Merge remote-tracking branch 'origin/staging' into gcc-4.9

Conflicts:
	pkgs/build-support/cc-wrapper/default.nix
	pkgs/development/libraries/wayland/default.nix
	pkgs/development/tools/build-managers/cmake/default.nix
	pkgs/top-level/all-packages.nix

.version

@@ -1 +1 @@
-15.05
+15.06

README.md

@@ -1,12 +1,31 @@
-[<img src="http://nixos.org/logo/nixos-hires.png" width="500px" alt="logo" />
+[<img src="http://nixos.org/logo/nixos-hires.png" width="500px" alt="logo" />](https://nixos.org/nixos)
-](https://nixos.org/nixos)
 
-[![Build Status](https://travis-ci.org/NixOS/nixpkgs.svg?branch=master)](https://travis-ci.org/NixOS/nixpkgs) [![Issue Stats](http://www.issuestats.com/github/nixos/nixpkgs/badge/pr)](http://www.issuestats.com/github/nixos/nixpkgs) [![Issue Stats](http://www.issuestats.com/github/nixos/nixpkgs/badge/issue)](http://www.issuestats.com/github/nixos/nixpkgs)
+[![Build Status](https://travis-ci.org/NixOS/nixpkgs.svg?branch=master)](https://travis-ci.org/NixOS/nixpkgs)
+[![Issue Stats](http://www.issuestats.com/github/nixos/nixpkgs/badge/pr)](http://www.issuestats.com/github/nixos/nixpkgs)
+[![Issue Stats](http://www.issuestats.com/github/nixos/nixpkgs/badge/issue)](http://www.issuestats.com/github/nixos/nixpkgs)
 
-Nixpkgs is a collection of packages for [Nix](https://nixos.org/nix/) package
+Nixpkgs is a collection of packages for the [Nix](https://nixos.org/nix/) package
-manager.
+manager. It is periodically built and tested by the [hydra](http://hydra.nixos.org/)
+build daemon as so-called channels. To get channel information via git, add
+[nixpkgs-channels](https://github.com/NixOS/nixpkgs-channels.git) as a remote:
 
-[NixOS](https://nixos.org/nixos/) linux distribution source code is located inside `nixos/` folder.
+```
+% git remote add channels git://github.com/NixOS/nixpkgs-channels.git
+```
+
+For stability and maximum binary package support, it is recommended to maintain
+custom changes on top of one of the channels, e.g. `nixos-14.12` for the latest
+release and `nixos-unstable` for the latest successful build of master:
+
+```
+% git remote update channels
+% git rebase channels/nixos-14.12
+```
+
+For pull-requests, please rebase onto nixpkgs `master`.
+
+[NixOS](https://nixos.org/nixos/) linux distribution source code is located inside
+`nixos/` folder.
 
 * [NixOS installation instructions](https://nixos.org/nixos/manual/#ch-installation)
 * [Documentation (Nix Expression Language chapter)](https://nixos.org/nix/manual/#ch-expression-language)

doc/coding-conventions.xml

@@ -5,7 +5,7 @@
 <title>Coding conventions</title>
 
 
-<section><title>Syntax</title>
+<section xml:id="sec-syntax"><title>Syntax</title>
 
 <itemizedlist>
 
@@ -207,7 +207,7 @@ args.stdenv.mkDerivation (args // {
 </section>
 
 
-<section><title>Package naming</title>
+<section xml:id="sec-package-naming"><title>Package naming</title>
 
 <para>In Nixpkgs, there are generally three different names associated with a package:
 
@@ -256,6 +256,12 @@ bound to the variable name <varname>e2fsprogs</varname> in
   a package named <literal>hello-svn</literal> by
   <command>nix-env</command>.</para></listitem>
 
+  <listitem><para>If package is fetched from git's commit then
+  the version part of the name <emphasis>must</emphasis> be the date of that 
+  (fetched) commit. The date must be in <literal>"YYYY-MM-DD"</literal> format.
+  Also add <literal>"git"</literal> to the name - e.g.,
+  <literal>"pkgname-git-2014-09-23"</literal>.</para></listitem>
+
   <listitem><para>Dashes in the package name should be preserved
   in new variable names, rather than converted to underscores
   (which was convention up to around 2013 and most names
@@ -286,7 +292,7 @@ dashes between words — not in camel case.  For instance, it should be
 <filename>allPackages.nix</filename> or
 <filename>AllPackages.nix</filename>.</para>
 
-<section><title>Hierarchy</title>
+<section xml:id="sec-hierarchy"><title>Hierarchy</title>
 
 <para>Each package should be stored in its own directory somewhere in
 the <filename>pkgs/</filename> tree, i.e. in
@@ -598,6 +604,51 @@ evaluate correctly.</para>
 </section>
 
 </section>
-
+<section xml:id="sec-sources"><title>Fetching Sources</title>
-
+  <para>There are multiple ways to fetch a package source in nixpkgs. The
+    general guidline is that you should package sources with a high degree of
+    availability. Right now there is only one fetcher which has mirroring
+    support and that is <literal>fetchurl</literal>. Note that you should also
+    prefer protocols which have a corresponding proxy environment variable.
+  </para>
+  <para>You can find many source fetch helpers in <literal>pkgs/build-support/fetch*</literal>.
+  </para>
+  <para>In the file <literal>pkgs/top-level/all-packages.nix</literal> you can
+    find fetch helpers, these have names on the form
+    <literal>fetchFrom*</literal>. The intention of these are to provide
+    snapshot fetches but using the same api as some of the version controlled
+    fetchers from <literal>pkgs/build-support/</literal>. As an example going
+    from bad to good:
+    <itemizedlist>
+      <listitem><para>Uses <literal>git://</literal> which won't be proxied.
+        <programlisting>
+          src = fetchgit {
+            url = "git://github.com/NixOS/nix.git";
+            rev = "1f795f9f44607cc5bec70d1300150bfefcef2aae";
+            sha256 = "1cw5fszffl5pkpa6s6wjnkiv6lm5k618s32sp60kvmvpy7a2v9kg";
+          }
+        </programlisting></para>
+      </listitem>
+      <listitem><para>This is ok, but an archive fetch will still be faster.
+        <programlisting>
+          src = fetchgit {
+            url = "https://github.com/NixOS/nix.git";
+            rev = "1f795f9f44607cc5bec70d1300150bfefcef2aae";
+            sha256 = "1cw5fszffl5pkpa6s6wjnkiv6lm5k618s32sp60kvmvpy7a2v9kg";
+          }
+        </programlisting></para>
+      </listitem>
+      <listitem><para>Fetches a snapshot archive and you get the rev you want.
+        <programlisting>
+          src = fetchFromGitHub {
+            owner = "NixOS";
+            repo = "nix";
+            rev = "1f795f9f44607cc5bec70d1300150bfefcef2aae";
+            sha256 = "04yri911rj9j19qqqn6m82266fl05pz98inasni0vxr1cf1gdgv9";
+          }
+        </programlisting></para>
+      </listitem>
+    </itemizedlist>
+  </para>
+</section>
 </chapter>

doc/language-support.xml

@@ -13,7 +13,7 @@ in Nixpkgs to easily build packages for other programming languages,
 such as Perl or Haskell.  These are described in this chapter.</para>
 
 
-<section xml:id="ssec-language-perl"><title>Perl</title>
+<section xml:id="sec-language-perl"><title>Perl</title>
 
 <para>Nixpkgs provides a function <varname>buildPerlPackage</varname>,
 a generic package builder function for any Perl package that has a
@@ -151,7 +151,7 @@ ClassC3Componentised = buildPerlPackage rec {
 
 </para>
 
-<section><title>Generation from CPAN</title>
+<section xml:id="ssec-generation-from-CPAN"><title>Generation from CPAN</title>
 
 <para>Nix expressions for Perl packages can be generated (almost)
 automatically from CPAN.  This is done by the program
@@ -191,7 +191,7 @@ you need it.</para>
 </section>
 
 
-<section xml:id="python"><title>Python</title>
+<section xml:id="sec-python"><title>Python</title>
 
 <para>
   Currently supported interpreters are <varname>python26</varname>, <varname>python27</varname>,
@@ -276,7 +276,7 @@ are provided with all modules included.</para>
   </varlistentry>
 
 </variablelist>
-<section xml:id="build-python-package"><title><varname>buildPythonPackage</varname> function</title>
+<section xml:id="ssec-build-python-package"><title><varname>buildPythonPackage</varname> function</title>
 
   <para>
   The function is implemented in <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/pkgs/development/python-modules/generic/default.nix">
@@ -420,11 +420,25 @@ twisted = buildPythonPackage {
       </para></listitem>
     </varlistentry>
 
+    <varlistentry>
+      <term><varname>makeWrapperArgs</varname></term>
+      <listitem><para>
+        A list of strings. Arguments to be passed to
+        <varname>makeWrapper</varname>, which wraps generated binaries. By
+        default, the arguments to <varname>makeWrapper</varname> set
+        <varname>PATH</varname> and <varname>PYTHONPATH</varname> environment
+        variables before calling the binary. Additional arguments here can
+        allow a developer to set environment variables which will be
+        available when the binary is run. For example,
+        <varname>makeWrapperArgs = ["--set FOO BAR" "--set BAZ QUX"]</varname>.
+      </para></listitem>
+    </varlistentry>
+
   </variablelist>
 
 </section>
 
-<section xml:id="python-build-env"><title><function>python.buildEnv</function> function</title>
+<section xml:id="ssec-python-build-env"><title><function>python.buildEnv</function> function</title>
   <para>
     Create Python environments using low-level <function>pkgs.buildEnv</function> function. Example <filename>default.nix</filename>:
 
@@ -470,7 +484,7 @@ python.buildEnv.override {
   </variablelist>
 </section>
 
-<section xml:id="python-tools"><title>Tools</title>
+<section xml:id="ssec-python-tools"><title>Tools</title>
 
 <para>Packages inside nixpkgs are written by hand. However many tools
 exist in community to help save time. No tool is preferred at the moment.
@@ -497,7 +511,7 @@ exist in community to help save time. No tool is preferred at the moment.
 
 </section>
 
-<section xml:id="python-development"><title>Development</title>
+<section xml:id="ssec-python-development"><title>Development</title>
 
   <para>
     To develop Python packages <function>buildPythonPackage</function> has
@@ -541,7 +555,7 @@ buildPythonPackage {
 
 </section>
 
-<section xml:id="python-faq"><title>FAQ</title>
+<section xml:id="ssec-python-faq"><title>FAQ</title>
 
 <variablelist>
 
@@ -583,7 +597,7 @@ sed -i '/ = data_files/d' setup.py</programlisting>
 </section>
 
 
-<section xml:id="python-contrib"><title>Contributing guidelines</title>
+<section xml:id="ssec-python-contrib"><title>Contributing guidelines</title>
 <para>
   Following rules are desired to be respected:
 </para>
@@ -611,7 +625,7 @@ sed -i '/ = data_files/d' setup.py</programlisting>
 </section>
 
 
-<section xml:id="ssec-language-ruby"><title>Ruby</title>
+<section xml:id="sec-language-ruby"><title>Ruby</title>
   <para>There currently is support to bundle applications that are packaged as Ruby gems. The utility "bundix" allows you to write a <filename>Gemfile</filename>, let bundler create a <filename>Gemfile.lock</filename>, and then convert
   this into a nix expression that contains all Gem dependencies automatically.</para>
 
@@ -652,7 +666,7 @@ and scalable.";
 
 </section>
 
-<section xml:id="ssec-language-go"><title>Go</title>
+<section xml:id="sec-language-go"><title>Go</title>
 
 <para>The function <varname>buildGoPackage</varname> builds
 standard Go packages.
@@ -662,20 +676,19 @@ standard Go packages.
 <programlisting>
 net = buildGoPackage rec {
   name = "go.net-${rev}";
-  goPackagePath = "code.google.com/p/go.net"; <co xml:id='ex-buildGoPackage-1' />
+  goPackagePath = "golang.org/x/net"; <co xml:id='ex-buildGoPackage-1' />
   subPackages = [ "ipv4" "ipv6" ]; <co xml:id='ex-buildGoPackage-2' />
-  rev = "28ff664507e4";
+  rev = "e0403b4e005";
-  src = fetchhg {
+  src = fetchFromGitHub {
     inherit rev;
-    url = "https://${goPackagePath}";
+    owner = "golang";
-    sha256 = "1lkz4c9pyz3yz2yz18hiycvlfhgy3jxp68bs7mv7bcfpaj729qav";
+    repo = "net";
+    sha256 = "1g7cjzw4g4301a3yqpbk8n1d4s97sfby2aysl275x04g0zh8jxqp";
   };
-  renameImports = [ <co xml:id='ex-buildGoPackage-3' />
+  goPackageAliases = [ "code.google.com/p/go.net" ]; <co xml:id='ex-buildGoPackage-3' />
-    "code.google.com/p/go.crypto golang.org/x/crypto"
-    "code.google.com/p/goprotobuf github.com/golang/protobuf"
-  ];
   propagatedBuildInputs = [ goPackages.text ]; <co xml:id='ex-buildGoPackage-4' />
   buildFlags = "--tags release"; <co xml:id='ex-buildGoPackage-5' />
+  disabled = isGo13;<co xml:id='ex-buildGoPackage-6' />
 };
 </programlisting>
 </example>
@@ -703,17 +716,18 @@ the following arguments are of special significance to the function:
     </para>
   </callout>
 
-  <callout arearefs='ex-buildGoPackage-4'>
+  <callout arearefs='ex-buildGoPackage-3'>
     <para>
-      <varname>renameImports</varname> is a list of import paths to be renamed before
+      <varname>goPackageAliases</varname> is a list of alternative import paths
-      building the package. The path to be renamed can be a regular expression.
+      that are valid for this library.
+      Packages that depend on this library will automatically rename
+      import paths that match any of the aliases to <literal>goPackagePath</literal>.
     </para>
     <para>
       In this example imports will be renamed from
-      <literal>code.google.com/p/go.crypto</literal> to
+      <literal>code.google.com/p/go.net</literal> to
-      <literal>golang.org/x/crypto</literal> and from
+      <literal>golang.org/x/net</literal> in every package that depend on the
-      <literal>code.google.com/p/goprotobuf</literal> to
+      <literal>go.net</literal> library.
-      <literal>github.com/golang/protobuf</literal>.
     </para>
   </callout>
 
@@ -732,6 +746,18 @@ the following arguments are of special significance to the function:
     </para>
   </callout>
 
+  <callout arearefs='ex-buildGoPackage-6'>
+    <para>
+      If <varname>disabled</varname> is <literal>true</literal>,
+      nix will refuse to build this package.
+    </para>
+    <para>
+      In this example the package will not be built for go 1.3. The <literal>isGo13</literal>
+      is an utility function that returns <literal>true</literal> if go used to build the
+      package has version 1.3.x.
+    </para>
+  </callout>
+
 </calloutlist>
 
 </para>
@@ -761,7 +787,7 @@ done
 </section>
 
 
-<section xml:id="ssec-language-java"><title>Java</title>
+<section xml:id="sec-language-java"><title>Java</title>
 
 <para>Ant-based Java packages are typically built from source as follows:
 
@@ -842,7 +868,7 @@ Runtime) instead of the OpenJRE.</para>
 </section>
 
 
-<section xml:id="ssec-language-lua"><title>Lua</title>
+<section xml:id="sec-language-lua"><title>Lua</title>
 
 <para>
   Lua packages are built by the <varname>buildLuaPackage</varname> function.  This function is
@@ -889,7 +915,7 @@ fileSystem = buildLuaPackage {
 
 </section>
 
-<section xml:id="ssec-language-coq"><title>Coq</title>
+<section xml:id="sec-language-coq"><title>Coq</title>
   <para>
     Coq libraries should be installed in
     <literal>$(out)/lib/coq/${coq.coq-version}/user-contrib/</literal>.

doc/meta.xml

@@ -82,7 +82,8 @@ hello-2.3  A program that produces a familiar, friendly greeting
 </para>
 
 
-<section><title>Standard meta-attributes</title>
+<section xml:id="sec-standard-meta-attributes"><title>Standard
+meta-attributes</title>
 
 <para>It is expected that each meta-attribute is one of the following:</para>
 

doc/package-notes.xml

@@ -141,7 +141,7 @@ $ make menuconfig ARCH=<replaceable>arch</replaceable></screen>
 
 <!--============================================================-->
 
-<section>
+<section xml:id="sec-xorg">
 
 <title>X.org</title>
 

doc/packageconfig.xml

@@ -67,7 +67,8 @@
 	<filename>lib/licenses.nix</filename> of the nix package tree.
     </para>
 
-<section><title>Modify packages via <literal>packageOverrides</literal></title>
+<section xml:id="sec-modify-via-packageOverrides"><title>Modify
+packages via <literal>packageOverrides</literal></title>
 
 <para>
 

doc/stdenv.xml

@@ -15,7 +15,8 @@ environment does everything automatically.  If
 can easily customise or override the various build phases.</para>
 
 
-<section><title>Using <literal>stdenv</literal></title>
+<section xml:id="sec-using-stdenv"><title>Using
+<literal>stdenv</literal></title>
 
 <para>To build a package with the standard environment, you use the
 function <varname>stdenv.mkDerivation</varname>, instead of the
@@ -124,7 +125,8 @@ genericBuild
 </section>
 
 
-<section><title>Tools provided by <literal>stdenv</literal></title>
+<section xml:id="sec-tools-of-stdenv"><title>Tools provided by
+<literal>stdenv</literal></title>
 
 <para>The standard environment provides the following packages:
 
@@ -225,7 +227,7 @@ genericBuild
 </section>
 
 
-<section xml:id="ssec-stdenv-phases"><title>Phases</title>
+<section xml:id="sec-stdenv-phases"><title>Phases</title>
 
 <para>The generic builder has a number of <emphasis>phases</emphasis>.
 Package builds are split into phases to make it easier to override
@@ -243,7 +245,8 @@ is convenient to override a phase from the derivation, while the
 latter is convenient from a build script.</para>
 
 
-<section><title>Controlling phases</title>
+<section xml:id="ssec-controlling-phases"><title>Controlling
+phases</title>
 
 <para>There are a number of variables that control what phases are
 executed and in what order:
@@ -327,7 +330,7 @@ executed and in what order:
 </section>
 
 
-<section><title>The unpack phase</title>
+<section xml:id="ssec-unpack-phase"><title>The unpack phase</title>
 
 <para>The unpack phase is responsible for unpacking the source code of
 the package.  The default implementation of
@@ -434,7 +437,7 @@ Additional file types can be supported by setting the
 </section>
 
 
-<section><title>The patch phase</title>
+<section xml:id="ssec-patch-phase"><title>The patch phase</title>
 
 <para>The patch phase applies the list of patches defined in the
 <varname>patches</varname> variable.</para>
@@ -477,7 +480,7 @@ Additional file types can be supported by setting the
 </section>
 
 
-<section><title>The configure phase</title>
+<section xml:id="ssec-configure-phase"><title>The configure phase</title>
 
 <para>The configure phase prepares the source tree for building.  The
 default <function>configurePhase</function> runs
@@ -573,7 +576,7 @@ script) if it exists.</para>
 </section>
 
 
-<section><title>The build phase</title>
+<section xml:id="build-phase"><title>The build phase</title>
 
 <para>The build phase is responsible for actually building the package
 (e.g. compiling it).  The default <function>buildPhase</function>
@@ -657,7 +660,7 @@ called, respectively.</para>
 </section>
 
 
-<section><title>The check phase</title>
+<section xml:id="ssec-check-phase"><title>The check phase</title>
 
 <para>The check phase checks whether the package was built correctly
 by running its test suite.  The default
@@ -717,7 +720,7 @@ doCheck = true;</programlisting>
 </section>
 
 
-<section><title>The install phase</title>
+<section xml:id="ssec-install-phase"><title>The install phase</title>
 
 <para>The install phase is responsible for installing the package in
 the Nix store under <envar>out</envar>.  The default
@@ -772,7 +775,7 @@ installTargets = "install-bin install-doc";</programlisting>
 </section>
 
 
-<section><title>The fixup phase</title>
+<section xml:id="ssec-fixup-phase"><title>The fixup phase</title>
 
 <para>The fixup phase performs some (Nix-specific) post-processing
 actions on the files installed under <filename>$out</filename> by the
@@ -895,7 +898,8 @@ following:
 </section>
 
 
-<section><title>The distribution phase</title>
+<section xml:id="ssec-distribution-phase"><title>The distribution
+phase</title>
 
 <para>The distribution phase is intended to produce a source
 distribution of the package.  The default
@@ -1199,7 +1203,7 @@ echo @foo@
 </section>
 
 
-<section><title>Purity in Nixpkgs</title>
+<section xml:id="sec-purity-in-nixpkgs"><title>Purity in Nixpkgs</title>
 
 <para>[measures taken to prevent dependencies on packages outside the
 store, and what you can do to prevent them]</para>

lib/customisation.nix

@@ -158,4 +158,27 @@ rec {
       drv' = (lib.head outputsList).value;
     in lib.deepSeq drv' drv';
 
+
+  /* Tests whether a derivation can be used by the current platform
+     Returns the derivation if true, otherwise null. */
+  shouldUsePkgSystem = system: pkg_: let pkg = (builtins.tryEval pkg_).value;
+    in if lib.any (x: x == system) (pkg.meta.platforms or [])
+      then pkg
+      else null;
+
+  /* Returns a configure flag string in an autotools format
+     trueStr: Prepended when cond is true
+     falseStr: Prepended when cond is false
+     cond: The condition for the prepended string type and value
+     name: The flag name
+     val: The value of the flag only set when cond is true */
+  mkFlag = trueStr: falseStr: cond: name: val:
+    if cond == null then null else
+      "--${if cond != false then trueStr else falseStr}${name}"
+      + "${if val != null && cond != false then "=${val}" else ""}";
+
+  /* Flag setting helpers for autotools like packages */
+  mkEnable = mkFlag "enable-" "disable-";
+  mkWith = mkFlag "with-" "without-";
+  mkOther = mkFlag "" "" true;
 }

lib/licenses.nix

@@ -85,6 +85,11 @@ lib.mapAttrs (n: v: v // { shortName = n; }) rec {
     fullName = "Creative Commons Zero v1.0 Universal";
   };
 
+  cc-by-sa-25 = spdx {
+    spdxId = "CC-BY-SA-2.5";
+    fullName = "Creative Commons Attribution Share Alike 2.5";
+  };
+
   cc-by-30 = spdx {
     spdxId = "CC-BY-3.0";
     fullName = "Creative Commons Attribution 3.0";
@@ -403,6 +408,11 @@ lib.mapAttrs (n: v: v // { shortName = n; }) rec {
     fullName = "The Unlicense";
   };
 
+  vim = spdx {
+    spdxId = "Vim";
+    fullName = "Vim License";
+  };
+
   vsl10 = spdx {
     spdxId = "VSL-1.0";
     fullName = "Vovida Software License v1.0";

lib/maintainers.nix

@@ -8,6 +8,7 @@
   abaldeau = "Andreas Baldeau <andreas@baldeau.net>";
   abbradar = "Nikolay Amiantov <ab@fmap.me>";
   aforemny = "Alexander Foremny <alexanderforemny@googlemail.com>";
+  aflatter = "Alexander Flatter <flatter@fastmail.fm>";
   aherrmann = "Andreas Herrmann <andreash87@gmx.ch>";
   ak = "Alexander Kjeldaas <ak@formalprivacy.com>";
   akc = "Anders Claesson <akc@akc.is>";
@@ -43,6 +44,7 @@
   bosu = "Boris Sukholitko <boriss@gmail.com>";
   bramd = "Bram Duvigneau <bram@bramd.nl>";
   bstrik = "Berno Strik <dutchman55@gmx.com>";
+  c0dehero = "CodeHero <codehero@nerdpol.ch>";
   calrama = "Moritz Maxeiner <moritz@ucworks.org>";
   campadrenalin = "Philip Horger <campadrenalin@gmail.com>";
   cdepillabout = "Dennis Gosnell <cdep.illabout@gmail.com>";
@@ -70,6 +72,7 @@
   eikek = "Eike Kettner <eike.kettner@posteo.de>";
   ellis = "Ellis Whitehead <nixos@ellisw.net>";
   emery = "Emery Hemingway <emery@vfemail.net>";
+  ericbmerritt = "Eric Merritt <eric@afiniate.com>";
   ertes = "Ertugrul Söylemez <ertesx@gmx.de>";
   exlevan = "Alexey Levan <exlevan@gmail.com>";
   falsifian = "James Cook <james.cook@utoronto.ca>";
@@ -97,6 +100,7 @@
   iand675 = "Ian Duncan <ian@iankduncan.com>";
   ianwookim = "Ian-Woo Kim <ianwookim@gmail.com>";
   iElectric = "Domen Kozar <domen@dev.si>";
+  ikervagyok = "Balázs Lengyel <ikervagyok@gmail.com>";
   iyzsong = "Song Wenwu <iyzsong@gmail.com>";
   j-keck = "Jürgen Keck <jhyphenkeck@gmail.com>";
   jagajaga = "Arseniy Seroka <ars.seroka@gmail.com>";
@@ -110,6 +114,7 @@
   joelteon = "Joel Taylor <me@joelt.io>";
   jpbernardy = "Jean-Philippe Bernardy <jeanphilippe.bernardy@gmail.com>";
   jwiegley = "John Wiegley <johnw@newartisans.com>";
+  jwilberding = "Jordan Wilberding <jwilberding@afiniate.com>";
   jzellner = "Jeff Zellner <jeffz@eml.cc>";
   kkallio = "Karn Kallio <tierpluspluslists@gmail.com>";
   koral = "Koral <koral@mailoo.org>";
@@ -133,6 +138,8 @@
   meditans = "Carlo Nucera <meditans@gmail.com>";
   meisternu = "Matt Miemiec <meister@krutt.org>";
   michelk = "Michel Kuhlmann <michel@kuhlmanns.info>";
+  mirdhyn = "Merlin Gaillard <mirdhyn@gmail.com>";
+  mschristiansen = "Mikkel Christiansen <mikkel@rheosystems.com>";
   modulistic = "Pablo Costa <modulistic@gmail.com>";
   mornfall = "Petr Ročkai <me@mornfall.net>";
   MP2E = "Cray Elliott <MP2E@archlinux.us>";
@@ -149,10 +156,12 @@
   offline = "Jaka Hudoklin <jakahudoklin@gmail.com>";
   olcai = "Erik Timan <dev@timan.info>";
   orbitz = "Malcolm Matalka <mmatalka@gmail.com>";
+  osener = "Ozan Sener <ozan@ozansener.com>";
   page = "Carles Pagès <page@cubata.homelinux.net>";
   paholg = "Paho Lurie-Gregg <paho@paholg.com>";
   pakhfn = "Fedor Pakhomov <pakhfn@gmail.com>";
   pashev = "Igor Pashev <pashev.igor@gmail.com>";
+  pesterhazy = "Paulus Esterhazy <pesterhazy@gmail.com>";
   phausmann = "Philipp Hausmann <nix@314.ch>";
   philandstuff = "Philip Potter <philip.g.potter@gmail.com>";
   phreedom = "Evgeny Egorochkin <phreedom@yandex.ru>";
@@ -162,6 +171,7 @@
   pkmx = "Chih-Mao Chen <pkmx.tw@gmail.com>";
   plcplc = "Philip Lykke Carlsen <plcplc@gmail.com>";
   pmahoney = "Patrick Mahoney <pat@polycrystal.org>";
+  pmiddend = "Philipp Middendorf <pmidden@secure.mailbox.org>";
   prikhi = "Pavan Rikhi <pavan.rikhi@gmail.com>";
   pSub = "Pascal Wittmann <mail@pascal-wittmann.de>";
   puffnfresh = "Brian McKenna <brian@brianmckenna.org>";
@@ -195,6 +205,7 @@
   smironov = "Sergey Mironov <ierton@gmail.com>";
   sprock = "Roger Mason <rmason@mun.ca>";
   spwhitt = "Spencer Whitt <sw@swhitt.me>";
+  stephenmw = "Stephen Weinberg <stephen@q5comm.com>";
   sztupi = "Attila Sztupak <attila.sztupak@gmail.com>";
   tailhook = "Paul Colomiets <paul@colomiets.name>";
   taktoa = "Remy Goldschmidt <taktoa@gmail.com>";
@@ -222,6 +233,7 @@
   winden = "Antonio Vargas Gonzalez <windenntw@gmail.com>";
   wizeman = "Ricardo M. Correia <rcorreia@wizy.org>";
   wjlroe = "William Roe <willroe@gmail.com>";
+  womfoo = "Kranium Gikos Mendoza <kranium@gikos.net>";
   wkennington = "William A. Kennington III <william@wkennington.com>";
   wmertens = "Wout Mertens <Wout.Mertens@gmail.com>";
   wscott = "Wayne Scott <wsc9tt@gmail.com>";

maintainers/scripts/hydra_eval_check

@@ -6,6 +6,7 @@ hydra_eval_jobs \
   --argstr system i686-linux \
   --argstr system x86_64-darwin \
   --argstr system i686-cygwin \
+  --argstr system x86_64-cygwin \
   --argstr system i686-freebsd \
   --arg officialRelease false \
   --arg nixpkgs "{ outPath = builtins.storePath ./. ; rev = 1234; }" \

nixos/doc/manual/development/sources.xml

@@ -24,6 +24,9 @@ $ mkdir -p <replaceable>/my/sources</replaceable>
 $ cd <replaceable>/my/sources</replaceable>
 $ nix-env -i git
 $ git clone git://github.com/NixOS/nixpkgs.git
+$ cd nixpkgs
+$ git remote add channels git://github.com/NixOS/nixpkgs-channels.git
+$ git remote update channels
 </screen>
 
 This will check out the latest NixOS sources to
@@ -31,7 +34,12 @@ This will check out the latest NixOS sources to
 and the Nixpkgs sources to
 <filename><replaceable>/my/sources</replaceable>/nixpkgs</filename>.
 (The NixOS source tree lives in a subdirectory of the Nixpkgs
-repository.)</para>
+repository.) The remote <literal>channels</literal> refers to a
+read-only repository that tracks the Nixpkgs/NixOS channels (see <xref
+linkend="sec-upgrading"/> for more information about channels). Thus,
+the Git branch <literal>channels/nixos-14.12</literal> will contain
+the latest built and tested version available in the
+<literal>nixos-14.12</literal> channel.</para>
 
 <para>It’s often inconvenient to develop directly on the master
 branch, since if somebody has just committed (say) a change to GCC,
@@ -40,28 +48,32 @@ rebuild everything from source. So you may want to create a local
 branch based on your current NixOS version:
 
 <screen>
-$ <replaceable>/my/sources</replaceable>/nixpkgs/maintainers/scripts/update-channel-branches.sh
+$ nixos-version
-Fetching channels from https://nixos.org/channels:
+14.04.273.ea1952b (Baboon)
- * [new branch]      cbe467e           -> channels/remotes/nixos-unstable
+
-Fetching channels from nixos-version:
+$ git checkout -b local ea1952b
- * [new branch]      9ff4738           -> channels/current-system
-Fetching channels from ~/.nix-defexpr:
- * [new branch]      0d4acad           -> channels/root/nixos
-$ git checkout -b local channels/current-system
 </screen>
 
-Or, to base your local branch on the latest version available in the
+Or, to base your local branch on the latest version available in a
 NixOS channel:
 
 <screen>
-$ <replaceable>/my/sources</replaceable>/nixpkgs/maintainers/scripts/update-channel-branches.sh
+$ git remote update channels
-$ git checkout -b local channels/remotes/nixos-unstable
+$ git checkout -b local channels/nixos-14.12
 </screen>
 
-You can then use <command>git rebase</command> to sync your local
+(Replace <literal>nixos-14.12</literal> with the name of the channel
-branch with the upstream branch, and use <command>git
+you want to use.) You can use <command>git merge</command> or
-cherry-pick</command> to copy commits from your local branch to the
+<command>git rebase</command> to keep your local branch in sync with
-upstream branch.</para>
+the channel, e.g.
+
+<screen>
+$ git remote update channels
+$ git merge channels/nixos-14.12
+</screen>
+
+You can use <command>git cherry-pick</command> to copy commits from
+your local branch to the upstream branch.</para>
 
 <para>If you want to rebuild your system using your (modified)
 sources, you need to tell <command>nixos-rebuild</command> about them

nixos/doc/manual/development/writing-nixos-tests.xml

@@ -154,6 +154,15 @@ startAll;
     log.</para></listitem>
   </varlistentry>
 
+  <varlistentry>
+    <term><methodname>getScreenText</methodname></term>
+    <listitem><para>Return a textual representation of what is currently
+    visible on the machine's screen using optical character
+    recognition.</para>
+    <note><para>This requires passing <option>enableOCR</option> to the test
+    attribute set.</para></note></listitem>
+  </varlistentry>
+
   <varlistentry>
     <term><methodname>sendMonitorCommand</methodname></term>
     <listitem><para>Send a command to the QEMU monitor. This is rarely
@@ -237,6 +246,15 @@ startAll;
     connections.</para></listitem>
   </varlistentry>
 
+  <varlistentry>
+    <term><methodname>waitForText</methodname></term>
+    <listitem><para>Wait until the supplied regular expressions matches
+    the textual contents of the screen by using optical character recognition
+    (see <methodname>getScreenText</methodname>).</para>
+    <note><para>This requires passing <option>enableOCR</option> to the test
+    attribute set.</para></note></listitem>
+  </varlistentry>
+
   <varlistentry>
     <term><methodname>waitForWindow</methodname></term>
     <listitem><para>Wait until an X11 window has appeared whose name

nixos/doc/manual/release-notes/rl-unstable.xml

@@ -17,6 +17,7 @@
 
 <itemizedlist>
 <listitem><para><literal>brltty</literal></para></listitem>
+<listitem><para><literal>marathon</literal></para></listitem>
 </itemizedlist>
 </para>
 
@@ -61,6 +62,15 @@ was accordingly renamed to <literal>bomi</literal>
   </para>
 </listitem>
 
+<listitem>
+  <para>
+    HPLIP (printer, scanner, and fax drivers for HP devices) has
+    been updated to version <literal>3.15.4</literal>. This release
+    adds support for the <literal>arm6l-linux</literal> and
+    <literal>arm7l-linux</literal> platforms.
+  </para>
+</listitem>
+
 
 </itemizedlist>
 </para>

nixos/lib/test-driver/Machine.pm

@@ -9,6 +9,7 @@ use FileHandle;
 use Cwd;
 use File::Basename;
 use File::Path qw(make_path);
+use File::Slurp;
 
 
 my $showGraphics = defined $ENV{'DISPLAY'};
@@ -493,6 +494,44 @@ sub screenshot {
 }
 
 
+# Take a screenshot and return the result as text using optical character
+# recognition.
+sub getScreenText {
+    my ($self) = @_;
+
+    system("command -v tesseract &> /dev/null") == 0
+        or die "getScreenText used but enableOCR is false";
+
+    my $text;
+    $self->nest("performing optical character recognition", sub {
+        my $tmpbase = Cwd::abs_path(".")."/ocr";
+        my $tmpin = $tmpbase."in.ppm";
+        my $tmpout = "$tmpbase.ppm";
+
+        $self->sendMonitorCommand("screendump $tmpin");
+        system("ppmtopgm $tmpin | pamscale 4 -filter=lanczos > $tmpout") == 0
+            or die "cannot scale screenshot";
+        unlink $tmpin;
+        system("tesseract $tmpout $tmpbase") == 0 or die "OCR failed";
+        unlink $tmpout;
+        $text = read_file("$tmpbase.txt");
+        unlink "$tmpbase.txt";
+    });
+    return $text;
+}
+
+
+# Wait until a specific regexp matches the textual contents of the screen.
+sub waitForText {
+    my ($self, $regexp) = @_;
+    $self->nest("waiting for $regexp to appear on the screen", sub {
+        retry sub {
+            return 1 if $self->getScreenText =~ /$regexp/;
+        }
+    });
+}
+
+
 # Wait until it is possible to connect to the X server.  Note that
 # testing the existence of /tmp/.X11-unix/X0 is insufficient.
 sub waitForX {

nixos/lib/testing.nix

@@ -28,7 +28,7 @@ rec {
 
         wrapProgram $out/bin/nixos-test-driver \
           --prefix PATH : "${qemu_kvm}/bin:${vde2}/bin:${netpbm}/bin:${coreutils}/bin" \
-          --prefix PERL5LIB : "${lib.makePerlPath [ perlPackages.TermReadLineGnu perlPackages.XMLWriter perlPackages.IOTty ]}:$out/lib/perl5/site_perl"
+          --prefix PERL5LIB : "${with perlPackages; lib.makePerlPath [ TermReadLineGnu XMLWriter IOTty FileSlurp ]}:$out/lib/perl5/site_perl"
       '';
   };
 
@@ -68,7 +68,12 @@ rec {
 
 
   makeTest =
-    { testScript, makeCoverageReport ? false, name ? "unnamed", ... } @ t:
+    { testScript
+    , makeCoverageReport ? false
+    , enableOCR ? false
+    , name ? "unnamed"
+    , ...
+    } @ t:
 
     let
       testDriverName = "nixos-test-driver-${name}";
@@ -86,6 +91,8 @@ rec {
 
       vms = map (m: m.config.system.build.vm) (lib.attrValues nodes);
 
+      ocrProg = tesseract.override { enableLanguages = [ "eng" ]; };
+
       # Generate onvenience wrappers for running the test driver
       # interactively with the specified network, and for starting the
       # VMs from the command line.
@@ -102,12 +109,14 @@ rec {
           vms="$(for i in ${toString vms}; do echo $i/bin/run-*-vm; done)"
           wrapProgram $out/bin/nixos-test-driver \
             --add-flags "$vms" \
+            ${lib.optionalString enableOCR "--prefix PATH : '${ocrProg}/bin'"} \
             --run "testScript=\"\$(cat $out/test-script)\"" \
             --set testScript '"$testScript"' \
             --set VLANS '"${toString vlans}"'
           ln -s ${testDriver}/bin/nixos-test-driver $out/bin/nixos-run-vms
           wrapProgram $out/bin/nixos-run-vms \
             --add-flags "$vms" \
+            ${lib.optionalString enableOCR "--prefix PATH : '${ocrProg}/bin'"} \
             --set tests '"startAll; joinAll;"' \
             --set VLANS '"${toString vlans}"' \
             ${lib.optionalString (builtins.length vms == 1) "--set USE_SERIAL 1"}

nixos/modules/config/fonts/corefonts.nix

@@ -1,3 +1,6 @@
+# This module is deprecated, since you can just say ‘fonts.fonts = [
+# pkgs.corefonts ];’ instead.
+
 { config, lib, pkgs, ... }:
 
 with lib;
@@ -9,6 +12,7 @@ with lib;
     fonts = {
 
       enableCoreFonts = mkOption {
+        visible = false;
         default = false;
         description = ''
           Whether to include Microsoft's proprietary Core Fonts.  These fonts

nixos/modules/config/pulseaudio.nix

@@ -12,7 +12,7 @@ let
 
   # Forces 32bit pulseaudio and alsaPlugins to be built/supported for apps
   # using 32bit alsa on 64bit linux.
-  enable32BitAlsaPlugins = stdenv.isx86_64 && (pkgs_i686.alsaLib != null && pkgs_i686.pulseaudio != null);
+  enable32BitAlsaPlugins = stdenv.isx86_64 && (pkgs_i686.alsaLib != null && pkgs_i686.libpulseaudio != null);
 
   ids = config.ids;
 

nixos/modules/installer/tools/nixos-checkout.nix

@@ -1,5 +1,5 @@
-# This module generates the nixos-checkout script, which replaces the
+# This module generates the nixos-checkout script, which performs a
-# Nixpkgs source trees in /etc/nixos/nixpkgs with a Git checkout.
+# checkout of the Nixpkgs Git repository.
 
 { config, lib, pkgs, ... }:
 
@@ -37,8 +37,19 @@ let
             mv nixpkgs nixpkgs-$backupTimestamp
         fi
 
-        # Check out the NixOS and Nixpkgs sources.
+        # Check out the Nixpkgs sources.
-        git clone git://github.com/NixOS/nixpkgs.git nixpkgs
+        if ! [ -e nixpkgs/.git ]; then
+            echo "Creating repository in $prefix/nixpkgs..."
+            git init --quiet nixpkgs
+        else
+            echo "Updating repository in $prefix/nixpkgs..."
+        fi
+        cd nixpkgs
+        git remote add origin git://github.com/NixOS/nixpkgs.git || true
+        git remote add channels git://github.com/NixOS/nixpkgs-channels.git || true
+        git remote set-url origin --push git@github.com:NixOS/nixpkgs.git
+        git remote update
+        git checkout master
       '';
    };
 

nixos/modules/misc/ids.nix

@@ -196,7 +196,6 @@
       nylon = 168;
       apache-kafka = 169;
       panamax = 170;
-      marathon = 171;
       exim = 172;
       #fleet = 173; # unused
       #input = 174; # unused
@@ -217,6 +216,7 @@
       lambdabot = 191;
       asterisk = 192;
       plex = 193;
+      bird = 195;
 
       # When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!
 
@@ -390,7 +390,6 @@
       gitlab = 165;
       nylon = 168;
       panamax = 170;
-      #marathon = 171; # unused
       exim = 172;
       fleet = 173;
       input = 174;
@@ -412,6 +411,7 @@
       #asterisk = 192; # unused
       plex = 193;
       sabnzbd = 194;
+      bird = 195;
 
       # When adding a gid, make sure it doesn't match an existing
       # uid. Users and groups with the same name should have equal

nixos/modules/module-list.nix

@@ -62,6 +62,7 @@
   ./programs/environment.nix
   ./programs/info.nix
   ./programs/ibus.nix
+  ./programs/kbdlight.nix
   ./programs/light.nix
   ./programs/nano.nix
   ./programs/screen.nix
@@ -201,6 +202,7 @@
   ./services/misc/mediatomb.nix
   ./services/misc/mesos-master.nix
   ./services/misc/mesos-slave.nix
+  ./services/misc/mwlib.nix
   ./services/misc/nix-daemon.nix
   ./services/misc/nix-gc.nix
   ./services/misc/nixos-manual.nix
@@ -221,6 +223,7 @@
   ./services/monitoring/bosun.nix
   ./services/monitoring/cadvisor.nix
   ./services/monitoring/collectd.nix
+  ./services/monitoring/das_watchdog.nix
   ./services/monitoring/dd-agent.nix
   ./services/monitoring/graphite.nix
   ./services/monitoring/monit.nix
@@ -251,6 +254,7 @@
   ./services/networking/atftpd.nix
   ./services/networking/avahi-daemon.nix
   ./services/networking/bind.nix
+  ./services/networking/bird.nix
   ./services/networking/bitlbee.nix
   ./services/networking/btsync.nix
   ./services/networking/charybdis.nix
@@ -264,6 +268,7 @@
   ./services/networking/dhcpd.nix
   ./services/networking/dnscrypt-proxy.nix
   ./services/networking/dnsmasq.nix
+  ./services/networking/docker-registry-server.nix
   ./services/networking/ejabberd.nix
   ./services/networking/firefox/sync-server.nix
   ./services/networking/firewall.nix
@@ -289,6 +294,7 @@
   ./services/networking/nat.nix
   ./services/networking/networkmanager.nix
   ./services/networking/ngircd.nix
+  ./services/networking/nix-serve.nix
   ./services/networking/notbit.nix
   ./services/networking/nsd.nix
   ./services/networking/ntopng.nix
@@ -303,6 +309,7 @@
   ./services/networking/privoxy.nix
   ./services/networking/prosody.nix
   ./services/networking/quassel.nix
+  ./services/networking/racoon.nix
   ./services/networking/radicale.nix
   ./services/networking/radvd.nix
   ./services/networking/rdnssd.nix
@@ -403,12 +410,14 @@
   ./services/x11/xserver.nix
   ./system/activation/activation-script.nix
   ./system/activation/top-level.nix
+  ./system/boot/coredump.nix
   ./system/boot/emergency-mode.nix
   ./system/boot/kernel.nix
   ./system/boot/kexec.nix
   ./system/boot/loader/efi.nix
   ./system/boot/loader/loader.nix
   ./system/boot/loader/generations-dir/generations-dir.nix
+  ./system/boot/loader/generic-extlinux-compatible
   ./system/boot/loader/grub/grub.nix
   ./system/boot/loader/grub/ipxe.nix
   ./system/boot/loader/grub/memtest.nix
@@ -433,6 +442,7 @@
   ./tasks/filesystems.nix
   ./tasks/filesystems/btrfs.nix
   ./tasks/filesystems/cifs.nix
+  ./tasks/filesystems/exfat.nix
   ./tasks/filesystems/ext.nix
   ./tasks/filesystems/f2fs.nix
   ./tasks/filesystems/jfs.nix
@@ -461,5 +471,6 @@
   ./virtualisation/openvswitch.nix
   ./virtualisation/parallels-guest.nix
   ./virtualisation/virtualbox-guest.nix
+  ./virtualisation/vmware-guest.nix
   ./virtualisation/xen-dom0.nix
 ]

nixos/modules/profiles/minimal.nix

@@ -8,4 +8,5 @@ with lib;
 {
   environment.noXlibs = mkDefault true;
   i18n.supportedLocales = [ config.i18n.defaultLocale ];
+  services.nixosManual.enable = mkDefault false;
 }

nixos/modules/programs/kbdlight.nix

@@ -0,0 +1,16 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.programs.kbdlight;
+
+in
+{
+  options.programs.kbdlight.enable = mkEnableOption "kbdlight";
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.kbdlight ];
+    security.setuidPrograms = [ "kbdlight" ];
+  };
+}

nixos/modules/programs/venus.nix

@@ -166,7 +166,7 @@ in
         script = "exec venus-planet ${configFile}";
         serviceConfig.User = "${cfg.user}";
         serviceConfig.Group = "${cfg.group}";
-        environment.OPENSSL_X509_CERT_FILE = "/etc/ssl/certs/ca-bundle.crt";
+        environment.SSL_CERT_FILE = "/etc/ssl/certs/ca-bundle.crt";
         startAt = cfg.dates;
       };
 

nixos/modules/security/ca.nix

@@ -22,7 +22,7 @@ in
     security.pki.certificateFiles = mkOption {
       type = types.listOf types.path;
       default = [];
-      example = literalExample "[ \"\${pkgs.cacert}/etc/ca-bundle.crt\" ]";
+      example = literalExample "[ \"\${pkgs.cacert}/ca-bundle.crt\" ]";
       description = ''
         A list of files containing trusted root certificates in PEM
         format. These are concatenated to form
@@ -53,7 +53,7 @@ in
 
   config = {
 
-    security.pki.certificateFiles = [ "${pkgs.cacert}/etc/ca-bundle.crt" ];
+    security.pki.certificateFiles = [ "${pkgs.cacert}/ca-bundle.crt" ];
 
     # NixOS canonical location + Debian/Ubuntu/Arch/Gentoo compatibility.
     environment.etc."ssl/certs/ca-certificates.crt".source = caBundle;
@@ -66,8 +66,6 @@ in
 
     environment.sessionVariables =
       { SSL_CERT_FILE          = "/etc/ssl/certs/ca-certificates.crt";
-        # FIXME: unneeded - remove eventually.
-        OPENSSL_X509_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
         # FIXME: unneeded - remove eventually.
         GIT_SSL_CAINFO         = "/etc/ssl/certs/ca-certificates.crt";
       };

nixos/modules/services/backup/postgresql-backup.nix

@@ -3,7 +3,7 @@
 with lib;
 
 let
-  inherit (pkgs) postgresql gzip;
+  inherit (pkgs) gzip;
 
   location = config.services.postgresqlBackup.location;
 

nixos/modules/services/misc/apache-kafka.nix

@@ -143,6 +143,7 @@ in {
         '';
         User = "apache-kafka";
         PermissionsStartOnly = true;
+        SuccessExitStatus = "0 143";
       };
       preStart = ''
         mkdir -m 0700 -p ${concatStringsSep " " cfg.logDirs}

nixos/modules/services/misc/mesos-slave.nix

@@ -12,6 +12,8 @@ let
   attribsArg = optionalString (cfg.attributes != {})
                               "--attributes=${mkAttributes cfg.attributes}";
 
+  containerizers = [ "mesos" ] ++ (optional cfg.withDocker "docker");
+
 in {
 
   options.services.mesos = {
@@ -22,8 +24,14 @@ in {
         type = types.uniq types.bool;
       };
 
+      ip = mkOption {
+        description = "IP address to listen on.";
+        default = "0.0.0.0";
+        type = types.string;
+      };
+
       port = mkOption {
-        description = "Mesos Slave port";
+        description = "Port to listen on.";
         default = 5051;
         type = types.int;
       };
@@ -43,6 +51,12 @@ in {
         type = types.bool;
       };
 
+      withDocker = mkOption {
+        description = "Enable the docker containerizer.";
+        default = config.virtualisation.docker.enable;
+        type = types.bool;
+      };
+
       workDir = mkOption {
         description = "The Mesos work directory.";
         default = "/var/lib/mesos/slave";
@@ -92,17 +106,18 @@ in {
       description = "Mesos Slave";
       wantedBy = [ "multi-user.target" ];
       after = [ "network-interfaces.target" ];
-      environment.MESOS_CONTAINERIZERS = "docker,mesos";
+      environment.MESOS_CONTAINERIZERS = concatStringsSep "," containerizers;
       serviceConfig = {
         ExecStart = ''
           ${pkgs.mesos}/bin/mesos-slave \
+            --ip=${cfg.ip} \
             --port=${toString cfg.port} \
             --master=${cfg.master} \
-            ${optionalString cfg.withHadoop "--hadoop-home=${pkgs.hadoop}"} \
-            ${attribsArg} \
             --work_dir=${cfg.workDir} \
             --logging_level=${cfg.logLevel} \
-            --docker=${pkgs.docker}/libexec/docker/docker \
+            ${attribsArg} \
+            ${optionalString cfg.withHadoop "--hadoop-home=${pkgs.hadoop}"} \
+            ${optionalString cfg.withDocker "--docker=${pkgs.docker}/libexec/docker/docker"} \
             ${toString cfg.extraCmdLineOptions}
         '';
         PermissionsStartOnly = true;

nixos/modules/services/misc/mwlib.nix

@@ -0,0 +1,258 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.mwlib;
+  pypkgs = pkgs.python27Packages;
+
+  inherit (pypkgs) python mwlib;
+
+  user = mkOption {
+    default = "nobody";
+    type = types.str;
+    description = "User to run as.";
+  };
+
+in
+{
+
+  options.services.mwlib = {
+
+    nserve = {
+      enable = mkOption {
+        default = false;
+        type = types.bool;
+        description = ''
+          Whether to enable nserve. Nserve is a HTTP
+          server.  The Collection extension is talking to
+          that program directly.  Nserve uses at least
+          one qserve instance in order to distribute
+          and manage jobs.
+        '';
+      }; # nserve.enable
+
+      port = mkOption {
+        default = 8899;
+        type = types.int;
+        description = "Specify port to listen on.";
+      }; # nserve.port
+
+      address = mkOption {
+        default = "127.0.0.1";
+        type = types.str;
+        description = "Specify network interface to listen on.";
+      }; # nserve.address
+
+      qserve = mkOption {
+        default = [ "${cfg.qserve.address}:${toString cfg.qserve.port}" ];
+        type = types.listOf types.str;
+        description = "Register qserve instance.";
+      }; # nserve.qserve
+
+      inherit user;
+    }; # nserve
+
+    qserve = {
+      enable = mkOption {
+        default = false;
+        type = types.bool;
+        description = ''
+          A job queue server used to distribute and manage
+          jobs. You should start one qserve instance
+          for each machine that is supposed to render pdf
+          files. Unless you’re operating the Wikipedia
+          installation, one machine should suffice.
+        '';
+      }; # qserve.enable
+
+      port = mkOption {
+        default = 14311;
+        type = types.int;
+        description = "Specify port to listen on.";
+      }; # qserve.port
+
+      address = mkOption {
+        default = "127.0.0.1";
+        type = types.str;
+        description = "Specify network interface to listen on.";
+      }; # qserve.address
+
+      datadir = mkOption {
+        default = "/var/lib/mwlib-qserve";
+        type = types.path;
+        description = "qserve data directory (FIXME: unused?)";
+      }; # qserve.datadir
+
+      allow = mkOption {
+        default = [ "127.0.0.1" ];
+        type = types.listOf types.str;
+        description = "List of allowed client IPs. Empty means any.";
+      }; # qserve.allow
+
+      inherit user;
+    }; # qserve
+
+    nslave = {
+      enable = mkOption {
+        default = cfg.qserve.enable;
+        type = types.bool;
+        description = ''
+          Pulls new jobs from exactly one qserve instance
+          and calls the zip and render programs
+          in order to download article collections and
+          convert them to different output formats. Nslave
+          uses a cache directory to store the generated
+          documents. Nslave also starts an internal http
+          server serving the content of the cache directory.
+        '';
+      }; # nslave.enable
+
+      cachedir = mkOption {
+        default = "/var/cache/mwlib-nslave";
+        type = types.path;
+        description = "Directory to store generated documents.";
+      }; # nslave.cachedir
+
+      numprocs = mkOption {
+        default = 10;
+        type = types.int;
+        description = "Number of parallel jobs to be executed.";
+      }; # nslave.numprocs
+
+      http = mkOption {
+        default = {};
+        description = ''
+          Internal http server serving the content of the cache directory.
+          You have to enable it, or use your own way for serving files
+          and set the http.url option accordingly.
+          '';
+        type = types.submodule ({
+          options = {
+            enable = mkOption {
+              default = true;
+              type = types.bool;
+              description = "Enable internal http server.";
+            }; # nslave.http.enable
+
+            port = mkOption {
+              default = 8898;
+              type = types.int;
+              description = "Port to listen to when serving files from cache.";
+            }; # nslave.http.port
+
+            address = mkOption {
+              default = "127.0.0.1";
+              type = types.str;
+              description = "Specify network interface to listen on.";
+            }; # nslave.http.address
+
+            url = mkOption {
+              default = "http://localhost:${toString cfg.nslave.http.port}/cache";
+              type = types.str;
+              description = ''
+                Specify URL for accessing generated files from cache.
+                The Collection extension of Mediawiki won't be able to
+                download files without it.
+                '';
+            }; # nslave.http.url
+          };
+        }); # types.submodule
+      }; # nslave.http
+
+      inherit user;
+    }; # nslave
+
+  }; # options.services
+
+  config = { 
+
+    systemd.services.mwlib-nserve = mkIf cfg.nserve.enable
+    {
+      description = "mwlib network interface";
+
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" "mwlib-qserve.service" ];
+
+      serviceConfig = {
+        ExecStart = concatStringsSep " " (
+          [
+            "${mwlib}/bin/nserve"
+            "--port ${toString cfg.nserve.port}"
+            "--interface ${cfg.nserve.address}"
+          ] ++ cfg.nserve.qserve
+        );
+        User = cfg.nserve.user;
+      };
+    }; # systemd.services.mwlib-nserve
+
+    systemd.services.mwlib-qserve = mkIf cfg.qserve.enable
+    {
+      description = "mwlib job queue server";
+
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" "local-fs.target" ];
+
+      preStart = ''
+        mkdir -pv '${cfg.qserve.datadir}'
+        chown -Rc ${cfg.qserve.user}:`id -ng ${cfg.qserve.user}` '${cfg.qserve.datadir}'
+        chmod -Rc u=rwX,go= '${cfg.qserve.datadir}'
+      '';
+
+      serviceConfig = {
+        ExecStart = concatStringsSep " " (
+          [
+            "${mwlib}/bin/mw-qserve"
+            "-p ${toString cfg.qserve.port}"
+            "-i ${cfg.qserve.address}"
+            "-d ${cfg.qserve.datadir}"
+          ] ++ map (a: "-a ${a}") cfg.qserve.allow
+        );
+        User = cfg.qserve.user;
+        PermissionsStartOnly = true;
+      };
+    }; # systemd.services.mwlib-qserve
+
+    systemd.services.mwlib-nslave = mkIf cfg.nslave.enable
+    {
+      description = "mwlib worker";
+
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" "local-fs.target" ];
+
+      preStart = ''
+        mkdir -pv '${cfg.nslave.cachedir}'
+        chown -Rc ${cfg.nslave.user}:`id -ng ${cfg.nslave.user}` '${cfg.nslave.cachedir}'
+        chmod -Rc u=rwX,go= '${cfg.nslave.cachedir}'
+      '';
+
+      environment = {
+        PYTHONPATH = concatMapStringsSep ":"
+          (m: "${pypkgs.${m}}/lib/${python.libPrefix}/site-packages")
+          [ "mwlib-rl" "mwlib-ext" "pygments" ];
+      };
+
+      serviceConfig = {
+        ExecStart = concatStringsSep " " (
+          [
+            "${mwlib}/bin/nslave"
+            "--cachedir ${cfg.nslave.cachedir}"
+            "--numprocs ${toString cfg.nslave.numprocs}"
+            "--url ${cfg.nslave.http.url}"
+          ] ++ (
+            if cfg.nslave.http.enable then
+            [
+              "--serve-files-port ${toString cfg.nslave.http.port}"
+              "--serve-files-address ${cfg.nslave.http.address}"
+            ] else
+            [
+              "--no-serve-files"
+            ]
+          ));
+        User = cfg.nslave.user;
+        PermissionsStartOnly = true;
+      };
+    }; # systemd.services.mwlib-nslave
+
+  }; # config
+}

nixos/modules/services/monitoring/das_watchdog.nix

@@ -0,0 +1,34 @@
+# A general watchdog for the linux operating system that should run in the
+# background at all times to ensure a realtime process won't hang the machine
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  inherit (pkgs) das_watchdog;
+
+in {
+  ###### interface
+
+  options = {
+    services.das_watchdog.enable = mkEnableOption "Whether to enable realtime watchdog";
+  };
+
+  ###### implementation
+
+  config = mkIf config.services.das_watchdog.enable {
+    environment.systemPackages = [ das_watchdog ];
+    systemd.services.das_watchdog = {
+      description = "Watchdog to ensure a realtime process won't hang the machine";
+      after = [ "multi-user.target" "sound.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        User = "root";
+        Type = "oneshot";
+        ExecStart = "${das_watchdog}/bin/das_watchdog";
+        RemainAfterExit = true;
+      };
+    };
+  };
+}

nixos/modules/services/networking/bird.nix

@@ -0,0 +1,76 @@
+{ config, lib, pkgs, ... }:
+
+let
+  inherit (lib) mkEnableOption mkIf mkOption singleton types;
+  inherit (pkgs) bird;
+  cfg = config.services.bird;
+
+  configFile = pkgs.writeText "bird.conf" ''
+    ${cfg.config}
+  '';
+in
+
+{
+
+  ###### interface
+
+  options = {
+
+    services.bird = {
+
+      enable = mkEnableOption "BIRD Internet Routing Daemon";
+
+      config = mkOption {
+        type = types.string;
+        description = ''
+          BIRD Internet Routing Daemon configuration file.
+          <link xlink:href='http://bird.network.cz/'/>
+        '';
+      };
+
+      user = mkOption {
+        type = types.string;
+        default = "ircd";
+        description = ''
+          BIRD Internet Routing Daemon user.
+        '';
+      };
+
+      group = mkOption {
+        type = types.string;
+        default = "ircd";
+        description = ''
+          BIRD Internet Routing Daemon group.
+        '';
+      };
+
+    };
+
+  };
+
+
+  ###### implementation
+
+  config = mkIf cfg.enable {
+
+    users.extraUsers = singleton {
+      name = cfg.user;
+      description = "BIRD Internet Routing Daemon user";
+      uid = config.ids.uids.bird;
+      group = cfg.group;
+    };
+
+    users.extraGroups = singleton {
+      name = cfg.group;
+      gid = config.ids.gids.bird;
+    };
+
+    systemd.services.bird = {
+      description = "BIRD Internet Routing Daemon";
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        ExecStart   = "${bird}/bin/bird -d -c ${configFile} -s /var/run/bird.ctl -u ${cfg.user} -g ${cfg.group}";
+      };
+    };
+  };
+}

nixos/modules/services/networking/ddclient.nix

@@ -126,6 +126,8 @@ in
       description = "Dynamic DNS Client";
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
+
+      environment.SSL_CERT_FILE = "/etc/ssl/certs/ca-bundle.crt";
       serviceConfig = {
         # Uncomment this if too many problems occur:
         # Type = "forking";

nixos/modules/services/networking/docker-registry-server.nix

@@ -0,0 +1,98 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.nodeDockerRegistry;
+
+in {
+  options.services.nodeDockerRegistry = {
+    enable = mkEnableOption "Whether to enable docker registry service.";
+
+    port = mkOption {
+      description = "Docker registry listening port.";
+      default = 8080;
+      type = types.int;
+    };
+
+    users = mkOption {
+      description = "Docker registry list of users.";
+      default = [];
+      options = [{
+        user = mkOption {
+          description = "Docker registry user username.";
+          type = types.str;
+        };
+
+        pass = mkOption {
+          description = "Docker registry user password.";
+          type = types.str;
+        };
+      }];
+      type = types.listOf types.optionSet;
+    };
+
+    onTag = mkOption {
+      description = "Docker registry hook triggered when an image is tagged.";
+      default = "";
+      type = types.str;
+    };
+
+    onImage = mkOption {
+      description = "Docker registry hook triggered when an image metadata is uploaded.";
+      default = "";
+      type = types.str;
+    };
+
+    onLayer = mkOption {
+      description = "Docker registry hook triggered when an when an image layer is uploaded.";
+      default = "";
+      type = types.str;
+    };
+
+    onVerify = mkOption {
+      description = "Docker registry hook triggered when an image layer+metadata has been verified.";
+      default = "";
+      type = types.str;
+    };
+
+    onIndex = mkOption {
+      description = "Docker registry hook triggered when an when an image file system data has been indexed.";
+      default = "";
+      type = types.str;
+    };
+
+    dataDir = mkOption {
+      description = "Docker registry data directory";
+      default = "/var/lib/docker-registry";
+      type = types.path;
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.docker-registry-server = {
+      description = "Docker Registry Service.";
+      wantedBy = ["multi-user.target"];
+      after = ["network.target"];
+      script = ''
+        ${pkgs.nodePackages.docker-registry-server}/bin/docker-registry-server \
+          --dir ${cfg.dataDir} \
+          --port ${toString cfg.port} \
+          ${concatMapStringsSep " " (u: "--user ${u.user}:${u.pass}") cfg.users} \
+          ${optionalString (cfg.onTag != "") "--on-tag '${cfg.onTag}'"} \
+          ${optionalString (cfg.onImage != "") "--on-image '${cfg.onImage}'"} \
+          ${optionalString (cfg.onVerify != "") "--on-verify '${cfg.onVerify}'"} \
+          ${optionalString (cfg.onIndex != "") "--on-index '${cfg.onIndex}'"}
+      '';
+
+      serviceConfig.User = "docker-registry";
+    };
+
+    users.extraUsers.docker-registry = {
+      uid = config.ids.uids.docker-registry;
+      description = "Docker registry user";
+      createHome = true;
+      home = cfg.dataDir;
+    };
+  };
+}

nixos/modules/services/networking/nix-serve.nix

@@ -0,0 +1,56 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.services.nix-serve;
+in
+{
+  options = {
+    services.nix-serve = {
+      enable = mkEnableOption "nix-serve, the standalone Nix binary cache server";
+
+      port = mkOption {
+        type = types.int;
+        default = 5000;
+        description = ''
+          Port number where nix-serve will listen on.
+        '';
+      };
+
+      bindAddress = mkOption {
+        type = types.string;
+        default = "0.0.0.0";
+        description = ''
+          IP address where nix-serve will bind its listening socket.
+        '';
+      };
+
+      extraParams = mkOption {
+        type = types.string;
+        default = "";
+        description = ''
+          Extra command line parameters for nix-serve.
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.nix-serve = {
+      description = "nix-serve binary cache server";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      path = [ config.nix.package pkgs.bzip2 ];
+      environment.NIX_REMOTE = "daemon";
+
+      serviceConfig = {
+        ExecStart = "${pkgs.nix-serve}/bin/nix-serve " +
+          "--port ${cfg.bindAddress}:${toString cfg.port} ${cfg.extraParams}";
+        User = "nobody";
+        Group = "nogroup";
+      };
+    };
+  };
+}

nixos/modules/services/networking/racoon.nix

@@ -0,0 +1,42 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.racoon;
+in {
+  options.services.racoon = {
+    enable = mkEnableOption "Whether to enable racoon.";
+
+    config = mkOption {
+      description = "Contents of racoon configuration file.";
+      default = "";
+      type = types.str;
+    };
+
+    configPath = mkOption {
+      description = "Location of racoon config if config is not provided.";
+      default = "/etc/racoon/racoon.conf";
+      type = types.path;
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.racoon = {
+      description = "Racoon Daemon";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+      serviceConfig = {
+        ExecStart = "${pkgs.ipsecTools}/bin/racoon -f ${
+          if (cfg.config != "") then pkgs.writeText "racoon.conf" cfg.config
+          else cfg.configPath
+        }";
+        ExecReload = "${pkgs.ipsecTools}/bin/racoonctl reload-config";
+        PIDFile = "/var/run/racoon.pid";
+        Type = "forking";
+        Restart = "always";
+      };
+      preStart = "rm /var/run/racoon.pid || true";
+    };
+  };
+}

nixos/modules/services/networking/ssh/sshd.nix

@@ -268,6 +268,16 @@ in
         };
       };
 
+      moduliFile = mkOption {
+        example = "services.openssh.moduliFile = /etc/my-local-ssh-moduli;";
+        type = types.path;
+        description = ''
+          Path to <literal>moduli</literal> file to install in
+          <literal>/etc/ssh/moduli</literal>. If this option is unset, then
+          the <literal>moduli</literal> file shipped with OpenSSH will be used.
+        '';
+      };
+
     };
 
     users.extraUsers = mkOption {
@@ -286,8 +296,10 @@ in
         description = "SSH privilege separation user";
       };
 
+    services.openssh.moduliFile = mkDefault "${cfgc.package}/etc/ssh/moduli";
+
     environment.etc = authKeysFiles ++ [
-      { source = "${cfgc.package}/etc/ssh/moduli";
+      { source = cfg.moduliFile;
         target = "ssh/moduli";
       }
       { text = knownHostsText;

nixos/modules/services/networking/tinc.nix

@@ -154,6 +154,7 @@ in
     users.extraUsers = flip mapAttrs' cfg.networks (network: _:
       nameValuePair ("tinc.${network}") ({
         description = "Tinc daemon user for ${network}";
+        isSystemUser = true;
       })
     );
 

nixos/modules/services/scheduling/marathon.nix

@@ -12,27 +12,56 @@ in {
 
   options.services.marathon = {
     enable = mkOption {
-      description = "Whether to enable the marathon mesos framework.";
-      default = false;
       type = types.uniq types.bool;
+      default = false;
+      description = ''
+	Whether to enable the marathon mesos framework.
+      '';
     };
 
     httpPort = mkOption {
-      description = "Marathon listening port";
-      default = 8080;
       type = types.int;
+      default = 8080;
+      description = ''
+	Marathon listening port for HTTP connections.
+      '';
     };
 
     master = mkOption {
-      description = "Marathon mesos master zookeeper address";
-      default = "zk://${head cfg.zookeeperHosts}/mesos";
       type = types.str;
+      default = "zk://${concatStringsSep "," cfg.zookeeperHosts}/mesos";
+      example = "zk://1.2.3.4:2181,2.3.4.5:2181,3.4.5.6:2181/mesos";
+      description = ''
+	Mesos master address. See <link xlink:href="https://mesosphere.github.io/marathon/docs/"/> for details.
+      '';
     };
 
     zookeeperHosts = mkOption {
-      description = "Marathon mesos zookepper addresses";
-      default = [ "localhost:2181" ];
       type = types.listOf types.str;
+      default = [ "localhost:2181" ];
+      example = [ "1.2.3.4:2181" "2.3.4.5:2181" "3.4.5.6:2181" ];
+      description = ''
+	ZooKeeper hosts' addresses.
+      '';
+    };
+
+    extraCmdLineOptions = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      example = [ "--https_port=8443" "--zk_timeout=10000" "--marathon_store_timeout=2000" ];
+      description = ''
+	Extra command line options to pass to Marathon.
+	See <link xlink:href="https://mesosphere.github.io/marathon/docs/command-line-flags.html"/> for all possible flags.
+      '';
+    };
+
+    environment = mkOption {
+      default = { };
+      type = types.attrs;
+      example = { JAVA_OPTS = "-Xmx512m"; MESOSPHERE_HTTP_CREDENTIALS = "username:password"; };
+      description = ''
+	Environment variables passed to Marathon.
+      '';
     };
   };
 
@@ -41,17 +70,19 @@ in {
   config = mkIf cfg.enable {
     systemd.services.marathon = {
       description = "Marathon Service";
+      environment = cfg.environment;
       wantedBy = [ "multi-user.target" ];
       after = [ "network-interfaces.target" "zookeeper.service" "mesos-master.service" "mesos-slave.service" ];
 
       serviceConfig = {
-        ExecStart = "${pkgs.marathon}/bin/marathon --master ${cfg.master} --zk zk://${head cfg.zookeeperHosts}/marathon";
+        ExecStart = "${pkgs.marathon}/bin/marathon --master ${cfg.master} --zk zk://${concatStringsSep "," cfg.zookeeperHosts}/marathon --http_port ${toString cfg.httpPort} ${concatStringsSep " " cfg.extraCmdLineOptions}";
         User = "marathon";
+        Restart = "always";
+        RestartSec = "2";
       };
     };
 
     users.extraUsers.marathon = {
-      uid = config.ids.uids.marathon;
       description = "Marathon mesos framework user";
     };
   };

nixos/modules/services/x11/desktop-managers/gnome3.nix

@@ -45,7 +45,7 @@ in {
 
     environment.gnome3.packageSet = mkOption {
       default = null;
-      example = literalExample "pkgs.gnome3_12";
+      example = literalExample "pkgs.gnome3_16";
       description = "Which GNOME 3 package set to use.";
       apply = p: if p == null then pkgs.gnome3 else p;
     };
@@ -109,9 +109,6 @@ in {
           # Override default mimeapps
           export XDG_DATA_DIRS=$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}${mimeAppsList}/share
 
-          # Let gnome-control-center find gnome-shell search providers. GNOME 3.12 compatibility.
-          export GNOME_SEARCH_PROVIDERS_DIR=${config.system.path}/share/gnome-shell/search-providers/
-
           # Let nautilus find extensions
           export NAUTILUS_EXTENSION_DIR=${config.system.path}/lib/nautilus/extensions-3.0/
 

nixos/modules/services/x11/display-managers/lightdm.nix

@@ -65,7 +65,7 @@ let
       greeters-directory = ${cfg.greeter.package}
       sessions-directory = ${dmcfg.session.desktops}
 
-      [SeatDefaults]
+      [Seat:*]
       xserver-command = ${xserverWrapper}
       session-wrapper = ${dmcfg.session.script}
       greeter-session = ${cfg.greeter.name}
@@ -143,8 +143,26 @@ in
     services.dbus.enable = true;
     services.dbus.packages = [ lightdm ];
 
-    security.pam.services.lightdm = { allowNullPassword = true; startSession = true; };
+    security.pam.services.lightdm = {
-    security.pam.services.lightdm-greeter = { allowNullPassword = true; startSession = true; };
+      allowNullPassword = true;
+      startSession = true;
+    };
+    security.pam.services.lightdm-greeter = {
+      allowNullPassword = true;
+      startSession = true;
+      text = ''
+        auth     required pam_env.so
+        auth     required pam_permit.so
+
+        account  required pam_permit.so
+
+        password required pam_deny.so
+
+        session  required pam_env.so envfile=${config.system.build.pamEnvironment}
+        session  required pam_unix.so
+        session  optional ${pkgs.systemd}/lib/security/pam_systemd.so
+      '';
+    };
 
     users.extraUsers.lightdm = {
       createHome = true;

nixos/modules/system/boot/coredump.nix

@@ -0,0 +1,51 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+{
+
+  options = {
+
+    systemd.coredump = {
+
+      enable = mkOption {
+        default = false;
+        type = types.bool;
+        description = ''
+          Enables storing core dumps in systemd.
+          Note that this alone is not enough to enable core dumps. The maximum
+          file size for core dumps must be specified in limits.conf as well. See
+          <option>security.pam.loginLimits</option> as well as the limits.conf(5)
+          man page.
+        '';
+      };
+
+      extraConfig = mkOption {
+        default = "";
+        type = types.lines;
+        example = "Storage=journal";
+        description = ''
+          Extra config options for systemd-coredump. See coredump.conf(5) man page
+          for available options.
+        '';
+      };
+    };
+
+  };
+
+  config = mkIf config.systemd.coredump.enable {
+
+    environment.etc."systemd/coredump.conf".text =
+      ''
+        [Coredump]
+        ${config.systemd.coredump.extraConfig}
+      '';
+
+    # Have the kernel pass core dumps to systemd's coredump helper binary.
+    # From systemd's 50-coredump.conf file. See:
+    # <https://github.com/systemd/systemd/blob/v218/sysctl.d/50-coredump.conf.in>
+    boot.kernel.sysctl."kernel.core_pattern" = "|${pkgs.systemd}/lib/systemd/systemd-coredump %p %u %g %s %t %e";
+
+  };
+
+}

nixos/modules/system/boot/loader/generic-extlinux-compatible/default.nix

@@ -0,0 +1,44 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  blCfg = config.boot.loader;
+  cfg = blCfg.generic-extlinux-compatible;
+
+  timeoutStr = if blCfg.timeout == null then "-1" else toString blCfg.timeout;
+
+  builder = import ./extlinux-conf-builder.nix { inherit pkgs; };
+in
+{
+  options = {
+    boot.loader.generic-extlinux-compatible = {
+      enable = mkOption {
+        default = false;
+        type = types.bool;
+        description = ''
+          Whether to generate an extlinux-compatible configuration file
+          under <literal>/boot/extlinux.conf</literal>.  For instance,
+          U-Boot's generic distro boot support uses this file format.
+
+          See <link xlink:href="http://git.denx.de/?p=u-boot.git;a=blob;f=doc/README.distro;hb=refs/heads/master">U-boot's documentation</link>
+          for more information.
+        '';
+      };
+
+      configurationLimit = mkOption {
+        default = 20;
+        example = 10;
+        type = types.int;
+        description = ''
+          Maximum number of configurations in the boot menu.
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    system.build.installBootLoader = "${builder} -g ${toString cfg.configurationLimit} -t ${timeoutStr} -c";
+    system.boot.loader.id = "generic-extlinux-compatible";
+  };
+}

nixos/modules/system/boot/loader/generic-extlinux-compatible/extlinux-conf-builder.nix

@@ -0,0 +1,8 @@
+{ pkgs }:
+
+pkgs.substituteAll {
+  src = ./extlinux-conf-builder.sh;
+  isExecutable = true;
+  inherit (pkgs) bash;
+  path = [pkgs.coreutils pkgs.gnused pkgs.gnugrep];
+}

nixos/modules/system/boot/loader/generic-extlinux-compatible/extlinux-conf-builder.sh

@@ -0,0 +1,132 @@
+#! @bash@/bin/sh -e
+
+shopt -s nullglob
+
+export PATH=/empty
+for i in @path@; do PATH=$PATH:$i/bin; done
+
+usage() {
+    echo "usage: $0 -t <timeout> -c <path-to-default-configuration> [-d <boot-dir>] [-g <num-generations>]" >&2
+    exit 1
+}
+
+timeout=                # Timeout in centiseconds
+default=                # Default configuration
+target=/boot            # Target directory
+numGenerations=0        # Number of other generations to include in the menu
+
+while getopts "t:c:d:g:" opt; do
+    case "$opt" in
+        t) # U-Boot interprets '0' as infinite and negative as instant boot
+            if [ "$OPTARG" -lt 0 ]; then
+                timeout=0
+            elif [ "$OPTARG" = 0 ]; then
+                timeout=-10
+            else
+                timeout=$((OPTARG * 10))
+            fi
+            ;;
+        c) default="$OPTARG" ;;
+        d) target="$OPTARG" ;;
+        g) numGenerations="$OPTARG" ;;
+        \?) usage ;;
+    esac
+done
+
+[ "$timeout" = "" -o "$default" = "" ] && usage
+
+mkdir -p $target/nixos
+mkdir -p $target/extlinux
+
+# Convert a path to a file in the Nix store such as
+# /nix/store/<hash>-<name>/file to <hash>-<name>-<file>.
+cleanName() {
+    local path="$1"
+    echo "$path" | sed 's|^/nix/store/||' | sed 's|/|-|g'
+}
+
+# Copy a file from the Nix store to $target/nixos.
+declare -A filesCopied
+
+copyToKernelsDir() {
+    local src=$(readlink -f "$1")
+    local dst="$target/nixos/$(cleanName $src)"
+    # Don't copy the file if $dst already exists.  This means that we
+    # have to create $dst atomically to prevent partially copied
+    # kernels or initrd if this script is ever interrupted.
+    if ! test -e $dst; then
+        local dstTmp=$dst.tmp.$$
+        cp -r $src $dstTmp
+        mv $dstTmp $dst
+    fi
+    filesCopied[$dst]=1
+    result=$dst
+}
+
+# Copy its kernel, initrd and dtbs to $target/nixos, and echo out an
+# extlinux menu entry
+addEntry() {
+    local path=$(readlink -f "$1")
+    local tag="$2" # Generation number or 'default'
+
+    if ! test -e $path/kernel -a -e $path/initrd; then
+        return
+    fi
+
+    copyToKernelsDir "$path/kernel"; kernel=$result
+    copyToKernelsDir "$path/initrd"; initrd=$result
+    # XXX UGLY: maybe the system config should have a top-level "dtbs" entry?
+    copyToKernelsDir $(readlink -m "$path/kernel/../dtbs"); dtbs=$result
+
+    timestampEpoch=$(stat -L -c '%Z' $path)
+
+    timestamp=$(date "+%Y-%m-%d %H:%M" -d @$timestampEpoch)
+    nixosVersion="$(cat $path/nixos-version)"
+    extraParams="$(cat $path/kernel-params)"
+
+    echo
+    echo "LABEL nixos-$tag"
+    if [ "$tag" = "default" ]; then
+        echo "  MENU LABEL NixOS - Default"
+    else
+        echo "  MENU LABEL NixOS - Configuration $tag ($timestamp - $nixosVersion)"
+    fi
+    echo "  LINUX ../nixos/$(basename $kernel)"
+    echo "  INITRD ../nixos/$(basename $initrd)"
+    echo "  FDTDIR ../nixos/$(basename $dtbs)"
+    echo "  APPEND systemConfig=$path init=$path/init $extraParams"
+}
+
+tmpFile="$target/extlinux/extlinux.conf.tmp.$$"
+
+cat > $tmpFile <<EOF
+# Generated file, all changes will be lost on nixos-rebuild!
+
+# Change this to e.g. nixos-42 to temporarily boot to an older configuration.
+DEFAULT nixos-default
+
+TIMEOUT $timeout
+$(addEntry $default default)
+EOF
+
+# Add up to $numGenerations generations of the system profile to the menu,
+# in reverse (most recent to least recent) order.
+for generation in $(
+        (cd /nix/var/nix/profiles && ls -d system-*-link) \
+        | sed 's/system-\([0-9]\+\)-link/\1/' \
+        | sort -n -r \
+        | head -n $numGenerations); do
+    link=/nix/var/nix/profiles/system-$generation-link
+    addEntry $link $generation
+done >> $tmpFile
+
+mv -f $tmpFile $target/extlinux/extlinux.conf
+
+# Remove obsolete files from $target/nixos.
+for fn in $target/nixos/*; do
+    if ! test "${filesCopied[$fn]}" = 1; then
+        echo "Removing no longer needed boot file: $fn"
+        chmod +w -- "$fn"
+        rm -rf -- "$fn"
+    fi
+done

nixos/modules/system/boot/loader/grub/grub.nix

@@ -21,13 +21,13 @@ let
 
   grubEfi =
     # EFI version of Grub v2
-    if (cfg.devices != ["nodev"]) && cfg.efiSupport && (cfg.version == 2)
+    if cfg.efiSupport && (cfg.version == 2)
     then realGrub.override { efiSupport = cfg.efiSupport; }
     else null;
 
   f = x: if x == null then "" else "" + x;
 
-  grubConfig = pkgs.writeText "grub-config.xml" (builtins.toXML
+  grubConfig = args: pkgs.writeText "grub-config.xml" (builtins.toXML
     { splashImage = f config.boot.loader.grub.splashImage;
       grub = f grub;
       grubTarget = f (grub.grubTarget or "");
@@ -35,11 +35,14 @@ let
       fullVersion = (builtins.parseDrvName realGrub.name).version;
       grubEfi = f grubEfi;
       grubTargetEfi = if cfg.efiSupport && (cfg.version == 2) then f (grubEfi.grubTarget or "") else "";
-      inherit (efi) efiSysMountPoint canTouchEfiVariables;
+      bootPath = args.path;
+      efiSysMountPoint = if args.efiSysMountPoint == null then args.path else args.efiSysMountPoint;
+      inherit (args) devices;
+      inherit (efi) canTouchEfiVariables;
       inherit (cfg)
         version extraConfig extraPerEntryConfig extraEntries
         extraEntriesBeforeNixOS extraPrepareConfig configurationLimit copyKernels timeout
-        default devices fsIdentifier efiSupport;
+        default fsIdentifier efiSupport;
       path = (makeSearchPath "bin" ([
         pkgs.coreutils pkgs.gnused pkgs.gnugrep pkgs.findutils pkgs.diffutils pkgs.btrfsProgs
         pkgs.utillinux ] ++ (if cfg.efiSupport && (cfg.version == 2) then [pkgs.efibootmgr ] else [])
@@ -48,6 +51,9 @@ let
       ]);
     });
 
+  bootDeviceCounters = fold (device: attr: attr // { "${device}" = (attr."${device}" or 0) + 1; }) {}
+    (concatMap (args: args.devices) cfg.mirroredBoots);
+
 in
 
 {
@@ -101,6 +107,53 @@ in
         '';
       };
 
+      mirroredBoots = mkOption {
+        default = [ ];
+        example = [
+          { path = "/boot1"; devices = [ "/dev/sda" ]; }
+          { path = "/boot2"; devices = [ "/dev/sdb" ]; }
+        ];
+        description = ''
+          Mirror the boot configuration to multiple partitions and install grub
+          to the respective devices corresponding to those partitions.
+        '';
+
+        type = types.listOf types.optionSet;
+
+        options = {
+
+          path = mkOption {
+            example = "/boot1";
+            type = types.str;
+            description = ''
+              The path to the boot directory where grub will be written. Generally
+              this boot parth should double as an efi path.
+            '';
+          };
+
+          efiSysMountPoint = mkOption {
+            default = null;
+            example = "/boot1/efi";
+            type = types.nullOr types.str;
+            description = ''
+              The path to the efi system mount point. Usually this is the same
+              partition as the above path and can be left as null.
+            '';
+          };
+
+          devices = mkOption {
+            default = [ ];
+            example = [ "/dev/sda" "/dev/sdb" ];
+            type = types.listOf types.str;
+            description = ''
+              The path to the devices which will have the grub mbr written.
+              Note these are typically device paths and not paths to partitions.
+            '';
+          };
+
+        };
+      };
+
       configurationName = mkOption {
         default = "";
         example = "Stable 2.6.21";
@@ -284,20 +337,25 @@ in
           sha256 = "14kqdx2lfqvh40h6fjjzqgff1mwk74dmbjvmqphi6azzra7z8d59";
         }
         # GRUB 1.97 doesn't support gzipped XPMs.
-        else ./winkler-gnu-blue-640x480.png);
+        else "${pkgs.nixos-artwork}/gnome/Gnome_Dark.png");
     }
 
     (mkIf cfg.enable {
 
       boot.loader.grub.devices = optional (cfg.device != "") cfg.device;
 
-      system.build.installBootLoader =
+      boot.loader.grub.mirroredBoots = optionals (cfg.devices != [ ]) [
-        if cfg.devices == [] then
+        { path = "/boot"; inherit (cfg) devices; inherit (efi) efiSysMountPoint; }
-          throw "You must set the option ‘boot.loader.grub.device’ to make the system bootable."
+      ];
-        else
+
-          "PERL5LIB=${makePerlPath (with pkgs.perlPackages; [ FileSlurp XMLLibXML XMLSAX ListCompare ])} " +
+      system.build.installBootLoader = pkgs.writeScript "install-grub.sh" (''
-          (if cfg.enableCryptodisk then "GRUB_ENABLE_CRYPTODISK=y " else "") +
+        #!${pkgs.stdenv.shell}
-          "${pkgs.perl}/bin/perl ${./install-grub.pl} ${grubConfig}";
+        set -e
+        export PERL5LIB=${makePerlPath (with pkgs.perlPackages; [ FileSlurp XMLLibXML XMLSAX ListCompare ])}
+        ${optionalString cfg.enableCryptodisk "export GRUB_ENABLE_CRYPTODISK=y"}
+      '' + flip concatMapStrings cfg.mirroredBoots (args: ''
+        ${pkgs.perl}/bin/perl ${./install-grub.pl} ${grubConfig args} $@
+      ''));
 
       system.build.grub = grub;
 
@@ -312,13 +370,37 @@ in
           ${pkgs.coreutils}/bin/cp -pf "${v}" "/boot/${n}"
         '') config.boot.loader.grub.extraFiles);
 
-    assertions = [{ assertion = !cfg.zfsSupport || cfg.version == 2;
+      assertions = [
-                    message = "Only grub version 2 provides zfs support";}]
+        {
-      ++ flip map cfg.devices (dev: {
+          assertion = !cfg.zfsSupport || cfg.version == 2;
-        assertion = dev == "nodev" || hasPrefix "/" dev;
+          message = "Only grub version 2 provides zfs support";
-        message = "Grub devices must be absolute paths, not ${dev}";
+        }
-      });
+        {
-
+          assertion = cfg.mirroredBoots != [ ];
+          message = "You must set the option ‘boot.loader.grub.devices’ or "
+            + "'boot.loader.grub.mirroredBoots' to make the system bootable.";
+        }
+        {
+          assertion = all (c: c < 2) (mapAttrsToList (_: c: c) bootDeviceCounters);
+          message = "You cannot have duplicated devices in mirroredBoots";
+        }
+      ] ++ flip concatMap cfg.mirroredBoots (args: [
+        {
+          assertion = args.devices != [ ];
+          message = "A boot path cannot have an empty devices string in ${arg.path}";
+        }
+        {
+          assertion = hasPrefix "/" args.path;
+          message = "Boot paths must be absolute, not ${args.path}";
+        }
+        {
+          assertion = if args.efiSysMountPoint == null then true else hasPrefix "/" args.efiSysMountPoint;
+          message = "Efi paths must be absolute, not ${args.efiSysMountPoint}";
+        }
+      ] ++ flip map args.devices (device: {
+        assertion = device == "nodev" || hasPrefix "/" device;
+        message = "Grub devices must be absolute paths, not ${dev} in ${args.path}";
+      }));
     })
 
   ];

nixos/modules/system/boot/loader/grub/install-grub.pl

@@ -54,6 +54,7 @@ my $defaultEntry = int(get("default"));
 my $fsIdentifier = get("fsIdentifier");
 my $grubEfi = get("grubEfi");
 my $grubTargetEfi = get("grubTargetEfi");
+my $bootPath = get("bootPath");
 my $canTouchEfiVariables = get("canTouchEfiVariables");
 my $efiSysMountPoint = get("efiSysMountPoint");
 $ENV{'PATH'} = get("path");
@@ -62,16 +63,16 @@ die "unsupported GRUB version\n" if $grubVersion != 1 && $grubVersion != 2;
 
 print STDERR "updating GRUB $grubVersion menu...\n";
 
-mkpath("/boot/grub", 0, 0700);
+mkpath("$bootPath/grub", 0, 0700);
 
-# Discover whether /boot is on the same filesystem as / and
+# Discover whether the bootPath is on the same filesystem as / and
 # /nix/store.  If not, then all kernels and initrds must be copied to
-# /boot.
+# the bootPath.
-if (stat("/boot")->dev != stat("/nix/store")->dev) {
+if (stat($bootPath)->dev != stat("/nix/store")->dev) {
     $copyKernels = 1;
 }
 
-# Discover information about the location of /boot
+# Discover information about the location of the bootPath
 struct(Fs => {
     device => '$',
     type => '$',
@@ -206,7 +207,7 @@ sub GrubFs {
     }
     return Grub->new(path => $path, search => $search);
 }
-my $grubBoot = GrubFs("/boot");
+my $grubBoot = GrubFs($bootPath);
 my $grubStore;
 if ($copyKernels == 0) {
     $grubStore = GrubFs("/nix/store");
@@ -221,7 +222,7 @@ if ($grubVersion == 1) {
         timeout $timeout
     ";
     if ($splashImage) {
-        copy $splashImage, "/boot/background.xpm.gz" or die "cannot copy $splashImage to /boot\n";
+        copy $splashImage, "$bootPath/background.xpm.gz" or die "cannot copy $splashImage to $bootPath\n";
         $conf .= "splashimage " . $grubBoot->path . "/background.xpm.gz\n";
     }
 }
@@ -253,10 +254,15 @@ else {
           set timeout=$timeout
         fi
 
-        if loadfont " . $grubBoot->path . "/grub/fonts/unicode.pf2; then
+        # Setup the graphics stack for bios and efi systems
-          set gfxmode=640x480
-          insmod gfxterm
         insmod vbe
+        insmod efi_gop
+        insmod efi_uga
+        insmod font
+        if loadfont " . $grubBoot->path . "/grub/fonts/unicode.pf2; then
+          insmod gfxterm
+          set gfxmode=auto
+          set gfxpayload=keep
           terminal_output gfxterm
         fi
     ";
@@ -264,7 +270,7 @@ else {
     if ($splashImage) {
         # FIXME: GRUB 1.97 doesn't resize the background image if it
         # doesn't match the video resolution.
-        copy $splashImage, "/boot/background.png" or die "cannot copy $splashImage to /boot\n";
+        copy $splashImage, "$bootPath/background.png" or die "cannot copy $splashImage to $bootPath\n";
         $conf .= "
             insmod png
             if background_image " . $grubBoot->path . "/background.png; then
@@ -285,14 +291,14 @@ $conf .= "$extraConfig\n";
 $conf .= "\n";
 
 my %copied;
-mkpath("/boot/kernels", 0, 0755) if $copyKernels;
+mkpath("$bootPath/kernels", 0, 0755) if $copyKernels;
 
 sub copyToKernelsDir {
     my ($path) = @_;
     return $grubStore->path . substr($path, length("/nix/store")) unless $copyKernels;
     $path =~ /\/nix\/store\/(.*)/ or die;
     my $name = $1; $name =~ s/\//-/g;
-    my $dst = "/boot/kernels/$name";
+    my $dst = "$bootPath/kernels/$name";
     # Don't copy the file if $dst already exists.  This means that we
     # have to create $dst atomically to prevent partially copied
     # kernels or initrd if this script is ever interrupted.
@@ -396,14 +402,14 @@ if ($extraPrepareConfig ne "") {
 }
 
 # Atomically update the GRUB config.
-my $confFile = $grubVersion == 1 ? "/boot/grub/menu.lst" : "/boot/grub/grub.cfg";
+my $confFile = $grubVersion == 1 ? "$bootPath/grub/menu.lst" : "$bootPath/grub/grub.cfg";
 my $tmpFile = $confFile . ".tmp";
 writeFile($tmpFile, $conf);
 rename $tmpFile, $confFile or die "cannot rename $tmpFile to $confFile\n";
 
 
-# Remove obsolete files from /boot/kernels.
+# Remove obsolete files from $bootPath/kernels.
-foreach my $fn (glob "/boot/kernels/*") {
+foreach my $fn (glob "$bootPath/kernels/*") {
     next if defined $copied{$fn};
     print STDERR "removing obsolete file $fn\n";
     unlink $fn;
@@ -422,7 +428,7 @@ struct(GrubState => {
 });
 sub readGrubState {
     my $defaultGrubState = GrubState->new(version => "", efi => "", devices => "", efiMountPoint => "" );
-    open FILE, "</boot/grub/state" or return $defaultGrubState;
+    open FILE, "<$bootPath/grub/state" or return $defaultGrubState;
     local $/ = "\n";
     my $version = <FILE>;
     chomp($version);
@@ -491,10 +497,10 @@ if (($requireNewInstall != 0) && ($efiTarget eq "no" || $efiTarget eq "both")) {
         next if $dev eq "nodev";
         print STDERR "installing the GRUB $grubVersion boot loader on $dev...\n";
         if ($grubTarget eq "") {
-            system("$grub/sbin/grub-install", "--recheck", Cwd::abs_path($dev)) == 0
+            system("$grub/sbin/grub-install", "--recheck", "--boot-directory=$bootPath", Cwd::abs_path($dev)) == 0
                 or die "$0: installation of GRUB on $dev failed\n";
         } else {
-            system("$grub/sbin/grub-install", "--recheck", "--target=$grubTarget", Cwd::abs_path($dev)) == 0
+            system("$grub/sbin/grub-install", "--recheck", "--boot-directory=$bootPath", "--target=$grubTarget", Cwd::abs_path($dev)) == 0
                 or die "$0: installation of GRUB on $dev failed\n";
         }
     }
@@ -505,10 +511,10 @@ if (($requireNewInstall != 0) && ($efiTarget eq "no" || $efiTarget eq "both")) {
 if (($requireNewInstall != 0) && ($efiTarget eq "only" || $efiTarget eq "both")) {
     print STDERR "installing the GRUB $grubVersion EFI boot loader into $efiSysMountPoint...\n";
     if ($canTouchEfiVariables eq "true") {
-        system("$grubEfi/sbin/grub-install", "--recheck", "--target=$grubTargetEfi", "--efi-directory=$efiSysMountPoint") == 0
+        system("$grubEfi/sbin/grub-install", "--recheck", "--target=$grubTargetEfi", "--boot-directory=$bootPath", "--efi-directory=$efiSysMountPoint") == 0
                 or die "$0: installation of GRUB EFI into $efiSysMountPoint failed\n";
     } else {
-        system("$grubEfi/sbin/grub-install", "--recheck", "--target=$grubTargetEfi", "--efi-directory=$efiSysMountPoint", "--no-nvram") == 0
+        system("$grubEfi/sbin/grub-install", "--recheck", "--target=$grubTargetEfi", "--boot-directory=$bootPath", "--efi-directory=$efiSysMountPoint", "--no-nvram") == 0
                 or die "$0: installation of GRUB EFI into $efiSysMountPoint failed\n";
     }
 }
@@ -516,7 +522,7 @@ if (($requireNewInstall != 0) && ($efiTarget eq "only" || $efiTarget eq "both"))
 
 # update GRUB state file
 if ($requireNewInstall != 0) {
-    open FILE, ">/boot/grub/state" or die "cannot create /boot/grub/state: $!\n";
+    open FILE, ">$bootPath/grub/state" or die "cannot create $bootPath/grub/state: $!\n";
     print FILE get("fullVersion"), "\n" or die;
     print FILE $efiTarget, "\n" or die;
     print FILE join( ":", @deviceTargets ), "\n" or die;

nixos/modules/system/boot/loader/grub/winkler-gnu-blue.README

@@ -1,6 +0,0 @@
-This is a resized version of
-
-  http://www.gnu.org/graphics/winkler-gnu-blue.png
-
-by Kyle Winkler and released under the Free Art License
-(http://artlibre.org/licence.php/lalgb.html).

nixos/modules/tasks/filesystems/exfat.nix

@@ -0,0 +1,11 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+{
+  config = mkIf (any (fs: fs == "exfat") config.boot.supportedFilesystems) {
+
+    system.fsPackages = [ pkgs.exfat-utils pkgs.fuse_exfat ];
+
+  };
+}

nixos/modules/tasks/trackpoint.nix

@@ -45,6 +45,16 @@ with lib;
         '';
       };
 
+      fakeButtons = mkOption {
+        default = false;
+        type = types.bool;
+        description = ''
+          Switch to "bare" PS/2 mouse support in case Trackpoint buttons are not recognized
+          properly. This can happen for example on models like the L430, T450, T450s, on
+          which the Trackpoint buttons are actually a part of the Synaptics touchpad.
+        '';
+      };
+
     };
 
   };
@@ -52,11 +62,13 @@ with lib;
 
   ###### implementation
 
-  config = mkMerge [
+  config =
-    (mkIf config.hardware.trackpoint.enable {
+  let cfg = config.hardware.trackpoint; in
+  mkMerge [
+    (mkIf cfg.enable {
       services.udev.extraRules =
       ''
-        ACTION=="add|change", SUBSYSTEM=="input", ATTR{name}=="TPPS/2 IBM TrackPoint", ATTR{device/speed}="${toString config.hardware.trackpoint.speed}", ATTR{device/sensitivity}="${toString config.hardware.trackpoint.sensitivity}"
+        ACTION=="add|change", SUBSYSTEM=="input", ATTR{name}=="TPPS/2 IBM TrackPoint", ATTR{device/speed}="${toString cfg.speed}", ATTR{device/sensitivity}="${toString cfg.sensitivity}"
       '';
 
       system.activationScripts.trackpoint =
@@ -65,20 +77,22 @@ with lib;
         '';
     })
 
-    (mkIf config.hardware.trackpoint.emulateWheel {
+    (mkIf (cfg.emulateWheel) {
-      services.xserver.config =
+      services.xserver.inputClassSections =
-        ''
+        [''
-          Section "InputClass"
         Identifier "Trackpoint Wheel Emulation"
-            MatchProduct "Elantech PS/2 TrackPoint|TPPS/2 IBM TrackPoint|DualPoint Stick|Synaptics Inc. Composite TouchPad / TrackPoint|ThinkPad USB Keyboard with TrackPoint|USB Trackpoint pointing device|Composite TouchPad / TrackPoint"
+          MatchProduct "${if cfg.fakeButtons then "PS/2 Generic Mouse" else "Elantech PS/2 TrackPoint|TPPS/2 IBM TrackPoint|DualPoint Stick|Synaptics Inc. Composite TouchPad / TrackPoint|ThinkPad USB Keyboard with TrackPoint|USB Trackpoint pointing device|Composite TouchPad / TrackPoint"}"
           MatchDevicePath "/dev/input/event*"
           Option "EmulateWheel" "true"
           Option "EmulateWheelButton" "2"
           Option "Emulate3Buttons" "false"
           Option "XAxisMapping" "6 7"
           Option "YAxisMapping" "4 5"
-            EndSection
+        ''];
-        '';
+    })
+
+    (mkIf cfg.fakeButtons {
+      boot.extraModprobeConfig = "options psmouse proto=bare";
     })
   ];
 }

nixos/modules/virtualisation/azure-common.nix

@@ -0,0 +1,61 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+{
+  imports = [ ../profiles/headless.nix ];
+
+  boot.kernelParams = [ "console=ttyS0" "earlyprintk=ttyS0" "rootdelay=300" "panic=1" "boot.panic_on_fail" ];
+  boot.initrd.kernelModules = [ "hv_vmbus" "hv_netvsc" "hv_utils" "hv_storvsc" ];
+
+  # Generate a GRUB menu. 
+  boot.loader.grub.device = "/dev/sda";
+  boot.loader.grub.version = 2;
+  boot.loader.grub.timeout = 0;
+
+  # Don't put old configurations in the GRUB menu.  The user has no
+  # way to select them anyway.
+  boot.loader.grub.configurationLimit = 0;
+
+  fileSystems."/".device = "/dev/disk/by-label/nixos";
+
+  # Allow root logins only using the SSH key that the user specified
+  # at instance creation time, ping client connections to avoid timeouts
+  services.openssh.enable = true;
+  services.openssh.permitRootLogin = "without-password";
+  services.openssh.extraConfig = ''
+    ClientAliveInterval 180
+  '';
+
+  # Force getting the hostname from Azure
+  networking.hostName = mkDefault "";
+
+  # Always include cryptsetup so that NixOps can use it.
+  # sg_scan is needed to finalize disk removal on older kernels
+  environment.systemPackages = [ pkgs.cryptsetup pkgs.sg3_utils ];
+
+  networking.usePredictableInterfaceNames = false;
+
+  services.udev.extraRules = ''
+    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:0", ATTR{removable}=="0", SYMLINK+="disk/by-lun/0",
+    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:1", ATTR{removable}=="0", SYMLINK+="disk/by-lun/1",
+    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:2", ATTR{removable}=="0", SYMLINK+="disk/by-lun/2"
+    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:3", ATTR{removable}=="0", SYMLINK+="disk/by-lun/3"
+
+    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:4", ATTR{removable}=="0", SYMLINK+="disk/by-lun/4"
+    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:5", ATTR{removable}=="0", SYMLINK+="disk/by-lun/5"
+    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:6", ATTR{removable}=="0", SYMLINK+="disk/by-lun/6"
+    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:7", ATTR{removable}=="0", SYMLINK+="disk/by-lun/7"
+
+    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:8", ATTR{removable}=="0", SYMLINK+="disk/by-lun/8"
+    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:9", ATTR{removable}=="0", SYMLINK+="disk/by-lun/9"
+    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:10", ATTR{removable}=="0", SYMLINK+="disk/by-lun/10"
+    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:11", ATTR{removable}=="0", SYMLINK+="disk/by-lun/11"
+
+    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:12", ATTR{removable}=="0", SYMLINK+="disk/by-lun/12"
+    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:13", ATTR{removable}=="0", SYMLINK+="disk/by-lun/13"
+    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:14", ATTR{removable}=="0", SYMLINK+="disk/by-lun/14"
+    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:15", ATTR{removable}=="0", SYMLINK+="disk/by-lun/15"
+
+  '';
+
+}

nixos/modules/virtualisation/azure-image.nix

@@ -5,8 +5,6 @@ let
   diskSize = "4096";
 in
 {
-  imports = [ ../profiles/headless.nix ];
-
   system.build.azureImage =
     pkgs.vmTools.runInLinuxVM (
       pkgs.runCommand "azure-image"
@@ -24,7 +22,6 @@ in
 
           postVM =
             ''
-              echo Converting
               mkdir -p $out
               ${pkgs.vmTools.qemu}/bin/qemu-img convert -f raw -O vpc $diskImage $out/disk.vhd
               rm $diskImage
@@ -93,34 +90,11 @@ in
         ''
     );
 
-  fileSystems."/".device = "/dev/disk/by-label/nixos";
+  imports = [ ./azure-common.nix ];
 
   # Azure metadata is available as a CD-ROM drive.
   fileSystems."/metadata".device = "/dev/sr0";
 
-  boot.kernelParams = [ "console=ttyS0" "earlyprintk=ttyS0" "rootdelay=300" "panic=1" "boot.panic_on_fail" ];
-  boot.initrd.kernelModules = [ "hv_vmbus" "hv_netvsc" "hv_utils" "hv_storvsc" ];
-
-  # Generate a GRUB menu. 
-  boot.loader.grub.device = "/dev/sda";
-  boot.loader.grub.version = 2;
-  boot.loader.grub.timeout = 0;
-
-  # Don't put old configurations in the GRUB menu.  The user has no
-  # way to select them anyway.
-  boot.loader.grub.configurationLimit = 0;
-
-  # Allow root logins only using the SSH key that the user specified
-  # at instance creation time.
-  services.openssh.enable = true;
-  services.openssh.permitRootLogin = "without-password";
-
-  # Force getting the hostname from Azure
-  networking.hostName = mkDefault "";
-
-  # Always include cryptsetup so that NixOps can use it.
-  environment.systemPackages = [ pkgs.cryptsetup ];
-
   systemd.services.fetch-ssh-keys =
     { description = "Fetch host keys and authorized_keys for root user";
 
@@ -157,8 +131,4 @@ in
       serviceConfig.StandardOutput = "journal+console";
      };
 
-  networking.usePredictableInterfaceNames = false;
-
-  #users.extraUsers.root.openssh.authorizedKeys.keys = [ (builtins.readFile <ssh-pub-key>) ];
-
 }

nixos/modules/virtualisation/docker.nix

@@ -45,7 +45,7 @@ in
       };
     extraOptions =
       mkOption {
-        type = types.str;
+        type = types.separatedString " ";
         default = "";
         description =
           ''

nixos/modules/virtualisation/libvirtd.nix

@@ -57,6 +57,17 @@ in
           '';
       };
 
+    virtualisation.libvirtd.extraOptions =
+      mkOption {
+        type = types.listOf types.str;
+        default = [ ];
+        example = [ "--verbose" ];
+        description =
+          ''
+            Extra command line arguments passed to libvirtd on startup.
+          '';
+      };
+
     virtualisation.libvirtd.onShutdown =
       mkOption {
         type = types.enum ["shutdown" "suspend" ];
@@ -140,7 +151,7 @@ in
             done
           ''; # */
 
-        serviceConfig.ExecStart = ''@${pkgs.libvirt}/sbin/libvirtd libvirtd --config "${configFile}" --daemon --verbose'';
+        serviceConfig.ExecStart = ''@${pkgs.libvirt}/sbin/libvirtd libvirtd --config "${configFile}" --daemon ${concatStringsSep " " cfg.extraOptions}'';
         serviceConfig.Type = "forking";
         serviceConfig.KillMode = "process"; # when stopping, leave the VMs alone
 

nixos/modules/virtualisation/nova-image.nix

@@ -46,16 +46,20 @@ with lib;
 
           # Register the paths in the Nix database.
           printRegistration=1 perl ${pkgs.pathsFromGraph} /tmp/xchg/closure | \
-              chroot /mnt ${config.nix.package}/bin/nix-store --load-db
+              chroot /mnt ${config.nix.package}/bin/nix-store --load-db --option build-users-group ""
 
           # Create the system profile to allow nixos-rebuild to work.
-          chroot /mnt ${config.nix.package}/bin/nix-env \
+          chroot /mnt ${config.nix.package}/bin/nix-env --option build-users-group "" \
               -p /nix/var/nix/profiles/system --set ${config.system.build.toplevel}
 
           # `nixos-rebuild' requires an /etc/NIXOS.
           mkdir -p /mnt/etc
           touch /mnt/etc/NIXOS
 
+          # `switch-to-configuration' requires a /bin/sh
+          mkdir -p /mnt/bin
+          ln -s ${config.system.build.binsh}/bin/sh /mnt/bin/sh
+
           # Install a configuration.nix.
           mkdir -p /mnt/etc/nixos
           cp ${./nova-config.nix} /mnt/etc/nixos/configuration.nix
@@ -104,10 +108,6 @@ with lib;
     boot.initrd.supportedFilesystems = [ "unionfs-fuse" ];
     */
 
-  # Since Nova allows VNC access to instances, it's nice to start to
-  # start a few virtual consoles.
-  services.mingetty.ttys = [ "tty1" "tty2" ];
-
   # Allow root logins only using the SSH key that the user specified
   # at instance creation time.
   services.openssh.enable = true;

nixos/modules/virtualisation/openvswitch.nix

@@ -7,32 +7,33 @@ with lib;
 let
   cfg = config.virtualisation.vswitch;
 
-in
+in {
 
-{
+  options.virtualisation.vswitch = {
-
+    enable = mkOption {
-  options = {
-
-    virtualisation.vswitch.enable = mkOption {
       type = types.bool;
       default = false;
-      description =
+      description = ''
-        ''
+        Whether to enable Open vSwitch. A configuration daemon (ovs-server)
-        Enable Open vSwitch. A configuration 
+        will be started.
-        daemon (ovs-server) will be started.
         '';
     };
 
-
+    package = mkOption {
-    virtualisation.vswitch.package = mkOption {
       type = types.package;
       default = pkgs.openvswitch;
-      description =
+      description = ''
-        ''
         Open vSwitch package to use.
       '';
     };
 
+    ipsec = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Whether to start racoon service for openvswitch.
+      '';
+    };
   };
 
   config = mkIf cfg.enable (let
@@ -51,15 +52,12 @@ in
       buildInputs = with pkgs; [
         cfg.package
       ];
-      installPhase = 
+      installPhase = "mkdir -p $out";
-        ''
-        ensureDir $out/
-        '';
     };
 
-  in {
+  in (mkMerge [{
 
-    environment.systemPackages = [ cfg.package ]; 
+    environment.systemPackages = [ cfg.package pkgs.ipsecTools ];
 
     boot.kernelModules = [ "tun" "openvswitch" ];
 
@@ -85,7 +83,8 @@ in
         fi
         chmod -R +w /var/db/openvswitch
         '';
-      serviceConfig.ExecStart = 
+      serviceConfig = {
+        ExecStart =
           ''
           ${cfg.package}/bin/ovsdb-server \
             --remote=punix:${runDir}/db.sock \
@@ -93,15 +92,18 @@ in
             --certificate=db:Open_vSwitch,SSL,certificate \
             --bootstrap-ca-cert=db:Open_vSwitch,SSL,ca_cert \
             --unixctl=ovsdb.ctl.sock \
+            --pidfile=/var/run/openvswitch/ovsdb.pid \
+            --detach \
             /var/db/openvswitch/conf.db
           '';
-      serviceConfig.Restart = "always";
+        Restart = "always";
-      serviceConfig.RestartSec = 3;
+        RestartSec = 3;
-      postStart =
+        PIDFile = "/var/run/openvswitch/ovsdb.pid";
-        ''
+        Type = "forking";
+      };
+      postStart = ''
         ${cfg.package}/bin/ovs-vsctl --timeout 3 --retry --no-wait init
       '';
-
     };
 
     systemd.services.vswitchd = {
@@ -109,9 +111,55 @@ in
       bindsTo = [ "ovsdb.service" ];
       after = [ "ovsdb.service" ];
       path = [ cfg.package ];
-      serviceConfig.ExecStart = ''${cfg.package}/bin/ovs-vswitchd'';
+      serviceConfig = {
+        ExecStart = ''
+          ${cfg.package}/bin/ovs-vswitchd \
+          --pidfile=/var/run/openvswitch/ovs-vswitchd.pid \
+          --detach
+        '';
+        PIDFile = "/var/run/openvswitch/ovs-vswitchd.pid";
+        Type = "forking";
+      };
     };
 
-  });
+  }
+  (mkIf cfg.ipsec {
+    services.racoon.enable = true;
+    services.racoon.configPath = "${runDir}/ipsec/etc/racoon/racoon.conf";
+
+    networking.firewall.extraCommands = ''
+      iptables -I INPUT -t mangle -p esp -j MARK --set-mark 1/1
+      iptables -I INPUT -t mangle -p udp --dport 4500 -j MARK --set-mark 1/1
+    '';
+
+    systemd.services.ovs-monitor-ipsec = {
+      description = "Open_vSwitch Ipsec Daemon";
+      wantedBy = [ "multi-user.target" ];
+      requires = [ "racoon.service" ];
+      after = [ "vswitchd.service" ];
+      environment.UNIXCTLPATH = "/tmp/ovsdb.ctl.sock";
+      serviceConfig = {
+        ExecStart = ''
+          ${cfg.package}/bin/ovs-monitor-ipsec \
+            --root-prefix ${runDir}/ipsec \
+            --pidfile /var/run/openvswitch/ovs-monitor-ipsec.pid \
+            --monitor --detach \
+            unix:/var/run/openvswitch/db.sock
+        '';
+        PIDFile = "/var/run/openvswitch/ovs-monitor-ipsec.pid";
+        Type = "forking";
+      };
+
+      preStart = ''
+        rm -r ${runDir}/ipsec/etc/racoon/certs || true
+        mkdir -p ${runDir}/ipsec/{etc/racoon,etc/init.d/,usr/sbin/}
+        ln -fs ${pkgs.ipsecTools}/bin/setkey ${runDir}/ipsec/usr/sbin/setkey
+        ln -fs ${pkgs.writeScript "racoon-restart" ''
+        #!${pkgs.stdenv.shell}
+        /var/run/current-system/sw/bin/systemctl $1 racoon
+        ''} ${runDir}/ipsec/etc/init.d/racoon
+      '';
+    };
+  })]));
 
 }

nixos/modules/virtualisation/vmware-guest.nix

@@ -0,0 +1,47 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.vmwareGuest;
+  open-vm-tools = pkgs.open-vm-tools;
+in
+{
+  options = {
+    services.vmwareGuest.enable = mkEnableOption "Enable VMWare Guest Support";
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [ {
+      assertion = pkgs.stdenv.isi686 || pkgs.stdenv.isx86_64;
+      message = "VMWare guest is not currently supported on ${pkgs.stdenv.system}";
+    } ];
+
+    environment.systemPackages = [ open-vm-tools ];
+
+    systemd.services.vmware =
+      { description = "VMWare Guest Service";
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig.ExecStart = "${open-vm-tools}/bin/vmtoolsd";
+      };
+
+    services.xserver = {
+      videoDrivers = mkOverride 50 [ "vmware" ];
+
+      config = ''
+          Section "InputDevice"
+            Identifier "VMMouse"
+            Driver "vmmouse"
+          EndSection
+        '';
+
+      serverLayoutSection = ''
+          InputDevice "VMMouse"
+        '';
+
+      displayManager.sessionCommands = ''
+          ${open-vm-tools}/bin/vmware-user-suid-wrapper
+        '';
+    };
+  };
+}

nixos/release-combined.nix

@@ -53,6 +53,7 @@ in rec {
         (all nixos.tests.firewall)
         (all nixos.tests.gnome3)
         (all nixos.tests.installer.lvm)
+        (all nixos.tests.installer.luksroot)
         (all nixos.tests.installer.separateBoot)
         (all nixos.tests.installer.simple)
         (all nixos.tests.installer.simpleLabels)
@@ -63,6 +64,7 @@ in rec {
         (all nixos.tests.installer.btrfsSubvolDefault)
         (all nixos.tests.ipv6)
         (all nixos.tests.kde4)
+        (all nixos.tests.lightdm)
         (all nixos.tests.login)
         (all nixos.tests.misc)
         (all nixos.tests.nat.firewall)

nixos/release.nix

@@ -255,6 +255,7 @@ in rec {
   tests.i3wm = callTest tests/i3wm.nix {};
   tests.installer.grub1 = forAllSystems (system: hydraJob (import tests/installer.nix { inherit system; }).grub1.test);
   tests.installer.lvm = forAllSystems (system: hydraJob (import tests/installer.nix { inherit system; }).lvm.test);
+  tests.installer.luksroot = forAllSystems (system: hydraJob (import tests/installer.nix { inherit system; }).luksroot.test);
   tests.installer.rebuildCD = forAllSystems (system: hydraJob (import tests/installer.nix { inherit system; }).rebuildCD.test);
   tests.installer.separateBoot = forAllSystems (system: hydraJob (import tests/installer.nix { inherit system; }).separateBoot.test);
   tests.installer.simple = forAllSystems (system: hydraJob (import tests/installer.nix { inherit system; }).simple.test);
@@ -270,6 +271,7 @@ in rec {
   tests.kde4 = callTest tests/kde4.nix {};
   tests.kubernetes = hydraJob (import tests/kubernetes.nix { system = "x86_64-linux"; });
   tests.latestKernel.login = callTest tests/login.nix { latestKernel = true; };
+  tests.lightdm = callTest tests/lightdm.nix {};
   tests.login = callTest tests/login.nix {};
   #tests.logstash = callTest tests/logstash.nix {};
   tests.misc = callTest tests/misc.nix {};

nixos/tests/chromium.nix

@@ -9,6 +9,8 @@ import ./make-test.nix (
 }: rec {
   name = "chromium";
 
+  enableOCR = true;
+
   machine.imports = [ ./common/x11.nix ];
   machine.virtualisation.memorySize = 1024;
 
@@ -106,15 +108,11 @@ import ./make-test.nix (
         "ulimit -c unlimited; ".
         "$pkg/bin/chromium $args \"$url\" & disown"
       );
+      $machine->waitForText(qr/Type to search or enter a URL to navigate/);
       $machine->waitUntilSucceeds("${xdo "check-startup" ''
         search --sync --onlyvisible --name "startup done"
         # close first start help popup
         key -delay 1000 Escape
-        # XXX: This is to make sure the popup is closed, but we better do
-        # screenshots to detect visual changes.
-        key -delay 2000 Escape
-        key -delay 3000 Escape
-        key -delay 4000 Escape
         windowfocus --sync
         windowactivate --sync
       ''}");

nixos/tests/gnome3_16.nix

@@ -1,34 +0,0 @@
-import ./make-test.nix {
-  name = "gnome3";
-
-  machine =
-    { config, pkgs, ... }:
-
-    { imports = [ ./common/user-account.nix ];
-
-      services.xserver.enable = true;
-
-      services.xserver.displayManager.auto.enable = true;
-      services.xserver.displayManager.auto.user = "alice";
-      services.xserver.desktopManager.gnome3.enable = true;
-
-      environment.gnome3.packageSet = pkgs.gnome3_16;
-
-      virtualisation.memorySize = 512;
-    };
-
-  testScript =
-    ''
-      $machine->waitForX;
-      $machine->sleep(15);
-
-      # Check that logging in has given the user ownership of devices.
-      $machine->succeed("getfacl /dev/snd/timer | grep -q alice");
-
-      $machine->succeed("su - alice -c 'DISPLAY=:0.0 gnome-terminal &'");
-      $machine->waitForWindow(qr/Terminal/);
-      $machine->sleep(20);
-      $machine->screenshot("screen");
-    '';
-
-}

nixos/tests/installer.nix

@@ -45,7 +45,8 @@ let
 
   # The configuration to install.
   makeConfig = { testChannel, grubVersion, grubDevice, grubIdentifier
-    , readOnly ? true, forceGrubReinstallCount ? 0 }:
+               , extraConfig, readOnly ? true, forceGrubReinstallCount ? 0
+               }:
     pkgs.writeText "configuration.nix" ''
       { config, lib, pkgs, modulesPath, ... }:
 
@@ -70,6 +71,7 @@ let
         environment.systemPackages = [ ${optionalString testChannel "pkgs.rlwrap"} ];
 
         nix.binaryCaches = [ http://cache.nixos.org/ ];
+        ${replaceChars ["\n"] ["\n  "] extraConfig}
       }
     '';
 
@@ -106,7 +108,9 @@ let
   # disk, and then reboot from the hard disk.  It's parameterized with
   # a test script fragment `createPartitions', which must create
   # partitions and filesystems.
-  testScriptFun = { createPartitions, testChannel, grubVersion, grubDevice, grubIdentifier }:
+  testScriptFun = { createPartitions, testChannel, grubVersion, grubDevice
+                  , grubIdentifier, preBootCommands, extraConfig
+                  }:
     let
       # FIXME: OVMF doesn't boot from virtio http://www.mail-archive.com/edk2-devel@lists.sourceforge.net/msg01501.html
       iface = if grubVersion == 1 then "scsi" else "virtio";
@@ -116,7 +120,7 @@ let
       hdFlags =''hda => "harddisk", hdaInterface => "${iface}", '';
     in
     ''
-      createDisk("harddisk", 4 * 1024);
+      createDisk("harddisk", 8 * 1024);
 
       my $machine = createMachine({ ${hdFlags}
         cdrom => glob("${iso}/iso/*.iso"),
@@ -172,7 +176,7 @@ let
       $machine->succeed("cat /mnt/etc/nixos/hardware-configuration.nix >&2");
 
       $machine->copyFileFromHost(
-          "${ makeConfig { inherit testChannel grubVersion grubDevice grubIdentifier; } }",
+          "${ makeConfig { inherit testChannel grubVersion grubDevice grubIdentifier extraConfig; } }",
           "/mnt/etc/nixos/configuration.nix");
 
       # Perform the installation.
@@ -190,6 +194,9 @@ let
       # Now see if we can boot the installation.
       $machine = createMachine({ ${hdFlags} qemuFlags => "${qemuFlags}" });
 
+      # For example to enter LUKS passphrase
+      ${preBootCommands}
+
       # Did /boot get mounted?
       $machine->waitForUnit("local-fs.target");
 
@@ -210,7 +217,7 @@ let
 
       # We need to a writable nix-store on next boot
       $machine->copyFileFromHost(
-          "${ makeConfig { inherit testChannel grubVersion grubDevice grubIdentifier; readOnly = false; forceGrubReinstallCount = 1; } }",
+          "${ makeConfig { inherit testChannel grubVersion grubDevice grubIdentifier extraConfig; readOnly = false; forceGrubReinstallCount = 1; } }",
           "/etc/nixos/configuration.nix");
 
       # Check whether nixos-rebuild works.
@@ -225,9 +232,10 @@ let
 
       # Check whether a writable store build works
       $machine = createMachine({ ${hdFlags} qemuFlags => "${qemuFlags}" });
+      ${preBootCommands}
       $machine->waitForUnit("multi-user.target");
       $machine->copyFileFromHost(
-          "${ makeConfig { inherit testChannel grubVersion grubDevice grubIdentifier; readOnly = false; forceGrubReinstallCount = 2; } }",
+          "${ makeConfig { inherit testChannel grubVersion grubDevice grubIdentifier extraConfig; readOnly = false; forceGrubReinstallCount = 2; } }",
           "/etc/nixos/configuration.nix");
       $machine->succeed("nixos-rebuild boot >&2");
       $machine->shutdown;
@@ -235,19 +243,25 @@ let
       # And just to be sure, check that the machine still boots after
       # "nixos-rebuild switch".
       $machine = createMachine({ ${hdFlags} qemuFlags => "${qemuFlags}" });
+      ${preBootCommands}
       $machine->waitForUnit("network.target");
       $machine->shutdown;
     '';
 
 
   makeInstallerTest = name:
-    { createPartitions, testChannel ? false, grubVersion ? 2, grubDevice ? "/dev/vda", grubIdentifier ? "uuid" }:
+    { createPartitions, preBootCommands ? "", extraConfig ? ""
+    , testChannel ? false, grubVersion ? 2, grubDevice ? "/dev/vda"
+    , grubIdentifier ? "uuid", enableOCR ? false
+    }:
     makeTest {
       inherit iso;
       name = "installer-" + name;
       nodes = if testChannel then { inherit webserver; } else { };
+      inherit enableOCR;
       testScript = testScriptFun {
-        inherit createPartitions testChannel grubVersion grubDevice grubIdentifier;
+        inherit createPartitions preBootCommands testChannel grubVersion
+                grubDevice grubIdentifier extraConfig;
       };
     };
 
@@ -321,6 +335,44 @@ in {
         '';
     };
 
+  # Boot off an encrypted root partition
+  luksroot = makeInstallerTest "luksroot"
+    { createPartitions = ''
+        $machine->succeed(
+          "parted /dev/vda mklabel msdos",
+          "parted /dev/vda -- mkpart primary ext2 1M 50MB", # /boot
+          "parted /dev/vda -- mkpart primary linux-swap 50M 1024M",
+          "parted /dev/vda -- mkpart primary 1024M -1s", # LUKS
+          "udevadm settle",
+          "mkswap /dev/vda2 -L swap",
+          "swapon -L swap",
+          "modprobe dm_mod dm_crypt",
+          "echo -n supersecret | cryptsetup luksFormat -q /dev/vda3 -",
+          "echo -n supersecret | cryptsetup luksOpen --key-file - /dev/vda3 cryptroot",
+          "mkfs.ext3 -L nixos /dev/mapper/cryptroot",
+          "mount LABEL=nixos /mnt",
+          "mkfs.ext3 -L boot /dev/vda1",
+          "mkdir -p /mnt/boot",
+          "mount LABEL=boot /mnt/boot",
+        );
+      '';
+      # XXX: Currently, generate-config doesn't detect LUKS yet.
+      extraConfig = ''
+        boot.kernelParams = lib.mkAfter [ "console=tty0" ];
+        boot.initrd.luks.devices = lib.singleton {
+          name = "cryptroot";
+          device = "/dev/vda3";
+          preLVM = true;
+        };
+      '';
+      enableOCR = true;
+      preBootCommands = ''
+        $machine->start;
+        $machine->waitForText(qr/Enter passphrase/);
+        $machine->sendChars("supersecret\n");
+      '';
+    };
+
   swraid = makeInstallerTest "swraid"
     { createPartitions =
         ''

nixos/tests/lightdm.nix

@@ -0,0 +1,25 @@
+import ./make-test.nix {
+  name = "lightdm";
+
+  machine = { lib, ... }: {
+    imports = [ ./common/user-account.nix ];
+    services.xserver.enable = true;
+    services.xserver.displayManager.lightdm.enable = true;
+    services.xserver.windowManager.default = "icewm";
+    services.xserver.windowManager.icewm.enable = true;
+    services.xserver.desktopManager.default = "none";
+  };
+
+  enableOCR = true;
+
+  testScript = { nodes, ... }: let
+    user = nodes.machine.config.users.extraUsers.alice;
+  in ''
+    startAll;
+    $machine->waitForText(qr/${user.description}/);
+    $machine->screenshot("lightdm");
+    $machine->sendChars("${user.password}\n");
+    $machine->waitForText(qr/^\d{2}(?::\d{2}){2} (?:AM|PM)$/m);
+    $machine->screenshot("session");
+  '';
+}

nixos/tests/printing.nix

@@ -68,6 +68,7 @@ import ./make-test.nix ({pkgs, ... }: {
 
               # Print the file on the client.
               $client->succeed("lp $file");
+              $client->sleep(10);
               $client->succeed("lpq") =~ /active.*root.*$fn/ or die;
 
               # Ensure that a raw PCL file appeared in the server's queue
@@ -75,11 +76,13 @@ import ./make-test.nix ({pkgs, ... }: {
               # course, since there is no actual USB printer attached, the
               # file will stay in the queue forever.
               $server->waitForFile("/var/spool/cups/d00001-001");
+              $server->sleep(10);
               $server->succeed("lpq -a") =~ /$fn/ or die;
 
               # Delete the job on the client.  It should disappear on the
               # server as well.
               $client->succeed("lprm");
+              $client->sleep(10);
               $client->succeed("lpq -a") =~ /no entries/;
               Machine::retry sub {
                 return 1 if $server->succeed("lpq -a") =~ /no entries/;

pkgs/applications/altcoins/bitcoin.nix

@@ -6,14 +6,14 @@ with stdenv.lib;
 stdenv.mkDerivation rec{
 
   name = "bitcoin" + (toString (optional (!withGui) "d")) + "-" + version;
-  core_version = "0.10.1";
+  core_version = "0.10.2";
   version = core_version;
 
   src = fetchurl {
-    url = [ "https://bitcoin.org/bin/bitcoin-core-${core_version}/bitcoin-${version}.tar.gz"
+    urls = [ "https://bitcoin.org/bin/bitcoin-core-${core_version}/bitcoin-${version}.tar.gz"
              "mirror://sourceforge/bitcoin/Bitcoin/bitcoin-${core_version}/bitcoin-${version}.tar.gz"
            ];
-    sha256 = "287873f9ba4fd49cd4e4be7eba070d2606878f1690c5be0273164d37cbf3c138";
+    sha256 = "cddf96c71d0a35524fde93380981cf0cf0b51441454a3a68b9be491b9239bfec";
   };
 
   buildInputs = [ pkgconfig autoreconfHook openssl db48 boost zlib

pkgs/applications/altcoins/darkcoin.nix

@@ -1,4 +1,4 @@
-{ fetchurl, stdenv, pkgconfig
+{ fetchzip, stdenv, pkgconfig
 , openssl, db48, boost, zlib, miniupnpc, qt4, qrencode, glib, protobuf
 , utillinux
 , withGui }:
@@ -9,9 +9,9 @@ stdenv.mkDerivation rec {
   name = "darkcoin" + (toString (optional (!withGui) "d")) + "-" + version;
   version = "0.10.99.99";
 
-  src = fetchurl {
+  src = fetchzip {
     url = "https://github.com/darkcoin/darkcoin/archive/v${version}.tar.gz";
-    sha256 = "1a05a7l878klg4wqk9ykndkhyknrd7jp75v38k99qgk5fi8wa752";
+    sha256 = "0sigvimqwc1mvaq43a8c2aq7fjla2ncafrals08qfq3jd6in8b4f";
   };
 
   buildInputs = [ pkgconfig glib openssl db48 boost zlib miniupnpc ]

pkgs/applications/audio/LazyLimiter/default.nix

@@ -0,0 +1,33 @@
+{ stdenv, fetchFromGitHub, faust2jack, faust2lv2 }:
+stdenv.mkDerivation rec {
+  name = "LazyLimiter-${version}";
+  version = "0.3.01";
+
+  src = fetchFromGitHub {
+    owner = "magnetophon";
+    repo = "LazyLimiter";
+    rev = "v${version}";
+    sha256 = "1yx9d5cakmqbiwb1j9v2af9h5lqzahl3kaamnyk71cf4i8g7zp3l";
+  };
+
+  buildInputs = [ faust2jack faust2lv2 ];
+
+  buildPhase = ''
+    faust2jack -t 99999 LazyLimiter.dsp
+    faust2lv2 -t 99999 LazyLimiter.dsp
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp LazyLimiter $out/bin/
+    mkdir -p $out/lib/lv2
+    cp -r LazyLimiter.lv2/ $out/lib/lv2
+  '';
+
+  meta = {
+    description = "A fast yet clean lookahead limiter for jack and lv2";
+    homepage = https://magnetophon.github.io/LazyLimiter/;
+    license = stdenv.lib.licenses.gpl2;
+    maintainers = [ stdenv.lib.maintainers.magnetophon ];
+  };
+}

pkgs/applications/audio/MBdistortion/default.nix

@@ -0,0 +1,33 @@
+{ stdenv, fetchFromGitHub, faust2jack, faust2lv2 }:
+stdenv.mkDerivation rec {
+  name = "MBdistortion-${version}";
+  version = "1.1";
+
+  src = fetchFromGitHub {
+    owner = "magnetophon";
+    repo = "MBdistortion";
+    rev = "v${version}";
+    sha256 = "1rmvfi48hg8ybfw517zgj3fjj2xzckrmv8x131i26vj0fv7svjsp";
+  };
+
+  buildInputs = [ faust2jack faust2lv2 ];
+
+  buildPhase = ''
+    faust2jack -t 99999 MBdistortion.dsp
+    faust2lv2 -t 99999 MBdistortion.dsp
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp MBdistortion $out/bin/
+    mkdir -p $out/lib/lv2
+    cp -r MBdistortion.lv2/ $out/lib/lv2
+  '';
+
+  meta = {
+    description = "Mid-side multiband distortion for jack and lv2";
+    homepage = https://github.com/magnetophon/MBdistortion;
+    license = stdenv.lib.licenses.gpl2;
+    maintainers = [ stdenv.lib.maintainers.magnetophon ];
+  };
+}

pkgs/applications/audio/QmidiNet/default.nix

@@ -0,0 +1,21 @@
+{ stdenv, fetchurl, qt4, alsaLib, jack2 }:
+
+stdenv.mkDerivation rec {
+  version = "0.2.1";
+  name = "qmidinet-${version}";
+
+  src = fetchurl {
+    url = "http://downloads.sourceforge.net/qmidinet/${name}.tar.gz";
+    sha256 = "1a1pj4w74wj1gcfv4a0vzcglmr5sw0xp0y56w8rk3ig4k11xi8sa";
+  };
+
+  buildInputs = [ qt4 alsaLib jack2 ];
+
+  meta = with stdenv.lib; {
+    description = "A MIDI network gateway application that sends and receives MIDI data (ALSA Sequencer and/or JACK MIDI) over the network";
+    homepage = http://qmidinet.sourceforge.net/;
+    license = licenses.gpl2Plus;
+    maintainers = [ maintainers.magnetophon ];
+    platforms = stdenv.lib.platforms.linux;
+  };
+}

pkgs/applications/audio/VoiceOfFaust/default.nix

@@ -0,0 +1,65 @@
+
+{ stdenv, pkgs, callPackage, fetchFromGitHub, faust2jack, helmholtz, mrpeach, puredata-with-plugins }:
+stdenv.mkDerivation rec {
+  name = "VoiceOfFaust-${version}";
+  version = "0.7";
+
+  src = fetchFromGitHub {
+    owner = "magnetophon";
+    repo = "VoiceOfFaust";
+    rev = "v${version}";
+    sha256 = "14jjs7cnhg20pzijgblr7caspcpx8p8lpkbvjzc656s9lqn6m9sn";
+  };
+
+  plugins = [ helmholtz mrpeach ];
+
+  pitchTracker = puredata-with-plugins plugins;
+
+  buildInputs = [ faust2jack ];
+
+  runtimeInputs = [ pitchTracker ];
+
+  patchPhase = ''
+    sed -i "s@pd -nodac@${pitchTracker}/bin/pd -nodac@g" launchers/synthWrapper
+    sed -i "s@../PureData/OscSendVoc.pd@$out/PureData/OscSendVoc.pd@g" launchers/synthWrapper
+  '';
+
+  buildPhase = ''
+    faust2jack -osc classicVocoder.dsp
+    faust2jack -osc CZringmod.dsp
+    faust2jack -osc FMsinger.dsp
+    faust2jack -osc FOFvocoder.dsp
+    faust2jack -osc Karplus-StrongSinger.dsp
+    faust2jack -osc -sch -t 99999 Karplus-StrongSingerMaxi.dsp
+    faust2jack -osc PAFvocoder.dsp
+    faust2jack -osc -sch -t 99999 stringSinger.dsp
+    faust2jack -osc subSinger.dsp
+    # doesn't compile on most systems, too big:
+    #faust2jack -osc -sch -t 99999 VocSynthFull.dsp
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp launchers/* $out/bin/
+    cp classicVocoder $out/bin/
+    cp CZringmod $out/bin/
+    cp FMsinger $out/bin/
+    cp FOFvocoder $out/bin/
+    cp Karplus-StrongSinger $out/bin/
+    cp Karplus-StrongSingerMaxi $out/bin/
+    cp PAFvocoder $out/bin/
+    cp stringSinger $out/bin/
+    cp subSinger $out/bin/
+    #cp VocSynthFull $out/bin/
+    mkdir $out/PureData/
+    cp PureData/OscSendVoc.pd $out/PureData/OscSendVoc.pd
+  '';
+
+  meta = {
+    description = "Turn your voice into a synthesizer";
+    homepage = https://github.com/magnetophon/VoiceOfFaust;
+    license = stdenv.lib.licenses.gpl3;
+    maintainers = [ stdenv.lib.maintainers.magnetophon ];
+  };
+}
+

pkgs/applications/audio/beast/default.nix

@@ -29,9 +29,9 @@ stdenv.mkDerivation {
       ./patch.patch # patches taken from gentoo
     ];
 
-  meta = { 
+  meta = with stdenv.lib; {
     description = "A music composition and modular synthesis application";
     homepage = http://beast.gtk.org;
-    license = ["GPL-2" "LGPL-2.1"];
+    license = with licenses; [ gpl2 lgpl21 ];
   };
 }

pkgs/applications/audio/bitmeter/default.nix

@@ -0,0 +1,21 @@
+{ stdenv, fetchurl, jack2, gtk2, pkgconfig }:
+
+stdenv.mkDerivation rec {
+  name = "bitmeter-${version}";
+  version = "1.2";
+
+  src = fetchurl {
+    url = "http://devel.tlrmx.org/audio/source/${name}.tar.gz";
+    sha256 = "09ck2gxqky701dc1p0ip61rrn16v0pdc7ih2hc2sd63zcw53g2a7";
+  };
+
+  buildInputs = [ jack2 gtk2 pkgconfig ];
+
+  meta = with stdenv.lib; {
+    homepage = http://devel.tlrmx.org/audio/bitmeter/;
+    description = "Also known as jack bitscope. Useful to detect denormals.";
+    license = licenses.gpl2;
+    maintainers = [ maintainers.magnetophon ];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/audio/bristol/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, alsaLib, jack2, pkgconfig, pulseaudio, xlibs }:
+{ stdenv, fetchurl, alsaLib, jack2, pkgconfig, libpulseaudio, xlibs }:
 
 stdenv.mkDerivation  rec {
   name = "bristol-${version}";
@@ -10,7 +10,7 @@ stdenv.mkDerivation  rec {
   };
 
   buildInputs = [
-    alsaLib jack2 pkgconfig pulseaudio xlibs.libX11 xlibs.libXext
+    alsaLib jack2 pkgconfig libpulseaudio xlibs.libX11 xlibs.libXext
     xlibs.xproto
   ];
 

pkgs/applications/audio/chuck/default.nix

@@ -1,12 +1,12 @@
 { stdenv, fetchurl, alsaLib, bison, flex, libsndfile, which }:
 
 stdenv.mkDerivation rec {
-  version = "1.3.5.0";
+  version = "1.3.5.1";
   name = "chuck-${version}";
 
   src = fetchurl {
     url = "http://chuck.cs.princeton.edu/release/files/chuck-${version}.tgz";
-    sha256 = "0rj2l5k6ncm4jaiq0igwfc2bzryzchk1is1jhk1n7wifxcf3d3k5";
+    sha256 = "0lqzkphfd91kz95nf1wqy0z17r1m70c8inwvnb9fscbiaihwlhfi";
   };
 
   buildInputs = [ bison flex libsndfile which ]

pkgs/applications/audio/clementine/default.nix

@@ -46,8 +46,8 @@ let
     usbmuxd
   ];
 
-  unwrapped = stdenv.mkDerivation {
+  free = stdenv.mkDerivation {
-    name = "clementine-unwrapped-${version}";
+    name = "clementine-free-${version}";
     inherit patches src buildInputs;
     enableParallelBuilding = true;
     meta = with stdenv.lib; {
@@ -91,7 +91,7 @@ with stdenv.lib;
 
 runCommand "clementine-${version}"
 {
-  inherit blob unwrapped;
+  inherit blob free;
   buildInputs = [ makeWrapper ] ++ gst_plugins; # for the setup-hooks
   dontPatchELF = true;
   dontStrip = true;
@@ -109,7 +109,12 @@ runCommand "clementine-${version}"
 }
 ''
   mkdir -p $out/bin
-  makeWrapper "$unwrapped/bin/${exeName}" "$out/bin/${exeName}" \
+  makeWrapper "$free/bin/${exeName}" "$out/bin/${exeName}" \
       ${optionalString withSpotify "--set CLEMENTINE_SPOTIFYBLOB \"$blob/libexec/clementine\""} \
       --prefix GST_PLUGIN_SYSTEM_PATH : "$GST_PLUGIN_SYSTEM_PATH"
+
+  mkdir -p $out/share
+  for dir in applications icons kde4; do
+      ln -s "$free/share/$dir" "$out/share/$dir"
+  done
 ''

pkgs/applications/audio/cmus/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchgit, ncurses, pkgconfig, alsaLib, flac, libmad, ffmpeg, libvorbis, libmpc, mp4v2, libcue, pulseaudio}:
+{ stdenv, fetchgit, ncurses, pkgconfig, alsaLib, flac, libmad, ffmpeg, libvorbis, libmpc, mp4v2, libcue, libpulseaudio}:
 
 stdenv.mkDerivation rec {
   name = "cmus-${version}";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   configurePhase = "./configure prefix=$out";
 
-  buildInputs = [ ncurses pkgconfig alsaLib flac libmad ffmpeg libvorbis libmpc mp4v2 libcue pulseaudio ];
+  buildInputs = [ ncurses pkgconfig alsaLib flac libmad ffmpeg libvorbis libmpc mp4v2 libcue libpulseaudio ];
 
   meta = {
     description = "Small, fast and powerful console music player for Linux and *BSD";

pkgs/applications/audio/csound/default.nix

@@ -1,6 +1,6 @@
 { stdenv, fetchurl, cmake, libsndfile, flex, bison
 , alsaLib ? null
-, pulseaudio ? null
+, libpulseaudio ? null
 , tcltk ? null
 
 # maybe csound can be compiled with support for those, see configure output
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
     sha256 = "0w6ij57dbfjljpf05bb9r91jphwaq1v63rh0713vl2n11d73dy7m";
   };
 
-  buildInputs = [ cmake libsndfile flex bison alsaLib pulseaudio tcltk ];
+  buildInputs = [ cmake libsndfile flex bison alsaLib libpulseaudio tcltk ];
 
   meta = {
     description = "sound design, audio synthesis, and signal processing system, providing facilities for music composition and performance on all major operating systems and platforms";

pkgs/applications/audio/deadbeef/default.nix

@@ -18,7 +18,7 @@
 , osdSupport ? true, dbus ? null
 # output plugins
 , alsaSupport ? true, alsaLib ? null
-, pulseSupport ? true, pulseaudio ? null
+, pulseSupport ? true, libpulseaudio ? null
 # effect plugins
 , resamplerSupport ? true, libsamplerate ? null
 , overloadSupport ? true, zlib ? null
@@ -41,7 +41,7 @@ assert artworkSupport -> imlib2 != null;
 assert hotkeysSupport -> libX11 != null;
 assert osdSupport -> dbus != null;
 assert alsaSupport -> alsaLib != null;
-assert pulseSupport -> pulseaudio != null;
+assert pulseSupport -> libpulseaudio != null;
 assert resamplerSupport -> libsamplerate != null;
 assert overloadSupport -> zlib != null;
 assert wavpackSupport -> wavpack != null;
@@ -70,7 +70,7 @@ stdenv.mkDerivation rec {
     ++ optional hotkeysSupport libX11
     ++ optional osdSupport dbus
     ++ optional alsaSupport alsaLib
-    ++ optional pulseSupport pulseaudio
+    ++ optional pulseSupport libpulseaudio
     ++ optional resamplerSupport libsamplerate
     ++ optional overloadSupport zlib
     ++ optional wavpackSupport wavpack

pkgs/applications/audio/drumkv1/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "drumkv1-${version}";
-  version = "0.6.1";
+  version = "0.6.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/drumkv1/${name}.tar.gz";
-    sha256 = "082ml6g63n6s3w704fjkma8085g2l10az3f6r78y9hpgpw3042jw";
+    sha256 = "1f0vpwq7vydldrq9fdfipbkzqqndyxlx0n81ch1i9kw81xj3sxjq";
   };
 
   buildInputs = [ jack2 libsndfile lv2 qt4 ];

pkgs/applications/audio/easytag/default.nix

@@ -1,6 +1,6 @@
 { stdenv, fetchurl, pkgconfig, intltool, gtk3, glib, libid3tag, id3lib, taglib
 , libvorbis, libogg, flac, itstool, libxml2, gsettings_desktop_schemas
-, makeWrapper, gnome_icon_theme, dconf
+, makeWrapper, gnome3
 }:
 
 stdenv.mkDerivation rec {
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   preFixup = ''
     wrapProgram $out/bin/easytag \
       --prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH:$out/share" \
-      --prefix GIO_EXTRA_MODULES : "${dconf}/lib/gio/modules"
+      --prefix GIO_EXTRA_MODULES : "${gnome3.dconf}/lib/gio/modules"
   '';
 
   NIX_LDFLAGS = "-lid3tag -lz";
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [
     pkgconfig intltool gtk3 glib libid3tag id3lib taglib libvorbis libogg flac
-    itstool libxml2 gsettings_desktop_schemas gnome_icon_theme dconf
+    itstool libxml2 gsettings_desktop_schemas gnome3.defaultIconTheme gnome3.dconf
   ];
 
   meta = {

pkgs/applications/audio/ekho/default.nix

@@ -1,5 +1,5 @@
 { stdenv, fetchurl, pkgconfig
-, libsndfile, pulseaudio
+, libsndfile, libpulseaudio
 }:
 
 let
@@ -35,5 +35,5 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
 
-  buildInputs = [ libsndfile pulseaudio ];
+  buildInputs = [ libsndfile libpulseaudio ];
 }

pkgs/applications/audio/eq10q/default.nix

@@ -0,0 +1,37 @@
+{ stdenv, fetchurl, cmake, fftw, gtkmm, libxcb, lv2, pkgconfig, xlibs }:
+stdenv.mkDerivation rec {
+  name = "eq10q-2-${version}";
+  version = "beta7.1";
+  src = fetchurl {
+    url = "http://downloads.sourceforge.net/project/eq10q/${name}.tar.gz";
+    sha256 = "1jmrcx4jlx8kgsy5n4jcxa6qkjqvx7d8l2p7dsmw4hj20s39lgyi";
+  };
+
+  buildInputs = [ cmake fftw gtkmm libxcb lv2 pkgconfig xlibs.libpthreadstubs xlibs.libXdmcp xlibs.libxshmfence ];
+
+  installFlags = ''
+    DESTDIR=$(out)
+  '';
+
+  fixupPhase = ''
+    cp -r $out/var/empty/local/lib $out
+    rm -R $out/var
+  '';
+
+  meta = {
+    description = "LV2 EQ plugins and more, with 64 bit processing";
+    longDescription = ''
+      Up to 10-Bands parametric equalizer with mono and stereo versions.
+      Versatile noise-gate plugin with mono and stereo versions.
+      Compressor plugin with mono and stereo versions.
+      BassUp plugin - Enhanceing the bass guitar sound or other low frequency sounding instruments.
+      Improved high frequency response for peaking filter (in equalizers).
+      64 bits floating point internal audio processing.
+      Nice GUI with powerful metering for every plugin.
+    '';
+    homepage = http://eq10q.sourceforge.net/;
+    license = stdenv.lib.licenses.gpl3;
+    maintainers = [ stdenv.lib.maintainers.magnetophon ];
+    platforms = stdenv.lib.platforms.linux;
+  };
+}

pkgs/applications/audio/fldigi/default.nix

@@ -1,5 +1,5 @@
 { stdenv, fetchurl, hamlib, fltk13, libjpeg, libpng, portaudio, libsndfile,
-  libsamplerate, pulseaudio, libXinerama, gettext, pkgconfig, alsaLib }:
+  libsamplerate, libpulseaudio, libXinerama, gettext, pkgconfig, alsaLib }:
 
 stdenv.mkDerivation rec {
   version = "3.22.02";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [ libXinerama gettext hamlib fltk13 libjpeg libpng portaudio
-                  libsndfile libsamplerate pulseaudio pkgconfig alsaLib ];
+                  libsndfile libsamplerate libpulseaudio pkgconfig alsaLib ];
 
   meta = {
     description = "Digital modem program";

pkgs/applications/audio/fluidsynth/default.nix

@@ -1,5 +1,5 @@
 { stdenv, fetchurl, alsaLib, glib, jack2, libsndfile, pkgconfig
-, pulseaudio }:
+, libpulseaudio }:
 
 stdenv.mkDerivation  rec {
   name = "fluidsynth-${version}";
@@ -21,7 +21,7 @@ stdenv.mkDerivation  rec {
     "-framework CoreAudio";
 
   buildInputs = [ glib libsndfile pkgconfig ]
-    ++ stdenv.lib.optionals (!stdenv.isDarwin) [ alsaLib pulseaudio jack2 ];
+    ++ stdenv.lib.optionals (!stdenv.isDarwin) [ alsaLib libpulseaudio jack2 ];
 
   meta = with stdenv.lib; {
     description = "Real-time software synthesizer based on the SoundFont 2 specifications";

pkgs/applications/audio/fmit/default.nix

@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
       ALSA or JACK as sound input library.
     '';
     homepage = http://home.gna.org/fmit/index.html;
-    license = with licenses; gpl3Plus;
+    license = licenses.gpl3Plus;
     platforms = with platforms; linux;
     maintainers = with maintainers; [ nckx ];
   };

pkgs/applications/audio/foo-yc20/default.nix

@@ -0,0 +1,27 @@
+{ stdenv, fetchFromGitHub,  jack2, gtk2, lv2, faust, pkgconfig }:
+
+stdenv.mkDerivation rec {
+  version = "git-2015-05-21";
+  name = "foo-yc20-${version}";
+  src = fetchFromGitHub {
+    owner = "sampov2";
+    repo = "foo-yc20";
+    rev = "edd9d14c91229429b14270a181743e1046160ca8";
+    sha256 = "0i8261n95n4xic766h70xkrpbvw3sag96n1883ahmg6h7yb94avq";
+  };
+
+  buildInputs = [ jack2 gtk2 lv2 faust pkgconfig ];
+
+  makeFlags = "PREFIX=$(out)";
+
+  # remove lv2 until https://github.com/sampov2/foo-yc20/issues/6 is resolved
+  postInstallFixup = "rm -rf $out/lib/lv2";
+
+  meta = {
+    description = "A Faust implementation of a 1969 designed Yamaha combo organ, the YC-20";
+    homepage = https://github.com/sampov2/foo-yc20;
+    license     = "BSD";
+    maintainers = stdenv.lib.maintainers.magnetophon;
+    platforms = stdenv.lib.platforms.linux;
+  };
+}

pkgs/applications/audio/freewheeling/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchsvn, pkgconfig, autoconf, automake, gnutls, freetype
+{ stdenv, fetchsvn, pkgconfig, autoconf, automake, gnutls33, freetype
 , SDL, SDL_gfx, SDL_ttf, liblo, libxml2, alsaLib, jack2, libvorbis
 , libsndfile, libogg
 }:
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
   };
 
   buildInputs = [
-    pkgconfig autoconf automake gnutls freetype SDL SDL_gfx SDL_ttf
+    pkgconfig autoconf automake gnutls33 freetype SDL SDL_gfx SDL_ttf
     liblo libxml2 jack2 alsaLib libvorbis libsndfile libogg
   ];
 

pkgs/applications/audio/gpodder/default.nix

@@ -1,5 +1,5 @@
 { pkgs, stdenv, fetchurl, python, buildPythonPackage, pythonPackages, mygpoclient, intltool,
-  ipodSupport ? true, libgpod, gnome3, hicolor_icon_theme }:
+  ipodSupport ? true, libgpod, gnome3 }:
 
 with pkgs.lib;
 
@@ -16,8 +16,7 @@ in buildPythonPackage rec {
 
   buildInputs = [
     coverage feedparser minimock sqlite3 mygpoclient intltool
-    gnome3.gnome_themes_standard gnome3.gnome_icon_theme
+    gnome3.gnome_themes_standard gnome3.defaultIconTheme
-    gnome3.gnome_icon_theme_symbolic hicolor_icon_theme
     gnome3.gsettings_desktop_schemas
   ];
 

pkgs/applications/audio/gtkpod/default.nix

@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ pkgconfig makeWrapper intltool curl gettext perl perlXMLParser
     flex libgpod libid3tag flac libvorbis gtk3 gdk_pixbuf libglade gnome.anjuta
-    gnome.gdl gnome.gnome_icon_theme_symbolic gnome.gnome_icon_theme
+    gnome.gdl gnome.defaultIconTheme
     hicolor_icon_theme ];
 
   patchPhase = ''

pkgs/applications/audio/guitarix/default.nix

@@ -1,6 +1,7 @@
 { stdenv, fetchurl, gettext, intltool, pkgconfig, python
 , avahi, bluez, boost, eigen, fftw, glib, glibmm, gtk, gtkmm, jack2
 , ladspaH, librdf, libsndfile, lilv, lv2, serd, sord, sratom
+,  zita-convolver, zita-resampler
 , optimizationSupport ? false # Enable support for native CPU extensions
 }:
 
@@ -22,15 +23,14 @@ stdenv.mkDerivation rec {
   buildInputs = [
     avahi bluez boost eigen fftw glib glibmm gtk gtkmm jack2
     ladspaH librdf libsndfile lilv lv2 serd sord sratom
+    zita-convolver zita-resampler
   ];
 
   configureFlags = [
     "--shared-lib"
     "--no-desktop-update"
-    "--no-faust" # Need to package a release of faust, 0.9.58 or 0.9.65
     "--enable-nls"
-    "--includeresampler" # Zita-resampler not packaged, use vendored version
+    "--no-faust" # todo: find out why --faust doesn't work
-    "--includeconvolver" # Zita-convolver not packaged, use vendored version
   ] ++ optional optimizationSupport "--optimization";
 
   configurePhase = ''python waf configure --prefix=$out $configureFlags'';

pkgs/applications/audio/ir.lv2/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, gtk, lv2, libsamplerate, libsndfile, pkgconfig, zita-convolver }:
+{ stdenv, fetchurl, fftw, gtk, lv2, libsamplerate, libsndfile, pkgconfig, zita-convolver }:
 
 stdenv.mkDerivation rec {
   name = "ir.lv2-${version}";
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "17a6h2mv9xv41jpbx6bdakkngin4kqzh2v67l4076ddq609k5a7v";
   };
 
-  buildInputs = [ gtk lv2 libsamplerate libsndfile pkgconfig zita-convolver ];
+  buildInputs = [ fftw gtk lv2 libsamplerate libsndfile pkgconfig zita-convolver ];
 
   buildPhase = ''
     make

pkgs/applications/audio/jaaa/default.nix

@@ -25,29 +25,20 @@ stdenv.mkDerivation rec {
     "-I${zita-alsa-pcmi}/include"
   ];
 
-  patchPhase = ''
+  makeFlags = [
-    cd source/
+    "PREFIX=$(out)"
-    sed -i "s@clthreads.h@${libclthreads}/include@g" $(find . -name '*.cc')
+    "SUFFIX=''"
-    sed -i "s@clxclient.h@${libclxclient}/include@g" $(find . -name '*.cc')
+  ];
-    sed -i "s@clthreads.h@${libclthreads}/include@g" $(find . -name '*.h')
-    sed -i "s@clxclient.h@${libclxclient}/include@g" $(find . -name '*.h')
-  '';
 
-  buildlPhase = ''
+  preConfigure = ''
-    make PREFIX="$out"
+    cd ./source/
-  '';
-
-  installPhase = ''
-    echo zita= ${zita-alsa-pcmi}
-    make PREFIX="$out" install
-    install -Dm644 ../README "$out/README"
   '';
 
   meta = with stdenv.lib; {
     homepage = http://kokkinizita.linuxaudio.org/linuxaudio/index.html;
     description = "JACK and ALSA Audio Analyser";
     license = licenses.gpl2;
-    maintainers = [ maintainers.magnetophon ];
+    maintainers = with maintainers; [ magnetophon ];
     platforms = platforms.linux;
   };
 }

pkgs/applications/audio/keyfinder-cli/default.nix

@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
       used to estimate the musical key of many different audio formats.
     '';
     homepage = https://github.com/EvanPurkhiser/keyfinder-cli;
-    license = with licenses; gpl3Plus;
+    license = licenses.gpl3Plus;
     platforms = with platforms; linux;
     maintainers = with maintainers; [ nckx ];
   };

pkgs/applications/audio/keyfinder/default.nix

@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
       efficient workflow tool.
     '';
     homepage = http://www.ibrahimshaath.co.uk/keyfinder/;
-    license = with licenses; gpl3Plus;
+    license = licenses.gpl3Plus;
     platforms = with platforms; linux;
     maintainers = with maintainers; [ nckx ];
   };

pkgs/applications/audio/ladspa-sdk/default.nix

@@ -0,0 +1,28 @@
+{ stdenv, fetchurl }:
+stdenv.mkDerivation rec {
+  name = "ladspa-sdk-${version}";
+  version = "1.13";
+  src = fetchurl {
+    url = "http://www.ladspa.org/download/ladspa_sdk_${version}.tgz";
+    sha256 = "0srh5n2l63354bc0srcrv58rzjkn4gv8qjqzg8dnq3rs4m7kzvdm";
+  };
+
+  patchPhase = ''
+    cd src
+    sed -i 's@/usr/@$(out)/@g'  makefile
+    sed -i 's@-mkdirhier@mkdir -p@g'  makefile
+  '';
+
+  meta = {
+    description = "The SDK for the LADSPA audio plugin standard";
+    longDescription = ''
+      The LADSPA SDK, including the ladspa.h API header file,
+      ten example LADSPA plugins and 
+      three example programs (applyplugin, analyseplugin and listplugins).
+    '';
+    homepage = http://www.ladspa.org/ladspa_sdk/overview.html;
+    license = stdenv.lib.licenses.lgpl2;
+    maintainers = [ stdenv.lib.maintainers.magnetophon ];
+    platforms = stdenv.lib.platforms.linux;
+  };
+}

pkgs/applications/audio/lmms/default.nix

@@ -1,6 +1,6 @@
 { stdenv, fetchurl, SDL, alsaLib, cmake, fftwSinglePrec, fluidsynth
 , fltk13, jack2, libvorbis , libsamplerate, libsndfile, pkgconfig
-, pulseaudio, qt4, freetype
+, libpulseaudio, qt4, freetype
 }:
 
 stdenv.mkDerivation  rec {
@@ -14,7 +14,7 @@ stdenv.mkDerivation  rec {
 
   buildInputs = [
     SDL alsaLib cmake fftwSinglePrec fltk13 fluidsynth jack2
-    libsamplerate libsndfile libvorbis pkgconfig pulseaudio qt4
+    libsamplerate libsndfile libvorbis pkgconfig libpulseaudio qt4
   ];
 
   enableParallelBuilding = true;

pkgs/applications/audio/mhwaveedit/default.nix

@@ -1,5 +1,5 @@
 { stdenv, fetchurl, SDL , alsaLib, gtk, jack2, ladspaH
-, ladspaPlugins, libsamplerate, libsndfile, pkgconfig, pulseaudio }:
+, ladspaPlugins, libsamplerate, libsndfile, pkgconfig, libpulseaudio }:
 
 stdenv.mkDerivation  rec {
   name = "mhwaveedit-${version}";
@@ -12,7 +12,7 @@ stdenv.mkDerivation  rec {
 
   buildInputs =
    [ SDL alsaLib gtk jack2 ladspaH libsamplerate libsndfile
-     pkgconfig pulseaudio
+     pkgconfig libpulseaudio
    ];
 
   configureFlags = "--with-default-ladspa-path=${ladspaPlugins}/lib/ladspa";

pkgs/applications/audio/minimodem/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, fftw, fftwSinglePrec, alsaLib, libsndfile, pulseaudio }:
+{ stdenv, fetchurl, pkgconfig, fftw, fftwSinglePrec, alsaLib, libsndfile, libpulseaudio }:
 
 stdenv.mkDerivation rec {
   version = "0.19";
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "003xyqjq59wcjafrdv1b8w34xsn4nvzz51wwd7mqddajh0g4dz4g";
   };
 
-  buildInputs = [ pkgconfig fftw fftwSinglePrec alsaLib libsndfile pulseaudio ];
+  buildInputs = [ pkgconfig fftw fftwSinglePrec alsaLib libsndfile libpulseaudio ];
 
   meta = {
     description = "General-purpose software audio FSK modem";