Merge branch 'master' into staging

Thousands of rebuilds from master.

lib/maintainers.nix

@@ -72,6 +72,7 @@
   bcarrell = "Brandon Carrell <brandoncarrell@gmail.com>";
   bcdarwin = "Ben Darwin <bcdarwin@gmail.com>";
   bdimcheff = "Brandon Dimcheff <brandon@dimcheff.com>";
+  bendlas = "Herwig Hochleitner <herwig@bendlas.net>";
   benley = "Benjamin Staffin <benley@gmail.com>";
   bennofs = "Benno Fünfstück <benno.fuenfstueck@gmail.com>";
   benwbooth = "Ben Booth <benwbooth@gmail.com>";
@@ -196,6 +197,7 @@
   eqyiel = "Ruben Maher <r@rkm.id.au>";
   ericbmerritt = "Eric Merritt <eric@afiniate.com>";
   ericsagnes = "Eric Sagnes <eric.sagnes@gmail.com>";
+  erictapen = "Justin Humm <justin.humm@posteo.de>";
   erikryb = "Erik Rybakken <erik.rybakken@math.ntnu.no>";
   ertes = "Ertugrul Söylemez <esz@posteo.de>";
   ethercrow = "Dmitry Ivanov <ethercrow@gmail.com>";

nixos/doc/manual/installation/installing-usb.xml

@@ -31,7 +31,7 @@ ISO, copy its contents verbatim to your drive, then either:
     <para>Edit <filename>loader/entries/nixos-livecd.conf</filename> on the drive
     and change the <literal>root=</literal> field in the <literal>options</literal>
     line to point to your drive (see the documentation on <literal>root=</literal>
-    in <link xlink:href="https://www.kernel.org/doc/Documentation/kernel-parameters.txt">
+    in <link xlink:href="https://www.kernel.org/doc/Documentation/admin-guide/kernel-parameters.txt">
     the kernel documentation</link> for more details).</para>
   </listitem>
   <listitem>

nixos/lib/make-disk-image.nix

@@ -80,7 +80,7 @@ let
     truncate -s ${toString diskSize}M $diskImage
 
     ${if partitioned then ''
-      parted $diskImage -- mklabel msdos mkpart primary ext4 1M -1s
+      parted --script $diskImage -- mklabel msdos mkpart primary ext4 1M -1s
       offset=$((2048*512))
     '' else ''
       offset=0

nixos/modules/config/nsswitch.nix

@@ -18,7 +18,7 @@ let
 
   hostArray = [ "files" ]
     ++ optionals mymachines [ "mymachines" ]
-    ++ optionals nssmdns [ "mdns_minimal [!UNAVAIL=return]" ]
+    ++ optionals nssmdns [ "mdns_minimal [NOTFOUND=return]" ]
     ++ optionals nsswins [ "wins" ]
     ++ optionals resolved ["resolve [!UNAVAIL=return]"]
     ++ [ "dns" ]

nixos/modules/config/timezone.nix

@@ -5,6 +5,9 @@ with lib;
 let
 
   tzdir = "${pkgs.tzdata}/share/zoneinfo";
+  nospace  = str: filter (c: c == " ") (stringToCharacters str) == [];
+  timezone = types.nullOr (types.addCheck types.str nospace)
+    // { description = "null or string without spaces"; };
 
 in
 
@@ -15,7 +18,7 @@ in
 
       timeZone = mkOption {
         default = null;
-        type = types.nullOr types.str;
+        type = timezone;
         example = "America/New_York";
         description = ''
           The time zone used when displaying times and dates. See <link

nixos/modules/services/misc/gitlab.nix

@@ -581,6 +581,7 @@ in {
         mkdir -p ${cfg.statePath}/{log,uploads}
         ln -sf ${cfg.statePath}/log /run/gitlab/log
         ln -sf ${cfg.statePath}/uploads /run/gitlab/uploads
+        ln -sf ${cfg.statePath}/tmp /run/gitlab/tmp
         chown -R ${cfg.user}:${cfg.group} /run/gitlab
 
         # Prepare home directory
@@ -639,10 +640,10 @@ in {
         chmod -R ug+rwX,o-rwx ${cfg.statePath}/repositories
         chmod -R ug-s ${cfg.statePath}/repositories
         find ${cfg.statePath}/repositories -type d -print0 | xargs -0 chmod g+s
-        chmod 700 ${cfg.statePath}/uploads
+        chmod 770 ${cfg.statePath}/uploads
         chown -R git ${cfg.statePath}/uploads
         find ${cfg.statePath}/uploads -type f -exec chmod 0644 {} \;
-        find ${cfg.statePath}/uploads -type d -not -path ${cfg.statePath}/uploads -exec chmod 0700 {} \;
+        find ${cfg.statePath}/uploads -type d -not -path ${cfg.statePath}/uploads -exec chmod 0770 {} \;
       '';
 
       serviceConfig = {

nixos/modules/services/scheduling/atd.nix

@@ -42,6 +42,8 @@ in
 
   config = mkIf cfg.enable {
 
+    # Not wrapping "batch" because it's a shell script (kernel drops perms
+    # anyway) and it's patched to invoke the "at" setuid wrapper.
     security.wrappers = builtins.listToAttrs (
       map (program: { name = "${program}"; value = {
       source = "${at}/bin/${program}";
@@ -49,7 +51,7 @@ in
       group = "atd";
       setuid = true;
       setgid = true;
-    };}) [ "at" "atq" "atrm" "batch" ]);
+    };}) [ "at" "atq" "atrm" ]);
 
     environment.systemPackages = [ at ];
 

nixos/modules/services/security/sshguard.nix

@@ -89,7 +89,7 @@ in {
 
     environment.systemPackages = [ pkgs.sshguard pkgs.iptables pkgs.ipset ];
 
-    environment.etc."sshguard.conf".text = let 
+    environment.etc."sshguard.conf".text = let
         list_services = ( name:  "-t ${name} ");
       in ''
         BACKEND="${pkgs.sshguard}/libexec/sshg-fw-ipset"

nixos/modules/virtualisation/brightbox-image.nix

@@ -33,9 +33,9 @@ in
         }
         ''
           # Create partition table
-          ${pkgs.parted}/sbin/parted /dev/vda mklabel msdos
+          ${pkgs.parted}/sbin/parted --script /dev/vda mklabel msdos
-          ${pkgs.parted}/sbin/parted /dev/vda mkpart primary ext4 1 ${diskSize}
+          ${pkgs.parted}/sbin/parted --script /dev/vda mkpart primary ext4 1 ${diskSize}
-          ${pkgs.parted}/sbin/parted /dev/vda print
+          ${pkgs.parted}/sbin/parted --script /dev/vda print
           . /sys/class/block/vda1/uevent
           mknod /dev/vda1 b $MAJOR $MINOR
 

nixos/release-combined.nix

@@ -42,12 +42,11 @@ in rec {
     name = "nixos-${nixos.channel.version}";
     meta = {
       description = "Release-critical builds for the NixOS channel";
-      maintainers = [ pkgs.lib.maintainers.eelco ];
+      maintainers = with pkgs.lib.maintainers; [ eelco fpletz ];
     };
     constituents =
       let
-        all = x: map (system: x.${system})
+        all = x: map (system: x.${system}) supportedSystems;
-          (supportedSystems ++ limitedSupportedSystems);
       in [
         nixos.channel
         (all nixos.dummy)
@@ -61,7 +60,7 @@ in rec {
         nixos.tests.chromium
         (all nixos.tests.firefox)
         (all nixos.tests.firewall)
-        nixos.tests.gnome3.x86_64-linux # FIXME: i686-linux
+        (all nixos.tests.gnome3)
         nixos.tests.installer.zfsroot.x86_64-linux # ZFS is 64bit only
         (all nixos.tests.installer.lvm)
         (all nixos.tests.installer.luksroot)
@@ -80,9 +79,8 @@ in rec {
         (all nixos.tests.boot.uefiCdrom)
         (all nixos.tests.boot.uefiUsb)
         (all nixos.tests.boot-stage1)
-        nixos.tests.hibernate.x86_64-linux # i686 is flaky, see #23107
+        (all nixos.tests.hibernate)
         nixos.tests.docker
-        nixos.tests.docker-edge
         (all nixos.tests.ecryptfs)
         (all nixos.tests.env)
         (all nixos.tests.ipv6)
@@ -93,7 +91,7 @@ in rec {
         (all nixos.tests.keymap.dvp)
         (all nixos.tests.keymap.neo)
         (all nixos.tests.keymap.qwertz)
-        nixos.tests.plasma5.x86_64-linux # avoid big build on i686
+        (all nixos.tests.plasma5)
         #(all nixos.tests.lightdm)
         (all nixos.tests.login)
         (all nixos.tests.misc)

nixos/release.nix

@@ -214,6 +214,7 @@ in rec {
   # Run the tests for each platform.  You can run a test by doing
   # e.g. ‘nix-build -A tests.login.x86_64-linux’, or equivalently,
   # ‘nix-build tests/login.nix -A result’.
+  tests.atd = callTest tests/atd.nix {};
   tests.acme = callTest tests/acme.nix {};
   tests.avahi = callTest tests/avahi.nix {};
   tests.bittorrent = callTest tests/bittorrent.nix {};
@@ -249,6 +250,7 @@ in rec {
   tests.firewall = callTest tests/firewall.nix {};
   tests.fleet = hydraJob (import tests/fleet.nix { system = "x86_64-linux"; });
   #tests.gitlab = callTest tests/gitlab.nix {};
+  tests.gitolite = callTest tests/gitolite.nix {};
   tests.glance = callTest tests/glance.nix {};
   tests.gocd-agent = callTest tests/gocd-agent.nix {};
   tests.gocd-server = callTest tests/gocd-server.nix {};
@@ -303,6 +305,7 @@ in rec {
   #tests.panamax = hydraJob (import tests/panamax.nix { system = "x86_64-linux"; });
   tests.peerflix = callTest tests/peerflix.nix {};
   tests.postgresql = callSubTests tests/postgresql.nix {};
+  tests.postgis = callTest tests/postgis.nix {};
   #tests.pgjwt = callTest tests/pgjwt.nix {};
   tests.printing = callTest tests/printing.nix {};
   tests.proxy = callTest tests/proxy.nix {};

nixos/tests/atd.nix

@@ -0,0 +1,36 @@
+import ./make-test.nix ({ pkgs, lib, ... }:
+
+{
+  name = "atd";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ bjornfor ];
+  };
+
+  machine =
+    { config, pkgs, ... }:
+    { services.atd.enable = true;
+      users.extraUsers.alice = { isNormalUser = true; };
+    };
+
+  # "at" has a resolution of 1 minute
+  testScript = ''
+    startAll;
+
+    $machine->fail("test -f ~root/at-1");
+    $machine->fail("test -f ~root/batch-1");
+    $machine->fail("test -f ~alice/at-1");
+    $machine->fail("test -f ~alice/batch-1");
+
+    $machine->succeed("echo 'touch ~root/at-1' | at now+1min");
+    $machine->succeed("echo 'touch ~root/batch-1' | batch");
+    $machine->succeed("su - alice -c \"echo 'touch at-1' | at now+1min\"");
+    $machine->succeed("su - alice -c \"echo 'touch batch-1' | batch\"");
+
+    $machine->succeed("sleep 1.5m");
+
+    $machine->succeed("test -f ~root/at-1");
+    $machine->succeed("test -f ~root/batch-1");
+    $machine->succeed("test -f ~alice/at-1");
+    $machine->succeed("test -f ~alice/batch-1");
+  '';
+})

nixos/tests/gitolite.nix

@@ -0,0 +1,139 @@
+import ./make-test.nix ({ pkgs, ...}:
+
+let
+  adminPrivateKey = pkgs.writeText "id_ed25519" ''
+    -----BEGIN OPENSSH PRIVATE KEY-----
+    b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+    QyNTUxOQAAACDu7qxYQAPdAU6RrhB3llk2N1v4PTwcVzcX1oX265uC3gAAAJBJiYxDSYmM
+    QwAAAAtzc2gtZWQyNTUxOQAAACDu7qxYQAPdAU6RrhB3llk2N1v4PTwcVzcX1oX265uC3g
+    AAAEDE1W6vMwSEUcF1r7Hyypm/+sCOoDmKZgPxi3WOa1mD2u7urFhAA90BTpGuEHeWWTY3
+    W/g9PBxXNxfWhfbrm4LeAAAACGJmb0BtaW5pAQIDBAU=
+    -----END OPENSSH PRIVATE KEY-----
+  '';
+
+  adminPublicKey = pkgs.writeText "id_ed25519.pub" ''
+    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO7urFhAA90BTpGuEHeWWTY3W/g9PBxXNxfWhfbrm4Le root@client
+  '';
+
+  alicePrivateKey = pkgs.writeText "id_ed25519" ''
+    -----BEGIN OPENSSH PRIVATE KEY-----
+    b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+    QyNTUxOQAAACBbeWvHh/AWGWI6EIc1xlSihyXtacNQ9KeztlW/VUy8wQAAAJAwVQ5VMFUO
+    VQAAAAtzc2gtZWQyNTUxOQAAACBbeWvHh/AWGWI6EIc1xlSihyXtacNQ9KeztlW/VUy8wQ
+    AAAEB7lbfkkdkJoE+4TKHPdPQWBKLSx+J54Eg8DaTr+3KoSlt5a8eH8BYZYjoQhzXGVKKH
+    Je1pw1D0p7O2Vb9VTLzBAAAACGJmb0BtaW5pAQIDBAU=
+    -----END OPENSSH PRIVATE KEY-----
+  '';
+
+  alicePublicKey = pkgs.writeText "id_ed25519.pub" ''
+    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFt5a8eH8BYZYjoQhzXGVKKHJe1pw1D0p7O2Vb9VTLzB alice@client
+  '';
+
+  bobPrivateKey = pkgs.writeText "id_ed25519" ''
+    -----BEGIN OPENSSH PRIVATE KEY-----
+    b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+    QyNTUxOQAAACCWTaJ1D9Xjxy6759FvQ9oXTes1lmWBciXPkEeqTikBMAAAAJDQBmNV0AZj
+    VQAAAAtzc2gtZWQyNTUxOQAAACCWTaJ1D9Xjxy6759FvQ9oXTes1lmWBciXPkEeqTikBMA
+    AAAEDM1IYYFUwk/IVxauha9kuR6bbRtT3gZ6ZA0GLb9txb/pZNonUP1ePHLrvn0W9D2hdN
+    6zWWZYFyJc+QR6pOKQEwAAAACGJmb0BtaW5pAQIDBAU=
+    -----END OPENSSH PRIVATE KEY-----
+  '';
+
+  bobPublicKey = pkgs.writeText "id_ed25519.pub" ''
+    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJZNonUP1ePHLrvn0W9D2hdN6zWWZYFyJc+QR6pOKQEw bob@client
+  '';
+
+  gitoliteAdminConfSnippet = ''
+    repo alice-project
+        RW+     =   alice
+  '';
+in
+{
+  name = "gitolite";
+
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ bjornfor ];
+  };
+
+  nodes = {
+
+    server =
+      { config, pkgs, lib, ... }:
+      {
+        services.gitolite = {
+          enable = true;
+          adminPubkey = builtins.readFile adminPublicKey;
+        };
+        services.openssh.enable = true;
+      };
+
+    client =
+      { config, pkgs, lib, ... }:
+      {
+        environment.systemPackages = [ pkgs.git ];
+        programs.ssh.extraConfig = ''
+          Host *
+            UserKnownHostsFile /dev/null
+            StrictHostKeyChecking no
+            # there's nobody around that can input password
+            PreferredAuthentications publickey
+        '';
+        users.extraUsers.alice = { isNormalUser = true; };
+        users.extraUsers.bob = { isNormalUser = true; };
+      };
+
+  };
+
+  testScript = ''
+    startAll;
+
+    subtest "can setup ssh keys on system", sub {
+      $client->mustSucceed("mkdir -p ~root/.ssh");
+      $client->mustSucceed("cp ${adminPrivateKey} ~root/.ssh/id_ed25519");
+      $client->mustSucceed("chmod 600 ~root/.ssh/id_ed25519");
+
+      $client->mustSucceed("sudo -u alice mkdir -p ~alice/.ssh");
+      $client->mustSucceed("sudo -u alice cp ${alicePrivateKey} ~alice/.ssh/id_ed25519");
+      $client->mustSucceed("sudo -u alice chmod 600 ~alice/.ssh/id_ed25519");
+
+      $client->mustSucceed("sudo -u bob mkdir -p ~bob/.ssh");
+      $client->mustSucceed("sudo -u bob cp ${bobPrivateKey} ~bob/.ssh/id_ed25519");
+      $client->mustSucceed("sudo -u bob chmod 600 ~bob/.ssh/id_ed25519");
+    };
+
+    subtest "gitolite server starts", sub {
+      $server->waitForUnit("gitolite-init.service");
+      $server->waitForUnit("sshd.service");
+      $client->mustSucceed('ssh gitolite@server info');
+    };
+
+    subtest "admin can clone and configure gitolite-admin.git", sub {
+      $client->mustSucceed('git clone gitolite@server:gitolite-admin.git');
+      $client->mustSucceed("git config --global user.name 'System Administrator'");
+      $client->mustSucceed("git config --global user.email root\@domain.example");
+      $client->mustSucceed("cp ${alicePublicKey} gitolite-admin/keydir/alice.pub");
+      $client->mustSucceed("cp ${bobPublicKey} gitolite-admin/keydir/bob.pub");
+      $client->mustSucceed('(cd gitolite-admin && git add . && git commit -m "Add keys for alice, bob" && git push)');
+      $client->mustSucceed("printf '${gitoliteAdminConfSnippet}' >> gitolite-admin/conf/gitolite.conf");
+      $client->mustSucceed('(cd gitolite-admin && git add . && git commit -m "Add repo for alice" && git push)');
+    };
+
+    subtest "non-admins cannot clone gitolite-admin.git", sub {
+      $client->mustFail('sudo -i -u alice git clone gitolite@server:gitolite-admin.git');
+      $client->mustFail('sudo -i -u bob git clone gitolite@server:gitolite-admin.git');
+    };
+
+    subtest "non-admins can clone testing.git", sub {
+      $client->mustSucceed('sudo -i -u alice git clone gitolite@server:testing.git');
+      $client->mustSucceed('sudo -i -u bob git clone gitolite@server:testing.git');
+    };
+
+    subtest "alice can clone alice-project.git", sub {
+      $client->mustSucceed('sudo -i -u alice git clone gitolite@server:alice-project.git');
+    };
+
+    subtest "bob cannot clone alice-project.git", sub {
+      $client->mustFail('sudo -i -u bob git clone gitolite@server:alice-project.git');
+    };
+  '';
+})

nixos/tests/installer.nix

@@ -260,9 +260,9 @@ in {
     { createPartitions =
         ''
           $machine->succeed(
-              "parted /dev/vda mklabel msdos",
+              "parted --script /dev/vda mklabel msdos",
-              "parted /dev/vda -- mkpart primary linux-swap 1M 1024M",
+              "parted --script /dev/vda -- mkpart primary linux-swap 1M 1024M",
-              "parted /dev/vda -- mkpart primary ext2 1024M -1s",
+              "parted --script /dev/vda -- mkpart primary ext2 1024M -1s",
               "udevadm settle",
               "mkswap /dev/vda1 -L swap",
               "swapon -L swap",
@@ -277,11 +277,11 @@ in {
     { createPartitions =
         ''
           $machine->succeed(
-              "parted /dev/vda mklabel gpt",
+              "parted --script /dev/vda mklabel gpt",
-              "parted -s /dev/vda -- mkpart ESP fat32 1M 50MiB", # /boot
+              "parted --script /dev/vda -- mkpart ESP fat32 1M 50MiB", # /boot
-              "parted -s /dev/vda -- set 1 boot on",
+              "parted --script /dev/vda -- set 1 boot on",
-              "parted -s /dev/vda -- mkpart primary linux-swap 50MiB 1024MiB",
+              "parted --script /dev/vda -- mkpart primary linux-swap 50MiB 1024MiB",
-              "parted -s /dev/vda -- mkpart primary ext2 1024MiB -1MiB", # /
+              "parted --script /dev/vda -- mkpart primary ext2 1024MiB -1MiB", # /
               "udevadm settle",
               "mkswap /dev/vda2 -L swap",
               "swapon -L swap",
@@ -300,10 +300,10 @@ in {
     { createPartitions =
         ''
           $machine->succeed(
-              "parted /dev/vda mklabel msdos",
+              "parted --script /dev/vda mklabel msdos",
-              "parted /dev/vda -- mkpart primary ext2 1M 50MB", # /boot
+              "parted --script /dev/vda -- mkpart primary ext2 1M 50MB", # /boot
-              "parted /dev/vda -- mkpart primary linux-swap 50MB 1024M",
+              "parted --script /dev/vda -- mkpart primary linux-swap 50MB 1024M",
-              "parted /dev/vda -- mkpart primary ext2 1024M -1s", # /
+              "parted --script /dev/vda -- mkpart primary ext2 1024M -1s", # /
               "udevadm settle",
               "mkswap /dev/vda2 -L swap",
               "swapon -L swap",
@@ -321,10 +321,10 @@ in {
     { createPartitions =
         ''
           $machine->succeed(
-              "parted /dev/vda mklabel msdos",
+              "parted --script /dev/vda mklabel msdos",
-              "parted /dev/vda -- mkpart primary ext2 1M 50MB", # /boot
+              "parted --script /dev/vda -- mkpart primary ext2 1M 50MB", # /boot
-              "parted /dev/vda -- mkpart primary linux-swap 50MB 1024M",
+              "parted --script /dev/vda -- mkpart primary linux-swap 50MB 1024M",
-              "parted /dev/vda -- mkpart primary ext2 1024M -1s", # /
+              "parted --script /dev/vda -- mkpart primary ext2 1024M -1s", # /
               "udevadm settle",
               "mkswap /dev/vda2 -L swap",
               "swapon -L swap",
@@ -357,9 +357,9 @@ in {
       createPartitions =
         ''
           $machine->succeed(
-              "parted /dev/vda mklabel msdos",
+              "parted --script /dev/vda mklabel msdos",
-              "parted /dev/vda -- mkpart primary linux-swap 1M 1024M",
+              "parted --script /dev/vda -- mkpart primary linux-swap 1M 1024M",
-              "parted /dev/vda -- mkpart primary 1024M -1s",
+              "parted --script /dev/vda -- mkpart primary 1024M -1s",
               "udevadm settle",
 
               "mkswap /dev/vda1 -L swap",
@@ -380,11 +380,11 @@ in {
     { createPartitions =
         ''
           $machine->succeed(
-              "parted /dev/vda mklabel msdos",
+              "parted --script /dev/vda mklabel msdos",
-              "parted /dev/vda -- mkpart primary 1M 2048M", # PV1
+              "parted --script /dev/vda -- mkpart primary 1M 2048M", # PV1
-              "parted /dev/vda -- set 1 lvm on",
+              "parted --script /dev/vda -- set 1 lvm on",
-              "parted /dev/vda -- mkpart primary 2048M -1s", # PV2
+              "parted --script /dev/vda -- mkpart primary 2048M -1s", # PV2
-              "parted /dev/vda -- set 2 lvm on",
+              "parted --script /dev/vda -- set 2 lvm on",
               "udevadm settle",
               "pvcreate /dev/vda1 /dev/vda2",
               "vgcreate MyVolGroup /dev/vda1 /dev/vda2",
@@ -402,10 +402,10 @@ in {
   luksroot = makeInstallerTest "luksroot"
     { createPartitions = ''
         $machine->succeed(
-          "parted /dev/vda mklabel msdos",
+          "parted --script /dev/vda mklabel msdos",
-          "parted /dev/vda -- mkpart primary ext2 1M 50MB", # /boot
+          "parted --script /dev/vda -- mkpart primary ext2 1M 50MB", # /boot
-          "parted /dev/vda -- mkpart primary linux-swap 50M 1024M",
+          "parted --script /dev/vda -- mkpart primary linux-swap 50M 1024M",
-          "parted /dev/vda -- mkpart primary 1024M -1s", # LUKS
+          "parted --script /dev/vda -- mkpart primary 1024M -1s", # LUKS
           "udevadm settle",
           "mkswap /dev/vda2 -L swap",
           "swapon -L swap",
@@ -434,7 +434,7 @@ in {
     { createPartitions =
         ''
           $machine->succeed(
-              "parted /dev/vda --"
+              "parted --script /dev/vda --"
               . " mklabel msdos"
               . " mkpart primary ext2 1M 100MB" # /boot
               . " mkpart extended 100M -1s"
@@ -469,9 +469,9 @@ in {
     { createPartitions =
         ''
           $machine->succeed(
-              "parted /dev/sda mklabel msdos",
+              "parted --script /dev/sda mklabel msdos",
-              "parted /dev/sda -- mkpart primary linux-swap 1M 1024M",
+              "parted --script /dev/sda -- mkpart primary linux-swap 1M 1024M",
-              "parted /dev/sda -- mkpart primary ext2 1024M -1s",
+              "parted --script /dev/sda -- mkpart primary ext2 1024M -1s",
               "udevadm settle",
               "mkswap /dev/sda1 -L swap",
               "swapon -L swap",

nixos/tests/postgis.nix

@@ -9,15 +9,11 @@ import ./make-test.nix ({ pkgs, ...} : {
       { pkgs, config, ... }:
 
       {
-        services.postgresql = let mypg = pkgs.postgresql95; in {
+        services.postgresql = let mypg = pkgs.postgresql100; in {
             enable = true;
             package = mypg;
-            extraPlugins = [ (pkgs.postgis.override { postgresql = mypg; }).v_2_2_1 ];
+            extraPlugins = [ (pkgs.postgis.override { postgresql = mypg; }).v_2_4_0 ];
-            initialScript =  pkgs.writeText "postgresql-init.sql"
+        };
-          ''
-          CREATE ROLE postgres WITH superuser login createdb;
-          '';
-          };
       };
   };
 

nixos/tests/virtualbox.nix

@@ -107,8 +107,8 @@ let
 
     buildInputs = [ pkgs.utillinux pkgs.perl ];
   } ''
-    ${pkgs.parted}/sbin/parted /dev/vda mklabel msdos
+    ${pkgs.parted}/sbin/parted --script /dev/vda mklabel msdos
-    ${pkgs.parted}/sbin/parted /dev/vda -- mkpart primary ext2 1M -1s
+    ${pkgs.parted}/sbin/parted --script /dev/vda -- mkpart primary ext2 1M -1s
     . /sys/class/block/vda1/uevent
     mknod /dev/vda1 b $MAJOR $MINOR
 

pkgs/applications/altcoins/go-ethereum.nix

@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "go-ethereum-${version}";
-  version = "1.7.1";
+  version = "1.7.2";
   goPackagePath = "github.com/ethereum/go-ethereum";
 
   # Fix for usb-related segmentation faults on darwin
@@ -16,7 +16,7 @@ buildGoPackage rec {
     owner = "ethereum";
     repo = "go-ethereum";
     rev = "v${version}";
-    sha256 = "1rhqnqp2d951d4084z7dc07q0my4wd5401968a0nqj030a9vgng2";
+    sha256 = "11n77zlf8qixhx26sqf33v911716msi6h0z4ng8gxhzhznrn2nrd";
   };
 
   meta = with stdenv.lib; {

pkgs/applications/display-managers/sddm/default.nix

@@ -50,12 +50,16 @@ in mkDerivation rec {
   postInstall = ''
     # remove empty scripts
     rm "$out/share/sddm/scripts/Xsetup" "$out/share/sddm/scripts/Xstop"
+    for f in $out/share/sddm/themes/**/theme.conf ; do
+      substituteInPlace $f \
+        --replace 'background=' "background=$(dirname $f)/"
+    done
   '';
 
   meta = with lib; {
     description = "QML based X11 display manager";
-    homepage = https://github.com/sddm/sddm;
+    homepage    = https://github.com/sddm/sddm;
-    platforms = platforms.linux;
     maintainers = with maintainers; [ abbradar ttuegel ];
+    platforms   = platforms.linux;
   };
 }

pkgs/applications/editors/android-studio/packages.nix

@@ -27,9 +27,9 @@ in rec {
 
   preview = mkStudio rec {
     pname = "android-studio-preview";
-    version = "3.0.0.15"; # "Android Studio 3.0 Beta 7"
+    version = "3.0.0.16"; # "Android Studio 3.0 RC 1"
-    build = "171.4365657";
+    build = "171.4392136";
-    sha256Hash = "0am3rq0ag982ik95mpcxvx2zlv0h4l6747b29mlsbqih66868db6";
+    sha256Hash = "13zaqbbl7bqhiwh0ybbxkfv0h90qsfpa7sim778n2j32jjvdcby5";
 
     meta = stable.meta // {
       description = "The Official IDE for Android (preview version)";

pkgs/applications/editors/jetbrains/default.nix

@@ -219,12 +219,12 @@ in
 
   clion = buildClion rec {
     name = "clion-${version}";
-    version = "2017.2.2"; /* updated by script */
+    version = "2017.2.3"; /* updated by script */
     description  = "C/C++ IDE. New. Intelligent. Cross-platform";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/cpp/CLion-${version}.tar.gz";
-      sha256 = "1rnncii7z44186jv9xl3ax179ws9wfwd6yndyf9pvnpcd4jcs6d0"; /* updated by script */
+      sha256 = "02hyndyfcrvfbi4q8vmmj0xh2bggwc2azggm24g3m03iffa7j6fx"; /* updated by script */
     };
     wmClass = "jetbrains-clion";
     update-channel = "CLion_Release"; # channel's id as in http://www.jetbrains.com/updates/updates.xml
@@ -245,12 +245,12 @@ in
 
   gogland = buildGogland rec {
     name = "gogland-${version}";
-    version = "172.3968.45"; /* updated by script */
+    version = "173.2696.28"; /* updated by script */
     description = "Up and Coming Go IDE";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/go/${name}.tar.gz";
-      sha256 = "0nk9g28l414yp5ldyx1yl38qpp9s1pxkfxfwmw9yvlff3bi0kkyw"; /* updated by script */
+      sha256 = "07nz2pf7fnjxsvc82vihk2i880cji349czxzshr1dk50ixlydq7n"; /* updated by script */
     };
     wmClass = "jetbrains-gogland";
     update-channel = "gogland_1.0_EAP";
@@ -258,12 +258,12 @@ in
 
   idea-community = buildIdea rec {
     name = "idea-community-${version}";
-    version = "2017.2.4"; /* updated by script */
+    version = "2017.2.5"; /* updated by script */
     description = "Integrated Development Environment (IDE) by Jetbrains, community edition";
     license = stdenv.lib.licenses.asl20;
     src = fetchurl {
       url = "https://download.jetbrains.com/idea/ideaIC-${version}.tar.gz";
-      sha256 = "179nqzgbb76pyr48faca6k69v32m5kvx66i2apih95g54sd1xgva"; /* updated by script */
+      sha256 = "01p63wsy60icy4673ci435rmzpjfkyz7a8w413vw45i2bm76skhr"; /* updated by script */
     };
     wmClass = "jetbrains-idea-ce";
     update-channel = "IDEA_Release";
@@ -271,12 +271,12 @@ in
 
   idea-ultimate = buildIdea rec {
     name = "idea-ultimate-${version}";
-    version = "2017.2.4"; /* updated by script */
+    version = "2017.2.5"; /* updated by script */
     description = "Integrated Development Environment (IDE) by Jetbrains, requires paid license";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/idea/ideaIU-${version}-no-jdk.tar.gz";
-      sha256 = "1qwqk1r42llh8py0w2iq4w1ks3ipzsxkbdz0zkrd1572zngpk90m"; /* updated by script */
+      sha256 = "0pp49nck1cad6pz81bd95v4v55vmnvj7cbdzybmldglka1afqjb6"; /* updated by script */
     };
     wmClass = "jetbrains-idea";
     update-channel = "IDEA_Release";
@@ -323,12 +323,12 @@ in
 
   rider = buildRider rec {
     name = "rider-${version}";
-    version = "2017.1.1"; /* updated by script */
+    version = "2017.1.2"; /* updated by script */
     description = "A cross-platform .NET IDE based on the IntelliJ platform and ReSharper";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/resharper/JetBrains.Rider-${version}.tar.gz";
-      sha256 = "1h6p847izddard3227ifg3q5klwvdfixir63i6adkd2fvsqn5935"; /* updated by script */
+      sha256 = "0kphjxibrs4ss6hpxbssvs3n35xh9zzw7a1q09x79ibvvk73gwqh"; /* updated by script */
     };
     wmClass = "jetbrains-rider";
     update-channel = "rider_2017_1";

pkgs/applications/editors/rstudio/default.nix

@@ -3,7 +3,7 @@ R, qt5, libuuid, hunspellDicts, unzip, ant, jdk, gnumake, makeWrapper, pandoc
 }:
 
 let
-  version = "1.1.351";
+  version = "1.1.383";
   ginVer = "1.5";
   gwtVer = "2.7.0";
 in
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://github.com/rstudio/rstudio/archive/v${version}.tar.gz";
-    sha256 = "0dpzmkq7jkdndidmmgdcr849q33ypmzkqwx22fraaqcy7w4f0pcn";
+    sha256 = "06680l9amq03b4jarmzfr605bijhb79fip9rk464zab6hgwqbp3f";
   };
 
   # Hack RStudio to only use the input R.

pkgs/applications/gis/qgis/default.nix

@@ -5,7 +5,7 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "qgis-2.18.12";
+  name = "qgis-2.18.13";
 
   buildInputs = [ gdal qt4 flex openssl bison proj geos xlibsWrapper sqlite gsl qwt qscintilla
     fcgi libspatialindex libspatialite postgresql qjson qca2 txt2tags ] ++
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "http://qgis.org/downloads/${name}.tar.bz2";
-    sha256 = "0fh256j2d2kh9hjx6q1zdzxfqsgifg9dvgk214sv6zxzhsn0kxvs";
+    sha256 = "033l3wg3l7hv4642wmsdycjca1dw8p89sk9xyc51wpb3id17vgv2";
   };
 
   cmakeFlags = stdenv.lib.optional withGrass "-DGRASS_PREFIX7=${grass}/${grass.name}";

pkgs/applications/misc/cli-visualizer/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, fftw, ncurses, libpulseaudio }:
+{ stdenv, fetchFromGitHub, fftw, ncurses5, libpulseaudio, makeWrapper }:
 
 stdenv.mkDerivation rec {
   version = "1.5";
@@ -15,13 +15,15 @@ stdenv.mkDerivation rec {
     sed '1i#include <cmath>' -i src/Transformer/SpectrumCircleTransformer.cpp
   '';
 
-  buildInputs = [ fftw ncurses libpulseaudio ];
+  buildInputs = [ fftw ncurses5 libpulseaudio makeWrapper ];
 
   buildFlags = [ "ENABLE_PULSE=1" ];
 
   installPhase = ''
     mkdir -p $out/bin
     cp build/vis $out/bin/vis
+    # See https://github.com/dpayne/cli-visualizer/issues/62#issuecomment-330738075
+    wrapProgram $out/bin/vis --set TERM rxvt-256color
   '';
 
   meta = {

pkgs/applications/misc/kdeconnect/default.nix

@@ -5,6 +5,7 @@
 , kcmutils
 , kconfigwidgets
 , kdbusaddons
+, kdoctools
 , kiconthemes
 , ki18n
 , knotifications
@@ -25,25 +26,19 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [
-    kcmutils
+    libfakekey libXtst
-    kconfigwidgets
+    ki18n kiconthemes kcmutils kconfigwidgets kdbusaddons knotifications
-    kdbusaddons
+    qca-qt5 qtx11extras
-    qca-qt5
-    ki18n
-    kiconthemes
-    knotifications
-    libfakekey
-    libXtst
-    qtx11extras
   ];
 
-  nativeBuildInputs = [ extra-cmake-modules ];
+  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
 
-  meta = {
+  enableParallelBuilding = true;
+
+  meta = with lib; {
     description = "KDE Connect provides several features to integrate your phone and your computer";
-    license = with lib.licenses; [ gpl2 ];
+    homepage    = https://community.kde.org/KDEConnect;
-    maintainers = with lib.maintainers; [ fridh ];
+    license     = with licenses; [ gpl2 ];
-    homepage = https://community.kde.org/KDEConnect;
+    maintainers = with maintainers; [ fridh ];
   };
-
 }

pkgs/applications/misc/pgadmin/default.nix

@@ -1,23 +1,32 @@
-{ stdenv, fetchurl, postgresql, wxGTK, libxml2, libxslt, openssl, zlib, makeDesktopItem }:
+{ stdenv, fetchurl, fetchpatch, postgresql, wxGTK, libxml2, libxslt, openssl, zlib, makeDesktopItem }:
 
 stdenv.mkDerivation rec {
   name = "pgadmin3-${version}";
-  version = "1.22.1";
+  version = "1.22.2";
 
   src = fetchurl {
-    url = "http://ftp.postgresql.org/pub/pgadmin3/release/v${version}/src/pgadmin3-${version}.tar.gz";
+    url = "http://ftp.postgresql.org/pub/pgadmin/pgadmin3/v${version}/src/pgadmin3-${version}.tar.gz";
-    sha256 = "0gkqpj8cg6jd6yhssrij1cbh960rg9fkjbdzcpryi6axwv0ag7ki";
+    sha256 = "1b24b356h8z188nci30xrb57l7kxjqjnh6dq9ws638phsgiv0s4v";
   };
 
   enableParallelBuilding = true;
 
   buildInputs = [ postgresql wxGTK openssl zlib ];
 
+  patches = [
+    (fetchpatch {
+      sha256 = "09hp7s3zjz80rpx2j3xyznwswwfxzi70z7c05dzrdk74mqjjpkfk";
+      name = "843344.patch";
+      url = "https://sources.debian.net/data/main/p/pgadmin3/1.22.2-1/debian/patches/843344";
+    })
+  ];
+
   preConfigure = ''
     substituteInPlace pgadmin/ver_svn.sh --replace "bin/bash" "$shell"
   '';
 
   configureFlags = [
+    "--with-pgsql=${postgresql}"
     "--with-libxml2=${libxml2.dev}"
     "--with-libxslt=${libxslt.dev}"
   ];

pkgs/applications/misc/rofi/default.nix

@@ -1,14 +1,15 @@
 { stdenv, fetchurl, autoreconfHook, pkgconfig, libxkbcommon, pango, which, git
 , cairo, glib, libxcb, xcbutil, xcbutilwm, xcbutilxrm, libstartup_notification
+, bison, flex, librsvg, check
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.3.1";
+  version = "1.4.1";
   name = "rofi-${version}";
 
   src = fetchurl {
     url = "https://github.com/DaveDavenport/rofi/releases/download/${version}/${name}.tar.gz";
-    sha256 = "09i3vd8k6zqphrm382fglsmxc4q6dg00xddzl96kakszgvdd4qfs";
+    sha256 = "19x11s71q24gjdnsjf1ar6raq1drav7qp3nzjkw8qajpgvjrxwcn";
   };
 
   preConfigure = ''
@@ -18,7 +19,7 @@ stdenv.mkDerivation rec {
   '';
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
-  buildInputs = [ libxkbcommon pango cairo git
+  buildInputs = [ libxkbcommon pango cairo git bison flex librsvg check
     libstartup_notification libxcb xcbutil xcbutilwm xcbutilxrm which
   ];
   doCheck = true;

pkgs/applications/networking/browsers/chromium/browser.nix

@@ -47,7 +47,7 @@ mkChromiumDerivation (base: rec {
   meta = {
     description = "An open source web browser from Google";
     homepage = http://www.chromium.org/;
-    maintainers = with maintainers; [ chaoflow ];
+    maintainers = with maintainers; [ chaoflow bendlas ];
     license = licenses.bsd3;
     platforms = platforms.linux;
     hydraPlatforms = if channel == "stable" then ["x86_64-linux"] else [];

pkgs/applications/networking/browsers/firefox-bin/default.nix

@@ -16,6 +16,7 @@
 , gstreamer
 , gtk2
 , gtk3
+, kerberos
 , libX11
 , libXScrnSaver
 , libxcb
@@ -100,6 +101,7 @@ stdenv.mkDerivation {
       gstreamer
       gtk2
       gtk3
+      kerberos
       libX11
       libXScrnSaver
       libXcomposite
@@ -168,6 +170,7 @@ stdenv.mkDerivation {
     '';
 
   passthru.ffmpegSupport = true;
+  passthru.gssSupport = true;
   passthru.updateScript = import ./update.nix {
     inherit name channel writeScript xidel coreutils gnused gnugrep gnupg curl;
     baseUrl =

pkgs/applications/networking/browsers/firefox/common.nix

@@ -19,6 +19,7 @@
 , pulseaudioSupport ? true, libpulseaudio
 , ffmpegSupport ? true, gstreamer, gst-plugins-base
 , gtk3Support ? !isTorBrowserLike, gtk2, gtk3, wrapGAppsHook
+, gssSupport ? true, kerberos
 
 ## privacy-related options
 
@@ -72,7 +73,8 @@ stdenv.mkDerivation (rec {
   ++ lib.optional  alsaSupport alsaLib
   ++ lib.optional  pulseaudioSupport libpulseaudio # only headers are needed
   ++ lib.optionals ffmpegSupport [ gstreamer gst-plugins-base ]
-  ++ lib.optional  gtk3Support gtk3;
+  ++ lib.optional  gtk3Support gtk3
+  ++ lib.optional  gssSupport kerberos;
 
   NIX_CFLAGS_COMPILE = "-I${nspr.dev}/include/nspr -I${nss.dev}/include/nss";
 
@@ -128,7 +130,8 @@ stdenv.mkDerivation (rec {
     "--disable-gconf"
     "--enable-default-toolkit=cairo-gtk${if gtk3Support then "3" else "2"}"
   ]
-  ++ lib.optionals (stdenv.lib.versionAtLeast version "56") [
+  ++ lib.optionals (stdenv.lib.versionAtLeast version "56" && !stdenv.hostPlatform.isi686) [
+    # on i686-linux: --with-libclang-path is not available in this configuration
     "--with-libclang-path=${llvmPackages.clang-unwrapped}/lib"
     "--with-clang-path=${llvmPackages.clang}/bin/clang"
   ]
@@ -155,6 +158,7 @@ stdenv.mkDerivation (rec {
   ++ flag alsaSupport "alsa"
   ++ flag pulseaudioSupport "pulseaudio"
   ++ flag ffmpegSupport "ffmpeg"
+  ++ flag gssSupport "negotiateauth"
   ++ lib.optional (!ffmpegSupport) "--disable-gstreamer"
   ++ flag webrtcSupport "webrtc"
   ++ flag geolocationSupport "mozril-geoloc"
@@ -219,6 +223,7 @@ stdenv.mkDerivation (rec {
     gtk = gtk2;
     inherit nspr;
     inherit ffmpegSupport;
+    inherit gssSupport;
   } // lib.optionalAttrs gtk3Support { inherit gtk3; };
 
 } // overrides)

pkgs/applications/networking/browsers/firefox/packages.nix

@@ -113,6 +113,7 @@ in rec {
   } // commonAttrs) {
     stdenv = overrideCC stdenv gcc5;
     ffmpegSupport = false;
+    gssSupport = false;
   };
 
   tor-browser-7-0 = common (rec {

pkgs/applications/networking/browsers/firefox/wrapper.nix

@@ -9,6 +9,7 @@
 , esteidfirefoxplugin
 , vlc_npapi
 , libudev
+, kerberos
 }:
 
 ## configurability of the wrapper itself
@@ -25,6 +26,7 @@ let
   cfg = stdenv.lib.attrByPath [ browserName ] {} config;
   enableAdobeFlash = cfg.enableAdobeFlash or false;
   ffmpegSupport = browser.ffmpegSupport or false;
+  gssSupport = browser.gssSupport or false;
   jre = cfg.jre or false;
   icedtea = cfg.icedtea or false;
 
@@ -46,6 +48,7 @@ let
       ++ lib.optional (cfg.enableVLC or false) vlc_npapi
      );
   libs = (if ffmpegSupport then [ ffmpeg ] else with gst_all; [ gstreamer gst-plugins-base ])
+         ++ lib.optional gssSupport kerberos
          ++ lib.optionals (cfg.enableQuakeLive or false)
          (with xorg; [ stdenv.cc libX11 libXxf86dga libXxf86vm libXext libXt alsaLib zlib libudev ])
          ++ lib.optional (enableAdobeFlash && (cfg.enableAdobeFlashDRM or false)) hal-flash

pkgs/applications/networking/instant-messengers/scudcloud/default.nix

@@ -9,7 +9,7 @@ in python3Packages.buildPythonPackage {
     sha256 = "e0d1cb72115d0fda17db92d28be51558ad8fe250972683fac3086dbe8d350d22";
   };
 
-  propagatedBuildInputs = with python3Packages; [ pyqt5 dbus-python ];
+  propagatedBuildInputs = with python3Packages; [ pyqt5 dbus-python jsmin ];
 
   meta = with stdenv.lib; {
     description = "Non-official desktop client for Slack";

pkgs/applications/networking/mailreaders/astroid/default.nix

@@ -1,31 +1,30 @@
-{ stdenv, fetchFromGitHub, scons, pkgconfig, gnome3, gmime, webkitgtk24x-gtk3
+{ stdenv, fetchFromGitHub, scons, pkgconfig, gnome3, gmime3, webkitgtk24x-gtk3
 , libsass, notmuch, boost, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
   name = "astroid-${version}";
-  version = "0.9.1";
+  version = "0.10.2";
 
   src = fetchFromGitHub {
     owner = "astroidmail";
     repo = "astroid";
     rev = "v${version}";
-    sha256 = "0ha2jd3fvc54amh0x8f58s9ac4r8xgyhvkwd4jvs0h4mfh6cg496";
+    sha256 = "0y1i40xbjjvnylqpdkvj0m9fl6f5k9zk1z4pqg3vhj8x1ys8am1c";
   };
 
   nativeBuildInputs = [ scons pkgconfig wrapGAppsHook ];
 
-  buildInputs = [ gnome3.gtkmm gmime webkitgtk24x-gtk3 libsass gnome3.libpeas
+  buildInputs = [ gnome3.gtkmm gmime3 webkitgtk24x-gtk3 libsass gnome3.libpeas
-                  notmuch boost gnome3.gsettings_desktop_schemas
+                  notmuch boost gnome3.gsettings_desktop_schemas ];
-                  gnome3.adwaita-icon-theme ];
 
   buildPhase = "scons --propagate-environment --prefix=$out build";
   installPhase = "scons --propagate-environment --prefix=$out install";
 
-  meta = {
+  meta = with stdenv.lib; {
     homepage = https://astroidmail.github.io/;
     description = "GTK+ frontend to the notmuch mail system";
-    maintainers = [ stdenv.lib.maintainers.bdimcheff ];
+    maintainers = with maintainers; [ bdimcheff SuprDewd ];
-    license = stdenv.lib.licenses.gpl3Plus;
+    license = licenses.gpl3Plus;
-    platforms = stdenv.lib.platforms.linux;
+    platforms = platforms.linux;
   };
 }

pkgs/applications/networking/mailreaders/mailnag/default.nix

@@ -1,9 +1,12 @@
-{ stdenv, fetchurl, gettext, gtk3, python2Packages
+{ stdenv, fetchurl, gettext, gtk3, pythonPackages
 , gdk_pixbuf, libnotify, gst_all_1
-, libgnome_keyring3 ? null, networkmanager ? null
+, libgnome_keyring3, networkmanager
+, wrapGAppsHook, gnome3
+, withGnomeKeyring ? false
+, withNetworkManager ? true
 }:
 
-python2Packages.buildPythonApplication rec {
+pythonPackages.buildPythonApplication rec {
   name = "mailnag-${version}";
   version = "1.2.1";
 
@@ -13,26 +16,20 @@ python2Packages.buildPythonApplication rec {
   };
 
   buildInputs = [
-    gettext gtk3 python2Packages.pygobject3 python2Packages.dbus-python
+    gettext gtk3 gdk_pixbuf libnotify gst_all_1.gstreamer
-    python2Packages.pyxdg gdk_pixbuf libnotify gst_all_1.gstreamer
     gst_all_1.gst-plugins-base gst_all_1.gst-plugins-good
-    gst_all_1.gst-plugins-bad libgnome_keyring3 networkmanager
+    gst_all_1.gst-plugins-bad
+    gnome3.defaultIconTheme
+  ] ++ stdenv.lib.optional withGnomeKeyring libgnome_keyring3
+    ++ stdenv.lib.optional withNetworkManager networkmanager;
+
+  nativeBuildInputs = [
+    wrapGAppsHook
   ];
 
-  preFixup = ''
+  propagatedBuildInputs = with pythonPackages; [
-    for script in mailnag mailnag-config; do
+    pygobject3 dbus-python pyxdg
-      wrapProgram $out/bin/$script \
+  ];
-        --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
-        --prefix GI_TYPELIB_PATH : "$GI_TYPELIB_PATH" \
-        --prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0" \
-        --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH:$out/share" \
-        --prefix PYTHONPATH : "$PYTHONPATH"
-    done
-  '';
-
-  buildPhase = "";
-
-  installPhase = "python2 setup.py install --prefix=$out";
 
   doCheck = false;
 

pkgs/applications/networking/mailreaders/notmuch-bower/default.nix

@@ -0,0 +1,36 @@
+{ stdenv, fetchFromGitHub, gawk, mercury, pandoc, ncurses, gpgme }:
+
+stdenv.mkDerivation rec {
+  name = "notmuch-bower-${version}";
+  version = "2017-09-27";
+
+  src = fetchFromGitHub {
+    owner = "wangp";
+    repo = "bower";
+    rev = "e4918ed581984bf2813f51f007a0aaaa7fa0da7f";
+    sha256 = "13np5yharjik1pp23cfgffi0g0ikl6pl5sqqyy0ki7gk7gyy913i";
+  };
+
+  nativeBuildInputs = [ gawk mercury pandoc ];
+
+  buildInputs = [ ncurses gpgme ];
+
+  makeFlags = [ "PARALLEL=-j$(NIX_BUILD_CORES)" "bower" "man" ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    mv bower $out/bin/
+    mkdir -p $out/share/man/man1
+    mv bower.1 $out/share/man/man1/
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/wangp/bower;
+    description = "A curses terminal client for the Notmuch email system";
+    maintainers = with maintainers; [ erictapen ];
+    license = licenses.gpl3;
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/science/logic/abella/default.nix

@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   name = "abella-${version}";
-  version = "2.0.2";
+  version = "2.0.4";
 
   src = fetchurl {
     url = "http://abella-prover.org/distributions/${name}.tar.gz";
-    sha256 = "b56d865ebdb198111f1dcd5b6fbcc0d7fc6dd1294f7601903ba4e3c3322c099c";
+    sha256 = "1hnccjlyzwgz7kqsr4xmx9y4wmalbxsj0g6fxdk6xrgpc84ihw2c";
   };
 
-  buildInputs = [ rsync ] ++ (with ocamlPackages; [ ocaml ocamlbuild ]);
+  buildInputs = [ rsync ] ++ (with ocamlPackages; [ ocaml ocamlbuild findlib ]);
 
   installPhase = ''
     mkdir -p $out/bin
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = http://abella-prover.org/;
     license = stdenv.lib.licenses.gpl3;
-    maintainers = with stdenv.lib.maintainers; [ bcdarwin ];
+    maintainers = with stdenv.lib.maintainers; [ bcdarwin ciil ];
     platforms = stdenv.lib.platforms.unix;
   };
 }

pkgs/applications/science/logic/aiger/default.nix

@@ -0,0 +1,53 @@
+{ stdenv, fetchurl, picosat }:
+
+stdenv.mkDerivation rec {
+  name = "aiger-${version}";
+  version = "1.9.9";
+
+  src = fetchurl {
+    url    = "http://fmv.jku/aiger/${name}.tar.gz";
+    sha256 = "1ish0dw0nf9gyghxsdhpy1jjiy5wp54c993swp85xp7m6vdx6l0y";
+  };
+
+  enableParallelBuilding = true;
+
+  configurePhase = ''
+    # Set up picosat, so we can build 'aigbmc'
+    echo $(pwd)
+    ls ..
+    mkdir ../picosat
+    ln -s ${picosat}/include/picosat/picosat.h ../picosat/picosat.h
+    ln -s ${picosat}/lib/picosat.o             ../picosat/picosat.o
+    ln -s ${picosat}/share/picosat.version     ../picosat/VERSION
+    ls ..
+    ./configure.sh
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+
+    # Do the installation manually, as the Makefile has odd
+    # cyrillic characters, and this is easier than adding
+    # a whole .patch file.
+    BINS=( \
+      aigand aigdd aigflip aigfuzz aiginfo aigjoin   \
+      aigmiter aigmove aignm aigor aigreset aigsim   \
+      aigsplit aigstrip aigtoaig aigtoblif aigtocnf  \
+      aigtodot aigtosmv aigunconstraint aigunroll    \
+      andtoaig bliftoaig smvtoaig soltostim wrapstim \
+      aigbmc aigdep
+    )
+
+    for x in ''${BINS[*]}; do
+      install -m 755 -s $x $out/bin/$x
+    done
+  '';
+
+  meta = {
+    description = "And-Inverter Graph (AIG) utilities";
+    homepage    = http://fmv.jku.at/aiger/;
+    license     = stdenv.lib.licenses.mit;
+    maintainers = with stdenv.lib.maintainers; [ thoughtpolice ];
+    platforms   = stdenv.lib.platforms.linux;
+  };
+}

pkgs/applications/science/logic/avy/0001-no-static-boost-libs.patch

@@ -0,0 +1,12 @@
+diff --git a/avy/CMakeLists.txt b/avy/CMakeLists.txt
+index 5913076..b0453b5 100644
+--- a/avy/CMakeLists.txt
++++ b/avy/CMakeLists.txt
+@@ -23,7 +23,6 @@ if (CUSTOM_BOOST_ROOT)
+   set (Boost_NO_SYSTEM_PATHS "ON")
+ endif()
+ 
+-set (Boost_USE_STATIC_LIBS ON)
+ find_package (Boost 1.46.1 REQUIRED program_options)
+ IF (Boost_FOUND)
+   include_directories (${Boost_INCLUDE_DIRS})

pkgs/applications/science/logic/avy/default.nix

@@ -0,0 +1,32 @@
+{ stdenv, fetchgit, cmake, zlib, boost }:
+
+stdenv.mkDerivation rec {
+  name = "avy-${version}";
+  version = "2017.10.16";
+
+  src = fetchgit {
+    url    = "https://bitbucket.org/arieg/extavy";
+    rev    = "c75c83379c38d6ea1046d0caee95aef77283ffe3";
+    sha256 = "0zcycnypg4q5g710bnkjpycaawmibc092vmyhgfbixkgq9fb5lfh";
+    fetchSubmodules = true;
+  };
+
+  buildInputs = [ cmake zlib boost.out boost.dev ];
+  NIX_CFLAGS_COMPILE = [ "-Wno-narrowing" ];
+  patches =
+    [ ./0001-no-static-boost-libs.patch
+    ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp avy/src/{avy,avybmc} $out/bin/
+  '';
+
+  meta = {
+    description = "AIGER model checking for Property Directed Reachability";
+    homepage    = https://arieg.bitbucket.io/avy/;
+    license     = stdenv.lib.licenses.mit;
+    maintainers = with stdenv.lib.maintainers; [ thoughtpolice ];
+    platforms   = stdenv.lib.platforms.linux;
+  };
+}

pkgs/applications/science/logic/picosat/default.nix

@@ -12,9 +12,11 @@ stdenv.mkDerivation rec {
   configurePhase = "./configure.sh --shared --trace";
 
   installPhase = ''
-   mkdir -p $out/bin $out/lib $out/include/picosat
+   mkdir -p $out/bin $out/lib $out/share $out/include/picosat
    cp picomus picomcs picosat picogcnf "$out"/bin
 
+   cp VERSION      "$out"/share/picosat.version
+   cp picosat.o    "$out"/lib
    cp libpicosat.a "$out"/lib
    cp libpicosat.so "$out"/lib
 

pkgs/applications/science/logic/symbiyosys/default.nix

@@ -0,0 +1,37 @@
+{ stdenv, fetchFromGitHub, yosys, python3 }:
+
+stdenv.mkDerivation rec {
+  name = "symbiyosys-${version}";
+  version = "2017.10.16";
+
+  src = fetchFromGitHub {
+    owner  = "cliffordwolf";
+    repo   = "symbiyosys";
+    rev    = "f403b99fae053baab651e3ec8345a68cb3ba6a96";
+    sha256 = "0jzzlybxaqmhrasfjv3q3skshalr7lvv4p142qgdqz1ig36znbi8";
+  };
+
+  buildInputs = [ python3 yosys ];
+
+  buildPhase = "true";
+  installPhase = ''
+    mkdir -p $out/bin $out/share/yosys/python3
+
+    cp sbysrc/sby_*.py $out/share/yosys/python3/
+    cp sbysrc/sby.py $out/bin/sby
+    chmod +x $out/bin/sby
+
+    # Fix up shebang and Yosys imports
+    patchShebangs $out/bin/sby
+    substituteInPlace $out/bin/sby \
+      --replace "##yosys-sys-path##" \
+                "sys.path += [p + \"/share/yosys/python3/\" for p in [\"$out\", \"${yosys}\"]]"
+  '';
+  meta = {
+    description = "Yosys verification tools for Hardware Definition Languages";
+    homepage    = https://symbiyosys.readthedocs.io/;
+    license     = stdenv.lib.licenses.mit;
+    maintainers = with stdenv.lib.maintainers; [ thoughtpolice ];
+    platforms   = stdenv.lib.platforms.linux;
+  };
+}

pkgs/applications/version-management/git-and-tools/git-dit/default.nix

@@ -1,39 +1,41 @@
-{ stdenv, fetchFromGitHub, pandoc }:
+{ stdenv
+, fetchFromGitHub
+, openssl
+, gcc
+, zlib
+, libssh
+, cmake
+, perl
+, pkgconfig
+, rustPlatform
+}:
 
-stdenv.mkDerivation rec {
+with rustPlatform;
+
+buildRustPackage rec {
   name = "git-dit-${version}";
-  version = "0.1.0";
+  version = "0.4.0";
-
-  buildInputs = [ pandoc ];
 
   src = fetchFromGitHub {
     owner = "neithernut";
     repo = "git-dit";
     rev = "v${version}";
-    sha256 = "1rvp2dhnb8yqrracvfpvf8z1vz4fs0rii18hhrskr6n1sfd7x9kd";
+    sha256 = "1sx6sc2dj3l61gbiqz8vfyhw5w4xjdyfzn1ixz0y8ipm579yc7a2";
   };
 
-  # the Makefile doesn’t work, we emulate it below
+  depsSha256 = "1z2n3z5wkh5z5vc976yscq77fgjszwzwlrp7g17hmsbhzx6x170h";
-  dontBuild = true;
 
-  postPatch = ''
+  nativeBuildInputs = [
-    # resolve binaries to the right path
+    cmake
-    sed -e "s|exec git-dit-|exec $out/bin/git-dit-|" -i git-dit
+    pkgconfig
+    perl
+  ];
 
-    # we change every git dit command to the local subcommand path
+  buildInputs = [
-    # (git dit foo -> /nix/store/…-git-dit/bin/git-dit-foo)
+    openssl
-    for script in git-dit-*; do
+    libssh
-      sed -e "s|git dit |$out/bin/git-dit-|g" -i "$script"
+    zlib
-    done
+  ];
-  '';
-
-  installPhase = ''
-    mkdir -p $out/{bin,share/man/man1}
-    # from the Makefile
-    ${stdenv.lib.getBin pandoc}/bin/pandoc -s -t man git-dit.1.md \
-                                           -o $out/share/man/man1/git-dit.1
-    cp git-dit* $out/bin
-  '';
 
   meta = with stdenv.lib; {
     inherit (src.meta) homepage;
@@ -41,6 +43,4 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     maintainers = with maintainers; [ profpatsch matthiasbeyer ];
   };
-
-
 }

pkgs/applications/version-management/gitlab/default.nix

@@ -84,12 +84,14 @@ stdenv.mkDerivation rec {
   '';
 
   installPhase = ''
+    rm -r tmp
     mkdir -p $out/share
     cp -r . $out/share/gitlab
     rm -rf $out/share/gitlab/log
     ln -sf /run/gitlab/log $out/share/gitlab/log
     ln -sf /run/gitlab/uploads $out/share/gitlab/public/uploads
     ln -sf /run/gitlab/config $out/share/gitlab/config
+    ln -sf /run/gitlab/tmp $out/share/gitlab/tmp
 
     # rake tasks to mitigate CVE-2017-0882
     # see https://about.gitlab.com/2017/03/20/gitlab-8-dot-17-dot-4-security-release/

pkgs/applications/video/mkvtoolnix/default.nix

@@ -10,13 +10,13 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "mkvtoolnix-${version}";
-  version = "15.0.0";
+  version = "16.0.0";
 
   src = fetchFromGitHub {
     owner = "mbunkus";
     repo = "mkvtoolnix";
     rev = "release-${version}";
-    sha256 = "06n0hbp484zpsjvnzp6p0nzzssym3illxdicn3y1jf8gy971rxi0";
+    sha256 = "0zdmjp0f7sh0bkaj0ls4sy4sg9qdq9ycrl18hlkafnj9xnbijgnn";
   };
 
   nativeBuildInputs = [ pkgconfig autoconf automake gettext drake ruby docbook_xsl libxslt ];

pkgs/data/misc/hackage/default.nix

@@ -1,11 +1,34 @@
-{ fetchFromGitHub }:
+{ fetchFromGitHub
+, stdenv
+, pkgconfig
+, libarchive
+, glib
+, # Override this to use a different revision
+  src-spec ?
+    { owner = "commercialhaskell";
+      repo = "all-cabal-hashes";
+      rev = "901c2522e6797270f5ded4495b1a529e6c16ef45";
+      sha256 = "05jmwsgrk77nz9vvgfbpsps0l320qgjpkr2c9zhkn9sc3d275lfb";
+    }
+, lib
+}:
 
 # Use builtins.fetchTarball "https://github.com/commercialhaskell/all-cabal-hashes/archive/hackage.tar.gz"
 # instead if you want the latest Hackage automatically at the price of frequent re-downloads.
-
+let partition-all-cabal-hashes = stdenv.mkDerivation
-fetchFromGitHub {
+      { name = "partition-all-cabal-hashes";
-  owner = "commercialhaskell";
+        src = ./partition-all-cabal-hashes.c;
-  repo = "all-cabal-hashes";
+        unpackPhase = "true";
-  rev = "901c2522e6797270f5ded4495b1a529e6c16ef45";
+        buildInputs = [ libarchive glib ];
-  sha256 = "0wng314y3yn6bbwa5ar254l7p8y99gsvm8ll4z7f3wg77v5fzish";
+        nativeBuildInputs = [ pkgconfig ];
-}
+        buildPhase =
+          "cc -O3 $(pkg-config --cflags --libs libarchive glib-2.0) $src -o partition-all-cabal-hashes";
+        installPhase =
+          ''
+            mkdir -p $out/bin
+            install -m755 partition-all-cabal-hashes $out/bin
+          '';
+      };
+in fetchFromGitHub (src-spec //
+  { postFetch = "${partition-all-cabal-hashes}/bin/partition-all-cabal-hashes $downloadedFile $out";
+  })

pkgs/data/misc/hackage/partition-all-cabal-hashes.c

@@ -0,0 +1,190 @@
+#include <stdio.h>
+#include <ctype.h>
+#include <glib.h>
+#include <string.h>
+#include <locale.h>
+#include <archive.h>
+#include <archive_entry.h>
+
+static char * case_normalize(char * str) {
+  for (char * iter = str; *iter; ++iter) {
+    *iter = tolower(*iter);
+  }
+  return str;
+}
+
+static gint compare_str(const void * a, const void * b, void * _) {
+  return strcmp(a, b);
+}
+
+int main(int argc, char ** argv) {
+  if (argc != 3) {
+    fprintf(stderr, "Usage: %s TARBALL OUTPUT\n", argv[0]);
+    return 1;
+  }
+
+  size_t output_len = strlen(argv[2]);
+
+  /* Switch to standard locale to ensure consistency in case-folding.
+   */
+  setlocale(LC_CTYPE, "C");
+
+  /* Map from case-normalized package name to a sorted sequence of
+   * package names in the equivalence class defined by
+   * case-normalization.
+   */
+  GHashTable * equivalence_classes =
+    g_hash_table_new(g_str_hash, g_str_equal);
+
+  /* Open up the tarball.
+   */
+  struct archive * ar = archive_read_new();
+  if (!ar) {
+    perror("Allocating archive structure");
+    return 1;
+  }
+  archive_read_support_filter_gzip(ar);
+  archive_read_support_format_tar(ar);
+  if (archive_read_open_filename( ar
+                                , argv[1]
+                                , 10240
+                                ) == ARCHIVE_FATAL) {
+    fprintf( stderr
+           , "Error opening %s: %s\n"
+           , argv[0]
+           , archive_error_string(ar)
+           );
+    return 1;
+  }
+
+  /* Extract the length of the output directory that prefixes all
+   * tarball entries from the first entry in the tarball.
+   */
+  struct archive_entry * ent;
+  int err = archive_read_next_header(ar, &ent);
+  if (err != ARCHIVE_OK) {
+    if (err == ARCHIVE_EOF) {
+      fprintf( stderr
+             , "No entries in %s, surely this is an error!\n"
+             , argv[1]
+             );
+    } else {
+      fprintf( stderr
+             , "Error reading entry from %s: %s\n"
+             , argv[1]
+             , archive_error_string(ar)
+             );
+    }
+    return 1;
+  }
+  const char * path = archive_entry_pathname(ent);
+  /* Number of characters from the start of the path name until after
+   * the slash after the leading directory.
+   */
+  size_t prefix_len = strchr(path, '/') - path + 1;
+
+  /* Extract each entry to the right partition.
+   */
+  do {
+    path = archive_entry_pathname(ent) + prefix_len;
+    const char * pkg_end = strchr(path, '/');
+    if (!pkg_end)
+      /* If there is no second slash, then this is either just the entry
+       * corresponding to the root or some non-package file (e.g.
+       * travis.yml). In either case, we don't care.
+       */
+      continue;
+
+    /* Find our package in the equivalence class map.
+     */
+    char * pkg_name = g_strndup(path, pkg_end - path);
+    char * pkg_normalized =
+      case_normalize(g_strndup(path, pkg_end - path));
+    GSequence * pkg_class =
+      g_hash_table_lookup(equivalence_classes, pkg_normalized);
+    gint partition_num;
+    if (!pkg_class) {
+      /* We haven't seen any packages with this normalized name yet,
+       * so we need to initialize the sequence and add it to the map.
+       */
+      pkg_class = g_sequence_new(NULL);
+      g_sequence_append(pkg_class, pkg_name);
+      g_hash_table_insert( equivalence_classes
+                         , pkg_normalized
+                         , pkg_class
+                         );
+      partition_num = 1;
+    } else {
+      g_free(pkg_normalized);
+      /* Find the package name in the equivalence class */
+      GSequenceIter * pkg_iter =
+        g_sequence_search( pkg_class
+                         , pkg_name
+                         , compare_str
+                         , NULL
+                         );
+      if (!g_sequence_iter_is_end(pkg_iter)) {
+        /* If there are any packages after this one in the list, bail
+         * out. In principle we could solve this by moving them up to
+         * the next partition, but so far I've never seen any github
+         * tarballs out of order so let's save ourselves the work
+         * until we know we need it.
+         */
+        fprintf( stderr
+               , "Out of order github tarball: %s is after %s\n"
+               , pkg_name
+               , (char *) g_sequence_get(pkg_iter)
+               );
+        return 1;
+      }
+      pkg_iter = g_sequence_iter_prev(pkg_iter);
+      if (strcmp( g_sequence_get(pkg_iter)
+                , pkg_name
+                ) != 0) {
+        /* This package doesn't have the same name as the one right
+         * before where it should be in the sequence, which means it's
+         * new and needs to be added to the sequence.
+         *
+         * !!! We need to change this to use g_sequence_insert_before
+         * if we ever get an out-of-order github tarball, see comment
+         * after the check for !g_sequence_iter_is_end(pkg_iter).
+         */
+        pkg_iter = g_sequence_append(pkg_class, pkg_name);
+      } else {
+        g_free(pkg_name);
+      }
+      /* Get the partition number, starting with 1.
+       */
+      partition_num = g_sequence_iter_get_position(pkg_iter) + 1;
+    }
+
+    /* Set the destination path.
+     * The 3 below is for the length of /#/, the partition number part
+     * of the path. If we have more than 9 partitions, we deserve to
+     * segfault. The 1 at the end is for the trailing null.
+     */
+    char * dest_path = g_malloc(output_len + 3 + strlen(path) + 1);
+    sprintf(dest_path, "%s/%d/%s", argv[2], partition_num, path);
+    archive_entry_set_pathname(ent, dest_path);
+
+    if (archive_read_extract(ar, ent, 0) != ARCHIVE_OK) {
+      fprintf( stderr
+             , "Error extracting entry %s from %s: %s\n"
+             , dest_path
+             , argv[1]
+             , archive_error_string(ar)
+             );
+      return 1;
+    }
+  } while ((err = archive_read_next_header(ar, &ent)) == ARCHIVE_OK);
+  if (err != ARCHIVE_EOF) {
+    fprintf( stderr
+           , "Error reading entry from %s: %s\n"
+           , argv[1]
+           , archive_error_string(ar)
+           );
+    return 1;
+  }
+
+  return 0;
+}

pkgs/development/compilers/arachne-pnr/default.nix

@@ -11,10 +11,9 @@ stdenv.mkDerivation rec {
     sha256 = "1wszcx6hgw4q4r778zswrlwdwvwxq834bkajck8w9yfqwxs9lmq8";
   };
 
-  preBuild = ''
+  makeFlags =
-    makeFlags="DESTDIR=$out $makeFlags"
+    [ "DESTDIR=$(out)" "ICEBOX=${icestorm}/share/icebox"
-  '';
+    ];
-  makeFlags = "ICEBOX=${icestorm}/share/icebox";
 
   meta = {
     description = "Place and route tool for FPGAs";
@@ -30,7 +29,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = https://github.com/cseed/arachne-pnr;
     license = stdenv.lib.licenses.mit;
-    maintainers = [ stdenv.lib.maintainers.shell ];
+    maintainers = with stdenv.lib.maintainers; [ shell thoughtpolice ];
     platforms = stdenv.lib.platforms.linux;
   };
 }

pkgs/development/compilers/jetbrains-jdk/default.nix

@@ -7,13 +7,13 @@
 
 let drv = stdenv.mkDerivation rec {
   pname = "jetbrainsjdk";
-  version = "152b970.2";
+  version = "152b1036.1";
   name = pname + "-" + version;
 
   src = if stdenv.system == "x86_64-linux" then
     fetchurl {
       url = "https://bintray.com/jetbrains/intellij-jdk/download_file?file_path=jbsdk8u${version}_linux_x64.tar.gz";
-      sha256 = "0i2cqjfab91kr618z88nb5g9yg60j5z08wjl0nlvcmpvg2z6va0m";
+      sha256 = "1768f02i3dxdbxn8n29d522h8v0mkgnhpb8ixzq5p54vwjmfl6md";
     }
   else
     abort "unsupported system: ${stdenv.system}";

pkgs/development/compilers/yosys/default.nix

@@ -1,27 +1,30 @@
-{ stdenv, fetchFromGitHub, fetchFromBitbucket, pkgconfig, tcl, readline, libffi, python3, bison, flex }:
+{ stdenv, fetchFromGitHub, fetchFromBitbucket
+, pkgconfig, tcl, readline, libffi, python3, bison, flex
+}:
 
 stdenv.mkDerivation rec {
   name = "yosys-${version}";
-  version = "2017.09.01";
+  version = "2017.10.16";
 
   srcs = [
     (fetchFromGitHub {
       owner = "cliffordwolf";
       repo = "yosys";
-      rev = "18609f3df82a3403c41d552908183f7e49ff5678";
+      rev = "716dbc92745aa8b41d85a60d50263433d5a79393";
-      sha256 = "0qdjxqg3l098g8pda5a4cif4bd78rx7vilv3z62r56ppj55mgw96";
+      sha256 = "0va77my4iddsw6psgjfhfgs0z0z1hpj0l8ipchcl8crpxipxcr77";
       name = "yosys";
     })
     (fetchFromBitbucket {
       owner = "alanmi";
       repo = "abc";
-      rev = "ff5be0604997";
+      rev = "6283c5d99b06";
-      sha256 = "08gdvxm44dvhgjw6lf2jx0xyk6h4ai37h6b88dysvaa69sx7rh8n";
+      sha256 = "1mv8r1la4d4r9bk32sl4nq3flyxi8jf2ccaak64j5rz9hirrlpla";
       name = "yosys-abc";
     })
   ];
   sourceRoot = "yosys";
 
+  enableParallelBuilding = true;
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ tcl readline libffi python3 bison flex ];
   preBuild = ''
@@ -43,9 +46,9 @@ stdenv.mkDerivation rec {
       adding additional passes as needed by extending the yosys C++
       code base.
     '';
-    homepage = http://www.clifford.at/yosys/;
+    homepage    = http://www.clifford.at/yosys/;
-    license = stdenv.lib.licenses.isc;
+    license     = stdenv.lib.licenses.isc;
-    maintainers = [ stdenv.lib.maintainers.shell ];
+    maintainers = with stdenv.lib.maintainers; [ shell thoughtpolice ];
-    platforms = stdenv.lib.platforms.linux;
+    platforms   = stdenv.lib.platforms.linux;
   };
 }

pkgs/development/haskell-modules/make-package-set.nix

@@ -118,10 +118,23 @@ let
       '';
   };
 
-  hackage2nix = name: version: self.haskellSrc2nix {
+  all-cabal-hashes-component = name: import (pkgs.runCommand "all-cabal-hashes-component-${name}.nix" {}
+    ''
+      set +o pipefail
+      for component in ${all-cabal-hashes}/*; do
+        if ls $component | grep -q ${name}; then
+          echo "builtins.storePath $component" > $out
+          exit 0
+        fi
+      done
+      echo "${name} not found in any all-cabal-hashes component, are you sure it's in hackage?" >&2
+      exit 1
+    '');
+
+  hackage2nix = name: version: let component = all-cabal-hashes-component name; in self.haskellSrc2nix {
     name   = "${name}-${version}";
-    sha256 = ''$(sed -e 's/.*"SHA256":"//' -e 's/".*$//' "${all-cabal-hashes}/${name}/${version}/${name}.json")'';
+    sha256 = ''$(sed -e 's/.*"SHA256":"//' -e 's/".*$//' "${component}/${name}/${version}/${name}.json")'';
-    src    = "${all-cabal-hashes}/${name}/${version}/${name}.cabal";
+    src    = "${component}/${name}/${version}/${name}.cabal";
   };
 
 in package-set { inherit pkgs stdenv callPackage; } self // {

pkgs/development/interpreters/erlang/R19.nix

@@ -1,9 +1,18 @@
-{ mkDerivation, fetchurl }:
+{ mkDerivation, fetchurl, fetchpatch }:
 
 mkDerivation rec {
   version = "19.3";
   sha256 = "0pp2hl8jf4iafpnsmf0q7jbm313daqzif6ajqcmjyl87m5pssr86";
 
+  patches = [
+    # macOS 10.13 crypto fix from OTP-20.1.2
+    (fetchpatch {
+      name = "darwin-crypto.patch";
+      url = "https://github.com/erlang/otp/commit/882c90f72ba4e298aa5a7796661c28053c540a96.patch";
+      sha256 = "1gggzpm8ssamz6975z7px0g8qq5i4jqw81j846ikg49c5cxvi0hi";
+    })
+  ];
+
   prePatch = ''
     substituteInPlace configure.in --replace '`sw_vers -productVersion`' '10.10'
   '';

pkgs/development/libraries/check/default.nix

@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   name = "check-${version}";
-  version = "0.10.0";
+  version = "0.11.0";
 
   src = fetchurl {
-    url = "mirror://sourceforge/check/${version}/check-${version}.tar.gz";
+    url = "https://github.com/libcheck/check/releases/download/${version}/check-${version}.tar.gz";
-    sha256 = "0lhhywf5nxl3dd0hdakra3aasl590756c9kmvyifb3vgm9k0gxgm";
+    sha256 = "05jn1pgb7hqb937xky2147nnq3r4qy5wwr79rddpax3bms5a9xr4";
   };
 
   # Test can randomly fail: http://hydra.nixos.org/build/7243912
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
          can be used within source code editors and IDEs.
       '';
 
-    homepage = http://check.sourceforge.net/;
+    homepage = https://libcheck.github.io/check/;
 
     license = licenses.lgpl2Plus;
     platforms = platforms.all;

pkgs/development/libraries/libmatroska/default.nix

@@ -1,11 +1,11 @@
 { stdenv, fetchurl, pkgconfig, libebml }:
 
 stdenv.mkDerivation rec {
-  name = "libmatroska-1.4.7";
+  name = "libmatroska-1.4.8";
 
   src = fetchurl {
-    url = "http://dl.matroska.org/downloads/libmatroska/${name}.tar.bz2";
+    url = "http://dl.matroska.org/downloads/libmatroska/${name}.tar.xz";
-    sha256 = "1yi5cnv13nhl27xyqayd5l3sf0j3swfj3apzibv71yg9pariwi26";
+    sha256 = "14n9sw974prr3yp4yjb7aadi6x2yz5a0hjw8fs3qigy5shh2piyq";
   };
 
   nativeBuildInputs = [ pkgconfig ];

pkgs/development/libraries/opencv/3.x.nix

@@ -14,8 +14,8 @@
 , enableGtk3      ? false, gtk3
 , enableFfmpeg    ? false, ffmpeg
 , enableGStreamer ? false, gst_all_1
-, enableEigen     ? false, eigen
+, enableEigen     ? true, eigen
-, enableOpenblas  ? false, openblas
+, enableOpenblas  ? true, openblas
 , enableCuda      ? false, cudatoolkit, gcc5
 , enableTesseract ? false, tesseract, leptonica
 , AVFoundation, Cocoa, QTKit

pkgs/development/libraries/opencv/default.nix

@@ -9,7 +9,7 @@
 , enableJPEG2K ? true, jasper
 , enableFfmpeg ? false, ffmpeg
 , enableGStreamer ? false, gst_all
-, enableEigen ? false, eigen
+, enableEigen ? true, eigen
 , darwin
 }:
 

pkgs/development/libraries/postgis/default.nix

@@ -109,4 +109,30 @@ in rec {
     '';
   });
 
+  v_2_4_0 = pgDerivationBaseNewer.merge ( fix : {
+    version = "2.4.0";
+    sha256 = "02baa90f04da41e04b6c18eedfda53110c45ae943d4e65050f6d202f7de07d29";
+    sql_srcs = ["postgis.sql" "spatial_ref_sys.sql"];
+    builtInputs = [gdal json_c pkgconfig];
+
+    # postgis config directory assumes /include /lib from the same root for json-c library
+    NIX_LDFLAGS = "-L${stdenv.lib.getLib json_c}/lib";
+
+    dontDisableStatic = true;
+    preConfigure = ''
+      sed -i 's@/usr/bin/file@${file}/bin/file@' configure
+      configureFlags="$configureFlags --with-gdalconfig=${gdal}/bin/gdal-config --with-jsondir=${json_c.dev}"
+    '';
+    postConfigure = ''
+      sed -i "s|@mkdir -p \$(DESTDIR)\$(PGSQL_BINDIR)||g ;
+              s|\$(DESTDIR)\$(PGSQL_BINDIR)|$prefix/bin|g
+              " \
+          "raster/loader/Makefile";
+      sed -i "s|\$(DESTDIR)\$(PGSQL_BINDIR)|$prefix/bin|g
+              " \
+          "raster/scripts/python/Makefile";
+    '';
+  });
+
+
 }

pkgs/development/libraries/qt-5/5.6/qtwebkit/qtwebkit-icu-59.patch

@@ -0,0 +1,86 @@
+From: Konstantin Tokarev <annulen@yandex.ru>
+Date: Thu, 4 May 2017 12:12:37 +0000 (+0300)
+Subject: Fix compilation with ICU 59
+X-Git-Url: https://codereview.qt-project.org/gitweb?p=qt%2Fqtwebkit.git;a=commitdiff_plain;h=bf172ae289a1348842005a9421797970f9b72060;hp=821eaaadc9d63d03aca65cf757230b520daaaa7c
+
+Fix compilation with ICU 59
+
+Upstream fix: https://bugs.webkit.org/show_bug.cgi?id=171612
+
+Task-number: QTBUG-60532
+Change-Id: I6014feea213aa70ebe40b09d9d1a03fd1ed3c843
+Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
+---
+
+diff --git a/Source/JavaScriptCore/API/JSStringRef.cpp b/Source/JavaScriptCore/API/JSStringRef.cpp
+index 812f3d4..77a3fd0 100644
+--- a/Source/JavaScriptCore/API/JSStringRef.cpp
++++ b/Source/JavaScriptCore/API/JSStringRef.cpp
+@@ -37,7 +37,7 @@ using namespace WTF::Unicode;
+ JSStringRef JSStringCreateWithCharacters(const JSChar* chars, size_t numChars)
+ {
+     initializeThreading();
+-    return OpaqueJSString::create(chars, numChars).leakRef();
++    return OpaqueJSString::create(reinterpret_cast<const UChar*>(chars), numChars).leakRef();
+ }
+ 
+ JSStringRef JSStringCreateWithUTF8CString(const char* string)
+@@ -62,7 +62,7 @@ JSStringRef JSStringCreateWithUTF8CString(const char* string)
+ JSStringRef JSStringCreateWithCharactersNoCopy(const JSChar* chars, size_t numChars)
+ {
+     initializeThreading();
+-    return OpaqueJSString::create(StringImpl::createWithoutCopying(chars, numChars, WTF::DoesNotHaveTerminatingNullCharacter)).leakRef();
++    return OpaqueJSString::create(StringImpl::createWithoutCopying(reinterpret_cast<const UChar*>(chars), numChars, WTF::DoesNotHaveTerminatingNullCharacter)).leakRef();
+ }
+ 
+ JSStringRef JSStringRetain(JSStringRef string)
+@@ -83,7 +83,7 @@ size_t JSStringGetLength(JSStringRef string)
+ 
+ const JSChar* JSStringGetCharactersPtr(JSStringRef string)
+ {
+-    return string->characters();
++    return reinterpret_cast<const JSChar*>(string->characters());
+ }
+ 
+ size_t JSStringGetMaximumUTF8CStringSize(JSStringRef string)
+diff --git a/Source/JavaScriptCore/runtime/DateConversion.cpp b/Source/JavaScriptCore/runtime/DateConversion.cpp
+index 0b57f01..05e2733 100644
+--- a/Source/JavaScriptCore/runtime/DateConversion.cpp
++++ b/Source/JavaScriptCore/runtime/DateConversion.cpp
+@@ -107,7 +107,8 @@ String formatDateTime(const GregorianDateTime& t, DateTimeFormat format, bool as
+ #if OS(WINDOWS)
+             TIME_ZONE_INFORMATION timeZoneInformation;
+             GetTimeZoneInformation(&timeZoneInformation);
+-            const WCHAR* timeZoneName = t.isDST() ? timeZoneInformation.DaylightName : timeZoneInformation.StandardName;
++            const WCHAR* winTimeZoneName = t.isDST() ? timeZoneInformation.DaylightName : timeZoneInformation.StandardName;
++            String timeZoneName(reinterpret_cast<const UChar*>(winTimeZoneName));
+ #else
+             struct tm gtm = t;
+             char timeZoneName[70];
+diff --git a/Source/WTF/wtf/TypeTraits.h b/Source/WTF/wtf/TypeTraits.h
+index 9df2c95..f5d6121 100644
+--- a/Source/WTF/wtf/TypeTraits.h
++++ b/Source/WTF/wtf/TypeTraits.h
+@@ -72,6 +72,9 @@ namespace WTF {
+     template<> struct IsInteger<unsigned long>      { static const bool value = true; };
+     template<> struct IsInteger<long long>          { static const bool value = true; };
+     template<> struct IsInteger<unsigned long long> { static const bool value = true; };
++#if __cplusplus >= 201103L || defined(__GXX_EXPERIMENTAL_CXX0X__) || (defined(_HAS_CHAR16_T_LANGUAGE_SUPPORT) && _HAS_CHAR16_T_LANGUAGE_SUPPORT)
++    template<> struct IsInteger<char16_t>           { static const bool value = true; };
++#endif
+ #if !COMPILER(MSVC) || defined(_NATIVE_WCHAR_T_DEFINED)
+     template<> struct IsInteger<wchar_t>            { static const bool value = true; };
+ #endif
+diff --git a/Source/WebKit2/Shared/API/c/WKString.cpp b/Source/WebKit2/Shared/API/c/WKString.cpp
+index cbac67d..23400a6 100644
+--- a/Source/WebKit2/Shared/API/c/WKString.cpp
++++ b/Source/WebKit2/Shared/API/c/WKString.cpp
+@@ -55,7 +55,7 @@ size_t WKStringGetLength(WKStringRef stringRef)
+ size_t WKStringGetCharacters(WKStringRef stringRef, WKChar* buffer, size_t bufferLength)
+ {
+     COMPILE_ASSERT(sizeof(WKChar) == sizeof(UChar), WKStringGetCharacters_sizeof_WKChar_matches_UChar);
+-    return (toImpl(stringRef)->getCharacters(static_cast<UChar*>(buffer), bufferLength));
++    return (toImpl(stringRef)->getCharacters(reinterpret_cast<UChar*>(buffer), bufferLength));
+ }
+ 
+ size_t WKStringGetMaximumUTF8CStringSize(WKStringRef stringRef)

pkgs/development/libraries/qt-5/5.6/qtwebkit/series

@@ -1,3 +1,4 @@
 qtwebkit-dlopen-gtk.patch
 qtwebkit-dlopen-udev.patch
 qtwebkit-icucore-darwin.patch
+qtwebkit-icu-59.patch

pkgs/development/ocaml-modules/ansiterminal/default.nix

@@ -1,12 +1,14 @@
 { stdenv, fetchurl, ocaml, findlib, ocamlbuild }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
 
-  name = "ansiterminal-0.6.5";
+  version = "0.7";
+
+  name = "ocaml${ocaml.version}-ansiterminal-${version}";
 
   src = fetchurl {
-    url = "https://forge.ocamlcore.org/frs/download.php/1206/ANSITerminal-0.6.5.tar.gz";
+    url = "https://github.com/Chris00/ANSITerminal/releases/download/${version}/ANSITerminal-${version}.tar.gz";
-    sha256 = "1j9kflv2i16vf9hy031cl6z8hv6791mjbhnd9bw07y1pswdlx1r6";
+    sha256 = "03pqfxvw9pa9720l8i5fgxky1qx70kw6wxbczd5i50xi668lh0i9";
   };
 
   buildInputs = [ ocaml findlib ocamlbuild ];
@@ -20,7 +22,7 @@ stdenv.mkDerivation {
   createFindlibDestdir = true;
 
   meta = with stdenv.lib; {
-    homepage = https://forge.ocamlcore.org/projects/ansiterminal;
+    homepage = "https://github.com/Chris00/ANSITerminal";
     description = "A module allowing to use the colors and cursor movements on ANSI terminals";
     longDescription = ''
       ANSITerminal is a module allowing to use the colors and cursor

pkgs/development/ocaml-modules/javalib/default.nix

@@ -10,11 +10,11 @@ let
 in
 stdenv.mkDerivation rec {
   name = "ocaml${ocaml.version}-${pname}-${version}";
-  version = "2.3.3";
+  version = "2.3.4";
 
   src = fetchurl {
-    url = https://gforge.inria.fr/frs/download.php/file/36307/javalib-2.3.3.tar.bz2;
+    url = "https://gforge.inria.fr/frs/download.php/file/37153/javalib-2.3.4.tar.bz2";
-    sha256 = "0427n3vfb2h51gy2p4878gdwlp0mb03asn3g9kp9v4wfxmksjj11";
+    sha256 = "081ga3qzx0lkz0wy92qyj6k75k3s79518bvqii2q778hh5wif36f";
   };
 
   buildInputs = [ which ocaml findlib camlp4 ];

pkgs/development/ocaml-modules/qtest/default.nix

@@ -4,13 +4,13 @@ if !stdenv.lib.versionAtLeast ocaml.version "4"
 then throw "qtest is not available for OCaml ${ocaml.version}"
 else
 
-let version = "2.6"; in
+let version = "2.7"; in
 
 stdenv.mkDerivation {
-  name = "ocaml-qtest-${version}";
+  name = "ocaml${ocaml.version}-qtest-${version}";
   src = fetchzip {
     url = "https://github.com/vincent-hugot/iTeML/archive/v${version}.tar.gz";
-    sha256 = "1v5c1n5p8rhnisn606fs05q8764lqwgw08w66y5dm8wgmxgmsb3k";
+    sha256 = "0z72m2drp67qchvsxx4sg2qjrrq8hp6p9kzdx16ibx58pvpw1sh2";
   };
 
   buildInputs = [ ocaml findlib ocamlbuild ];

pkgs/development/ocaml-modules/uuidm/default.nix

@@ -1,20 +1,18 @@
-{ stdenv, fetchurl, ocaml, findlib, ocamlbuild }:
+{ stdenv, fetchurl, ocaml, findlib, ocamlbuild, topkg, opam, cmdliner }:
 
 stdenv.mkDerivation rec {
-  version = "0.9.5";
+  version = "0.9.6";
   name = "uuidm-${version}"; 
   src = fetchurl {
     url = "http://erratique.ch/software/uuidm/releases/uuidm-${version}.tbz";
-    sha256 = "03bgxs119bphv9ggg97nsl5m61s43ixgby05hhggv16iadx9zndm";
+    sha256 = "0hz4fdx0x16k0pw9995vkz5d1hmzz6b16wck9li399rcbfnv5jlc";
   };
 
   unpackCmd = "tar -xf $curSrc";
 
-  buildInputs = [ ocaml findlib ocamlbuild ];
+  buildInputs = [ ocaml findlib ocamlbuild topkg opam cmdliner ];
 
-  configurePhase = "ocaml setup.ml -configure --prefix $prefix";
+  inherit (topkg) buildPhase installPhase;
-  buildPhase = "ocaml setup.ml -build";
-  installPhase = "ocaml setup.ml -install";
 
   createFindlibDestdir = true;
 

pkgs/development/python-modules/MechanicalSoup/default.nix

@@ -0,0 +1,23 @@
+{ fetchPypi, buildPythonPackage, lib
+, requests, beautifulsoup4, six }:
+
+
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "MechanicalSoup";
+  version = "0.7.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0wh93rml446ipx603n5z5i5bpan46pzliq6sw76d0ms9w7w2658d";
+  };
+
+  propagatedBuildInputs = [ requests beautifulsoup4 six ];
+
+  meta = with lib; {
+    description = "A Python library for automating interaction with websites";
+    homepage = https://github.com/hickford/MechanicalSoup;
+    license = licenses.mit;
+    maintainers = [ maintainers.jgillich ];
+  };
+}

pkgs/development/python-modules/jsmin/default.nix

@@ -0,0 +1,18 @@
+{ stdenv, lib, buildPythonPackage, fetchPypi }:
+
+buildPythonPackage rec {
+  pname = "jsmin";
+  version = "2.2.2";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0fsmqbjvpxvff0984x7c0y8xmf49ax9mncz48b9xjx8wrnr9kpxn";
+  };
+
+  meta = with lib; {
+    description = "JavaScript minifier";
+    homepage = "https://github.com/tikitu/jsmin/";
+    license = licenses.mit;
+  };
+}

pkgs/development/python-modules/keras/default.nix

@@ -1,13 +1,6 @@
-{ stdenv
+{ stdenv, lib, buildPythonPackage, fetchPypi
-, buildPythonPackage
+, pytest, pytestcov, pytestpep8, pytest_xdist
-, fetchPypi
+, six, numpy, scipy, pyyaml
-, pytest
-, pytestcov
-, pytestpep8
-, pytest_xdist
-, six
-, Theano
-, pyyaml
 }:
 
 buildPythonPackage rec {
@@ -28,7 +21,7 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
-    six Theano pyyaml
+    six pyyaml numpy scipy
   ];
 
   # Couldn't get tests working

pkgs/development/python-modules/libnacl/default.nix

@@ -1,13 +1,15 @@
-{ stdenv, buildPythonPackage, fetchPypi, pytest, libsodium }:
+{ stdenv, buildPythonPackage, fetchFromGitHub, pytest, libsodium }:
 
 buildPythonPackage rec {
   pname = "libnacl";
-  version = "1.5.2";
+  version = "1.6.0";
   name = "${pname}-${version}";
 
-  src = fetchPypi {
+  src = fetchFromGitHub {
-    inherit pname version;
+    owner = "saltstack";
-    sha256 = "c58390b0d191db948fc9ab681f07fdfce2a573cd012356bada47d56795d00ee2";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0iaql3mrj3hf48km8177bi6nmjdar26kmqjc3jw8mrjc940v99fk";
   };
 
   buildInputs = [ pytest ];

pkgs/development/python-modules/plyfile/default.nix

@@ -0,0 +1,22 @@
+{ lib, fetchPypi, buildPythonPackage, numpy
+}:
+
+buildPythonPackage rec {
+  pname = "plyfile";
+  version = "0.5";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1cspvhfy2nw1rfwpvrd69wkz0b6clr4wzqpwpmdk872vk2q89yzi";
+  };
+
+  propagatedBuildInputs = [ numpy ];
+
+  meta = with lib; {
+    description = "NumPy-based text/binary PLY file reader/writer for Python";
+    homepage    = "https://github.com/dranjan/python-plyfile";
+    maintainers = with maintainers; [ abbradar ];
+  };
+
+}

pkgs/development/python-modules/yowsup/argparse-dependency.patch

@@ -0,0 +1,13 @@
+diff --git a/setup.py b/setup.py
+index 053ed07..60f0d9a 100755
+--- a/setup.py
++++ b/setup.py
+@@ -5,7 +5,7 @@ import yowsup
+ import platform
+ import sys
+ 
+-deps = ['python-dateutil', 'argparse', 'python-axolotl>=0.1.39', 'six']
++deps = ['python-dateutil', 'python-axolotl>=0.1.39', 'six']
+ 
+ if sys.version_info < (2,7):
+     deps += ['importlib']

pkgs/development/python-modules/yowsup/default.nix

@@ -0,0 +1,30 @@
+{ buildPythonPackage, stdenv, fetchFromGitHub, six, python-axolotl, pytest }:
+
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "yowsup";
+  version = "2.5.2";
+
+  src = fetchFromGitHub {
+    owner = "tgalal";
+    repo = "yowsup";
+    rev = "v${version}";
+    sha256 = "16l8jmr32wwvl11m0a4r4id3dkfqj2n7dn6gky1077xwmj2da4fl";
+  };
+
+  checkInputs = [ pytest ];
+  checkPhase = ''
+    HOME=$(mktemp -d) py.test yowsup
+  '';
+
+  patches = [ ./argparse-dependency.patch ];
+
+  propagatedBuildInputs = [ six python-axolotl ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/tgalal/yowsup";
+    description = "The python WhatsApp library";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ ma27 ];
+  };
+}

pkgs/development/tools/analysis/flow/default.nix

@@ -3,14 +3,14 @@
 with lib;
 
 stdenv.mkDerivation rec {
-  version = "0.57.0";
+  version = "0.57.2";
   name = "flow-${version}";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "flow";
     rev = "v${version}";
-    sha256 = "1y2znwiwc3zkwz17a2m0m28dpknw7hpjd7ih4h7zf6p8nnqd3k6d";
+    sha256 = "04fqnan9m69rjwvm97p0br1wd862ldiybp0v2nqlm6giaaa691r0";
   };
 
   installPhase = ''

pkgs/development/tools/build-managers/meson/default.nix

@@ -18,7 +18,11 @@ python3Packages.buildPythonApplication rec {
     popd
   '';
 
-  setupHook = ./setup-hook.sh;
+  postPatch = ''
+    sed -i -e 's|e.fix_rpath(install_rpath)||' mesonbuild/scripts/meson_install.py
+  '';
+
+  setupHook = ./setup-hook.sh;    
 
   meta = with lib; {
     homepage = http://mesonbuild.com;

pkgs/development/tools/continuous-integration/jenkins/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "jenkins-${version}";
-  version = "2.77";
+  version = "2.84";
 
   src = fetchurl {
     url = "http://mirrors.jenkins-ci.org/war/${version}/jenkins.war";
-    sha256 = "1hmj5f14qpq58018q2jmdd4j36v2idsbb9caiakxfy08gppzhz00";
+    sha256 = "0pwmviaps4gbv9a3sdn17kqdv9jmh5fpbms1wm95jfj77m5dyyq6";
   };
 
   buildCommand = ''

pkgs/development/tools/database/sqldeveloper/default.nix

@@ -1,12 +1,39 @@
 { stdenv, makeWrapper, requireFile, unzip, openjdk }:
 
 stdenv.mkDerivation rec {
-  name = "sqldeveloper-4.1.1.19.59";
+  version = "17.3.0.271.2323";
+  name = "sqldeveloper-${version}";
 
-  src = requireFile {
+  src = requireFile rec {
-    name = "${name}-no-jre.zip";
+    name = "sqldeveloper-${version}-no-jre.zip";
     url = "http://www.oracle.com/technetwork/developer-tools/sql-developer/downloads/";
-    sha256 = "1dbbqlz11zps9w5qvzlcv5rdv43s25c3mbzf8il1px4m2j33y3rv";
+    message = ''
+      This Nix expression requires that ${name} already be part of the store. To
+      obtain it you need to
+
+      - navigate to ${url}
+      - make sure that it says "Version ${version}" above the list of downloads 
+        - if it does not, click on the "Previous Version" link below the downloads
+          and repeat until the version is correct. This is necessarry because as the
+          time of this writing there exists no permanent link for the current version
+          yet.
+          Also consider updating this package yourself (you probably just need to
+          change the `version` variable and update the sha256 to the one of the
+          new file) or opening an issue at the nixpkgs repo.
+      - accept the license agreement
+      - download the file listed under "Other Platforms"
+      - sign in or create an oracle account if neccessary
+
+      and then add the file to the Nix store using either:
+
+        nix-store --add-fixed sha256 ${name}
+
+      or
+
+        nix-prefetch-url --type sha256 file:///path/to/${name}
+    '';
+    # obtained by `sha256sum sqldeveloper-${version}-no-jre.zip`
+    sha256 = "06ba5920544bacbea83425548b1b8f69ab3e9bb279076321aece2c0c6d415dad";
   };
 
   buildInputs = [ makeWrapper unzip ];

pkgs/development/tools/icestorm/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "icestorm-${version}";
-  version = "2017.08.31";
+  version = "2017.10.16";
 
   src = fetchFromGitHub {
     owner = "cliffordwolf";
     repo = "icestorm";
-    rev = "8354bc6086f11002cc58497f91f43200a09c13a9";
+    rev = "d9d2a3dcaa749014f5b9a539768b8368bb529b28";
-    sha256 = "0mg6sp5ymdxmkyzmssyavsjicw0z74bn4lv1jqwxjnmynw5l0f9b";
+    sha256 = "1a755jnbjq3v7a3l90qjlgihmrpbdfiiabb4g8sw3ay3qmvzwh6b";
   };
 
   buildInputs = [ python3 libftdi ];
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = http://www.clifford.at/icestorm/;
     license = stdenv.lib.licenses.isc;
-    maintainers = [ stdenv.lib.maintainers.shell ];
+    maintainers = with stdenv.lib.maintainers; [ shell thoughtpolice ];
     platforms = stdenv.lib.platforms.linux;
   };
 }

pkgs/development/tools/misc/sqitch/default.nix

@@ -11,7 +11,11 @@ stdenv.mkDerivation {
   installPhase = ''
     mkdir -p $out/bin
     for d in bin/sqitch etc lib share ; do
-      ln -s ${sqitchModule}/$d $out/$d
+      # make sure dest alreay exists before symlink
+      # this prevents installing a broken link into the path
+      if [ -e ${sqitchModule}/$d ]; then
+        ln -s ${sqitchModule}/$d $out/$d
+      fi
     done
   '';
   dontStrip = true;

pkgs/development/tools/ocaml/ocamlbuild/default.nix

@@ -1,5 +1,4 @@
-{stdenv, fetchFromGitHub, ocaml, findlib, buildOcaml, type_conv, camlp4,
+{ stdenv, fetchFromGitHub, ocaml, findlib }:
- ocamlmod, ocamlify, ounit, expect}:
 let
   version = "0.11.0";
 in

pkgs/development/tools/ocaml/ocamlmod/default.nix

@@ -1,20 +1,24 @@
-{ stdenv, fetchurl, ocaml, findlib, ocamlbuild }:
+{ stdenv, fetchurl, ocaml, findlib, ocamlbuild, ounit }:
 
 stdenv.mkDerivation rec {
   name = "ocamlmod-${version}";
-  version = "0.0.8";
+  version = "0.0.9";
 
   src = fetchurl {
-    url = "http://forge.ocamlcore.org/frs/download.php/1544/${name}.tar.gz";
+    url = "https://forge.ocamlcore.org/frs/download.php/1702/ocamlmod-0.0.9.tar.gz";
-    sha256 = "1w0w8lfyymvk300dv13gvhrddpcyknvyp4g2yvq2vaw7khkhjs9g";
+    sha256 = "0cgp9qqrq7ayyhddrmqmq1affvfqcn722qiakjq4dkywvp67h4aa";
   };
 
-  buildInputs = [ ocaml findlib ocamlbuild ];
+  buildInputs = [ ocaml findlib ocamlbuild ounit ];
 
-  configurePhase = "ocaml setup.ml -configure --prefix $out";
+  configurePhase = "ocaml setup.ml -configure --prefix $out --enable-tests";
   buildPhase     = "ocaml setup.ml -build";
   installPhase   = "ocaml setup.ml -install";
 
+  doCheck = true;
+
+  checkPhase = "ocaml setup.ml -test";
+
   dontStrip = true;
 
   meta = {

pkgs/development/tools/pew/default.nix

@@ -0,0 +1,32 @@
+{ stdenv, python3Packages }:
+with python3Packages; buildPythonApplication rec {
+    name = "${pname}-${version}";
+    pname = "pew";
+    version = "1.1.0";
+
+    src = fetchPypi {
+      inherit pname version;
+      sha256 = "0b8z1vjsll1kgnh3mmdjps5rr9gayy091rapp2dra71jrwkx3yfh";
+    };
+
+    propagatedBuildInputs = [ virtualenv virtualenv-clone setuptools ];
+
+    postFixup = ''
+      set -euo pipefail
+      PEW_SITE="$out/lib/${python.libPrefix}/site-packages"
+      SETUPTOOLS="${setuptools}/lib/${python.libPrefix}/site-packages"
+      SETUPTOOLS_SITE=$SETUPTOOLS/$(cat $SETUPTOOLS/setuptools.pth)
+      CLONEVENV_SITE="${virtualenv-clone}/lib/${python.libPrefix}/site-packages"
+      SITE_PACKAGES="[\'$PEW_SITE\',\'$SETUPTOOLS_SITE\',\'$CLONEVENV_SITE\']"
+      substituteInPlace $PEW_SITE/pew/pew.py \
+        --replace "from pew.pew" "import sys; sys.path.extend($SITE_PACKAGES); from pew.pew" \
+        --replace 'sys.executable, "-m", "virtualenv"' "'${virtualenv}/bin/virtualenv'"
+    '';
+
+    meta = with stdenv.lib; {
+      description = "Tools to manage multiple virtualenvs written in pure python";
+      license = licenses.mit;
+      platforms = platforms.all;
+      maintainers = with maintainers; [ berdario ];
+    };
+  }

pkgs/development/tools/pipenv/default.nix

@@ -0,0 +1,24 @@
+{ stdenv, python3Packages, pew }:
+with python3Packages; buildPythonApplication rec {
+    name = "${pname}-${version}";
+    pname = "pipenv";
+    version = "8.2.7";
+
+    src = fetchPypi {
+      inherit pname version;
+      sha256 = "08wkxs6qqgzxamym523bjv7zahg8p9v18x0yi9vwclij5k91iyzm";
+    };
+
+    LC_ALL = "en_US.UTF-8";
+
+    propagatedBuildInputs = [ pew pip requests flake8 ];
+
+    doCheck = false;
+
+    meta = with stdenv.lib; {
+      description = "Python Development Workflow for Humans";
+      license = licenses.mit;
+      platforms = platforms.all;
+      maintainers = with maintainers; [ berdario ];
+    };
+  }

pkgs/development/web/nodejs/v8.nix

@@ -10,11 +10,11 @@ let
   baseName = if enableNpm then "nodejs" else "nodejs-slim";
 in
   stdenv.mkDerivation (nodejs // rec {
-    version = "8.6.0";
+    version = "8.7.0";
     name = "${baseName}-${version}";
     src = fetchurl {
       url = "https://nodejs.org/download/release/v${version}/node-v${version}.tar.xz";
-      sha256 = "14vy9xnyfz44j460hkrx423g7acpzzyqlxiv6sgmna9qj8872w5i";
+      sha256 = "16mml3cwjnq7yf9yd67d2dybav3nvbnk89fkixs1wz7fd26d05ss";
     };
 
     patches = stdenv.lib.optionals stdenv.isDarwin [ ./no-xcode-v7.patch ];

pkgs/misc/drivers/epson-escpr/default.nix

@@ -1,46 +1,41 @@
 { stdenv, fetchurl, cups }:
 
-let
+stdenv.mkDerivation rec {
-  version = "1.6.12";
+  name = "epson-escpr-${version}";
-in
+  version = "1.6.16";
-  stdenv.mkDerivation {
 
-    name = "epson-escpr-${version}";
+  src = fetchurl {
-  
+    url = "https://download3.ebz.epson.net/dsc/f/03/00/06/41/54/29588ed107f800e5bc3f91706661567efb369c1c/epson-inkjet-printer-escpr-1.6.16-1lsb3.2.tar.gz";
-    src = fetchurl {
+    sha256 = "0v9mcih3dg3ws18hdcgm014k97hv6imga39hy2a84gnc6badp6n6";
+  };
 
-      url = "https://download3.ebz.epson.net/dsc/f/03/00/05/46/21/01534966894f35247dac8c8ef0a0a9c94d1c8b40/epson-inkjet-printer-escpr-1.6.12-1lsb3.2.tar.gz";
+  patches = [ ./cups-filter-ppd-dirs.patch ];
-      sha256 = "3773e74a0c4debf202eb9ad0aa31c6614a93d6170484ff660c14e99f8698cfda";
-    }; 
 
-    patches = [ ./cups-filter-ppd-dirs.patch ]; 
+  buildInputs = [ cups ];
 
-    buildInputs = [ cups ];
+  meta = with stdenv.lib; {
+    homepage = "http://download.ebz.epson.net/dsc/search/01/search/";
+    description = "ESC/P-R Driver (generic driver)";
+    longDescription = ''
+      Epson Inkjet Printer Driver (ESC/P-R) for Linux and the
+      corresponding PPD files. The list of supported printers
+      can be found at http://www.openprinting.org/driver/epson-escpr/ .
 
-    meta = with stdenv.lib; {
+      To use the driver adjust your configuration.nix file:
-      homepage = http://download.ebz.epson.net/dsc/search/01/search/;
+        services.printing = {
-      description = "ESC/P-R Driver (generic driver)";
+          enable = true;
-      longDescription = ''
+          drivers = [ pkgs.epson-escpr ];
-        Epson Inkjet Printer Driver (ESC/P-R) for Linux and the
+        };
-	corresponding PPD files. The list of supported printers
-	can be found at http://www.openprinting.org/driver/epson-escpr/ .
 
-	To use the driver adjust your configuration.nix file:
+      To setup a wireless printer, enable Avahi which provides
-	  services.printing = {
+      printer's hostname to CUPS and nss-mdns to make this
-	    enable = true;
+      hostname resolvable:
-	    drivers = [ pkgs.epson-escpr ];
+        services.avahi = {
-	  };
+          enable = true;
-
+          nssmdns = true;
-  To setup a wireless printer, enable Avahi which provides
+        };'';
-  printer's hostname to CUPS and nss-mdns to make this
+    license = licenses.gpl3Plus;
-  hostname resolvable:
+    maintainers = with maintainers; [ artuuge ];
-    services.avahi = {
+    platforms = platforms.linux;
-      enable = true;
+  };
-      nssmdns = true;
+}
-    };'';
-      license = licenses.gpl3Plus;
-      maintainers = with maintainers; [ artuuge ];
-      platforms = platforms.linux;
-    };
-
-  }

pkgs/misc/emulators/cdemu/base.nix

@@ -32,5 +32,6 @@ in stdenv.mkDerivation ({
     homepage = http://cdemu.sourceforge.net/;
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
+    maintainers = with stdenv.lib.maintainers; [ bendlas ];
   };
 } // drvParams)

pkgs/misc/emulators/cdemu/vhba.nix

@@ -18,5 +18,6 @@ stdenv.mkDerivation rec {
     homepage = http://cdemu.sourceforge.net/about/vhba/;
     platforms = platforms.linux;
     licenses = licenses.gpl2Plus;
+    maintainers = with stdenv.lib.maintainers; [ bendlas ];
   };
 }

pkgs/misc/emulators/wine/base.nix

@@ -109,6 +109,6 @@ stdenv.mkDerivation ((lib.optionalAttrs (! isNull buildScript) {
     homepage = http://www.winehq.org/;
     license = "LGPL";
     description = "An Open Source implementation of the Windows API on top of X, OpenGL, and Unix";
-    maintainers = with stdenv.lib.maintainers; [ avnik raskin ];
+    maintainers = with stdenv.lib.maintainers; [ avnik raskin bendlas ];
   };
 })

pkgs/os-specific/linux/hostapd/default.nix

@@ -23,6 +23,40 @@ stdenv.mkDerivation rec {
       url = "https://w1.fi/cgit/hostap/patch/?id=b70d508c50e8e2d2b8fb96ae44ae10f84cf0c1ae";
       sha256 = "0pslmsbay2cy1k07w1mdcr0b8w059jkrqrr9zi1aljvkm3vbwhj1";
     })
+
+    #KRACKAttack.com
+    (fetchurl {
+      url = "http://w1.fi/security/2017-1/rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch";
+      sha256 = "02zl2x4pxay666yq18g4f3byccrzipfjbky1ydw62v15h76174aj";
+    })
+    (fetchurl {
+      url = "http://w1.fi/security/2017-1/rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch";
+      sha256 = "1mrmqg00x1bqa43dyhxb14msk74lh3kvr4avni43c3qpfjmlfvfq";
+    })
+    (fetchurl {
+      url = "http://w1.fi/security/2017-1/rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch";
+      sha256 = "10byyi8wfpcc8i788ag7ndycd3xvq2iwnssyb3rwf34sfcv5wlyl";
+    })
+    (fetchurl {
+      url = "http://w1.fi/security/2017-1/rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch";
+      sha256 = "02z2rsbh4sw81wsc56xjbblbi76ii0clmpnr1m1szdb1h5s58fkr";
+    })
+    (fetchurl {
+      url = "http://w1.fi/security/2017-1/rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch";
+      sha256 = "17pbrn5h6l5v14y6gn2yr2knqya9i0n2vyq4ck8hasb00yz8lz0l";
+    })
+    (fetchurl {
+      url = "http://w1.fi/security/2017-1/rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch";
+      sha256 = "19mgcqbdyzm4myi182jcn1rn26xi3jib74cpxbbrx1gaccxlsvar";
+    })
+    #(fetchurl { # wpa-supplicant only
+    #  url = "http://w1.fi/security/2017-1/rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch";
+    #  sha256 = "0di71j8762dkvr0c7h5mrbkqyfdy8mljvnp0dk2qhbgc9bw7m8f5";
+    #})
+    (fetchurl {
+      url = "http://w1.fi/security/2017-1/rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch";
+      sha256 = "1ca312cixbld70rp12q7h66lnjjxzz0qag0ii2sg6cllgf2hv168";
+    })
   ];
 
   nativeBuildInputs = [ pkgconfig ];

pkgs/os-specific/linux/kernel/linux-4.13.nix

@@ -1,11 +1,11 @@
 { stdenv, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.13.6";
+  version = "4.13.7";
   extraMeta.branch = "4.13";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0l30vlxmp49mm743cydkvr3wfw4nmh0q71avasnksd8xmv71km27";
+    sha256 = "16vjjl3qw0a8ci6xbnywhb8bpr3ccbs0i6xa54lc094cd5gvx4v3";
   };
 } // (args.argsOverride or {}))

pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix

@@ -3,9 +3,9 @@
 with stdenv.lib;
 
 let
-  version = "4.13.6";
+  version = "4.13.7";
   revision = "a";
-  sha256 = "1xmnnwwlnc7s5zf08rzb4zqd52iysz81y9iqdn7rdqr3c8j7pdv9";
+  sha256 = "1ddhjj77pslivy6ngkqn020z08n5nvq8p261hz14sgp8h69v30is";
 
   # modVersion needs to be x.y.z, will automatically add .0 if needed
   modVersion = concatStrings (intersperse "." (take 3 (splitString "." "${version}.0")));

pkgs/os-specific/linux/kernel/linux-testing.nix

@@ -1,13 +1,13 @@
 { stdenv, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.14-rc4";
+  version = "4.14-rc5";
-  modDirVersion = "4.14.0-rc4";
+  modDirVersion = "4.14.0-rc5";
   extraMeta.branch = "4.14";
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "1n9jni7sdawhjnlpl1g3rw89ggfi8d6s088wv1h21cnmsav911ik";
+    sha256 = "1y383vw79jhpr15s919xwzxif2y8zbiwa64sg2aan075xfhzijp8";
   };
 
   # Should the testing kernels ever be built on Hydra?

pkgs/os-specific/linux/wireguard/default.nix

@@ -6,11 +6,11 @@ assert kernel != null -> stdenv.lib.versionAtLeast kernel.version "3.10";
 let
   name = "wireguard-${version}";
 
-  version = "0.0.20171005";
+  version = "0.0.20171011";
 
   src = fetchurl {
     url    = "https://git.zx2c4.com/WireGuard/snapshot/WireGuard-${version}.tar.xz";
-    sha256 = "026n0a7fln5w8s7lsxdn4fgzqxdwhqnnnfhczn36j3sipdy3nal3";
+    sha256 = "15hby5fi85r7h7adr8kva26w9b2sz3147d7nl2y0fdblb3v4zr72";
   };
 
   meta = with stdenv.lib; {

pkgs/os-specific/linux/wpa_supplicant/default.nix

@@ -80,6 +80,39 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./build-fix.patch
+    #KRACKAttack.com
+    (fetchurl {
+      url = "http://w1.fi/security/2017-1/rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch";
+      sha256 = "02zl2x4pxay666yq18g4f3byccrzipfjbky1ydw62v15h76174aj";
+    })
+    (fetchurl {
+      url = "http://w1.fi/security/2017-1/rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch";
+      sha256 = "1mrmqg00x1bqa43dyhxb14msk74lh3kvr4avni43c3qpfjmlfvfq";
+    })
+    (fetchurl {
+      url = "http://w1.fi/security/2017-1/rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch";
+      sha256 = "10byyi8wfpcc8i788ag7ndycd3xvq2iwnssyb3rwf34sfcv5wlyl";
+    })
+    (fetchurl {
+      url = "http://w1.fi/security/2017-1/rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch";
+      sha256 = "02z2rsbh4sw81wsc56xjbblbi76ii0clmpnr1m1szdb1h5s58fkr";
+    })
+    (fetchurl {
+      url = "http://w1.fi/security/2017-1/rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch";
+      sha256 = "17pbrn5h6l5v14y6gn2yr2knqya9i0n2vyq4ck8hasb00yz8lz0l";
+    })
+    (fetchurl {
+      url = "http://w1.fi/security/2017-1/rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch";
+      sha256 = "19mgcqbdyzm4myi182jcn1rn26xi3jib74cpxbbrx1gaccxlsvar";
+    })
+    (fetchurl { # wpa-supplicant only
+      url = "http://w1.fi/security/2017-1/rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch";
+      sha256 = "0di71j8762dkvr0c7h5mrbkqyfdy8mljvnp0dk2qhbgc9bw7m8f5";
+    })
+    (fetchurl {
+      url = "http://w1.fi/security/2017-1/rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch";
+      sha256 = "1ca312cixbld70rp12q7h66lnjjxzz0qag0ii2sg6cllgf2hv168";
+    })
   ];
 
   postInstall = ''

pkgs/servers/http/nginx/mainline.nix

@@ -1,6 +1,6 @@
 { callPackage, ... }@args:
 
 callPackage ./generic.nix (args // {
-  version = "1.13.5";
+  version = "1.13.6";
-  sha256 = "0blzna6h76xd7ddz37yb7yqg4yx7gpwsz8zbg8vlbxxk552bjx8f";
+  sha256 = "1y7qcdpjskjc1iwwrjqsbgm74jpnf873pwv17clsy83ak1pzq4l5";
 })

pkgs/servers/sql/postgresql/plv8/default.nix

@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   name = "plv8-${version}";
-  version = "2.0.3";
+  version = "2.1.0";
 
   nativeBuildInputs = [ perl ];
   buildInputs = [ v8 postgresql ];
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     owner = "plv8";
     repo = "plv8";
     rev = "v${version}";
-    sha256 = "0cn7ynckmdb08dkzjilvc55xz61d1jiya7yrnphizw404j84y3qc";
+    sha256 = "1sfpxz0zcbinn6822j12lkwgrw9kfacrs83ic968rm489rl9w241";
   };
 
   preConfigure = ''

pkgs/servers/unifi/default.nix

@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   name = "unifi-controller-${version}";
-  version = "5.6.16";
+  version = "5.6.18";
 
   src = fetchurl {
-    url = "https://www.ubnt.com/downloads/unifi/${version}-86cdeea491/unifi_sysvinit_all.deb";
+    url = "https://www.ubnt.com/downloads/unifi/${version}-8261dc5066/unifi_sysvinit_all.deb";
-    sha256 = "1kfrawf48q9rx48hcnmiqndbg84v340yfykh23af7xpcxmzl5jy7";
+    sha256 = "1xcnfmxwzij9qs9l71d3zkmq6q3ci80a8xbmfckb0gz08cvrw5k1";
   };
 
   buildInputs = [ dpkg ];

pkgs/servers/web-apps/piwik/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "piwik-${version}";
-  version = "3.1.1";
+  version = "3.2.0";
 
   src = fetchurl {
     url = "https://builds.piwik.org/${name}.tar.gz";
-    sha512 = "2mqzk12959j9xqb9cqz8np35zcs1313zjx9pikbjw9z9mfcqgv0ccvrnl2ymmwll333drr9qaxs54n0mkk66xbhz04nmzmib0kp9k8h";
+    sha512 = "21hss97mms5vavfzw41v2p3qsxx0ar8xa3dnr4d2fw2mps8jg3s5ng9i725lqrbl96q7855fh9ymabjsi1zr4q9nif2yap0izaakxib";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/servers/x11/xorg/overrides.nix

@@ -315,11 +315,11 @@ in
     installFlags = "sdkdir=\${out}/include/xorg";
   };
 
-  xf86inputlibinput = attrs: attrs // {
+  xf86inputlibinput = attrs: attrs // rec {
-    name = "xf86-input-libinput-0.25.1";
+    name = "xf86-input-libinput-0.26.0";
     src = args.fetchurl {
-      url = mirror://xorg/individual/driver/xf86-input-libinput-0.25.1.tar.bz2;
+      url = "mirror://xorg/individual/driver/${name}.tar.bz2";
-      sha256 = "1q67hjd67ni1nq7kgxdrrdgkyhzaqvvn2vlnsiiq9w4y3icpv7s8";
+      sha256 = "0yrqs88b7yn9nljwlxzn76jfmvf0sh939kzij5b2jvr2qa7mbjmb";
     };
     buildInputs = attrs.buildInputs ++ [ args.libinput ];
     installFlags = "sdkdir=\${out}/include/xorg";

pkgs/tools/misc/lbdb/add-methods-to-rc.patch

@@ -0,0 +1,11 @@
+--- a/lbdb.rc.in
++++ b/lbdb.rc.in
+@@ -40,7 +40,7 @@
+ # - m_vcf        search a vcard (according to RFC2426) file.
+ # - m_khard      search a CardDAV address book via khard
+ 
+-METHODS="m_inmail m_passwd m_finger"
++METHODS="@MODULES@"
+ 
+ 
+ #

pkgs/tools/misc/lbdb/default.nix

@@ -1,17 +1,39 @@
-{ stdenv, fetchurl, perl, finger_bsd }:
+{ stdenv, fetchurl, perl, perlPackages, finger_bsd, makeWrapper
+, abook ? null
+, gnupg ? null
+, goobook ? null
+, khard ? null
+}:
 
 let
-  version = "0.38";
+  version = "0.44";
 in
-
+with stdenv.lib;
+with perlPackages;
 stdenv.mkDerivation {
   name = "lbdb-${version}";
   src = fetchurl {
     url = "http://www.spinnaker.de/debian/lbdb_${version}.tar.gz";
-    sha256 = "1279ssfrh4cqrjzq5q47xbdlw5qx3aazxjshi86ljm4cw6xxvgar";
+    sha256 = "0kjz3n2ilrg6yrz8z40714ppdprgwhbgvzcsjzs822l6da4qxna3";
   };
 
-  buildInputs = [ perl ] ++ stdenv.lib.optional (!stdenv.isDarwin) finger_bsd;
+  buildInputs = [ goobook makeWrapper perl ConvertASN1 NetLDAP AuthenSASL ]
+    ++ optional (!stdenv.isDarwin) finger_bsd
+    ++ optional   (abook != null) abook
+    ++ optional   (gnupg != null) gnupg
+    ++ optional (goobook != null) goobook
+    ++ optional   (khard != null) khard;
+  configureFlags = [ ]
+    ++ optional   (abook != null) "--with-abook"
+    ++ optional   (gnupg != null) "--with-gpg"
+    ++ optional (goobook != null) "--with-goobook"
+    ++ optional   (khard != null) "--with-khard";
+
+  patches = [ ./add-methods-to-rc.patch ];
+  postFixup = "wrapProgram $out/lib/mutt_ldap_query --prefix PERL5LIB : "
+    + "${AuthenSASL}/${perl.libPrefix}"
+    + ":${ConvertASN1}/${perl.libPrefix}"
+    + ":${NetLDAP}/${perl.libPrefix}";
 
   meta = {
     homepage = http://www.spinnaker.de/lbdb/;

pkgs/tools/networking/fastd/default.nix

@@ -11,6 +11,11 @@ stdenv.mkDerivation rec {
     sha256 = "0c9v3igv3812b3jr7jk75a2np658yy00b3i4kpbpdjgvqzc1jrq8";
   };
 
+  postPatch = ''
+    substituteInPlace src/crypto/cipher/CMakeLists.txt \
+      --replace 'add_subdirectory(aes128_ctr)' ""
+  '';
+
   nativeBuildInputs = [ pkgconfig bison cmake ];
   buildInputs = [ libuecc libsodium libcap json_c ];
 

pkgs/tools/networking/httpie/default.nix

@@ -2,7 +2,6 @@
 
 pythonPackages.buildPythonApplication rec {
   name = "httpie-0.9.9";
-  namePrefix = "";
 
   src = fetchurl {
     url = "mirror://pypi/h/httpie/${name}.tar.gz";

pkgs/tools/system/at/default.nix

@@ -1,4 +1,7 @@
-{ fetchurl, stdenv, bison, flex, pam, sendmailPath ? "/run/wrappers/bin/sendmail" }:
+{ fetchurl, stdenv, bison, flex, pam
+, sendmailPath ? "/run/wrappers/bin/sendmail"
+, atWrapperPath ? "/run/wrappers/bin/at"
+}:
 
 stdenv.mkDerivation rec {
   name = "at-${version}";
@@ -30,6 +33,13 @@ stdenv.mkDerivation rec {
        --with-daemon_username=atd --with-daemon_groupname=atd
     '';
 
+  # Ensure that "batch" can invoke the setuid "at" wrapper, if it exists, or
+  # else we get permission errors (on NixOS). "batch" is a shell script, so
+  # when the kernel executes it it drops setuid perms.
+  postInstall = ''
+    sed -i "6i test -x ${atWrapperPath} && exec ${atWrapperPath} -qb now  # exec doesn't return" "$out/bin/batch"
+  '';
+
   meta = {
     description = ''The classical Unix `at' job scheduling command'';
     license = stdenv.lib.licenses.gpl2Plus;