Merge branch 'master' into staging

nixos/modules/programs/ssh.nix

@@ -148,11 +148,11 @@ in
           [
             {
               hostNames = [ "myhost" "myhost.mydomain.com" "10.10.1.4" ];
-              publicKeyFile = "./pubkeys/myhost_ssh_host_dsa_key.pub";
+              publicKeyFile = ./pubkeys/myhost_ssh_host_dsa_key.pub;
             }
             {
               hostNames = [ "myhost2" ];
-              publicKeyFile = "./pubkeys/myhost2_ssh_host_dsa_key.pub";
+              publicKeyFile = ./pubkeys/myhost2_ssh_host_dsa_key.pub;
             }
           ]
         '';

nixos/modules/services/monitoring/graphite.nix

@@ -22,8 +22,8 @@ let
   );
 
   graphiteApiConfig = pkgs.writeText "graphite-api.yaml" ''
-    time_zone: ${config.time.timeZone}
     search_index: ${dataDir}/index
+    ${optionalString (!isNull config.time.timeZone) ''time_zone: ${config.time.timeZone}''}
     ${optionalString (cfg.api.finders != []) ''finders:''}
     ${concatMapStringsSep "\n" (f: "  - " + f.moduleName) cfg.api.finders}
     ${optionalString (cfg.api.functions != []) ''functions:''}
@@ -536,7 +536,7 @@ in {
         environment = {
           PYTHONPATH = let
               aenv = pkgs.python.buildEnv.override {
-                extraLibs = [ cfg.api.package pkgs.cairo ] ++ cfg.api.finders;
+                extraLibs = [ cfg.api.package pkgs.cairo pkgs.pythonPackages.cffi ] ++ cfg.api.finders;
               };
             in "${aenv}/${pkgs.python.sitePackages}";
           GRAPHITE_API_CONFIG = graphiteApiConfig;

nixos/modules/services/networking/dnschain.nix

@@ -158,7 +158,7 @@ in
       serviceConfig = {
         User = "dnschain";
         Restart = "on-failure";
-        ExecStart = "${pkgs.dnschain}/bin/dnschain";
+        ExecStart = "${pkgs.nodePackages.dnschain}/bin/dnschain";
       };
 
       preStart = ''

nixos/modules/services/web-servers/apache-httpd/default.nix

@@ -676,6 +676,7 @@ in
       ''
         ; Needed for PHP's mail() function.
         sendmail_path = sendmail -t -i
+      '' + optionalString (!isNull config.time.timeZone) ''
 
         ; Apparently PHP doesn't use $TZ.
         date.timezone = "${config.time.timeZone}"

nixos/modules/services/web-servers/apache-httpd/wordpress.nix

@@ -13,6 +13,7 @@ let
     define('DB_HOST',     '${config.dbHost}');
     define('DB_CHARSET',  'utf8');
     $table_prefix  = '${config.tablePrefix}';
+    define('AUTOMATIC_UPDATER_DISABLED', true);
     ${config.extraConfig}
     if ( !defined('ABSPATH') )
     	define('ABSPATH', dirname(__FILE__) . '/');

nixos/tests/graphite.nix

@@ -4,22 +4,28 @@ import ./make-test.nix ({ pkgs, ...} :
   nodes = {
     one =
       { config, pkgs, ... }: {
+        time.timeZone = "UTC";
         services.graphite = {
-          web = {
+          web.enable = true;
+          api = {
             enable = true;
+            port = 8082;
           };
-          carbon = {
+          carbon.enableCache = true;
-            enableCache = true;
+          seyren.enable = true;
-          };
+          pager.enable = true;
         };
       };
-    };
+  };
 
   testScript = ''
     startAll;
     $one->waitForUnit("default.target");
     $one->requireActiveUnit("graphiteWeb.service");
+    $one->requireActiveUnit("graphiteApi.service");
+    $one->requireActiveUnit("graphitePager.service");
     $one->requireActiveUnit("carbonCache.service");
+    $one->requireActiveUnit("seyren.service");
     $one->succeed("echo \"foo 1 `date +%s`\" | nc -q0 localhost 2003");
     $one->waitUntilSucceeds("curl 'http://localhost:8080/metrics/find/?query=foo&format=treejson' --silent | grep foo")
   '';

pkgs/applications/altcoins/bitcoin-unlimited.nix

@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     owner = "bitcoinunlimited";
     repo = "bitcoinunlimited";
     rev = "v${version}";
-    sha256 = "0rhk6xvzvzyfppg0pgq72nqgm2rmkiw0nhg3rwnzcvvj90nrz3da";
+    sha256 = "17cmyns1908s2rqs0zwr05f3541nqm2pg08n2xn97g2k3yimdg5q";
   };
 
   nativeBuildInputs = [ pkgconfig autoreconfHook ];

pkgs/applications/graphics/hugin/default.nix

@@ -5,11 +5,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "hugin-2016.2.0";
+  name = "hugin-2017.0.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/hugin/${name}.tar.bz2";
-    sha256 = "058zd63vx29yrx2pphbbll7kzcxkai22q26lpw13rn4lvp41pasl";
+    sha256 = "02a6rlwp20jdn5jdsyg3c7liljr10c3jfdkxiv9mkf9jgyi6wr46";
   };
 
   buildInputs = [

pkgs/applications/misc/cli-visualizer/default.nix

@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, fftw, ncurses5, libpulseaudio, makeWrapper }:
 
 stdenv.mkDerivation rec {
-  version = "1.5";
+  version = "1.6";
   name = "cli-visualizer-${version}";
 
   src = fetchFromGitHub {
     owner = "dpayne";
     repo = "cli-visualizer";
     rev = version;
-    sha256 = "18qv4ya64qmczq94dnynrnzn7pwhmzbn14r05qcvbbwv7r8gclzs";
+    sha256 = "0mirp8bk398di5xyq95iprmdyvplfghxqmrfj7jdnpy554vx7ppc";
   };
 
   postPatch = ''

pkgs/applications/misc/hstr/default.nix

@@ -1,7 +1,7 @@
 { stdenv, fetchurl, readline, ncurses }:
 
 let
-  version = "1.22";
+  version = "1.23";
 in
 stdenv.mkDerivation rec {
 
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://github.com/dvorka/hstr/releases/download/${version}/hh-${version}-src.tgz";
-    sha256 = "09rh510x8qc5jbpnfzazbv9wc3bqmf5asydcl2wijpqm5bi21iqp";
+    sha256 = "1hnira256p7sdilx34mnkji7gi2jcl98zz4izqxsqmnzj8ghhzkv";
   };
 
   buildInputs = [ readline ncurses ];

pkgs/applications/misc/khal/default.nix

@@ -5,11 +5,11 @@ with python3Packages;
 buildPythonApplication rec {
   name = "${pname}-${version}";
   pname = "khal";
-  version = "0.9.7";
+  version = "0.9.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0x1p62ff7ggb172rjr6sbdrjh1gl3ck3bwxsqlsix8i5wycwvnmv";
+    sha256 = "1blx3gxnv7sj302biqphfw7i6ilzl2xlmvzp130n3113scg9w17y";
   };
 
   LC_ALL = "en_US.UTF-8";

pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix

@@ -4,7 +4,7 @@
 
 let
 
-  version = "5.4.0.1";
+  version = "5.5.0.1";
 
   rpath = stdenv.lib.makeLibraryPath [
     alsaLib
@@ -54,7 +54,7 @@ let
     if stdenv.system == "x86_64-linux" then
       fetchurl {
         url = "https://repo.skype.com/deb/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb";
-        sha256 = "1idjgmn0kym7jml30xq6zrcp8qinx64kgnxlw8m0ys4z6zlw0c8z";
+        sha256 = "1r65qlsjwp0n0fmlhvbp71h03b3x73r26jk9f4q687sjqnzmkvcr";
       }
     else
       throw "Skype for linux is not supported on ${stdenv.system}";

pkgs/applications/office/beancount/bean-add.nix

@@ -1,13 +1,13 @@
 { stdenv, fetchFromGitHub, python3Packages }:
 
 stdenv.mkDerivation rec {
-  name = "bean-add-2017-09-13";
+  name = "bean-add-2017-10-31";
 
   src = fetchFromGitHub {
     owner = "simon-v";
     repo = "bean-add";
-    rev = "035f07a9e48a9dd23b49a27ba9c070ee9ddc4cc7";
+    rev = "9ac64272a17e76f8292bd94deb5aee45c14130d2";
-    sha256 = "0lj8940bn2h8541am4x0sfqpfk5xfnyfdnf3jpajfgx6wyjm2frg";
+    sha256 = "1vcwbbi2jsf87yq8f2hyf7nz9br1973sb20qjnsx5fxlmcpn47jh";
   };
 
   propagatedBuildInputs = with python3Packages; [ python ];

pkgs/applications/office/beancount/default.nix

@@ -1,13 +1,13 @@
 { stdenv, fetchhg, pkgs, pythonPackages }:
 
 pythonPackages.buildPythonApplication rec {
-  version = "2.0b15";
+  version = "2.0rc1";
   name = "beancount-${version}";
   namePrefix = "";
 
   src = pkgs.fetchurl {
     url = "mirror://pypi/b/beancount/${name}.tar.gz";
-    sha256 = "1dvnpgja4v4k5zagfsmdjavlib0z3r9r4z197yvj86szhzs0z86k";
+    sha256 = "12vlkck4q3dax9866krp6963c6d845b7inkkwrlkk4njh84n71wf";
   };
 
   buildInputs = with pythonPackages; [ nose ];

pkgs/applications/version-management/git-and-tools/git/default.nix

@@ -13,7 +13,7 @@
 }:
 
 let
-  version = "2.14.3";
+  version = "2.15.0";
   svn = subversionClient.override { perlBindings = true; };
 in
 
@@ -22,7 +22,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "078m0za5gyzcah5iaxdwx663yvdp8byvjc8rpzjzcrr4sl6rcc2k";
+    sha256 = "0siyxg1ppg6szjp8xp37zfq1fj97kbdxpigi3asmidqhkx41cw8h";
   };
 
   hardeningDisable = [ "format" ];

pkgs/applications/virtualization/xen/4.5.nix

@@ -32,13 +32,15 @@ let
     udev pciutils xorg.libX11 SDL pixman acl glusterfs spice_protocol usbredir
     alsaLib
   ];
+
+  xsa = import ./xsa-patches.nix { inherit fetchpatch; };
 in
 
 callPackage (import ./generic.nix (rec {
   version = "4.5.5";
 
   src = fetchurl {
-    url = "http://bits.xensource.com/oss-xen/release/${version}/xen-${version}.tar.gz";
+    url = "https://downloads.xenproject.org/release/xen/${version}/xen-${version}.tar.gz";
     sha256 = "1y74ms4yc3znf8jc3fgyq94va2y0pf7jh8m9pfqnpgklywqnw8g2";
   };
 
@@ -183,227 +185,52 @@ callPackage (import ./generic.nix (rec {
     ++ optional (withOVMF) "--with-system-ovmf=${OVMF.fd}/FV/OVMF.fd"
     ++ optional (withInternalOVMF) "--enable-ovmf";
 
-  patches =
+  patches = with xsa; flatten [
-    [ ./0001-libxl-Spice-image-compression-setting-support-for-up.patch
+    ./0001-libxl-Spice-image-compression-setting-support-for-up.patch
-      ./0002-libxl-Spice-streaming-video-setting-support-for-upst.patch
+    ./0002-libxl-Spice-streaming-video-setting-support-for-upst.patch
-      ./0003-Add-qxl-vga-interface-support-for-upstream-qem.patch
+    ./0003-Add-qxl-vga-interface-support-for-upstream-qem.patch
-      (xsaPatch {
+    XSA_190
-        name = "190-4.5";
+    XSA_191
-        sha256 = "0f8pw38kkxky89ny3ic5h26v9zsjj9id89lygx896zc3w1klafqm";
+    XSA_192
-      })
+    XSA_193
-      (xsaPatch {
+    XSA_195
-        name = "191-4.6";
+    XSA_196
-        sha256 = "1wl1ndli8rflmc44pkp8cw4642gi8z7j7gipac8mmlavmn3wdqhg";
+    XSA_198
-      })
+    XSA_200
-      (xsaPatch {
+    XSA_202_45
-        name = "192-4.5";
+    XSA_204_45
-        sha256 = "0m8cv0xqvx5pdk7fcmaw2vv43xhl62plyx33xqj48y66x5z9lxpm";
+    XSA_206_45
-      })
+    XSA_207
-      (xsaPatch {
+    XSA_212
-        name = "193-4.5";
+    XSA_213_45
-        sha256 = "0k9mykhrpm4rbjkhv067f6s05lqmgnldcyb3vi8cl0ndlyh66lvr";
+    XSA_214
-      })
+    XSA_215
-      (xsaPatch {
+    XSA_217_45
-        name = "195";
+    XSA_218_45
-        sha256 = "0m0g953qnjy2knd9qnkdagpvkkgjbk3ydgajia6kzs499dyqpdl7";
+    XSA_219_45
-      })
+    XSA_220_45
-      (xsaPatch {
+    XSA_221
-        name = "196-0001-x86-emul-Correct-the-IDT-entry-calculation-in-inject";
+    XSA_222_45
-        sha256 = "0z53nzrjvc745y26z1qc8jlg3blxp7brawvji1hx3s74n346ssl6";
+    XSA_223
-      })
+    XSA_224_45
-      (xsaPatch {
+    XSA_227_45
-        name = "196-0002-x86-svm-Fix-injection-of-software-interrupts";
+    XSA_230
-        sha256 = "11cqvr5jn2s92wsshpilx9qnfczrd9hnyb5aim6qwmz3fq3hrrkz";
+    XSA_231_45
-      })
+    XSA_232
-      (xsaPatch {
+    XSA_233
-        name = "198";
+    XSA_234_45
-        sha256 = "0d1nndn4p520c9xa87ixnyks3mrvzcri7c702d6mm22m8ansx6d9";
+    XSA_235_45
-      })
+    XSA_236_45
-      (xsaPatch {
+    XSA_237_45
-        name = "200-4.6";
+    XSA_238_45
-        sha256 = "0k918ja83470iz5k4vqi15293zjvz2dipdhgc9sy9rrhg4mqncl7";
+    XSA_239_45
-      })
+    XSA_240_45
-      (xsaPatch {
+    XSA_241
-        name = "202-4.6";
+    XSA_242
-        sha256 = "0nnznkrvfbbc8z64dr9wvbdijd4qbpc0wz2j5vpmx6b32sm7932f";
+    XSA_243_45
-      })
+    XSA_244_45
-      (xsaPatch {
+    XSA_245
-        name = "204-4.5";
+  ];
-        sha256 = "083z9pbdz3f532fnzg7n2d5wzv6rmqc0f4mvc3mnmkd0rzqw8vcp";
-      })
-      (xsaPatch {
-        name = "206-4.5/0001-xenstored-apply-a-write-transaction-rate-limit";
-        sha256 = "07vsm8mlbxh2s01ny2xywnm1bqhhxas1az31fzwb6f1g14vkzwm4";
-      })
-      (xsaPatch {
-        name = "206-4.5/0002-xenstored-Log-when-the-write-transaction-rate-limit-";
-        sha256 = "17pnvxjmhny22abwwivacfig4vfsy5bqlki07z236whc2y7yzbsx";
-      })
-      (xsaPatch {
-        name = "206-4.5/0003-oxenstored-refactor-putting-response-on-wire";
-        sha256 = "0xf566yicnisliy82cydb2s9k27l3bxc43qgmv6yr2ir3ixxlw5s";
-      })
-      (xsaPatch {
-        name = "206-4.5/0004-oxenstored-remove-some-unused-parameters";
-        sha256 = "16cqx9i0w4w3x06qqdk9rbw4z96yhm0kbc32j40spfgxl82d1zlk";
-      })
-      (xsaPatch {
-        name = "206-4.5/0005-oxenstored-refactor-request-processing";
-        sha256 = "1g2hzlv7w03sqnifbzda85mwlz3bw37rk80l248180sv3k7k6bgv";
-      })
-      (xsaPatch {
-        name = "206-4.5/0006-oxenstored-keep-track-of-each-transaction-s-operatio";
-        sha256 = "0n65yfxvpfd4cz95dpbwqj3nablyzq5g7a0klvi2y9zybhch9cmg";
-      })
-      (xsaPatch {
-        name = "206-4.5/0007-oxenstored-move-functions-that-process-simple-operat";
-        sha256 = "0qllvbc9rnj7jhhlslxxs35gvphvih0ywz52jszj4irm23ka5vnz";
-      })
-      (xsaPatch {
-        name = "206-4.5/0008-oxenstored-replay-transaction-upon-conflict";
-        sha256 = "0lixkxjfzciy9l0f980cmkr8mcsx14c289kg0mn5w1cscg0hb46g";
-      })
-      (xsaPatch {
-        name = "206-4.5/0009-oxenstored-log-request-and-response-during-transacti";
-        sha256 = "09ph8ddcx0k7rndd6hx6kszxh3fhxnvdjsq13p97n996xrpl1x7b";
-      })
-      (xsaPatch {
-        name = "206-4.5/0010-oxenstored-allow-compilation-prior-to-OCaml-3.12.0";
-        sha256 = "1y0m7sqdz89z2vs4dfr45cyvxxas323rxar0xdvvvivgkgxawvxj";
-      })
-      (xsaPatch {
-        name = "206-4.5/0011-oxenstored-comments-explaining-some-variables";
-        sha256 = "1d3n0y9syya4kaavrvqn01d3wsn85gmw7qrbylkclznqgkwdsr2p";
-      })
-      (xsaPatch {
-        name = "206-4.5/0012-oxenstored-handling-of-domain-conflict-credit";
-        sha256 = "12zgid5y9vrhhpk2syxp0x01lzzr6447fa76n6rjmzi1xgdzpaf8";
-      })
-      (xsaPatch {
-        name = "206-4.5/0013-oxenstored-ignore-domains-with-no-conflict-credit";
-        sha256 = "0v3g9pm60w6qi360hdqjcw838s0qcyywz9qpl8gzmhrg7a35avxl";
-      })
-      (xsaPatch {
-        name = "206-4.5/0014-oxenstored-add-transaction-info-relevant-to-history-";
-        sha256 = "0vv3w0h5xh554i9v2vbc8gzm8wabjf2vzya3dyv5yzvly6ygv0sb";
-      })
-      (xsaPatch {
-        name = "206-4.5/0015-oxenstored-support-commit-history-tracking";
-        sha256 = "1iv2vy29g437vj73x9p33rdcr5ln2q0kx1b3pgxq202ghbc1x1zj";
-      })
-      (xsaPatch {
-        name = "206-4.5/0016-oxenstored-only-record-operations-with-side-effects-";
-        sha256 = "1cjkw5ganbg6lq78qsg0igjqvbgph3j349faxgk1p5d6nr492zzy";
-      })
-      (xsaPatch {
-        name = "206-4.5/0017-oxenstored-discard-old-commit-history-on-txn-end";
-        sha256 = "0lm15lq77403qqwpwcqvxlzgirp6ffh301any9g401hs98f9y4ps";
-      })
-      (xsaPatch {
-        name = "206-4.5/0018-oxenstored-track-commit-history";
-        sha256 = "1jh92p6vjhkm3bn5vz260npvsjji63g2imsxflxs4f3r69sz1nkd";
-      })
-      (xsaPatch {
-        name = "206-4.5/0019-oxenstored-blame-the-connection-that-caused-a-transa";
-        sha256 = "17k264pk0fvsamj85578msgpx97mw63nmj0j9v5hbj4bgfazvj4h";
-      })
-      (xsaPatch {
-        name = "206-4.5/0020-oxenstored-allow-self-conflicts";
-        sha256 = "15z3rd49q0pa72si0s8wjsy2zvbm613d0hjswp4ikc6nzsnsh4qy";
-      })
-      (xsaPatch {
-        name = "206-4.5/0021-oxenstored-do-not-commit-read-only-transactions";
-        sha256 = "04wpzazhv90lg3228z5i6vnh1z4lzd08z0d0fvc4br6pkd0w4va8";
-      })
-      (xsaPatch {
-        name = "206-4.5/0022-oxenstored-don-t-wake-to-issue-no-conflict-credit";
-        sha256 = "1shbrn0w68rlywcc633zcgykfccck1a77igmg8ydzwjsbwxsmsjy";
-      })
-      (xsaPatch {
-        name = "206-4.5/0023-oxenstored-transaction-conflicts-improve-logging";
-        sha256 = "1086y268yh8047k1vxnxs2nhp6izp7lfmq01f1gq5n7jiy1sxcq7";
-      })
-      (xsaPatch {
-        name = "206-4.5/0024-oxenstored-trim-history-in-the-frequent_ops-function";
-        sha256 = "014zs6i4gzrimn814k5i7gz66vbb0adkzr2qyai7i4fxc9h9r7w8";
-      })
-      (xsaPatch {
-        name = "207";
-        sha256 = "0wdlhijmw9mdj6a82pyw1rwwiz605dwzjc392zr3fpb2jklrvibc";
-      })
-      (xsaPatch {
-        name = "212";
-        sha256 = "1ggjbbym5irq534a3zc86md9jg8imlpc9wx8xsadb9akgjrr1r8d";
-      })
-      (xsaPatch {
-        name = "213-4.5";
-        sha256 = "1vnqf89ydacr5bq3d6z2r33xb2sn5vsd934rncyc28ybc9rvj6wm";
-      })
-      (xsaPatch {
-        name = "214";
-        sha256 = "0qapzx63z0yl84phnpnglpkxp6b9sy1y7cilhwjhxyigpfnm2rrk";
-      })
-      (xsaPatch {
-        name = "215";
-        sha256 = "0sv8ccc5xp09f1w1gj5a9n3mlsdsh96sdb1n560vh31f4kkd61xs";
-      })
-      (xsaPatch {
-        name = "217-4.5";
-        sha256 = "067pgsfrb9py2dhm1pk9g8f6fs40vyfrcxhj8c12vzamb6svzmn4";
-      })
-      (xsaPatch {
-        name = "218-4.5/0001-IOMMU-handle-IOMMU-mapping-and-unmapping-failures";
-        sha256 = "00y6j3yjxw0igpldsavikmhlxw711k2jsj1qx0s05w2k608gadkq";
-      })
-      (xsaPatch {
-        name = "218-4.5/0002-gnttab-fix-unmap-pin-accounting-race";
-        sha256 = "0qbbfnnjlpdcd29mzmacfmi859k92c213l91q7w1rg2k6pzx928k";
-      })
-      (xsaPatch {
-        name = "218-4.5/0003-gnttab-Avoid-potential-double-put-of-maptrack-entry";
-        sha256 = "1cndzvyhf41mk4my6vh3bk9jvh2y4gpmqdhvl9zhxhmppszslqkc";
-      })
-      (xsaPatch {
-        name = "218-4.5/0004-gnttab-correct-maptrack-table-accesses";
-        sha256 = "02zpb0ffigijacqvyyjylwx3qpgibwslrka7mbxwnclf4s9c03a2";
-      })
-      (xsaPatch {
-        name = "219-4.5";
-        sha256 = "003msr5vhsc66scmdpgn0lp3p01g4zfw5vj86y5lw9ajkbaywdsm";
-      })
-      (xsaPatch {
-        name = "220-4.5";
-        sha256 = "1dj9nn6lzxlipjb3nb7b9m4337fl6yn2bd7ap1lqrjn8h9zkk1pp";
-      })
-      (xsaPatch {
-        name = "221";
-        sha256 = "1mcr1nqgxyjrkywdg7qhlfwgz7vj2if1dhic425vgd41p9cdgl26";
-      })
-      (xsaPatch {
-        name = "222-1-4.6";
-        sha256 = "1g4dqm5qx4wqlv1520jpfiscph95vllcp4gqp1rdfailk8xi0mcf";
-      })
-      (xsaPatch {
-        name = "222-2-4.5";
-        sha256 = "1hw8rhc7q4v309f4w11gxfsn5x1pirvxkg7s4kr711fnmvp9hkzd";
-      })
-      (xsaPatch {
-        name = "224-4.5/0001-gnttab-Fix-handling-of-dev_bus_addr-during-unmap";
-        sha256 = "1aislj66ss4cb3v2bh12mrqsyrf288d4h54rj94jjq7h1hnycw7h";
-      })
-      (xsaPatch {
-        name = "224-4.5/0002-gnttab-never-create-host-mapping-unless-asked-to";
-        sha256 = "1j6fgm1ccb07gg0mi5qmdr0vqwwc3n12z433g1jrija2gbk1x8aq";
-      })
-      (xsaPatch {
-        name = "224-4.5/0003-gnttab-correct-logic-to-get-page-references-during-m";
-        sha256 = "166kmicwx280fjqjvgigbmhabjksa0hhvqx5h4v6kjlcjpmxqy08";
-      })
-      (xsaPatch {
-        name = "224-4.5/0004-gnttab-__gnttab_unmap_common_complete-is-all-or-noth";
-        sha256 = "1skc0yj1zsn8xgyq1y57bdc0scvvlmd0ynrjwwf1zkias1wlilav";
-      })
-    ];
 
   # Fix build on Glibc 2.24.
   NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";

pkgs/applications/virtualization/xen/4.8.nix

@@ -27,6 +27,8 @@ let
     inherit sha256;
   });
 
+  xsa = import ./xsa-patches.nix { inherit fetchpatch; };
+
   qemuDeps = [
     udev pciutils xorg.libX11 SDL pixman acl glusterfs spice_protocol usbredir
     alsaLib
@@ -34,11 +36,11 @@ let
 in
 
 callPackage (import ./generic.nix (rec {
-  version = "4.8.1";
+  version = "4.8.2";
 
   src = fetchurl {
-    url = "http://bits.xensource.com/oss-xen/release/${version}/xen-${version}.tar.gz";
+    url = "https://downloads.xenproject.org/release/xen/${version}/xen-${version}.tar.gz";
-    sha256 = "158kb1w61jmwxi3fc560s4269hhpxrin9xhm60ljj52njhxias8x";
+    sha256 = "1ydgwbn8ab0s16jrbi3wzaa6j0y3zk0j8pay458qcgayk3qc476b";
   };
 
   # Sources needed to build tools and firmwares.
@@ -141,68 +143,22 @@ callPackage (import ./generic.nix (rec {
     ++ optional (withOVMF) "--with-system-ovmf=${OVMF.fd}/FV/OVMF.fd"
     ++ optional (withInternalOVMF) "--enable-ovmf";
 
-  patches =
+  patches = with xsa; flatten [
-    [ (xsaPatch {
+    XSA_231
-        name = "213-4.8";
+    XSA_232
-        sha256 = "0ia3zr6r3bqy2h48fdy7p0iz423lniy3i0qkdvzgv5a8m80darr2";
+    XSA_233
-      })
+    XSA_234_48
-      (xsaPatch {
+    XSA_236
-        name = "214";
+    XSA_237_48
-        sha256 = "0qapzx63z0yl84phnpnglpkxp6b9sy1y7cilhwjhxyigpfnm2rrk";
+    XSA_238
-      })
+    XSA_239
-      (xsaPatch {
+    XSA_240_48
-        name = "217";
+    XSA_241
-        sha256 = "1khs5ilif14dzcm7lmikjzkwsrfzlmir1rgrgzkc411gf18ylzmj";
+    XSA_242
-      })
+    XSA_243_48
-      (xsaPatch {
+    XSA_244
-        name = "218-4.8/0001-gnttab-fix-unmap-pin-accounting-race";
+    XSA_245
-        sha256 = "0r363frai239r2wmwxi48kcr50gbk5l64nja0h9lppi3z2y3dkdd";
+  ];
-      })
-      (xsaPatch {
-        name = "218-4.8/0002-gnttab-Avoid-potential-double-put-of-maptrack-entry";
-        sha256 = "07wm06i7frv7bsaykakx3g9h0hfqv96zcadvwf6wv194dggq1plc";
-      })
-      (xsaPatch {
-        name = "218-4.8/0003-gnttab-correct-maptrack-table-accesses";
-        sha256 = "0ad0irc3p4dmla8sp3frxbh2qciji1dipkslh0xqvy2hyf9p80y9";
-      })
-      (xsaPatch {
-        name = "219-4.8";
-        sha256 = "16q7kiamy86x8qdvls74wmq5j72kgzgdilryig4q1b21mp0ij1jq";
-      })
-      (xsaPatch {
-        name = "220-4.8";
-        sha256 = "0214qyqx7qap5y1pdi9fm0vz4y2fbyg71gaq36fisknj35dv2mh5";
-      })
-      (xsaPatch {
-        name = "221";
-        sha256 = "1mcr1nqgxyjrkywdg7qhlfwgz7vj2if1dhic425vgd41p9cdgl26";
-      })
-      (xsaPatch {
-        name = "222-1";
-        sha256 = "0x02x4kqwfw255638fh2zcxwig1dy6kadlmqim1jgnjgmrvvqas2";
-      })
-      (xsaPatch {
-        name = "222-2-4.8";
-        sha256 = "1xhyp6q3c5l8djh965g1i8201m2wvhms8k886h4sn30hks38giin";
-      })
-      (xsaPatch {
-        name = "224-4.8/0001-gnttab-Fix-handling-of-dev_bus_addr-during-unmap";
-        sha256 = "1k326yan5811qzyvpdfkv801a19nyd09nsqayi8gyh58xx9c21m4";
-      })
-      (xsaPatch {
-        name = "224-4.8/0002-gnttab-never-create-host-mapping-unless-asked-to";
-        sha256 = "06nj1x59bbx9hrj26xmvbw8z805lfqhld9hm0ld0fs6dmcpqzcck";
-      })
-      (xsaPatch {
-        name = "224-4.8/0003-gnttab-correct-logic-to-get-page-references-during-m";
-        sha256 = "0kmag6fdsskgplcvzqp341yfi6pgc14wvjj58bp7ydb9hdk53qx2";
-      })
-      (xsaPatch {
-        name = "224-4.8/0004-gnttab-__gnttab_unmap_common_complete-is-all-or-noth";
-        sha256 = "1ww80pi7jr4gjpymkcw8qxmr5as18b2asdqv35527nqprylsff9f";
-      })
-    ];
 
   # Fix build on Glibc 2.24.
   NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";

pkgs/applications/virtualization/xen/xsa-patches.nix

@@ -0,0 +1,774 @@
+{ fetchpatch }:
+
+let
+  xsaPatch = { name , sha256 }: (fetchpatch {
+    url = "https://xenbits.xen.org/xsa/xsa${name}.patch";
+    inherit sha256;
+  });
+in rec {
+  # 4.5
+  XSA_190 = (xsaPatch {
+    name = "190-4.5";
+    sha256 = "0f8pw38kkxky89ny3ic5h26v9zsjj9id89lygx896zc3w1klafqm";
+  });
+
+  # 4.5
+  XSA_191 = (xsaPatch {
+    name = "191-4.6";
+    sha256 = "1wl1ndli8rflmc44pkp8cw4642gi8z7j7gipac8mmlavmn3wdqhg";
+  });
+
+  # 4.5
+  XSA_192 = (xsaPatch {
+    name = "192-4.5";
+    sha256 = "0m8cv0xqvx5pdk7fcmaw2vv43xhl62plyx33xqj48y66x5z9lxpm";
+  });
+
+  # 4.5
+  XSA_193 = (xsaPatch {
+    name = "193-4.5";
+    sha256 = "0k9mykhrpm4rbjkhv067f6s05lqmgnldcyb3vi8cl0ndlyh66lvr";
+  });
+
+  # 4.5
+  XSA_195 = (xsaPatch {
+    name = "195";
+    sha256 = "0m0g953qnjy2knd9qnkdagpvkkgjbk3ydgajia6kzs499dyqpdl7";
+  });
+
+  # 4.5
+  XSA_196 = [
+    (xsaPatch {
+      name = "196-0001-x86-emul-Correct-the-IDT-entry-calculation-in-inject";
+      sha256 = "0z53nzrjvc745y26z1qc8jlg3blxp7brawvji1hx3s74n346ssl6";
+    })
+    (xsaPatch {
+      name = "196-0002-x86-svm-Fix-injection-of-software-interrupts";
+      sha256 = "11cqvr5jn2s92wsshpilx9qnfczrd9hnyb5aim6qwmz3fq3hrrkz";
+    })
+  ];
+
+  # 4.5
+  XSA_198 = (xsaPatch {
+    name = "198";
+    sha256 = "0d1nndn4p520c9xa87ixnyks3mrvzcri7c702d6mm22m8ansx6d9";
+  });
+
+  # 4.5
+  XSA_200 = (xsaPatch {
+    name = "200-4.6";
+    sha256 = "0k918ja83470iz5k4vqi15293zjvz2dipdhgc9sy9rrhg4mqncl7";
+  });
+
+  # 4.5
+  XSA_202_45 = (xsaPatch {
+    name = "202-4.6";
+    sha256 = "0nnznkrvfbbc8z64dr9wvbdijd4qbpc0wz2j5vpmx6b32sm7932f";
+  });
+
+  # 4.8
+  XSA_202 = (xsaPatch {
+    name = "202";
+    sha256 = "0j1d5akcjgx8w2c6w6p9znv77fkmps0880m2xgpbgs1ra9grshm1";
+  });
+
+  # 4.8
+  XSA_203 = (xsaPatch {
+    name = "203";
+    sha256 = "1s1q7xskvpg87ivwfaiqr0cj3ajdkhkhpmpikfkvq127h8hhmd8j";
+  });
+
+  # 4.5
+  XSA_204_45 = (xsaPatch {
+    name = "204-4.5";
+    sha256 = "083z9pbdz3f532fnzg7n2d5wzv6rmqc0f4mvc3mnmkd0rzqw8vcp";
+  });
+
+  # 4.8
+  XSA_204 = (xsaPatch {
+    name = "204-4.8";
+    sha256 = "0rs498s4w2alz3h6jhlr2y0ni630vhggmxbrd1p1p3gcv8p6zzrr";
+  });
+
+  # 4.5
+  XSA_206_45 = [
+    (xsaPatch {
+      name = "206-4.5/0001-xenstored-apply-a-write-transaction-rate-limit";
+      sha256 = "07vsm8mlbxh2s01ny2xywnm1bqhhxas1az31fzwb6f1g14vkzwm4";
+    })
+    (xsaPatch {
+      name = "206-4.5/0002-xenstored-Log-when-the-write-transaction-rate-limit-";
+      sha256 = "17pnvxjmhny22abwwivacfig4vfsy5bqlki07z236whc2y7yzbsx";
+    })
+    (xsaPatch {
+      name = "206-4.5/0003-oxenstored-refactor-putting-response-on-wire";
+      sha256 = "0xf566yicnisliy82cydb2s9k27l3bxc43qgmv6yr2ir3ixxlw5s";
+    })
+    (xsaPatch {
+      name = "206-4.5/0004-oxenstored-remove-some-unused-parameters";
+      sha256 = "16cqx9i0w4w3x06qqdk9rbw4z96yhm0kbc32j40spfgxl82d1zlk";
+    })
+    (xsaPatch {
+      name = "206-4.5/0005-oxenstored-refactor-request-processing";
+      sha256 = "1g2hzlv7w03sqnifbzda85mwlz3bw37rk80l248180sv3k7k6bgv";
+    })
+    (xsaPatch {
+      name = "206-4.5/0006-oxenstored-keep-track-of-each-transaction-s-operatio";
+      sha256 = "0n65yfxvpfd4cz95dpbwqj3nablyzq5g7a0klvi2y9zybhch9cmg";
+    })
+    (xsaPatch {
+      name = "206-4.5/0007-oxenstored-move-functions-that-process-simple-operat";
+      sha256 = "0qllvbc9rnj7jhhlslxxs35gvphvih0ywz52jszj4irm23ka5vnz";
+    })
+    (xsaPatch {
+      name = "206-4.5/0008-oxenstored-replay-transaction-upon-conflict";
+      sha256 = "0lixkxjfzciy9l0f980cmkr8mcsx14c289kg0mn5w1cscg0hb46g";
+    })
+    (xsaPatch {
+      name = "206-4.5/0009-oxenstored-log-request-and-response-during-transacti";
+      sha256 = "09ph8ddcx0k7rndd6hx6kszxh3fhxnvdjsq13p97n996xrpl1x7b";
+    })
+    (xsaPatch {
+      name = "206-4.5/0010-oxenstored-allow-compilation-prior-to-OCaml-3.12.0";
+      sha256 = "1y0m7sqdz89z2vs4dfr45cyvxxas323rxar0xdvvvivgkgxawvxj";
+    })
+    (xsaPatch {
+      name = "206-4.5/0011-oxenstored-comments-explaining-some-variables";
+      sha256 = "1d3n0y9syya4kaavrvqn01d3wsn85gmw7qrbylkclznqgkwdsr2p";
+    })
+    (xsaPatch {
+      name = "206-4.5/0012-oxenstored-handling-of-domain-conflict-credit";
+      sha256 = "12zgid5y9vrhhpk2syxp0x01lzzr6447fa76n6rjmzi1xgdzpaf8";
+    })
+    (xsaPatch {
+      name = "206-4.5/0013-oxenstored-ignore-domains-with-no-conflict-credit";
+      sha256 = "0v3g9pm60w6qi360hdqjcw838s0qcyywz9qpl8gzmhrg7a35avxl";
+    })
+    (xsaPatch {
+      name = "206-4.5/0014-oxenstored-add-transaction-info-relevant-to-history-";
+      sha256 = "0vv3w0h5xh554i9v2vbc8gzm8wabjf2vzya3dyv5yzvly6ygv0sb";
+    })
+    (xsaPatch {
+      name = "206-4.5/0015-oxenstored-support-commit-history-tracking";
+      sha256 = "1iv2vy29g437vj73x9p33rdcr5ln2q0kx1b3pgxq202ghbc1x1zj";
+    })
+    (xsaPatch {
+      name = "206-4.5/0016-oxenstored-only-record-operations-with-side-effects-";
+      sha256 = "1cjkw5ganbg6lq78qsg0igjqvbgph3j349faxgk1p5d6nr492zzy";
+    })
+    (xsaPatch {
+      name = "206-4.5/0017-oxenstored-discard-old-commit-history-on-txn-end";
+      sha256 = "0lm15lq77403qqwpwcqvxlzgirp6ffh301any9g401hs98f9y4ps";
+    })
+    (xsaPatch {
+      name = "206-4.5/0018-oxenstored-track-commit-history";
+      sha256 = "1jh92p6vjhkm3bn5vz260npvsjji63g2imsxflxs4f3r69sz1nkd";
+    })
+    (xsaPatch {
+      name = "206-4.5/0019-oxenstored-blame-the-connection-that-caused-a-transa";
+      sha256 = "17k264pk0fvsamj85578msgpx97mw63nmj0j9v5hbj4bgfazvj4h";
+    })
+    (xsaPatch {
+      name = "206-4.5/0020-oxenstored-allow-self-conflicts";
+      sha256 = "15z3rd49q0pa72si0s8wjsy2zvbm613d0hjswp4ikc6nzsnsh4qy";
+    })
+    (xsaPatch {
+      name = "206-4.5/0021-oxenstored-do-not-commit-read-only-transactions";
+      sha256 = "04wpzazhv90lg3228z5i6vnh1z4lzd08z0d0fvc4br6pkd0w4va8";
+    })
+    (xsaPatch {
+      name = "206-4.5/0022-oxenstored-don-t-wake-to-issue-no-conflict-credit";
+      sha256 = "1shbrn0w68rlywcc633zcgykfccck1a77igmg8ydzwjsbwxsmsjy";
+    })
+    (xsaPatch {
+      name = "206-4.5/0023-oxenstored-transaction-conflicts-improve-logging";
+      sha256 = "1086y268yh8047k1vxnxs2nhp6izp7lfmq01f1gq5n7jiy1sxcq7";
+    })
+    (xsaPatch {
+      name = "206-4.5/0024-oxenstored-trim-history-in-the-frequent_ops-function";
+      sha256 = "014zs6i4gzrimn814k5i7gz66vbb0adkzr2qyai7i4fxc9h9r7w8";
+    })
+  ];
+
+  # 4.8
+  XSA_206 = [
+    (xsaPatch {
+      name = "206-4.8/0001-xenstored-apply-a-write-transaction-rate-limit";
+      sha256 = "1c81d93i3qx7l38f9af0sd84w5x51zvn262mzl25ilcklql4kzl6";
+    })
+    (xsaPatch {
+      name = "206-4.8/0002-xenstored-Log-when-the-write-transaction-rate-limit-";
+      sha256 = "0b8iw409wi1x6p0swpnr51lcdlla1lgxjv5f910sj4wl96bca84q";
+    })
+    (xsaPatch {
+      name = "206-4.8/0003-oxenstored-comments-explaining-some-variables";
+      sha256 = "1d3n0y9syya4kaavrvqn01d3wsn85gmw7qrbylkclznqgkwdsr2p";
+    })
+    (xsaPatch {
+      name = "206-4.8/0004-oxenstored-handling-of-domain-conflict-credit";
+      sha256 = "020rw7hgc0dmhr4admz91kd99b4z1bdpji47nsy1255bjgvwc01k";
+    })
+    (xsaPatch {
+      name = "206-4.8/0005-oxenstored-ignore-domains-with-no-conflict-credit";
+      sha256 = "1ilhcgyn803bxvfbqv0ihfrh9jfpp0lidkv7i4613f9v9vjm8q0h";
+    })
+    (xsaPatch {
+      name = "206-4.8/0006-oxenstored-add-transaction-info-relevant-to-history-";
+      sha256 = "1dbd9pzda6hn9wj9pck44dlgz9nxvch3bzgrpaivanww8llxdfzz";
+    })
+    (xsaPatch {
+      name = "206-4.8/0007-oxenstored-support-commit-history-tracking";
+      sha256 = "1jfr56c22fqkhj6fnv1ha7zsid86zm9l0nihpb8m932xgc4a6h9h";
+    })
+    (xsaPatch {
+      name = "206-4.8/0008-oxenstored-only-record-operations-with-side-effects-";
+      sha256 = "1y845hj8krjdrirbd2jx4jqgnylwjv7bxnk7474lkld5kdnlbjyf";
+    })
+    (xsaPatch {
+      name = "206-4.8/0009-oxenstored-discard-old-commit-history-on-txn-end";
+      sha256 = "1lcr9gz2b77x74sr1flfymyyz4xzs04iv88rc1633ibyqxmvk0lx";
+    })
+    (xsaPatch {
+      name = "206-4.8/0010-oxenstored-track-commit-history";
+      sha256 = "1qwnivak4y038mpby75aaz0y70r0l3yc3hsz6wl5x0b74q6yy0ja";
+    })
+    (xsaPatch {
+      name = "206-4.8/0011-oxenstored-blame-the-connection-that-caused-a-transa";
+      sha256 = "0p2w5ddyhc6d95dnlxzc5k77j063p02d53ab7m7ijfm7m6gknq8y";
+    })
+    (xsaPatch {
+      name = "206-4.8/0012-oxenstored-allow-self-conflicts";
+      sha256 = "1571l81m30cbmqm4pk33q33p3dy58sfy2lnkl2wbgl2b3mkk657l";
+    })
+    (xsaPatch {
+      name = "206-4.8/0013-oxenstored-do-not-commit-read-only-transactions";
+      sha256 = "15985wl635w22dddjyx5l97b5p6m55mzv5ygk7xr0jx7mi192f9x";
+    })
+    (xsaPatch {
+      name = "206-4.8/0014-oxenstored-don-t-wake-to-issue-no-conflict-credit";
+      sha256 = "08672w4gaf2n3r8xy09h874gh5lg2vnrkjzq6xzvzdhdl092mipw";
+    })
+    (xsaPatch {
+      name = "206-4.8/0015-oxenstored-transaction-conflicts-improve-logging";
+      sha256 = "0ck98ms0py8wjsc38pbx6222x7n6l90zckfa7m7nnszsyc0sxxad";
+    })
+    (xsaPatch {
+      name = "206-4.8/0016-oxenstored-trim-history-in-the-frequent_ops-function";
+      sha256 = "014zs6i4gzrimn814k5i7gz66vbb0adkzr2qyai7i4fxc9h9r7w8";
+    })
+  ];
+
+  # 4.5 - 4.8
+  XSA_207 = (xsaPatch {
+    name = "207";
+    sha256 = "0wdlhijmw9mdj6a82pyw1rwwiz605dwzjc392zr3fpb2jklrvibc";
+  });
+
+  # 4.8
+  XSA_210 = (xsaPatch {
+    name = "210";
+    sha256 = "02mykxqxnsrd0sr4ij022j8y7618wzi2a6j6j761vx8qgmh11xai";
+  });
+
+  # 4.5 - 4.8
+  XSA_212 = (xsaPatch {
+    name = "212";
+    sha256 = "1ggjbbym5irq534a3zc86md9jg8imlpc9wx8xsadb9akgjrr1r8d";
+  });
+
+  # 4.5
+  XSA_213_45 = (xsaPatch {
+    name = "213-4.5";
+    sha256 = "1vnqf89ydacr5bq3d6z2r33xb2sn5vsd934rncyc28ybc9rvj6wm";
+  });
+
+  # 4.8
+  XSA_213 = (xsaPatch {
+    name = "213-4.8";
+    sha256 = "0ia3zr6r3bqy2h48fdy7p0iz423lniy3i0qkdvzgv5a8m80darr2";
+  });
+
+  # 4.5 - 4.8
+  XSA_214 = (xsaPatch {
+    name = "214";
+    sha256 = "0qapzx63z0yl84phnpnglpkxp6b9sy1y7cilhwjhxyigpfnm2rrk";
+  });
+
+  # 4.5
+  XSA_215 = (xsaPatch {
+    name = "215";
+    sha256 = "0sv8ccc5xp09f1w1gj5a9n3mlsdsh96sdb1n560vh31f4kkd61xs";
+  });
+
+  # 4.5
+  XSA_217_45 = (xsaPatch {
+    name = "217-4.5";
+    sha256 = "067pgsfrb9py2dhm1pk9g8f6fs40vyfrcxhj8c12vzamb6svzmn4";
+  });
+
+  # 4.6 - 4.8
+  XSA_217 = (xsaPatch {
+    name = "217";
+    sha256 = "1khs5ilif14dzcm7lmikjzkwsrfzlmir1rgrgzkc411gf18ylzmj";
+  });
+
+  # 4.5
+  XSA_218_45 = [
+    (xsaPatch {
+      name = "218-4.5/0001-IOMMU-handle-IOMMU-mapping-and-unmapping-failures";
+      sha256 = "00y6j3yjxw0igpldsavikmhlxw711k2jsj1qx0s05w2k608gadkq";
+    })
+    (xsaPatch {
+      name = "218-4.5/0002-gnttab-fix-unmap-pin-accounting-race";
+      sha256 = "0qbbfnnjlpdcd29mzmacfmi859k92c213l91q7w1rg2k6pzx928k";
+    })
+    (xsaPatch {
+      name = "218-4.5/0003-gnttab-Avoid-potential-double-put-of-maptrack-entry";
+      sha256 = "1cndzvyhf41mk4my6vh3bk9jvh2y4gpmqdhvl9zhxhmppszslqkc";
+    })
+    (xsaPatch {
+      name = "218-4.5/0004-gnttab-correct-maptrack-table-accesses";
+      sha256 = "02zpb0ffigijacqvyyjylwx3qpgibwslrka7mbxwnclf4s9c03a2";
+    })
+  ];
+
+  # 4.8
+  XSA_218 = [
+    (xsaPatch {
+      name = "218-4.8/0001-gnttab-fix-unmap-pin-accounting-race";
+      sha256 = "0r363frai239r2wmwxi48kcr50gbk5l64nja0h9lppi3z2y3dkdd";
+    })
+    (xsaPatch {
+      name = "218-4.8/0002-gnttab-Avoid-potential-double-put-of-maptrack-entry";
+      sha256 = "07wm06i7frv7bsaykakx3g9h0hfqv96zcadvwf6wv194dggq1plc";
+    })
+    (xsaPatch {
+      name = "218-4.8/0003-gnttab-correct-maptrack-table-accesses";
+      sha256 = "0ad0irc3p4dmla8sp3frxbh2qciji1dipkslh0xqvy2hyf9p80y9";
+    })
+  ];
+
+  # 4.5
+  XSA_219_45 = (xsaPatch {
+    name = "219-4.5";
+    sha256 = "003msr5vhsc66scmdpgn0lp3p01g4zfw5vj86y5lw9ajkbaywdsm";
+  });
+
+  # 4.8
+  XSA_219 = (xsaPatch {
+    name = "219-4.8";
+    sha256 = "16q7kiamy86x8qdvls74wmq5j72kgzgdilryig4q1b21mp0ij1jq";
+  });
+
+  # 4.5
+  XSA_220_45 = (xsaPatch {
+    name = "220-4.5";
+    sha256 = "1dj9nn6lzxlipjb3nb7b9m4337fl6yn2bd7ap1lqrjn8h9zkk1pp";
+  });
+
+  # 4.8
+  XSA_220 = (xsaPatch {
+    name = "220-4.8";
+    sha256 = "0214qyqx7qap5y1pdi9fm0vz4y2fbyg71gaq36fisknj35dv2mh5";
+  });
+
+  # 4.5 - 4.8
+  XSA_221 = (xsaPatch {
+    name = "221";
+    sha256 = "1mcr1nqgxyjrkywdg7qhlfwgz7vj2if1dhic425vgd41p9cdgl26";
+  });
+
+  # 4.5
+  XSA_222_45 = [
+    (xsaPatch {
+      name = "222-1-4.6";
+      sha256 = "1g4dqm5qx4wqlv1520jpfiscph95vllcp4gqp1rdfailk8xi0mcf";
+    })
+    (xsaPatch {
+      name = "222-2-4.5";
+      sha256 = "1hw8rhc7q4v309f4w11gxfsn5x1pirvxkg7s4kr711fnmvp9hkzd";
+    })
+  ];
+
+  # 4.8
+  XSA_222 = [
+    (xsaPatch {
+      name = "222-1";
+      sha256 = "0x02x4kqwfw255638fh2zcxwig1dy6kadlmqim1jgnjgmrvvqas2";
+    })
+    (xsaPatch {
+      name = "222-2-4.8";
+      sha256 = "1xhyp6q3c5l8djh965g1i8201m2wvhms8k886h4sn30hks38giin";
+    })
+  ];
+
+  # 4.5 - 4.8
+  XSA_223 = (xsaPatch {
+    name = "223";
+    sha256 = "0803gjgcbq9vaz2mq0v5finf1fq8iik1g4hqsjqhjxvspn8l70c5";
+  });
+
+  # 4.5
+  XSA_224_45 = [
+    (xsaPatch {
+      name = "224-4.5/0001-gnttab-Fix-handling-of-dev_bus_addr-during-unmap";
+      sha256 = "1aislj66ss4cb3v2bh12mrqsyrf288d4h54rj94jjq7h1hnycw7h";
+    })
+    (xsaPatch {
+      name = "224-4.5/0002-gnttab-never-create-host-mapping-unless-asked-to";
+      sha256 = "1j6fgm1ccb07gg0mi5qmdr0vqwwc3n12z433g1jrija2gbk1x8aq";
+    })
+    (xsaPatch {
+      name = "224-4.5/0003-gnttab-correct-logic-to-get-page-references-during-m";
+      sha256 = "166kmicwx280fjqjvgigbmhabjksa0hhvqx5h4v6kjlcjpmxqy08";
+    })
+    (xsaPatch {
+      name = "224-4.5/0004-gnttab-__gnttab_unmap_common_complete-is-all-or-noth";
+      sha256 = "1skc0yj1zsn8xgyq1y57bdc0scvvlmd0ynrjwwf1zkias1wlilav";
+    })
+  ];
+
+  # 4.8
+  XSA_224 = [
+    (xsaPatch {
+      name = "224-4.8/0001-gnttab-Fix-handling-of-dev_bus_addr-during-unmap";
+      sha256 = "1k326yan5811qzyvpdfkv801a19nyd09nsqayi8gyh58xx9c21m4";
+    })
+    (xsaPatch {
+      name = "224-4.8/0002-gnttab-never-create-host-mapping-unless-asked-to";
+      sha256 = "06nj1x59bbx9hrj26xmvbw8z805lfqhld9hm0ld0fs6dmcpqzcck";
+    })
+    (xsaPatch {
+      name = "224-4.8/0003-gnttab-correct-logic-to-get-page-references-during-m";
+      sha256 = "0kmag6fdsskgplcvzqp341yfi6pgc14wvjj58bp7ydb9hdk53qx2";
+    })
+    (xsaPatch {
+      name = "224-4.8/0004-gnttab-__gnttab_unmap_common_complete-is-all-or-noth";
+      sha256 = "1ww80pi7jr4gjpymkcw8qxmr5as18b2asdqv35527nqprylsff9f";
+    })
+  ];
+
+  # 4.6 - 4.8
+  XSA_225 = (xsaPatch {
+    name = "225";
+    sha256 = "0lcp2bs0r849xnvhrdf8s821v36cqdbzk8lwz6chrjhjalk6ha2g";
+  });
+
+  # 4.5
+  XSA_226_45 = [
+    (xsaPatch {
+      name = "226-4.5/0001-gnttab-dont-use-possibly-unbounded-tail-calls";
+      sha256 = "1hx47ppv5q33cw4dwp82lgvv4fp28gx7rxijw0iaczsv8bvb8vcg";
+    })
+    (xsaPatch {
+      name = "226-4.5/0002-gnttab-fix-transitive-grant-handling";
+      sha256 = "1gzp8m2zfihwlk71c3lqyd0ajh9h11pvkhzhw0mawckxy0qksvlc";
+    })
+  ];
+
+  # 4.8 - 4.9
+  XSA_226 = [
+    (xsaPatch {
+      name = "226-4.9/0001-gnttab-dont-use-possibly-unbounded-tail-calls";
+      sha256 = "1hx47ppv5q33cw4dwp82lgvv4fp28gx7rxijw0iaczsv8bvb8vcg";
+    })
+    (xsaPatch {
+      name = "226-4.9/0002-gnttab-fix-transitive-grant-handling";
+      sha256 = "1gzp8m2zfihwlk71c3lqyd0ajh9h11pvkhzhw0mawckxy0qksvlc";
+    })
+  ];
+
+  # 4.5
+  XSA_227_45 = (xsaPatch {
+    name = "227-4.5";
+    sha256 = "1qfjfisgqm4x98qw54x2qrvgjnvvzizx9p1pjhcnsps9q6g1y3x8";
+  });
+
+  # 4.8 - 4.9
+  XSA_227 = (xsaPatch {
+    name = "227";
+    sha256 = "0zdcm43i5n08rh7rrnb0fcssvd4fgawwmizsa16w2ak7pzvgmg94";
+  });
+
+  # 4.8
+  XSA_228_48 = (xsaPatch {
+    name = "228-4.8";
+    sha256 = "085pnzwyv0rdb51hv5vhbhwfyxl0wg8sxcm912gjq8z7da5cv10n";
+  });
+
+  # 4.9
+  XSA_228 = (xsaPatch {
+    name = "228";
+    sha256 = "0c9nvfpnr5ira7ha3fszhvvh71nsxrvmzrab56xwjhl2dbw2yy23";
+  });
+
+  # 4.5 - 4.9
+  XSA_230 = (xsaPatch {
+    name = "230";
+    sha256 = "10x0j7wmzkrwycs1ng89fgjzvzh8vsdd4c5nb68b3j1azdx4ld83";
+  });
+
+  # 4.5
+  XSA_231_45 = (xsaPatch {
+    name = "231-4.5";
+    sha256 = "06gwx2f1lg51dfk2b4zxp7wv9c4pxdi87pg2asvmxqc78ir7l5s6";
+  });
+
+  # 4.8 - 4.9
+  XSA_231 = (xsaPatch {
+    name = "231-4.9";
+    sha256 = "09r8xxq2fd52wrk6i0y0sk3nbidfg6pzzrkx327hfmdjj76iyz3b";
+  });
+
+  # 4.5 - 4.9
+  XSA_232 = (xsaPatch {
+    name = "232";
+    sha256 = "0n6irjpmraa3hbxxm64a1cplc6y6g07x7v2fmlpvn70ql3fs0220";
+  });
+
+  # 4.5 - 4.9
+  XSA_233 = (xsaPatch {
+    name = "233";
+    sha256 = "1w3m8349cqav56av63w6jzvlsv4jw5rimwvskr9pq2rcbk2dx8kf";
+  });
+
+  # 4.5
+  XSA_234_45 = (xsaPatch {
+    name = "234-4.5";
+    sha256 = "1ji6hbgybb4gbgz5l5fis9midnvjbddzam8d63377rkzdyb3yz9f";
+  });
+
+  # 4.8
+  XSA_234_48 = (xsaPatch {
+    name = "234-4.8";
+    sha256 = "08n1pf7z5y67dmay1ap39bi81clgkx82fpmfn7jsh8k4aw94jrsa";
+  });
+
+  # 4.9
+  XSA_234 = (xsaPatch {
+    name = "234-4.9";
+    sha256 = "1znmxg432is0virw8321gax8zqq2zcmi2pc5p2j31sixylixsvzx";
+  });
+
+  # 4.5
+  XSA_235_45 = (xsaPatch {
+    name = "235-4.5";
+    sha256 = "0hhgnql2gji111020z4wiyzg23wqs6ymanb67rg11p4qad1fp3ff";
+  });
+
+  # 4.8 - 4.9
+  XSA_235 = (xsaPatch {
+    name = "235-4.9";
+    sha256 = "1rj4jkmh79wm30jq9f8x65qv3al8l91zc3m5s23q0x6abn3pfb9z";
+  });
+
+  # 4.5
+  XSA_236_45 = (xsaPatch {
+    name = "236-4.5";
+    sha256 = "0hcla86x81wykssd2967gblp7fzx61290p4ls4v0hcyxdg2bs2yz";
+  });
+
+  # 4.8 - 4.9
+  XSA_236 = (xsaPatch {
+    name = "236-4.9";
+    sha256 = "0vqxy7mgflga05l33j3488fwxmdw3p9yxj4ylhk9n3nw8id72ghq";
+  });
+
+  # 4.5
+  XSA_237_45 = [
+    (xsaPatch {
+      name = "237-4.5/0001-x86-dont-allow-MSI-pIRQ-mapping-on-unowned-device";
+      sha256 = "0hjxs20jhls4i0iph45a0qpw4znkm04gv74jmwhw84gy4hrhzq3b";
+    })
+    (xsaPatch {
+      name = "237-4.5/0002-x86-enforce-proper-privilege-when-mapping-pIRQ-s";
+      sha256 = "0ki8nmbc2g1l9wnqsph45a2k4c6dk5s7jvdlxg3zznyiyxjcv8yn";
+    })
+    (xsaPatch {
+      name = "237-4.5/0003-x86-MSI-disallow-redundant-enabling";
+      sha256 = "1hdz83qrjaqnihz8ji186dypxiblbfpgyb01j9m5alhk4whjqvp1";
+    })
+    (xsaPatch {
+      name = "237-4.5/0004-x86-IRQ-conditionally-preserve-irq-pirq-mapping-on-error";
+      sha256 = "0csdfn9kzn1k94pg3fcwsgqw14wcd4myi1jkcq5alj1fmkhw4wmk";
+    })
+    (xsaPatch {
+      name = "237-4.5/0005-x86-FLASK-fix-unmap-domain-IRQ-XSM-hook";
+      sha256 = "14b73rkvbkd1a2gh9kp0zrvv2d3kfwkiv24fg9agh4hrf2w3nx7y";
+    })
+  ];
+
+  # 4.8
+  XSA_237_48 = [
+    (xsaPatch {
+      name = "237-4.8/0001-x86-dont-allow-MSI-pIRQ-mapping-on-unowned-device";
+      sha256 = "0qjisp37lwi2611mp7fbbm1s7m0bx726rrg79dnxs2mj0skw59iv";
+    })
+    (xsaPatch {
+      name = "237-4.8/0002-x86-enforce-proper-privilege-when-mapping-pIRQ-s";
+      sha256 = "05q1dny13jrqhjfwak7r635mqp9chpibjvn8b7d90japc1nzpq62";
+    })
+    (xsaPatch {
+      name = "237-4.8/0003-x86-MSI-disallow-redundant-enabling";
+      sha256 = "1907lv8nb2zhpb6k6jlw4m0hm0n0lyd69vfr3wpzbc56dn0w7jqd";
+    })
+    (xsaPatch {
+      name = "237-4.8/0004-x86-IRQ-conditionally-preserve-irq-pirq-mapping-on-error";
+      sha256 = "06nrq0bx3p9ipab2r1why6qm4g32dj0x5q24hfkwc6ih0l9xwf8h";
+    })
+    (xsaPatch {
+      name = "237-4.8/0005-x86-FLASK-fix-unmap-domain-IRQ-XSM-hook";
+      sha256 = "1nbg7bjw2hv55gnkhf6chkh35va6brs08acq1d5jxncl6kv0amc1";
+    })
+  ];
+
+  # 4.9
+  XSA_237 = [
+    (xsaPatch {
+      name = "237-4.9/0001-x86-dont-allow-MSI-pIRQ-mapping-on-unowned-device";
+      sha256 = "1cbl24mqxa62h0wgsnrpcs6y6vs53znzj7g8dfsbmf74xwrd4px6";
+    })
+    (xsaPatch {
+      name = "237-4.9/0002-x86-enforce-proper-privilege-when-mapping-pIRQ-s";
+      sha256 = "0p60148j18b78pxz0dx5ymh1gyrhg2cgmxq0jxmbk090bc4jql35";
+    })
+    (xsaPatch {
+      name = "237-4.9/0003-x86-MSI-disallow-redundant-enabling";
+      sha256 = "1907lv8nb2zhpb6k6jlw4m0hm0n0lyd69vfr3wpzbc56dn0w7jqd";
+    })
+    (xsaPatch {
+      name = "237-4.9/0004-x86-IRQ-conditionally-preserve-irq-pirq-mapping-on-error";
+      sha256 = "0q95z5641amni53agimnzbspva53p0hz5wl16zaz2yhnjasj5pzr";
+    })
+    (xsaPatch {
+      name = "237-4.9/0005-x86-FLASK-fix-unmap-domain-IRQ-XSM-hook";
+      sha256 = "0bnqx9w7ppgx8wxj2zw09z0rkv1jzn3r0bd76cz0r22wz29fsdp2";
+    })
+  ];
+
+  # 4.5
+  XSA_238_45 = (xsaPatch {
+    name = "238-4.5";
+    sha256 = "1x2fg5vfv5jc084h5gjm6fq0nxjpzvi96px3sqzz4pvsvy4y4i1z";
+  });
+
+  # 4.8 - 4.9
+  XSA_238 = (xsaPatch {
+    name = "238";
+    sha256 = "1cbmg1bi5ajh7qbwsl92ynaxw2c3p7i24p3wds81r4n93r0y5dxk";
+  });
+
+  # 4.5
+  XSA_239_45 = (xsaPatch {
+    name = "239-4.5";
+    sha256 = "06bi8q3973yajxsdj7pcqarvb56q2gisxdiy0cpbyffbmpkfv3h6";
+  });
+
+  # 4.8 - 4.9
+  XSA_239 = (xsaPatch {
+    name = "239";
+    sha256 = "1a9r8j7167s43ds5i7v7mm4y970vjnbhhkrjzpmzlcx8kcz96vh3";
+  });
+
+  # 4.5
+  XSA_240_45 = [
+    (xsaPatch {
+      name = "240-4.5/0001-x86-limit-linear-page-table-use-to-a-single-level";
+      sha256 = "0pmf10mbnmb88y7mly8s2l0j88cg0ayhkcnmj1zbjrkjmpccv395";
+    })
+    (xsaPatch {
+      name = "240-4.5/0002-x86-mm-Disable-PV-linear-pagetables-by-default";
+      sha256 = "19f096ra3xndvzkjjasx73p2g25hfkm905px0p3yakwll0qzd029";
+    })
+  ];
+
+  # 4.8
+  XSA_240_48 = [
+    (xsaPatch {
+      name = "240-4.8/0001-x86-limit-linear-page-table-use-to-a-single-level";
+      sha256 = "0m44qhhqk2pdwqg8g28pypqrylq6iw00k9qrzf6qd0iza2y42kgj";
+    })
+    (xsaPatch {
+      name = "240-4.8/0002-x86-mm-Disable-PV-linear-pagetables-by-default";
+      sha256 = "1jd720wvngj9wq3fprdhakxvqlff0jd8zcx2pd3vsn2qvjbvr2gf";
+    })
+  ];
+
+  # 4.9
+  XSA_240 = [
+    (xsaPatch {
+      name = "240-4.9/0001-x86-limit-linear-page-table-use-to-a-single-level";
+      sha256 = "1759ni80aifakm44g4cc6pnmbcn1xjic8j66fvj0vibm0wqk6xck";
+    })
+    (xsaPatch {
+      name = "240-4.9/0002-x86-mm-Disable-PV-linear-pagetables-by-default";
+      sha256 = "0g6dpi006p5cjxw5d8h33p0429fdmdm6nqzj0m63ralpqvns3ib5";
+    })
+  ];
+
+  # 4.5 - 4.8
+  XSA_241 = (xsaPatch {
+    name = "241-4.8";
+    sha256 = "16zb75kzs98f4mdxhbyczk5mbh9dvn6j3yhfafki34x1dfdnq4pj";
+  });
+
+  # 4.9
+  XSA_241_49 = (xsaPatch {
+    name = "241-4.9";
+    sha256 = "0xlhin7wkhmlnbp9mqcbq3q4drdwb5la482ja9nwkhi8i867p6wc";
+  });
+
+  # 4.5 - 4.9
+  XSA_242 = (xsaPatch {
+    name = "242-4.9";
+    sha256 = "0yx3x0i2wybsm7lzdffxa2mm866bjl4ipbb9vipnw77dyg705zpr";
+  });
+
+  # 4.5
+  XSA_243_45 = [
+    (xsaPatch {
+      name = "243-4.6-1";
+      sha256 = "1cqanpyysa7px0j645z4jw9yqsvv6cbh7yq1b86ap134axfifcan";
+    })
+    (xsaPatch {
+      name = "243-4.5-2";
+      sha256 = "0wbcgw4m0nzm2902jnda2020l7bd5adkq8j5myi1zmsfzbq03hwn";
+    })
+  ];
+
+  # 4.8
+  XSA_243_48 = (xsaPatch {
+    name = "243-4.8";
+    sha256 = "1q60zn55l9wpq45nrxh0av59sjz0jg8pkjm1gkyywkdsgg4fg5z4";
+  });
+
+  # 4.9
+  XSA_243 = (xsaPatch {
+    name = "243";
+    sha256 = "06fnbnh9zlsbkqih9ipnb7a8gly54m7lp17d854j1r370ad3c4yg";
+  });
+
+  # 4.5
+  XSA_244_45 = (xsaPatch {
+    name = "244-4.5";
+    sha256 = "05ci3vdl1ywfjpzcvsy1k52whxjk8pxzj7dh3r94yqasr56i5v2l";
+  });
+
+  # 4.8 - 4.9
+  XSA_244 = (xsaPatch {
+    name = "244";
+    sha256 = "10308xsgmhb0vg6fk0ql8v94zifv6dcv6vkaicryfp405yj2rzkm";
+  });
+
+  # 4.5 - 4.9
+  XSA_245 = [
+    (xsaPatch {
+      name = "245/0001-xen-page_alloc-Cover-memory-unreserved-after-boot-in";
+      sha256 = "12brsgbn7xwakalsn10afykgqmx119mqg6vjj3v2b1pnmf4ss0w8";
+    })
+    (xsaPatch {
+      name = "245/0002-xen-arm-Correctly-report-the-memory-region-in-the-du";
+      sha256 = "1k6z5r7wnrswsczn2j3a1mc4nvxqm4ydj6n6rvgqizk2pszdkqg8";
+    })
+  ];
+}

pkgs/build-support/fetchbzr/builder.sh

@@ -4,6 +4,6 @@ header "exporting \`$url' (revision $rev) into \`$out'"
 
 # Perform a lightweight checkout so that we don't end up importing
 # all the repository's history.
-bzr -Ossl.cert_reqs=none export -r "$rev" --format=dir "$out" "$url"
+BZR_LOG=/dev/null bzr -Ossl.cert_reqs=none export -r "$rev" --format=dir "$out" "$url"
 
 stopNest

pkgs/desktops/lxqt/core/lxqt-panel/default.nix

@@ -1,5 +1,5 @@
 {
-  stdenv, fetchFromGitHub, fetchurl, standardPatch,
+  stdenv, fetchFromGitHub, fetchpatch, standardPatch,
   cmake, pkgconfig, lxqt-build-tools,
   qtbase, qttools, qtx11extras, qtsvg, libdbusmenu, kwindowsystem, solid,
   kguiaddons, liblxqt, libqtxdg, lxqt-common, lxqt-globalkeys, libsysstat,
@@ -50,9 +50,10 @@ stdenv.mkDerivation rec {
   ];
 
   patches = [
-    (fetchurl {
+    (fetchpatch {
        url = https://github.com/lxde/lxqt-panel/commit/ec62109e0fa678875a9b10fc6f1975267432712d.patch;
-       sha256 = "1ywwk8gb6gbvs8z9gwgsnb13z1jvyvjij349nq7ij6iyhyld0jlr";
+       name = "fix-compile-explicit-keyword.patch";
+       sha256 = "1grda0dw175kbsfq90lr5qaf79akwikzxw85jhd5f339nnramp81";
     })
   ];
 

pkgs/development/haskell-modules/configuration-common.nix

@@ -98,7 +98,7 @@ self: super: {
       name = "git-annex-${drv.version}-src";
       url = "git://git-annex.branchable.com/";
       rev = "refs/tags/" + drv.version;
-      sha256 = "1143qcsljp66v0xvq2a2nqji24890rnmxcmwnxw8xj818gqk0p3m";
+      sha256 = "0iz0yz0bwkmpza5qahsxr9plg1ylmkv7znp1a8f0z65px7f300an";
     };
   })).override {
     dbus = if pkgs.stdenv.isLinux then self.dbus else null;

pkgs/development/haskell-modules/configuration-hackage2nix.yaml

@@ -37,7 +37,7 @@ core-packages:
   - ghcjs-base-0
 
 default-package-overrides:
-  # LTS Haskell 9.10
+  # LTS Haskell 9.11
   - abstract-deque ==0.3
   - abstract-deque-tests ==0.3
   - abstract-par ==0.3.3
@@ -323,7 +323,7 @@ default-package-overrides:
   - bytestring-strict-builder ==0.4.5
   - bytestring-tree-builder ==0.2.7.1
   - bytestring-trie ==0.2.4.1
-  - bzlib-conduit ==0.2.1.4
+  - bzlib-conduit ==0.2.1.5
   - c2hs ==0.28.2
   - Cabal ==1.24.2.0
   - cabal-dependency-licenses ==0.2.0.0
@@ -669,7 +669,7 @@ default-package-overrides:
   - expiring-cache-map ==0.0.6.1
   - explicit-exception ==0.1.9
   - exp-pairs ==0.1.5.2
-  - extensible ==0.4.5
+  - extensible ==0.4.6
   - extensible-effects ==1.11.1.0
   - extensible-exceptions ==0.1.1.4
   - extra ==1.5.3
@@ -686,6 +686,7 @@ default-package-overrides:
   - fclabels ==2.0.3.2
   - fdo-notify ==0.3.1
   - feature-flags ==0.1.0.1
+  - fedora-haskell-tools ==0.3
   - feed ==0.3.12.0
   - FenwickTree ==0.1.2.1
   - fft ==0.1.8.6
@@ -790,7 +791,7 @@ default-package-overrides:
   - gi-soup ==2.4.14
   - git ==0.2.0
   - github ==0.16.0
-  - github-release ==1.0.6
+  - github-release ==1.0.7
   - github-types ==0.2.1
   - github-webhook-handler ==0.0.8
   - github-webhook-handler-snap ==0.0.7
@@ -948,7 +949,7 @@ default-package-overrides:
   - haddock-api ==2.17.4
   - haddock-library ==1.4.3
   - haddock-test ==0.0.1
-  - hailgun ==0.4.1.5
+  - hailgun ==0.4.1.6
   - hailgun-simple ==0.1.0.0
   - hakyll ==4.9.8.0
   - hakyll-favicon ==0.1.0
@@ -1024,12 +1025,12 @@ default-package-overrides:
   - hebrew-time ==0.1.1
   - hedgehog ==0.5
   - hedgehog-quickcheck ==0.1
-  - hedis ==0.9.10
+  - hedis ==0.9.11
   - here ==1.2.11
   - heredoc ==0.2.0.0
   - heterocephalus ==1.0.5.0
   - hex ==0.1.2
-  - hexml ==0.3.2
+  - hexml ==0.3.3
   - hexpat ==0.20.13
   - hexstring ==0.11.1
   - hformat ==0.3.1.0
@@ -1090,8 +1091,8 @@ default-package-overrides:
   - hsebaysdk ==0.4.0.0
   - hse-cpp ==0.2
   - hsemail ==2
-  - hset ==2.2.0
   - HSet ==0.0.1
+  - hset ==2.2.0
   - hsexif ==0.6.1.4
   - hs-GeoIP ==0.3
   - hsignal ==0.2.7.5
@@ -1207,7 +1208,7 @@ default-package-overrides:
   - inline-c ==0.5.6.1
   - inline-c-cpp ==0.1.0.0
   - inline-java ==0.6.5
-  - inline-r ==0.9.0.1
+  - inline-r ==0.9.0.2
   - insert-ordered-containers ==0.2.1.0
   - instance-control ==0.1.2.0
   - integer-logarithms ==1.0.2
@@ -1232,10 +1233,10 @@ default-package-overrides:
   - ip6addr ==0.5.3
   - iproute ==1.7.1
   - IPv6Addr ==1.0.1
-  - IPv6DB ==0.2.2
+  - IPv6DB ==0.2.3
   - irc ==0.6.1.0
   - irc-client ==0.4.4.4
-  - irc-conduit ==0.2.2.3
+  - irc-conduit ==0.2.2.4
   - irc-ctcp ==0.1.3.0
   - irc-dcc ==2.0.1
   - islink ==0.1.0.0
@@ -1283,7 +1284,7 @@ default-package-overrides:
   - kraken ==0.0.3
   - l10n ==0.1.0.1
   - labels ==0.3.3
-  - lackey ==0.4.3
+  - lackey ==0.4.4
   - lame ==0.1.1
   - language-c ==0.6.1
   - language-c-quote ==0.12.1
@@ -1349,7 +1350,7 @@ default-package-overrides:
   - lmdb ==0.2.5
   - loch-th ==0.2.1
   - log ==0.9.0.1
-  - log-base ==0.7.3.0
+  - log-base ==0.7.4.0
   - log-domain ==0.11.2
   - log-elasticsearch ==0.9.1.0
   - logfloat ==0.13.3.3
@@ -1630,14 +1631,14 @@ default-package-overrides:
   - perf ==0.1.2
   - persistable-record ==0.5.1.1
   - persistable-types-HDBC-pg ==0.0.1.5
-  - persistent ==2.7.0
+  - persistent ==2.7.1
   - persistent-mongoDB ==2.6.0
-  - persistent-mysql ==2.6.1
+  - persistent-mysql ==2.6.2.1
   - persistent-mysql-haskell ==0.3.0.0
-  - persistent-postgresql ==2.6.1
+  - persistent-postgresql ==2.6.2
   - persistent-redis ==2.5.2
   - persistent-refs ==0.4
-  - persistent-sqlite ==2.6.2
+  - persistent-sqlite ==2.6.3
   - persistent-template ==2.5.3
   - pgp-wordlist ==0.1.0.2
   - pg-transact ==0.1.0.1
@@ -1646,7 +1647,7 @@ default-package-overrides:
   - picoparsec ==0.1.2.3
   - picosat ==0.1.4
   - pid1 ==0.1.2.0
-  - pinboard ==0.9.12.5
+  - pinboard ==0.9.12.6
   - pinch ==0.3.2.0
   - pinchot ==0.24.0.0
   - pipes ==4.3.6
@@ -1735,8 +1736,8 @@ default-package-overrides:
   - prompt ==0.1.1.2
   - protobuf ==0.2.1.1
   - protobuf-simple ==0.1.0.4
-  - protocol-buffers ==2.4.4
+  - protocol-buffers ==2.4.5
-  - protocol-buffers-descriptor ==2.4.4
+  - protocol-buffers-descriptor ==2.4.5
   - proto-lens ==0.2.1.0
   - proto-lens-arbitrary ==0.1.1.1
   - proto-lens-combinators ==0.1.0.7
@@ -1752,7 +1753,7 @@ default-package-overrides:
   - publicsuffix ==0.20170508
   - pure-io ==0.2.1
   - pureMD5 ==2.1.3
-  - purescript-bridge ==0.11.1.0
+  - purescript-bridge ==0.11.1.1
   - pusher-http-haskell ==1.2.0.1
   - pwstore-fast ==2.4.4
   - QuasiText ==0.1.2.6
@@ -1783,7 +1784,7 @@ default-package-overrides:
   - rank-product ==0.2.0.1
   - Rasterific ==0.7.2.1
   - rasterific-svg ==0.3.3
-  - ratel ==0.3.5
+  - ratel ==0.3.6
   - ratel-wai ==0.2.0
   - rattletrap ==2.5.0
   - rawfilepath ==0.2.4
@@ -1852,7 +1853,7 @@ default-package-overrides:
   - result ==0.2.6.0
   - rethinkdb ==2.2.0.10
   - rethinkdb-client-driver ==0.0.25
-  - retry ==0.7.4.2
+  - retry ==0.7.4.3
   - rev-state ==0.1.2
   - rfc5051 ==0.1.0.3
   - rng-utils ==0.2.1
@@ -1921,16 +1922,16 @@ default-package-overrides:
   - servant-mock ==0.8.2
   - servant-purescript ==0.8.0.1
   - servant-ruby ==0.2.1.0
-  - servant-server ==0.11
+  - servant-server ==0.11.0.1
   - servant-static-th ==0.1.0.6
   - servant-subscriber ==0.6.0.0
   - servant-swagger ==1.1.3.1
-  - servant-swagger-ui ==0.2.4.3.0.20
+  - servant-swagger-ui ==0.2.4.3.4.0
   - servant-yaml ==0.1.0.0
   - serversession ==1.0.1
   - serversession-frontend-wai ==1.0
   - serversession-frontend-yesod ==1.0
-  - servius ==1.2.0.2
+  - servius ==1.2.0.3
   - set-cover ==0.0.8
   - setenv ==0.1.1.3
   - setlocale ==1.0.0.5
@@ -2251,7 +2252,7 @@ default-package-overrides:
   - typography-geometry ==1.0.0.1
   - tz ==0.1.3.0
   - tzdata ==0.1.20170320.0
-  - ua-parser ==0.7.4
+  - ua-parser ==0.7.4.1
   - uglymemo ==0.1.0.1
   - unbound ==0.5.1
   - unbounded-delays ==0.1.1.0
@@ -2357,7 +2358,7 @@ default-package-overrides:
   - wai-routes ==0.10.0
   - wai-routing ==0.13.0
   - wai-session ==0.3.2
-  - wai-session-postgresql ==0.2.1.0
+  - wai-session-postgresql ==0.2.1.1
   - wai-slack-middleware ==0.2.0
   - waitra ==0.0.4.0
   - wai-transformers ==0.0.7
@@ -2802,6 +2803,7 @@ dont-distribute-packages:
   aeson-smart:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
   aeson-streams:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
   aeson-t:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
+  aeson-tiled:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
   aeson-yak:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
   AesonBson:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
   affection:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -3258,6 +3260,7 @@ dont-distribute-packages:
   cabal-setup:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
   cabal-sort:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   cabal-test:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
+  cabal-toolkit:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
   cabal-upload:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
   cabal2arch:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   cabal2doap:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -3409,6 +3412,7 @@ dont-distribute-packages:
   clafer:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
   claferIG:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   claferwiki:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
+  clang-compilation-database:                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   clang-pure:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   clanki:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
   clarifai:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -3564,6 +3568,7 @@ dont-distribute-packages:
   Configurable:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
   congruence-relation:                          [ i686-linux, x86_64-linux, x86_64-darwin ]
   conjure:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
+  conkin:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
   conlogger:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
   Conscript:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
   consistent:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -4229,6 +4234,7 @@ dont-distribute-packages:
   filediff:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   FileManip:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
   FileManipCompat:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
+  filepath-crypto:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
   filepath-io-access:                           [ i686-linux, x86_64-linux, x86_64-darwin ]
   filepather:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   FilePather:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -4335,7 +4341,9 @@ dont-distribute-packages:
   free-theorems-seq:                            [ i686-linux, x86_64-linux, x86_64-darwin ]
   free-theorems-webui:                          [ i686-linux, x86_64-linux, x86_64-darwin ]
   free-theorems:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
+  free-vector-spaces:                           [ i686-linux, x86_64-linux, x86_64-darwin ]
   freekick2:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
+  freelude:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   freesect:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   freesound:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
   freetype-simple:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -4831,6 +4839,7 @@ dont-distribute-packages:
   haskell-brainfuck:                            [ i686-linux, x86_64-linux, x86_64-darwin ]
   haskell-cnc:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
   haskell-coffee:                               [ i686-linux, x86_64-linux, x86_64-darwin ]
+  haskell-compression:                          [ i686-linux, x86_64-linux, x86_64-darwin ]
   haskell-course-preludes:                      [ i686-linux, x86_64-linux, x86_64-darwin ]
   haskell-eigen-util:                           [ i686-linux, x86_64-linux, x86_64-darwin ]
   haskell-formatter:                            [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -5020,6 +5029,7 @@ dont-distribute-packages:
   Hermes:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
   hermit-syb:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   hermit:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
+  herms:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
   herringbone-embed:                            [ i686-linux, x86_64-linux, x86_64-darwin ]
   herringbone-wai:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
   herringbone:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -5752,6 +5762,7 @@ dont-distribute-packages:
   karakuri:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   karps:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
   katip-elasticsearch:                          [ i686-linux, x86_64-linux, x86_64-darwin ]
+  katip-syslog:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
   katt:                                         [ i686-linux, x86_64-linux, x86_64-darwin ]
   kawaii:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
   kazura-queue:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -5943,6 +5954,7 @@ dont-distribute-packages:
   libsystemd-daemon:                            [ i686-linux, x86_64-linux, x86_64-darwin ]
   libtagc:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
   libvirt-hs:                                   [ "x86_64-darwin" ]
+  libvirt-hs:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   libxls:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
   libxml-enumerator:                            [ i686-linux, x86_64-linux, x86_64-darwin ]
   libxml:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -5964,6 +5976,7 @@ dont-distribute-packages:
   linear-maps:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
   linear-opengl:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
   linear-vect:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
+  linearmap-category:                           [ i686-linux, x86_64-linux, x86_64-darwin ]
   linearscan-hoopl:                             [ i686-linux, x86_64-linux, x86_64-darwin ]
   LinearSplit:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
   LinkChecker:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -5988,6 +6001,7 @@ dont-distribute-packages:
   liquid:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
   liquidhaskell-cabal-demo:                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   liquidhaskell-cabal:                          [ i686-linux, x86_64-linux, x86_64-darwin ]
+  liquidhaskell:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
   list-mux:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   list-t-attoparsec:                            [ i686-linux, x86_64-linux, x86_64-darwin ]
   list-t-html-parser:                           [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -6129,6 +6143,7 @@ dont-distribute-packages:
   mandulia:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   mangopay:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   manifold-random:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
+  manifolds-core:                               [ i686-linux, x86_64-linux, x86_64-darwin ]
   manifolds:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
   mappy:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
   marionetta:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -6252,6 +6267,7 @@ dont-distribute-packages:
   mmtl:                                         [ i686-linux, x86_64-linux, x86_64-darwin ]
   moan:                                         [ i686-linux, x86_64-linux, x86_64-darwin ]
   modelicaparser:                               [ i686-linux, x86_64-linux, x86_64-darwin ]
+  modern-uri:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   modsplit:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   modular-arithmetic:                           [ i686-linux, x86_64-linux, x86_64-darwin ]
   modular-prelude-classy:                       [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -6314,6 +6330,7 @@ dont-distribute-packages:
   mono-foldable:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
   Monocle:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
   monoid-owns:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
+  monoid-statistics:                            [ i686-linux, x86_64-linux, x86_64-darwin ]
   monoidplus:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   monoids:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
   monte-carlo:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -6324,6 +6341,7 @@ dont-distribute-packages:
   morfeusz:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   morph:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
   mosaico-lib:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
+  motor:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
   mount:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
   movie-monad:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
   mp3decoder:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -6673,6 +6691,7 @@ dont-distribute-packages:
   paragon:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
   Paraiso:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
   parallel-tasks:                               [ i686-linux, x86_64-linux, x86_64-darwin ]
+  parameterized:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
   paranoia:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   parco-attoparsec:                             [ i686-linux, x86_64-linux, x86_64-darwin ]
   parco-parsec:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -6877,6 +6896,7 @@ dont-distribute-packages:
   postgresql-typed-lifted:                      [ i686-linux, x86_64-linux, x86_64-darwin ]
   postgresql-typed:                             [ i686-linux, x86_64-linux, x86_64-darwin ]
   PostgreSQL:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
+  postgrest-ws:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
   postgrest:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
   postie:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
   postmark-streams:                             [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -7047,6 +7067,7 @@ dont-distribute-packages:
   rail-compiler-editor:                         [ i686-linux, x86_64-linux, x86_64-darwin ]
   rails-session:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
   rainbow-tests:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
+  Raincat:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
   raketka:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
   rakhana:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
   rakuten:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -7175,6 +7196,7 @@ dont-distribute-packages:
   reify:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
   relation:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   relational-postgresql8:                       [ i686-linux, x86_64-linux, x86_64-darwin ]
+  relational-record-examples:                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   relative-date:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
   reload:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
   remark:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -7236,6 +7258,7 @@ dont-distribute-packages:
   rewrite:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
   rewriting:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
   rezoom:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
+  rhine:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
   rhythm-game-tutorial:                         [ i686-linux, x86_64-linux, x86_64-darwin ]
   riak:                                         [ i686-linux, x86_64-linux, x86_64-darwin ]
   RichConditional:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -7323,6 +7346,7 @@ dont-distribute-packages:
   safer-file-handles:                           [ i686-linux, x86_64-linux, x86_64-darwin ]
   saferoute:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
   sai-shape-syb:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
+  sajson:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
   Salsa:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
   saltine-quickcheck:                           [ i686-linux, x86_64-linux, x86_64-darwin ]
   saltine:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -7392,6 +7416,7 @@ dont-distribute-packages:
   sdl2-cairo-image:                             [ i686-linux, x86_64-linux, x86_64-darwin ]
   sdl2-compositor:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
   sdl2-gfx:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
+  sdl2-mixer:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   sdr:                                          [ i686-linux, x86_64-linux, x86_64-darwin ]
   seacat:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
   search:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -7762,6 +7787,7 @@ dont-distribute-packages:
   step-function:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
   stepwise:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   stgi:                                         [ i686-linux, x86_64-linux, x86_64-darwin ]
+  STLinkUSB:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
   stm-chunked-queues:                           [ i686-linux, x86_64-linux, x86_64-darwin ]
   stm-firehose:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
   stmcontrol:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -8354,6 +8380,7 @@ dont-distribute-packages:
   wai-lite:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   wai-logger-prefork:                           [ i686-linux, x86_64-linux, x86_64-darwin ]
   wai-make-assets:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
+  wai-middleware-brotli:                        [ i686-linux, x86_64-linux, x86_64-darwin ]
   wai-middleware-cache-redis:                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   wai-middleware-cache:                         [ i686-linux, x86_64-linux, x86_64-darwin ]
   wai-middleware-catch:                         [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -8435,6 +8462,7 @@ dont-distribute-packages:
   WikimediaParser:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
   wikipedia4epub:                               [ i686-linux, x86_64-linux, x86_64-darwin ]
   wild-bind-task-x11:                           [ "x86_64-darwin" ]
+  windns:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
   windowslive:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
   winerror:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   winio:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -8450,6 +8478,7 @@ dont-distribute-packages:
   woffex:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
   wolf:                                         [ i686-linux, x86_64-linux, x86_64-darwin ]
   WordAlignment:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
+  wordchoice:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   Wordlint:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   WordNet-ghc74:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
   WordNet:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -8509,6 +8538,7 @@ dont-distribute-packages:
   xing-api:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   xkbcommon:                                    [ "x86_64-darwin" ]
   xkcd:                                         [ i686-linux, x86_64-linux, x86_64-darwin ]
+  xleb:                                         [ i686-linux, x86_64-linux, x86_64-darwin ]
   xls:                                          [ "x86_64-darwin" ]
   xlsior:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
   xlsx-templater:                               [ i686-linux, x86_64-linux, x86_64-darwin ]

pkgs/development/interpreters/racket/default.nix

@@ -33,11 +33,11 @@ in
 
 stdenv.mkDerivation rec {
   name = "racket-${version}";
-  version = "6.10.1";
+  version = "6.11";
 
   src = fetchurl {
-    url = "http://mirror.racket-lang.org/installers/${version}/${name}-src.tgz";
+    url = "https://mirror.racket-lang.org/installers/${version}/${name}-src.tgz";
-    sha256 = "0v3z6x277lq1y7wkqdf6mj3826z5vq0yadygspx9h4r0f1dnmafc";
+    sha256 = "1nk7705x24jjlbqqhj8yvbgqkfscxx3m81bry1g56kjxysjmf3sw";
   };
 
   FONTCONFIG_FILE = fontsConf;

pkgs/development/libraries/ffmpeg-full/default.nix

@@ -411,7 +411,8 @@ stdenv.mkDerivation rec {
     ++ optionals isLinux [ alsaLib libraw1394 libv4l ]
     ++ optionals nvenc [ nvidia-video-sdk ]
     ++ optionals stdenv.isDarwin [ Cocoa CoreServices CoreAudio AVFoundation
-                                   MediaToolbox VideoDecodeAcceleration ];
+                                   MediaToolbox VideoDecodeAcceleration
+                                   libiconv ];
 
   # Build qt-faststart executable
   buildPhase = optional qtFaststartProgram ''make tools/qt-faststart'';

pkgs/development/libraries/libav/default.nix

@@ -27,8 +27,9 @@ let inherit (stdenv.lib) optional optionals hasPrefix; in
 
 let
   result = {
+    # e.g. https://libav.org/releases/libav-11.11.tar.xz.sha1
     libav_0_8 = libavFun "0.8.20" "0c7a2417c3a01eb74072691bb93ce802ae1be08f";
-    libav_11  = libavFun "11.10"  "38db6721ca8423682e4d614c170eccc33ba32e00";
+    libav_11  = libavFun "11.11"  "d7444fa4f135bdd7347cc962ab4b5228796b0f23";
     libav_12  = libavFun "12.2"   "3784b15f88076ca0ab8fb6b0377e975b83a5c9f5";
   };
 

pkgs/development/libraries/theft/default.nix

@@ -0,0 +1,29 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  version = "0.4.3";
+  name = "theft-${version}";
+
+  src = fetchFromGitHub {
+    owner = "silentbicycle";
+    repo = "theft";
+    rev = "v${version}";
+    sha256 = "1ibh8np12lafnrsrvjbbzlyq45zq654939x0y22vdnc6s8dpbhw4";
+  };
+
+  preConfigure = "patchShebangs ./scripts/mk_bits_lut";
+
+  doCheck = true;
+  checkTarget = "test";
+  
+  installFlags = [ "PREFIX=$(out)" ];
+  postInstall = "install -m644 vendor/greatest.h $out/include/";
+  
+  meta = {
+    description = "A C library for property-based testing";
+    platforms = stdenv.lib.platforms.linux;
+    homepage = "http://github.com/silentbicycle/theft/";
+    license = stdenv.lib.licenses.isc;
+    maintainers = [ stdenv.lib.maintainers.kquick ];
+  };
+}

pkgs/development/libraries/websocket++/default.nix

@@ -2,21 +2,22 @@
 
 stdenv.mkDerivation rec {
   name = "websocket++-${version}";
-  version = "0.4.0";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "zaphoyd";
     repo = "websocketpp";
     rev = version;
-    sha256 = "1n6j0dh3qpis0f7crd49a2nhxd5459h0blch408z3kwlasx2g0i5";
+    sha256 = "1i64sps52kvy8yffysjbmmbb109pi28kqai0qdxxz1dcj3xfckqd";
   };
 
   buildInputs = [ cmake ];
 
-  meta = {
+  meta = with stdenv.lib; {
     homepage = http://www.zaphoyd.com/websocketpp/;
     description = "C++/Boost Asio based websocket client/server library";
-    license = stdenv.lib.licenses.bsd3;
+    license = licenses.bsd3;
-    platforms = stdenv.lib.platforms.unix;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ andir ];
   };
 }

pkgs/development/libraries/wlroots/default.nix

@@ -0,0 +1,35 @@
+{ stdenv, fetchFromGitHub, meson, ninja, pkgconfig
+, wayland, mesa_noglu, wayland-protocols, libinput, libxkbcommon, pixman
+, xcbutilwm, libX11, libcap
+}:
+
+let pname = "wlroots";
+    version = "unstable-2017-10-31";
+in stdenv.mkDerivation rec {
+  name = "${pname}-${version}";
+
+  src = fetchFromGitHub {
+    owner = "swaywm";
+    repo = "wlroots";
+    rev = "7200d643363e988edf6777c38e7f8fcd451a2c50";
+    sha256 = "179raymkni1xzaph32zdhg7nfin0xfzrlnbnxkcr266k9y8k66ac";
+  };
+
+  # TODO: Temporary workaround for compilation errors
+  patches = [ ./libdrm.patch ./no-werror.patch ];
+
+  nativeBuildInputs = [ meson ninja pkgconfig ];
+
+  buildInputs = [
+    wayland mesa_noglu wayland-protocols libinput libxkbcommon pixman
+    xcbutilwm libX11 libcap
+  ];
+
+  meta = with stdenv.lib; {
+    description = "A modular Wayland compositor library";
+    inherit (src.meta) homepage;
+    license     = licenses.mit;
+    platforms   = platforms.linux;
+    maintainers = with maintainers; [ primeos ];
+  };
+}

pkgs/development/libraries/wlroots/libdrm.patch

@@ -0,0 +1,9 @@
+--- a/backend/meson.build	2017-10-31 22:08:01.112927610 +0100
++++ b/backend/meson.build	2017-10-31 22:09:28.155264343 +0100
+@@ -43,5 +43,5 @@
+ 	'wlr_backend',
+ 	backend_files,
+ 	include_directories: wlr_inc,
+-	dependencies: [wayland_server, egl, gbm, libinput, systemd, elogind, wlr_render, wlr_protos],
++	dependencies: [wayland_server, egl, gbm, libinput, systemd, elogind, wlr_render, wlr_protos, drm],
+ )

pkgs/development/libraries/wlroots/no-werror.patch

@@ -0,0 +1,10 @@
+--- a/meson.build	2017-10-31 22:08:01.132927689 +0100
++++ b/meson.build	2017-10-31 22:20:58.215784350 +0100
+@@ -5,7 +5,6 @@
+ 	default_options: [
+ 		'c_std=c11',
+ 		'warning_level=2',
+-		'werror=true',
+ 	],
+ )
+ 

pkgs/development/misc/loc/default.nix

@@ -3,17 +3,17 @@
 with rustPlatform;
 
 buildRustPackage rec {
-  version = "2017-06-23";
+  version = "0.4.1";
   name = "loc-${version}";
 
   src = fetchFromGitHub {
     owner = "cgag";
     repo = "loc";
-    rev = "bbea575f56879ef614d57a42a6b79fd45b9a8b38";
+    rev = "v${version}";
-    sha256 = "0agyhi55rh248fmlsip4fi1iw4xv3433q7bcb2lpjfnjpzxxlvfn";
+    sha256 = "0086asrx48qlmc484pjz5r5znli85q6qgpfbd81gjlzylj7f57gg";
   };
 
-  cargoSha256 = "0f3i8av9g19r2nhr9m8ca8s23kq294c5kqyvx155l6p76r7a9kvb";
+  cargoSha256 = "0y2ww48vh667kkyg9pyjwcbh7fxi41bjnkhwp749crjqn2abimrk";
 
   meta = {
     homepage = http://github.com/cgag/loc;

pkgs/development/node-packages/README.md

@@ -1,13 +1,34 @@
 Node.js packages
 ================
-To add a package from [NPM](https://www.npmjs.com/) to nixpkgs:
+The `pkgs/development/node-packages` folder contains a generated collection of
+[NPM packages](https://npmjs.com/) that can be installed with the Nix package
+manager.
+
+As a rule of thumb, the package set should only provide *end user* software
+packages, such as command-line utilities. Libraries should only be added to the
+package set if there is a non-NPM package that requires it.
+
+When it is desired to use NPM libraries in a development project, use the
+`node2nix` generator directly on the `package.json` configuration file of the
+project.
+
+The package set also provides support for multiple Node.js versions. The policy
+is that a new package should be added to the collection for the latest stable LTS
+release (which is currently 6.x), unless there is an explicit reason to support
+a different release.
+
+To add a package from NPM to nixpkgs:
 
  1. Modify `pkgs/development/node-packages/node-packages-v6.json` to add, update
     or remove package entries. (Or `pkgs/development/node-packages/node-packages-v4.json`
-    for packagages depending on Node.js 4.x)
+    for packages depending on Node.js 4.x)
  2. Run the script: `(cd pkgs/development/node-packages && ./generate.sh)`.
  3. Build your new package to test your changes:
     `cd /path/to/nixpkgs && nix-build -A nodePackages.<new-or-updated-package>`.
     To build against a specific Node.js version (e.g. 4.x):
     `nix-build -A nodePackages_4_x.<new-or-updated-package>`
  4. Add and commit all modified and generated files.
+
+For more information about the generation process, consult the
+[README.md](https://github.com/svanderburg/node2nix) file of the `node2nix`
+tool.

pkgs/development/node-packages/default-v6.nix

@@ -6,6 +6,13 @@ let
   };
 in
 nodePackages // {
+  dnschain =  nodePackages.dnschain.override (oldAttrs: {
+    buildInputs = oldAttrs.buildInputs ++ [ pkgs.makeWrapper nodePackages.coffee-script ];
+    postInstall = ''
+      wrapProgram $out/bin/dnschain --suffix PATH : ${pkgs.openssl.bin}/bin
+    '';
+  });
+
   node-inspector = nodePackages.node-inspector.override (oldAttrs: {
     buildInputs = oldAttrs.buildInputs ++ [ nodePackages.node-pre-gyp ];
   });

pkgs/development/ocaml-modules/alcotest/default.nix

@@ -1,20 +1,35 @@
-{ stdenv, fetchzip, ocaml, findlib, ocamlbuild, topkg, opam, cmdliner, astring, fmt, result }:
+{ stdenv, fetchzip, ocaml, findlib, ocamlbuild, topkg, opam, jbuilder
+, cmdliner, astring, fmt, result
+}:
+
+let param =
+  if stdenv.lib.versionAtLeast ocaml.version "4.02" then {
+    version = "0.8.1";
+    sha256 = "1bjhgwmshlaz9xncrrkknys7prigf8vlg1kqvfx9l8kn92mlf10b";
+    buildInputs = [ jbuilder ];
+    buildPhase = "jbuilder build -p alcotest";
+    inherit (jbuilder) installPhase;
+  } else {
+    version = "0.7.2";
+    sha256 = "1qgsz2zz5ky6s5pf3j3shc4fjc36rqnjflk8x0wl1fcpvvkr52md";
+    buildInputs = [ ocamlbuild opam topkg ];
+    inherit (topkg) buildPhase installPhase;
+  };
+in
 
 stdenv.mkDerivation rec {
   name = "ocaml${ocaml.version}-alcotest-${version}";
-  version = "0.7.2";
+  inherit (param) version buildPhase installPhase;
 
   src = fetchzip {
     url = "https://github.com/mirage/alcotest/archive/${version}.tar.gz";
-    sha256 = "1qgsz2zz5ky6s5pf3j3shc4fjc36rqnjflk8x0wl1fcpvvkr52md";
+    inherit (param) sha256;
   };
 
-  buildInputs = [ ocaml findlib ocamlbuild opam topkg ];
+  buildInputs = [ ocaml findlib ] ++ param.buildInputs;
 
   propagatedBuildInputs = [ cmdliner astring fmt result ];
 
-  inherit (topkg) buildPhase installPhase;
-
   createFindlibDestdir = true;
 
   meta = with stdenv.lib; {

pkgs/development/ocaml-modules/lablgtk/default.nix

@@ -1,18 +1,24 @@
 { stdenv, fetchurl, ocaml, findlib, pkgconfig, gtk2, libgnomecanvas, libglade, gtksourceview }:
 
-let
+let param =
-  pname = "lablgtk";
+  let check = stdenv.lib.versionAtLeast ocaml.version; in
-in
+  if check "4.06" then {
-
+    version = "2.18.6";
-assert stdenv.lib.versionAtLeast ocaml.version "3.12";
+    url = https://forge.ocamlcore.org/frs/download.php/1726/lablgtk-2.18.6.tar.gz;
-
+    sha256 = "1y38fdvswy6hmppm65qvgdk4pb3ghhnvz7n4ialf46340r1s5p2d";
-stdenv.mkDerivation rec {
+  } else if check "3.12" then {
-  name = "${pname}-${version}";
+    version = "2.18.5";
-  version = "2.18.5";
-
-  src = fetchurl {
     url = https://forge.ocamlcore.org/frs/download.php/1627/lablgtk-2.18.5.tar.gz;
     sha256 = "0cyj6sfdvzx8hw7553lhgwc0krlgvlza0ph3dk9gsxy047dm3wib";
+  } else throw "lablgtk is not available for OCaml ${ocaml.version}";
+in
+
+stdenv.mkDerivation rec {
+  name = "lablgtk-${version}";
+  inherit (param) version;
+
+  src = fetchurl {
+    inherit (param) url sha256;
   };
 
   nativeBuildInputs = [ pkgconfig ];

pkgs/development/python-modules/keyutils/default.nix

@@ -0,0 +1,24 @@
+{ lib, buildPythonPackage, fetchurl, pkgs, pytestrunner }:
+
+let
+  pname = "keyutils";
+  version = "0.5";
+in buildPythonPackage rec {
+  name = "${pname}-${version}";
+
+  src = fetchurl {
+    url = "mirror://pypi/k/${pname}/${name}.tar.gz";
+    sha256 = "0dskys71vkn59vlsfs1ljli0qnzk7b10iv4pawxawnk2hvyjrf10";
+  };
+
+  buildInputs = [ pkgs.keyutils pytestrunner ];
+
+  doCheck = false;
+
+  meta = {
+    description = "A set of python bindings for keyutils";
+    homepage = https://github.com/sassoftware/python-keyutils;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ primeos ];
+  };
+}

pkgs/development/python-modules/multidict/default.nix

@@ -1,9 +1,9 @@
 { lib
 , fetchurl
 , buildPythonPackage
-, pytest
+, cython
+, pytest, psutil, pytestrunner
 , isPy3k
-, psutil
 }:
 
 let
@@ -17,11 +17,8 @@ in buildPythonPackage rec {
     sha256 = "e76909da2fad6966281d4e0e4ccfd3c3025699ebcc30806afa09fa1384c3532b";
   };
 
-  checkInputs = [ pytest psutil ];
+  buildInputs = [ cython ];
-
+  checkInputs = [ pytest psutil pytestrunner ];
-  checkPhase = ''
-    py.test
-  '';
 
   disabled = !isPy3k;
 
@@ -30,4 +27,4 @@ in buildPythonPackage rec {
     homepage = https://github.com/aio-libs/multidict/;
     license = lib.licenses.asl20;
   };
-}
+}

pkgs/development/python-modules/raven/default.nix

@@ -0,0 +1,23 @@
+{ lib, buildPythonPackage, fetchurl, isPy3k, contextlib2 }:
+
+buildPythonPackage rec {
+  name = "raven-6.3.0";
+
+  src = fetchurl {
+    url = "mirror://pypi/r/raven/${name}.tar.gz";
+    sha256 = "1wgddbd092vih6k6mknp68vvm1pp12fikjqzglw6mnyw8njnbr7k";
+  };
+
+  # way too many dependencies to run tests
+  # see https://github.com/getsentry/raven-python/blob/master/setup.py
+  doCheck = false;
+
+  propagatedBuildInputs = lib.optionals (!isPy3k) [ contextlib2 ];
+
+  meta = {
+    description = "A Python client for Sentry (getsentry.com)";
+    homepage = https://github.com/getsentry/raven-python;
+    license = [ lib.licenses.bsd3 ];
+    maintainers = with lib.maintainers; [ primeos ];
+  };
+}

pkgs/development/python-modules/zipstream/default.nix

@@ -0,0 +1,22 @@
+{ lib, buildPythonPackage, fetchurl, nose }:
+
+let
+  pname = "zipstream";
+  version = "1.1.4";
+in buildPythonPackage rec {
+  name = "${pname}-${version}";
+
+  src = fetchurl {
+    url = "mirror://pypi/z/${pname}/${name}.tar.gz";
+    sha256 = "01im5anqdyggmwkigqcjg0qw2a5bnn84h33mfaqjjd69a28lpwif";
+  };
+
+  buildInputs = [ nose ];
+
+  meta = {
+    description = "A zip archive generator";
+    homepage = https://github.com/allanlei/python-zipstream;
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ primeos ];
+  };
+}

pkgs/development/tools/build-managers/apache-maven/default.nix

@@ -2,7 +2,7 @@
 
 assert jdk != null;
 
-let version = "3.5.0"; in
+let version = "3.5.2"; in
 stdenv.mkDerivation rec {
   name = "apache-maven-${version}";
 
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://apache/maven/maven-3/${version}/binaries/${name}-bin.tar.gz";
-    sha256 = "0d7hjnj77hc7qqnnfmqlwij8n6pcldfavvd6lilvv5ak4hci9fdy";
+    sha256 = "1zza5kjf69hnx41gy3yhvsk1kz259nig5njcmzjbsr8a75p1yyvh";
   };
 
   buildInputs = [ makeWrapper ];
@@ -22,5 +22,6 @@ stdenv.mkDerivation rec {
     homepage = http://maven.apache.org/;
     license = licenses.asl20;
     platforms = platforms.unix;
+    maintainers = with maintainers; [ cko ];
   };
 }

pkgs/servers/dnschain/default.nix

@@ -1,51 +0,0 @@
-{ stdenv, fetchFromGitHub, callPackage, makeWrapper, openssl }:
-
-let
-  nodePackages = callPackage (import ../../top-level/node-packages.nix) {
-    self = nodePackages;
-    generated = ./package.nix;
-  };
-
-in nodePackages.buildNodePackage rec {
-  name    = "dnschain-${version}";
-  version = "0.5.3";
-
-  src = fetchFromGitHub {
-    owner  = "okTurtles";
-    repo   = "dnschain";
-    rev    = "a8d477f9ad33d7790f94ffc563e2205823e62515";
-    sha256 = "0j5glbxf0fxnxl4l1lysb3a619b18rk0l1ks57wd255llc2mw7zy";
-  };
-
-  deps = with nodePackages; [
-    by-spec."bluebird"."2.9.9"
-    by-spec."bottleneck"."1.5.x"
-    by-spec."event-stream"."3.2.2"
-    by-spec."express"."4.11.2"
-    by-spec."hiredis"."0.4.1"
-    by-spec."json-rpc2"."0.8.1"
-    by-spec."lodash"."3.1.0"
-    by-spec."native-dns"."git+https://github.com/okTurtles/node-dns.git#08433ec98f517eed3c6d5e47bdf62603539cd402"
-    by-spec."native-dns-packet"."0.1.1"
-    by-spec."nconf"."0.7.1"
-    by-spec."properties"."1.2.1"
-    by-spec."redis"."0.12.x"
-    by-spec."string"."2.0.1"
-    by-spec."winston"."0.8.0"
-    by-spec."superagent"."0.21.0"
-  ];
-
-  buildInputs = [ makeWrapper nodePackages.coffee-script ];
-  postInstall = ''
-      wrapProgram $out/bin/dnschain --suffix PATH : ${openssl.bin}/bin
-  '';
-
-  meta = with stdenv.lib; {
-    description = "A blockchain-based DNS + HTTP server";
-    homepage    = https://okturtles.com/;
-    license     = licenses.mpl20;
-    maintainers = with maintainers; [ rnhmjoj ];
-    platforms   = platforms.unix;
-  };
-
-}

pkgs/servers/dnschain/package.json

@@ -1,3 +0,0 @@
-[ "dnschain"
-, "coffee-script"
-]

pkgs/servers/http/nginx/modules.nix

@@ -35,7 +35,7 @@
       owner = "openresty";
       repo = "headers-more-nginx-module";
       rev = "v0.26";
-      sha256 = "01wkqhk8mk8jgmzi7jbzmg5kamffx3lmhj5yfwryvnvs6xqs74wn";
+      sha256 = "0zhr3ai4xf5yghxvlbrwv8n06fgx33f1n1d4a6gmsczdfjzf8g6g";
     };
   };
 

pkgs/servers/quagga/default.nix

@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   name = "quagga-${version}";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchurl {
     url = "mirror://savannah/quagga/${name}.tar.gz";
-    sha256 = "1kgvcr9cfgys5asvb5lh5h95silkr624apqm5x68xva19xfvmpda";
+    sha256 = "0c99rjjc62xl5kwvx2pwyvs0709vbwax1qydqbqf6r7fpvr24bjj";
   };
 
   buildInputs =

pkgs/servers/web-apps/wordpress/default.nix

@@ -2,11 +2,12 @@
 { fetchFromGitHub, lib } : fetchFromGitHub {
   owner = "WordPress";
   repo = "WordPress";
-  rev = "4.7.4";
+  rev = "4.8.3";
-  sha256 = "1ia9d3n085x2r6pvdrv4rk6gdp6xhjhpsq5g7a6448xzv9hf14ri";
+  sha256 = "077bdx22sj29v8q493b49xfzxpc38q45pjhmn4znw2fmkjilih5p";
   meta = {
     homepage = https://wordpress.org;
     description = "WordPress is open source software you can use to create a beautiful website, blog, or app.";
     license = lib.licenses.gpl2;
+    maintainers = [ lib.maintainers.basvandijk ];
   };
 }

pkgs/tools/admin/ansible/2.4.nix

@@ -6,12 +6,12 @@
 
 pythonPackages.buildPythonPackage rec {
   pname = "ansible";
-  version = "2.4.0.0";
+  version = "2.4.1.0";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "http://releases.ansible.com/ansible/${name}.tar.gz";
-    sha256 = "0xkwnx817rygb1922gncv9ivgvb7hjg8g53r39hfdm3jgzp6y9qs";
+    sha256 = "0spv0kjaicwss4q52s727b6grdizcxpa0bbsfg26pgf5kjrayqfs";
   };
 
   prePatch = ''

pkgs/tools/cd-dvd/bchunk/CVE-2017-15953.patch

@@ -0,0 +1,25 @@
+--- a/bchunk.c	2017-10-30 18:03:58.658741629 +0000
++++ b/bchunk.c	2017-10-30 19:40:25.558131619 +0000
+@@ -18,6 +18,7 @@
+   *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+   */
+
++#define _GNU_SOURCE
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <string.h>
+@@ -271,11 +272,10 @@
+ 	int16_t i;
+ 	float fl;
+ 	
+-	if (!(fname = malloc(strlen(bname) + 8))) {
+-		fprintf(stderr, "main(): malloc() failed, out of memory\n");
++	if (asprintf(&fname, "%s%2.2d.%s", bname, track->num, track->extension) == -1) {
++		fprintf(stderr, "writetrack(): asprintf() failed, out of memory\n");
+ 		exit(4);
+ 	}
+-	sprintf(fname, "%s%2.2d.%s", bname, track->num, track->extension);
+ 	
+ 	printf("%2d: %s ", track->num, fname);
+ 	
+

pkgs/tools/cd-dvd/bchunk/CVE-2017-15955.patch

@@ -0,0 +1,33 @@
+diff -urNZ bchunk-1.2.0.orig/bchunk.c bchunk-1.2.0/bchunk.c
+--- a/bchunk.c	2017-10-30 18:03:58.658741629 +0000
++++ b/bchunk.c	2017-10-30 19:17:36.732855884 +0000
+@@ -426,11 +426,11 @@
+ 			printf("\nTrack ");
+ 			if (!(p = strchr(p, ' '))) {
+ 				fprintf(stderr, "... ouch, no space after TRACK.\n");
+-				continue;
++				exit(3);
+ 			}
+ 			p++;
+ 			if (!(t = strchr(p, ' '))) {
+ 				fprintf(stderr, "... ouch, no space after track number.\n");
+-				continue;
++				exit(3);
+ 			}
+ 			*t = '\0';
+
+@@ -460,12 +460,12 @@
+ 		} else if ((p = strstr(s, "INDEX"))) {
+ 			if (!(p = strchr(p, ' '))) {
+ 				printf("... ouch, no space after INDEX.\n");
+-				continue;
++				exit(3);
+ 			}
+ 			p++;
+ 			if (!(t = strchr(p, ' '))) {
+ 				printf("... ouch, no space after index number.\n");
+-				continue;
++				exit(3);
+ 			}
+ 			*t = '\0';
+ 			t++;

pkgs/tools/cd-dvd/bchunk/default.nix

@@ -8,20 +8,16 @@ stdenv.mkDerivation rec {
     sha256 = "0pcbyx3689cbl23dcij497hb3q5f1wmki7cxic5nzldx71g9vp5g";
   };
 
-  preConfigure =
+  patches = [ ./CVE-2017-15953.patch ./CVE-2017-15955.patch ];
-    ''
-      substituteInPlace Makefile \
-        --replace "-o root -g root" "" \
-        --replace "-o bin -g bin" ""
-    '';
 
-  makeFlags = "PREFIX=$(out) MAN_DIR=$(out)/share/man";
+  installPhase = ''
+    install -Dt $out/bin bchunk
+    install -Dt $out/share/man/man1 bchunk.1    
+  '';
 
-  preInstall = "mkdir -p $out/bin $out/share/man/man1";
+  meta = with stdenv.lib; {
-
-  meta = {
     homepage = http://he.fi/bchunk/;
-    description = "A program that converts CD-ROM images in BIN/CUE format into a set of ISO and CDR tracks";
+    description = "A program that converts CD images in BIN/CUE format into a set of ISO and CDR tracks";
-    platforms = stdenv.lib.platforms.linux;
+    platforms = platforms.unix;
   };
 }

pkgs/tools/filesystems/9pfs/default.nix

@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   name = "9pfs";
 
   src = fetchFromGitHub {
-    owner = "spewspew";
+    owner = "mischief";
     repo = "9pfs";
     rev = "7f4ca4cd750d650c1215b92ac3cc2a28041960e4";
     sha256 = "007s2idsn6bspmfxv1qabj39ggkgvn6gwdbhczwn04lb4c6gh3xc";
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   meta = {
-    homepage = https://github.com/spewspew/9pfs;
+    #homepage = https://github.com/spewspew/9pfs; # the account apparently doesn't exist
     description = "FUSE-based client of the 9P network filesystem protocol";
     maintainers = [ lib.maintainers.eelco ];
     platforms = lib.platforms.linux;

pkgs/tools/graphics/scrot/default.nix

@@ -2,23 +2,21 @@
 
 let
   debPatch = fetchzip {
-    url = mirror://debian/pool/main/s/scrot/scrot_0.8-17.debian.tar.xz;
+    url = mirror://debian/pool/main/s/scrot/scrot_0.8-18.debian.tar.xz;
-    sha256 = "0ydsr3vah5wkcbnp91knkdbil4hx0cn0iy57frl03azqzc29bkw5";
+    sha256 = "1m8m8ad0idf3nzw0k57f6rfbw8n7dza69a7iikriqgbrpyvxqybx";
   };
 in
 stdenv.mkDerivation rec {
-  name = "scrot-0.8-17";
+  name = "scrot-0.8-18";
 
   src = fetchurl {
     url = "http://linuxbrit.co.uk/downloads/${name}.tar.gz";
     sha256 = "1wll744rhb49lvr2zs6m93rdmiq59zm344jzqvijrdn24ksiqgb1";
   };
 
-  inherit debPatch;
-
   postPatch = ''
-    for patch in $(cat $debPatch/patches/series); do
+    for patch in $(cat ${debPatch}/patches/series); do
-      patch -p1 < "$debPatch/patches/$patch"
+      patch -p1 < "${debPatch}/patches/$patch"
     done
   '';
 

pkgs/tools/misc/lf/default.nix

@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   name = "lf-unstable-${version}";
-  version = "2017-09-06";
+  version = "2017-10-30";
 
   src = fetchFromGitHub {
     owner = "gokcehan";
     repo = "lf";
-    rev = "ae4a29e5501f805fadb115658e83df6744a258b2"; # nightly
+    rev = "3f7bd0a62d1a243562e182d9051ebb54f3414aaa"; # nightly
-    sha256 = "099ckbnyk08a716fc5qz7yldalb1p9gn2zn8kqp7bp4adi541hid";
+    sha256 = "0g6wf4j3dfy3yfkby3wlqajryv4kffqvhljq2q0x482fsrl4vipz";
   };
 
   goPackagePath = "github.com/gokcehan/lf";

pkgs/tools/misc/lf/deps.nix

@@ -4,8 +4,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/nsf/termbox-go";
-      rev = "4ed959e0540971545eddb8c75514973d670cf739"; # master
+      rev = "10cefba34bc5e7a6e5df0836a42513c28a10e074"; # master
-      sha256 = "1vx64i1mg660if3wwm81p4b7lzxfb3qbr39i7misdyld3fc486p9";
+      sha256 = "05jy6dpva2a1xfsv3yajavbx41gx8hhh5k3k901dnk0118hnyd0w";
     };
   }
   {

pkgs/tools/misc/mht2htm/default.nix

@@ -0,0 +1,43 @@
+{ stdenv, fetchurl, unzip, fpc, lazarus }:
+
+let
+  date = "07.apr.2016";
+
+in stdenv.mkDerivation rec {
+  name = "mht2mht-${version}";
+  version = "1.8.1.35";
+
+  src = fetchurl {
+    # there is a disconnect between the directory name date and file name date
+    # you should verify if that is still then case when the next version is released
+    url    = "mirror://sourceforge/mht2htm/mht2htm/1.8.1%20%2805.apr.2016%29/mht2htmcl-${version}_${date}.source.zip";
+    sha256 = "16r6zkihp84yqllp2hyaf0nvymdn9ji3g30mc5scfwycdfanja6f";
+  };
+
+  sourceRoot = ".";
+
+  buildInputs = [ fpc lazarus ];
+
+  nativeBuildInputs = [ unzip ];
+
+  buildPhase = ''
+    runHook preBuild
+    lazbuild --lazarusdir=${lazarus}/share/lazarus mht2htmcl.lpi
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 -t $out/bin               mht2htmcl
+    install -Dm644 -t $out/share/doc/mht2htm CHANGELOG COPYING README
+    runHook postInstall
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Convert .mht files to .html";
+    homepage    = http://pgm.bpalanka.com/mht2htm.html;
+    license     = licenses.gpl3;
+    maintainers = with maintainers; [ peterhoeg ];
+    platforms   = platforms.all;
+  };
+}

pkgs/tools/misc/vdirsyncer/default.nix

@@ -6,12 +6,12 @@ let
   pythonPackages = python3Packages;
 in
 pythonPackages.buildPythonApplication rec {
-  version = "0.15.0";
+  version = "0.16.3";
   name = "vdirsyncer-${version}";
 
   src = fetchurl {
     url = "mirror://pypi/v/vdirsyncer/${name}.tar.gz";
-    sha256 = "08aa5yxcj7ziz2r0hz4p554q8hgpfl2bh8r6r85f4g24mg6arxsj";
+    sha256 = "0dpwbfi97ksijqng191659m8k0v215y8ld95w8gb126m4m96qpzw";
   };
 
   propagatedBuildInputs = with pythonPackages; [

pkgs/tools/networking/http-prompt/default.nix

@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, pythonPackages, httpie }:
 
 pythonPackages.buildPythonApplication rec {
-  version = "0.10.2";
+  version = "0.11.0";
   name = "http-prompt";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     repo = "http-prompt";
     owner = "eliangcs";
-    sha256 = "0c03n1ll61zd4f60kzih3skl0hspck5hhpcf74h5l6v5as7qdbi2";
+    sha256 = "0arl85880nnyfx8cvpzm6cr8nalhyrkz5zqfr628p487rwqv45ip";
   };
 
   propagatedBuildInputs = with pythonPackages; [

pkgs/tools/security/pwgen/default.nix

@@ -1,11 +1,14 @@
-{stdenv, fetchurl}:
+{stdenv, fetchurl, autoreconfHook}:
 stdenv.mkDerivation {
-  name = "pwgen-2.07";
+  name = "pwgen-2.08";
 
   src = fetchurl {
-    url = mirror://sourceforge/pwgen/pwgen-2.07.tar.gz;
+    url = https://github.com/tytso/pwgen/archive/v2.08.tar.gz;
-    sha256 = "0mhmw700kkh238fzivcwnwi94bj9f3h36yfh3k3j2v19b0zmjx7b";
+    sha256 = "8d6e94f28655e61d6126290e3eafad4d17d7fba0d0d354239522a740a270bb2f";
   };
+
+  nativeBuildInputs = [ autoreconfHook ];
+
   meta = {
     description = "Password generator which creates passwords which can be easily memorized by a human";
     platforms = stdenv.lib.platforms.all;

pkgs/tools/text/languagetool/default.nix

@@ -20,6 +20,11 @@ stdenv.mkDerivation rec {
     EXE
     chmod +x $out/bin/$lt
     done
+    cat > $out/bin/languagetool-http-server <<EXE
+    #!${stdenv.shell}
+    ${jdk}/bin/java -cp $out/share/languagetool-server.jar org.languagetool.server.HTTPServer "\$@"
+    EXE
+    chmod +x $out/bin/languagetool-http-server
   '';
 
   meta = with stdenv.lib; {

pkgs/top-level/all-packages.nix

@@ -152,6 +152,8 @@ with pkgs;
 
   packer = callPackage ../development/tools/packer { };
 
+  mht2htm = callPackage ../tools/misc/mht2htm { };
+
   fetchpatch = callPackage ../build-support/fetchpatch { };
 
   fetchs3 = callPackage ../build-support/fetchs3 { };
@@ -10789,6 +10791,8 @@ with pkgs;
 
   tet = callPackage ../development/tools/misc/tet { };
 
+  theft = callPackage ../development/libraries/theft { };
+
   thrift = callPackage ../development/libraries/thrift {
     inherit (pythonPackages) twisted;
   };
@@ -11478,8 +11482,6 @@ with pkgs;
     inherit (perlPackages) Error MailDKIM MIMEtools NetServer;
   };
 
-  dnschain = callPackage ../servers/dnschain { };
-
   dovecot = callPackage ../servers/mail/dovecot { };
   dovecot_pigeonhole = callPackage ../servers/mail/dovecot/plugins/pigeonhole { };
   dovecot_antispam = callPackage ../servers/mail/dovecot/plugins/antispam { };
@@ -15044,7 +15046,9 @@ with pkgs;
 
   hue-cli = callPackage ../tools/networking/hue-cli { };
 
-  hugin = callPackage ../applications/graphics/hugin { };
+  hugin = callPackage ../applications/graphics/hugin {
+    wxGTK = wxGTK30;
+  };
 
   hugo = callPackage ../applications/misc/hugo { };
 
@@ -15064,6 +15068,7 @@ with pkgs;
   spectrwm = callPackage ../applications/window-managers/spectrwm { };
 
   wlc = callPackage ../development/libraries/wlc { };
+  wlroots = callPackage ../development/libraries/wlroots { };
   orbment = callPackage ../applications/window-managers/orbment { };
   sway = callPackage ../applications/window-managers/sway { };
   swaylock = callPackage ../applications/window-managers/sway { };

pkgs/top-level/lua-packages.nix

@@ -438,12 +438,15 @@ let
   };
 
 
-  luastdlib = buildLuaPackage {
+  luastdlib = buildLuaPackage rec {
-    name = "stdlib";
+    name = "stdlib-${version}";
+    version = "41.2.1";
 
-    src = fetchzip {
+    src = fetchFromGitHub {
-      url = "https://github.com/lua-stdlib/lua-stdlib/archive/release.zip";
+      owner = "lua-stdlib";
-      sha256 = "0636absdfjx8ybglwydmqxwfwmqz1c4b9s5mhxlgm4ci18lw3hms";
+      repo = "lua-stdlib";
+      rev = "release-v${version}";
+      sha256 = "03wd1qvkrj50fjszb2apzdkc8d5bpfbbi9pajl0vbrlzzmmi3jlq";
     };
 
     nativeBuildInputs = [ autoreconfHook unzip ];
@@ -616,7 +619,7 @@ let
     # NOTE: For updating, new Lua mpack bindings live at:
     # https://github.com/libmpack/libmpack-lua.
     src = libmpack.src;
-    sourceRoot = "libmpack-${libmpack.rev}-src/binding/lua";
+    sourceRoot = "${src.name}/binding/lua";
 
     nativeBuildInputs = [ pkgconfig ];
     buildInputs = [ libmpack ]; # ++ [ libtool lua ];

pkgs/top-level/python-packages.nix

@@ -2703,12 +2703,12 @@ in {
   };
 
   click-log = buildPythonPackage rec {
-    version = "0.1.3";
+    version = "0.2.1";
     name = "click-log-${version}";
 
     src = pkgs.fetchurl {
       url = "mirror://pypi/c/click-log/${name}.tar.gz";
-      sha256 = "0kdd1vminxpcfczxl2kkf285n0dr1gxh2cdbx1p6vkj7b7bci3gx";
+      sha256 = "1r1x85023cslb2pwldd089jjk573mk3w78cnashs77wrx7yz8fj9";
     };
 
     propagatedBuildInputs = with self; [ click ];
@@ -7367,24 +7367,7 @@ in {
     };
   };
 
-  raven = buildPythonPackage rec {
+  raven = callPackage ../development/python-modules/raven { };
-    name = "raven-6.2.1";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/r/raven/${name}.tar.gz";
-      sha256 = "1zkh8llsfng5viz8cpf9j74v30705hv80vb5g6gha1ij7v60p8y0";
-    };
-
-    # way too many dependencies to run tests
-    # see https://github.com/getsentry/raven-python/blob/master/setup.py
-    doCheck = false;
-
-    propagatedBuildInputs = optionals (!isPy3k) [ self.contextlib2 ];
-
-    meta = {
-      maintainers = with maintainers; [ primeos ];
-    };
-  };
 
   rethinkdb = buildPythonPackage rec {
     name = "rethinkdb-${version}";
@@ -10574,27 +10557,7 @@ in {
 
   keyring = callPackage ../development/python-modules/keyring { };
 
-  keyutils = buildPythonPackage rec {
+  keyutils = callPackage ../development/python-modules/keyutils { };
-    name = "${pname}-${version}";
-    pname = "keyutils";
-    version = "0.5";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/k/${pname}/${name}.tar.gz";
-      sha256 = "0dskys71vkn59vlsfs1ljli0qnzk7b10iv4pawxawnk2hvyjrf10";
-    };
-
-    buildInputs = with self; [ pkgs.keyutils pytestrunner ];
-
-    doCheck = false;
-
-    meta = {
-      description = "A set of python bindings for keyutils";
-      homepage = https://github.com/sassoftware/python-keyutils;
-      license = licenses.asl20;
-      maintainers = with maintainers; [ primeos ];
-    };
-  };
 
   klaus = buildPythonPackage rec {
     version = "0.9.1";
@@ -21860,25 +21823,7 @@ EOF
     };
   });
 
-  zipstream = buildPythonPackage rec {
+  zipstream = callPackage ../development/python-modules/zipstream { };
-    name = "${pname}-${version}";
-    pname = "zipstream";
-    version = "1.1.4";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/z/${pname}/${name}.tar.gz";
-      sha256 = "01im5anqdyggmwkigqcjg0qw2a5bnn84h33mfaqjjd69a28lpwif";
-    };
-
-    buildInputs = with self; [ nose ];
-
-    meta = {
-      description = "A zip archive generator";
-      homepage = "https://github.com/allanlei/python-zipstream";
-      license = licenses.gpl3Plus;
-      maintainers = with maintainers; [ primeos ];
-    };
-  };
 
   zodb = callPackage ../development/python-modules/zodb {};