Merge branch 'master' into staging

Nontrivial rebuilds from master, again :-/

lib/maintainers.nix

@@ -204,6 +204,7 @@
   havvy = "Ryan Scheel <ryan.havvy@gmail.com>";
   hbunke = "Hendrik Bunke <bunke.hendrik@gmail.com>";
   hce = "Hans-Christian Esperer <hc@hcesperer.org>";
+  heel = "Sergii Paryzhskyi <parizhskiy@gmail.com>";
   henrytill = "Henry Till <henrytill@gmail.com>";
   hinton = "Tom Hinton <t@larkery.com>";
   hrdinka = "Christoph Hrdinka <c.nix@hrdinka.at>";

nixos/modules/installer/cd-dvd/iso-image.nix

@@ -172,7 +172,6 @@ in
 
     isoImage.includeSystemBuildDependencies = mkOption {
       default = false;
-      example = true;
       description = ''
         Set this option to include all the needed sources etc in the
         image. It significantly increases image size. Use that when

nixos/modules/module-list.nix

@@ -273,6 +273,7 @@
   ./services/misc/gogs.nix
   ./services/misc/gpsd.nix
   #./services/misc/ihaskell.nix
+  ./services/misc/irkerd.nix
   ./services/misc/leaps.nix
   ./services/misc/mantisbt.nix
   ./services/misc/mathics.nix
@@ -334,6 +335,7 @@
   ./services/monitoring/prometheus/nginx-exporter.nix
   ./services/monitoring/prometheus/node-exporter.nix
   ./services/monitoring/prometheus/snmp-exporter.nix
+  ./services/monitoring/prometheus/unifi-exporter.nix
   ./services/monitoring/prometheus/varnish-exporter.nix
   ./services/monitoring/riemann.nix
   ./services/monitoring/riemann-dash.nix

nixos/modules/programs/adb.nix

@@ -10,7 +10,6 @@ with lib;
     programs.adb = {
       enable = mkOption {
         default = false;
-        example = true;
         type = types.bool;
         description = ''
           Whether to configure system to use Android Debug Bridge (adb).

nixos/modules/programs/gphoto2.nix

@@ -10,7 +10,6 @@ with lib;
     programs.gphoto2 = {
       enable = mkOption {
         default = false;
-        example = true;
         type = types.bool;
         description = ''
           Whether to configure system to use gphoto2.

nixos/modules/programs/mosh.nix

@@ -14,7 +14,6 @@ in
         Whether to enable mosh. Note, this will open ports in your firewall!
       '';
       default = false;
-      example = true;
       type = lib.types.bool;
     };
   };

nixos/modules/programs/ssmtp.nix

@@ -22,7 +22,6 @@ in
       directDelivery = mkOption {
         type = types.bool;
         default = false;
-        example = true;
         description = ''
           Use the trivial Mail Transfer Agent (MTA)
           <command>ssmtp</command> package to allow programs to send
@@ -65,7 +64,6 @@ in
       useTLS = mkOption {
         type = types.bool;
         default = false;
-        example = true;
         description = ''
           Whether TLS should be used to connect to the default mail
           server.
@@ -75,7 +73,6 @@ in
       useSTARTTLS = mkOption {
         type = types.bool;
         default = false;
-        example = true;
         description = ''
           Whether the STARTTLS should be used to connect to the default
           mail server.  (This is needed for TLS-capable mail servers

nixos/modules/programs/tmux.nix

@@ -65,7 +65,6 @@ in {
 
       aggressiveResize = mkOption {
         default = false;
-        example = true;
         type = types.bool;
         description = ''
           Resize the window to the size of the smallest session for which it is the current window.
@@ -81,14 +80,12 @@ in {
 
       clock24 = mkOption {
         default = false;
-        example = true;
         type = types.bool;
         description = "Use 24 hour clock.";
       };
 
       customPaneNavigationAndResize = mkOption {
         default = false;
-        example = true;
         type = types.bool;
         description = "Override the hjkl and HJKL bindings for pane navigation and resizing in VI mode.";
       };
@@ -124,14 +121,12 @@ in {
 
       newSession = mkOption {
         default = false;
-        example = true;
         type = types.bool;
         description = "Automatically spawn a session if trying to attach and none are running.";
       };
 
       reverseSplit = mkOption {
         default = false;
-        example = true;
         type = types.bool;
         description = "Reverse the window split shortcuts.";
       };

nixos/modules/programs/vim.nix

@@ -9,7 +9,6 @@ in {
     defaultEditor = mkOption {
       type = types.bool;
       default = false;
-      example = true;
       description = ''
         When enabled, installs vim and configures vim to be the default editor
         using the EDITOR environment variable.

nixos/modules/security/dhparams.nix

@@ -19,6 +19,12 @@ in
             Note: The name of the DH params is taken as being the name of the
             service it serves: the params will be generated before the said
             service is started.
+
+            Warning: If you are removing all dhparams from this list, you have
+            to leave security.dhparams.enable for at least one activation in
+            order to have them be cleaned up. This also means if you rollback to
+            a version without any dhparams the existing ones won't be cleaned
+            up.
           '';
         type = with types; attrsOf int;
         default = {};
@@ -34,57 +40,68 @@ in
         type = types.str;
         default = "/var/lib/dhparams";
       };
+
+      enable = mkOption {
+        description =
+          ''
+            Whether to generate new DH params and clean up old DH params.
+          '';
+        default = false;
+        type = types.bool;
+      };
     };
   };
 
-  config.systemd.services = {
+  config = mkIf cfg.enable {
-    dhparams-init = {
+    systemd.services = {
-      description = "Cleanup old Diffie-Hellman parameters";
+      dhparams-init = {
-      wantedBy = [ "multi-user.target" ]; # Clean up even when no DH params is set
+        description = "Cleanup old Diffie-Hellman parameters";
-      serviceConfig.Type = "oneshot";
+        wantedBy = [ "multi-user.target" ]; # Clean up even when no DH params is set
-      script =
+        serviceConfig.Type = "oneshot";
-        # Create directory
+        script =
-        ''
+          # Create directory
-          if [ ! -d ${cfg.path} ]; then
+          ''
-            mkdir -p ${cfg.path}
+            if [ ! -d ${cfg.path} ]; then
-          fi
+              mkdir -p ${cfg.path}
-        '' +
-        # Remove old dhparams
-        ''
-          for file in ${cfg.path}/*; do
-            if [ ! -f "$file" ]; then
-              continue
             fi
-        '' + concatStrings (mapAttrsToList (name: value:
+          '' +
-        ''
+          # Remove old dhparams
-            if [ "$file" == "${cfg.path}/${name}.pem" ] && \
+          ''
-                ${pkgs.openssl}/bin/openssl dhparam -in "$file" -text | head -n 1 | grep "(${toString value} bit)" > /dev/null; then
+            for file in ${cfg.path}/*; do
-              continue
+              if [ ! -f "$file" ]; then
-            fi
+                continue
-        ''
+              fi
-        ) cfg.params) +
+          '' + concatStrings (mapAttrsToList (name: value:
-        ''
+          ''
-            rm $file
+              if [ "$file" == "${cfg.path}/${name}.pem" ] && \
-          done
+                  ${pkgs.openssl}/bin/openssl dhparam -in "$file" -text | head -n 1 | grep "(${toString value} bit)" > /dev/null; then
+                continue
+              fi
+          ''
+          ) cfg.params) +
+          ''
+              rm $file
+            done
 
-          # TODO: Ideally this would be removing the *former* cfg.path, though this
+            # TODO: Ideally this would be removing the *former* cfg.path, though this
-          # does not seem really important
+            # does not seem really important as changes to it are quite unlikely
-          rmdir -p --ignore-fail-on-non-empty ${cfg.path}
+            rmdir --ignore-fail-on-non-empty ${cfg.path}
-        '';
+          '';
-    };
+      };
-  } //
+    } //
-    mapAttrs' (name: value: nameValuePair "dhparams-gen-${name}" {
+      mapAttrs' (name: value: nameValuePair "dhparams-gen-${name}" {
-      description = "Generate Diffie-Hellman parameters for ${name} if they don't exist yet";
+        description = "Generate Diffie-Hellman parameters for ${name} if they don't exist yet";
-      after = [ "dhparams-init.service" ];
+        after = [ "dhparams-init.service" ];
-      before = [ "${name}.service" ];
+        before = [ "${name}.service" ];
-      wantedBy = [ "multi-user.target" ];
+        wantedBy = [ "multi-user.target" ];
-      serviceConfig.Type = "oneshot";
+        serviceConfig.Type = "oneshot";
-      script =
+        script =
-        ''
+          ''
-          mkdir -p ${cfg.path}
+            mkdir -p ${cfg.path}
-          if [ ! -f ${cfg.path}/${name}.pem ]; then
+            if [ ! -f ${cfg.path}/${name}.pem ]; then
-            ${pkgs.openssl}/bin/openssl dhparam -out ${cfg.path}/${name}.pem ${toString value}
+              ${pkgs.openssl}/bin/openssl dhparam -out ${cfg.path}/${name}.pem ${toString value}
-          fi
+            fi
-        '';
+          '';
-    }) cfg.params;
+      }) cfg.params;
+  };
 }

nixos/modules/security/grsecurity.nix

@@ -21,7 +21,6 @@ in
 
     enable = mkOption {
       type = types.bool;
-      example = true;
       default = false;
       description = ''
         Enable grsecurity/PaX.
@@ -30,7 +29,6 @@ in
 
     lockTunables = mkOption {
       type = types.bool;
-      example = false;
       default = true;
       description = ''
         Whether to automatically lock grsecurity tunables
@@ -43,7 +41,6 @@ in
 
     disableEfiRuntimeServices = mkOption {
       type = types.bool;
-      example = false;
       default = true;
       description = ''
         Whether to disable access to EFI runtime services.  Enabling EFI runtime

nixos/modules/services/backup/rsnapshot.nix

@@ -26,7 +26,6 @@ in
       enableManualRsnapshot = mkOption {
         description = "Whether to enable manual usage of the rsnapshot command with this module.";
         default = true;
-        example = false;
         type = types.bool;
       };
 

nixos/modules/services/computing/boinc/client.nix

@@ -12,7 +12,6 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        example = true;
         description = ''
           Whether to enable the BOINC distributed computing client. If this
           option is set to true, the boinc_client daemon will be run as a
@@ -41,7 +40,6 @@ in
       allowRemoteGuiRpc = mkOption {
         type = types.bool;
         default = false;
-        example = true;
         description = ''
           If set to true, any remote host can connect to and control this BOINC
           client (subject to password authentication). If instead set to false,

nixos/modules/services/databases/cassandra.nix

@@ -310,7 +310,6 @@ in {
     autoBootstrap = mkOption {
       description = "It makes new (non-seed) nodes automatically migrate the right data to themselves.";
       default = true;
-      example = true;
       type = types.bool;
     };
     streamingSocketTimoutInMS = mkOption {

nixos/modules/services/databases/couchdb.nix

@@ -4,20 +4,29 @@ with lib;
 
 let
   cfg = config.services.couchdb;
-  configFile = pkgs.writeText "couchdb.ini"
+  useVersion2 = strings.versionAtLeast (strings.getVersion cfg.package) "2.0";
+  configFile = pkgs.writeText "couchdb.ini" (
     ''
       [couchdb]
       database_dir = ${cfg.databaseDir}
       uri_file = ${cfg.uriFile}
       view_index_dir = ${cfg.viewIndexDir}
-
+    '' + (if useVersion2 then
+    ''
+      [chttpd]
+    '' else
+    ''
       [httpd]
+    '') +
+    ''
       port = ${toString cfg.port}
       bind_address = ${cfg.bindAddress}
 
       [log]
       file = ${cfg.logFile}
-    '';
+    '');
+  executable = if useVersion2 then "${cfg.package}/bin/couchdb"
+    else ''${cfg.package}/bin/couchdb -a ${configFile} -a ${pkgs.writeText "couchdb-extra.ini" cfg.extraConfig} -a ${cfg.configFile}'';
 
 in {
 
@@ -130,7 +139,6 @@ in {
 
       configFile = mkOption {
         type = types.string;
-        default = "/var/lib/couchdb/couchdb.ini";
         description = ''
           Configuration file for persisting runtime changes. File
           needs to be readable and writable from couchdb user/group.
@@ -147,6 +155,9 @@ in {
 
     environment.systemPackages = [ cfg.package ];
 
+    services.couchdb.configFile = mkDefault
+      (if useVersion2 then "/var/lib/couchdb/local.ini" else "/var/lib/couchdb/couchdb.ini");
+
     systemd.services.couchdb = {
       description = "CouchDB Server";
       wantedBy = [ "multi-user.target" ];
@@ -170,11 +181,20 @@ in {
         fi
         '';
 
+      environment = mkIf useVersion2 {
+        # we are actually specifying 4 configuration files:
+        # 1. the preinstalled default.ini
+        # 2. the module configuration
+        # 3. the extraConfig from the module options
+        # 4. the locally writable config file, which couchdb itself writes to
+        ERL_FLAGS= ''-couch_ini ${cfg.package}/etc/default.ini ${configFile} ${pkgs.writeText "couchdb-extra.ini" cfg.extraConfig} ${cfg.configFile}'';
+      };
+
       serviceConfig = {
         PermissionsStartOnly = true;
         User = cfg.user;
         Group = cfg.group;
-        ExecStart = "${cfg.package}/bin/couchdb -a ${configFile} -a ${pkgs.writeText "couchdb-extra.ini" cfg.extraConfig} -a ${cfg.configFile}";
+        ExecStart = executable;
       };
     };
 

nixos/modules/services/databases/neo4j.nix

@@ -130,6 +130,7 @@ in {
         ExecStart = "${cfg.package}/bin/neo4j console";
         User = "neo4j";
         PermissionsStartOnly = true;
+        LimitNOFILE = 40000;
       };
       preStart = ''
         mkdir -m 0700 -p ${cfg.dataDir}/{data/graph.db,conf,logs}

nixos/modules/services/databases/openldap.nix

@@ -25,7 +25,6 @@ in
         description = "
           Whether to enable the ldap server.
         ";
-        example = true;
       };
 
       user = mkOption {

nixos/modules/services/editors/emacs.nix

@@ -21,7 +21,6 @@ in {
     enable = mkOption {
       type = types.bool;
       default = false;
-      example = true;
       description = ''
         Whether to enable a user service for the Emacs daemon. Use <literal>emacsclient</literal> to connect to the
         daemon. If <literal>true</literal>, <varname>services.emacs.install</varname> is
@@ -32,7 +31,6 @@ in {
     install = mkOption {
       type = types.bool;
       default = false;
-      example = true;
       description = ''
         Whether to install a user service for the Emacs daemon. Once
         the service is started, use emacsclient to connect to the
@@ -57,7 +55,6 @@ in {
     defaultEditor = mkOption {
       type = types.bool;
       default = false;
-      example = true;
       description = ''
         When enabled, configures emacsclient to be the default editor
         using the EDITOR environment variable.

nixos/modules/services/mail/mlmmj.nix

@@ -18,7 +18,7 @@ let
   footer = domain: list: "To unsubscribe send a mail to ${list}+unsubscribe@${domain}";
   createList = d: l: ''
     ${pkgs.coreutils}/bin/mkdir -p ${listCtl d l}
-    echo ${listAddress d l} > ${listCtl d l}/listadress
+    echo ${listAddress d l} > ${listCtl d l}/listaddress
     echo "${lib.concatStringsSep "\n" (customHeaders d l)}" > ${listCtl d l}/customheaders
     echo ${footer d l} > ${listCtl d l}/footer
     echo ${subjectPrefix l} > ${listCtl d l}/prefix

nixos/modules/services/mail/offlineimap.nix

@@ -12,7 +12,6 @@ in {
     install = mkOption {
       type = types.bool;
       default = false;
-      example = true;
       description = ''
         Whether to install a user service for Offlineimap. Once
         the service is started, emails will be fetched automatically.

nixos/modules/services/misc/ihaskell.nix

@@ -16,7 +16,6 @@ in
     services.ihaskell = {
       enable = mkOption {
         default = false;
-        example = true;
         description = "Autostart an IHaskell notebook service.";
       };
 

nixos/modules/services/misc/irkerd.nix

@@ -0,0 +1,67 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.irkerd;
+  ports = [ 6659 ];
+in
+{
+  options.services.irkerd = {
+    enable = mkOption {
+      description = "Whether to enable irker, an IRC notification daemon.";
+      default = false;
+      type = types.bool;
+    };
+
+    openPorts = mkOption {
+      description = "Open ports in the firewall for irkerd";
+      default = false;
+      type = types.bool;
+    };
+
+    listenAddress = mkOption {
+      default = "localhost";
+      example = "0.0.0.0";
+      type = types.str;
+      description = ''
+        Specifies the bind address on which the irker daemon listens.
+        The default is localhost.
+
+        Irker authors strongly warn about the risks of running this on
+        a publicly accessible interface, so change this with caution.
+      '';
+    };
+
+    nick = mkOption {
+      default = "irker";
+      type = types.str;
+      description = "Nick to use for irker";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.irkerd = {
+      description = "Internet Relay Chat (IRC) notification daemon";
+      documentation = [ "man:irkerd(8)" "man:irkerhook(1)" "man:irk(1)" ];
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        ExecStart = "${pkgs.irker}/bin/irkerd -H ${cfg.listenAddress} -n ${cfg.nick}";
+        User = "irkerd";
+      };
+    };
+
+    environment.systemPackages = [ pkgs.irker ];
+
+    users.users.irkerd = {
+      description = "Irker daemon user";
+      isSystemUser = true;
+      group = "irkerd";
+    };
+    users.groups.irkerd = {};
+
+    networking.firewall.allowedTCPPorts = mkIf cfg.openPorts ports;
+    networking.firewall.allowedUDPPorts = mkIf cfg.openPorts ports;
+  };
+}

nixos/modules/services/misc/taskserver/default.nix

@@ -148,7 +148,6 @@ in {
       enable = mkOption {
         type = types.bool;
         default = false;
-        example = true;
         description = ''
           Whether to enable the Taskwarrior server.
 

nixos/modules/services/monitoring/arbtt.nix

@@ -10,7 +10,6 @@ in {
       enable = mkOption {
         type = types.bool;
         default = false;
-        example = true;
         description = ''
           Enable the arbtt statistics capture service.
         '';

nixos/modules/services/monitoring/prometheus/unifi-exporter.nix

@@ -0,0 +1,104 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.services.prometheus.unifiExporter;
+in {
+  options = {
+    services.prometheus.unifiExporter = {
+      enable = mkEnableOption "prometheus unifi exporter";
+
+      port = mkOption {
+        type = types.int;
+        default = 9130;
+        description = ''
+          Port to listen on.
+        '';
+      };
+
+      unifiAddress = mkOption {
+        type = types.str;
+        example = "https://10.0.0.1:8443";
+        description = ''
+          URL of the UniFi Controller API.
+        '';
+      };
+
+      unifiInsecure = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          If enabled skip the verification of the TLS certificate of the UniFi Controller API.
+          Use with caution.
+        '';
+      };
+      
+      unifiUsername = mkOption {
+        type = types.str;
+        example = "ReadOnlyUser";
+        description = ''
+          username for authentication against UniFi Controller API.
+        '';
+      };
+      
+      unifiPassword = mkOption {
+        type = types.str;
+        description = ''
+          Password for authentication against UniFi Controller API.
+        '';
+      };
+      
+      unifiTimeout = mkOption {
+        type = types.str;
+        default = "5s";
+        example = "2m";
+        description = ''
+          Timeout including unit for UniFi Controller API requests.
+        '';
+      };
+
+      extraFlags = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        description = ''
+          Extra commandline options when launching the unifi exporter.
+        '';
+      };
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Open port in firewall for incoming connections.
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = optional cfg.openFirewall cfg.port;
+
+    systemd.services.prometheus-unifi-exporter = {
+      description = "Prometheus exporter for UniFi Controller metrics";
+      unitConfig.Documentation = "https://github.com/mdlayher/unifi_exporter";
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        User = "nobody";
+        Restart = "always";
+        PrivateTmp = true;
+        WorkingDirectory = /tmp;
+        ExecStart = ''
+          ${pkgs.prometheus-unifi-exporter}/bin/unifi_exporter \
+            -telemetry.addr :${toString cfg.port} \
+            -unifi.addr ${cfg.unifiAddress} \
+            -unifi.username ${cfg.unifiUsername} \
+            -unifi.password ${cfg.unifiPassword} \
+            -unifi.timeout ${cfg.unifiTimeout} \
+            ${optionalString cfg.unifiInsecure "-unifi.insecure" } \
+            ${concatStringsSep " \\\n  " cfg.extraFlags}
+        '';
+      };
+    };
+  };
+}

nixos/modules/services/networking/aiccu.nix

@@ -35,7 +35,6 @@ in {
       enable = mkOption {
         type = types.bool;
         default = false;
-        example = true;
         description = "Enable aiccu IPv6 over IPv4 SiXXs tunnel";
       };
 
@@ -88,21 +87,18 @@ in {
       verbose = mkOption {
         type = types.bool;
         default = false;
-        example = true;
         description = "Be verbose?";
       };
 
       automatic = mkOption {
         type = types.bool;
         default = true;
-        example = false;
         description = "Automatic Login and Tunnel activation";
       };
 
       requireTLS = mkOption {
         type = types.bool;
         default = false;
-        example = true;
         description = ''
           When set to true, if TLS is not supported on the server
           the TIC transaction will fail.
@@ -124,7 +120,6 @@ in {
       defaultRoute = mkOption {
         type = types.bool;
         default = true;
-        example = false;
         description = "Add a default route";
       };
 
@@ -138,7 +133,6 @@ in {
       makeHeartBeats = mkOption {
         type = types.bool;
         default = true;
-        example = false;
         description = ''
           In general you don't want to turn this off
           Of course only applies to AYIYA and heartbeat tunnels not to static ones
@@ -148,21 +142,18 @@ in {
       noConfigure = mkOption {
         type = types.bool;
         default = false;
-        example = true;
         description = "Don't configure anything";
       };
 
       behindNAT = mkOption {
         type = types.bool;
         default = false;
-        example = true;
         description = "Notify the user that a NAT-kind network is detected";
       };
 
       localIPv4Override = mkOption {
         type = types.bool;
         default = false;
-        example = true;
         description = ''
           Overrides the IPv4 parameter received from TIC
           This allows one to configure a NAT into "DMZ" mode and then

nixos/modules/services/networking/ferm.nix

@@ -19,7 +19,6 @@ in {
     services.ferm = {
       enable = mkOption {
         default = false;
-        example = true;
         type = types.bool;
         description = ''
           Whether to enable Ferm Firewall.

nixos/modules/services/networking/firefox/sync-server.nix

@@ -33,7 +33,6 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        example = true;
         description = ''
           Whether to enable a Firefox Sync Server, this give the opportunity to
           Firefox users to store all synchronized data on their own server. To use this
@@ -78,7 +77,6 @@ in
       allowNewUsers = mkOption {
         type = types.bool;
         default = true;
-        example = false;
         description = ''
           Whether to allow new-user signups on the server. Only request by
           existing accounts will be honored.

nixos/modules/services/networking/mosquitto.nix

@@ -147,7 +147,6 @@ in
 
       allowAnonymous = mkOption {
         default = false;
-        example = true;
         type = types.bool;
         description = ''
           Allow clients to connect without authentication.

nixos/modules/services/networking/quagga.nix

@@ -104,7 +104,6 @@ in
         enable = mkOption {
           type = types.bool;
           default = any isEnabled services;
-          example = true;
           description = ''
             Whether to enable the Zebra routing manager.
 

nixos/modules/services/networking/znc.nix

@@ -132,7 +132,6 @@ in
     services.znc = {
       enable = mkOption {
         default = false;
-        example = true;
         type = types.bool;
         description = ''
           Enable a ZNC service for a user.
@@ -251,7 +250,6 @@ in
 
         useSSL = mkOption {
           default = true;
-          example = true;
           type = types.bool;
           description = ''
             Indicates whether the ZNC server should use SSL when listening on the specified port. A self-signed certificate will be generated.
@@ -278,7 +276,6 @@ in
  
       mutable = mkOption {
         default = false;
-        example = true;
         type = types.bool;
         description = ''
           Indicates whether to allow the contents of the `dataDir` directory to be changed

nixos/modules/services/scheduling/cron.nix

@@ -39,7 +39,7 @@ in
 
       enable = mkOption {
         type = types.bool;
-        example = true;
+        default = false;
         description = "Whether to enable the Vixie cron daemon.";
       };
 

nixos/modules/services/security/haka.nix

@@ -99,7 +99,6 @@ in
 
       pcap = mkOption {
         default = true;
-        example = false;
         type = types.bool;
         description = "Whether to enable pcap";
       };

nixos/modules/services/security/tor.nix

@@ -12,6 +12,10 @@ let
   torRc = ''
     User tor
     DataDirectory ${torDirectory}
+    ${optionalString cfg.enableGeoIP ''
+      GeoIPFile ${pkgs.tor.geoip}/share/tor/geoip
+      GeoIPv6File ${pkgs.tor.geoip}/share/tor/geoip6
+    ''}
 
     ${optint "ControlPort" cfg.controlPort}
   ''
@@ -58,6 +62,18 @@ in
         '';
       };
 
+      enableGeoIP = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Whenever to configure Tor daemon to use GeoIP databases.
+
+          Disabling this will disable by-country statistics for
+          bridges and relays and some client and third-party software
+          functionality.
+        '';
+      };
+
       extraConfig = mkOption {
         type = types.lines;
         default = "";

nixos/modules/services/security/torify.nix

@@ -25,9 +25,17 @@ in
     services.tor.tsocks = {
 
       enable = mkOption {
-        default = cfg.enable && cfg.client.enable;
+        default = false;
         description = ''
-          Whether to build tsocks wrapper script to relay application traffic via TOR.
+          Whether to build tsocks wrapper script to relay application traffic via Tor.
+
+          <important>
+            <para>You shouldn't use this unless you know what you're
+            doing because your installation of Tor already comes with
+            its own superior (doesn't leak DNS queries)
+            <literal>torsocks</literal> wrapper which does pretty much
+            exactly the same thing as this.</para>
+          </important>
         '';
       };
 

nixos/modules/services/torrent/deluge.nix

@@ -13,7 +13,6 @@ in {
       deluge = {
         enable = mkOption {
           default = false;
-          example = true;
           description = "Start the Deluge daemon";
         };
 
@@ -29,7 +28,6 @@ in {
       deluge.web = {
         enable = mkOption {
           default = false;
-          example = true;
           description = ''
             Start Deluge Web daemon.
           '';

nixos/modules/services/web-apps/atlassian/crowd.nix

@@ -88,7 +88,6 @@ in
         secure = mkOption {
           type = types.bool;
           default = true;
-          example = false;
           description = "Whether the connections to the proxy should be considered secure.";
         };
       };

nixos/modules/services/web-apps/atlassian/jira.nix

@@ -78,7 +78,6 @@ in
         secure = mkOption {
           type = types.bool;
           default = true;
-          example = false;
           description = "Whether the connections to the proxy should be considered secure.";
         };
       };

nixos/modules/services/web-servers/caddy.nix

@@ -29,7 +29,6 @@ in
 
     agree = mkOption {
       default = false;
-      example = true;
       type = types.bool;
       description = "Agree to Let's Encrypt Subscriber Agreement";
     };

nixos/modules/services/web-servers/jboss/default.nix

@@ -25,7 +25,7 @@ in
 
       enable = mkOption {
         default = false;
-        description = "Whether to enable jboss";
+        description = "Whether to enable JBoss. WARNING : this package is outdated and is known to have vulnerabilities.";
       };
 
       tempDir = mkOption {

nixos/modules/services/x11/compton.nix

@@ -43,7 +43,6 @@ in {
     enable = mkOption {
       type = types.bool;
       default = false;
-      example = true;
       description = ''
         Whether of not to enable Compton as the X.org composite manager.
       '';
@@ -52,7 +51,6 @@ in {
     fade = mkOption {
       type = types.bool;
       default = false;
-      example = true;
       description = ''
         Fade windows in and out.
       '';
@@ -93,7 +91,6 @@ in {
     shadow = mkOption {
       type = types.bool;
       default = false;
-      example = true;
       description = ''
         Draw window shadows.
       '';

nixos/modules/services/x11/desktop-managers/enlightenment.nix

@@ -20,7 +20,6 @@ in
 
     services.xserver.desktopManager.enlightenment.enable = mkOption {
       default = false;
-      example = true;
       description = "Enable the Enlightenment desktop environment.";
     };
 

nixos/modules/services/x11/desktop-managers/gnome3.nix

@@ -53,7 +53,6 @@ in {
     services.xserver.desktopManager.gnome3 = {
       enable = mkOption {
         default = false;
-        example = true;
         description = "Enable Gnome 3 desktop manager.";
       };
 

nixos/modules/services/x11/desktop-managers/kodi.nix

@@ -11,7 +11,6 @@ in
     services.xserver.desktopManager.kodi = {
       enable = mkOption {
         default = false;
-        example = true;
         description = "Enable the kodi multimedia center.";
       };
     };

nixos/modules/services/x11/desktop-managers/xterm.nix

@@ -13,7 +13,6 @@ in
 
     services.xserver.desktopManager.xterm.enable = mkOption {
       default = true;
-      example = false;
       description = "Enable a xterm terminal as a desktop manager.";
     };
 

nixos/modules/services/x11/hardware/libinput.nix

@@ -73,7 +73,6 @@ in {
       clickMethod = mkOption {
         type = types.nullOr (types.enum [ "none" "buttonareas" "clickfinger" ]);
         default = null;
-        example = "none";
         description =
           ''
             Enables a click method. Permitted values are none, buttonareas, clickfinger.
@@ -85,14 +84,12 @@ in {
       leftHanded = mkOption {
         type = types.bool;
         default = false;
-        example = true;
         description = "Enables left-handed button orientation, i.e. swapping left and right buttons.";
       };
 
       middleEmulation = mkOption {
         type = types.bool;
         default = true;
-        example = false;
         description =
           ''
             Enables middle button emulation. When enabled, pressing the left and right buttons
@@ -103,7 +100,6 @@ in {
       naturalScrolling = mkOption {
         type = types.bool;
         default = false;
-        example = true;
         description = "Enables or disables natural scrolling behavior.";
       };
 
@@ -131,7 +127,6 @@ in {
       horizontalScrolling = mkOption {
         type = types.bool;
         default = true;
-        example = false;
         description =
           ''
             Disables horizontal scrolling. When disabled, this driver will discard any horizontal scroll
@@ -153,7 +148,6 @@ in {
       tapping = mkOption {
         type = types.bool;
         default = true;
-        example = false;
         description =
           ''
             Enables or disables tap-to-click behavior.
@@ -163,7 +157,6 @@ in {
       tappingDragLock = mkOption {
         type = types.bool;
         default = true;
-        example = false;
         description =
           ''
             Enables or disables drag lock during tapping behavior. When enabled, a finger up during tap-
@@ -175,7 +168,6 @@ in {
       disableWhileTyping = mkOption {
         type = types.bool;
         default = true;
-        example = false;
         description =
           ''
             Disable input method while typing.

nixos/modules/services/x11/hardware/multitouch.nix

@@ -18,20 +18,17 @@ in {
 
       enable = mkOption {
         default = false;
-        example = true;
         description = "Whether to enable multitouch touchpad support.";
       };
 
       invertScroll = mkOption {
         default = false;
-        example = true;
         type = types.bool;
         description = "Whether to invert scrolling direction à la OSX Lion";
       };
 
       ignorePalm = mkOption {
         default = false;
-        example = true;
         type = types.bool;
         description = "Whether to ignore touches detected as being the palm (i.e when typing)";
       };
@@ -39,7 +36,6 @@ in {
       tapButtons = mkOption {
         type = types.bool;
         default = true;
-        example = false;
         description = "Whether to enable tap buttons.";
       };
 

nixos/modules/services/x11/hardware/synaptics.nix

@@ -29,7 +29,6 @@ in {
       enable = mkOption {
         type = types.bool;
         default = false;
-        example = true;
         description = "Whether to enable touchpad support.";
       };
 
@@ -102,7 +101,6 @@ in {
       tapButtons = mkOption {
         type = types.bool;
         default = true;
-        example = false;
         description = "Whether to enable tap buttons.";
       };
 
@@ -125,7 +123,6 @@ in {
       palmDetect = mkOption {
         type = types.bool;
         default = false;
-        example = true;
         description = "Whether to enable palm detection (hardware support required)";
       };
 
@@ -146,7 +143,6 @@ in {
       horizontalScroll = mkOption {
         type = types.bool;
         default = true;
-        example = false;
         description = "Whether to enable horizontal scrolling (on touchpad)";
       };
 

nixos/modules/services/x11/redshift.nix

@@ -12,7 +12,6 @@ in {
     enable = mkOption {
       type = types.bool;
       default = false;
-      example = true;
       description = ''
         Enable Redshift to change your screen's colour temperature depending on
         the time of day.

nixos/modules/services/x11/unclutter-xfixes.nix

@@ -11,7 +11,6 @@ in {
       description = "Enable unclutter-xfixes to hide your mouse cursor when inactive.";
       type = types.bool;
       default = false;
-      example = true;
     };
 
     package = mkOption {

nixos/modules/services/x11/unclutter.nix

@@ -11,7 +11,6 @@ in {
       description = "Enable unclutter to hide your mouse cursor when inactive";
       type = types.bool;
       default = false;
-      example = true;
     };
 
     package = mkOption {

nixos/modules/services/x11/urxvtd.nix

@@ -11,7 +11,6 @@ in {
   options.services.urxvtd.enable = mkOption {
     type = types.bool;
     default = false;
-    example = true;
     description = ''
       Enable urxvtd, the urxvt terminal daemon. To use urxvtd, run
       "urxvtc".

nixos/modules/services/x11/window-managers/exwm.nix

@@ -21,7 +21,6 @@ in
       enable = mkEnableOption "exwm";
       enableDefaultConfig = mkOption {
         default = true;
-        example = false;
         type = lib.types.bool;
         description = "Enable an uncustomised exwm configuration.";
       };

nixos/modules/services/x11/window-managers/xmonad.nix

@@ -44,7 +44,6 @@ in
 
       enableContribAndExtras = mkOption {
         default = false;
-        example = true;
         type = lib.types.bool;
         description = "Enable xmonad-{contrib,extras} in Xmonad.";
       };

nixos/modules/system/boot/loader/grub/grub.nix

@@ -381,7 +381,6 @@ in
 
       efiInstallAsRemovable = mkOption {
         default = false;
-        example = true;
         type = types.bool;
         description = ''
           Whether to invoke <literal>grub-install</literal> with

nixos/modules/tasks/filesystems/zfs.nix

@@ -109,7 +109,6 @@ in
       forceImportRoot = mkOption {
         type = types.bool;
         default = true;
-        example = false;
         description = ''
           Forcibly import the ZFS root pool(s) during early boot.
 
@@ -128,7 +127,6 @@ in
       forceImportAll = mkOption {
         type = types.bool;
         default = true;
-        example = false;
         description = ''
           Forcibly import all ZFS pool(s).
 

nixos/modules/tasks/network-interfaces.nix

@@ -548,7 +548,6 @@ in
           };
 
           rstp = mkOption {
-            example = true;
             default = false;
             type = types.bool;
             description = "Whether the bridge interface should enable rstp.";

nixos/modules/virtualisation/containers.nix

@@ -274,7 +274,6 @@ let
       };
       isReadOnly = mkOption {
         default = true;
-        example = true;
         type = types.bool;
         description = "Determine whether the mounted path will be accessed in read-only mode.";
       };

nixos/tests/firefox.nix

@@ -8,15 +8,21 @@ import ./make-test.nix ({ pkgs, ... }: {
     { config, pkgs, ... }:
 
     { imports = [ ./common/x11.nix ];
-      environment.systemPackages = [ pkgs.firefox ];
+      environment.systemPackages = [ pkgs.firefox pkgs.xdotool ];
     };
 
   testScript =
     ''
       $machine->waitForX;
-      $machine->execute("firefox file://${pkgs.valgrind.doc}/share/doc/valgrind/html/index.html &");
+      $machine->execute("xterm -e 'firefox file://${pkgs.valgrind.doc}/share/doc/valgrind/html/index.html' &");
       $machine->waitForWindow(qr/Valgrind/);
       $machine->sleep(40); # wait until Firefox has finished loading the page
+      $machine->execute("xdotool key space"); # do I want to make Firefox the
+                             # default browser? I just want to close the dialog
+      $machine->sleep(2); # wait until Firefox hides the default browser window
+      $machine->execute("xdotool key F12");
+      $machine->sleep(10); # wait until Firefox draws the developer tool panel
+      $machine->succeed("xwininfo -root -tree | grep Valgrind");
       $machine->screenshot("screen");
     '';
 

pkgs/applications/audio/clementine/default.nix

@@ -5,6 +5,10 @@
 
 let
   withSpotify = config.clementine.spotify or false;
+  withIpod = config.clementine.ipod or false;
+  withMTP = config.clementine.mtp or true;
+  withCD = config.clementine.cd or true;
+  withCloud = config.clementine.cloud or true;
 
   version = "1.2.3";
 
@@ -30,21 +34,19 @@ let
     gst-plugins-base
     gstreamer
     gvfs
-    libcdio
-    libgpod
     liblastfm
-    libmtp
-    libplist
     pkgconfig
     protobuf
     qca2
     qjson
     qt4
-    sparsehash
     sqlite
     taglib
-    usbmuxd
+  ]
-  ];
+  ++ stdenv.lib.optionals (withIpod) [libgpod libplist usbmuxd]
+  ++ stdenv.lib.optionals (withMTP) [libmtp]
+  ++ stdenv.lib.optionals (withCD) [libcdio]
+  ++ stdenv.lib.optionals (withCloud) [sparsehash];
 
   free = stdenv.mkDerivation {
     name = "clementine-free-${version}";

pkgs/applications/editors/atom/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, lib, makeWrapper, gvfs, atomEnv, libXScrnSaver, libxkbfile }:
+{ stdenv, fetchurl, lib, makeWrapper, gvfs, atomEnv}:
 
 stdenv.mkDerivation rec {
   name = "atom-${version}";
@@ -21,9 +21,7 @@ stdenv.mkDerivation rec {
     rm -r $out/share/lintian
     rm -r $out/usr/
     wrapProgram $out/bin/atom \
-      --prefix "PATH" : "${gvfs}/bin" \
+      --prefix "PATH" : "${gvfs}/bin"
-      --prefix LD_PRELOAD : ${stdenv.lib.makeLibraryPath [ libXScrnSaver ]}/libXss.so.1 \
-      --prefix LD_PRELOAD : ${stdenv.lib.makeLibraryPath [ libxkbfile ]}/libxkbfile.so.1
 
     fixupPhase
 
@@ -33,8 +31,11 @@ stdenv.mkDerivation rec {
     patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       --set-rpath "${atomEnv.libPath}" \
       $out/share/atom/resources/app/apm/bin/node
+
     patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       $out/share/atom/resources/app.asar.unpacked/node_modules/symbols-view/vendor/ctags-linux
+
+    find $out/share/atom -name "*.node" -exec patchelf --set-rpath "${atomEnv.libPath}:$out/share/atom" {} \;
   '';
 
   meta = with stdenv.lib; {

pkgs/applications/editors/atom/env.nix

@@ -9,7 +9,7 @@ let
     fontconfig gdk_pixbuf cairo cups expat libgpgerror alsaLib nspr gconf nss
     xorg.libXrender xorg.libX11 xorg.libXext xorg.libXdamage xorg.libXtst
     xorg.libXcomposite xorg.libXi xorg.libXfixes xorg.libXrandr
-    xorg.libXcursor libcap systemd libnotify
+    xorg.libXcursor xorg.libxkbfile xorg.libXScrnSaver libcap systemd libnotify
   ];
 
   libPathNative = lib.makeLibraryPath packages;

pkgs/applications/editors/emacs/default.nix

@@ -4,7 +4,7 @@
 , alsaLib, cairo, acl, gpm, AppKit, CoreWLAN, Kerberos, GSS, ImageIO
 , withX ? !stdenv.isDarwin
 , withGTK2 ? false, gtk2 ? null
-, withGTK3 ? true, gtk3 ? null
+, withGTK3 ? true, gtk3 ? null, gsettings_desktop_schemas ? null
 , withXwidgets ? false, webkitgtk24x ? null, wrapGAppsHook ? null, glib_networking ? null
 , withCsrc ? true
 , srcRepo ? false, autoconf ? null, automake ? null, texinfo ? null
@@ -57,7 +57,8 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [ pkgconfig ]
-    ++ lib.optionals srcRepo [ autoconf automake texinfo ];
+    ++ lib.optionals srcRepo [ autoconf automake texinfo ]
+    ++ lib.optional (withX && (withGTK3 || withXwidgets)) wrapGAppsHook;
 
   buildInputs =
     [ ncurses gconf libxml2 gnutls alsaLib acl gpm gettext ]
@@ -66,9 +67,9 @@ stdenv.mkDerivation rec {
       [ xlibsWrapper libXaw Xaw3d libXpm libpng libjpeg libungif libtiff librsvg libXft
         imagemagick gconf ]
     ++ lib.optional (withX && withGTK2) gtk2
-    ++ lib.optional (withX && withGTK3) gtk3
+    ++ lib.optionals (withX && withGTK3) [ gtk3 gsettings_desktop_schemas ]
     ++ lib.optional (stdenv.isDarwin && withX) cairo
-    ++ lib.optionals withXwidgets [ webkitgtk24x wrapGAppsHook glib_networking ];
+    ++ lib.optionals (withX && withXwidgets) [ webkitgtk24x glib_networking ];
 
   propagatedBuildInputs = lib.optionals stdenv.isDarwin [ AppKit GSS ImageIO ];
 

pkgs/applications/kde/fetch.sh

@@ -1 +1 @@
-WGET_ARGS=( http://download.kde.org/stable/applications/16.12.2/ -A '*.tar.xz' )
+WGET_ARGS=( http://download.kde.org/stable/applications/16.12.3/ -A '*.tar.xz' )

pkgs/applications/misc/emem/default.nix

@@ -2,23 +2,20 @@
 
 stdenv.mkDerivation rec {
   pname = "emem";
-  version = "0.2.35";
+  version = "0.2.42";
   name = "${pname}-${version}";
 
   inherit jdk;
 
   src = fetchurl {
     url = "https://github.com/ebzzry/${pname}/releases/download/v${version}/${pname}.jar";
-    sha256 = "0y1jwfmqmmff3kh82j07p9j0l2hc7dxhy8vij4lz8wrv6pnxng7f";
+    sha256 = "0zm3sqgbiaj44nkgkjiifxwwyrcjs42nry6zmbg3dnnpd0v82v8j";
   };
 
-  buildInputs = [ ];
-
   phases = [ "buildPhase" "installPhase" ];
 
   buildPhase = ''
-    mkdir -p $out/bin
+    mkdir -p $out/bin $out/share/java
-    mkdir -p $out/share/java
   '';
 
   installPhase = ''

pkgs/applications/misc/pdfpc/default.nix

@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, cmake, makeWrapper, pkgconfig, vala, gtk3, libgee
-, poppler, libpthreadstubs, gstreamer, gst-plugins-base, librsvg }:
+, poppler, libpthreadstubs, gstreamer, gst-plugins-base, librsvg, pcre }:
 
 stdenv.mkDerivation rec {
   name = "${product}-${version}";
@@ -15,7 +15,9 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake pkgconfig vala ];
   buildInputs = [ gstreamer gst-plugins-base gtk3 libgee poppler
-    libpthreadstubs makeWrapper librsvg ];
+    libpthreadstubs makeWrapper librsvg pcre ];
+
+  cmakeFlags = stdenv.lib.optionalString stdenv.isDarwin "-DMOVIES=OFF";
 
   postInstall = ''
     wrapProgram $out/bin/pdfpc \
@@ -27,7 +29,7 @@ stdenv.mkDerivation rec {
     homepage = https://pdfpc.github.io/;
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ pSub ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 
 }

pkgs/applications/misc/qmetro/default.nix

@@ -0,0 +1,32 @@
+{ stdenv, fetchurl, qmake4Hook, unzip, qt4 }:
+
+stdenv.mkDerivation rec {
+  name = "${project}-${version}";
+  project = "qmetro";
+  version = "0.7.1";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/${project}/${name}.zip";
+    sha256 = "1zdj87lzcr43gr2h05g17z31pd22n5kxdwbvx7rx656rmhv0sjq5";
+  };
+
+  nativeBuildInputs = [ qmake4Hook unzip ];
+
+  buildInputs = [ qt4 ];
+
+  postPatch = ''
+    sed -e 's#Exec=/usr/bin/qmetro#Exec=qmetro#' -i rc/qmetro.desktop
+    echo 'LIBS += -lz' >> qmetro.pro
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    homepage = https://sourceforge.net/projects/qmetro/;
+    description = "Worldwide transit maps viewer";
+    license = licenses.gpl3;
+
+    maintainter = with maintainers; [ orivej ];
+    platforms = platforms.unix;
+  };
+}

pkgs/applications/misc/robomongo/default.nix

@@ -24,5 +24,6 @@ stdenv.mkDerivation {
     platforms = stdenv.lib.platforms.linux;
     license = stdenv.lib.licenses.gpl3;
     maintainers = [ stdenv.lib.maintainers.amorsillo ];
+    broken = true;
   };
 }

pkgs/applications/misc/sc-im/default.nix

@@ -1,23 +1,25 @@
-{ stdenv, fetchFromGitHub, yacc, ncurses, libxml2, pkgconfig }:
+{ stdenv, fetchFromGitHub, yacc, ncurses, libxml2, libzip, libxls, pkgconfig }:
 
 stdenv.mkDerivation rec {
-  version = "0.4.0";
+  version = "0.5.0";
   name = "sc-im-${version}";
 
   src = fetchFromGitHub {
     owner = "andmarti1424";
     repo = "sc-im";
     rev = "v${version}";
-    sha256 = "1v1cfmfqs5997bqlirp6p7smc3qrinq8dvsi33sk09r33zkzyar0";
+    sha256 = "1vdn9p9srvdksxznrn65pfigwrd7brlq8bac3pjfqsvf8gjnzq61";
   };
 
-  buildInputs = [ yacc ncurses libxml2 pkgconfig ];
+  buildInputs = [ yacc ncurses libxml2 libzip libxls pkgconfig ];
 
   buildPhase = ''
     cd src
 
-    sed -i "s,prefix=/usr,prefix=$out," Makefile
+    sed -e "\|^prefix  = /usr/local|   s|/usr/local|$out|" \
-    sed -i "s,-I/usr/include/libxml2,-I$libxml2," Makefile
+        -e "\|^#LDLIBS += -lxlsreader| s|^#||            " \
+        -e "\|^#CFLAGS += -DXLS|       s|^#||            " \
+        -i Makefile
 
     make
     export DESTDIR=$out

pkgs/applications/misc/taskjuggler/Gemfile

@@ -0,0 +1,2 @@
+source 'http://rubygems.org'
+gem 'taskjuggler'

pkgs/applications/misc/taskjuggler/Gemfile.lock

@@ -0,0 +1,21 @@
+GEM
+  remote: http://rubygems.org/
+  specs:
+    mail (2.6.3)
+      mime-types (>= 1.16, < 3)
+    mime-types (2.6.1)
+    taskjuggler (3.5.0)
+      mail (>= 2.4.3)
+      term-ansicolor (>= 1.0.7)
+    term-ansicolor (1.3.2)
+      tins (~> 1.0)
+    tins (1.6.0)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  taskjuggler
+
+BUNDLED WITH
+   1.10.5

pkgs/applications/misc/taskjuggler/default.nix

@@ -0,0 +1,15 @@
+{ lib, bundlerEnv, ruby }:
+
+bundlerEnv {
+  name = "taskjuggler-3.5.0";
+
+  inherit ruby;
+  gemdir = ./.;
+
+  meta = {
+    description = "A modern and powerful project management tool";
+    homepage    = http://taskjuggler.org/;
+    license     = lib.licenses.gpl2;
+    platforms   = lib.platforms.unix;
+  };
+}

pkgs/applications/misc/taskjuggler/gemset.nix

@@ -0,0 +1,47 @@
+{
+  "mail" = {
+    version = "2.6.3";
+    source = {
+      type = "gem";
+      sha256 = "1nbg60h3cpnys45h7zydxwrl200p7ksvmrbxnwwbpaaf9vnf3znp";
+    };
+    dependencies = [
+      "mime-types"
+    ];
+  };
+  "mime-types" = {
+    version = "2.6.1";
+    source = {
+      type = "gem";
+      sha256 = "1vnrvf245ijfyxzjbj9dr6i1hkjbyrh4yj88865wv9bs75axc5jv";
+    };
+  };
+  "taskjuggler" = {
+    version = "3.5.0";
+    source = {
+      type = "gem";
+      sha256 = "0r84rlc7a6w7p9nc9mgycbs5h0hq0kzscjq7zj3296xyf0afiwj2";
+    };
+    dependencies = [
+      "mail"
+      "term-ansicolor"
+    ];
+  };
+  "term-ansicolor" = {
+    version = "1.3.2";
+    source = {
+      type = "gem";
+      sha256 = "0ydbbyjmk5p7fsi55ffnkq79jnfqx65c3nj8d9rpgl6sw85ahyys";
+    };
+    dependencies = [
+      "tins"
+    ];
+  };
+  "tins" = {
+    version = "1.6.0";
+    source = {
+      type = "gem";
+      sha256 = "02qarvy17nbwvslfgqam8y6y7479cwmb1a6di9z18hzka4cf90hz";
+    };
+  };
+}

pkgs/applications/misc/timewarrior/default.nix

@@ -13,11 +13,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  installPhase = ''
+  patches = [ ./install-all-themes.patch ];
-    mkdir -p $out/{bin,share/man/man1}
-    cp -rv doc/man/*.1 $out/share/man/man1
-    cp src/timew $out/bin/
-  '';
 
   meta = with stdenv.lib; {
     description = "A command-line time tracker";

pkgs/applications/misc/timewarrior/install-all-themes.patch

@@ -0,0 +1,27 @@
+From e4a14c61bff3a55de42718dc11b282c4d5342995 Mon Sep 17 00:00:00 2001
+From: Will Dietz <w@wdtz.org>
+Date: Tue, 14 Mar 2017 07:51:02 -0500
+Subject: [PATCH] doc/themes: install all themes, not just 'dark.theme'.
+
+---
+ doc/themes/CMakeLists.txt | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/doc/themes/CMakeLists.txt b/doc/themes/CMakeLists.txt
+index a954576..3a3b453 100644
+--- a/doc/themes/CMakeLists.txt
++++ b/doc/themes/CMakeLists.txt
+@@ -2,5 +2,8 @@ cmake_minimum_required (VERSION 2.8)
+ 
+ message ("-- Configuring theme documentation")
+ 
+-install (FILES README     DESTINATION ${TIMEW_DOCDIR}/doc/themes)
+-install (FILES dark.theme DESTINATION ${TIMEW_DOCDIR}/doc/themes)
++install (FILES README           DESTINATION ${TIMEW_DOCDIR}/doc/themes)
++install (FILES dark.theme       DESTINATION ${TIMEW_DOCDIR}/doc/themes)
++install (FILES dark_blue.theme  DESTINATION ${TIMEW_DOCDIR}/doc/themes)
++install (FILES dark_green.theme DESTINATION ${TIMEW_DOCDIR}/doc/themes)
++install (FILES dark_red.theme   DESTINATION ${TIMEW_DOCDIR}/doc/themes)
+-- 
+2.12.0
+

pkgs/applications/misc/xastir/default.nix

@@ -0,0 +1,37 @@
+{ stdenv, fetchFromGitHub, autoreconfHook
+, curl, db, gdal, libgeotiff
+, libXpm, libXt, motif, pcre
+, perl, proj, rastermagick, shapelib
+}:
+
+let
+  version = "208";
+in
+stdenv.mkDerivation {
+  name = "xastir-"+version;
+
+  src = fetchFromGitHub {
+    owner = "Xastir";
+    repo = "Xastir";
+    rev = "707f3aa8c7ca3e3fecd32d5a4af3f742437e5dce";
+    sha256 = "1mm22vn3hws7dmg9wpaj4s0zkzb77i3aqa2ay3q6kqjkdhv25brl";
+  };
+
+  buildInputs =
+    [ autoreconfHook
+      curl db gdal libgeotiff
+      libXpm libXt motif pcre
+      perl proj rastermagick shapelib
+    ];
+
+  configureFlags =
+    [ "--with-motif-includes=${motif}/include" ];
+
+  meta = with stdenv.lib; {
+    description = "Graphical APRS client";
+    homepage = https://xastir.org;
+    license = licenses.gpl2;
+    maintainers = [ maintainers.ehmry ];
+    platforms   = platforms.linux;
+  };
+}

pkgs/applications/networking/browsers/chromium/plugins.nix

@@ -94,12 +94,12 @@ let
 
   flash = stdenv.mkDerivation rec {
     name = "flashplayer-ppapi-${version}";
-    version = "24.0.0.221";
+    version = "25.0.0.127";
 
     src = fetchzip {
       url = "https://fpdownload.adobe.com/pub/flashplayer/pdc/"
           + "${version}/flash_player_ppapi_linux.x86_64.tar.gz";
-      sha256 = "0vqvb098wms9v2r1xm9yq4cpn1h9dr1y7izfy2rwg3y7gr8ycv80";
+      sha256 = "1gf0ncclkk3h4vj9kkhbqj1nnnm54gwm5mdcs4p4pl8i339scs14";
       stripRoot = false;
     };
 

pkgs/applications/networking/browsers/firefox/default.nix

@@ -152,8 +152,8 @@ in {
 
   firefox-unwrapped = common {
     pname = "firefox";
-    version = "52.0";
+    version = "52.0.1";
-    sha512 = "bffe5fd9eee240f252bf8a882c46f04551d21f6f58b8da68779cd106ed012ea77ee16bc287c847f8a7b959203c79f1b1d3f50151111f9610e1ca7a57c7b811f7";
+    sha512 = "535e2cc0ee645d4ebe9f1d2d1f4fbb16ff5d1745ce493add6b2e323ca3b0907c3054705c5a15eaadb314d5d6474ba1825554fd1ff0780ab7f76fd3f9672a6974";
     updateScript = import ./update.nix {
       attrPath = "firefox-unwrapped";
       inherit writeScript lib common-updater-scripts xidel coreutils gnused gnugrep curl;
@@ -162,8 +162,8 @@ in {
 
   firefox-esr-unwrapped = common {
     pname = "firefox-esr";
-    version = "52.0esr";
+    version = "52.0.1esr";
-    sha512 = "7e191c37af98163131cbba4dcc820a4edc0913d81c3b2493d9aad0a2886e7aed41a990fa5281ccfb08566ecfdfd7df7353063a01ad92d2ec6e1ce19d277b6e67";
+    sha512 = "c1f0aea279254e7788f62bba7892840edd2b667f385a649d374c9e783b93ec7faf9e5ebfccd04cd94f46da37aeb6bd7785d17faca2ad441a0b6e8587917faab2";
     updateScript = import ./update.nix {
       attrPath = "firefox-esr-unwrapped";
       versionSuffix = "esr";

pkgs/applications/networking/cluster/nomad/default.nix

@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "nomad-${version}";
-  version = "0.5.4";
+  version = "0.5.5";
   rev = "v${version}";
 
   goPackagePath = "github.com/hashicorp/nomad";
@@ -12,7 +12,7 @@ buildGoPackage rec {
     owner = "hashicorp";
     repo = "nomad";
     inherit rev;
-    sha256 = "0x7bi6wq7kpqv3wfhk5mqikj4hsb0f6lx867xz5l9cq3i39b5gj3";
+    sha256 = "17xq88ymm77b6y27l4v49i9hm6yjyrk61rdb2v7nvn8fa4bn6b65";
   };
 
   meta = with stdenv.lib; {

pkgs/applications/networking/cluster/terraform/default.nix

@@ -1,34 +1,59 @@
 { stdenv, lib, buildGoPackage, fetchFromGitHub }:
 
-buildGoPackage rec {
+let
-  name = "terraform-${version}";
+  generic = { version, sha256 }:
-  version = "0.8.8";
+  buildGoPackage rec {
+    name = "terraform-${version}";
 
-  goPackagePath = "github.com/hashicorp/terraform";
+    goPackagePath = "github.com/hashicorp/terraform";
 
-  src = fetchFromGitHub {
+    src = fetchFromGitHub {
-    owner  = "hashicorp";
+      owner  = "hashicorp";
-    repo   = "terraform";
+      repo   = "terraform";
-    rev    = "v${version}";
+      rev    = "v${version}";
+      inherit sha256;
+    };
+
+    postInstall = ''
+      # remove all plugins, they are part of the main binary now
+      for i in $bin/bin/*; do
+        if [[ $(basename $i) != terraform ]]; then
+          rm "$i"
+        fi
+      done
+    '';
+
+    preCheck = ''
+      export HOME=$TMP
+    '';
+
+    doCheck = true;
+
+    meta = with stdenv.lib; {
+      description = "Tool for building, changing, and versioning infrastructure";
+      homepage = https://www.terraform.io/;
+      license = licenses.mpl20;
+      maintainers = with maintainers; [ jgeerds zimbatm peterhoeg ];
+    };
+  };
+
+in rec {
+  terraform_0_8_5 = generic {
+    version = "0.8.5";
+    sha256 = "1cxwv3652fpsbm2zk1akw356cd7w7vhny1623ighgbz9ha8gvg09";
+  };
+
+  terraform_0_8_8 = generic {
+    version = "0.8.8";
     sha256 = "0ibgpcpvz0bmn3cw60nzsabsrxrbmmym1hv7fx6zmjxiwd68w5gb";
   };
 
-  postInstall = ''
+  terraform_0_9_0 = generic {
-    # remove all plugins, they are part of the main binary now
+    version = "0.9.0";
-    for i in $bin/bin/*; do
+    sha256 = "1v96qgc6pd1bkwvkz855625xdcy7xb5lk60lg70144idqmwfjb9g";
-      if [[ $(basename $i) != terraform ]]; then
-        rm "$i"
-      fi
-    done
-  '';
-
-  meta = with stdenv.lib; {
-    description = "Tool for building, changing, and versioning infrastructure";
-    homepage = "https://www.terraform.io/";
-    license = licenses.mpl20;
-    maintainers = with maintainers; [
-      jgeerds
-      zimbatm
-    ];
   };
+
+  terraform_0_8 = terraform_0_8_8;
+  terraform_0_9 = terraform_0_9_0;
+  terraform = terraform_0_9;
 }

pkgs/applications/networking/mpop/default.nix

@@ -1,24 +1,27 @@
 { stdenv, fetchurl, openssl, pkgconfig, gnutls, gsasl, libidn, Security }:
 
+with stdenv.lib;
+
 stdenv.mkDerivation rec {
-  version = "1.2.4";
+  version = "1.2.6";
   name = "mpop-${version}";
 
   src = fetchurl {
     url = "mirror://sourceforge/mpop/${name}.tar.xz";
-    sha256 = "158zl6clxrl2id4kvdig2lvdvm0vg2byqcgn1dnxfjg5mw16ngwk";
+    sha256 = "0p1ix63jh64dibrlccch8q7gxl9nn18wd2qpyr5z1h4gs2fpmv4z";
   };
 
-  buildInputs = [ openssl pkgconfig gnutls gsasl libidn ]
+  nativeBuildInputs = [ pkgconfig ];
-    ++ stdenv.lib.optional stdenv.isDarwin Security;
+  buildInputs = [ openssl gnutls gsasl libidn ]
+    ++ optional stdenv.isDarwin Security;
 
   configureFlags =
-    stdenv.lib.optional stdenv.isDarwin [ "--with-macosx-keyring" ];
+    optional stdenv.isDarwin [ "--with-macosx-keyring" ];
 
   meta = {
       description = "POP3 mail retrieval agent";
-      homepage = "http://mpop.sourceforge.net/";
+      homepage = http://mpop.sourceforge.net/;
-      license = stdenv.lib.licenses.gpl3Plus;
+      license = licenses.gpl3Plus;
-      platforms = stdenv.lib.platforms.unix;
+      platforms = platforms.unix;
     };
 }

pkgs/applications/networking/remote/citrix-receiver/default.nix

@@ -41,10 +41,12 @@ stdenv.mkDerivation rec {
 
       ${homepage}
 
+      (if you do not find version ${version} there, try https://www.citrix.com/downloads/citrix-receiver/)
+
       Once you have downloaded the file, please use the following command and re-run the
       installation:
 
-      nix-prefetch-url file://${name}
+      nix-prefetch-url file://$PWD/${name}
     '';
   };
 

pkgs/applications/networking/sniffers/wireshark/default.nix

@@ -1,7 +1,7 @@
 { stdenv, lib, fetchurl, pkgconfig, pcre, perl, flex, bison, gettext, libpcap, libnl, c-ares
 , gnutls, libgcrypt, libgpgerror, geoip, openssl, lua5, makeDesktopItem, python, libcap, glib
 , libssh, zlib, cmake, extra-cmake-modules
-, withGtk ? false, gtk3 ? null, pango ? null, cairo ? null, gdk_pixbuf ? null
+, withGtk ? false, gtk3 ? null, librsvg ? null, gsettings_desktop_schemas ? null, wrapGAppsHook ? null
 , withQt ? false, qt5 ? null
 , ApplicationServices, SystemConfiguration, gmp
 }:
@@ -23,11 +23,15 @@ in stdenv.mkDerivation {
     sha256 = "049r5962yrajhhz9r4dsnx403dab50d6091y2mw298ymxqszp9s2";
   };
 
+  nativeBuildInputs = [
+    bison cmake extra-cmake-modules flex
+  ] ++ optional withGtk wrapGAppsHook;
+
   buildInputs = [
-    bison cmake extra-cmake-modules flex gettext pcre perl pkgconfig libpcap lua5 libssh openssl libgcrypt libgpgerror gnutls
+    gettext pcre perl pkgconfig libpcap lua5 libssh openssl libgcrypt
-    geoip c-ares python glib zlib
+    libgpgerror gnutls geoip c-ares python glib zlib
-  ] ++ (optionals withQt  (with qt5; [ qtbase qtmultimedia qtsvg qttools ]))
+  ] ++ optionals withQt  (with qt5; [ qtbase qtmultimedia qtsvg qttools ])
-    ++ (optionals withGtk [ gtk3 pango cairo gdk_pixbuf ])
+    ++ optionals withGtk [ gtk3 librsvg gsettings_desktop_schemas ]
     ++ optionals stdenv.isLinux  [ libcap libnl ]
     ++ optionals stdenv.isDarwin [ SystemConfiguration ApplicationServices gmp ];
 

pkgs/applications/networking/znc/default.nix

@@ -9,14 +9,16 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "znc-${version}";
-  version = "1.6.4";
+  version = "1.6.5";
 
   src = fetchurl {
-    url = "http://znc.in/releases/${name}.tar.gz";
+    url = "http://znc.in/releases/archive/${name}.tar.gz";
-    sha256 = "070d6b1i3jy66m4ci4ypxkg4pbwqbzbzss1y1ycgq2w62zmrf423";
+    sha256 = "1jia6kq6bp8yxfj02d5vj9vqb4pylqcldspyjj6iz82kkka2a0ig";
   };
 
-  buildInputs = [ openssl pkgconfig ]
+  nativeBuildInputs = [ pkgconfig ];
+
+  buildInputs = [ openssl ]
     ++ optional withPerl perl
     ++ optional withPython python3
     ++ optional withTcl tcl

pkgs/applications/version-management/gitkraken/default.nix

@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   name = "gitkraken-${version}";
-  version = "2.1.0";
+  version = "2.2.0";
 
   src = fetchurl {
     url = "https://release.gitkraken.com/linux/v${version}.tar.gz";
-    sha256 = "56b5657f5c13fa1d8f6b7b9331194cbc8c48c0b913e5f0fb561d0e9af82f7999";
+    sha256 = "0a3ed917e6e937af4dd180144fbb4ad8b99b35b5d8c1f0684a55de38189a812d";
   };
 
   libPath = stdenv.lib.makeLibraryPath [
@@ -69,6 +69,6 @@ stdenv.mkDerivation rec {
     description = "The downright luxurious and most popular Git client for Windows, Mac & Linux";
     license = licenses.unfree;
     platforms = platforms.linux;
-    maintainers = [ ];
+    maintainers = with maintainers; [ xnwdd ];
   };
 }

pkgs/applications/virtualization/docker/default.nix

@@ -11,14 +11,14 @@ with lib;
 
 stdenv.mkDerivation rec {
   name = "docker-${version}";
-  version = "1.13.1";
+  version = "17.03.0-ce";
-  rev = "092cba3"; # should match the version commit
+  rev = "60ccb22"; # should match the version commit
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "docker";
     rev = "v${version}";
-    sha256 = "0l9kjibnpwcgk844sibxk9ppyqniw9r0np1mzp95f8f461jb0iar";
+    sha256 = "0ml9aan8x4w8kfz7dm9vvl8b1a0vq09si9b7z50xz84040cjhnr9";
   };
 
   docker-runc = runc.overrideAttrs (oldAttrs: rec {
@@ -26,8 +26,8 @@ stdenv.mkDerivation rec {
     src = fetchFromGitHub {
       owner = "docker";
       repo = "runc";
-      rev = "9df8b306d01f59d3a8029be411de015b7304dd8f";
+      rev = "a01dafd48bc1c7cc12bdb01206f9fea7dd6feb70";
-      sha256 = "1yvrk1w2409b90gk55k72z7l3jlkj682x4h3b7004mkl9bhscqd9";
+      sha256 = "0n7vr47fhpyxx5vdnp453qp4cq50w4hwgq3ldyj5878d91iir7l1";
     };
     # docker/runc already include these patches / are not applicable
     patches = [];
@@ -37,8 +37,8 @@ stdenv.mkDerivation rec {
     src = fetchFromGitHub {
       owner = "docker";
       repo = "containerd";
-      rev = "aa8187dbd3b7ad67d8e5e3a15115d3eef43a7ed1";
+      rev = "977c511eda0925a723debdc94d09459af49d082a";
-      sha256 = "0vidbsgyn77m98kisrqnbykva0zmk1ljprgqhbfp5lw16ac6qj8c";
+      sha256 = "0hmcj8i70vv3a3bbdawrgi84a442m09x5mpc7fgn8dd3v031lcbc";
     };
   });
   docker-tini = tini.overrideAttrs  (oldAttrs: rec {

pkgs/applications/virtualization/virt-manager/qt.nix

@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   name = "virt-manager-qt-${version}";
-  version = "0.39.60";
+  version = "0.42.67";
 
   src = fetchFromGitHub {
     owner  = "F1ash";
     repo   = "qt-virt-manager";
     rev    = "${version}";
-    sha256 = "010lpw85m5sd613l281y4zxkp5v3k16pgnawskbi1ricsnj4k5mh";
+    sha256 = "0hskaffc84wf8h9qck5xg840jw8x2krfy6cw4hqnq946z9lbyanr";
   };
 
   cmakeFlags = [

pkgs/applications/window-managers/icewm/default.nix

@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   };
 
   preConfigure = ''
-    export cmakeFlags="-DPREFIX=$out"
+    export cmakeFlags="-DPREFIX=$out -DCFGDIR=/etc/icewm"
   '';
 
   meta = {

pkgs/desktops/gnome-3/3.22/apps/evolution/default.nix

@@ -28,7 +28,7 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig wrapGAppsHook ];
 
-  configureFlags = [ "--disable-spamassassin" "--disable-pst-import" "--disable-autoar"
+  configureFlags = [ "--disable-pst-import" "--disable-autoar"
                      "--disable-libcryptui" ];
 
   NIX_CFLAGS_COMPILE = "-I${nss.dev}/include/nss -I${glib.dev}/include/gio-unix-2.0";

pkgs/desktops/gnome-3/3.22/core/libgee/default.nix

@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     description = "Utility library providing GObject-based interfaces and classes for commonly used data structures";
     license = licenses.lgpl21Plus;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     maintainers = gnome3.maintainers;
   };
 }

pkgs/development/compilers/go/1.4.nix

@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, tzdata, iana_etc, libcCross
+{ stdenv, lib, fetchurl, fetchpatch, tzdata, iana_etc, libcCross
 , pkgconfig
 , pcre
 , Security }:
@@ -114,6 +114,13 @@ stdenv.mkDerivation rec {
   patches = [
     ./remove-tools-1.4.patch
     ./creds-test-1.4.patch
+
+    # This test checks for the wrong thing with recent tzdata. It's been fixed in master but the patch
+    # actually works on old versions too.
+    (fetchpatch {
+      url    = "https://github.com/golang/go/commit/91563ced5897faf729a34be7081568efcfedda31.patch";
+      sha256 = "1ny5l3f8a9dpjjrnjnsplb66308a0x13sa0wwr4j6yrkc8j4qxqi";
+    })
   ];
 
   GOOS = if stdenv.isDarwin then "darwin" else "linux";

pkgs/development/compilers/go/1.6.nix

@@ -113,6 +113,13 @@ stdenv.mkDerivation rec {
   patches = [
     ./remove-tools-1.5.patch
     ./creds-test.patch
+
+    # This test checks for the wrong thing with recent tzdata. It's been fixed in master but the patch
+    # actually works on old versions too.
+    (fetchpatch {
+      url    = "https://github.com/golang/go/commit/91563ced5897faf729a34be7081568efcfedda31.patch";
+      sha256 = "1ny5l3f8a9dpjjrnjnsplb66308a0x13sa0wwr4j6yrkc8j4qxqi";
+    })
   ];
 
   GOOS = if stdenv.isDarwin then "darwin" else "linux";

pkgs/development/compilers/go/1.7.nix

@@ -107,6 +107,13 @@ stdenv.mkDerivation rec {
     [ ./remove-tools-1.7.patch
       ./cacert-1.7.patch
       ./creds-test.patch
+
+      # This test checks for the wrong thing with recent tzdata. It's been fixed in master but the patch
+      # actually works on old versions too.
+      (fetchpatch {
+        url    = "https://github.com/golang/go/commit/91563ced5897faf729a34be7081568efcfedda31.patch";
+        sha256 = "1ny5l3f8a9dpjjrnjnsplb66308a0x13sa0wwr4j6yrkc8j4qxqi";
+      })
     ];
 
   SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";

pkgs/development/compilers/go/1.8.nix

@@ -80,11 +80,6 @@ stdenv.mkDerivation rec {
   '' + optionalString stdenv.isLinux ''
     sed -i 's,/usr/share/zoneinfo/,${tzdata}/share/zoneinfo/,' src/time/zoneinfo_unix.go
   '' + optionalString stdenv.isDarwin ''
-
-    # Disabling `format_test.go` because it fails on Darwin for an
-    # unknown reason see: https://github.com/NixOS/nixpkgs/pull/23122#issuecomment-282188727
-    rm src/time/format_test.go
-
     substituteInPlace src/race.bash --replace \
       "sysctl machdep.cpu.extfeatures | grep -qv EM64T" true
     sed -i 's,strings.Contains(.*sysctl.*,true {,' src/cmd/dist/util.go
@@ -115,6 +110,13 @@ stdenv.mkDerivation rec {
       ./cacert-1.8.patch
       ./creds-test.patch
       ./remove-test-pie-1.8.patch
+
+      # This test checks for the wrong thing with recent tzdata. It's been fixed in master but the patch
+      # works fine here for now.
+      (fetchpatch {
+        url    = "https://github.com/golang/go/commit/91563ced5897faf729a34be7081568efcfedda31.patch";
+        sha256 = "1ny5l3f8a9dpjjrnjnsplb66308a0x13sa0wwr4j6yrkc8j4qxqi";
+      })
     ];
 
   SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";

pkgs/development/compilers/openjdk-darwin/8.nix

@@ -1,10 +1,16 @@
 { stdenv, fetchurl, unzip, setJavaClassPath, freetype }:
 let
+  jce-policies = fetchurl {
+    # Ugh, unversioned URLs... I hope this doesn't change often enough to cause pain before we move to a Darwin source build of OpenJDK!
+    url    = "http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
+    sha256 = "0nk7m0lgcbsvldq2wbfni2pzq8h818523z912i7v8hdcij5s48c0";
+  };
+
   jdk = stdenv.mkDerivation {
     name = "zulu1.8.0_66-8.11.0.1";
 
     src = fetchurl {
-      url = http://cdn.azulsystems.com/zulu/bin/zulu1.8.0_66-8.11.0.1-macosx.zip;
+      url = "http://cdn.azulsystems.com/zulu/bin/zulu1.8.0_66-8.11.0.1-macosx.zip";
       sha256 = "0pvbpb3vf0509xm2x1rh0p0w4wmx50zf15604p28z1k8ai1a23sz";
       curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/zulu-linux/";
     };
@@ -15,6 +21,9 @@ let
       mkdir -p $out
       mv * $out
 
+      unzip ${jce-policies}
+      mv -f ZuluJCEPolicies/*.jar $out/jre/lib/security/
+
       # jni.h expects jni_md.h to be in the header search path.
       ln -s $out/include/darwin/*_md.h $out/include/
     '';

pkgs/development/compilers/ponyc/default.nix

@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation ( rec {
   name = "ponyc-${version}";
-  version = "0.11.0";
+  version = "0.11.3";
 
   src = fetchFromGitHub {
     owner = "ponylang";
     repo = "ponyc";
     rev = version;
-    sha256 = "0jjzc1711km53zkkxwy4r9ki9yxdx8mdjrp7g3mkr42p7q5h4w70";
+    sha256 = "08wh8rh17bf043glvn7778bwpxyzpm95kgfll645hf2m65n5ncsh";
   };
 
   buildInputs = [ llvm makeWrapper which ];

pkgs/development/compilers/ponyc/pony-stable.nix

@@ -1,13 +1,13 @@
 {stdenv, fetchFromGitHub, ponyc }:
 
 stdenv.mkDerivation {
-  name = "pony-stable-2016-10-10";
+  name = "pony-stable-unstable-2017-01-03";
 
   src = fetchFromGitHub {
     owner = "jemc";
     repo = "pony-stable";
-    rev = "fdefa26fed93f4ff81c323f29abd47813c515703";
+    rev = "0054b429a54818d187100ed40f5525ec7931b31b";
-    sha256 = "16inavy697icgryyvn9gcylgh639xxs7lnbrqdzcryvh0ck15qxk";
+    sha256 = "0libx8byzwqjjgxxyiiahiprzzp845xgbk09sx9bzban5cd5j0g5";
   };
 
   buildInputs = [ ponyc ];

pkgs/development/compilers/rust/nightlyBin.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, makeWrapper, cacert, zlib, buildRustPackage }:
+{ stdenv, fetchurl, makeWrapper, cacert, zlib, buildRustPackage, curl }:
 
 let
   inherit (stdenv.lib) optionalString;
@@ -9,7 +9,7 @@ let
 
   bootstrapHash =
     if stdenv.system == "x86_64-linux"
-    then "1v7jvwigb29m15wilzcrk5jmlpaccpzbkhlzf7z5qw08320gvc91"
+    then "1d5h34dkm1r1ff562szygn9xk2qll1pjryvypl0lazzanxdh5gv5"
     else throw "missing bootstrap hash for platform ${stdenv.system}";
 
   needsPatchelf = stdenv.isLinux;
@@ -19,7 +19,7 @@ let
      sha256 = bootstrapHash;
   };
 
-  version = "2017-01-26";
+  version = "2017-03-16";
 in
 
 rec {
@@ -69,7 +69,7 @@ rec {
       license = [ licenses.mit licenses.asl20 ];
     };
 
-    buildInputs = [ makeWrapper ];
+    buildInputs = [ makeWrapper curl ];
     phases = ["unpackPhase" "installPhase"];
 
     installPhase = ''
@@ -78,6 +78,7 @@ rec {
 
       ${optionalString needsPatchelf ''
         patchelf \
+          --set-rpath "${stdenv.lib.makeLibraryPath [ curl zlib ]}" \
           --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
           "$out/bin/cargo"
       ''}