Merge branch 'master' into staging

lib/maintainers.nix

@@ -582,7 +582,7 @@
   rushmorem = "Rushmore Mushambi <rushmore@webenchanter.com>";
   rvl = "Rodney Lorrimar <dev+nix@rodney.id.au>";
   rvlander = "Gaëtan André <rvlander@gaetanandre.eu>";
-  rvolosatovs = "Roman Volosatovs <rvolosatovs@riseup.net";
+  rvolosatovs = "Roman Volosatovs <rvolosatovs@riseup.net>";
   ryanartecona = "Ryan Artecona <ryanartecona@gmail.com>";
   ryansydnor = "Ryan Sydnor <ryan.t.sydnor@gmail.com>";
   ryantm = "Ryan Mulligan <ryan@ryantm.com>";

nixos/doc/manual/release-notes/rl-1803.xml

@@ -139,6 +139,12 @@ following incompatible changes:</para>
       will be accessible at <literal>/run/memcached/memcached.sock</literal>.
     </para>
   </listitem>
+  <listitem>
+    <para>
+      The DNSCrypt proxy module has been removed, the upstream project
+      is no longer maintained.
+    </para>
+  </listitem>
 </itemizedlist>
 
 </section>

nixos/modules/module-list.nix

@@ -446,7 +446,6 @@
   ./services/networking/dhcpd.nix
   ./services/networking/dnscache.nix
   ./services/networking/dnschain.nix
-  ./services/networking/dnscrypt-proxy.nix
   ./services/networking/dnscrypt-wrapper.nix
   ./services/networking/dnsmasq.nix
   ./services/networking/ejabberd.nix

nixos/modules/rename.nix

@@ -89,6 +89,9 @@ with lib;
     # Tarsnap
     (mkRenamedOptionModule [ "services" "tarsnap" "config" ] [ "services" "tarsnap" "archives" ])
 
+    # dnscrypt-proxy
+    (mkRemovedOptionModule [ "services" "dnscrypt-proxy" "enable" ] "")
+
     # ibus
     (mkRenamedOptionModule [ "programs" "ibus" "plugins" ] [ "i18n" "inputMethod" "ibus" "engines" ])
 

nixos/modules/services/audio/mopidy.nix

@@ -4,17 +4,22 @@ with pkgs;
 with lib;
 
 let
-
   uid = config.ids.uids.mopidy;
   gid = config.ids.gids.mopidy;
   cfg = config.services.mopidy;
 
   mopidyConf = writeText "mopidy.conf" cfg.configuration;
 
-  mopidyEnv = python.buildEnv.override {
+  mopidyEnv = buildEnv {
-    extraLibs = [ mopidy ] ++ cfg.extensionPackages;
+    name = "mopidy-with-extensions-${mopidy.version}";
+    paths = closePropagation cfg.extensionPackages;
+    pathsToLink = [ "/${python.sitePackages}" ];
+    buildInputs = [ makeWrapper ];
+    postBuild = ''
+      makeWrapper ${mopidy}/bin/mopidy $out/bin/mopidy \
+        --prefix PYTHONPATH : $out/${python.sitePackages}
+    '';
   };
-
 in {
 
   options = {
@@ -61,7 +66,6 @@ in {
 
   };
 
-
   ###### implementation
 
   config = mkIf cfg.enable {

nixos/modules/services/misc/matrix-synapse.nix

@@ -578,6 +578,18 @@ in {
           Extra config options for matrix-synapse.
         '';
       };
+      extraConfigFiles = mkOption {
+        type = types.listOf types.path;
+        default = [];
+        description = ''
+          Extra config files to include.
+
+          The configuration files will be included based on the command line
+          argument --config-path. This allows to configure secrets without
+          having to go through the Nix store, e.g. based on deployment keys if
+          NixOPS is in use.
+        '';
+      };
       logConfig = mkOption {
         type = types.lines;
         default = readFile ./matrix-synapse-log_config.yaml;
@@ -627,7 +639,11 @@ in {
         Group = "matrix-synapse";
         WorkingDirectory = cfg.dataDir;
         PermissionsStartOnly = true;
-        ExecStart = "${cfg.package}/bin/homeserver --config-path ${configFile} --keys-directory ${cfg.dataDir}";
+        ExecStart = ''
+          ${cfg.package}/bin/homeserver \
+            ${ concatMapStringsSep "\n  " (x: "--config-path ${x} \\") ([ configFile ] ++ cfg.extraConfigFiles) }
+            --keys-directory ${cfg.dataDir}
+        '';
         Restart = "on-failure";
       };
     };

nixos/modules/services/networking/dnscrypt-proxy.nix

@@ -1,321 +0,0 @@
-{ config, lib, pkgs, ... }:
-with lib;
-
-let
-  cfg = config.services.dnscrypt-proxy;
-
-  stateDirectory = "/var/lib/dnscrypt-proxy";
-
-  # The minisign public key used to sign the upstream resolver list.
-  # This is somewhat more flexible than preloading the key as an
-  # embedded string.
-  upstreamResolverListPubKey = pkgs.fetchurl {
-    url = https://raw.githubusercontent.com/jedisct1/dnscrypt-proxy/master/minisign.pub;
-    sha256 = "18lnp8qr6ghfc2sd46nn1rhcpr324fqlvgsp4zaigw396cd7vnnh";
-  };
-
-  # Internal flag indicating whether the upstream resolver list is used.
-  useUpstreamResolverList = cfg.customResolver == null;
-
-  # The final local address.
-  localAddress = "${cfg.localAddress}:${toString cfg.localPort}";
-
-  # The final resolvers list path.
-  resolverList = "${stateDirectory}/dnscrypt-resolvers.csv";
-
-  # Build daemon command line
-
-  resolverArgs =
-    if (cfg.customResolver == null)
-      then
-        [ "-L ${resolverList}"
-          "-R ${cfg.resolverName}"
-        ]
-      else with cfg.customResolver;
-        [ "-N ${name}"
-          "-k ${key}"
-          "-r ${address}:${toString port}"
-        ];
-
-  daemonArgs =
-       [ "-a ${localAddress}" ]
-    ++ resolverArgs
-    ++ cfg.extraArgs;
-in
-
-{
-  meta = {
-    maintainers = with maintainers; [ joachifm ];
-    doc = ./dnscrypt-proxy.xml;
-  };
-
-  options = {
-    # Before adding another option, consider whether it could
-    # equally well be passed via extraArgs.
-
-    services.dnscrypt-proxy = {
-      enable = mkOption {
-        default = false;
-        type = types.bool;
-        description = "Whether to enable the DNSCrypt client proxy";
-      };
-
-      localAddress = mkOption {
-        default = "127.0.0.1";
-        type = types.str;
-        description = ''
-          Listen for DNS queries to relay on this address. The only reason to
-          change this from its default value is to proxy queries on behalf
-          of other machines (typically on the local network).
-        '';
-      };
-
-      localPort = mkOption {
-        default = 53;
-        type = types.int;
-        description = ''
-          Listen for DNS queries to relay on this port. The default value
-          assumes that the DNSCrypt proxy should relay DNS queries directly.
-          When running as a forwarder for another DNS client, set this option
-          to a different value; otherwise leave the default.
-        '';
-      };
-
-      resolverName = mkOption {
-        default = "random";
-        example = "dnscrypt.eu-nl";
-        type = types.nullOr types.str;
-        description = ''
-          The name of the DNSCrypt resolver to use, taken from
-          <filename>${resolverList}</filename>.  The default is to
-          pick a random non-logging resolver that supports DNSSEC.
-        '';
-      };
-
-      customResolver = mkOption {
-        default = null;
-        description = ''
-          Use an unlisted resolver (e.g., a private DNSCrypt provider). For
-          advanced users only. If specified, this option takes precedence.
-        '';
-        type = types.nullOr (types.submodule ({ ... }: { options = {
-          address = mkOption {
-            type = types.str;
-            description = "IP address";
-            example = "208.67.220.220";
-          };
-
-          port = mkOption {
-            type = types.int;
-            description = "Port";
-            default = 443;
-          };
-
-          name = mkOption {
-            type = types.str;
-            description = "Fully qualified domain name";
-            example = "2.dnscrypt-cert.example.com";
-          };
-
-          key = mkOption {
-            type = types.str;
-            description = "Public key";
-            example = "B735:1140:206F:225D:3E2B:D822:D7FD:691E:A1C3:3CC8:D666:8D0C:BE04:BFAB:CA43:FB79";
-          };
-        }; }));
-      };
-
-      extraArgs = mkOption {
-        default = [];
-        type = types.listOf types.str;
-        description = ''
-          Additional command-line arguments passed verbatim to the daemon.
-          See <citerefentry><refentrytitle>dnscrypt-proxy</refentrytitle>
-          <manvolnum>8</manvolnum></citerefentry> for details.
-        '';
-        example = [ "-X libdcplugin_example_cache.so,--min-ttl=60" ];
-      };
-    };
-  };
-
-  config = mkIf cfg.enable (mkMerge [{
-    assertions = [
-      { assertion = (cfg.customResolver != null) || (cfg.resolverName != null);
-        message   = "please configure upstream DNSCrypt resolver";
-      }
-    ];
-
-    users.users.dnscrypt-proxy = {
-      description = "dnscrypt-proxy daemon user";
-      isSystemUser = true;
-      group = "dnscrypt-proxy";
-    };
-    users.groups.dnscrypt-proxy = {};
-
-    systemd.sockets.dnscrypt-proxy = {
-      description = "dnscrypt-proxy listening socket";
-      documentation = [ "man:dnscrypt-proxy(8)" ];
-
-      wantedBy = [ "sockets.target" ];
-
-      socketConfig = {
-        ListenStream = localAddress;
-        ListenDatagram = localAddress;
-      };
-    };
-
-    systemd.services.dnscrypt-proxy = {
-      description = "dnscrypt-proxy daemon";
-      documentation = [ "man:dnscrypt-proxy(8)" ];
-
-      before = [ "nss-lookup.target" ];
-      after = [ "network.target" ];
-      requires = [ "dnscrypt-proxy.socket "];
-
-      serviceConfig = {
-        NonBlocking = "true";
-        ExecStart = "${pkgs.dnscrypt-proxy}/bin/dnscrypt-proxy ${toString daemonArgs}";
-        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
-
-        User = "dnscrypt-proxy";
-
-        PrivateTmp = true;
-        PrivateDevices = true;
-        ProtectHome = true;
-      };
-    };
-    }
-
-    (mkIf config.security.apparmor.enable {
-    systemd.services.dnscrypt-proxy.after = [ "apparmor.service" ];
-
-    security.apparmor.profiles = singleton (pkgs.writeText "apparmor-dnscrypt-proxy" ''
-      ${pkgs.dnscrypt-proxy}/bin/dnscrypt-proxy {
-        /dev/null rw,
-        /dev/urandom r,
-
-        /etc/passwd r,
-        /etc/group r,
-        ${config.environment.etc."nsswitch.conf".source} r,
-
-        ${getLib pkgs.glibc}/lib/*.so mr,
-        ${pkgs.tzdata}/share/zoneinfo/** r,
-
-        network inet stream,
-        network inet6 stream,
-        network inet dgram,
-        network inet6 dgram,
-
-        ${getLib pkgs.dnscrypt-proxy}/lib/dnscrypt-proxy/libdcplugin*.so mr,
-
-        ${getLib pkgs.gcc.cc}/lib/libssp.so.* mr,
-        ${getLib pkgs.libsodium}/lib/libsodium.so.* mr,
-        ${getLib pkgs.systemd}/lib/libsystemd.so.* mr,
-        ${getLib pkgs.xz}/lib/liblzma.so.* mr,
-        ${getLib pkgs.libgcrypt}/lib/libgcrypt.so.* mr,
-        ${getLib pkgs.libgpgerror}/lib/libgpg-error.so.* mr,
-        ${getLib pkgs.libcap}/lib/libcap.so.* mr,
-        ${getLib pkgs.lz4}/lib/liblz4.so.* mr,
-        ${getLib pkgs.attr}/lib/libattr.so.* mr, # */
-
-        ${resolverList} r,
-
-        /run/systemd/notify rw,
-      }
-    '');
-    })
-
-    (mkIf useUpstreamResolverList {
-    systemd.services.init-dnscrypt-proxy-statedir = {
-      description = "Initialize dnscrypt-proxy state directory";
-
-      wantedBy = [ "dnscrypt-proxy.service" ];
-      before = [ "dnscrypt-proxy.service" ];
-
-      script = ''
-        mkdir -pv ${stateDirectory}
-        chown -c dnscrypt-proxy:dnscrypt-proxy ${stateDirectory}
-        cp -uv \
-          ${pkgs.dnscrypt-proxy}/share/dnscrypt-proxy/dnscrypt-resolvers.csv \
-          ${stateDirectory}
-      '';
-
-      serviceConfig = {
-        Type = "oneshot";
-        RemainAfterExit = true;
-      };
-    };
-
-    systemd.services.update-dnscrypt-resolvers = {
-      description = "Update list of DNSCrypt resolvers";
-
-      requires = [ "init-dnscrypt-proxy-statedir.service" ];
-      after = [ "init-dnscrypt-proxy-statedir.service" ];
-
-      path = with pkgs; [ curl diffutils dnscrypt-proxy minisign ];
-      script = ''
-        cd ${stateDirectory}
-        domain=raw.githubusercontent.com
-        get="curl -fSs --resolve $domain:443:$(hostip -r 8.8.8.8 $domain | head -1)"
-        $get -o dnscrypt-resolvers.csv.tmp \
-          https://$domain/jedisct1/dnscrypt-proxy/master/dnscrypt-resolvers.csv
-        $get -o dnscrypt-resolvers.csv.minisig.tmp \
-          https://$domain/jedisct1/dnscrypt-proxy/master/dnscrypt-resolvers.csv.minisig
-        mv dnscrypt-resolvers.csv.minisig{.tmp,}
-        if ! minisign -q -V -p ${upstreamResolverListPubKey} \
-          -m dnscrypt-resolvers.csv.tmp -x dnscrypt-resolvers.csv.minisig ; then
-          echo "failed to verify resolver list!" >&2
-          exit 1
-        fi
-        [[ -f dnscrypt-resolvers.csv ]] && mv dnscrypt-resolvers.csv{,.old}
-        mv dnscrypt-resolvers.csv{.tmp,}
-        if cmp dnscrypt-resolvers.csv{,.old} ; then
-          echo "no change"
-        else
-          echo "resolver list updated"
-        fi
-      '';
-
-      serviceConfig = {
-        PrivateTmp = true;
-        PrivateDevices = true;
-        ProtectHome = true;
-        ProtectSystem = "strict";
-        ReadWritePaths = "${dirOf stateDirectory} ${stateDirectory}";
-        SystemCallFilter = "~@mount";
-      };
-    };
-
-    systemd.timers.update-dnscrypt-resolvers = {
-      wantedBy = [ "timers.target" ];
-      timerConfig = {
-        OnBootSec = "5min";
-        OnUnitActiveSec = "6h";
-      };
-    };
-    })
-    ]);
-
-  imports = [
-    (mkRenamedOptionModule [ "services" "dnscrypt-proxy" "port" ] [ "services" "dnscrypt-proxy" "localPort" ])
-
-    (mkChangedOptionModule
-      [ "services" "dnscrypt-proxy" "tcpOnly" ]
-      [ "services" "dnscrypt-proxy" "extraArgs" ]
-      (config:
-        let val = getAttrFromPath [ "services" "dnscrypt-proxy" "tcpOnly" ] config; in
-        optional val "-T"))
-
-    (mkChangedOptionModule
-      [ "services" "dnscrypt-proxy" "ephemeralKeys" ]
-      [ "services" "dnscrypt-proxy" "extraArgs" ]
-      (config:
-        let val = getAttrFromPath [ "services" "dnscrypt-proxy" "ephemeralKeys" ] config; in
-        optional val "-E"))
-
-    (mkRemovedOptionModule [ "services" "dnscrypt-proxy" "resolverList" ] ''
-      The current resolver listing from upstream is always used
-      unless a custom resolver is specified.
-    '')
-  ];
-}

nixos/modules/services/networking/dnscrypt-proxy.xml

@@ -1,69 +0,0 @@
-<chapter xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-dnscrypt-proxy">
-
-  <title>DNSCrypt client proxy</title>
-
-  <para>
-    The DNSCrypt client proxy relays DNS queries to a DNSCrypt enabled
-    upstream resolver. The traffic between the client and the upstream
-    resolver is encrypted and authenticated, mitigating the risk of MITM
-    attacks, DNS poisoning attacks, and third-party snooping (assuming the
-    upstream is trustworthy).
-  </para>
-
-  <sect1><title>Basic configuration</title>
-
-  <para>
-    To enable the client proxy, set
-    <programlisting>
-      services.dnscrypt-proxy.enable = true;
-    </programlisting>
-  </para>
-
-  <para>
-    Enabling the client proxy does not alter the system nameserver; to
-    relay local queries, prepend <literal>127.0.0.1</literal> to
-    <option>networking.nameservers</option>.
-  </para>
-
-  </sect1>
-
-  <sect1><title>As a forwarder for another DNS client</title>
-
-  <para>
-    To run the DNSCrypt proxy client as a forwarder for another
-    DNS client, change the default proxy listening port to a
-    non-standard value and point the other client to it:
-    <programlisting>
-      services.dnscrypt-proxy.localPort = 43;
-    </programlisting>
-  </para>
-
-  <sect2><title>dnsmasq</title>
-  <para>
-    <programlisting>
-      {
-        services.dnsmasq.enable = true;
-        services.dnsmasq.servers = [ "127.0.0.1#43" ];
-      }
-    </programlisting>
-  </para>
-  </sect2>
-
-  <sect2><title>unbound</title>
-  <para>
-    <programlisting>
-      {
-        services.unbound.enable = true;
-        services.unbound.forwardAddresses = [ "127.0.0.1@43" ];
-      }
-    </programlisting>
-  </para>
-  </sect2>
-
-  </sect1>
-
-</chapter>

nixos/release.nix

@@ -255,7 +255,6 @@ in rec {
   tests.docker = hydraJob (import tests/docker.nix { system = "x86_64-linux"; });
   tests.docker-edge = hydraJob (import tests/docker-edge.nix { system = "x86_64-linux"; });
   tests.dovecot = callTest tests/dovecot.nix {};
-  tests.dnscrypt-proxy = callTest tests/dnscrypt-proxy.nix { system = "x86_64-linux"; };
   tests.ecryptfs = callTest tests/ecryptfs.nix {};
   tests.etcd = hydraJob (import tests/etcd.nix { system = "x86_64-linux"; });
   tests.ec2-nixops = hydraJob (import tests/ec2.nix { system = "x86_64-linux"; }).boot-ec2-nixops;

nixos/tests/dnscrypt-proxy.nix

@@ -1,32 +0,0 @@
-import ./make-test.nix ({ pkgs, ... }: {
-  name = "dnscrypt-proxy";
-  meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ joachifm ];
-  };
-
-  nodes = {
-    # A client running the recommended setup: DNSCrypt proxy as a forwarder
-    # for a caching DNS client.
-    client =
-    { config, pkgs, ... }:
-    let localProxyPort = 43; in
-    {
-      security.apparmor.enable = true;
-
-      services.dnscrypt-proxy.enable = true;
-      services.dnscrypt-proxy.localPort = localProxyPort;
-      services.dnscrypt-proxy.extraArgs = [ "-X libdcplugin_example.so" ];
-
-      services.dnsmasq.enable = true;
-      services.dnsmasq.servers = [ "127.0.0.1#${toString localProxyPort}" ];
-    };
-  };
-
-  testScript = ''
-    $client->waitForUnit("dnsmasq");
-
-    # The daemon is socket activated; sending a single ping should activate it.
-    $client->execute("${pkgs.iputils}/bin/ping -c1 example.com");
-    $client->succeed("systemctl is-active dnscrypt-proxy");
-  '';
-})

pkgs/applications/audio/audacity/default.nix

@@ -7,12 +7,12 @@
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
-  version = "2.2.0";
+  version = "2.2.1";
   name = "audacity-${version}";
 
   src = fetchurl {
     url = "https://github.com/audacity/audacity/archive/Audacity-${version}.tar.gz";
-    sha256 = "09xpr4bjnainz1xmc35v3qg3dadjr9wv8bmn1p4y91aqyihnhjry";
+    sha256 = "1n05r8b4rnf9fas0py0is8cm97s3h65dgvqkk040aym5d1x6wd7z";
   };
 
   preConfigure = /* we prefer system-wide libs */ ''

pkgs/applications/editors/jetbrains/default.nix

@@ -234,12 +234,12 @@ in
 
   clion = buildClion rec {
     name = "clion-${version}";
-    version = "2017.3"; /* updated by script */
+    version = "2017.3.1"; /* updated by script */
     description  = "C/C++ IDE. New. Intelligent. Cross-platform";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/cpp/CLion-${version}.tar.gz";
-      sha256 = "0gv9krqy4bhijx5s005qhswxnc05l1jsjlxs0h15z23bmv7rlpnf"; /* updated by script */
+      sha256 = "19pb78s5pa5ywifi1azs8gpg0a65c9n3yiqng348a7s27azkw01z"; /* updated by script */
     };
     wmClass = "jetbrains-clion";
     update-channel = "CLion_Release"; # channel's id as in http://www.jetbrains.com/updates/updates.xml
@@ -273,12 +273,12 @@ in
 
   idea-community = buildIdea rec {
     name = "idea-community-${version}";
-    version = "2017.3"; /* updated by script */
+    version = "2017.3.2";
     description = "Integrated Development Environment (IDE) by Jetbrains, community edition";
     license = stdenv.lib.licenses.asl20;
     src = fetchurl {
       url = "https://download.jetbrains.com/idea/ideaIC-${version}.tar.gz";
-      sha256 = "04qp37pv4z6d9gw6j56m4zfxw4v2cydk8w7jzyzrcg52jr064kwi"; /* updated by script */
+      sha256 = "70cc4f36a6517c7af980456758214414ea74c5c4f314ecf30dd2640600badd62"; /* updated by script */
     };
     wmClass = "jetbrains-idea-ce";
     update-channel = "IDEA_Release";
@@ -286,12 +286,12 @@ in
 
   idea-ultimate = buildIdea rec {
     name = "idea-ultimate-${version}";
-    version = "2017.3"; /* updated by script */
+    version = "2017.3.2"; /* updated by script */
     description = "Integrated Development Environment (IDE) by Jetbrains, requires paid license";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/idea/ideaIU-${version}-no-jdk.tar.gz";
-      sha256 = "0w9ihi6vzgfiav2qia7d7vrn14k8v56npir0dyx7ii8an887s7ws"; /* updated by script */
+      sha256 = "0lygnhn2wbs1678g3jbd3c5yzxnjp106qx7v9kgvb1k6l9mqb3my"; /* updated by script */
     };
     wmClass = "jetbrains-idea";
     update-channel = "IDEA_Release";
@@ -312,12 +312,12 @@ in
 
   pycharm-community = buildPycharm rec {
     name = "pycharm-community-${version}";
-    version = "2017.3"; /* updated by script */
+    version = "2017.3.2"; /* updated by script */
     description = "PyCharm Community Edition";
     license = stdenv.lib.licenses.asl20;
     src = fetchurl {
       url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "1lca3g5h716l97pkqfb8i7apsnx445xzcc9j41d0y3yyncf5hwxr"; /* updated by script */
+      sha256 = "1xp4hva2wj2r3haqwmji4vpg6xm9fsx2xihslwmq89vfrbzybyq6"; /* updated by script */
     };
     wmClass = "jetbrains-pycharm-ce";
     update-channel = "PyCharm_Release";
@@ -325,12 +325,12 @@ in
 
   pycharm-professional = buildPycharm rec {
     name = "pycharm-professional-${version}";
-    version = "2017.3"; /* updated by script */
+    version = "2017.3.2"; /* updated by script */
     description = "PyCharm Professional Edition";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "06lh0nxmzn0lsyd6isyb6gf01h4nbksi0f03hwwm6wdfvsfw92pb"; /* updated by script */
+      sha256 = "0bqavq9f9pg82yh04bpzpb3a36980v2bn70j1ch6gsm3hdd75swv"; /* updated by script */
     };
     wmClass = "jetbrains-pycharm";
     update-channel = "PyCharm_Release";
@@ -351,12 +351,12 @@ in
 
   ruby-mine = buildRubyMine rec {
     name = "ruby-mine-${version}";
-    version = "2017.3"; /* updated by script */
+    version = "2017.3.1"; /* updated by script */
     description = "The Most Intelligent Ruby and Rails IDE";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/ruby/RubyMine-${version}.tar.gz";
-      sha256 = "04h299mbzwrdgqxkff0vgpj2kbisb29l55mm6r45amgpqcnms6i5"; /* updated by script */
+      sha256 = "01y89blg30y41j2h254mhf7b7d7nd3bgscinn03vpkjfg7hzr689"; /* updated by script */
     };
     wmClass = "jetbrains-rubymine";
     update-channel = "rm2017.3";
@@ -364,12 +364,12 @@ in
 
   webstorm = buildWebStorm rec {
     name = "webstorm-${version}";
-    version = "2017.3"; /* updated by script */
+    version = "2017.3.2"; /* updated by script */
     description = "Professional IDE for Web and JavaScript development";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/webstorm/WebStorm-${version}.tar.gz";
-      sha256 = "0whr5zygrbi044pl48ac2w7a4rxldbaqlf76dkfqj83g2wl4n990"; /* updated by script */
+      sha256 = "1if99qjpnf9x7d3f1anpiglg9lwc3phamfd4wbyi9yjnk3rf5qcr"; /* updated by script */
     };
     wmClass = "jetbrains-webstorm";
     update-channel = "WS_Release";

pkgs/applications/editors/micro/default.nix

@@ -0,0 +1,28 @@
+{ stdenv, buildGoPackage, fetchFromGitHub }:
+
+buildGoPackage  rec {
+  name = "micro-${version}";
+  version = "1.3.4";
+
+  goPackagePath = "github.com/zyedidia/micro";
+
+  src = fetchFromGitHub {
+    owner = "zyedidia";
+    repo = "micro";
+    rev = "v${version}";
+    sha256 = "1giyp2xk2rb6vdyfnj5wa7qb9fwbcmmwm16wdlnmq7xnp7qamdkw";
+    fetchSubmodules = true;
+  };
+
+  subPackages = [ "cmd/micro" ];
+
+  buildFlagsArray = [ "-ldflags=" "-X main.Version=${version}" ];
+
+  meta = with stdenv.lib; {
+    homepage = https://micro-editor.github.io;
+    description = "Modern and intuitive terminal-based text editor";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dtzWill ];
+  };
+}
+

pkgs/applications/editors/tiled/default.nix

@@ -1,17 +1,15 @@
 { stdenv, fetchFromGitHub, pkgconfig, qmake
 , python, qtbase, qttools, zlib }:
 
-let
+stdenv.mkDerivation rec {
-#  qtEnv = with qt5; env "qt-${qtbase.version}" [ qtbase qttools ];
-in stdenv.mkDerivation rec {
   name = "tiled-${version}";
-  version = "1.0.3";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "bjorn";
     repo = "tiled";
     rev = "v${version}";
-    sha256 = "1j8307h7xkxqwr8rpr9fn1svm5h10k61w6zxr4sgph1hiv8x33aa";
+    sha256 = "1c6n5xshadxv5qwv8kfrj1kbfnkvx6nyxc9p4mpzkjrkxw1b1qf1";
   };
 
   nativeBuildInputs = [ pkgconfig qmake ];

pkgs/applications/misc/electron-cash/default.nix

@@ -7,14 +7,14 @@ let
 in
 
 python3Packages.buildPythonApplication rec {
-  version = "3.0";
+  version = "3.1.1";
   name = "electron-cash-${version}";
 
   src = fetchurl {
     url = "https://electroncash.org/downloads/${version}/win-linux/ElectronCash-${version}.tar.gz";
     # Verified using official SHA-1 and signature from
     # https://github.com/fyookball/keys-n-hashes
-    sha256 = "f0e2bf5c6d29da714eddd50b45761fea9fc905a0172c7b92df8fca7427439f1a";
+    sha256 = "cd42a0a0075787125f195508834d8c34d651896c0986d0b2066763add59bad2b";
   };
 
   propagatedBuildInputs = with python3Packages; [
@@ -36,6 +36,11 @@ python3Packages.buildPythonApplication rec {
     trezor
   ];
 
+  postPatch = ''
+    # Remove pyqt5 check
+    sed -i '/pyqt5/d' setup.py
+  '';
+
   preBuild = ''
     sed -i 's,usr_share = .*,usr_share = "'$out'/share",g' setup.py
     pyrcc5 icons.qrc -o gui/qt/icons_rc.py

pkgs/applications/misc/electrum/default.nix

@@ -2,11 +2,11 @@
 
 python3Packages.buildPythonApplication rec {
   name = "electrum-${version}";
-  version = "3.0.3";
+  version = "3.0.5";
 
   src = fetchurl {
     url = "https://download.electrum.org/${version}/Electrum-${version}.tar.gz";
-    sha256 = "09h3s1mbkliwh8758prbdk3sm19bnma7wy3k10pl9q9fkarbhp75";
+    sha256 = "06z0a5p1jg93jialphslip8d72q9yg3651qqaf494gs3h9kw1sv1";
   };
 
   propagatedBuildInputs = with python3Packages; [

pkgs/applications/misc/pdfpc/default.nix

@@ -4,13 +4,13 @@
 stdenv.mkDerivation rec {
   name = "${product}-${version}";
   product = "pdfpc";
-  version = "4.0.7";
+  version = "4.1";
 
   src = fetchFromGitHub {
     repo = "pdfpc";
     owner = "pdfpc";
     rev = "v${version}";
-    sha256 = "00qfmmk8h762p53z46g976z7j4fbxyi16w5axzsv1ymvdq95ds8c";
+    sha256 = "02cp0x5prqrizxdp0sf2sk5ip0363vyw6fxsb3zwyx4dw0vz4g96";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/instant-messengers/pidgin/default.nix

@@ -3,6 +3,7 @@
 , perl, perlXMLParser, libxml2, nss, nspr, farstream
 , libXScrnSaver, ncurses, avahi, dbus, dbus_glib, intltool, libidn
 , lib, python, libICE, libXext, libSM
+, cyrus_sasl ? null
 , openssl ? null
 , gnutls ? null
 , libgcrypt ? null
@@ -33,7 +34,7 @@ let unwrapped = stdenv.mkDerivation rec {
     libxml2 nss nspr farstream
     libXScrnSaver ncurses python
     avahi dbus dbus_glib intltool libidn
-    libICE libXext libSM
+    libICE libXext libSM cyrus_sasl
   ]
   ++ (lib.optional (openssl != null) openssl)
   ++ (lib.optional (gnutls != null) gnutls)
@@ -55,6 +56,7 @@ let unwrapped = stdenv.mkDerivation rec {
     "--disable-nm"
     "--disable-tcl"
   ]
+  ++ (lib.optionals (cyrus_sasl != null) [ "--enable-cyrus-sasl=yes" ])
   ++ (lib.optionals (gnutls != null) ["--enable-gnutls=yes" "--enable-nss=no"]);
 
   enableParallelBuilding = true;
@@ -78,4 +80,3 @@ in if plugins == [] then unwrapped
       inherit stdenv makeWrapper symlinkJoin plugins;
       pidgin = unwrapped;
     }
-

pkgs/applications/networking/remote/citrix-receiver/default.nix

@@ -67,9 +67,20 @@ let
       patch     = "0";
       x64hash   = "18fb374b9fb8e249b79178500dddca7a1f275411c6537e7695da5dcf19c5ba91";
       x86hash   = "4c68723b0327cf6f12da824056fce2b7853c38e6163a48c9d222b93dd8da75b6";
-      homepage  = https://www.citrix.com/downloads/citrix-receiver/linux/receiver-for-linux-latest.html; # Fix when updating version
       x64suffix = "10276927";
       x86suffix = "10276925";
+      homepage = https://www.citrix.com/downloads/citrix-receiver/legacy-receiver-for-linux/receiver-for-linux-137.html;
+    };
+
+    "13.8.0" = {
+      major = "13";
+      minor = "8";
+      patch = "0";
+      x64hash = "FDF5991CCD52B2B98289D7B2FB46D492D3E4032846D4AFA52CAA0F8AC0578931";
+      x86hash = "E0CFB43312BF79F753514B11F7B8DE4529823AE4C92D1B01E8A2C34F26AC57E7";
+      x64suffix = "10299729";
+      x86suffix = "10299729";
+      homepage = https://www.citrix.com/downloads/citrix-receiver/linux/receiver-for-linux-latest.html;
     };
   };
 

pkgs/applications/networking/syncthing012/default.nix

@@ -24,4 +24,12 @@ buildGoPackage rec {
   preBuild = ''
     export buildFlagsArray+=("-tags" "noupgrade release")
   '';
+
+  meta = {
+    knownVulnerabilities = [ "CVE-2017-1000420" ];
+    homepage = https://www.syncthing.net/;
+    description = "Open Source Continuous File Synchronization";
+    license = stdenv.lib.licenses.mpl20;
+    platforms = with stdenv.lib.platforms; linux ++ freebsd ++ openbsd ++ netbsd;
+  };
 }

pkgs/applications/networking/syncthing013/default.nix

@@ -29,6 +29,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
+    knownVulnerabilities = [ "CVE-2017-1000420" ];
     homepage = https://www.syncthing.net/;
     description = "Open Source Continuous File Synchronization";
     license = stdenv.lib.licenses.mpl20;

pkgs/applications/office/gnumeric/default.nix

@@ -9,11 +9,11 @@ let
   isonum = fetchurl { url = http://www.oasis-open.org/docbook/xml/4.5/ent/isonum.ent; sha256 = "04b62dw2g3cj9i4vn9xyrsrlz8fpmmijq98dm0nrkky31bwbbrs3"; };
   isogrk1 = fetchurl { url = http://www.oasis-open.org/docbook/xml/4.5/ent/isogrk1.ent; sha256 = "04b23anhs5wr62n4rgsjirzvw7rpjcsf8smz4ffzaqh3b0vw90vm"; };
 in stdenv.mkDerivation rec {
-  name = "gnumeric-1.12.36";
+  name = "gnumeric-1.12.38";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnumeric/1.12/${name}.tar.xz";
-    sha256 = "3cbfe25f26bd31b832efed2827ac35c3c1600bed9ccd233a4037a9f4d7c54848";
+    sha256 = "3435d7d93a47a32764b1ec2d03f7fbb348a97af52530815e49370803a1a69c65";
   };
 
   configureFlags = "--disable-component";

pkgs/applications/office/osmo/default.nix

@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   name = "osmo-${version}";
-  version = "0.4.0-1";
+  version = "0.4.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/osmo-pim/${name}.tar.gz";
-    sha256 = "fb454718e071c44bd360ce3e56cb29926cbf44a0d06ec738fa9b40fe3cbf8a33";
+    sha256 = "1gjd4w9jckfpqr9n0bw0w25h3qhfyzw1xvilh3hqdadfinwyal2v";
   };
 
   nativeBuildInputs = [ pkgconfig gettext wrapGAppsHook ];

pkgs/build-support/vm/default.nix

@@ -208,7 +208,7 @@ rec {
       -device virtio-rng-pci \
       -virtfs local,path=${storeDir},security_model=none,mount_tag=store \
       -virtfs local,path=$TMPDIR/xchg,security_model=none,mount_tag=xchg \
-      -drive file=$diskImage,if=virtio,cache=unsafe,werror=report \
+      ''${diskImage:+-drive file=$diskImage,if=virtio,cache=unsafe,werror=report} \
       -kernel ${kernel}/${img} \
       -initrd ${initrd}/initrd \
       -append "console=ttyS0 panic=1 command=${stage2Init} out=$out mountDisk=$mountDisk loglevel=4" \
@@ -223,8 +223,6 @@ rec {
     mkdir xchg
     mv saved-env xchg/
 
-    diskImage=''${diskImage:-/dev/null}
-
     eval "$preVM"
 
     if [ "$enableParallelBuilding" = 1 ]; then
@@ -240,7 +238,7 @@ rec {
     # the -K option to preserve the temporary build directory).
     cat > ./run-vm <<EOF
     #! ${bash}/bin/sh
-    diskImage=$diskImage
+    ''${diskImage:+diskImage=$diskImage}
     TMPDIR=$TMPDIR
     cd $TMPDIR
     ${qemuCommand}

pkgs/desktops/gnome-3/core/gnome-screenshot/default.nix

@@ -1,6 +1,6 @@
 { stdenv, gettext, libxml2, fetchurl, pkgconfig, libcanberra_gtk3
 , bash, gtk3, glib, meson, ninja, wrapGAppsHook, appstream-glib
-, gnome3, librsvg, gdk_pixbuf }:
+, gnome3, librsvg, gdk_pixbuf, gobjectIntrospection }:
 
 stdenv.mkDerivation rec {
   inherit (import ./src.nix fetchurl) name src;
@@ -15,7 +15,8 @@ stdenv.mkDerivation rec {
   propagatedUserEnvPkgs = [ gnome3.gnome_themes_standard ];
   propagatedBuildInputs = [ gdk_pixbuf gnome3.defaultIconTheme librsvg ];
 
-  nativeBuildInputs = [ meson ninja pkgconfig gettext appstream-glib libxml2 wrapGAppsHook ];
+  nativeBuildInputs = [ meson ninja pkgconfig gettext appstream-glib libxml2
+                        wrapGAppsHook gobjectIntrospection ];
   buildInputs = [ bash gtk3 glib libcanberra_gtk3
                   gnome3.gsettings_desktop_schemas ];
 

pkgs/desktops/gnome-3/core/libcroco/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, libxml2, glib }:
+{ stdenv, fetchurl, pkgconfig, libxml2, glib, fetchpatch }:
 
 stdenv.mkDerivation rec {
   name = "libcroco-0.6.12";
@@ -8,6 +8,19 @@ stdenv.mkDerivation rec {
     sha256 = "0q7qhi7z64i26zabg9dbs5706fa8pmzp1qhpa052id4zdiabbi6x";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2017-7960.patch";
+      url = "https://git.gnome.org/browse/libcroco/patch/?id=898e3a8c8c0314d2e6b106809a8e3e93cf9d4394";
+      sha256 = "1xjwdqijxf4b7mhdp3kkgnb6c14y0bn3b3gg79kyrm82x696d94l";
+    })
+    (fetchpatch {
+      name = "CVE-2017-7961.patch";
+      url = "https://git.gnome.org/browse/libcroco/patch/?id=9ad72875e9f08e4c519ef63d44cdbd94aa9504f7";
+      sha256 = "0zakd72ynzjgzskwyvqglqiznsb93j1bkvc1lgyrzgv9rwrbwv9s";
+    })
+  ];
+
   outputs = [ "out" "dev" ];
   outputBin = "dev";
 

pkgs/development/arduino/arduino-core/default.nix

@@ -20,8 +20,8 @@ let
   externalDownloads = import ./downloads.nix {inherit fetchurl; inherit (lib) optionalAttrs; inherit (stdenv) system;};
   # Some .so-files are later copied from .jar-s to $HOME, so patch them beforehand
   patchelfInJars =
-       lib.optional (stdenv.system == "x86_64-linux") {jar = "share/arduino/lib/jssc-2.8.0.jar"; file = "libs/linux/libjSSC-2.8_x86_64.so";}
+       lib.optional (stdenv.system == "x86_64-linux") {jar = "share/arduino/lib/jssc-2.8.0-arduino1.jar"; file = "libs/linux/libjSSC-2.8_x86_64.so";}
-    ++ lib.optional (stdenv.system == "i686-linux") {jar = "share/arduino/lib/jssc-2.8.0.jar"; file = "libs/linux/libjSSC-2.8_x86.so";}
+    ++ lib.optional (stdenv.system == "i686-linux") {jar = "share/arduino/lib/jssc-2.8.0-arduino1.jar"; file = "libs/linux/libjSSC-2.8_x86.so";}
   ;
   # abiVersion 6 is default, but we need 5 for `avrdude_bin` executable
   ncurses5 = ncurses.override { abiVersion = "5"; };
@@ -54,25 +54,25 @@ let
              + stdenv.lib.optionalString (!withGui) "-core";
 in
 stdenv.mkDerivation rec {
-  version = "1.8.2";
+  version = "1.8.5";
   name = "${flavor}-${version}";
 
   src = fetchFromGitHub {
     owner = "arduino";
     repo = "Arduino";
     rev = "${version}";
-    sha256 = "1ssznjmzmahayslj2xnci9b5wpsl53nyg85say54akng93qipmfb";
+    sha256 = "0ww72qfk7fyvprz15lc80i1axfdacb5fij4h5j5pakrg76mng2c3";
   };
 
   teensyduino_src = fetchurl {
-    url = "https://www.pjrc.com/teensy/td_136/TeensyduinoInstall.${teensy_architecture}";
+    url = "https://www.pjrc.com/teensy/td_140/TeensyduinoInstall.${teensy_architecture}";
     sha256 =
       lib.optionalString ("${teensy_architecture}" == "linux64")
-        "0qvb5z9y6nsqy0kzib9fvvbn8dakl50vib6r3nm6bnpvyxzwjl2r"
+        "0127a1ak31252dbmr5niqa5mkvbm8dnz1cfcnmydzx9qn9rk00ir"
       + lib.optionalString ("${teensy_architecture}" == "linux32")
-        "14ca62vq7cpx269vfd92shi80qj8spf0dzli8gfcb39ss2zc4jf1"
+        "01mxj5xsr7gka652c9rp4szy5mkcka8mljk044v4agk3sxvx3v3i"
       + lib.optionalString ("${teensy_architecture}" == "linuxarm")
-        "122z1gxcgkmwjb8wdklb2w8c3qkj5rc1ap5n4a8fi3kjz29va9rx";
+        "1dff3alhvk9x8qzy3n85qrg6rfmy6l9pj6fmrlzpli63lzykvv4i";
   };
 
   buildInputs = [ jdk ant libusb libusb1 unzip zlib ncurses5 readline

pkgs/development/arduino/arduino-core/downloads.nix

@@ -1,5 +1,8 @@
 {fetchurl, optionalAttrs, system}:
-
+# This file preloads all the archives which Arduino's build/build.xml
+# would otherwise try to download itself. When updating this for a new
+# version of Arduino, check build.xml for version numbers and new
+# urls.
 {
   "build/shared/reference-1.6.6-3.zip" = fetchurl {
     url = "https://downloads.arduino.cc/reference-1.6.6-3.zip";
@@ -21,17 +24,17 @@
     url = "https://github.com/arduino-libraries/Bridge/archive/1.6.3.zip";
     sha256 = "1lha5wkzz63bgcn7bhx4rmgsh9ywa47lffycpyz6qjnl1pvm5mmj";
   };
-  "build/Robot_Control-1.0.3.zip" = fetchurl {
+  "build/Robot_Control-1.0.4.zip" = fetchurl {
-    url = "https://github.com/arduino-libraries/Robot_Control/archive/1.0.3.zip";
+    url = "https://github.com/arduino-libraries/Robot_Control/archive/1.0.4.zip";
-    sha256 = "1pc3b8skbpx7j32jnxa67mfqhnsmfz3876pc9mdyzpsad4mmcn62";
+    sha256 = "1pkabrghx3h8l60x571vwkbhfm02nhyn5x2vqz4vhx9cczr70zq7";
   };
-  "build/Robot_Motor-1.0.2.zip" = fetchurl {
+  "build/Robot_Motor-1.0.3.zip" = fetchurl {
-    url = "https://github.com/arduino-libraries/Robot_Motor/archive/1.0.2.zip";
+    url = "https://github.com/arduino-libraries/Robot_Motor/archive/1.0.3.zip";
-    sha256 = "0da21kfzy07kk2qnkprs3lj214fgkcjxlkk3hdp306jfv8ilmvy2";
+    sha256 = "1pkvrimg77jrhdsz4l81y59hv50h6cl7hvhk9w8ac7ckg70lvxkw";
   };
-  "build/RobotIRremote-1.0.2.zip" = fetchurl {
+  "build/RobotIRremote-2.0.0.zip" = fetchurl {
-    url = "https://github.com/arduino-libraries/RobotIRremote/archive/1.0.2.zip";
+    url = "https://github.com/arduino-libraries/RobotIRremote/archive/2.0.0.zip";
-    sha256 = "0wkya7dy4x0xyi7wn5aghmr1gj0d0wszd61pq18zgfdspz1gi6xn";
+    sha256 = "0j5smap74j8p3wc6k0h73b1skj4gkr7r25jbjh1j1cg052dxri86";
   };
   "build/SpacebrewYun-1.0.1.zip" = fetchurl {
     url = "https://github.com/arduino-libraries/SpacebrewYun/archive/1.0.1.zip";
@@ -61,9 +64,13 @@
     url = "https://github.com/arduino-libraries/Servo/archive/1.1.2.zip";
     sha256 = "14k1883qrx425wnm0r8kszzq32yvvs3jwxf3g7ybp7v0ga0q47l7";
   };
-  "build/Adafruit_CircuitPlayground-1.6.4.zip" = fetchurl {
+  "build/LiquidCrystal-1.0.7.zip" = fetchurl {
-    url = "https://github.com/Adafruit/Adafruit_CircuitPlayground/archive/1.6.4.zip";
+    url = "https://github.com/arduino-libraries/LiquidCrystal/archive/1.0.7.zip";
-    sha256 = "1ph7m0l1sfx9db56n2h6vi78pn3zyah813lfhqiqghncx34amrhj";
+    sha256 = "1wrxrqz3n4yrj9j1a2b7pdd7a1rlyi974ra7crv5amjng8817x9n";
+  };
+  "build/Adafruit_CircuitPlayground-1.6.8.zip" = fetchurl {
+    url = "https://github.com/Adafruit/Adafruit_CircuitPlayground/archive/1.6.8.zip";
+    sha256 = "0zm667xiaygx8v1ygcls43s6qd5n7pf21n0998n1z7nf18s35j41";
   };
   "build/libastylej-2.05.1-3.zip" = fetchurl {
     url = "https://downloads.arduino.cc/libastylej-2.05.1-3.zip";
@@ -73,9 +80,9 @@
     url = "https://downloads.arduino.cc/liblistSerials/liblistSerials-1.4.0.zip";
     sha256 = "129mfbyx7snq3znzhkfbdjiifdr85cwk6wjn8l9ia0wynszs5zyv";
   };
-  "build/shared/WiFi101-Updater-ArduinoIDE-Plugin-0.9.0.zip" = fetchurl {
+  "build/shared/WiFi101-Updater-ArduinoIDE-Plugin-0.9.1.zip" = fetchurl {
-    url = "https://github.com/arduino-libraries/WiFi101-FirmwareUpdater-Plugin/releases/download/v0.9.0/WiFi101-Updater-ArduinoIDE-Plugin-0.9.0.zip";
+    url = "https://github.com/arduino-libraries/WiFi101-FirmwareUpdater-Plugin/releases/download/v0.9.1/WiFi101-Updater-ArduinoIDE-Plugin-0.9.1.zip";
-    sha256 = "1nkk87q2l3bs9y387hdxzgqllm0lqpmc5kdmr6my4hjz5lcpgbza";
+    sha256 = "15przp8z1dp6lamcvqdx4daq6fqi3c1algc3sbinyh25pm69pq74";
   };
 }
 // optionalAttrs (system == "x86_64-linux") {

pkgs/development/compilers/fsharp/default.nix

@@ -1,4 +1,4 @@
-# Temporaririly avoid dependency on dotnetbuildhelpers to avoid rebuilding many times while working on it
+# Temporarily avoid dependency on dotnetbuildhelpers to avoid rebuilding many times while working on it
 
 { stdenv, fetchurl, mono, pkgconfig, dotnetbuildhelpers, autoconf, automake, which }:
 

pkgs/development/compilers/ghc/7.10.3-binary.nix

@@ -1,7 +1,7 @@
 { stdenv
 , fetchurl, perl
 , ncurses5, gmp, libiconv
-, gcc
+, gcc, llvm_35
 }:
 
 # Prebuilt only does native
@@ -43,6 +43,7 @@ stdenv.mkDerivation rec {
     or (throw "cannot bootstrap GHC on this platform"));
 
   nativeBuildInputs = [ perl ];
+  buildInputs = stdenv.lib.optionals stdenv.isArm [ llvm_35 ];
 
   # Cannot patchelf beforehand due to relative RPATHs that anticipate
   # the final install location/

pkgs/development/compilers/ghc/7.10.3.nix

@@ -2,7 +2,7 @@
 , buildPlatform, hostPlatform, targetPlatform
 
 # build-tools
-, bootPkgs, hscolour
+, bootPkgs, hscolour, llvm_35
 , coreutils, fetchurl, fetchpatch, perl
 , docbook_xsl, docbook_xml_dtd_45, docbook_xml_dtd_42, libxml2, libxslt
 
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
     ./relocation.patch
   ];
 
-  buildInputs = [ ghc perl libxml2 libxslt docbook_xsl docbook_xml_dtd_45 docbook_xml_dtd_42 hscolour ];
+  buildInputs = [ ghc perl libxml2 libxslt docbook_xsl docbook_xml_dtd_45 docbook_xml_dtd_42 hscolour ] ++ stdenv.lib.optionals stdenv.isArm [ llvm_35 ];
 
   enableParallelBuilding = true;
 

pkgs/development/compilers/ghc/8.0.2.nix

@@ -2,7 +2,7 @@
 , buildPlatform, hostPlatform, targetPlatform
 
 # build-tools
-, bootPkgs, hscolour
+, bootPkgs, hscolour, llvm_37
 , coreutils, fetchurl, fetchpatch, patchutils, perl, sphinx
 
 , libiconv ? null, ncurses
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     ++ stdenv.lib.optional stdenv.isLinux ./ghc-no-madv-free.patch
     ++ stdenv.lib.optional stdenv.isDarwin ./ghc-8.0.2-no-cpp-warnings.patch;
 
-  buildInputs = [ ghc perl hscolour sphinx ];
+  buildInputs = [ ghc perl hscolour sphinx ] ++ stdenv.lib.optionals (stdenv.isArm || stdenv.isAarch64) [ llvm_37 ];
 
   enableParallelBuilding = true;
 

pkgs/development/compilers/ghc/8.2.1-binary.nix

@@ -1,5 +1,5 @@
 { stdenv
-, fetchurl, perl, gcc
+, fetchurl, perl, gcc, llvm_39
 , ncurses5, gmp, libiconv
 }:
 
@@ -46,6 +46,7 @@ stdenv.mkDerivation rec {
     or (throw "cannot bootstrap GHC on this platform"));
 
   nativeBuildInputs = [ perl ];
+  buildInputs = stdenv.lib.optionals (stdenv.isArm || stdenv.isAarch64) [ llvm_39 ];
 
   # Cannot patchelf beforehand due to relative RPATHs that anticipate
   # the final install location/

pkgs/development/compilers/ghc/8.2.2.nix

@@ -3,7 +3,7 @@
 , selfPkgs, cross ? null
 
 # build-tools
-, bootPkgs, alex, happy, hscolour
+, bootPkgs, alex, happy, hscolour, llvm_39
 , autoconf, automake, coreutils, fetchurl, perl, python3, sphinx
 
 , libiconv ? null, ncurses
@@ -46,7 +46,7 @@ stdenv.mkDerivation (rec {
     sed 's|#BuildFlavour  = quick-cross|BuildFlavour  = perf-cross|' mk/build.mk.sample > mk/build.mk
   '';
 
-  buildInputs = [ alex autoconf automake ghc happy hscolour perl python3 sphinx ];
+  buildInputs = [ alex autoconf automake ghc happy hscolour perl python3 sphinx ] ++ stdenv.lib.optionals (stdenv.isArm || stdenv.isAarch64) [ llvm_39 ];
 
   enableParallelBuilding = true;
 
@@ -58,6 +58,8 @@ stdenv.mkDerivation (rec {
     "--with-gmp-includes=${gmp.dev}/include" "--with-gmp-libraries=${gmp.out}/lib"
   ] ++ stdenv.lib.optional stdenv.isDarwin [
     "--with-iconv-includes=${libiconv}/include" "--with-iconv-libraries=${libiconv}/lib"
+  ] ++ stdenv.lib.optional stdenv.isArm [
+    "LD=${stdenv.cc}/bin/ld.gold"
   ];
 
   # required, because otherwise all symbols from HSffi.o are stripped, and

pkgs/development/compilers/scala/dotty-bare.nix

@@ -0,0 +1,40 @@
+{ stdenv, fetchurl, makeWrapper, jre }:
+
+stdenv.mkDerivation rec {
+  version = "0.4.0-RC1";
+  name = "dotty-bare-${version}";
+
+  src = fetchurl {
+    url = "https://github.com/lampepfl/dotty/releases/download/${version}/dotty-${version}.tar.gz";
+    sha256 = "1d1ab08b85bd6898ce6273fa50818de0d314fc6e5377fb6ee05494827043321b";
+  };
+
+  propagatedBuildInputs = [ jre ] ;
+  buildInputs = [ makeWrapper ] ;
+
+  installPhase = ''
+    mkdir -p $out
+    mv * $out
+  '';
+
+  fixupPhase = ''
+        bin_files=$(find $out/bin -type f ! -name common)
+        for f in $bin_files ; do
+          wrapProgram $f --set JAVA_HOME ${jre}
+        done
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Research platform for new language concepts and compiler technologies for Scala.";
+    longDescription = ''
+       Dotty is a platform to try out new language concepts and compiler technologies for Scala.
+       The focus is mainly on simplification. We remove extraneous syntax (e.g. no XML literals),
+       and try to boil down Scala’s types into a smaller set of more fundamental constructs.
+       The theory behind these constructs is researched in DOT, a calculus for dependent object types.
+    '';
+    homepage = http://dotty.epfl.ch/;
+    license = licenses.bsd3;
+    platforms = platforms.all;
+    maintainers = [maintainers.karolchmist];
+  };
+}

pkgs/development/compilers/scala/dotty.nix

@@ -1,46 +1,22 @@
-{ stdenv, fetchurl, makeWrapper, jre }:
+{ stdenv, fetchurl, makeWrapper, jre, callPackage }:
 
-stdenv.mkDerivation rec {
+let
-  version = "0.4.0-RC1";
+  dotty-bare = callPackage ./dotty-bare.nix {
-  name = "dotty-${version}";
+    inherit stdenv fetchurl makeWrapper jre;
-
-  src = fetchurl {
-    url = "https://github.com/lampepfl/dotty/releases/download/${version}/${name}.tar.gz";
-    sha256 = "1d1ab08b85bd6898ce6273fa50818de0d314fc6e5377fb6ee05494827043321b";
   };
+in
 
-  propagatedBuildInputs = [ jre ] ;
+stdenv.mkDerivation {
-  buildInputs = [ makeWrapper ] ;
+  name = "dotty-${dotty-bare.version}";
+
+  unpackPhase = ":";
 
   installPhase = ''
-    mkdir -p $out
+    mkdir -p $out/bin
-    mv * $out
+    ln -s ${dotty-bare}/bin/dotc $out/bin/dotc
-
+    ln -s ${dotty-bare}/bin/dotd $out/bin/dotd
-    mkdir -p $out/shared
+    ln -s ${dotty-bare}/bin/dotr $out/bin/dotr
-    mv $out/bin/common $out/shared
   '';
 
-  fixupPhase = ''
+  inherit (dotty-bare) meta;
-    for file in $out/bin/* ; do
-      substituteInPlace $file \
-        --replace '$PROG_HOME/bin/common' $out/shared/common
-
-      wrapProgram $file \
-        --set JAVA_HOME ${jre}
-    done
-  '';
-
-  meta = with stdenv.lib; {
-    description = "Research platform for new language concepts and compiler technologies for Scala.";
-    longDescription = ''
-       Dotty is a platform to try out new language concepts and compiler technologies for Scala.
-       The focus is mainly on simplification. We remove extraneous syntax (e.g. no XML literals),
-       and try to boil down Scala’s types into a smaller set of more fundamental constructs.
-       The theory behind these constructs is researched in DOT, a calculus for dependent object types.
-    '';
-    homepage = http://dotty.epfl.ch/;
-    license = licenses.bsd3;
-    platforms = platforms.all;
-    maintainers = [maintainers.karolchmist];
-  };
 }

pkgs/development/haskell-modules/configuration-common.nix

@@ -1029,4 +1029,6 @@ self: super: {
   # https://github.com/Twinside/Juicy.Pixels/issues/149
   JuicyPixels = dontHaddock super.JuicyPixels;
 
+  # armv7l fixes.
+  happy = if pkgs.stdenv.isArm then dontCheck super.happy else super.happy; # Similar to https://ghc.haskell.org/trac/ghc/ticket/13062
 }

pkgs/development/haskell-modules/configuration-ghc-8.2.x.nix

@@ -93,4 +93,8 @@ self: super: {
             sha256 = "06sfxk5cyd8nqgjyb95jkihxxk8m6dw9m3mlv94sm2qwylj86gqy";
           };
     in appendPatch super.coordinate patch;
+
+  # https://github.com/purescript/purescript/issues/3189
+  purescript = doJailbreak (super.purescript);
+
 }

pkgs/development/haskell-modules/configuration-hackage2nix.yaml

@@ -38,7 +38,7 @@ core-packages:
   - ghcjs-base-0
 
 default-package-overrides:
-  # LTS Haskell 10.2
+  # LTS Haskell 10.3
   - abstract-deque ==0.3
   - abstract-deque-tests ==0.3
   - abstract-par ==0.3.3
@@ -250,7 +250,7 @@ default-package-overrides:
   - base-unicode-symbols ==0.2.2.4
   - basic-prelude ==0.7.0
   - bbdb ==0.8
-  - bcrypt ==0.0.10
+  - bcrypt ==0.0.11
   - bench ==1.0.7
   - benchpress ==0.2.2.10
   - bencode ==0.6.0.0
@@ -415,7 +415,7 @@ default-package-overrides:
   - cmark-gfm ==0.1.3
   - cmark-highlight ==0.2.0.0
   - cmark-lucid ==0.1.0.0
-  - cmdargs ==0.10.18
+  - cmdargs ==0.10.19
   - code-builder ==0.1.3
   - codec ==0.2.1
   - code-page ==0.1.3
@@ -449,7 +449,7 @@ default-package-overrides:
   - conduit-algorithms ==0.0.6.1
   - conduit-combinators ==1.1.2
   - conduit-connection ==0.1.0.3
-  - conduit-extra ==1.2.3.1
+  - conduit-extra ==1.2.3.2
   - conduit-iconv ==0.1.1.2
   - conduit-parse ==0.1.2.2
   - conduit-throttle ==0.3.1.0
@@ -484,7 +484,7 @@ default-package-overrides:
   - crackNum ==1.9
   - criterion ==1.2.6.0
   - cron ==0.6.1
-  - crypto-api ==0.13.2
+  - crypto-api ==0.13.3
   - crypto-api-tests ==0.3
   - cryptocipher ==0.6.2
   - crypto-cipher-tests ==0.0.11
@@ -515,7 +515,7 @@ default-package-overrides:
   - cubicspline ==0.1.2
   - cublas ==0.4.0.0
   - cuda ==0.9.0.0
-  - cue-sheet ==1.0.0
+  - cue-sheet ==1.0.1
   - cufft ==0.8.0.0
   - curl ==1.3.8
   - currencies ==0.1.1.1
@@ -847,10 +847,10 @@ default-package-overrides:
   - ghc-paths ==0.1.0.9
   - ghc-prof ==1.4.0.4
   - ghc-syb-utils ==0.2.3.3
-  - ghc-tcplugins-extra ==0.2.1
+  - ghc-tcplugins-extra ==0.2.2
-  - ghc-typelits-extra ==0.2.3
+  - ghc-typelits-extra ==0.2.4
-  - ghc-typelits-knownnat ==0.3.1
+  - ghc-typelits-knownnat ==0.4
-  - ghc-typelits-natnormalise ==0.5.7
+  - ghc-typelits-natnormalise ==0.5.8
   - ghost-buster ==0.1.1.0
   - gi-atk ==2.0.14
   - gi-cairo ==1.0.14
@@ -1035,7 +1035,7 @@ default-package-overrides:
   - hashable ==1.2.6.1
   - hashable-time ==0.2.0.1
   - hashids ==1.0.2.3
-  - hashmap ==1.3.2
+  - hashmap ==1.3.3
   - hashtables ==1.2.2.1
   - haskeline ==0.7.4.2
   - haskell-gi ==0.20.3
@@ -1055,16 +1055,16 @@ default-package-overrides:
   - haskell-src-exts-simple ==1.19.0.0
   - haskell-src-exts-util ==0.2.1.2
   - haskell-src-meta ==0.8.0.1
-  - haskell-tools-ast ==1.0.0.2
+  - haskell-tools-ast ==1.0.0.3
-  - haskell-tools-backend-ghc ==1.0.0.2
+  - haskell-tools-backend-ghc ==1.0.0.3
-  - haskell-tools-builtin-refactorings ==1.0.0.2
+  - haskell-tools-builtin-refactorings ==1.0.0.3
-  - haskell-tools-cli ==1.0.0.2
+  - haskell-tools-cli ==1.0.0.3
-  - haskell-tools-daemon ==1.0.0.2
+  - haskell-tools-daemon ==1.0.0.3
-  - haskell-tools-debug ==1.0.0.2
+  - haskell-tools-debug ==1.0.0.3
-  - haskell-tools-demo ==1.0.0.2
+  - haskell-tools-demo ==1.0.0.3
-  - haskell-tools-prettyprint ==1.0.0.2
+  - haskell-tools-prettyprint ==1.0.0.3
-  - haskell-tools-refactor ==1.0.0.2
+  - haskell-tools-refactor ==1.0.0.3
-  - haskell-tools-rewrite ==1.0.0.2
+  - haskell-tools-rewrite ==1.0.0.3
   - haskintex ==0.8.0.0
   - hasmin ==1.0.1
   - hasql ==1.1.1
@@ -1082,7 +1082,7 @@ default-package-overrides:
   - hbeanstalk ==0.2.4
   - Hclip ==3.0.0.4
   - HCodecs ==0.5
-  - hdaemonize ==0.5.4
+  - hdaemonize ==0.5.5
   - HDBC ==2.4.0.2
   - HDBC-mysql ==0.7.1.0
   - HDBC-session ==0.1.1.1
@@ -1171,7 +1171,7 @@ default-package-overrides:
   - hsignal ==0.2.7.5
   - hsinstall ==1.6
   - hslogger ==1.2.10
-  - hslua ==0.9.3
+  - hslua ==0.9.5
   - hslua-aeson ==0.3.0.1
   - hslua-module-text ==0.1.2.1
   - hsndfile ==0.8.0
@@ -1297,8 +1297,8 @@ default-package-overrides:
   - intern ==0.9.1.4
   - interpolate ==0.1.1
   - interpolatedstring-perl6 ==1.0.0
-  - interpolation ==0.1.0.2
   - Interpolation ==0.3.0
+  - interpolation ==0.1.0.2
   - IntervalMap ==0.5.3.1
   - intervals ==0.8.1
   - intro ==0.3.0.1
@@ -1351,7 +1351,7 @@ default-package-overrides:
   - json-rpc-generic ==0.2.1.3
   - json-schema ==0.7.4.1
   - json-stream ==0.4.1.5
-  - JuicyPixels ==3.2.9.2
+  - JuicyPixels ==3.2.9.3
   - JuicyPixels-extra ==0.2.2
   - JuicyPixels-scale-dct ==0.1.1.2
   - justified-containers ==0.2.0.1
@@ -1433,8 +1433,8 @@ default-package-overrides:
   - ListLike ==4.5.1
   - listsafe ==0.1.0.1
   - list-t ==1.0.0.1
-  - llvm-hs ==5.1.2
+  - llvm-hs ==5.1.3
-  - llvm-hs-pure ==5.1.1
+  - llvm-hs-pure ==5.1.2
   - lmdb ==0.2.5
   - load-env ==0.1.2
   - loch-th ==0.2.1
@@ -1533,12 +1533,12 @@ default-package-overrides:
   - mltool ==0.1.0.2
   - mmap ==0.5.9
   - mmark ==0.0.4.0
-  - mmark-ext ==0.0.1.1
+  - mmark-ext ==0.0.1.2
   - mmorph ==1.1.0
   - mnist-idx ==0.1.2.8
   - mockery ==0.3.5
   - model ==0.4.4
-  - modern-uri ==0.1.2.0
+  - modern-uri ==0.1.2.1
   - modify-fasta ==0.8.2.3
   - moesocks ==1.0.0.43
   - mole ==0.0.6
@@ -1667,10 +1667,10 @@ default-package-overrides:
   - numhask-range ==0.1.3.0
   - NumInstances ==1.4
   - numtype-dk ==0.5.0.1
-  - nvim-hs ==0.2.4
+  - nvim-hs ==0.2.5
   - nvim-hs-contrib ==0.2.0
   - nvim-hs-ghcid ==0.2.0
-  - nvvm ==0.8.0.1
+  - nvvm ==0.8.0.2
   - objective ==1.1.2
   - ObjectName ==1.1.0.1
   - ochintin-daicho ==0.1.0.1
@@ -1711,7 +1711,7 @@ default-package-overrides:
   - pagination ==0.2.1
   - palette ==0.1.0.5
   - pandoc ==2.0.6
-  - pandoc-citeproc ==0.12.2.2
+  - pandoc-citeproc ==0.12.2.5
   - pandoc-types ==1.17.3
   - pango ==0.13.4.0
   - papillon ==0.1.0.5
@@ -1721,7 +1721,7 @@ default-package-overrides:
   - parsec ==3.1.11
   - parsec-numeric ==0.1.0.0
   - ParsecTools ==0.0.2.0
-  - parser-combinators ==0.2.1
+  - parser-combinators ==0.4.0
   - parsers ==0.12.8
   - partial-handler ==1.0.2
   - partial-isomorphisms ==0.2.2.1
@@ -1753,8 +1753,8 @@ default-package-overrides:
   - persistent ==2.7.1
   - persistent-mongoDB ==2.6.0
   - persistent-mysql ==2.6.2.1
-  - persistent-mysql-haskell ==0.3.5
+  - persistent-mysql-haskell ==0.3.6
-  - persistent-postgresql ==2.6.2.1
+  - persistent-postgresql ==2.6.2.2
   - persistent-refs ==0.4
   - persistent-sqlite ==2.6.4
   - persistent-template ==2.5.3
@@ -2003,8 +2003,8 @@ default-package-overrides:
   - say ==0.1.0.0
   - sbp ==2.3.2
   - sbv ==7.4
-  - scalendar ==1.2.0
   - SCalendar ==1.1.0
+  - scalendar ==1.2.0
   - scalpel ==0.5.1
   - scalpel-core ==0.5.1
   - scanner ==0.2
@@ -2232,7 +2232,7 @@ default-package-overrides:
   - tasty-ant-xml ==1.1.1
   - tasty-auto ==0.2.0.0
   - tasty-dejafu ==0.7.1.1
-  - tasty-discover ==4.1.2
+  - tasty-discover ==4.1.3
   - tasty-expected-failure ==0.11.0.4
   - tasty-fail-fast ==0.0.3
   - tasty-golden ==2.3.1.2
@@ -2324,7 +2324,7 @@ default-package-overrides:
   - time-compat ==0.1.0.3
   - timeit ==1.0.0.0
   - timelens ==0.2.0.2
-  - time-lens ==0.4.0.1
+  - time-lens ==0.4.0.2
   - time-locale-compat ==0.1.1.3
   - time-locale-vietnamese ==1.0.0.0
   - timemap ==0.0.6
@@ -2336,7 +2336,7 @@ default-package-overrides:
   - tinylog ==0.14.0
   - tinytemplate ==0.1.2.0
   - titlecase ==1.0.1
-  - tldr ==0.2.3
+  - tldr ==0.2.4
   - tls ==1.4.0
   - tls-debug ==0.4.5
   - tls-session-manager ==0.0.0.2
@@ -2374,7 +2374,7 @@ default-package-overrides:
   - type-combinators ==0.2.4.3
   - type-combinators-singletons ==0.1.0.0
   - TypeCompose ==0.9.12
-  - typed-process ==0.2.0.0
+  - typed-process ==0.2.1.0
   - type-fun ==0.1.1
   - type-hint ==0.1
   - type-level-integers ==0.0.1
@@ -2389,7 +2389,7 @@ default-package-overrides:
   - tzdata ==0.1.20170320.0
   - ua-parser ==0.7.4.1
   - uglymemo ==0.1.0.1
-  - unagi-chan ==0.4.0.0
+  - unagi-chan ==0.4.1.0
   - unbounded-delays ==0.1.1.0
   - unbound-generics ==0.3.1
   - unboxed-ref ==0.4.0.0
@@ -2420,7 +2420,7 @@ default-package-overrides:
   - unix-compat ==0.5.0.1
   - unix-time ==0.3.7
   - unliftio ==0.2.2.0
-  - unliftio-core ==0.1.0.0
+  - unliftio-core ==0.1.1.0
   - unlit ==0.4.0.0
   - unordered-containers ==0.2.8.0
   - unordered-intmap ==0.1.0.0
@@ -2482,7 +2482,7 @@ default-package-overrides:
   - vivid-osc ==0.3.0.0
   - vivid-supercollider ==0.3.0.0
   - void ==0.7.2
-  - vty ==5.19
+  - vty ==5.19.1
   - wai ==3.2.1.1
   - wai-app-static ==3.1.6.1
   - wai-cli ==0.1.1
@@ -2500,7 +2500,7 @@ default-package-overrides:
   - wai-middleware-crowd ==0.1.4.2
   - wai-middleware-metrics ==0.2.4
   - wai-middleware-prometheus ==0.3.0
-  - wai-middleware-rollbar ==0.8.0
+  - wai-middleware-rollbar ==0.8.1
   - wai-middleware-static ==0.8.1
   - wai-middleware-throttle ==0.2.2.0
   - wai-predicates ==0.10.0
@@ -2519,14 +2519,14 @@ default-package-overrides:
   - webdriver-angular ==0.1.11
   - webpage ==0.0.5
   - web-plugins ==0.2.9
-  - web-routes ==0.27.12
+  - web-routes ==0.27.13
   - web-routes-boomerang ==0.28.4.2
   - web-routes-happstack ==0.23.11
   - web-routes-hsp ==0.24.6.1
   - web-routes-th ==0.22.6.2
   - web-routes-wai ==0.24.3
   - webrtc-vad ==0.1.0.3
-  - websockets ==0.12.2.0
+  - websockets ==0.12.3.0
   - websockets-rpc ==0.6.0
   - websockets-simple ==0.0.6.3
   - websockets-snap ==0.10.2.4
@@ -2534,7 +2534,7 @@ default-package-overrides:
   - weigh ==0.0.7
   - wide-word ==0.1.0.5
   - wikicfp-scraper ==0.1.0.9
-  - wild-bind ==0.1.0.3
+  - wild-bind ==0.1.1.0
   - wild-bind-x11 ==0.1.0.7
   - Win32 ==2.5.4.1
   - Win32-notify ==0.3.0.3
@@ -2557,8 +2557,8 @@ default-package-overrides:
   - Workflow ==0.8.3
   - wrap ==0.0.0
   - wrecker ==1.2.3.0
-  - wreq ==0.5.1.0
+  - wreq ==0.5.2.0
-  - wreq-stringless ==0.5.1.0
+  - wreq-stringless ==0.5.2.0
   - writer-cps-full ==0.1.0.0
   - writer-cps-lens ==0.1.0.1
   - writer-cps-morph ==0.1.0.2
@@ -2582,7 +2582,7 @@ default-package-overrides:
   - xlsx-tabular ==0.2.2
   - xml ==1.3.14
   - xml-basic ==0.1.2
-  - xml-conduit ==1.7.0
+  - xml-conduit ==1.7.0.1
   - xml-conduit-parse ==0.3.1.2
   - xml-conduit-writer ==0.1.1.2
   - xmlgen ==0.6.2.1
@@ -2683,6 +2683,7 @@ extra-packages:
   - haddock < 2.17                      # required on GHC 7.10.x
   - haddock-api == 2.15.*               # required on GHC 7.8.x
   - haddock-api == 2.16.*               # required on GHC 7.10.x
+  - haddock-api == 2.17.*               # required on GHC 8.0.x
   - haddock-library == 1.2.*            # required for haddock-api-2.16.x
   - haddock-library == 1.4.4            # required for haddock-api-2.18.x
   - happy <1.19.6                       # newer versions break Agda

pkgs/development/haskell-modules/generic-builder.nix

@@ -130,7 +130,7 @@ let
     (optionalString (enableSharedExecutables && stdenv.isDarwin) "--ghc-option=-optl=-Wl,-headerpad_max_install_names")
     (optionalString enableParallelBuilding "--ghc-option=-j$NIX_BUILD_CORES")
     (optionalString useCpphs "--with-cpphs=${cpphs}/bin/cpphs --ghc-options=-cpp --ghc-options=-pgmP${cpphs}/bin/cpphs --ghc-options=-optP--cpp")
-    (enableFeature (enableDeadCodeElimination && (versionAtLeast "8.0.1" ghc.version)) "split-objs")
+    (enableFeature (enableDeadCodeElimination && !stdenv.isArm && !stdenv.isAarch64 && (versionAtLeast "8.0.1" ghc.version)) "split-objs")
     (enableFeature enableLibraryProfiling "library-profiling")
     (enableFeature enableExecutableProfiling (if versionOlder ghc.version "8" then "executable-profiling" else "profiling"))
     (enableFeature enableSharedLibraries "shared")

pkgs/development/libraries/goffice/default.nix

@@ -2,11 +2,11 @@
 , libgsf, libxml2, libxslt, cairo, pango, librsvg, libspectre }:
 
 stdenv.mkDerivation rec {
-  name = "goffice-0.10.36";
+  name = "goffice-0.10.38";
 
   src = fetchurl {
     url = "mirror://gnome/sources/goffice/0.10/${name}.tar.xz";
-    sha256 = "cfe65fc0a665538704c7bab8541784291cf0781df8b4cff73cb0a513ee0baad6";
+    sha256 = "443199d7a9833fddaadfc4f9065c289e639eed480de316f37da816e396bb9764";
   };
 
   nativeBuildInputs = [ pkgconfig intltool ];

pkgs/development/libraries/libfilezilla/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "libfilezilla-${version}";
-  version = "0.11.1";
+  version = "0.11.2";
 
   src = fetchurl {
     url = "http://download.filezilla-project.org/libfilezilla/${name}.tar.bz2";
-    sha256 = "1xv4is3zaz66h6iblj9pikapsjasjcbxx31bhkgn62xdq1sadfpc";
+    sha256 = "0wl42yxrha633dbh1vcbhrpsd7sv4zwskbmlpx549ygnzi39krcn";
   };
 
   meta = with stdenv.lib; {

pkgs/development/libraries/openssl/default.nix

@@ -1,5 +1,6 @@
 { stdenv, fetchurl, buildPackages, perl
 , hostPlatform
+, fetchpatch
 , withCryptodev ? false, cryptodevHeaders
 , enableSSL2 ? false
 }:
@@ -114,6 +115,13 @@ in {
   openssl_1_1_0 = common {
     version = "1.1.0g";
     sha256 = "1bvka2wf33w2vxv7yw578nnjqyhz2b3chvfb0l4k2ffscw950kfy";
+    patches = [
+      (fetchpatch {
+        name = "CVE-2017-3738.patch";
+        url = "https://github.com/openssl/openssl/commit/563066.patch";
+        sha256 = "0ni9fwpxf8raw8b58pfa15akbqmxx4q64v0ldsm4b9dqhbxf8mkz";
+      })
+    ];
   };
 
 }

pkgs/development/libraries/readline/6.3.nix

@@ -16,6 +16,12 @@ stdenv.mkDerivation rec {
 
   patchFlags = "-p0";
 
+  configureFlags =
+    stdenv.lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
+    [ # This test requires running host code
+      "bash_cv_wcwidth_broken=no"
+    ];
+
   patches =
     [ ./link-against-ncurses.patch
       ./no-arch_only-6.3.patch

pkgs/development/ocaml-modules/otr/default.nix

@@ -1,22 +1,25 @@
-{ stdenv, buildOcaml, fetchFromGitHub, ocamlbuild, findlib, topkg, ocaml
+{ stdenv, fetchFromGitHub, ocaml, ocamlbuild, findlib, topkg
-, ppx_tools, ppx_sexp_conv, cstruct, ppx_cstruct, sexplib, result, nocrypto, astring
+, ppx_tools, ppx_sexp_conv, cstruct, ppx_cstruct, sexplib, rresult, nocrypto
+, astring
 }:
 
-buildOcaml rec {
+if !stdenv.lib.versionAtLeast ocaml.version "4.03"
-  name = "otr";
+then throw "otr is not available for OCaml ${ocaml.version}"
-  version = "0.3.3";
+else
 
-  minimumSupportedOcamlVersion = "4.02";
+stdenv.mkDerivation rec {
+  name = "ocaml${ocaml.version}-otr-${version}";
+  version = "0.3.4";
 
   src = fetchFromGitHub {
     owner  = "hannesm";
     repo   = "ocaml-otr";
     rev    = "${version}";
-    sha256 = "07zzix5mfsasqpqdx811m0x04gp8mq1ayf4b64998k98027v01rr";
+    sha256 = "0ixf0jvccmcbhk5mhzqakfzimvz200wkdkq3z2d0bdzyggslbdl4";
   };
 
-  buildInputs = [ ocamlbuild findlib topkg ppx_tools ppx_sexp_conv ppx_cstruct ];
+  buildInputs = [ ocaml ocamlbuild findlib topkg ppx_tools ppx_sexp_conv ppx_cstruct ];
-  propagatedBuildInputs = [ cstruct sexplib result nocrypto astring ];
+  propagatedBuildInputs = [ cstruct sexplib rresult nocrypto astring ];
 
   buildPhase = "${topkg.run} build --tests true";
 
@@ -26,6 +29,7 @@ buildOcaml rec {
   checkPhase = "${topkg.run} test";
 
   meta = with stdenv.lib; {
+    inherit (ocaml.meta) platforms;
     homepage = https://github.com/hannesm/ocaml-otr;
     description = "Off-the-record messaging protocol, purely in OCaml";
     license = licenses.bsd2;

pkgs/development/python-modules/ipython/5.nix

@@ -27,12 +27,12 @@
 
 buildPythonPackage rec {
   pname = "ipython";
-  version = "5.3.0";
+  version = "5.5.0";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "bf5e615e7d96dac5a61fbf98d9e2926d98aa55582681bea7e9382992a3f43c1d";
+    sha256 = "66469e894d1f09d14a1f23b971a410af131daa9ad2a19922082e02e0ddfd150f";
   };
 
   prePatch = stdenv.lib.optionalString stdenv.isDarwin ''

pkgs/development/python-modules/ldaptor/default.nix

@@ -0,0 +1,35 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, twisted
+, pycrypto
+, pyopenssl
+, pyparsing
+, zope_interface
+, isPy3k
+}:
+
+buildPythonPackage rec {
+  pname = "ldaptor";
+  version = "16.0.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "6b9ebe5814e9e7091703c4e3bfeae73b46508b4678e2ff403cddaedf8213815d";
+  };
+
+  propagatedBuildInputs = [
+    twisted pycrypto pyopenssl pyparsing zope_interface
+  ];
+
+  disabled = isPy3k;
+
+  # TypeError: None is neither bytes nor unicode
+  doCheck = false;
+
+  meta = {
+    description = "A Pure-Python Twisted library for LDAP";
+    homepage = https://github.com/twisted/ldaptor;
+    license = lib.licenses.mit;
+  };
+}

pkgs/development/python-modules/marionette-harness/marionette_driver.nix

@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "marionette_driver";
-  version = "2.3.0";
+  version = "2.5.0";
   name = "${pname}-${version}";
   disabled = isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0ab9xxsp0zvckf32k84n52hpibw2c62sa2pmx821d3q0d67yv2vv";
+    sha256 = "0axhdin9ys3i9lnwqqqw87wap9000bk6cdgrzpd2gqricc7l3v65";
   };
 
   propagatedBuildInputs = [ mozversion mozrunner ]; 

pkgs/development/python-modules/pyfakefs/default.nix

@@ -0,0 +1,21 @@
+{ stdenv, buildPythonPackage, fetchPypi, pytest, unittest2 }:
+
+buildPythonPackage rec {
+  version = "3.3";
+  pname = "pyfakefs";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "19hj5wyi8wy8n8hdj5dwlryl3frrn783y4dsfdxn5mg0lpg9iqg3";
+  };
+
+  propagatedBuildInputs = [ pytest unittest2 ];
+
+  meta = with stdenv.lib; {
+    description = "Fake file system that mocks the Python file system modules";
+    license     = licenses.asl20;
+    homepage    = "http://pyfakefs.org/";
+    maintainers = with maintainers; [ gebner ];
+  };
+}

pkgs/development/tools/analysis/flow/default.nix

@@ -4,14 +4,14 @@
 with lib;
 
 stdenv.mkDerivation rec {
-  version = "0.62.0";
+  version = "0.63.1";
   name = "flow-${version}";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "flow";
     rev = "v${version}";
-    sha256 = "03la72wgsh7s063h2l171h74c84haqsinnnk8fwifq3id0gq6xk1";
+    sha256 = "1djcyf1c88xw5mv1gh4wggy16d2gi84ndj31n11y5qh99hh3lmfl";
   };
 
   installPhase = ''

pkgs/development/tools/continuous-integration/gitlab-runner/default.nix

@@ -1,16 +1,16 @@
 { lib, buildGoPackage, fetchFromGitLab, fetchurl, go-bindata }:
 
 let
-  version = "10.2.0";
+  version = "10.3.0";
   # Gitlab runner embeds some docker images these are prebuilt for arm and x86_64
   docker_x86_64 = fetchurl {
     url = "https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/docker/prebuilt-x86_64.tar.xz";
-    sha256 = "191yzh9k6ivj7mdfi5mv7wgbdcclb5q99rcbry70h064vzwfgkp6";
+    sha256 = "0nhxxx2wxnli5nfz8vxqc0mwdjzj836zx3zmywnfyy1k2zybjijv";
   };
 
   docker_arm = fetchurl {
     url = "https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/docker/prebuilt-arm.tar.xz";
-    sha256 = "1xvfsffwks5z74kxba6f4cilbabcsxhr0kskbxwczi90pn0rxsnn";
+    sha256 = "0jacimz4p9k5s9j510g3vn7gg8pybpa20j4cvz4pffrcwl1lgk4i";
   };
 in
 buildGoPackage rec {
@@ -29,7 +29,7 @@ buildGoPackage rec {
     owner = "gitlab-org";
     repo = "gitlab-runner";
     rev = "v${version}";
-    sha256 = "1psnajn4b3ym2fpvn6rizxqb093s78lvxcs3bysgrmf9q1ivf3a6";
+    sha256 = "0wjy5bbz6bw0na57vglcwzn17q980x6j24qkschqx49rjyk3fz2i";
   };
 
   patches = [ ./fix-shell-path.patch ];

pkgs/development/tools/haskell/vaultenv/default.nix

@@ -1,17 +1,20 @@
-{ mkDerivation, fetchurl, async, base, bytestring, http-conduit, lens
+{ mkDerivation, fetchzip, async, base, bytestring, hpack, http-conduit
-, lens-aeson, optparse-applicative, retry, stdenv, text, unix
+, lens, lens-aeson, optparse-applicative, retry, stdenv, text, unix
 , unordered-containers, utf8-string
 }:
 
 mkDerivation rec {
   pname = "vaultenv";
-  version = "0.5.0";
+  version = "0.5.3";
 
-  src = fetchurl {
+  src = fetchzip {
     url = "https://github.com/channable/vaultenv/archive/v${version}.tar.gz";
-    sha256 = "0hdcxq88cf3ygnikkppyg3fcf7xmwm9zif7274j3n34p9vd8xci3";
+    sha256 = "1kxq2pp8l8xf7xwjyd9cwyi7z192013s6psq5fk8jrkkhrk8z3li";
   };
 
+  buildTools = [ hpack ];
+  preConfigure = "hpack .";
+
   isLibrary = false;
   isExecutable = true;
   executableHaskellDepends = [
@@ -23,5 +26,4 @@ mkDerivation rec {
   description = "Runs processes with secrets from HashiCorp Vault";
   license = stdenv.lib.licenses.bsd3;
   maintainers = with stdenv.lib.maintainers; [ lnl7 ];
-  broken = true;  # https://hydra.nixos.org/build/66706385
 }

pkgs/development/tools/remarshal/default.nix

@@ -2,13 +2,13 @@
 
 pythonPackages.buildPythonApplication rec {
   name = "remarshal-${version}";
-  version = "0.6.0";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner  = "dbohdan";
     repo   = "remarshal";
     rev    = "v${version}";
-    sha256 = "0jslawpzghv3chamrfddnyn5p5068kjxy8d38fxvi5h06qgfb4wp";
+    sha256 = "1wsgvzfp40lvly7nyyhv9prip4vi32rfc8kdji587jpw28zc1dfb";
   };
 
   propagatedBuildInputs = with pythonPackages; [

pkgs/development/tools/remarshal/deps.nix

@@ -1,20 +0,0 @@
-[
-  {
-    goPackagePath = "gopkg.in/yaml.v2";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/yaml.v2";
-      rev = "a83829b6f1293c91addabc89d0571c246397bbf4";
-      sha256 = "1m4dsmk90sbi17571h6pld44zxz7jc4lrnl4f27dpd1l8g5xvjhh";
-    };
-  }
-  {
-    goPackagePath = "github.com/BurntSushi/toml";
-    fetch = {
-      type = "git";
-      url = "https://github.com/BurntSushi/toml";
-      rev = "056c9bc7be7190eaa7715723883caffa5f8fa3e4";
-      sha256 = "0gkgkw04ndr5y7hrdy0r4v2drs5srwfcw2bs1gyas066hwl84xyw";
-    };
-  }
-]

pkgs/os-specific/linux/dpdk/default.nix

@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "1w3nx5cqf8z600bdlbwz7brmdb5yn233qrqvv24kbmmxhbwp7qld";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ] ++ kernel.moduleBuildDependencies;
   buildInputs = [ libvirt ];
 
   RTE_KERNELDIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";

pkgs/os-specific/linux/kernel/common-config.nix

@@ -370,6 +370,15 @@ with stdenv.lib;
     MICROCODE_AMD_EARLY y
   ''}
 
+  ${optionalString (versionAtLeast version "4.10") ''
+    # Write Back Throttling
+    # https://lwn.net/Articles/682582/
+    # https://bugzilla.kernel.org/show_bug.cgi?id=12309#c655
+    BLK_WBT y
+    BLK_WBT_SQ y
+    BLK_WBT_MQ y
+  ''}
+
   # Misc. options.
   8139TOO_8129 y
   8139TOO_PIO n # PIO is slower

pkgs/os-specific/linux/kernel/linux-samus-4.12.nix

@@ -1,7 +1,5 @@
 { stdenv, hostPlatform, fetchFromGitHub, perl, buildLinux, ncurses, ... } @ args:
 
-assert stdenv.is64bit;
-
 import ./generic.nix (args // rec {
   version = "4.12.2";
   extraMeta.branch = "4.12-2";
@@ -14,5 +12,5 @@ import ./generic.nix (args // rec {
       sha256 = "1dr74i79p8r13522w2ppi8gnjd9bhngc9d2hsn91ji6f5a8fbxx9";
     }; in "${upstream}/build/linux";
 
-  extraMeta.hydraPlatforms = [];
+  extraMeta.platforms = [ "x86_64-linux" ];
 } // (args.argsOverride or {}))

pkgs/os-specific/linux/mba6x_bl/default.nix

@@ -13,6 +13,8 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
   hardeningDisable = [ "pic" ];
 
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
   makeFlags = [
     "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     "INSTALL_MOD_PATH=$(out)"

pkgs/servers/http/nginx/modules.nix

@@ -47,12 +47,12 @@
     '';
   };
 
-  modsecurity-beta = {
+  modsecurity-nginx = {
     src = fetchFromGitHub {
       owner = "SpiderLabs";
       repo = "ModSecurity-nginx";
-      rev = "a2a5858d249222938c2f5e48087a922c63d7f9d8";
+      rev = "v1.0.0";
-      sha256 = "1zj0fq35hddzf7b3x40xlbss866lg7w2vd1bbm8g1hcq1ny2s84n";
+      sha256 = "0zzpdqhbdqqy8kjkszv0mrq6136ah9v3zwr1jbh312j8izmzdyi7";
     };
     inputs = [ pkgs.curl pkgs.geoip pkgs.libmodsecurity pkgs.libxml2 pkgs.lmdb pkgs.yajl ];
   };

pkgs/servers/matrix-synapse/default.nix

@@ -10,27 +10,29 @@ let
     };
   };
   matrix-synapse-ldap3 = pythonPackages.buildPythonPackage rec {
-    name = "matrix-synapse-ldap3-${version}";
+    pname = "matrix-synapse-ldap3";
-    version = "0.1.2";
+    version = "0.1.3";
 
     src = fetchFromGitHub {
       owner = "matrix-org";
       repo = "matrix-synapse-ldap3";
       rev = "v${version}";
-      sha256 = "16pivz1lhs1c3z84rxxy8khyvn0hqxwxaz552br1y9ri0maa0aq8";
+      sha256 = "0ss7ld3bpmqm8wcs64q1kb7vxlpmwk9lsgq0mh21a9izyfc7jb2l";
     };
 
     propagatedBuildInputs = with pythonPackages; [ service-identity ldap3 twisted ];
+
+    checkInputs = with pythonPackages; [ ldaptor mock ];
   };
 in pythonPackages.buildPythonApplication rec {
   name = "matrix-synapse-${version}";
-  version = "0.25.1";
+  version = "0.26.0";
 
   src = fetchFromGitHub {
     owner = "matrix-org";
     repo = "synapse";
     rev = "v${version}";
-    sha256 = "110558l147n1dqpylzrdzp8spj36nack88c5kknsxn69gr8yb7j2";
+    sha256 = "1ggdnb4c8y835j9lxsglxry6fqy7d190s70rccjrc3rj0p5vwlyj";
   };
 
   patches = [ ./matrix-synapse.patch ];

pkgs/tools/filesystems/btrfs-progs/default.nix

@@ -2,14 +2,14 @@
 , asciidoc, xmlto, docbook_xml_dtd_45, docbook_xsl, libxslt, zstd
 }:
 
-let version = "4.14"; in
+let version = "4.14.1"; in
 
 stdenv.mkDerivation rec {
   name = "btrfs-progs-${version}";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
-    sha256 = "1bwirg6hz6gyfj5r3xkj4lfwadvl9pxlccf916fsmdn27fy5q289";
+    sha256 = "1palnddw3d50kyflwk1j4xapbc6jniid6j5i9dsr8l8a7nkv7ich";
   };
 
   nativeBuildInputs = [ pkgconfig ];

pkgs/tools/filesystems/tmsu/default.nix

@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   name = "tmsu-${version}";
-  version = "0.6.1";
+  version = "0.7.0";
 
   go-sqlite3 = fetchgit {
     url = "git://github.com/mattn/go-sqlite3";
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     owner = "oniony";
     repo = "tmsu";
     rev = "v${version}";
-    sha256 = "08mz08pw59zaljp7dcndklnfdbn36ld27capivq3ifbq96nnqdf3";
+    sha256 = "0vccxb8mlr7wf92xawnqpvzwlw2xs3b962hjn09dnd6yxqscql64";
   };
 
   buildInputs = [ go fuse ];

pkgs/tools/graphics/optar/default.nix

@@ -0,0 +1,35 @@
+{ stdenv, fetchurl, imagemagick, libpng }:
+
+stdenv.mkDerivation rec {
+  name = "optar-${version}";
+  version = "20150210";
+
+  src = fetchurl {
+    url    = "http://ronja.twibright.com/optar.tgz";
+    sha256 = "10lr31k3xfcpa6vxkbl3abph7j3gks2210489khnnzmhmfdnm1a4";
+  };
+
+  buildInputs = [ libpng ];
+
+  enableParallelBuilding = true;
+
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace /usr/local $out
+
+    substituteInPlace pgm2ps \
+      --replace 'convert ' "${stdenv.lib.getBin imagemagick}/bin/convert "
+  '';
+
+  preInstall = ''
+    mkdir -p $out/bin
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Optar stands for OPTical ARchiver - it's a codec for encoding data on paper";
+    homepage = http://ronja.twibright.com/optar/;
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ peterhoeg ];
+    platforms = with platforms; linux; # possibly others, but only tested on Linux
+  };
+}

pkgs/tools/misc/debootstrap/default.nix

@@ -4,13 +4,13 @@
 # There is also cdebootstrap now. Is that easier to maintain?
 stdenv.mkDerivation rec {
   name = "debootstrap-${version}";
-  version = "1.0.92";
+  version = "1.0.93";
 
   src = fetchurl {
     # git clone git://git.debian.org/d-i/debootstrap.git
     # I'd like to use the source. However it's lacking the lanny script ? (still true?)
     url = "mirror://debian/pool/main/d/debootstrap/debootstrap_${version}.tar.gz";
-    sha256 = "06gp6ivmfh0ks4mibx1mz0pwzjyxqas319s741pp9b3k091jkip1";
+    sha256 = "1nyp9fwb7xrk1vin81dmgx2g9rb52yg4gwz4rcx97gamw4mlvbfd";
   };
 
   buildInputs = [ dpkg gettext gawk perl ];

pkgs/tools/misc/fpp/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "fpp-${version}";
-  version = "0.7.1";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "PathPicker";
     rev = version;
-    sha256 = "1mfyr9k5s3l1sg3c9vlyiqg8n1wwppzb981az2xaxqyk95wwl1sa";
+    sha256 = "03n8sc2fvs2vk46jv6qfkjbyqz85yxnphvabji7qnmd3jv631w47";
   };
 
   postPatch = ''

pkgs/tools/misc/pubs/default.nix

@@ -0,0 +1,34 @@
+{ stdenv, fetchFromGitHub, python3Packages }:
+
+python3Packages.buildPythonApplication rec {
+  name = "pubs-${version}";
+  version = "0.7.0";
+
+  src = fetchFromGitHub {
+    owner = "pubs";
+    repo = "pubs";
+    rev = "v${version}";
+    sha256 = "0n5wbjx9wqy6smfg625mhma739jyg7c92766biaiffp0a2bzr475";
+  };
+
+  propagatedBuildInputs = with python3Packages; [
+    dateutil configobj bibtexparser pyyaml requests beautifulsoup4
+    pyfakefs ddt
+  ];
+
+  preCheck = ''
+    # API tests require networking
+    rm tests/test_apis.py
+
+    # pyfakefs works weirdly in the sandbox
+    export HOME=/
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Command-line bibliography manager";
+    homepage = https://github.com/pubs/pubs;
+    license = licenses.lgpl3;
+    maintainers = with maintainers; [ gebner ];
+    platforms = platforms.all;
+  };
+}

pkgs/tools/misc/ttwatch/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "ttwatch-${version}";
-  version = "2017-10-31";
+  version = "2017-12-31";
 
   src = fetchFromGitHub {
     owner = "ryanbinns";
     repo = "ttwatch";
-    rev = "f4103bdeb612a216ac21747941b3df943d67c48c";
+    rev = "a261851d91e3304a47a04995758f6940747bc54a";
-    sha256 = "0fylycdi0g119d21l11yz23cjjhr3qdxjv02vz86zkc15kyvgsas";
+    sha256 = "0llcai1yxikh8nvzry71rr1zz365rg0k0lwp24np5w74kzza3kwx";
   };
 
   nativeBuildInputs = [ cmake perl ];

pkgs/tools/text/icdiff/default.nix

@@ -2,13 +2,13 @@
 
 pythonPackages.buildPythonApplication rec {
   name = "icdiff-${version}";
-  version = "1.9.0";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "jeffkaufman";
     repo = "icdiff";
     rev = "release-${version}";
-    sha256 = "03gcgj3xsqasvgkr8r0q1ljbw2kd2xmfb21qpxhk9lqqm2gl11sv";
+    sha256 = "0ffn5kq7dwvrimxgpj9ksym36c18md8nsdps82qzhm1xq7p9w9yb";
   };
 
   meta = with stdenv.lib; {

pkgs/tools/text/miller/default.nix

@@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
   name = "miller-${version}";
 
-  version = "5.2.2";
+  version = "5.3.0";
 
   src = fetchFromGitHub {
     owner = "johnkerl";
     repo = "miller";
-    rev = "v${version}";
+    rev = "${version}";
-    sha256 = "1i5lyknsf4vif601l070xh5sz8jy2h359jrb0kc0s0pl8lypxs4i";
+    sha256 = "0abw2n6mi4wbgwihcv3y2xccqx4sj0gdgwvdrg2jkcgraa78sw8v";
   };
 
   nativeBuildInputs = [ autoreconfHook flex libtool ];

pkgs/tools/typesetting/pdftk/default.nix

@@ -8,7 +8,7 @@ stdenv.mkDerivation {
     sha256 = "1hdq6zm2dx2f9h7bjrp6a1hfa1ywgkwydp14i2sszjiszljnm3qi";
   };
 
-  buildInputs = [ gcj unzip ];
+  nativeBuildInputs = [ gcj unzip ];
 
   hardeningDisable = [ "fortify" "format" ];
 

pkgs/top-level/all-packages.nix

@@ -1226,6 +1226,8 @@ with pkgs;
 
   onboard = callPackage ../applications/misc/onboard { };
 
+  optar = callPackage ../tools/graphics/optar {};
+
   patdiff = callPackage ../tools/misc/patdiff { };
 
   playerctl = callPackage ../tools/audio/playerctl { };
@@ -1482,7 +1484,8 @@ with pkgs;
 
   # Use Citrix Receiver 13.4.0 below if you get "A network error occured (SSL error 4)"
   # See https://discussions.citrix.com/topic/385459-ssl-error-with-135-works-with-134/?p=1977735
-  citrix_receiver        = hiPrio citrix_receiver_13_7_0;
+  citrix_receiver        = hiPrio citrix_receiver_13_8_0;
+  citrix_receiver_13_8_0 = callPackage ../applications/networking/remote/citrix-receiver { version = "13.8.0"; };
   citrix_receiver_13_7_0 = callPackage ../applications/networking/remote/citrix-receiver { version = "13.7.0"; };
   citrix_receiver_13_6_0 = callPackage ../applications/networking/remote/citrix-receiver { version = "13.6.0"; };
   citrix_receiver_13_5_0 = callPackage ../applications/networking/remote/citrix-receiver { version = "13.5.0"; };
@@ -4174,6 +4177,8 @@ with pkgs;
     libXNVCtrl = linuxPackages.nvidia_x11.settings.libXNVCtrl;
   };
 
+  pubs = callPackage ../tools/misc/pubs {};
+
   pv = callPackage ../tools/misc/pv { };
 
   pwgen = callPackage ../tools/security/pwgen { };
@@ -16252,6 +16257,8 @@ with pkgs;
 
   mythtv = callPackage ../applications/video/mythtv { };
 
+  micro = callPackage ../applications/editors/micro { };
+
   nano = callPackage ../applications/editors/nano { };
 
   nanoblogger = callPackage ../applications/misc/nanoblogger { };

pkgs/top-level/python-packages.nix

@@ -285,6 +285,8 @@ in {
 
   py3exiv2 = callPackage ../development/python-modules/py3exiv2 { };
 
+  pyfakefs = callPackage ../development/python-modules/pyfakefs {};
+
   pygame = callPackage ../development/python-modules/pygame { };
 
   pygame-git = callPackage ../development/python-modules/pygame/git.nix { };
@@ -9765,6 +9767,8 @@ in {
 
   };
 
+  ldaptor = callPackage ../development/python-modules/ldaptor { };
+
   le = buildPythonPackage rec {
     name = "le-${version}";
     version = "1.4.29";