgs; };
+        };
+        scrubDerivations = namePrefix: pkgSet: mapAttrs
+          (name: value:
+            let wholeName = "${namePrefix}.${name}"; in
+            if isAttrs value then
+              scrubDerivations wholeName value
+              // (optionalAttrs (isDerivation value) { outPath = "\${${wholeName}}"; })
+            else value
+          )
+          pkgSet;
+      in scrubbedEval.options;
   };
 
   entry = "${manual.manual}/share/doc/nixos/index.html";
@@ -81,6 +97,7 @@ in
 
     services.nixosManual.browser = mkOption {
       type = types.path;
+      default = "${pkgs.w3m-nox}/bin/w3m";
       description = ''
         Browser used to show the manual.
       '';
@@ -118,8 +135,6 @@ in
     services.mingetty.helpLine = mkIf cfg.showManual
       "\nPress <Alt-F${toString cfg.ttyNumber}> for the NixOS manual.";
 
-    services.nixosManual.browser = mkDefault "${pkgs.w3m-nox}/bin/w3m";
-
   };
 
 }

nixos/modules/services/misc/subsonic.nix

@@ -97,6 +97,7 @@ in
 
       transcoders = mkOption {
         type = types.listOf types.path;
+        default = [ "${pkgs.ffmpeg}/bin/ffmpeg" ];
         description = ''
           List of paths to transcoder executables that should be accessible
           from Subsonic. Symlinks will be created to each executable inside
@@ -152,8 +153,5 @@ in
     };
 
     users.extraGroups.subsonic.gid = config.ids.gids.subsonic;
-
-    services.subsonic.transcoders = mkDefault [ "${pkgs.ffmpeg}/bin/ffmpeg" ];
-
   };
 }

nixos/modules/services/monitoring/collectd.nix

@@ -100,7 +100,7 @@ in {
       wantedBy = [ "multi-user.target" ];
 
       serviceConfig = {
-        ExecStart = "${pkgs.collectd}/sbin/collectd -C ${conf} -P ${cfg.pidFile}";
+        ExecStart = "${cfg.package}/sbin/collectd -C ${conf} -P ${cfg.pidFile}";
         Type = "forking";
         PIDFile = cfg.pidFile;
         User = optional (cfg.user!="root") cfg.user;

nixos/modules/services/monitoring/grafana.nix

@@ -87,6 +87,7 @@ in {
 
     staticRootPath = mkOption {
       description = "Root path for static assets.";
+      default = "${cfg.package.out}/share/grafana/public";
       type = types.str;
     };
 
@@ -232,8 +233,5 @@ in {
       home = cfg.dataDir;
       createHome = true;
     };
-
-    services.grafana.staticRootPath = mkDefault "${cfg.package}/share/grafana/public";
-
   };
 }

nixos/modules/services/networking/dnscrypt-proxy.nix

@@ -52,7 +52,10 @@ in
         default = "opendns";
         type = types.nullOr types.string;
         description = ''
-          The name of the upstream DNSCrypt resolver to use.
+          The name of the upstream DNSCrypt resolver to use. See
+          <literal>${resolverListFile}</literal> for alternative resolvers
+          (e.g., if you are concerned about logging and/or server
+          location).
         '';
       };
       customResolver = mkOption {

nixos/modules/services/networking/nsd.nix

@@ -9,6 +9,7 @@ let
   stateDir = "/var/lib/nsd";
   pidFile = stateDir + "/var/nsd.pid";
 
+  # build nsd with the options needed for the given config
   nsdPkg = pkgs.nsd.override {
     bind8Stats = cfg.bind8Stats;
     ipv6 = cfg.ipv6;
@@ -17,74 +18,99 @@ let
     zoneStats = length (collect (x: (x.zoneStats or null) != null) cfg.zones) > 0;
   };
 
-  zoneFiles = pkgs.stdenv.mkDerivation {
+
-    preferLocalBuild = true;
+  nsdEnv = pkgs.buildEnv {
     name = "nsd-env";
-    buildCommand = concatStringsSep "\n"
+
-      [ "mkdir -p $out"
+    paths = [ configFile ]
-        (concatStrings (mapAttrsToList (zoneName: zoneOptions: ''
+      ++ mapAttrsToList (name: zone: writeZoneData name zone.data) zoneConfigs;
-          cat > "$out/${zoneName}" <<_EOF_
+
-          ${zoneOptions.data}
+    postBuild = ''
-          _EOF_
+      echo "checking zone files"
-        '') zoneConfigs))
+      cd $out/zones
-      ];
+
+      for zoneFile in *; do
+        ${nsdPkg}/sbin/nsd-checkzone "$zoneFile" "$zoneFile" || {
+          if grep -q \\\\\\$ "$zoneFile"; then
+            echo zone "$zoneFile" contains escaped dollar signes \\\$
+            echo Escaping them is not needed any more. Please make shure \
+                 to unescape them where they prefix a variable name
+          fi
+
+          exit 1
+        }
+      done
+
+      echo "checking configuration file"
+      ${nsdPkg}/sbin/nsd-checkconf $out/nsd.conf
+    '';
   };
 
-  configFile = pkgs.writeText "nsd.conf" ''
+  writeZoneData = name: text: pkgs.writeTextFile {
+    inherit name text;
+    destination = "/zones/${name}";
+  };
+
+
+  # options are ordered alphanumerically by the nixos option name
+  configFile = pkgs.writeTextDir "nsd.conf" ''
     server:
-      username: ${username}
       chroot:   "${stateDir}"
+      username: ${username}
 
       # The directory for zonefile: files. The daemon chdirs here.
       zonesdir: "${stateDir}"
 
       # the list of dynamically added zones.
-      zonelistfile: "${stateDir}/var/zone.list"
       database:     "${stateDir}/var/nsd.db"
       pidfile:      "${pidFile}"
       xfrdfile:     "${stateDir}/var/xfrd.state"
       xfrdir:       "${stateDir}/tmp"
+      zonelistfile: "${stateDir}/var/zone.list"
 
       # interfaces
     ${forEach "  ip-address: " cfg.interfaces}
 
-      server-count:        ${toString cfg.serverCount}
-      ip-transparent:      ${yesOrNo  cfg.ipTransparent}
-      do-ip4:              ${yesOrNo  cfg.ipv4}
-      do-ip6:              ${yesOrNo  cfg.ipv6}
-      port:                ${toString cfg.port}
-      verbosity:           ${toString cfg.verbosity}
       hide-version:        ${yesOrNo  cfg.hideVersion}
       identity:            "${cfg.identity}"
+      ip-transparent:      ${yesOrNo  cfg.ipTransparent}
+      do-ip4:              ${yesOrNo  cfg.ipv4}
+      ipv4-edns-size:      ${toString cfg.ipv4EDNSSize}
+      do-ip6:              ${yesOrNo  cfg.ipv6}
+      ipv6-edns-size:      ${toString cfg.ipv6EDNSSize}
+      log-time-ascii:      ${yesOrNo  cfg.logTimeAscii}
       ${maybeString "nsid: " cfg.nsid}
+      port:                ${toString cfg.port}
+      reuseport:           ${yesOrNo  cfg.reuseport}
+      round-robin:         ${yesOrNo  cfg.roundRobin}
+      server-count:        ${toString cfg.serverCount}
+      ${if cfg.statistics == null then "" else "statistics:          ${toString cfg.statistics}"}
       tcp-count:           ${toString cfg.tcpCount}
       tcp-query-count:     ${toString cfg.tcpQueryCount}
       tcp-timeout:         ${toString cfg.tcpTimeout}
-      ipv4-edns-size:      ${toString cfg.ipv4EDNSSize}
+      verbosity:           ${toString cfg.verbosity}
-      ipv6-edns-size:      ${toString cfg.ipv6EDNSSize}
+      ${maybeString "version: " cfg.version}
-      ${if cfg.statistics == null then "" else "statistics:          ${toString cfg.statistics}"}
       xfrd-reload-timeout: ${toString cfg.xfrdReloadTimeout}
       zonefiles-check:     ${yesOrNo  cfg.zonefilesCheck}
 
-      rrl-size:                ${toString cfg.ratelimit.size}
-      rrl-ratelimit:           ${toString cfg.ratelimit.ratelimit}
-      rrl-whitelist-ratelimit: ${toString cfg.ratelimit.whitelistRatelimit}
-      ${maybeString "rrl-slip: "               cfg.ratelimit.slip}
       ${maybeString "rrl-ipv4-prefix-length: " cfg.ratelimit.ipv4PrefixLength}
       ${maybeString "rrl-ipv6-prefix-length: " cfg.ratelimit.ipv6PrefixLength}
+      rrl-ratelimit:           ${toString cfg.ratelimit.ratelimit}
+      ${maybeString "rrl-slip: "               cfg.ratelimit.slip}
+      rrl-size:                ${toString cfg.ratelimit.size}
+      rrl-whitelist-ratelimit: ${toString cfg.ratelimit.whitelistRatelimit}
 
     ${keyConfigFile}
 
     remote-control:
       control-enable:    ${yesOrNo  cfg.remoteControl.enable}
-    ${forEach "  control-interface: " cfg.remoteControl.interfaces}
-      control-port:      ${toString cfg.port}
-      server-key-file:   "${cfg.remoteControl.serverKeyFile}"
-      server-cert-file:  "${cfg.remoteControl.serverCertFile}"
       control-key-file:  "${cfg.remoteControl.controlKeyFile}"
       control-cert-file: "${cfg.remoteControl.controlCertFile}"
+    ${forEach "  control-interface: " cfg.remoteControl.interfaces}
+      control-port:      ${toString cfg.remoteControl.port}
+      server-key-file:   "${cfg.remoteControl.serverKeyFile}"
+      server-cert-file:  "${cfg.remoteControl.serverCertFile}"
 
-    # zone files reside in "${zoneFiles}" linked to "${stateDir}/zones"
     ${concatStrings (mapAttrsToList zoneConfigFile zoneConfigs)}
 
     ${cfg.extraConfig}
@@ -106,22 +132,23 @@ let
     secret=$(cat "${keyOptions.keyFile}")
     dest="${stateDir}/private/${keyName}"
     echo "  secret: \"$secret\"" > "$dest"
-    ${pkgs.coreutils}/bin/chown ${username}:${username} "$dest"
+    chown ${username}:${username} "$dest"
-    ${pkgs.coreutils}/bin/chmod 0400 "$dest"
+    chmod 0400 "$dest"
   '') cfg.keys);
 
 
+  # options are ordered alphanumerically by the nixos option name
   zoneConfigFile = name: zone: ''
     zone:
       name:         "${name}"
       zonefile:     "${stateDir}/zones/${name}"
-      ${maybeString "zonestats: "          zone.zoneStats}
       ${maybeString "outgoing-interface: " zone.outgoingInterface}
     ${forEach     "  rrl-whitelist: "      zone.rrlWhitelist}
+      ${maybeString "zonestats: "          zone.zoneStats}
 
+      allow-axfr-fallback: ${yesOrNo       zone.allowAXFRFallback}
     ${forEach     "  allow-notify: "       zone.allowNotify}
     ${forEach     "  request-xfr: "        zone.requestXFR}
-      allow-axfr-fallback: ${yesOrNo       zone.allowAXFRFallback}
 
     ${forEach     "  notify: "             zone.notify}
       notify-retry:                        ${toString zone.notifyRetry}
@@ -152,17 +179,16 @@ let
 
   childConfig = x: v: { options.children = { type = types.attrsOf x; visible = v; }; };
 
+  # options are ordered alphanumerically
   zoneOptionsRaw = types.submodule {
     options = {
-      children = mkOption {
+
-        default     = {};
+      allowAXFRFallback = mkOption {
+        type = types.bool;
+        default = true;
         description = ''
-          Children zones inherit all options of their parents. Attributes
+          If NSD as secondary server should be allowed to AXFR if the primary
-          defined in a child will overwrite the ones of its parent. Only
+          server does not allow IXFR.
-          leaf zones will be actually served. This way it's possible to
-          define maybe zones which share most attributes without
-          duplicating everything. This mechanism replaces nsd's patterns
-          in a save and functional way.
         '';
       };
 
@@ -193,21 +219,25 @@ let
         '';
       };
 
-      requestXFR = mkOption {
+      children = mkOption {
-        type        = types.listOf types.str;
+        default = {};
-        default     = [];
-        example     = [];
         description = ''
-          Format: <code>[AXFR|UDP] &lt;ip-address&gt; &lt;key-name | NOKEY&gt;</code>
+          Children zones inherit all options of their parents. Attributes
+          defined in a child will overwrite the ones of its parent. Only
+          leaf zones will be actually served. This way it's possible to
+          define maybe zones which share most attributes without
+          duplicating everything. This mechanism replaces nsd's patterns
+          in a save and functional way.
         '';
       };
 
-      allowAXFRFallback = mkOption {
+      data = mkOption {
-        type        = types.bool;
+        type = types.str;
-        default     = true;
+        default = "";
+        example = "";
         description = ''
-          If NSD as secondary server should be allowed to AXFR if the primary
+          The actual zone data. This is the content of your zone file.
-          server does not allow IXFR.
+          Use imports or pkgs.lib.readFile if you don't want this data in your config file.
         '';
       };
 
@@ -238,16 +268,6 @@ let
         '';
       };
 
-      provideXFR = mkOption {
-        type        = types.listOf types.str;
-        default     = [];
-        example     = [ "192.0.2.0/24 NOKEY" "192.0.2.0/24 my_tsig_key_name" ];
-        description = ''
-          Allow these IPs and TSIG to transfer zones, addr TSIG|NOKEY|BLOCKED
-          address range 192.0.2.0/24, 1.2.3.4&amp;255.255.0.0, 3.0.2.20-3.0.2.40
-        '';
-      };
-
       outgoingInterface = mkOption {
         type = types.nullOr types.str;
         default = null;
@@ -260,6 +280,25 @@ let
         '';
       };
 
+      provideXFR = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        example = [ "192.0.2.0/24 NOKEY" "192.0.2.0/24 my_tsig_key_name" ];
+        description = ''
+          Allow these IPs and TSIG to transfer zones, addr TSIG|NOKEY|BLOCKED
+          address range 192.0.2.0/24, 1.2.3.4&amp;255.255.0.0, 3.0.2.20-3.0.2.40
+        '';
+      };
+
+      requestXFR = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        example = [];
+        description = ''
+          Format: <code>[AXFR|UDP] &lt;ip-address&gt; &lt;key-name | NOKEY&gt;</code>
+        '';
+      };
+
       rrlWhitelist = mkOption {
         type = types.listOf types.str;
         default = [];
@@ -270,16 +309,6 @@ let
         '';
       };
 
-      data = mkOption {
-        type        = types.str;
-        default     = "";
-        example     = "";
-        description = ''
-          The actual zone data. This is the content of your zone file.
-          Use imports or pkgs.lib.readFile if you don't want this data in your config file.
-        '';
-      };
-
       zoneStats = mkOption {
         type = types.nullOr types.str;
         default = null;
@@ -292,79 +321,24 @@ let
           and stats_noreset.
         '';
       };
+
     };
   };
 
 in
 {
-  options = {
+  # options are ordered alphanumerically
-    services.nsd = {
+  options.services.nsd = {
 
     enable = mkEnableOption "NSD authoritative DNS server";
+
     bind8Stats = mkEnableOption "BIND8 like statistics";
 
-      rootServer = mkOption {
+    extraConfig = mkOption {
-        type        = types.bool;
+      type = types.str;
-        default     = false;
+      default = "";
       description = ''
-          Wheter if this server will be a root server (a DNS root server, you
+        Extra nsd config.
-          usually don't want that).
-        '';
-      };
-
-      interfaces = mkOption {
-        type        = types.listOf types.str;
-        default     = [ "127.0.0.0" "::1" ];
-        description = ''
-          What addresses the server should listen to.
-        '';
-      };
-
-      serverCount = mkOption {
-        type        = types.int;
-        default     = 1;
-        description = ''
-          Number of NSD servers to fork. Put the number of CPUs to use here.
-        '';
-      };
-
-      ipTransparent = mkOption {
-        type        = types.bool;
-        default     = false;
-        description = ''
-          Allow binding to non local addresses.
-        '';
-      };
-
-      ipv4 = mkOption {
-        type        = types.bool;
-        default     = true;
-        description = ''
-          Wheter to listen on IPv4 connections.
-        '';
-      };
-
-      ipv6 = mkOption {
-        type        = types.bool;
-        default     = true;
-        description = ''
-          Wheter to listen on IPv6 connections.
-        '';
-      };
-
-      port = mkOption {
-        type        = types.int;
-        default     = 53;
-        description = ''
-          Port the service should bind do.
-        '';
-      };
-
-      verbosity = mkOption {
-        type        = types.int;
-        default     = 0;
-        description = ''
-          Verbosity level.
       '';
     };
 
@@ -384,6 +358,62 @@ in
       '';
     };
 
+    interfaces = mkOption {
+      type = types.listOf types.str;
+      default = [ "127.0.0.0" "::1" ];
+      description = ''
+        What addresses the server should listen to.
+      '';
+    };
+
+    ipTransparent = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Allow binding to non local addresses.
+      '';
+    };
+
+    ipv4 = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        Wheter to listen on IPv4 connections.
+      '';
+    };
+
+    ipv4EDNSSize = mkOption {
+      type = types.int;
+      default = 4096;
+      description = ''
+        Preferred EDNS buffer size for IPv4.
+      '';
+    };
+
+    ipv6 = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        Wheter to listen on IPv6 connections.
+      '';
+    };
+
+    ipv6EDNSSize = mkOption {
+      type = types.int;
+      default = 4096;
+      description = ''
+        Preferred EDNS buffer size for IPv6.
+      '';
+    };
+
+    logTimeAscii = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        Log time in ascii, if false then in unix epoch seconds.
+      '';
+    };
+
     nsid = mkOption {
       type = types.nullOr types.str;
       default = null;
@@ -392,6 +422,53 @@ in
       '';
     };
 
+    port = mkOption {
+      type = types.int;
+      default = 53;
+      description = ''
+        Port the service should bind do.
+      '';
+    };
+
+    reuseport = mkOption {
+      type = types.bool;
+      default = pkgs.stdenv.isLinux;
+      description = ''
+        Wheter to enable SO_REUSEPORT on all used sockets. This lets multiple
+        processes bind to the same port. This speeds up operation especially
+        if the server count is greater than one and makes fast restarts less
+        prone to fail
+      '';
+    };
+
+    rootServer = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Wheter if this server will be a root server (a DNS root server, you
+        usually don't want that).
+      '';
+    };
+
+    roundRobin = mkEnableOption "round robin rotation of records";
+
+    serverCount = mkOption {
+      type = types.int;
+      default = 1;
+      description = ''
+        Number of NSD servers to fork. Put the number of CPUs to use here.
+      '';
+    };
+
+    statistics = mkOption {
+      type = types.nullOr types.int;
+      default = null;
+      description = ''
+        Statistics are produced every number of seconds. Prints to log.
+        If null no statistics are logged.
+      '';
+    };
+
     tcpCount = mkOption {
       type = types.int;
       default = 100;
@@ -417,28 +494,21 @@ in
       '';
     };
 
-      ipv4EDNSSize = mkOption {
+    verbosity = mkOption {
       type = types.int;
-        default     = 4096;
+      default = 0;
       description = ''
-          Preferred EDNS buffer size for IPv4.
+        Verbosity level.
       '';
     };
 
-      ipv6EDNSSize = mkOption {
+    version = mkOption {
-        type        = types.int;
+      type = types.nullOr types.str;
-        default     = 4096;
-        description = ''
-          Preferred EDNS buffer size for IPv6.
-        '';
-      };
-
-      statistics = mkOption {
-        type        = types.nullOr types.int;
       default = null;
       description = ''
-          Statistics are produced every number of seconds. Prints to log.
+        The version string replied for CH TXT version.server and version.bind
-          If null no statistics are logged.
+        queries. Will use the compiled package version on null.
+        See hideVersion for enabling/disabling this responses.
       '';
     };
 
@@ -459,134 +529,10 @@ in
     };
 
 
-      extraConfig = mkOption {
-        type        = types.str;
-        default     = "";
-        description = ''
-          Extra nsd config.
-        '';
-      };
-
-
-      ratelimit = {
-        enable = mkEnableOption "ratelimit capabilities";
-
-        size = mkOption {
-          type        = types.int;
-          default     = 1000000;
-          description = ''
-            Size of the hashtable. More buckets use more memory but lower
-            the chance of hash hash collisions.
-          '';
-        };
-
-        ratelimit = mkOption {
-          type        = types.int;
-          default     = 200;
-          description = ''
-            Max qps allowed from any query source.
-            0 means unlimited. With an verbosity of 2 blocked and
-            unblocked subnets will be logged.
-          '';
-        };
-
-        whitelistRatelimit = mkOption {
-          type        = types.int;
-          default     = 2000;
-          description = ''
-            Max qps allowed from whitelisted sources.
-            0 means unlimited. Set the rrl-whitelist option for specific
-            queries to apply this limit instead of the default to them.
-          '';
-        };
-
-        slip = mkOption {
-          type        = types.nullOr types.int;
-          default     = null;
-          description = ''
-            Number of packets that get discarded before replying a SLIP response.
-            0 disables SLIP responses. 1 will make every response a SLIP response.
-          '';
-        };
-
-        ipv4PrefixLength = mkOption {
-          type        = types.nullOr types.int;
-          default     = null;
-          description = ''
-            IPv4 prefix length. Addresses are grouped by netblock.
-          '';
-        };
-
-        ipv6PrefixLength = mkOption {
-          type        = types.nullOr types.int;
-          default     = null;
-          description = ''
-            IPv6 prefix length. Addresses are grouped by netblock.
-          '';
-        };
-      };
-
-
-      remoteControl = {
-        enable = mkEnableOption "remote control via nsd-control";
-
-        interfaces = mkOption {
-          type        = types.listOf types.str;
-          default     = [ "127.0.0.1" "::1" ];
-          description = ''
-            Which interfaces NSD should bind to for remote control.
-          '';
-        };
-
-        port = mkOption {
-          type        = types.int;
-          default     = 8952;
-          description = ''
-            Port number for remote control operations (uses TLS over TCP).
-          '';
-        };
-
-        serverKeyFile = mkOption {
-          type        = types.path;
-          default     = "/etc/nsd/nsd_server.key";
-          description = ''
-            Path to the server private key, which is used by the server
-            but not by nsd-control. This file is generated by nsd-control-setup.
-          '';
-        };
-
-        serverCertFile = mkOption {
-          type        = types.path;
-          default     = "/etc/nsd/nsd_server.pem";
-          description = ''
-            Path to the server self signed certificate, which is used by the server
-            but and by nsd-control. This file is generated by nsd-control-setup.
-          '';
-        };
-
-        controlKeyFile = mkOption {
-          type        = types.path;
-          default     = "/etc/nsd/nsd_control.key";
-          description = ''
-            Path to the client private key, which is used by nsd-control
-            but not by the server. This file is generated by nsd-control-setup.
-          '';
-        };
-
-        controlCertFile = mkOption {
-          type        = types.path;
-          default     = "/etc/nsd/nsd_control.pem";
-          description = ''
-            Path to the client certificate signed with the server certificate.
-            This file is used by nsd-control and generated by nsd-control-setup.
-          '';
-        };
-      };
-
-
     keys = mkOption {
       type = types.attrsOf (types.submodule {
         options = {
+
           algorithm = mkOption {
             type = types.str;
             default = "hmac-sha256";
@@ -604,51 +550,177 @@ in
               user.
             '';
           };
+
         };
       });
       default = {};
-        example = {
+      example = literalExample ''
-          "tsig.example.org" = {
+        { "tsig.example.org" = {
             algorithm = "hmac-md5";
-            secret    = "aaaaaabbbbbbccccccdddddd";
+            keyFile = "/path/to/my/key";
           };
         };
+      '';
       description = ''
         Define your TSIG keys here.
       '';
     };
 
+
+    ratelimit = {
+
+      enable = mkEnableOption "ratelimit capabilities";
+
+      ipv4PrefixLength = mkOption {
+        type = types.nullOr types.int;
+        default = null;
+        description = ''
+          IPv4 prefix length. Addresses are grouped by netblock.
+        '';
+      };
+
+      ipv6PrefixLength = mkOption {
+        type = types.nullOr types.int;
+        default = null;
+        description = ''
+          IPv6 prefix length. Addresses are grouped by netblock.
+        '';
+      };
+
+      ratelimit = mkOption {
+        type = types.int;
+        default = 200;
+        description = ''
+          Max qps allowed from any query source.
+          0 means unlimited. With an verbosity of 2 blocked and
+          unblocked subnets will be logged.
+        '';
+      };
+
+      slip = mkOption {
+        type = types.nullOr types.int;
+        default = null;
+        description = ''
+          Number of packets that get discarded before replying a SLIP response.
+          0 disables SLIP responses. 1 will make every response a SLIP response.
+        '';
+      };
+
+      size = mkOption {
+        type = types.int;
+        default = 1000000;
+        description = ''
+          Size of the hashtable. More buckets use more memory but lower
+          the chance of hash hash collisions.
+        '';
+      };
+
+      whitelistRatelimit = mkOption {
+        type = types.int;
+        default = 2000;
+        description = ''
+          Max qps allowed from whitelisted sources.
+          0 means unlimited. Set the rrl-whitelist option for specific
+          queries to apply this limit instead of the default to them.
+        '';
+      };
+
+    };
+
+
+    remoteControl = {
+
+      enable = mkEnableOption "remote control via nsd-control";
+
+      controlCertFile = mkOption {
+        type = types.path;
+        default = "/etc/nsd/nsd_control.pem";
+        description = ''
+          Path to the client certificate signed with the server certificate.
+          This file is used by nsd-control and generated by nsd-control-setup.
+        '';
+      };
+
+      controlKeyFile = mkOption {
+        type = types.path;
+        default = "/etc/nsd/nsd_control.key";
+        description = ''
+          Path to the client private key, which is used by nsd-control
+          but not by the server. This file is generated by nsd-control-setup.
+        '';
+      };
+
+      interfaces = mkOption {
+        type = types.listOf types.str;
+        default = [ "127.0.0.1" "::1" ];
+        description = ''
+          Which interfaces NSD should bind to for remote control.
+        '';
+      };
+
+      port = mkOption {
+        type = types.int;
+        default = 8952;
+        description = ''
+          Port number for remote control operations (uses TLS over TCP).
+        '';
+      };
+
+      serverCertFile = mkOption {
+        type = types.path;
+        default = "/etc/nsd/nsd_server.pem";
+        description = ''
+          Path to the server self signed certificate, which is used by the server
+          but and by nsd-control. This file is generated by nsd-control-setup.
+        '';
+      };
+
+      serverKeyFile = mkOption {
+        type = types.path;
+        default = "/etc/nsd/nsd_server.key";
+        description = ''
+          Path to the server private key, which is used by the server
+          but not by nsd-control. This file is generated by nsd-control-setup.
+        '';
+      };
+
+    };
+
+
     zones = mkOption {
       type = types.attrsOf zoneOptions;
       default = {};
-        example     = {
+      example = literalExample ''
-          "serverGroup1" = {
+        { "serverGroup1" = {
             provideXFR = [ "10.1.2.3 NOKEY" ];
             children = {
               "example.com." = {
-                data = ''
+                data = '''
                   $ORIGIN example.com.
                   $TTL    86400
                   @ IN SOA a.ns.example.com. admin.example.com. (
                   ...
-                '';
+                ''';
               };
               "example.org." = {
-                data = ''
+                data = '''
                   $ORIGIN example.org.
                   $TTL    86400
                   @ IN SOA a.ns.example.com. admin.example.com. (
                   ...
-                '';
+                ''';
               };
             };
           };
 
           "example.net." = {
             provideXFR = [ "10.3.2.1 NOKEY" ];
-            data = ''...'';
+            data = '''
+              ...
+            ''';
           };
         };
+      '';
       description = ''
         Define your zones here. Zones can cascade other zones and therefore
         inherit settings from parent zones. Look at the definition of
@@ -660,7 +732,6 @@ in
     };
 
   };
-  };
 
   config = mkIf cfg.enable {
 
@@ -680,31 +751,40 @@ in
 
     systemd.services.nsd = {
       description = "NSD authoritative only domain name service";
+
+      after = [ "keys.target" "network.target" ];
       wantedBy = [ "multi-user.target" ];
-      after       = [ "network.target" ];
+      wants = [ "keys.target" ];
 
       serviceConfig = {
+        ExecStart = "${nsdPkg}/sbin/nsd -d -c ${nsdEnv}/nsd.conf";
         PIDFile = pidFile;
         Restart = "always";
-        ExecStart = "${nsdPkg}/sbin/nsd -d -c ${configFile}";
+        RestartSec = "4s";
+        StartLimitBurst = 4;
+        StartLimitInterval = "5min";
       };
 
       preStart = ''
-        ${pkgs.coreutils}/bin/mkdir -m 0700 -p "${stateDir}/private"
+        rm -Rf "${stateDir}/private/"
-        ${pkgs.coreutils}/bin/mkdir -m 0700 -p "${stateDir}/tmp"
+        rm -Rf "${stateDir}/tmp/"
-        ${pkgs.coreutils}/bin/mkdir -m 0700 -p "${stateDir}/var"
 
-        ${pkgs.coreutils}/bin/touch "${stateDir}/don't touch anything in here"
+        mkdir -m 0700 -p "${stateDir}/private"
+        mkdir -m 0700 -p "${stateDir}/tmp"
+        mkdir -m 0700 -p "${stateDir}/var"
 
-        ${pkgs.coreutils}/bin/rm -f "${stateDir}/private/"*
+        cat > "${stateDir}/don't touch anything in here" << EOF
-        ${pkgs.coreutils}/bin/rm -f "${stateDir}/tmp/"*
+        Everything in this directory except NSD's state in var is
+        automatically generated and will be purged and redeployed
+        by the nsd.service pre-start script.
+        EOF
 
-        ${pkgs.coreutils}/bin/chown nsd:nsd -R "${stateDir}/private"
+        chown ${username}:${username} -R "${stateDir}/private"
-        ${pkgs.coreutils}/bin/chown nsd:nsd -R "${stateDir}/tmp"
+        chown ${username}:${username} -R "${stateDir}/tmp"
-        ${pkgs.coreutils}/bin/chown nsd:nsd -R "${stateDir}/var"
+        chown ${username}:${username} -R "${stateDir}/var"
 
-        ${pkgs.coreutils}/bin/rm -rf "${stateDir}/zones"
+        rm -rf "${stateDir}/zones"
-        ${pkgs.coreutils}/bin/cp -r  "${zoneFiles}" "${stateDir}/zones"
+        cp -rL "${nsdEnv}/zones" "${stateDir}/zones"
 
         ${copyKeys}
       '';

nixos/modules/services/security/fail2ban.nix

@@ -50,9 +50,8 @@ in
 
       jails = mkOption {
         default = { };
-        example =
+        example = literalExample ''
-          { "apache-nohome-iptables" =
+          { apache-nohome-iptables = '''
-              ''
               # Block an IP address if it accesses a non-existent
               # home directory more than 5 times in 10 minutes,
               # since that indicates that it's scanning.
@@ -62,8 +61,9 @@ in
               findtime = 600
               bantime  = 600
               maxretry = 5
+            ''';
+          }
         '';
-          };
         type = types.attrsOf types.lines;
         description =
           ''

nixos/modules/services/web-servers/apache-httpd/moodle.nix

@@ -46,11 +46,11 @@ let
     '';
   # Unpack Moodle and put the config file in its root directory.
   moodleRoot = pkgs.stdenv.mkDerivation rec {
-    name= "moodle-2.8.5";
+    name= "moodle-2.8.10";
 
     src = pkgs.fetchurl {
       url = "https://download.moodle.org/stable28/${name}.tgz";
-      sha256 = "1a159a193010cddedce10ee009184502e6f732e4d7c85167d8597fe5dff9e190";
+      sha256 = "0c3r5081ipcwc9s6shakllnrkd589y2ln5z5m1q09l4h6a7cy4z2";
     };
 
     buildPhase =

nixos/modules/services/web-servers/phpfpm.nix

@@ -46,14 +46,15 @@ in {
 
       phpIni = mkOption {
         type = types.path;
-        description = "PHP configuration file to use.";
+        default = "${cfg.phpPackage}/etc/php-recommended.ini";
+        description = "php.ini file to use.";
       };
 
       poolConfigs = mkOption {
         type = types.attrsOf types.lines;
         default = {};
-        example = {
+        example = literalExample ''
-          mypool = ''
+          { mypool = '''
               listen = /run/phpfpm/mypool
               user = nobody
               pm = dynamic
@@ -62,8 +63,9 @@ in {
               pm.min_spare_servers = 5
               pm.max_spare_servers = 20
               pm.max_requests = 500
+            ''';
+          }
         '';
-        };
         description = ''
           A mapping between PHP FPM pool names and their configurations.
           See the documentation on <literal>php-fpm.conf</literal> for
@@ -87,7 +89,5 @@ in {
       };
     };
 
-    services.phpfpm.phpIni = mkDefault "${cfg.phpPackage}/etc/php-recommended.ini";
-
   };
 }

nixos/modules/services/x11/display-managers/default.nix

@@ -49,18 +49,6 @@ let
         fi
       ''}
 
-      ${optionalString cfg.displayManager.desktopManagerHandlesLidAndPower ''
-        # Stop systemd from handling the power button and lid switch,
-        # since presumably the desktop environment will handle these.
-        if [ -z "$_INHIBITION_LOCK_TAKEN" ]; then
-          export _INHIBITION_LOCK_TAKEN=1
-          if ! ${config.systemd.package}/bin/loginctl show-session $XDG_SESSION_ID | grep -q '^RemoteHost='; then
-            exec ${config.systemd.package}/bin/systemd-inhibit --what=handle-lid-switch:handle-power-key --why="Desktop environment handles power events" "$0" "$sessionType"
-          fi
-        fi
-
-      ''}
-
       ${optionalString cfg.startGnuPGAgent ''
         if test -z "$SSH_AUTH_SOCK"; then
             # Restart this script as a child of the GnuPG agent.
@@ -219,17 +207,6 @@ in
         '';
       };
 
-      desktopManagerHandlesLidAndPower = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Whether the display manager should prevent systemd from handling
-          lid and power events. This is normally handled by the desktop
-          environment's power manager. Turn this off when using a minimal
-          X11 setup without a full power manager.
-        '';
-      };
-
       session = mkOption {
         default = [];
         example = literalExample
@@ -309,9 +286,11 @@ in
   };
 
   config = {
-
     services.xserver.displayManager.xserverBin = "${xorg.xorgserver}/bin/X";
-
   };
 
+  imports = [
+   (mkRemovedOptionModule [ "services" "xserver" "displayManager" "desktopManagerHandlesLidAndPower" ])
+  ];
+
 }

nixos/modules/services/x11/display-managers/lightdm.nix

@@ -87,6 +87,7 @@ in
 
       background = mkOption {
         type = types.str;
+        default = "${pkgs.nixos-artwork}/share/artwork/gnome/Gnome_Dark.png";
         description = ''
           The background image or color to use.
         '';
@@ -152,9 +153,6 @@ in
     };
 
     users.extraGroups.lightdm.gid = config.ids.gids.lightdm;
-
-    services.xserver.displayManager.lightdm.background = mkDefault "${pkgs.nixos-artwork}/share/artwork/gnome/Gnome_Dark.png";
-
     services.xserver.tty     = null; # We might start multiple X servers so let the tty increment themselves..
     services.xserver.display = null; # We specify our own display (and logfile) in xserver-wrapper up there
   };

nixos/modules/services/x11/xserver.nix

@@ -156,13 +156,16 @@ in
       inputClassSections = mkOption {
         type = types.listOf types.lines;
         default = [];
-        example = [ ''
+        example = literalExample ''
+          [ '''
               Identifier      "Trackpoint Wheel Emulation"
               MatchProduct    "ThinkPad USB Keyboard with TrackPoint"
               Option          "EmulateWheel"          "true
               Option          "EmulateWheelButton"    "2"
               Option          "Emulate3Buttons"       "false"
-          '' ];
+            '''
+          ]
+        '';
         description = "Content of additional InputClass sections of the X server configuration file.";
       };
 

nixos/modules/system/activation/activation-script.nix

@@ -30,18 +30,19 @@ in
     system.activationScripts = mkOption {
       default = {};
 
-      example = {
+      example = literalExample ''
-        stdio = {
+        { stdio = {
-          text = ''
+            text = '''
               # Needed by some programs.
               ln -sfn /proc/self/fd /dev/fd
               ln -sfn /proc/self/fd/0 /dev/stdin
               ln -sfn /proc/self/fd/1 /dev/stdout
               ln -sfn /proc/self/fd/2 /dev/stderr
-          '';
+            ''';
             deps = [];
           };
-      };
+        }
+      '';
 
       description = ''
         A set of shell script fragments that are executed when a NixOS

nixos/modules/system/activation/top-level.nix

@@ -178,9 +178,10 @@ in
       default = false;
       description = ''
         If enabled, copies the NixOS configuration file
-        <literal>$NIXOS_CONFIG</literal> (usually
+        (usually <filename>/etc/nixos/configuration.nix</filename>)
-        <filename>/etc/nixos/configuration.nix</filename>)
+        and links it from the resulting system
-        to the system store path.
+        (getting to <filename>/run/current-system/configuration.nix</filename>).
+        Note that only this single file is copied, even if it imports others.
       '';
     };
 
@@ -238,7 +239,9 @@ in
     system.extraSystemBuilderCmds =
       optionalString
         config.system.copySystemConfiguration
-        "cp ${maybeEnv "NIXOS_CONFIG" "/etc/nixos/configuration.nix"} $out";
+        ''ln -s '${import ../../../lib/from-env.nix "NIXOS_CONFIG" <nixos-config>}' \
+            "$out/configuration.nix"
+        '';
 
     system.build.toplevel = system;
 

nixos/release.nix

@@ -284,7 +284,6 @@ in rec {
   tests.networkingProxy = callTest tests/networking-proxy.nix {};
   tests.nfs3 = callTest tests/nfs.nix { version = 3; };
   tests.nfs4 = callTest tests/nfs.nix { version = 4; };
-  tests.nixosPinVersion = callTest tests/nixos-pin-version.nix {};
   tests.nsd = callTest tests/nsd.nix {};
   tests.openssh = callTest tests/openssh.nix {};
   tests.panamax = hydraJob (import tests/panamax.nix { system = "x86_64-linux"; });

nixos/tests/nixos-pin-version.nix

@@ -1,57 +0,0 @@
-{ system ? builtins.currentSystem }:
-
-with import ../lib/testing.nix { inherit system; };
-let
-in
-
-pkgs.stdenv.mkDerivation rec {
-  name = "nixos-pin-version";
-  src = ../..;
-  buildInputs = with pkgs; [ nix gnugrep ];
-
-    withoutPath = pkgs.writeText "configuration.nix" ''
-    {
-      nixos.extraModules = [ ({lib, ...}: { system.nixosRevision = lib.mkForce "ABCDEF"; }) ];
-    }
-  '';
-
-  withPath = pkgs.writeText "configuration.nix" ''
-    {
-      nixos.path = ${src}/nixos ;
-      nixos.extraModules = [ ({lib, ...}: { system.nixosRevision = lib.mkForce "ABCDEF"; }) ];
-    }
-  '';
-
-  phases = "buildPhase";
-  buildPhase = ''
-    datadir="${pkgs.nix}/share"
-    export TEST_ROOT=$(pwd)/test-tmp
-    export NIX_STORE_DIR=$TEST_ROOT/store
-    export NIX_LOCALSTATE_DIR=$TEST_ROOT/var
-    export NIX_LOG_DIR=$TEST_ROOT/var/log/nix
-    export NIX_STATE_DIR=$TEST_ROOT/var/nix
-    export NIX_DB_DIR=$TEST_ROOT/db
-    export NIX_CONF_DIR=$TEST_ROOT/etc
-    export NIX_MANIFESTS_DIR=$TEST_ROOT/var/nix/manifests
-    export NIX_BUILD_HOOK=
-    export PAGER=cat
-    cacheDir=$TEST_ROOT/binary-cache
-    nix-store --init
-
-    export NIX_PATH="nixpkgs=$src:nixos=$src/nixos:nixos-config=${withoutPath}" ;
-    if test $(nix-instantiate $src/nixos -A config.system.nixosRevision --eval-only) != '"ABCDEF"' ; then :;
-    else
-      echo "Unexpected re-entry without the nixos.path option defined.";
-      exit 1;
-    fi;
-
-    export NIX_PATH="nixpkgs=$src:nixos=$src/nixos:nixos-config=${withPath}" ;
-    if test $(nix-instantiate $src/nixos -A config.system.nixosRevision --eval-only) = '"ABCDEF"' ; then :;
-    else
-      echo "Expected a re-entry when the nixos.path option is defined.";
-      exit 1;
-    fi;
-
-    touch $out;
-  '';
-}

pkgs/applications/altcoins/bitcoin-classic.nix

@@ -0,0 +1,43 @@
+{ stdenv, fetchurl, pkgconfig, autoreconfHook, openssl, db48, boost
+, zlib, miniupnpc, qt4, utillinux, protobuf, qrencode
+, withGui }:
+
+with stdenv.lib;
+stdenv.mkDerivation rec {
+
+  name = "bitcoin" + (toString (optional (!withGui) "d")) + "-classic-" + version;
+  version = "0.11.2.cl1.b1";
+
+  src = fetchurl {
+    url = "https://github.com/bitcoinclassic/bitcoinclassic/archive/v${version}.tar.gz";
+    sha256 = "1szsnx5aijk3hx7qkqzbqsr0basg8ydwp20mh3bhnf4ljryy2049";
+  };
+
+  buildInputs = [ pkgconfig autoreconfHook openssl db48 boost zlib
+                  miniupnpc utillinux protobuf ]
+                  ++ optionals withGui [ qt4 qrencode ];
+
+  configureFlags = [ "--with-boost-libdir=${boost.lib}/lib" ]
+                     ++ optionals withGui [ "--with-gui=qt4" ];
+
+  meta = {
+    description = "Peer-to-peer electronic cash system (Classic client)";
+    longDescription= ''
+      Bitcoin is a free open source peer-to-peer electronic cash system that is
+      completely decentralized, without the need for a central server or trusted
+      parties. Users hold the crypto keys to their own money and transact directly
+      with each other, with the help of a P2P network to check for double-spending.
+
+      We call our code repository Bitcoin Classic. It starts as a one-feature patch
+      to bitcoin-core that increases the blocksize limit to 2 MB. We will have
+      ports for master and 0.11.2, so that miners and businesses can upgrade to 2 MB
+      blocks from any recent bitcoin software version they run. In the future we will
+      continue to release updates that are in line with Satoshi’s whitepaper &
+      vision, and are agreed upon by the community.
+    '';
+    homepage = "https://bitcoinclassic.com/";
+    maintainers = with maintainers; [ jefdaj ];
+    license = licenses.mit;
+    platforms = platforms.unix;
+  };
+}

pkgs/applications/altcoins/bitcoin-xt.nix

@@ -6,12 +6,11 @@ with stdenv.lib;
 stdenv.mkDerivation rec{
 
   name = "bitcoin" + (toString (optional (!withGui) "d")) + "-xt-" + version;
-  xt_version = "0.11A";
+  version = "0.11D";
-  version = xt_version;
 
   src = fetchurl {
-    url = "https://github.com/bitcoinxt/bitcoinxt/archive/v0.11A.tar.gz";
+    url = "https://github.com/bitcoinxt/bitcoinxt/archive/v${version}.tar.gz";
-    sha256 = "129cbqf6bln6rhdk70c6nfwdjk6afvsaaw4xdyp0pnfand8idz7n";
+    sha256 = "09r2i88wzqaj6mh66l3ngyfkm1a0dhwm5ibalj6y55wbxm9bvd36";
   };
 
   buildInputs = [ pkgconfig autoreconfHook openssl db48 boost zlib
@@ -24,8 +23,13 @@ stdenv.mkDerivation rec{
   ] ++ optionals withGui [ "--with-gui=qt4" ];
 
   meta = {
-    description = "Peer-to-peer electronic cash system";
+    description = "Peer-to-peer electronic cash system (XT client)";
     longDescription= ''
+      Bitcoin is a free open source peer-to-peer electronic cash system that is
+      completely decentralized, without the need for a central server or trusted
+      parties. Users hold the crypto keys to their own money and transact directly
+      with each other, with the help of a P2P network to check for double-spending.
+
       Bitcoin XT is an implementation of a Bitcoin full node, based upon the
       source code of Bitcoin Core. It is built by taking the latest stable
       Core release, applying a series of patches, and then doing deterministic

pkgs/applications/altcoins/default.nix

@@ -5,6 +5,9 @@ rec {
   bitcoin  = callPackage ./bitcoin.nix { withGui = true; };
   bitcoind = callPackage ./bitcoin.nix { withGui = false; };
 
+  bitcoin-classic  = callPackage ./bitcoin-classic.nix { withGui = true; };
+  bitcoind-classic = callPackage ./bitcoin-classic.nix { withGui = false; };
+
   bitcoin-xt  = callPackage ./bitcoin-xt.nix { withGui = true; };
   bitcoind-xt = callPackage ./bitcoin-xt.nix { withGui = false; };
 

pkgs/applications/audio/QmidiNet/default.nix

@@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
   name = "qmidinet-${version}";
 
   src = fetchurl {
-    url = "http://downloads.sourceforge.net/qmidinet/${name}.tar.gz";
+    url = "mirror://sourceforge/qmidinet/${name}.tar.gz";
     sha256 = "1a1pj4w74wj1gcfv4a0vzcglmr5sw0xp0y56w8rk3ig4k11xi8sa";
   };
 

pkgs/applications/audio/ardour/default.nix

@@ -15,7 +15,7 @@ let
   # "git describe" when _not_ on an annotated tag(!): MAJOR.MINOR-REV-HASH.
 
   # Version to build.
-  tag = "4.4";
+  tag = "4.7";
 
 in
 
@@ -25,8 +25,8 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "Ardour";
     repo = "ardour";
-    rev = "b00d75adf63db155ef2873bd9d259dc8ca256be6";
+    rev = "d84a8222f2b6dab5028b2586f798535a8766670e";
-    sha256 = "1gnrcnq2ksnh7fsa301v1c4p5dqrbqpjylf02rg3za3ab58wxi7l";
+    sha256 = "149gswphz77m3pkzsn2nqbm6yvcfa3fva560bcvjzlgb73f64q5l";
   };
 
   buildInputs =

pkgs/applications/audio/bitmeter/default.nix

@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     homepage = http://devel.tlrmx.org/audio/bitmeter/;
-    description = "Also known as jack bitscope. Useful to detect denormals.";
+    description = "Also known as jack bitscope. Useful to detect denormals";
     license = licenses.gpl2;
     maintainers = [ maintainers.magnetophon ];
     platforms = platforms.linux;

pkgs/applications/audio/eq10q/default.nix

@@ -3,7 +3,7 @@ stdenv.mkDerivation rec {
   name = "eq10q-2-${version}";
   version = "beta7.1";
   src = fetchurl {
-    url = "http://downloads.sourceforge.net/project/eq10q/${name}.tar.gz";
+    url = "mirror://sourceforge/project/eq10q/${name}.tar.gz";
     sha256 = "1jmrcx4jlx8kgsy5n4jcxa6qkjqvx7d8l2p7dsmw4hj20s39lgyi";
   };
 

pkgs/applications/audio/faust/faust1.nix

@@ -12,7 +12,7 @@ let
   version = "0.9.73";
 
   src = fetchurl {
-    url = "http://downloads.sourceforge.net/project/faudiostream/faust-${version}.tgz";
+    url = "mirror://sourceforge/project/faudiostream/faust-${version}.tgz";
     sha256 = "0x2scxkwvvjx7b7smj5xb8kr269qakf49z3fxpasd9g7025q44k5";
   };
 

pkgs/applications/audio/faust/faust2.nix

@@ -19,7 +19,7 @@ let
   version = "2.0-a41";
 
   src = fetchurl {
-    url = "http://downloads.sourceforge.net/project/faudiostream/faust-2.0.a41.tgz";
+    url = "mirror://sourceforge/project/faudiostream/faust-2.0.a41.tgz";
     sha256 = "1cq4x1cax0lswrcqv0limx5mjdi3187zlmh7cj2pndr0xq6b96cm";
   };
 

pkgs/applications/audio/gjay/default.nix

@@ -5,7 +5,7 @@ stdenv.mkDerivation {
   name = "gjay-0.3.2";
 
   src = fetchurl {
-    url = "http://downloads.sourceforge.net/project/gjay/gjay-0.3.2.tar.gz";
+    url = "mirror://sourceforge/project/gjay/gjay-0.3.2.tar.gz";
     sha256 = "1a1vv4r0vnxjdyl0jyv7gga3zfd5azxlwjm1l6hjrf71lb228zn8";
   };
 

pkgs/applications/audio/kid3/default.nix

@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   name = "kid3-${meta.version}";
 
   src = fetchurl {
-    url = "http://downloads.sourceforge.net/project/kid3/kid3/${meta.version}/${name}.tar.gz";
+    url = "mirror://sourceforge/project/kid3/kid3/${meta.version}/${name}.tar.gz";
     sha256 = "12sa54mg1b3wkagmh5yi20ski8km9d199lk0a1yfxy0ffjfld7js";
   };
 

pkgs/applications/audio/mp3gain/default.nix

@@ -3,7 +3,7 @@
 stdenv.mkDerivation {
   name = "mp3gain-1.5.2";
   src = fetchurl {
-    url = "http://downloads.sourceforge.net/mp3gain/mp3gain-1_5_2-src.zip";
+    url = "mirror://sourceforge/mp3gain/mp3gain-1_5_2-src.zip";
     sha256 = "1jkgry59m8cnnfq05b9y1h4x4wpy3iq8j68slb9qffwa3ajcgbfv";
   };
 

pkgs/applications/audio/pd-plugins/cyclone/default.nix

@@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
   version = "0.1-alpha55";
 
   src = fetchurl {
-    url = "http://downloads.sourceforge.net/project/pure-data/libraries/cyclone/${name}.tar.gz";
+    url = "mirror://sourceforge/project/pure-data/libraries/cyclone/${name}.tar.gz";
     sha256 = "1yys9xrlz09xgnqk2gqdl8vw6xj6l9d7km2lkihidgjql0jx5b5i";
   };
 

pkgs/applications/audio/pd-plugins/maxlib/default.nix

@@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
   version = "1.5.5";
 
   src = fetchurl {
-    url = "http://downloads.sourceforge.net/project/pure-data/libraries/maxlib/${name}.tar.gz";
+    url = "mirror://sourceforge/project/pure-data/libraries/maxlib/${name}.tar.gz";
     sha256 = "0vxl9s815dnay5r0067rxsfh8f6jbk61f0nxrydzjydfycza7p1w";
   };
 

pkgs/applications/audio/renoise/default.nix

@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ libX11 libXext libXcursor libXrandr alsaLib libjack2 ];
 
   src =
-    if builtins.currentSystem == "x86_64-linux" then
+    if stdenv.system == "x86_64-linux" then
         if demo then
         fetchurl {
             url = "http://files.renoise.com/demo/Renoise_3_0_1_Demo_x86_64.tar.bz2";
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
             name = "rns_3_0_1_linux_x86_64.tar.gz";
             sha256 = "1yb5w5jrg9dk9fg5rfvfk6p0rxn4r4i32vxp2l9lzhbs02pv15wd";
         }
-    else if builtins.currentSystem == "i686-linux" then
+    else if stdenv.system == "i686-linux" then
         if demo then
         fetchurl {
             url = "http://files.renoise.com/demo/Renoise_3_0_1_Demo_x86.tar.bz2";

pkgs/applications/audio/yoshimi/default.nix

@@ -1,20 +1,20 @@
 { stdenv, fetchurl, alsaLib, boost, cairo, cmake, fftwSinglePrec, fltk
-, libjack2, libsndfile, readline, lv2, mesa, minixml, pkgconfig, zlib, xorg
+, libjack2, libsndfile, libXdmcp, readline, lv2, mesa, minixml, pkgconfig, zlib, xorg
 }:
 
 assert stdenv ? glibc;
 
 stdenv.mkDerivation  rec {
   name = "yoshimi-${version}";
-  version = "1.3.7.1";
+  version = "1.3.8.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/yoshimi/${name}.tar.bz2";
-    sha256 = "13xc1x8jrr2rn26jx4dini692ww3771d5j5xf7f56ixqr7mmdhvz";
+    sha256 = "0wl4ln6v1nkkx56kfah23chyrhga2vi93i82g0s200c4s4184xr8";
   };
 
   buildInputs = [
-    alsaLib boost cairo fftwSinglePrec fltk libjack2 libsndfile readline lv2 mesa
+    alsaLib boost cairo fftwSinglePrec fltk libjack2 libsndfile libXdmcp readline lv2 mesa
     minixml zlib xorg.libpthreadstubs
   ];
 

pkgs/applications/editors/eclipse/build-eclipse.nix

@@ -1,4 +1,4 @@
-{ stdenv, makeDesktopItem, freetype, fontconfig, libX11, libXrender, zlib, jre, glib, gtk, libXtst, webkitgtk2, makeWrapper, ... }:
+{ stdenv, makeDesktopItem, freetype, fontconfig, libX11, libXrender, zlib, jdk, glib, gtk, libXtst, webkitgtk2, makeWrapper, ... }:
 
 { name, src ? builtins.getAttr stdenv.system sources, sources ? null, description }:
 
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     productVersion=$(sed 's/version=//; t; d' $out/eclipse/.eclipseproduct)
 
     makeWrapper $out/eclipse/eclipse $out/bin/eclipse \
-      --prefix PATH : ${jre}/bin \
+      --prefix PATH : ${jdk}/bin \
       --prefix LD_LIBRARY_PATH : ${glib}/lib:${gtk}/lib:${libXtst}/lib${stdenv.lib.optionalString (webkitgtk2 != null) ":${webkitgtk2}/lib"} \
       --add-flags "-configuration \$HOME/.eclipse/''${productId}_$productVersion/configuration"
 

pkgs/applications/editors/eclipse/default.nix

@@ -1,6 +1,6 @@
 { stdenv, fetchurl, makeDesktopItem, makeWrapper
 , freetype, fontconfig, libX11, libXext, libXrender, zlib
-, glib, gtk, libXtst, jre
+, glib, gtk, libXtst, jdk
 , webkitgtk2 ? null  # for internal web browser
 , buildEnv, writeText, runCommand
 , callPackage

pkgs/applications/editors/heme/default.nix

@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   name = "heme-${version}";
   version = "0.4.2";
   src = fetchurl {
-    url = "http://downloads.sourceforge.net/project/heme/heme/heme-${version}/heme-${version}.tar.gz";
+    url = "mirror://sourceforge/project/heme/heme/heme-${version}/heme-${version}.tar.gz";
     sha256 = "0wsrnj5mrlazgqs4252k30aw8m86qw0z9dmrsli9zdxl7j4cg99v";
   };
   postPatch = ''

pkgs/applications/gis/saga/default.nix

@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   src = fetchurl {
-    url = "http://downloads.sourceforge.net/project/saga-gis/SAGA%20-%202.2/SAGA%202.2.2/saga-2.2.2.tar.gz";
+    url = "mirror://sourceforge/project/saga-gis/SAGA%20-%202.2/SAGA%202.2.2/saga-2.2.2.tar.gz";
     sha256 = "031cd70b7ec248f32f955a9316aefc7f7ab283c5129c49aa4bd748717d20357e";
   };
 

pkgs/applications/graphics/PythonMagick/default.nix

@@ -2,7 +2,7 @@
 
 let
 
-  version = "0.9.11";
+  version = "0.9.12";
 
 in
 
@@ -10,8 +10,8 @@ stdenv.mkDerivation rec {
   name = "pythonmagick-${version}";
 
   src = fetchurl {
-    url = "http://www.imagemagick.org/download/python/releases/PythonMagick-${version}.tar.gz";
+    url = "http://www.imagemagick.org/download/python/releases/PythonMagick-${version}.tar.xz";
-    sha256 = "01z01mlqkk0lvrh2jsmf84qjw29sq4rpj0653x7nqy7mrszwwp2v";
+    sha256 = "1l1kr3d7l40fkxgs6mrlxj65alv2jizm9hhgg9i9g90a8qj8642b";
   };
 
   buildInputs = [python boost pkgconfig imagemagick];

pkgs/applications/graphics/apitrace/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, libX11, procps, python, qtbase }:
+{ stdenv, fetchFromGitHub, cmake, libX11, procps, python, libdwarf, qtbase, qtwebkit }:
 
 stdenv.mkDerivation rec {
   name = "apitrace-${version}";
@@ -11,13 +11,11 @@ stdenv.mkDerivation rec {
     owner = "apitrace";
   };
 
-  buildInputs = [ libX11 procps python qtbase ];
+  # LD_PRELOAD wrappers need to be statically linked to work against all kinds
-  nativeBuildInputs = [ cmake ];
+  # of games -- so it's fine to use e.g. bundled snappy.
+  buildInputs = [ libX11 procps python libdwarf qtbase qtwebkit ];
 
-  buildPhase = ''
+  nativeBuildInputs = [ cmake ];
-    cmake
-    make
-  '';
 
   meta = with stdenv.lib; {
     homepage = https://apitrace.github.io;

pkgs/applications/graphics/xara/default.nix

@@ -17,4 +17,6 @@ stdenv.mkDerivation {
   patches = map fetchurl (import ./debian-patches.nix);
 
   prePatch = "patchShebangs Scripts";
+
+  meta.broken = true;
 }

pkgs/applications/misc/chirp/default.nix

@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    description = "A free, open-source tool for programming your amateur radio.";
+    description = "A free, open-source tool for programming your amateur radio";
     homepage = http://chirp.danplanet.com/;
     license = licenses.gpl3;
     platforms = platforms.linux;

pkgs/applications/misc/devilspie2/default.nix

@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    description = "Devilspie2 is a window matching utility.";
+    description = "Devilspie2 is a window matching utility";
     longDescription = ''
       Devilspie2 is a window matching utility, allowing the user to
       perform scripted actions on windows as they are created. For

pkgs/applications/misc/direwolf/default.nix

@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    description = "A Soundcard Packet TNC, APRS Digipeater, IGate, APRStt gateway.";
+    description = "A Soundcard Packet TNC, APRS Digipeater, IGate, APRStt gateway";
     # On the page: This page will be disappearing on October 8, 2015.
     homepage = https://home.comcast.net/~wb2osz/site/;
     license = licenses.gpl2;

pkgs/applications/misc/galculator/default.nix

@@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
   version = "2.1.3";
 
   src = fetchurl {
-    url = "http://downloads.sourceforge.net/galculator/${name}.tar.gz";
+    url = "mirror://sourceforge/galculator/${name}.tar.gz";
     sha256 = "12m7dldjk10lpkdxk7zpk98n32ci65zmxidghihb7n1m3rhp3q17";
   };
 

pkgs/applications/misc/jp2a/default.nix

@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     homepage = https://csl.name/jp2a/;
-    description = "A small utility that converts JPG images to ASCII.";
+    description = "A small utility that converts JPG images to ASCII";
     license = licenses.gpl2;
   };
 }

pkgs/applications/misc/lxappearance/default.nix

@@ -3,7 +3,7 @@
 stdenv.mkDerivation rec {
   name = "lxappearance-0.6.1";
   src = fetchurl{
-    url = "http://downloads.sourceforge.net/project/lxde/LXAppearance/${name}.tar.xz";
+    url = "mirror://sourceforge/project/lxde/LXAppearance/${name}.tar.xz";
     sha256 = "1phnv1b2jdj2vlibjyc9z01izcf3k5zxj8glsaf0i3vh77zqmqq9";
   };
   buildInputs = [ intltool libX11 pkgconfig gtk ];

pkgs/applications/misc/multimon-ng/default.nix

@@ -22,7 +22,7 @@ stdenv.mkDerivation {
   '';
 
   meta = with stdenv.lib; {
-    description = "Multimon is a digital baseband audio protocol decoder.";
+    description = "Multimon is a digital baseband audio protocol decoder";
     longDescription = ''
       multimon-ng a fork of multimon, a digital baseband audio
       protocol decoder for common signaling modes in commercial and

pkgs/applications/misc/quicksynergy/default.nix

@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   name = "quicksynergy-${version}";
   version = "0.9.0";
   src = fetchurl {
-    url = "http://downloads.sourceforge.net/project/quicksynergy/Linux/${version}/quicksynergy-${version}.tar.gz";
+    url = "mirror://sourceforge/project/quicksynergy/Linux/${version}/quicksynergy-${version}.tar.gz";
     sha256 = "1pi8503bg8q1psw50y6d780i33nnvfjqiy9vnr3v52pdcfip8pix";
   };
   buildInputs = [

pkgs/applications/misc/roxterm/default.nix

@@ -13,7 +13,7 @@ in stdenv.mkDerivation rec {
   name = "roxterm-${version}";
 
   src = fetchurl {
-    url = "http://downloads.sourceforge.net/roxterm/${name}.tar.bz2";
+    url = "mirror://sourceforge/roxterm/${name}.tar.bz2";
     sha256 = "0djfiwfmnqqp6930kswzr2rss0mh40vglcdybwpxrijcw4n8j21x";
   };
 

pkgs/applications/misc/vym/default.nix

@@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
   version = "2.2.4";
 
   src = fetchurl {
-    url = "http://downloads.sourceforge.net/project/vym/${version}/${name}.tar.bz2";
+    url = "mirror://sourceforge/project/vym/${version}/${name}.tar.bz2";
     sha256 = "1x4qp6wpszscbbs4czkfvskm7qjglvxm813nqv281bpy4y1hhvgs";
   };
 

pkgs/applications/misc/xiphos/default.nix

@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   version = "4.0.3-20150806";
 
   src = fetchurl {
-    url = "http://downloads.sourceforge.net/project/gnomesword/Xiphos/4.0.3/${name}.tar.gz";
+    url = "mirror://sourceforge/project/gnomesword/Xiphos/4.0.3/${name}.tar.gz";
     sha256 = "1xkvhpasdlda2rp0874znz158z4rjh1hpynwy13d96kjxq4npiqv";
   };
 

pkgs/applications/networking/instant-messengers/choqok/default.nix

@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   name = "${pn}-${v}";
 
   src = fetchurl {
-    url = "http://downloads.sourceforge.net/project/choqok/Choqok/choqok-1.5.tar.xz";
+    url = "mirror://sourceforge/project/choqok/Choqok/choqok-1.5.tar.xz";
     sha256 = "5cb97ac4cdf9db4699bb7445a9411393073d213fea649ab0713f659f1308efe4";
   };
 

pkgs/applications/networking/mailreaders/thunderbird/default.nix

@@ -13,7 +13,7 @@
   enableOfficialBranding ? false
 }:
 
-let version = "38.3.0"; in
+let version = "38.6.0"; in
 let verName = "${version}"; in
 
 stdenv.mkDerivation rec {

pkgs/applications/office/libreoffice/default.nix

@@ -106,6 +106,9 @@ in stdenv.mkDerivation rec {
     patchShebangs .
     # It is used only as an indicator of the proper current directory
     touch solenv/inc/target.mk
+
+    # BLFS patch for Glibc 2.23 renaming isnan
+    sed -ire "s@isnan@std::&@g" xmloff/source/draw/ximp3dscene.cxx
   '';
 
   # fetch_Download_item tries to interpret the name as a variable name

pkgs/applications/science/math/lp_solve/default.nix

@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    description = "lp_solve is a Mixed Integer Linear Programming (MILP) solver.";
+    description = "lp_solve is a Mixed Integer Linear Programming (MILP) solver";
     homepage    = "http://lpsolve.sourceforge.net";
     license     = licenses.gpl2Plus;
     maintainers = with maintainers; [ smironov ];

pkgs/applications/version-management/git-and-tools/cgit/default.nix

@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   name = "cgit-${version}";
-  version = "0.11.2";
+  version = "0.12";
 
   src = fetchurl {
     url = "http://git.zx2c4.com/cgit/snapshot/${name}.tar.xz";
-    sha256 = "0fryh56kyah7v9a8zzhbhwlyy2j116w87sxmgrn2kmwk0rvnw4if";
+    sha256 = "1dx54hgfyabmg9nm5qp6d01f54nlbqbbdwhwl0llb9imjf237qif";
   };
 
   # cgit is tightly coupled with git and needs a git source tree to build.
@@ -18,8 +18,8 @@ stdenv.mkDerivation rec {
   # NOTE: as of 0.10.1, the git version is compatible from 1.9.0 to
   # 1.9.2 (see the repository history)
   gitSrc = fetchurl {
-    url    = "mirror://kernel/software/scm/git/git-2.3.2.tar.xz";
+    url    = "mirror://kernel/software/scm/git/git-2.7.0.tar.xz";
-    sha256 = "09gqijsjfnxlbsxbxzlvllg37bfs9f4jwa2plqsanmba09i89sqq";
+    sha256 = "03bvb8s5j8i54qbi3yayl42bv0wf2fpgnh1a2lkhbj79zi7b77zs";
   };
 
   buildInputs = [

pkgs/applications/version-management/git-and-tools/git-radar/default.nix

@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = https://github.com/michaeldfallen/git-radar;
     license = licenses.mit;
-    description = "Git-radar is a tool you can add to your prompt to provide at-a-glance information on your git repo.";
+    description = "Git-radar is a tool you can add to your prompt to provide at-a-glance information on your git repo";
     platforms = with platforms; linux ++ darwin;
     maintainers = with maintainers; [ kamilchm ];
   };

pkgs/applications/version-management/gitinspector/default.nix

@@ -2,12 +2,12 @@
 
 buildPythonApplication rec {
   name = "gitinspector-${version}";
-  version = "0.4.1";
+  version = "0.4.4";
   namePrefix = "";
 
   src = fetchzip {
     url = "https://github.com/ejwa/gitinspector/archive/v${version}.tar.gz";
-    sha256 = "07kjvf9cj6g6gvjgnnas5facm3nhxppf0l0fcxyd4vq6xhdb3swp";
+    sha256 = "1pfsw6xldm6jigs3nhysvqaxk8a0zf8zczgfkrp920as9sya3c7m";
     name = name + "-src";
   };
 

pkgs/applications/version-management/gitstats/default.nix

@@ -0,0 +1,39 @@
+{ stdenv, fetchzip, perl, python, gnuplot, coreutils, gnugrep }:
+
+stdenv.mkDerivation rec {
+  name = "gitstats-${version}";
+  version = "2016-01-08";
+
+  # upstream does not make releases
+  src = fetchzip {
+    url = "https://github.com/hoxu/gitstats/archive/55c5c285558c410bb35ebf421245d320ab9ee9fa.zip";
+    sha256 = "1bfcwhksylrpm88vyp33qjby4js31zcxy7w368dzjv4il3fh2i59";
+    name = name + "-src";
+  };
+
+  buildInputs = [ perl python ];
+
+  postPatch = ''
+    sed -e "s|gnuplot_cmd = .*|gnuplot_cmd = '${gnuplot}/bin/gnuplot'|" \
+        -e "s|\<wc\>|${coreutils}/bin/wc|g" \
+        -e "s|\<grep\>|${gnugrep}/bin/grep|g" \
+        -i gitstats
+  '';
+
+  buildPhase = ''
+    make man VERSION="${version}"
+  '';
+
+  installPhase = ''
+    make install PREFIX="$out" VERSION="${version}"
+    install -Dm644 doc/gitstats.1 "$out"/share/man/man1/gitstats.1
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = http://gitstats.sourceforge.net/;
+    description = "Git history statistics generator";
+    license = licenses.gpl2Plus;
+    platforms = platforms.all;
+    maintainers = [ maintainers.bjornfor ];
+  };
+}

pkgs/applications/video/wxcam/default.nix

@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   version = "1.1";
 
   src = fetchurl {
-    url = "http://downloads.sourceforge.net/project/wxcam/wxcam/${version}/${name}.tar.gz";
+    url = "mirror://sourceforge/project/wxcam/wxcam/${version}/${name}.tar.gz";
     sha256 = "1765bvc65fpzn9ycnnj5hais9xkx9v0sm6a878d35x54bpanr859";
   };
 

pkgs/applications/virtualization/bochs/default.nix

@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   version = "2.6.8";
 
   src = fetchurl {
-    url = "http://downloads.sourceforge.net/project/bochs/bochs/${version}/${name}.tar.gz";
+    url = "mirror://sourceforge/project/bochs/bochs/${version}/${name}.tar.gz";
     sha256 = "1kl5cmbz6qgg33j5vv9898nzdppp1rqgy24r5pv762aaj7q0ww3r";
   };
 

pkgs/applications/virtualization/qemu/default.nix

@@ -11,7 +11,7 @@
 
 with stdenv.lib;
 let
-  version = "2.4.1";
+  version = "2.5.0";
   audio = optionalString (hasSuffix "linux" stdenv.system) "alsa,"
     + optionalString pulseSupport "pa,"
     + optionalString sdlSupport "sdl,";
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "http://wiki.qemu.org/download/qemu-${version}.tar.bz2";
-    sha256 = "0xx1wc7lj5m3r2ab7f0axlfknszvbd8rlclpqz4jk48zid6czmg3";
+    sha256 = "1m3j6xl7msrniidkvr5pw9d44yba5m7hm42xz8xy77v105s8hhrl";
   };
 
   buildInputs =

pkgs/applications/window-managers/i3/blocks.nix

@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   installFlags = "PREFIX=\${out} VERSION=${version}";
 
   meta = with stdenv.lib; {
-    description = "A flexible scheduler for your i3bar blocks.";
+    description = "A flexible scheduler for your i3bar blocks";
     homepage = https://github.com/vivien/i3blocks;
     license = licenses.gpl3;
     maintainers = [ "MindTooth" ];

pkgs/build-support/fetchgit/nix-prefetch-git

@@ -12,6 +12,11 @@ fetchSubmodules=
 builder=
 branchName=$NIX_PREFETCH_GIT_BRANCH_NAME
 
+# populated by clone_user_rev()
+fullRev=
+humanReadableRev=
+commitDate=
+
 if test -n "$deepClone"; then
     deepClone=true
 else
@@ -52,6 +57,7 @@ for arg; do
             --hash) argfun=set_hashType;;
             --branch-name) argfun=set_branchName;;
             --deepClone) deepClone=true;;
+            --quiet) QUIET=true;;
             --no-deepClone) deepClone=false;;
             --leave-dotGit) leaveDotGit=true;;
             --fetch-submodules) fetchSubmodules=true;;
@@ -254,7 +260,7 @@ make_deterministic_repo(){
 }
 
 
-clone_user_rev() {
+_clone_user_rev() {
     local dir="$1"
     local url="$2"
     local rev="${3:-HEAD}"
@@ -272,23 +278,60 @@ clone_user_rev() {
             fi;;
     esac
 
-    local full_revision=$(cd $dir && (git rev-parse $rev 2> /dev/null || git rev-parse refs/heads/$branchName) | tail -n1)
+    fullRev="$(cd $dir && (git rev-parse $rev 2> /dev/null || git rev-parse refs/heads/$branchName) | tail -n1)"
-    echo "git revision is $full_revision"
+    humanReadableRev="$(cd $dir && (git describe $fullRev 2> /dev/null || git describe --tags $fullRev 2> /dev/null || echo -- none --))"
-    echo "git human-readable version is $(cd $dir && (git describe $full_revision 2> /dev/null || git describe --tags $full_revision 2> /dev/null || echo -- none --))" >&2
+    commitDate="$(cd $dir && git show --no-patch --pretty=%ci $fullRev)"
-    echo "Commit date is $(cd $dir && git show --no-patch --pretty=%ci $full_revision)"
 
     # Allow doing additional processing before .git removal
     eval "$NIX_PREFETCH_GIT_CHECKOUT_HOOK"
     if test -z "$leaveDotGit"; then
         echo "removing \`.git'..." >&2
-        find $dir -name .git\* | xargs rm -rf
+        find "$dir" -name .git\* -print0 | xargs -0 rm -rf
     else
-        find $dir -name .git | while read gitdir; do
+        find "$dir" -name .git | while read gitdir; do
             make_deterministic_repo "$(readlink -f "$gitdir/..")"
         done
     fi
 }
 
+clone_user_rev() {
+    if ! test -n "$QUIET"; then
+        _clone_user_rev "$@"
+    else
+        errfile="$(mktemp "${TMPDIR:-/tmp}/git-checkout-err-XXXXXXXX")"
+        trap "rm -rf \"$errfile\"" EXIT
+        _clone_user_rev "$@" 2> "$errfile" || (
+            status="$?"
+            cat "$errfile" >&2
+            exit "$status"
+        )
+    fi
+}
+
+
+print_results() {
+    hash="$1"
+    if ! test -n "$QUIET"; then
+        echo "" >&2
+        echo "git revision is $fullRev" >&2
+        if test -n "$finalPath"; then
+            echo "path is $finalPath" >&2
+        fi
+        echo "git human-readable version is $humanReadableRev" >&2
+        echo "Commit date is $commitDate" >&2
+        if test -n "$hash"; then
+            echo "hash is $hash" >&2
+        fi
+    fi
+    if test -n "$hash"; then
+        echo "{"
+        echo "  url = \"$url\";"
+        echo "  rev = \"$fullRev\";"
+        echo "  $hashType = \"$hash\";"
+        echo "}"
+    fi
+}
+
 if test -z "$branchName"; then
     branchName=fetchgit
 fi
@@ -327,20 +370,18 @@ else
 
         # Compute the hash.
         hash=$(nix-hash --type $hashType --base32 $tmpFile)
-        if ! test -n "$QUIET"; then echo "hash is $hash" >&2; fi
 
         # Add the downloaded file to the Nix store.
         finalPath=$(nix-store --add-fixed --recursive "$hashType" "$tmpFile")
 
         if test -n "$expHash" -a "$expHash" != "$hash"; then
-            echo "hash mismatch for URL \`$url'"
+            print_metadata
+            echo "hash mismatch for URL \`$url'" >&2
             exit 1
         fi
     fi
 
-    if ! test -n "$QUIET"; then echo "path is $finalPath" >&2; fi
+    print_results "$hash"
-
-    echo $hash
 
     if test -n "$PRINT_PATH"; then
         echo $finalPath

pkgs/build-support/fetchurl/boot.nix

@@ -0,0 +1,20 @@
+let mirrors = import ./mirrors.nix; in
+
+{ system }:
+
+{ url ? builtins.head urls
+, urls ? []
+, sha256
+}:
+
+import <nix/fetchurl.nix> {
+  inherit system sha256;
+
+  url =
+    # Handle mirror:// URIs. Since <nix/fetchurl.nix> currently
+    # supports only one URI, use the first listed mirror.
+    let m = builtins.match "mirror://([a-z]+)/(.*)" url; in
+    if m == null then url
+    else builtins.head (mirrors.${builtins.elemAt m 0}) + (builtins.elemAt m 1);
+
+}

pkgs/data/icons/vanilla-dmz/default.nix

@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   '';
   meta = with lib; {
     homepage = "http://jimmac.musichall.cz";
-    description = "A style neutral scalable cursor theme.";
+    description = "A style neutral scalable cursor theme";
     platforms = platforms.all;
     license = licenses.cc-by-nc-sa-30;
     maintainers = with maintainers; [ cstrahan ];

pkgs/desktops/e19/default.nix

@@ -1,16 +1,7 @@
 { callPackage, pkgs }:
-let
-  openjpeg_1 = with pkgs; lib.overrideDerivation openjpeg (oldAttrs: rec {
-         name = "openjpeg-1.5.2";
-         src = fetchurl {
-           url = "mirror://sourceforge/openjpeg.mirror/${name}.tar.gz";
-           sha1 = "lahbqvjpsfdxsrm0wsy3pdrp3pzrjvj9";
-         };
-     });
-in
 rec {
   #### CORE EFL
-  efl = callPackage ./efl.nix { openjpeg=openjpeg_1; };
+  efl = callPackage ./efl.nix { openjpeg = pkgs.openjpeg_1; };
   evas = callPackage ./evas.nix { };
   emotion = callPackage ./emotion.nix { };
   elementary = callPackage ./elementary.nix { };

pkgs/desktops/plasma-5.5/libksysguard/default.nix

@@ -1,4 +1,4 @@
-{ plasmaPackage, extra-cmake-modules, kauth, kcompletion
+{ fetchpatch, plasmaPackage, extra-cmake-modules, kauth, kcompletion
 , kconfigwidgets, kcoreaddons, kservice, kwidgetsaddons
 , kwindowsystem, plasma-framework, qtscript, qtwebkit, qtx11extras
 , kconfig, ki18n, kiconthemes
@@ -6,7 +6,14 @@
 
 plasmaPackage {
   name = "libksysguard";
-  patches = [ ./0001-qdiriterator-follow-symlinks.patch ];
+  patches = [
+    ./0001-qdiriterator-follow-symlinks.patch
+    (fetchpatch { # should be included on update
+      name = "glibc-2.23-isnan.patch";
+      url = https://github.com/KDE/libksysguard/commit/b0578798eb3.patch;
+      sha256 = "1my5nqp58c5azyi265j261a10wh047zxakprrnpl85mlg7bwskdh";
+    })
+  ];
   nativeBuildInputs = [
     extra-cmake-modules
   ];

pkgs/desktops/xfce/default.nix

@@ -14,7 +14,7 @@ xfce_self = rec { # the lines are very long but it seems better than the even-od
 
   #### NixOS support
 
-  inherit (pkgs) gvfs;
+  gvfs = pkgs.gvfs.override { samba = null; }; # samba is a rather heavy dependency
   xinitrc = "${xfce4session}/etc/xdg/xfce4/xinitrc";
 
   #### CORE                 from "mirror://xfce/src/xfce/${p_name}/${ver_maj}/${name}.tar.bz2"

pkgs/desktops/xfce/panel-plugins/xfce4-whiskermenu-plugin.nix

@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     homepage = "http://goodies.xfce.org/projects/panel-plugins/${p_name}";
-    description = "Whisker Menu is an alternate application launcher for Xfce.";
+    description = "Whisker Menu is an alternate application launcher for Xfce";
     platforms = platforms.linux;
     maintainers = [ maintainers.pjbarnoy ];
   };

pkgs/development/compilers/coreclr/default.nix

@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     homepage = http://dotnet.github.io/core/;
-    description = ".NET is a general purpose development platform.";
+    description = ".NET is a general purpose development platform";
     platforms = [ "x86_64-linux" ];
     maintainers = with stdenv.lib.maintainers; [ obadz ];
     license = stdenv.lib.licenses.mit;

pkgs/development/compilers/elm/packages/elm-compiler.nix

@@ -33,6 +33,6 @@ mkDerivation {
   ];
   jailbreak = true;
   homepage = "http://elm-lang.org";
-  description = "Values to help with elm-package, elm-make, and elm-lang.org.";
+  description = "Values to help with elm-package, elm-make, and elm-lang.org";
   license = stdenv.lib.licenses.bsd3;
 }

pkgs/development/compilers/gcc/gfortran-darwin.nix

@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
   makeFlags = ["CC=clang"];
   passthru.cc = stdenv.cc.cc;
   meta = with stdenv.lib; {
-    description = "GNU Fortran compiler, part of the GNU Compiler Collection.";
+    description = "GNU Fortran compiler, part of the GNU Compiler Collection";
     homepage    = "https://gcc.gnu.org/fortran/";
     license     = licenses.gpl3Plus;
     platforms   = platforms.darwin;

pkgs/development/erlang-modules/hex-packages.nix

@@ -388,7 +388,7 @@ let
 	      "4dacd60356177ec8cf93dbff399de17435b613f3318202614d3d5acbccee1474";
 	      
 	    meta = {
-	      description = "Support library for manipulating Web protocols.";
+	      description = "Support library for manipulating Web protocols";
 	      license = stdenv.lib.licenses.isc;
 	      homepage = "https://github.com/ninenines/cowlib";
 	    };
@@ -405,7 +405,7 @@ let
 	      "db622da03aa039e6366ab953e31186cc8190d32905e33788a1acb22744e6abd2";
 	      
 	    meta = {
-	      description = "Support library for manipulating Web protocols.";
+	      description = "Support library for manipulating Web protocols";
 	      license = stdenv.lib.licenses.isc;
 	      homepage = "https://github.com/ninenines/cowlib";
 	    };
@@ -422,7 +422,7 @@ let
 	      "2b1ac020ec92e7a59cb7322779870c2d3adc7c904ecb3b9fa406f04dc9816b73";
 	      
 	    meta = {
-	      description = "Support library for manipulating Web protocols.";
+	      description = "Support library for manipulating Web protocols";
 	      license = stdenv.lib.licenses.isc;
 	      homepage = "https://github.com/ninenines/cowlib";
 	    };
@@ -599,7 +599,7 @@ let
 	      "6d7365a7854cd724e8d1fd005f5faa4444eae6a87eb6df9b789b6e7f6f09110a";
 	      
 	    meta = {
-	      description = "Markdown generated from Edoc.";
+	      description = "Markdown generated from Edoc";
 	      license = stdenv.lib.licenses.free;
 	      homepage = "https://github.com/uwiger/edown";
 	    };
@@ -1500,7 +1500,7 @@ let
 	    compilePorts = true;
 	     
 	    meta = {
-	      description = "JSON Decoder/Encoder.";
+	      description = "JSON Decoder/Encoder";
 	      license = with stdenv.lib.licenses; [ mit bsd3 ];
 	      homepage = "https://github.com/davisp/jiffy";
 	    };
@@ -1792,7 +1792,7 @@ let
 	      "53e70ea9031f7583331a9f9bdbb29da933e591e5c4cce521b4bf85c68e7f3385";
 	      
 	    meta = {
-	      description = "Lasse: Server-Sent Event handler for Cowboy.";
+	      description = "Lasse: Server-Sent Event handler for Cowboy";
 	      license = stdenv.lib.licenses.asl20;
 	      homepage = "https://github.com/inaka/lasse";
 	    };
@@ -2196,7 +2196,7 @@ let
 	    erlangDeps  = [ getopt_0_8_2 ];
 	    
 	    meta = {
-	      description = "Providers provider.";
+	      description = "Providers provider";
 	      license = stdenv.lib.licenses.mit;
 	      homepage = "https://github.com/tsloughter/providers";
 	    };
@@ -2296,7 +2296,7 @@ let
 	      "98ade939e63e6567da5dec5bc5bd93cbdc53d53f8b1aa998adec60dc4057f048";
 	      
 	    meta = {
-	      description = "Socket acceptor pool for TCP protocols.";
+	      description = "Socket acceptor pool for TCP protocols";
 	      license = stdenv.lib.licenses.isc;
 	      homepage = "https://github.com/ninenines/ranch";
 	    };
@@ -2313,7 +2313,7 @@ let
 	      "82bbb48cdad151000f7ad600d7a29afd972df409fde600bbc9b1ed4fdc08c399";
 	      
 	    meta = {
-	      description = "Socket acceptor pool for TCP protocols.";
+	      description = "Socket acceptor pool for TCP protocols";
 	      license = stdenv.lib.licenses.isc;
 	      homepage = "https://github.com/ninenines/ranch";
 	    };
@@ -2933,7 +2933,7 @@ let
 	      "742c45b3c99e207dd0aeccb818edd2ace4af10699c96fbcee0ce2f692dc5fe12";
 	      
 	    meta = {
-	      description = "weber - is Elixir MVC web framework.";
+	      description = "weber - is Elixir MVC web framework";
 	      license = stdenv.lib.licenses.mit;
 	      homepage = "https://github.com/elixir-web/weber";
 	    };

pkgs/development/haskell-modules/configuration-common.nix

@@ -35,9 +35,6 @@ self: super: {
   hspec-expectations = dontCheck super.hspec-expectations;
   hspec = super.hspec.override { stringbuilder = dontCheck super.stringbuilder; };
   HTTP = dontCheck super.HTTP;
-  mwc-random_0_13_2_2 = dontCheck super.mwc-random_0_13_2_2;
-  mwc-random_0_13_3_0 = dontCheck super.mwc-random_0_13_3_0;
-  mwc-random = dontCheck super.mwc-random;
   nanospec_0_2_0 = dontCheck super.nanospec_0_2_0;
   nanospec = dontCheck super.nanospec;
   options_1_2_1 = dontCheck super.options_1_2_1;
@@ -330,7 +327,7 @@ self: super: {
   github-types = dontCheck super.github-types;          # http://hydra.cryp.to/build/1114046/nixlog/1/raw
   hadoop-rpc = dontCheck super.hadoop-rpc;              # http://hydra.cryp.to/build/527461/nixlog/2/raw
   hasql = dontCheck super.hasql;                        # http://hydra.cryp.to/build/502489/nixlog/4/raw
-  hjsonschema = overrideCabal super.hjsonschema (drv: { testTarget = "local"; });
+  hjsonschema = overrideCabal (super.hjsonschema.override { hjsonpointer = pkgs.hjsonpointer_0_2_0_4; }) (drv: { testTarget = "local"; });
   hoogle = overrideCabal super.hoogle (drv: { testTarget = "--test-option=--no-net"; });
   marmalade-upload = dontCheck super.marmalade-upload;  # http://hydra.cryp.to/build/501904/nixlog/1/raw
   network-transport-tcp = dontCheck super.network-transport-tcp;

pkgs/development/haskell-modules/configuration-hackage2nix.yaml

@@ -45,6 +45,7 @@ extra-packages:
   - gloss < 1.9.3                       # new versions don't compile with GHC 7.8.x
   - haddock-api < 2.16                  # required on GHC 7.8.x
   - haskell-src-exts < 1.16             # required for structured-haskell-mode-1.0.8
+  - hjsonpointer == 0.2.0.4             # required for hjsonschema-0.8.0.1
   - mtl < 2.2                           # newer versions require transformers > 0.4.x, which we cannot provide in GHC 7.8.x
   - mtl-prelude < 2                     # required for to build postgrest on mtl 2.1.x platforms
   - parallel == 3.2.0.3                 # newer versions don't work with GHC 6.12.3

pkgs/development/haskell-modules/configuration-lts-0.0.nix

@@ -655,6 +655,7 @@ self: super: {
   "LogicGrowsOnTrees-processes" = dontDistribute super."LogicGrowsOnTrees-processes";
   "LslPlus" = dontDistribute super."LslPlus";
   "Lucu" = dontDistribute super."Lucu";
+  "MASMGen" = dontDistribute super."MASMGen";
   "MC-Fold-DP" = dontDistribute super."MC-Fold-DP";
   "MFlow" = dontDistribute super."MFlow";
   "MHask" = dontDistribute super."MHask";
@@ -1489,6 +1490,7 @@ self: super: {
   "authoring" = dontDistribute super."authoring";
   "auto" = dontDistribute super."auto";
   "auto-update" = doDistribute super."auto-update_0_1_2";
+  "autoexporter" = dontDistribute super."autoexporter";
   "autonix-deps" = dontDistribute super."autonix-deps";
   "autonix-deps-kf5" = dontDistribute super."autonix-deps-kf5";
   "autoproc" = dontDistribute super."autoproc";
@@ -1982,6 +1984,7 @@ self: super: {
   "cases" = doDistribute super."cases_0_1_2";
   "cash" = dontDistribute super."cash";
   "casing" = dontDistribute super."casing";
+  "casr-logbook" = dontDistribute super."casr-logbook";
   "cassandra-cql" = dontDistribute super."cassandra-cql";
   "cassandra-thrift" = dontDistribute super."cassandra-thrift";
   "cassava" = doDistribute super."cassava_0_4_2_0";
@@ -1996,6 +1999,7 @@ self: super: {
   "categorical-algebra" = dontDistribute super."categorical-algebra";
   "categories" = dontDistribute super."categories";
   "category-extras" = dontDistribute super."category-extras";
+  "category-traced" = dontDistribute super."category-traced";
   "cayley-client" = dontDistribute super."cayley-client";
   "cayley-dickson" = dontDistribute super."cayley-dickson";
   "cblrepo" = dontDistribute super."cblrepo";
@@ -2737,6 +2741,7 @@ self: super: {
   "direct-sqlite" = doDistribute super."direct-sqlite_2_3_14";
   "directed-cubical" = dontDistribute super."directed-cubical";
   "directory-layout" = dontDistribute super."directory-layout";
+  "directory-listing-webpage-parser" = dontDistribute super."directory-listing-webpage-parser";
   "dirfiles" = dontDistribute super."dirfiles";
   "dirstream" = dontDistribute super."dirstream";
   "disassembler" = dontDistribute super."disassembler";
@@ -2753,6 +2758,7 @@ self: super: {
   "distributed-process-async" = dontDistribute super."distributed-process-async";
   "distributed-process-azure" = dontDistribute super."distributed-process-azure";
   "distributed-process-client-server" = dontDistribute super."distributed-process-client-server";
+  "distributed-process-ekg" = dontDistribute super."distributed-process-ekg";
   "distributed-process-execution" = dontDistribute super."distributed-process-execution";
   "distributed-process-extras" = dontDistribute super."distributed-process-extras";
   "distributed-process-lifted" = dontDistribute super."distributed-process-lifted";
@@ -3246,6 +3252,7 @@ self: super: {
   "flowsim" = dontDistribute super."flowsim";
   "fltkhs" = dontDistribute super."fltkhs";
   "fltkhs-demos" = dontDistribute super."fltkhs-demos";
+  "fltkhs-fluid-demos" = dontDistribute super."fltkhs-fluid-demos";
   "fltkhs-fluid-examples" = dontDistribute super."fltkhs-fluid-examples";
   "fltkhs-hello-world" = dontDistribute super."fltkhs-hello-world";
   "fluent-logger" = dontDistribute super."fluent-logger";
@@ -4057,6 +4064,7 @@ self: super: {
   "haskell-gi-base" = dontDistribute super."haskell-gi-base";
   "haskell-import-graph" = dontDistribute super."haskell-import-graph";
   "haskell-in-space" = dontDistribute super."haskell-in-space";
+  "haskell-kubernetes" = dontDistribute super."haskell-kubernetes";
   "haskell-modbus" = dontDistribute super."haskell-modbus";
   "haskell-mpfr" = dontDistribute super."haskell-mpfr";
   "haskell-mpi" = dontDistribute super."haskell-mpi";
@@ -4255,6 +4263,7 @@ self: super: {
   "herringbone" = dontDistribute super."herringbone";
   "herringbone-embed" = dontDistribute super."herringbone-embed";
   "herringbone-wai" = dontDistribute super."herringbone-wai";
+  "hesh" = dontDistribute super."hesh";
   "hesql" = dontDistribute super."hesql";
   "hetero-map" = dontDistribute super."hetero-map";
   "hetris" = dontDistribute super."hetris";
@@ -4753,6 +4762,7 @@ self: super: {
   "http-date" = doDistribute super."http-date_0_0_4";
   "http-encodings" = dontDistribute super."http-encodings";
   "http-enumerator" = dontDistribute super."http-enumerator";
+  "http-kinder" = dontDistribute super."http-kinder";
   "http-kit" = dontDistribute super."http-kit";
   "http-link-header" = dontDistribute super."http-link-header";
   "http-listen" = dontDistribute super."http-listen";
@@ -5415,6 +5425,7 @@ self: super: {
   "libtagc" = dontDistribute super."libtagc";
   "libvirt-hs" = dontDistribute super."libvirt-hs";
   "libvorbis" = dontDistribute super."libvorbis";
+  "libxls" = dontDistribute super."libxls";
   "libxml" = dontDistribute super."libxml";
   "libxml-enumerator" = dontDistribute super."libxml-enumerator";
   "libxml-sax" = dontDistribute super."libxml-sax";
@@ -6140,6 +6151,7 @@ self: super: {
   "nicovideo-translator" = dontDistribute super."nicovideo-translator";
   "nikepub" = dontDistribute super."nikepub";
   "nimber" = dontDistribute super."nimber";
+  "nist-beacon" = dontDistribute super."nist-beacon";
   "nitro" = dontDistribute super."nitro";
   "nix-eval" = dontDistribute super."nix-eval";
   "nix-paths" = dontDistribute super."nix-paths";
@@ -6215,6 +6227,7 @@ self: super: {
   "octohat" = dontDistribute super."octohat";
   "octopus" = dontDistribute super."octopus";
   "oculus" = dontDistribute super."oculus";
+  "oden-go-packages" = dontDistribute super."oden-go-packages";
   "oeis" = dontDistribute super."oeis";
   "off-simple" = dontDistribute super."off-simple";
   "ofx" = dontDistribute super."ofx";
@@ -6293,6 +6306,7 @@ self: super: {
   "options-time" = dontDistribute super."options-time";
   "optparse-applicative" = doDistribute super."optparse-applicative_0_11_0_1";
   "optparse-declarative" = dontDistribute super."optparse-declarative";
+  "optparse-generic" = dontDistribute super."optparse-generic";
   "optparse-simple" = dontDistribute super."optparse-simple";
   "orc" = dontDistribute super."orc";
   "orchestrate" = dontDistribute super."orchestrate";
@@ -6524,6 +6538,7 @@ self: super: {
   "pipes-bgzf" = dontDistribute super."pipes-bgzf";
   "pipes-binary" = dontDistribute super."pipes-binary";
   "pipes-bytestring" = dontDistribute super."pipes-bytestring";
+  "pipes-bzip" = dontDistribute super."pipes-bzip";
   "pipes-cacophony" = dontDistribute super."pipes-cacophony";
   "pipes-cellular" = dontDistribute super."pipes-cellular";
   "pipes-cellular-csv" = dontDistribute super."pipes-cellular-csv";
@@ -6544,6 +6559,7 @@ self: super: {
   "pipes-http" = dontDistribute super."pipes-http";
   "pipes-illumina" = dontDistribute super."pipes-illumina";
   "pipes-interleave" = dontDistribute super."pipes-interleave";
+  "pipes-key-value-csv" = dontDistribute super."pipes-key-value-csv";
   "pipes-mongodb" = dontDistribute super."pipes-mongodb";
   "pipes-network" = dontDistribute super."pipes-network";
   "pipes-network-tls" = dontDistribute super."pipes-network-tls";
@@ -6912,6 +6928,8 @@ self: super: {
   "rascal" = dontDistribute super."rascal";
   "rasterific-svg" = dontDistribute super."rasterific-svg";
   "rate-limit" = dontDistribute super."rate-limit";
+  "ratel" = dontDistribute super."ratel";
+  "ratel-wai" = dontDistribute super."ratel-wai";
   "ratio-int" = dontDistribute super."ratio-int";
   "raven-haskell" = dontDistribute super."raven-haskell";
   "raven-haskell-scotty" = dontDistribute super."raven-haskell-scotty";
@@ -7363,6 +7381,7 @@ self: super: {
   "serial-test-generators" = dontDistribute super."serial-test-generators";
   "serialport" = dontDistribute super."serialport";
   "serv" = dontDistribute super."serv";
+  "serv-wai" = dontDistribute super."serv-wai";
   "servant" = dontDistribute super."servant";
   "servant-JuicyPixels" = dontDistribute super."servant-JuicyPixels";
   "servant-blaze" = dontDistribute super."servant-blaze";
@@ -7654,6 +7673,7 @@ self: super: {
   "socket-io" = dontDistribute super."socket-io";
   "socket-sctp" = dontDistribute super."socket-sctp";
   "socketio" = dontDistribute super."socketio";
+  "socketson" = dontDistribute super."socketson";
   "sodium" = doDistribute super."sodium_0_11_0_2";
   "soegtk" = dontDistribute super."soegtk";
   "sonic-visualiser" = dontDistribute super."sonic-visualiser";
@@ -8346,6 +8366,7 @@ self: super: {
   "turkish-deasciifier" = dontDistribute super."turkish-deasciifier";
   "turni" = dontDistribute super."turni";
   "turtle" = dontDistribute super."turtle";
+  "turtle-options" = dontDistribute super."turtle-options";
   "tweak" = dontDistribute super."tweak";
   "twentefp" = dontDistribute super."twentefp";
   "twentefp-eventloop-graphics" = dontDistribute super."twentefp-eventloop-graphics";
@@ -8676,6 +8697,7 @@ self: super: {
   "vty-menu" = dontDistribute super."vty-menu";
   "vty-ui" = dontDistribute super."vty-ui";
   "vty-ui-extras" = dontDistribute super."vty-ui-extras";
+  "vulkan" = dontDistribute super."vulkan";
   "waddle" = dontDistribute super."waddle";
   "wai" = doDistribute super."wai_3_0_2";
   "wai-accept-language" = dontDistribute super."wai-accept-language";