From 0cb623c3d996638c548c8622c7df96d2cb4d1b05 Mon Sep 17 00:00:00 2001
From: Dan Peebles <pumpkin@me.com>
Date: Mon, 15 Aug 2016 10:27:39 -0400
Subject: [PATCH 001/161] fetchurl: add user agent

It would be nice to be able to track Nix requests. It's not trustworthy,
but can be helpful for stats and routing in HTTP logs.

Since `fetchurl` is used so widely, we should "magically" get a UA on
`fetchzip`, `fetchFromGitHub`, and other related fetchers.

Since `fetchurl` is only used for fixed-output derivations, this should
cause no mass rebuild.

User-Agent example: curl/7.57.0 Nixpkgs/18.03
---
 pkgs/build-support/fetchurl/builder.sh  | 25 ++++++++++++++-----------
 pkgs/build-support/fetchurl/default.nix |  4 +++-
 2 files changed, 17 insertions(+), 12 deletions(-)

diff --git a/pkgs/build-support/fetchurl/builder.sh b/pkgs/build-support/fetchurl/builder.sh
index 7c2bdf260b4..530864742f6 100644
--- a/pkgs/build-support/fetchurl/builder.sh
+++ b/pkgs/build-support/fetchurl/builder.sh
@@ -2,20 +2,23 @@ source $stdenv/setup
 
 source $mirrorsFile
 
+curlVersion=$(curl -V | head -1 | cut -d' ' -f2)
 
 # Curl flags to handle redirects, not use EPSV, handle cookies for
 # servers to need them during redirects, and work on SSL without a
 # certificate (this isn't a security problem because we check the
 # cryptographic hash of the output anyway).
-curl="curl \
- --location --max-redirs 20 \
- --retry 3 \
- --disable-epsv \
- --cookie-jar cookies \
- --insecure \
- $curlOpts \
- $NIX_CURL_FLAGS"
-
+curl=(
+    curl
+    --location
+    --max-redirs 20
+    --disable-epsv
+    --cookie-jar cookies
+    --insecure
+    --user-agent "curl/$curlVersion Nixpkgs/$nixpkgsVersion"
+    $curlOpts
+    $NIX_CURL_FLAGS
+)
 
 downloadedFile="$out"
 if [ -n "$downloadToTemp" ]; then downloadedFile="$TMPDIR/file"; fi
@@ -32,7 +35,7 @@ tryDownload() {
     # if we get error code 18, resume partial download
     while [ $curlexit -eq 18 ]; do
        # keep this inside an if statement, since on failure it doesn't abort the script
-       if $curl -C - --fail "$url" --output "$downloadedFile"; then
+       if "${curl[@]}" -C - --fail "$url" --output "$downloadedFile"; then
           success=1
           break
        else
@@ -61,7 +64,7 @@ tryHashedMirrors() {
 
     for mirror in $hashedMirrors; do
         url="$mirror/$outputHashAlgo/$outputHash"
-        if $curl --retry 0 --connect-timeout "${NIX_CONNECT_TIMEOUT:-15}" \
+        if "${curl[@]}" --retry 0 --connect-timeout "${NIX_CONNECT_TIMEOUT:-15}" \
             --fail --silent --show-error --head "$url" \
             --write-out "%{http_code}" --output /dev/null > code 2> log; then
             tryDownload "$url"
diff --git a/pkgs/build-support/fetchurl/default.nix b/pkgs/build-support/fetchurl/default.nix
index 8dac273eb1c..9ab3494b2b0 100644
--- a/pkgs/build-support/fetchurl/default.nix
+++ b/pkgs/build-support/fetchurl/default.nix
@@ -95,7 +95,7 @@ assert sha512 != "" -> builtins.compareVersions "1.11" builtins.nixVersion <= 0;
 
 
 let
-
+  inherit (stdenv.lib) fileContents;
   hasHash = showURLs || (outputHash != "" && outputHashAlgo != "")
     || sha1 != "" || sha256 != "" || sha512 != "";
   urls_ = if urls != [] then urls else [url];
@@ -132,6 +132,8 @@ else stdenv.mkDerivation {
 
   impureEnvVars = impureEnvVars ++ netrcImpureEnvVars;
 
+  nixpkgsVersion = fileContents ../../../.version;
+
   # Doing the download on a remote machine just duplicates network
   # traffic, so don't do that.
   preferLocalBuild = true;

From 1441806c27f3775db580360e072ead2afbe00ae9 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Thu, 7 Dec 2017 20:30:45 +0100
Subject: [PATCH 002/161] nixpkgs: add nixos function

---
 nixos/doc/manual/release-notes/rl-1809.xml | 14 +++++++
 pkgs/top-level/all-packages.nix            | 46 ++++++++++++++++++++++
 2 files changed, 60 insertions(+)

diff --git a/nixos/doc/manual/release-notes/rl-1809.xml b/nixos/doc/manual/release-notes/rl-1809.xml
index 61f9ec8ba99..29abea1afd6 100644
--- a/nixos/doc/manual/release-notes/rl-1809.xml
+++ b/nixos/doc/manual/release-notes/rl-1809.xml
@@ -77,6 +77,20 @@ following incompatible changes:</para>
 <itemizedlist>
   <listitem>
     <para>
+      The <literal>pkgs</literal> argument to NixOS modules can now be set directly using <literal>nixpkgs.pkgs</literal>. Previously, only the <literal>system</literal>, <literal>config</literal> and <literal>overlays</literal> arguments could be used to influence <literal>pkgs</literal>.
+    </para>
+  </listitem>
+  <listitem>
+    <para>
+      A NixOS system can now be constructed more easily based on a preexisting invocation of Nixpkgs. For example:
+      <programlisting>
+inherit (pkgs.nixos {
+  boot.loader.grub.enable = false;
+  fileSystems."/".device = "/dev/xvda1";
+}) toplevel kernel initialRamdisk manual;
+      </programlisting>
+
+      This benefits evaluation performance, lets you write Nixpkgs packages that depend on NixOS images and is consistent with a deployment architecture that would be centered around Nixpkgs overlays.
     </para>
   </listitem>
 </itemizedlist>
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 86500ece461..1a4fa144708 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -20690,6 +20690,52 @@ with pkgs;
 
   nixops-dns = callPackage ../tools/package-management/nixops/nixops-dns.nix { };
 
+  /*
+   * Evaluate a NixOS configuration using this evaluation of Nixpkgs.
+   *
+   * With this function you can write, for example, a package that
+   * depends on a custom virtual machine image.
+   *
+   * Parameter: A module, path or list of those that represent the
+   *            configuration of the NixOS system to be constructed.
+   *
+   * Result:    An attribute set containing packages produced by this
+   *            evaluation of NixOS, such as toplevel, kernel and
+   *            initialRamdisk.
+   *            The result can be extended in the modules by defining
+   *            extra options in system.build.
+   *
+   * Unlike in plain NixOS, the nixpkgs.config, nixpkgs.overlays and
+   * nixpkgs.system options will be ignored by default. Instead,
+   * nixpkgs.pkgs will have the default value of pkgs as it was
+   * constructed right after invoking the nixpkgs function (e.g. the
+   * value of import <nixpkgs> { overlays = [./my-overlay.nix]; }
+   * but not the value of (import <nixpkgs> {} // { extra = ...; }).
+   *
+   * If you do want to use the config.nixpkgs options, you are
+   * probably better off by calling nixos/lib/eval-config.nix
+   * directly, even though it is possible to set config.nixpkgs.pkgs.
+   *
+   * For more information about writing NixOS modules, see
+   * https://nixos.org/nixos/manual/index.html#sec-writing-modules
+   *
+   * Note that you will need to have called Nixpkgs with the system
+   * parameter set to the right value for your deployment target.
+   */
+  nixos = configuration:
+    (import (self.path + "/nixos/lib/eval-config.nix") {
+      inherit (pkgs) system;
+      modules = [(
+                  { lib, ... }: {
+                    config.nixpkgs.pkgs = lib.mkDefault pkgs;
+                  }
+                )] ++ (
+                  if builtins.isList configuration
+                  then configuration
+                  else [configuration]
+                );
+    }).config.system.build;
+
   nixui = callPackage ../tools/package-management/nixui { node_webkit = nwjs_0_12; };
 
   nix-bundle = callPackage ../tools/package-management/nix-bundle { };

From 789c0614f06e0ea98193e20fa726e87554cd8e88 Mon Sep 17 00:00:00 2001
From: Izorkin <Izorkin@gmail.com>
Date: Fri, 29 Dec 2017 20:28:53 +0300
Subject: [PATCH 003/161] mariadb galera: init at 25.3.23

---
 pkgs/servers/sql/mariadb/default.nix | 57 ++++++++++++++++++++++++++++
 1 file changed, 57 insertions(+)

diff --git a/pkgs/servers/sql/mariadb/default.nix b/pkgs/servers/sql/mariadb/default.nix
index 66125b35378..19154bd655e 100644
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@@ -2,6 +2,7 @@
 , openssl, pcre, boost, judy, bison, libxml2
 , libaio, libevent, groff, jemalloc, cracklib, systemd, numactl, perl
 , fixDarwinDylibNames, cctools, CoreServices
+, asio, buildEnv, check, qt4, scons
 }:
 
 with stdenv.lib;
@@ -12,6 +13,12 @@ mariadb = everything // {
   inherit client; # libmysqlclient.so in .out, necessary headers in .dev and utils in .bin
   server = everything; # a full single-output build, including everything in `client` again
   inherit connector-c; # libmysqlclient.so
+  inherit galera;
+};
+
+galeraLibs = buildEnv {
+  name = "galera-lib-inputs-united";
+  paths = [ openssl.out boost check ];
 };
 
 common = rec { # attributes common to both builds
@@ -146,6 +153,7 @@ everything = stdenv.mkDerivation (common // {
     "-DWITHOUT_EXAMPLE_STORAGE_ENGINE=1"
     "-DWITHOUT_FEDERATED_STORAGE_ENGINE=1"
     "-DWITH_WSREP=ON"
+    "-DWITH_INNODB_DISALLOW_WRITES=ON"
   ] ++ stdenv.lib.optionals stdenv.isDarwin [
     "-DWITHOUT_OQGRAPH_STORAGE_ENGINE=1"
     "-DWITHOUT_TOKUDB=1"
@@ -155,6 +163,7 @@ everything = stdenv.mkDerivation (common // {
     rm -r "$out"/{mysql-test,sql-bench,data} # Don't need testing data
     rm "$out"/share/man/man1/mysql-test-run.pl.1
     rm "$out"/bin/rcmysql
+    sed -i 's/-mariadb/-mysql/' "$out"/bin/galera_new_cluster
   '';
 
   CXXFLAGS = optionalString stdenv.isi686 "-fpermissive";
@@ -195,4 +204,52 @@ connector-c = stdenv.mkDerivation rec {
   };
 };
 
+galera = stdenv.mkDerivation rec {
+  name = "mariadb-galera-${version}";
+  version = "25.3.23";
+
+  src = fetchurl {
+    url = "https://mirrors.nxthost.com/mariadb/mariadb-10.2.14/galera-${version}/src/galera-${version}.tar.gz";
+    sha256 = "11pfc85z29jk0h6g6bmi3hdv4in4yb00xsr2r0qm1b0y7m2wq3ra";
+  };
+
+  buildInputs = [ asio boost check openssl qt4 scons ];
+
+  patchPhase = ''
+    substituteInPlace SConstruct \
+      --replace "boost_library_path = '''" "boost_library_path = '${boost}/lib'"
+  '';
+
+  preConfigure = ''
+    export CPPFLAGS="-I${asio}/include  -I${boost.dev}/include -I${check}/include -I${openssl.dev}/include"
+    export LIBPATH="${galeraLibs}/lib"
+  '';
+
+  buildPhase = ''
+     scons -j$NIX_BUILD_CORES ssl=1 system_asio=1 strict_build_flags=0
+  '';
+
+  installPhase = ''
+    # copied with modifications from scripts/packages/freebsd.sh
+    GALERA_LICENSE_DIR="$share/licenses/${name}"
+    install -d $out/{bin,lib/galera,share/doc/galera,$GALERA_LICENSE_DIR}
+    install -m 555 "garb/garbd"                       "$out/bin/garbd"
+    install -m 444 "libgalera_smm.so"                 "$out/lib/galera/libgalera_smm.so"
+    install -m 444 "scripts/packages/README"          "$out/share/doc/galera/"
+    install -m 444 "scripts/packages/README-MySQL"    "$out/share/doc/galera/"
+    install -m 444 "scripts/packages/freebsd/LICENSE" "$out/$GALERA_LICENSE_DIR"
+    install -m 444 "LICENSE"                          "$out/$GALERA_LICENSE_DIR/GPLv2"
+    install -m 444 "asio/LICENSE_1_0.txt"             "$out/$GALERA_LICENSE_DIR/LICENSE.asio"
+    install -m 444 "www.evanjones.ca/LICENSE"         "$out/$GALERA_LICENSE_DIR/LICENSE.crc32c"
+    install -m 444 "chromium/LICENSE"                 "$out/$GALERA_LICENSE_DIR/LICENSE.chromium"
+  '';
+
+  meta = {
+    description = "Galera 3 wsrep provider library";
+    homepage = http://galeracluster.com/;
+    license = licenses.lgpl2;
+    maintainers = with maintainers; [ izorkin ];
+    platforms = platforms.all;
+  };
+};
 in mariadb

From 50bb7de4686ae16303e5c7ba112033f2b6e2b781 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm+bot@ryantm.com>
Date: Tue, 22 May 2018 18:07:55 -0700
Subject: [PATCH 004/161] whois: 5.3.0 -> 5.3.1

Semi-automatic update generated by https://github.com/ryantm/nixpkgs-update tools.

This update was made based on information from https://repology.org/metapackage/whois/versions.

These checks were done:

- built on NixOS
- /nix/store/zw919iq17c3gjzl1fjqlc36n2r283mj6-whois-5.3.1/bin/whois passed the binary check.
- 1 of 1 passed binary check by having a zero exit code.
- 0 of 1 passed binary check by having the new version present in output.
- found 5.3.1 with grep in /nix/store/zw919iq17c3gjzl1fjqlc36n2r283mj6-whois-5.3.1
- directory tree listing: https://gist.github.com/95d27f7a76376cb86fdd0edd75927295
- du listing: https://gist.github.com/82d0c8264eb9f30e505961c027227041
---
 pkgs/tools/networking/whois/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/networking/whois/default.nix b/pkgs/tools/networking/whois/default.nix
index 4a40c320040..e644578b664 100644
--- a/pkgs/tools/networking/whois/default.nix
+++ b/pkgs/tools/networking/whois/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, perl, gettext, pkgconfig, libidn2, libiconv }:
 
 stdenv.mkDerivation rec {
-  version = "5.3.0";
+  version = "5.3.1";
   name = "whois-${version}";
 
   src = fetchFromGitHub {
     owner = "rfc1036";
     repo = "whois";
     rev = "v${version}";
-    sha256 = "01pfl1ap62hc27574sx1a4yaaf7hr2zkksspn5z97sgacl6h1rnf";
+    sha256 = "1xqvcsh70590bwmy37kwlwyl0rvnlqx987km3mnij93q4kvabg5n";
   };
 
   nativeBuildInputs = [ perl gettext pkgconfig ];

From 786449aa770f89c9db7c80d91375680f2a7e5348 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kristoffer=20Th=C3=B8mt=20Ravneberg?= <ktra@dbc.dk>
Date: Wed, 6 Jun 2018 13:04:35 +0200
Subject: [PATCH 005/161] gitaly: Cause ruby-cd to be wrapped so bundler will
 work

---
 pkgs/applications/version-management/gitaly/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/applications/version-management/gitaly/default.nix b/pkgs/applications/version-management/gitaly/default.nix
index 375e7ad001d..52d46a99118 100644
--- a/pkgs/applications/version-management/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitaly/default.nix
@@ -23,6 +23,8 @@ in buildGoPackage rec {
     inherit rubyEnv;
   };
 
+  buildInputs = [rubyEnv.wrappedRuby];
+
   postInstall = ''
     mkdir -p $ruby
     cp -rv $src/ruby/{bin,lib,vendor} $ruby

From 95ee1bc937c3813a7d1dfed7730b44fae5df6ca4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bastian=20K=C3=B6cher?= <git@kchr.de>
Date: Wed, 6 Jun 2018 20:21:22 +0200
Subject: [PATCH 006/161] nvidia_x11: 390.48 -> 390.67

---
 pkgs/os-specific/linux/nvidia-x11/default.nix | 12 +++++-------
 .../linux/nvidia-x11/fix_missing_symbol.patch | 19 -------------------
 2 files changed, 5 insertions(+), 26 deletions(-)
 delete mode 100644 pkgs/os-specific/linux/nvidia-x11/fix_missing_symbol.patch

diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index 11a97d420a8..8eeaf502020 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -17,13 +17,11 @@ in
 rec {
   # Policy: use the highest stable version as the default (on our master).
   stable = generic {
-    version = "390.48";
-    sha256_32bit = "1y6n2hfz9vd0h7gd31fgxcl76s5pjf8afwqyq5slqpcxpd78j5ai";
-    sha256_64bit = "16a3blvizcksmaxr644s857yanw3i3vcvqvn7qnwbsbqpmxga09c";
-    settingsSha256 = "058xaiw5g0kxrvc3lvy4424fqbjkvmsznj2v73cgbm25i1m83krl";
-    persistencedSha256 = "0y86bhzl42lqyrbibqzf8a8yd49zbq3ryb78vgsl13i44f9sl79k";
-
-    patches = [ ./fix_missing_symbol.patch ];
+    version = "390.67";
+    sha256_32bit = "01c8fa80njyyr39c1pyf7ssmfq65ci8mapbs94fd6gnhwc7gfjkg";
+    sha256_64bit = "0np6xj93fali2hss8xsdlmy5ykjgn4hx6mzjr8dpbdi0fhdcmwkd";
+    settingsSha256 = "1wk4587czysnbj5yxijmv3bldcffzwp4yvfx133apsr31dqca0s7";
+    persistencedSha256 = "1zia1r97lyj6fbmvsw4hv5qfcj84x3sz971m4430d8qyks2c4sdw";
   };
 
   beta = stable; # not enough interest to maintain beta ATM
diff --git a/pkgs/os-specific/linux/nvidia-x11/fix_missing_symbol.patch b/pkgs/os-specific/linux/nvidia-x11/fix_missing_symbol.patch
deleted file mode 100644
index ea783b4f011..00000000000
--- a/pkgs/os-specific/linux/nvidia-x11/fix_missing_symbol.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-https://devtalk.nvidia.com/default/topic/1030082/linux/kernel-4-16-rc1-breaks-latest-drivers-unknown-symbol-swiotlb_map_sg_attrs-/
---- a/kernel/common/inc/nv-linux.h~     2018-01-25 06:09:41.000000000 +0100
-+++ b/kernel/common/inc/nv-linux.h      2018-03-05 13:58:17.746725638 +0100
-@@ -1209,6 +1209,7 @@ static inline NvU32 nv_alloc_init_flags(
- static inline NvBool nv_dma_maps_swiotlb(struct pci_dev *dev)
- {
-     NvBool swiotlb_in_use = NV_FALSE;
-+#if 0
- #if defined(CONFIG_SWIOTLB)
-   #if defined(NV_DMA_OPS_PRESENT) || defined(NV_GET_DMA_OPS_PRESENT)
-     /*
-@@ -1251,7 +1252,7 @@ static inline NvBool nv_dma_maps_swiotlb
-     swiotlb_in_use = (swiotlb == 1);
-   #endif
- #endif
--
-+#endif
-     return swiotlb_in_use;
- }

From 8195e37c14b1c40f49604620e1dd58e8dc8d8c84 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm+bot@ryantm.com>
Date: Fri, 8 Jun 2018 02:31:16 -0700
Subject: [PATCH 007/161] ngspice: 27 -> 28

Semi-automatic update generated by https://github.com/ryantm/nixpkgs-update tools.

This update was made based on information from https://repology.org/metapackage/ngspice/versions.

These checks were done:

- built on NixOS
- Warning: no invocation of /nix/store/7mjpw971bh37wil41hin4ssn290wr3ad-ngspice-28/bin/cmpp had a zero exit code or showed the expected version
- /nix/store/7mjpw971bh37wil41hin4ssn290wr3ad-ngspice-28/bin/ngspice passed the binary check.
- 1 of 2 passed binary check by having a zero exit code.
- 0 of 2 passed binary check by having the new version present in output.
- found 28 with grep in /nix/store/7mjpw971bh37wil41hin4ssn290wr3ad-ngspice-28
- directory tree listing: https://gist.github.com/890c9d6d1b1aa9e86b2f4c8ddf86a36d
- du listing: https://gist.github.com/099b236d47fee839749355d18a841493
---
 pkgs/applications/science/electronics/ngspice/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/science/electronics/ngspice/default.nix b/pkgs/applications/science/electronics/ngspice/default.nix
index 96025e8faa6..73e770b63e2 100644
--- a/pkgs/applications/science/electronics/ngspice/default.nix
+++ b/pkgs/applications/science/electronics/ngspice/default.nix
@@ -1,11 +1,11 @@
 {stdenv, fetchurl, readline, bison, flex, libX11, libICE, libXaw, libXext, fftw}:
 
 stdenv.mkDerivation {
-  name = "ngspice-27";
+  name = "ngspice-28";
 
   src = fetchurl {
-    url = "mirror://sourceforge/ngspice/ngspice-27.tar.gz";
-    sha256 = "15862npsy5sj56z5yd1qiv3y0fgicrzj7wwn8hbcy89fgbawf20c";
+    url = "mirror://sourceforge/ngspice/ngspice-28.tar.gz";
+    sha256 = "0rnz2rdgyav16w7wfn3sfrk2lwvvgz1fh0l9107zkcldijklz04l";
   };
 
   nativeBuildInputs = [ flex bison ];

From 943625a62b10d212ab12f80d78386adaa215f30d Mon Sep 17 00:00:00 2001
From: Frank Doepper <github@woffs.de>
Date: Fri, 8 Jun 2018 12:45:15 +0200
Subject: [PATCH 008/161] loadwatch: init at 1.1

---
 pkgs/tools/system/loadwatch/default.nix | 19 +++++++++++++++++++
 pkgs/top-level/all-packages.nix         |  2 ++
 2 files changed, 21 insertions(+)
 create mode 100644 pkgs/tools/system/loadwatch/default.nix

diff --git a/pkgs/tools/system/loadwatch/default.nix b/pkgs/tools/system/loadwatch/default.nix
new file mode 100644
index 00000000000..ea1de93b270
--- /dev/null
+++ b/pkgs/tools/system/loadwatch/default.nix
@@ -0,0 +1,19 @@
+{ stdenv, fetchurl, ... }:
+
+stdenv.mkDerivation {
+  name = "loadwatch-1.1";
+  src = fetchurl {
+    url = "mirror://debian/pool/main/l/loadwatch/loadwatch_1.0+1.1alpha1.orig.tar.gz";
+    sha256 = "1abjl3cy4sa4ivdm7wghv9rq93h8kix4wjbiv7pb906rdqs4881a";
+  };
+  installPhase = ''
+    mkdir -p $out/bin
+    install loadwatch lw-ctl $out/bin
+  '';
+  meta = with stdenv.lib; {
+    description = "Run a program using only idle cycles";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ woffs ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b66a6492345..7f60178c8e6 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1338,6 +1338,8 @@ with pkgs;
 
   languagetool = callPackage ../tools/text/languagetool {  };
 
+  loadwatch = callPackage ../tools/system/loadwatch { };
+
   loccount = callPackage ../development/tools/misc/loccount { };
 
   long-shebang = callPackage ../misc/long-shebang {};

From 2630b1274c78619883622f3a09c972014a5ac17b Mon Sep 17 00:00:00 2001
From: Assassinkin <iuns@outlook.fr>
Date: Fri, 8 Jun 2018 12:28:43 +0100
Subject: [PATCH 009/161] pythonPackages.ansiconv: init at 1.0.0

---
 .../python-modules/ansiconv/default.nix       | 24 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 26 insertions(+)
 create mode 100644 pkgs/development/python-modules/ansiconv/default.nix

diff --git a/pkgs/development/python-modules/ansiconv/default.nix b/pkgs/development/python-modules/ansiconv/default.nix
new file mode 100644
index 00000000000..08f93134b32
--- /dev/null
+++ b/pkgs/development/python-modules/ansiconv/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, buildPythonPackage, fetchFromGitHub, pytest }:
+
+buildPythonPackage rec {
+  pname = "ansiconv";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "ansible";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0ljfpl8x069arzginvpi1v6hlaq4x2qpjqj01qds2ylz33scq8r4";
+  };  
+
+  checkInputs = [ pytest ];
+
+  meta = with stdenv.lib; {
+    description = "A module for converting ANSI coded text and converts it to either plain text or HTML";
+    homepage = https://github.com/ansible/ansiconv;
+    license = licenses.mit;
+    maintainers = with maintainers; [ psyanticy ];
+  };
+
+}
+
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 031746346b9..18fdc2f79b2 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -203,6 +203,8 @@ in {
 
   amazon_kclpy = callPackage ../development/python-modules/amazon_kclpy { };
 
+  ansiconv = callPackage ../development/python-modules/ansiconv { };
+
   backports_csv = callPackage ../development/python-modules/backports_csv {};
 
   bap = callPackage ../development/python-modules/bap {

From 1b6dcf493661bc18f8ffd4b327f73b0d2d91aa8b Mon Sep 17 00:00:00 2001
From: Orivej Desh <orivej@gmx.fr>
Date: Thu, 7 Jun 2018 09:04:45 +0000
Subject: [PATCH 010/161] dwarf-therapist: fix build

Update for dfc4744afd82b2d26a8df71b05ffacf05230af50.
---
 .../dwarf-fortress/dwarf-therapist/default.nix    | 15 ---------------
 .../dwarf-fortress/dwarf-therapist/wrapper.nix    |  4 ++--
 2 files changed, 2 insertions(+), 17 deletions(-)

diff --git a/pkgs/games/dwarf-fortress/dwarf-therapist/default.nix b/pkgs/games/dwarf-fortress/dwarf-therapist/default.nix
index 6d96f98aec9..2e54258c4be 100644
--- a/pkgs/games/dwarf-fortress/dwarf-therapist/default.nix
+++ b/pkgs/games/dwarf-fortress/dwarf-therapist/default.nix
@@ -11,24 +11,9 @@ stdenv.mkDerivation rec {
     sha256 = "0b5y7800nzydn0jcc0vglgi9mzkj8f3qhw16wd872cf5396xnag9";
   };
 
-  outputs = [ "out" "layouts" ];
   buildInputs = [ qtbase qtdeclarative ];
   nativeBuildInputs = [ texlive cmake ninja ];
 
-  configurePhase = ''
-    cmake -GNinja
-  '';
-
-  buildPhase = ''
-    ninja -j$NIX_BUILD_CORES
-  '';
-
-  installPhase = ''
-    mkdir -p $out/bin
-    cp ./DwarfTherapist $out/bin/DwarfTherapist
-    cp -r ./share/memory_layouts $layouts
-  '';
-
   meta = with stdenv.lib; {
     description = "Tool to manage dwarves in in a running game of Dwarf Fortress";
     maintainers = with maintainers; [ the-kenny abbradar bendlas ];
diff --git a/pkgs/games/dwarf-fortress/dwarf-therapist/wrapper.nix b/pkgs/games/dwarf-fortress/dwarf-therapist/wrapper.nix
index 6debf0bb0b2..f9e3e468cdc 100644
--- a/pkgs/games/dwarf-fortress/dwarf-therapist/wrapper.nix
+++ b/pkgs/games/dwarf-fortress/dwarf-therapist/wrapper.nix
@@ -18,7 +18,7 @@ in symlinkJoin {
   postBuild = ''
     # DwarfTherapist assumes it's run in $out/share/dwarftherapist and
     # therefore uses many relative paths.
-    wrapProgram $out/bin/DwarfTherapist \
+    wrapProgram $out/bin/dwarftherapist \
       --run "cd $out/share/dwarftherapist"
 
     rm -rf $out/share/dwarftherapist/memory_layouts/linux
@@ -26,7 +26,7 @@ in symlinkJoin {
     origmd5=$(cat "${dfHashFile}.orig" | cut -c1-8)
     patchedmd5=$(cat "${dfHashFile}" | cut -c1-8)
     substitute \
-      ${dt.layouts}/${inifile} \
+      ${dt}/share/dwarftherapist/memory_layouts/${inifile} \
       $out/share/dwarftherapist/memory_layouts/${inifile} \
       --replace "$origmd5" "$patchedmd5"
   '';

From 48696cf4fea6e9a49f83c4487626f2522babcb0b Mon Sep 17 00:00:00 2001
From: Jean-Philippe Bernardy <jeanphilippe.bernardy@gmail.com>
Date: Fri, 8 Jun 2018 15:13:47 +0200
Subject: [PATCH 011/161] python.packages.astunparse: init at 1.5.0

---
 .../python-modules/astunparse/default.nix       | 17 +++++++++++++++++
 pkgs/top-level/python-packages.nix              |  2 ++
 2 files changed, 19 insertions(+)
 create mode 100644 pkgs/development/python-modules/astunparse/default.nix

diff --git a/pkgs/development/python-modules/astunparse/default.nix b/pkgs/development/python-modules/astunparse/default.nix
new file mode 100644
index 00000000000..4c46f93b547
--- /dev/null
+++ b/pkgs/development/python-modules/astunparse/default.nix
@@ -0,0 +1,17 @@
+{ stdenv, fetchPypi, buildPythonPackage, six }:
+
+buildPythonPackage rec {
+  pname = "astunparse";
+  version =  "1.5.0";
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1kc9lm2jvfcip3z8snj04dar5a9jh857a704m6lvcv4xclm3rpsm";
+  };
+  propagatedBuildInputs = [ six ];
+  doCheck = false; # no tests
+  meta = with stdenv.lib; {
+    description = "This is a factored out version of unparse found in the Python source distribution";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ jyp ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index de99a1e64d8..7a0248a05b3 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -18171,6 +18171,8 @@ EOF
 
   spectral-cube = callPackage ../development/python-modules/spectral-cube { };
 
+  astunparse = callPackage ../development/python-modules/astunparse { };
+
 });
 
 in fix' (extends overrides packages)

From 72f051a97025f85dbbb6e6b6f74a8c4ea451e3f2 Mon Sep 17 00:00:00 2001
From: Jean-Philippe Bernardy <jeanphilippe.bernardy@gmail.com>
Date: Thu, 7 Jun 2018 13:29:27 +0200
Subject: [PATCH 012/161] python.packages.gast: init at 0.2.0

---
 pkgs/development/python-modules/gast/default.nix | 16 ++++++++++++++++
 pkgs/top-level/python-packages.nix               |  2 ++
 2 files changed, 18 insertions(+)
 create mode 100644 pkgs/development/python-modules/gast/default.nix

diff --git a/pkgs/development/python-modules/gast/default.nix b/pkgs/development/python-modules/gast/default.nix
new file mode 100644
index 00000000000..036bed9dd79
--- /dev/null
+++ b/pkgs/development/python-modules/gast/default.nix
@@ -0,0 +1,16 @@
+{ stdenv, fetchPypi, buildPythonPackage, astunparse }:
+
+buildPythonPackage rec {
+  pname = "gast";
+  version =  "0.2.0";
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0c296xm1vz9x4w4inmdl0k8mnc0i9arw94si2i7pglpc461r0s3h";
+  };
+  checkInputs = [ astunparse ] ;
+  meta = with stdenv.lib; {
+    description = "GAST provides a compatibility layer between the AST of various Python versions, as produced by ast.parse from the standard ast module.";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ jyp ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 7a0248a05b3..fc0ebcdc2e6 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -18173,6 +18173,8 @@ EOF
 
   astunparse = callPackage ../development/python-modules/astunparse { };
 
+  gast = callPackage ../development/python-modules/gast { };
+
 });
 
 in fix' (extends overrides packages)

From 14771710733d904de3849921923a5154d1bd3367 Mon Sep 17 00:00:00 2001
From: Jean-Philippe Bernardy <jeanphilippe.bernardy@gmail.com>
Date: Thu, 7 Jun 2018 13:29:58 +0200
Subject: [PATCH 013/161] python.packages.tensorflow-tensorboard: 1.5.0 ->
 1.7.0

---
 .../tensorflow-tensorboard/default.nix          | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/python-modules/tensorflow-tensorboard/default.nix b/pkgs/development/python-modules/tensorflow-tensorboard/default.nix
index f0b4e6f341d..a767120ddf3 100644
--- a/pkgs/development/python-modules/tensorflow-tensorboard/default.nix
+++ b/pkgs/development/python-modules/tensorflow-tensorboard/default.nix
@@ -3,33 +3,34 @@
 , numpy
 , werkzeug
 , protobuf
+, grpcio
 , markdown
 , futures
 }:
 
-# tensorflow is built from a downloaded wheel, because
-# https://github.com/tensorflow/tensorboard/issues/719
-# blocks buildBazelPackage.
+# tensorflow/tensorboard is built from a downloaded wheel, because
+# https://github.com/tensorflow/tensorboard/issues/719 blocks
+# buildBazelPackage.
 
 buildPythonPackage rec {
   pname = "tensorflow-tensorboard";
-  version = "1.5.1";
+  version = "1.7.0";
   name = "${pname}-${version}";
   format = "wheel";
 
   src = fetchPypi ({
-    pname = "tensorflow_tensorboard";
+    pname = "tensorboard";
     inherit version;
     format = "wheel";
   } // (if isPy3k then {
     python = "py3";
-    sha256 = "1cydgvrr0s05xqz1v9z2wdiv60gzbs8wv9wvbflw5700a2llb63l";
+    sha256 = "1aa42rl3fkpllqch09d311gk1j281qry6nn07ywgbs6j0kwr6isc";
   } else {
     python = "py2";
-    sha256 = "0dhljddlirq6nr84zg4yrk5k69gj3x2abb6wg3crgrparb6qbya7";
+    sha256 = "1vcdkyvw22kpljmj4gxb8m1q54ry02iwvw54w8v8hmdigvc77a7k";
   }));
 
-  propagatedBuildInputs = [ bleach_1_5_0 numpy werkzeug protobuf markdown ] ++ lib.optional (!isPy3k) futures;
+  propagatedBuildInputs = [ bleach_1_5_0 numpy werkzeug protobuf markdown grpcio ] ++ lib.optional (!isPy3k) futures;
 
   meta = with stdenv.lib; {
     description = "TensorFlow's Visualization Toolkit";

From 7d02ec9ac6e4788e5a8d679c6615d7d7f0c47e14 Mon Sep 17 00:00:00 2001
From: Jean-Philippe Bernardy <jeanphilippe.bernardy@gmail.com>
Date: Thu, 7 Jun 2018 13:30:29 +0200
Subject: [PATCH 014/161] python.packages.tensorflow: add missing dependencies

---
 pkgs/development/python-modules/tensorflow/bin.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/tensorflow/bin.nix b/pkgs/development/python-modules/tensorflow/bin.nix
index 9c6b84e8c7a..785cff5b8b7 100644
--- a/pkgs/development/python-modules/tensorflow/bin.nix
+++ b/pkgs/development/python-modules/tensorflow/bin.nix
@@ -3,8 +3,11 @@
 , fetchurl
 , buildPythonPackage
 , isPy3k, isPy35, isPy36, pythonOlder
+, astor
+, gast
 , numpy
 , six
+, termcolor
 , protobuf
 , absl-py
 , mock
@@ -47,7 +50,7 @@ in buildPythonPackage rec {
     dls = import ./tf1.7.1-hashes.nix;
   in fetchurl dls.${key};
 
-  propagatedBuildInputs = [ numpy six protobuf absl-py ]
+  propagatedBuildInputs = [ numpy six protobuf absl-py astor gast termcolor ]
                  ++ lib.optional (!isPy3k) mock
                  ++ lib.optionals (pythonOlder "3.4") [ backports_weakref enum34 ]
                  ++ lib.optional (pythonOlder "3.6") tensorflow-tensorboard;

From 8a012a28bfa4f9116cd54c56248b692834244490 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm+bot@ryantm.com>
Date: Fri, 8 Jun 2018 11:05:11 -0700
Subject: [PATCH 015/161] appstream-glib: 0.7.8 -> 0.7.9

Semi-automatic update generated by https://github.com/ryantm/nixpkgs-update tools.

This update was made based on information from https://repology.org/metapackage/appstream-glib/versions.

These checks were done:

- built on NixOS

- 0 of 0 passed binary check by having a zero exit code.
- 0 of 0 passed binary check by having the new version present in output.
- found 0.7.9 with grep in /nix/store/c15qrflgi7dn8by6lndn4szzxqfv6fbh-appstream-glib-0.7.9
- directory tree listing: https://gist.github.com/8232c1c6ab5664cb630765eefbbf7f5f
- du listing: https://gist.github.com/820804a1f32be45fb3ccdd98d6dd6a86
---
 pkgs/development/libraries/appstream-glib/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/appstream-glib/default.nix b/pkgs/development/libraries/appstream-glib/default.nix
index b09f5f67f56..3a0868ccecb 100644
--- a/pkgs/development/libraries/appstream-glib/default.nix
+++ b/pkgs/development/libraries/appstream-glib/default.nix
@@ -4,7 +4,7 @@
 , libuuid, json-glib, meson, gperf, ninja
 }:
 stdenv.mkDerivation rec {
-  name = "appstream-glib-0.7.8";
+  name = "appstream-glib-0.7.9";
 
   outputs = [ "out" "dev" "man" "installedTests" ];
   outputBin = "dev";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     owner = "hughsie";
     repo = "appstream-glib";
     rev = stdenv.lib.replaceStrings ["." "-"] ["_" "_"] name;
-    sha256 = "10hcl3sl3g8ajg9mssq3g4dbzz0d4b2ybimrcq71cpycqrqhilhx";
+    sha256 = "10b32qw7iy0v1jvmf18wqgs8d1cpy52zm5rzw0wv421n90qiyidk";
   };
 
   nativeBuildInputs = [

From cca45cc3e146a7b0abba24b3f72ae245f51473ee Mon Sep 17 00:00:00 2001
From: Christian Kauhaus <kc@flyingcircus.io>
Date: Sat, 9 Jun 2018 15:49:36 +0200
Subject: [PATCH 016/161] Get libtiff on the same patch level as Debian. The
 imported patch file contains:

CVE-2017-9935
CVE-2017-11613
CVE-2017-17095
CVE-2017-18013
CVE-2018-5784
CVE-2018-7456

Re #41748 (master)
Re #41749 (release-18.03 - needs to be cherry-picked)
---
 pkgs/development/libraries/libtiff/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix
index ab1bda9ed29..6676944d529 100644
--- a/pkgs/development/libraries/libtiff/default.nix
+++ b/pkgs/development/libraries/libtiff/default.nix
@@ -13,12 +13,12 @@ stdenv.mkDerivation rec {
 
   prePatch = let
       debian = fetchurl {
-        url = http://snapshot.debian.org/archive/debian-debug/20180128T155203Z//pool/main/t/tiff/tiff_4.0.9-3.debian.tar.xz;
-        sha256 = "0wya42y7kcq093g3h7ca10cm5sns1mgnkjmdd2qdi59v8arga4y4";
+        url = http://http.debian.net/debian/pool/main/t/tiff/tiff_4.0.9-5.debian.tar.xz;
+        sha256 = "15lwcsd46gini27akms2ngyxnwi1hs2yskrv5x2wazs5fw5ii62w";
       };
     in ''
-      tar xf '${debian}'
-      patches="$patches $(cat debian/patches/series | sed 's|^|debian/patches/|')"
+      tar xf ${debian}
+      patches="$patches $(sed 's|^|debian/patches/|' < debian/patches/series)"
     '';
 
   outputs = [ "bin" "dev" "out" "man" "doc" ];

From e2b44b317052fa65acd15cfb2ed53b78638327b9 Mon Sep 17 00:00:00 2001
From: Benjamin Hipple <bhipple@protonmail.com>
Date: Sat, 9 Jun 2018 19:18:16 -0400
Subject: [PATCH 017/161] fftw: support multiple src URLs

The fftw download page provides both an HTTP and FTP endpoint for downloading release tarballs:
http://fftw.org/download.html

Since some users may have difficulty fetching via FTP through corporate
firewalls, we should provide the option to get it over HTTP as well.
---
 pkgs/development/libraries/fftw/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/fftw/default.nix b/pkgs/development/libraries/fftw/default.nix
index 3c5100f2f7f..12b30cf0349 100644
--- a/pkgs/development/libraries/fftw/default.nix
+++ b/pkgs/development/libraries/fftw/default.nix
@@ -13,7 +13,10 @@ stdenv.mkDerivation rec {
   name = "fftw-${precision}-${version}";
 
   src = fetchurl {
-    url = "ftp://ftp.fftw.org/pub/fftw/fftw-${version}.tar.gz";
+    urls = [
+      "http://fftw.org/fftw-${version}.tar.gz"
+      "ftp://ftp.fftw.org/pub/fftw/fftw-${version}.tar.gz"
+    ];
     sha256 = "00z3k8fq561wq2khssqg0kallk0504dzlx989x3vvicjdqpjc4v1";
   };
 

From 129ea5ed817f1627e31ed1d030900e0814ff6649 Mon Sep 17 00:00:00 2001
From: Philip Lewis <pcl@pclewis.com>
Date: Sat, 9 Jun 2018 20:20:47 -0400
Subject: [PATCH 018/161] openjdk: fix truststore-from-env patch for jdk10

storePropName will be jsseDefaultStore if the property isn't present, and
jsseDefaultStore is never null, so the branch to use the environment variable
would never be taken.

The env var is supposed to be preferred to jssecacerts, so we can use it as
the default in the call to System.getProperty, and use the null check to fall
back on jsseDefaultStore instead.
---
 .../openjdk/read-truststore-from-env-jdk10.patch | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/compilers/openjdk/read-truststore-from-env-jdk10.patch b/pkgs/development/compilers/openjdk/read-truststore-from-env-jdk10.patch
index b5abc1d794d..6203064f5c0 100644
--- a/pkgs/development/compilers/openjdk/read-truststore-from-env-jdk10.patch
+++ b/pkgs/development/compilers/openjdk/read-truststore-from-env-jdk10.patch
@@ -8,12 +8,22 @@
       *    jssecacerts
       *    cacerts
       */
-@@ -144,6 +145,9 @@
+@@ -132,7 +133,8 @@
+                 public TrustStoreDescriptor run() {
+                     // Get the system properties for trust store.
+                     String storePropName = System.getProperty(
+-                            "javax.net.ssl.trustStore", jsseDefaultStore);
++                            "javax.net.ssl.trustStore",
++                            System.getenv("JAVAX_NET_SSL_TRUSTSTORE"));
+                     String storePropType = System.getProperty(
+                             "javax.net.ssl.trustStoreType",
+                             KeyStore.getDefaultType());
+@@ -144,6 +146,9 @@
                      String temporaryName = "";
                      File temporaryFile = null;
                      long temporaryTime = 0L;
-+                    if (storePropName == null){
-+                        storePropName = System.getenv("JAVAX_NET_SSL_TRUSTSTORE");
++                    if (storePropName == null) {
++                        storePropName = jsseDefaultStore;
 +                    }
                      if (!"NONE".equals(storePropName)) {
                          String[] fileNames =

From ed628fb74e3cd68c96932a6fd2e396f2c6695fe6 Mon Sep 17 00:00:00 2001
From: Raymond Hogenson <rhogenson@posteo.net>
Date: Sat, 9 Jun 2018 19:33:13 -0700
Subject: [PATCH 019/161] nethack: 3.6.0 -> 3.6.1

---
 pkgs/games/nethack/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/games/nethack/default.nix b/pkgs/games/nethack/default.nix
index b67a79aa3fe..9dd76581fd8 100644
--- a/pkgs/games/nethack/default.nix
+++ b/pkgs/games/nethack/default.nix
@@ -13,11 +13,11 @@ let
   binPath = lib.makeBinPath [ coreutils less ];
 
 in stdenv.mkDerivation {
-  name = "nethack-3.6.0";
+  name = "nethack-3.6.1";
 
   src = fetchurl {
-    url = "mirror://sourceforge/nethack/nethack-360-src.tgz";
-    sha256 = "12mi5kgqw3q029y57pkg3gnp930p7yvlqi118xxdif2qhj6nkphs";
+    url = "http://nethack.org/download/3.6.1/nethack-361-src.tgz";
+    sha256 = "1dha0ijvxhx7c9hr0452h93x81iiqsll8bc9msdnp7xdqcfbz32b";
   };
 
   buildInputs = [ ncurses ];

From 163c83e901b8f0cfa065d66bd0ef9a9772671988 Mon Sep 17 00:00:00 2001
From: Johannes Frankenau <johannes@frankenau.net>
Date: Thu, 7 Jun 2018 11:46:40 +0200
Subject: [PATCH 020/161] python.pkgs.pyqt5: apply patch for cura segfaults

---
 pkgs/development/python-modules/pyqt/5.x.nix | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/pyqt/5.x.nix b/pkgs/development/python-modules/pyqt/5.x.nix
index 331366e379d..d9de2edce68 100644
--- a/pkgs/development/python-modules/pyqt/5.x.nix
+++ b/pkgs/development/python-modules/pyqt/5.x.nix
@@ -1,4 +1,4 @@
-{ lib, fetchurl, pythonPackages, pkgconfig, makeWrapper, qmake
+{ lib, fetchurl, pythonPackages, pkgconfig, makeWrapper, qmake, fetchpatch
 , lndir, qtbase, qtsvg, qtwebkit, qtwebengine, dbus_libs
 , withWebSockets ? false, qtwebsockets
 , withConnectivity ? false, qtconnectivity
@@ -64,6 +64,17 @@ in buildPythonPackage {
     runHook postConfigure
   '';
 
+  patches = [
+    # This patch from Arch Linux fixes Cura segfaulting on startup
+    # https://github.com/Ultimaker/Cura/issues/3438
+    # It can probably removed on 5.10.3
+    (fetchpatch {
+      name = "pyqt5-cura-crash.patch";
+      url = https://git.archlinux.org/svntogit/packages.git/plain/repos/extra-x86_64/pyqt5-cura-crash.patch?id=6cfe64a3d1827e0ed9cc62f1683a53b582315f4f;
+      sha256 = "02a0mw1z8p9hhqhl4bgjrmf1xq82xjmpivn5bg6r4yv6pidsh7ck";
+    })
+  ];
+
   postInstall = ''
     for i in $out/bin/*; do
       wrapProgram $i --prefix PYTHONPATH : "$PYTHONPATH"

From 8ec26d8e5c6a8b9ec0babc00c7c667c43405fbc6 Mon Sep 17 00:00:00 2001
From: Johannes Frankenau <johannes@frankenau.net>
Date: Thu, 7 Jun 2018 11:52:25 +0200
Subject: [PATCH 021/161] libarcus: 3.2.1 -> 3.3.0

---
 pkgs/development/python-modules/libarcus/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/libarcus/default.nix b/pkgs/development/python-modules/libarcus/default.nix
index d9cc5fb0d9e..cf556a79003 100644
--- a/pkgs/development/python-modules/libarcus/default.nix
+++ b/pkgs/development/python-modules/libarcus/default.nix
@@ -7,7 +7,7 @@ else
 stdenv.mkDerivation rec {
   pname = "libarcus";
   name = "${pname}-${version}";
-  version = "3.2.1";
+  version = "3.3.0";
   
   src = fetchFromGitHub {
     owner = "Ultimaker";
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Communication library between internal components for Ultimaker software";
-    homepage = "https://github.com/Ultimaker/libArcus";
+    homepage = https://github.com/Ultimaker/libArcus;
     license = licenses.agpl3;
     platforms = platforms.linux;
     maintainers = with maintainers; [ abbradar ];

From e187dd170f0e32b1064d3373046352d83bee55e7 Mon Sep 17 00:00:00 2001
From: Johannes Frankenau <johannes@frankenau.net>
Date: Thu, 7 Jun 2018 11:55:47 +0200
Subject: [PATCH 022/161] curaengine: 3.2.1 -> 3.3.0

---
 pkgs/applications/misc/curaengine/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/misc/curaengine/default.nix b/pkgs/applications/misc/curaengine/default.nix
index c3a19e6551a..ac4c68f9b53 100644
--- a/pkgs/applications/misc/curaengine/default.nix
+++ b/pkgs/applications/misc/curaengine/default.nix
@@ -2,19 +2,19 @@
 
 stdenv.mkDerivation rec {
   name = "curaengine-${version}";
-  version = "3.2.1";
+  version = "3.3.0";
 
   src = fetchFromGitHub {
     owner = "Ultimaker";
     repo = "CuraEngine";
     rev = version;
-    sha256 = "1yqpp6qhixzni3ik11vbk5kcdrhlz2j4ylzmh8f6c86r4d73a0cp";
+    sha256 = "1dj80lk58qb54apdv7n9cmcck4smb00lidgqld21xnndnnqqb4lw";
   };
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ libarcus ];
 
-  enableParallelBuilding = true;
+  cmakeFlags = [ "-DCURA_ENGINE_VERSION=${version}" ];
 
   meta = with stdenv.lib; {
     description = "A powerful, fast and robust engine for processing 3D models into 3D printing instruction";

From 4c73d164d487932f29e74a9317dc5a0f2cab8c2f Mon Sep 17 00:00:00 2001
From: Johannes Frankenau <johannes@frankenau.net>
Date: Thu, 7 Jun 2018 11:56:12 +0200
Subject: [PATCH 023/161] cura: 3.2.1 -> 3.3.1

---
 pkgs/applications/misc/cura/default.nix | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/pkgs/applications/misc/cura/default.nix b/pkgs/applications/misc/cura/default.nix
index 10f6837761b..3b00bba709a 100644
--- a/pkgs/applications/misc/cura/default.nix
+++ b/pkgs/applications/misc/cura/default.nix
@@ -2,27 +2,30 @@
 
 mkDerivation rec {
   name = "cura-${version}";
-  version = "3.2.1";
+  version = "3.3.1";
 
   src = fetchFromGitHub {
     owner = "Ultimaker";
     repo = "Cura";
     rev = version;
-    sha256 = "0yaya0ww92qjm7g31q85m5f95nwdapldjx1kdf1ar4yzwh4r15rp";
+    sha256 = "0a2xxiw1h5cq4nd4pdkq757hap85p2i29msxs57kbfdd78izrjlx";
   };
 
   materials = fetchFromGitHub {
     owner = "Ultimaker";
     repo = "fdm_materials";
-    rev = "3.2.1";
-    sha256 = "1kr9ga727x0kazw2ypac9bi6g6lddbsx80qw8fbn0514kg2mr9n3";
+    rev = "3.3.0";
+    sha256 = "0vf7s4m14aqhdg4m2yjj87kjxi2gpa46mgx86p0a91jwvkxa8a1q";
   };
 
   buildInputs = [ qtbase qtquickcontrols2 ];
   propagatedBuildInputs = with python3.pkgs; [ uranium zeroconf pyserial numpy-stl ];
   nativeBuildInputs = [ cmake python3.pkgs.wrapPython ];
 
-  cmakeFlags = [ "-DURANIUM_DIR=${python3.pkgs.uranium.src}" ];
+  cmakeFlags = [
+    "-DURANIUM_DIR=${python3.pkgs.uranium.src}"
+    "-DCURA_VERSION=${version}"
+  ];
 
   postPatch = ''
     sed -i 's,/python''${PYTHON_VERSION_MAJOR}/dist-packages,/python''${PYTHON_VERSION_MAJOR}.''${PYTHON_VERSION_MINOR}/site-packages,g' CMakeLists.txt

From 985aea6b55c8ffb5316b1d07337b1cb7a139e463 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Sun, 10 Jun 2018 01:22:47 -0700
Subject: [PATCH 024/161] anki: 2.0.51 -> 2.0.52 (#41582)

Semi-automatic update generated by https://github.com/ryantm/nixpkgs-update tools.

This update was made based on information from https://repology.org/metapackage/anki/versions.

These checks were done:

- built on NixOS
- /nix/store/2dqw72sffcynzzgcfk0k9mh7jn8sw0kw-anki-2.0.52/bin/anki passed the binary check.
- /nix/store/2dqw72sffcynzzgcfk0k9mh7jn8sw0kw-anki-2.0.52/bin/..anki-wrapped-wrapped passed the binary check.
- /nix/store/2dqw72sffcynzzgcfk0k9mh7jn8sw0kw-anki-2.0.52/bin/.anki-wrapped passed the binary check.
- 3 of 3 passed binary check by having a zero exit code.
- 3 of 3 passed binary check by having the new version present in output.
- found 2.0.52 with grep in /nix/store/2dqw72sffcynzzgcfk0k9mh7jn8sw0kw-anki-2.0.52
- directory tree listing: https://gist.github.com/1a53026ee3eea78708113c1b6e9d857f
- du listing: https://gist.github.com/c8dcabda5b46155a959b86843ee24ddd
---
 pkgs/games/anki/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/games/anki/default.nix b/pkgs/games/anki/default.nix
index efc30c1bbf3..e9f239b4df3 100644
--- a/pkgs/games/anki/default.nix
+++ b/pkgs/games/anki/default.nix
@@ -28,7 +28,7 @@ let
     qt4 = pyqt4.qt;
 
 in buildPythonApplication rec {
-    version = "2.0.51";
+    version = "2.0.52";
     name = "anki-${version}";
 
     src = fetchurl {
@@ -37,7 +37,7 @@ in buildPythonApplication rec {
         # "http://ankisrs.net/download/mirror/${name}.tgz"
         # "http://ankisrs.net/download/mirror/archive/${name}.tgz"
       ];
-      sha256 = "17prfkz9hbz1sdb62ddi6m4jwsb50n08myhai997x8d0r0xxilw0";
+      sha256 = "0yjyxgpk79rplz9z2r93kmlk09ari6xxfrz1cfm2yl9v8zfw1n6l";
     };
 
     propagatedBuildInputs = [ pyqt4 sqlalchemy pyaudio beautifulsoup httplib2 ]

From 5095e9e32eacfcc794227bfe4fd45d5e60285f73 Mon Sep 17 00:00:00 2001
From: mingchuan <sifmelcara@users.noreply.github.com>
Date: Sun, 10 Jun 2018 16:37:58 +0800
Subject: [PATCH 025/161] solc: 0.4.23 -> 0.4.24 (#41631)

Also enable test
---
 pkgs/development/compilers/solc/default.nix   | 24 +++++++++++--------
 .../solc/patches/boost-shared-libs.patch      | 24 -------------------
 .../solc/patches/shared-libs-install.patch    | 12 +++++-----
 3 files changed, 20 insertions(+), 40 deletions(-)
 delete mode 100644 pkgs/development/compilers/solc/patches/boost-shared-libs.patch

diff --git a/pkgs/development/compilers/solc/default.nix b/pkgs/development/compilers/solc/default.nix
index d94ce75e3f5..edb7fc61d2a 100644
--- a/pkgs/development/compilers/solc/default.nix
+++ b/pkgs/development/compilers/solc/default.nix
@@ -1,16 +1,15 @@
 { stdenv, fetchzip, fetchFromGitHub, boost, cmake, z3 }:
 
 let
-  version = "0.4.23";
-  rev = "124ca40dc525a987a88176c6e5170978e82fa290";
-  sha256 = "07l8rfqh95yrdmbxc4pfb77s06k5v65dk3rgdqscqmwchkndrmm0";
-  jsoncppURL = https://github.com/open-source-parsers/jsoncpp/archive/1.7.7.tar.gz;
+  version = "0.4.24";
+  rev = "e67f0147998a9e3835ed3ce8bf6a0a0c634216c5";
+  sha256 = "1gy2miv6ia1z98zy6w4y03balwfr964bnvwzyg8v7pn2mayqnaap";
+  jsoncppURL = https://github.com/open-source-parsers/jsoncpp/archive/1.8.4.tar.gz;
   jsoncpp = fetchzip {
     url = jsoncppURL;
-    sha256 = "0jz93zv17ir7lbxb3dv8ph2n916rajs8i96immwx9vb45pqid3n0";
+    sha256 = "1z0gj7a6jypkijmpknis04qybs1hkd04d1arr3gy89lnxmp6qzlm";
   };
 in
-
 stdenv.mkDerivation {
   name = "solc-${version}";
 
@@ -21,7 +20,6 @@ stdenv.mkDerivation {
   };
 
   patches = [
-    ./patches/boost-shared-libs.patch
     ./patches/shared-libs-install.patch
   ];
 
@@ -30,17 +28,23 @@ stdenv.mkDerivation {
     echo >commit_hash.txt "${rev}"
     substituteInPlace cmake/jsoncpp.cmake \
       --replace "${jsoncppURL}" ${jsoncpp}
-    substituteInPlace cmake/EthCompilerSettings.cmake \
-      --replace "add_compile_options(-Werror)" ""
+
+    # To allow non-standard CMAKE_INSTALL_LIBDIR (fixed in upstream, not yet released)
+    substituteInPlace cmake/jsoncpp.cmake \
+      --replace "\''${CMAKE_INSTALL_LIBDIR}" "lib" \
+      --replace "# Build static lib but suitable to be included in a shared lib." "-DCMAKE_INSTALL_LIBDIR=lib"
   '';
 
   cmakeFlags = [
     "-DBoost_USE_STATIC_LIBS=OFF"
     "-DBUILD_SHARED_LIBS=ON"
     "-DINSTALL_LLLC=ON"
-    "-DTESTS=OFF"
   ];
 
+  doCheck = stdenv.hostPlatform.isLinux && stdenv.hostPlatform == stdenv.buildPlatform;
+  checkPhase = "LD_LIBRARY_PATH=./libsolc:./libsolidity:./liblll:./libevmasm:./libdevcore:$LD_LIBRARY_PATH " +
+               "./test/soltest -p -- --no-ipc --no-smt --testpath ../test";
+
   nativeBuildInputs = [ cmake ];
   buildInputs = [ boost z3 ];
 
diff --git a/pkgs/development/compilers/solc/patches/boost-shared-libs.patch b/pkgs/development/compilers/solc/patches/boost-shared-libs.patch
deleted file mode 100644
index 499fc46c6ca..00000000000
--- a/pkgs/development/compilers/solc/patches/boost-shared-libs.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-diff --git a/libsolidity/CMakeLists.txt b/libsolidity/CMakeLists.txt
-index 97b01c83..0bdec4b4 100644
---- a/libsolidity/CMakeLists.txt
-+++ b/libsolidity/CMakeLists.txt
-@@ -28,7 +28,7 @@ else()
- endif()
- 
- add_library(solidity ${sources} ${headers})
--target_link_libraries(solidity PUBLIC evmasm devcore)
-+target_link_libraries(solidity PUBLIC evmasm devcore ${Boost_FILESYSTEM_LIBRARY} ${Boost_SYSTEM_LIBRARY})
- 
- if (${Z3_FOUND})
-   target_link_libraries(solidity PUBLIC ${Z3_LIBRARY})
-diff --git a/lllc/CMakeLists.txt b/lllc/CMakeLists.txt
-index 5c480093..d6538ee2 100644
---- a/lllc/CMakeLists.txt
-+++ b/lllc/CMakeLists.txt
-@@ -1,5 +1,5 @@
- add_executable(lllc main.cpp)
--target_link_libraries(lllc PRIVATE lll)
-+target_link_libraries(lllc PRIVATE lll ${Boost_SYSTEM_LIBRARY})
- 
- if (INSTALL_LLLC)
- 	include(GNUInstallDirs)
diff --git a/pkgs/development/compilers/solc/patches/shared-libs-install.patch b/pkgs/development/compilers/solc/patches/shared-libs-install.patch
index 732797e5ae7..70162bfbcb6 100644
--- a/pkgs/development/compilers/solc/patches/shared-libs-install.patch
+++ b/pkgs/development/compilers/solc/patches/shared-libs-install.patch
@@ -1,11 +1,12 @@
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 4ac56b43..dacf3853 100644
+index 0c05208f..8893648e 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -48,6 +48,19 @@ add_subdirectory(libevmasm)
+@@ -48,6 +48,20 @@ add_subdirectory(libevmasm)
  add_subdirectory(libsolidity)
  add_subdirectory(libsolc)
  
++
 +install(DIRECTORY libdevcore/
 +        DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/libdevcore
 +        FILES_MATCHING PATTERN "*.h")
@@ -38,7 +39,7 @@ index 86192c1b..e7f15e93 100644
 @@ -3,3 +3,4 @@ file(GLOB headers "*.h")
  
  add_library(evmasm ${sources} ${headers})
- target_link_libraries(evmasm PUBLIC jsoncpp devcore)
+ target_link_libraries(evmasm PUBLIC devcore)
 +install(TARGETS evmasm LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR})
 diff --git a/liblll/CMakeLists.txt b/liblll/CMakeLists.txt
 index 4cdc073a..b61f03c7 100644
@@ -50,11 +51,10 @@ index 4cdc073a..b61f03c7 100644
  target_link_libraries(lll PUBLIC evmasm devcore)
 +install(TARGETS lll LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR})
 diff --git a/libsolidity/CMakeLists.txt b/libsolidity/CMakeLists.txt
-index 97b01c83..e876177e 100644
+index 0bdec4b4..e876177e 100644
 --- a/libsolidity/CMakeLists.txt
 +++ b/libsolidity/CMakeLists.txt
-@@ -28,7 +28,8 @@ else()
- endif()
+@@ -29,6 +29,7 @@ endif()
  
  add_library(solidity ${sources} ${headers})
  target_link_libraries(solidity PUBLIC evmasm devcore ${Boost_FILESYSTEM_LIBRARY} ${Boost_SYSTEM_LIBRARY})

From f0bfa9de83082fd27a092f330b22b697a7955883 Mon Sep 17 00:00:00 2001
From: Robert Helgesson <robert@rycee.net>
Date: Sun, 10 Jun 2018 11:51:09 +0200
Subject: [PATCH 026/161] pythonPackages.PyICU: 1.9.7 -> 2.0.3

---
 pkgs/top-level/python-packages.nix | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 5ee887ed598..1a6a625116a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -10841,13 +10841,20 @@ in {
   };
 
   PyICU = buildPythonPackage rec {
-    name = "PyICU-1.9.7";
+    name = "PyICU-2.0.3";
 
     src = pkgs.fetchurl {
       url = "mirror://pypi/P/PyICU/${name}.tar.gz";
-      sha256 = "0qavhngmn7c90fz25a8a2k50wd5gzp3vwwjq8v2pkf2hq4fcs9yv";
+      sha256 = "0pzss3l0b0vcsyr7wlqdd6pkcqldspajfgd9k2iijf6r152d2ln4";
     };
 
+    patches = [
+      (pkgs.fetchpatch {
+        url = https://sources.debian.org/data/main/p/pyicu/2.0.3-1/debian/patches/icu_test.patch;
+        sha256 = "1iavdkyqixm9i753svl17barla93b7jzgkw09dn3hnggamx7zwx9";
+      })
+    ];
+
     buildInputs = [ pkgs.icu self.pytest ];
 
     propagatedBuildInputs = [ self.six ];

From a601787e55c50ca6805a34e5e5190a3943cfb00b Mon Sep 17 00:00:00 2001
From: Bas van Dijk <v.dijk.bas@gmail.com>
Date: Sun, 10 Jun 2018 12:32:20 +0200
Subject: [PATCH 027/161] haskell: fix overriding haskellPackages using
 haskell.packageOverrides

Tested using:

$ nix-build -E '(import ./. { overlays = [(final : previous : { haskell = previous.haskell // { packageOverrides = self : super : {blablabla = super.scientific;};};})];}).haskellPackages.blablabla'
/nix/store/s75xbfhn88187jk8238h4ii2ap9kg4m2-scientific-0.3.6.2
---
 pkgs/top-level/all-packages.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index bc48df43f40..db65cd4a9b8 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6460,7 +6460,7 @@ with pkgs;
   haskell = callPackage ./haskell-packages.nix { };
 
   haskellPackages = haskell.packages.ghc822.override {
-    overrides = config.haskellPackageOverrides or (self: super: {});
+    overrides = config.haskellPackageOverrides or haskell.packageOverrides;
   };
 
   inherit (haskellPackages) ghc;

From ea66f3b839646800b0d33315dc85f349e5cb935b Mon Sep 17 00:00:00 2001
From: Sander Hollaar <git@humilis.net>
Date: Sun, 10 Jun 2018 13:27:59 +0200
Subject: [PATCH 028/161] pcsc-lite-not-found - alioth.debian.org
 decommissioned: https://reproducible-builds.org/blog/posts/162/

---
 pkgs/tools/security/pcsclite/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/security/pcsclite/default.nix b/pkgs/tools/security/pcsclite/default.nix
index 589316b1d1c..1fd10674657 100644
--- a/pkgs/tools/security/pcsclite/default.nix
+++ b/pkgs/tools/security/pcsclite/default.nix
@@ -8,8 +8,8 @@ stdenv.mkDerivation rec {
   src = fetchurl {
     # This URL changes in unpredictable ways, so it is not sensible
     # to put a version variable in there.
-    url = "https://alioth.debian.org/frs/download.php/file/4235/pcsc-lite-1.8.23.tar.bz2";
-    sha256 = "1jc9ws5ra6v3plwraqixin0w0wfxj64drahrbkyrrwzghqjjc9ss";
+    url = "https://pcsclite.apdu.fr/files/pcsc-lite-1.8.23.tar.bz2";
+    sha256 = "09b7a79hjkgiyvhyvwf8gpxaf8b7wd0342hx6zrpd269hhfbjvwy";
   };
 
   patches = [ ./no-dropdir-literals.patch ];

From 61d52aa62fa2596196c291dfb7139b7f39f269a8 Mon Sep 17 00:00:00 2001
From: Sander Hollaar <git@humilis.net>
Date: Sun, 10 Jun 2018 14:42:13 +0200
Subject: [PATCH 029/161] pcsc-lite-not-found - wrong hash

---
 pkgs/tools/security/pcsclite/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/tools/security/pcsclite/default.nix b/pkgs/tools/security/pcsclite/default.nix
index 1fd10674657..a2c6ff52663 100644
--- a/pkgs/tools/security/pcsclite/default.nix
+++ b/pkgs/tools/security/pcsclite/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     # This URL changes in unpredictable ways, so it is not sensible
     # to put a version variable in there.
     url = "https://pcsclite.apdu.fr/files/pcsc-lite-1.8.23.tar.bz2";
-    sha256 = "09b7a79hjkgiyvhyvwf8gpxaf8b7wd0342hx6zrpd269hhfbjvwy";
+    sha256 = "1jc9ws5ra6v3plwraqixin0w0wfxj64drahrbkyrrwzghqjjc9ss";
   };
 
   patches = [ ./no-dropdir-literals.patch ];

From fc9ffe790f5f0c3c378b1af25f3a45333145fded Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sun, 10 Jun 2018 12:09:01 +0200
Subject: [PATCH 030/161] linux: Enable RT53XX wifi support

---
 pkgs/os-specific/linux/kernel/common-config.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index a226061ecbf..d1314431abe 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -463,6 +463,7 @@ with stdenv.lib;
   PPP_FILTER y
   REGULATOR y # Voltage and Current Regulator Support
   RC_DEVICES? y # Enable IR devices
+  RT2800USB_RT53XX y
   RT2800USB_RT55XX y
   SCHED_AUTOGROUP y
   CFS_BANDWIDTH y

From 70050dbc48d61364248f8d453bd1408435f76c81 Mon Sep 17 00:00:00 2001
From: volth <volth@webmaster.ms>
Date: Sun, 10 Jun 2018 15:09:19 +0000
Subject: [PATCH 031/161] jogl: reflect recent changes in opengl (#41786)

---
 pkgs/development/java-modules/jogl/default.nix | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/java-modules/jogl/default.nix b/pkgs/development/java-modules/jogl/default.nix
index 474eaa0e1dc..cceec44e6ae 100644
--- a/pkgs/development/java-modules/jogl/default.nix
+++ b/pkgs/development/java-modules/jogl/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchgit, makeWrapper, ant, jdk, openjdk8, zulu8, git, xorg, udev }:
+{ stdenv, fetchgit, makeWrapper, ant, jdk, openjdk8, zulu8, git, xorg, udev, libGL, libGLU }:
 
 let
   # workaround https://github.com/NixOS/nixpkgs/issues/37364
@@ -19,12 +19,18 @@ in
       name = "jogl-${version}";
 
       src = fetchgit {
-        url = http://jogamp.org/srv/scm/jogl.git;
+        url = git://jogamp.org/srv/scm/jogl.git;
         rev = "v${version}";
         sha256 = "0msi2gxiqm2yqwkmxqbh521xdrimw1fly20g890r357rcgj8fsn3";
         fetchSubmodules = true;
       };
 
+      postPatch = ''
+        find  .  -type f  -name '*.java' \
+          -exec sed -i 's@"libGL.so"@"${libGL}/lib/libGL.so"@'    {} \; \
+          -exec sed -i 's@"libGLU.so"@"${libGLU}/lib/libGLU.so"@' {} \;
+      '';
+
       buildInputs = [ jdk-without-symlinks ant git udev xorg.libX11 xorg.libXrandr xorg.libXcursor xorg.libXt xorg.libXxf86vm xorg.libXrender ];
 
       buildPhase = ''

From fe1a06698547311fd0a6991d40501e784d64aa69 Mon Sep 17 00:00:00 2001
From: Aristid Breitkreuz <aristidb@gmail.com>
Date: Sun, 10 Jun 2018 17:43:55 +0200
Subject: [PATCH 032/161] gnucash: fix Finance::Quote integration

---
 pkgs/applications/office/gnucash/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/office/gnucash/default.nix b/pkgs/applications/office/gnucash/default.nix
index d12b1327e8f..c09d0b3aa39 100644
--- a/pkgs/applications/office/gnucash/default.nix
+++ b/pkgs/applications/office/gnucash/default.nix
@@ -37,8 +37,9 @@ stdenv.mkDerivation rec {
   buildInputs = [
     boost icu libxml2 libxslt gettext swig isocodes gtk3 glibcLocales
     webkit dconf hicolor-icon-theme libofx aqbanking gwenhywfar libdbi
-    libdbiDrivers guile perlWrapper
-  ];
+    libdbiDrivers guile
+    perlWrapper perl
+  ] ++ (with perlPackages; [ FinanceQuote DateManip ]);
 
   propagatedUserEnvPkgs = [ dconf ];
 
@@ -58,6 +59,7 @@ stdenv.mkDerivation rec {
     wrapProgram "$out/bin/gnucash" \
       --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH:$out/share/gsettings-schemas/${name}" \
       --prefix XDG_DATA_DIRS : "${hicolor-icon-theme}/share" \
+      --prefix PERL5LIB ":" "$PERL5LIB" \
       --prefix GIO_EXTRA_MODULES : "${stdenv.lib.getLib dconf}/lib/gio/modules"
   '';
 

From d4daddad751458b11a86b047162f098a328f96fa Mon Sep 17 00:00:00 2001
From: volth <volth@webmaster.ms>
Date: Sun, 10 Jun 2018 16:29:32 +0000
Subject: [PATCH 033/161] nixos/nat: optional networking.nat.externalInterface
 (#41758)

---
 nixos/modules/services/networking/nat.nix | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/services/networking/nat.nix b/nixos/modules/services/networking/nat.nix
index da3827c35e6..c27ae3f66f6 100644
--- a/nixos/modules/services/networking/nat.nix
+++ b/nixos/modules/services/networking/nat.nix
@@ -38,13 +38,13 @@ let
     # NAT the marked packets.
     ${optionalString (cfg.internalInterfaces != []) ''
       iptables -w -t nat -A nixos-nat-post -m mark --mark 1 \
-        -o ${cfg.externalInterface} ${dest}
+        ${optionalString (cfg.externalInterface != null) "-o ${cfg.externalInterface}"} ${dest}
     ''}
 
     # NAT packets coming from the internal IPs.
     ${concatMapStrings (range: ''
       iptables -w -t nat -A nixos-nat-post \
-        -s '${range}' -o ${cfg.externalInterface} ${dest}
+        -s '${range}' ${optionalString (cfg.externalInterface != null) "-o ${cfg.externalInterface}"} ${dest}
     '') cfg.internalIPs}
 
     # NAT from external ports to internal ports.
@@ -134,7 +134,8 @@ in
     };
 
     networking.nat.externalInterface = mkOption {
-      type = types.str;
+      type = types.nullOr types.str;
+      default = null;
       example = "eth1";
       description =
         ''
@@ -236,6 +237,15 @@ in
     { networking.firewall.extraCommands = mkBefore flushNat; }
     (mkIf config.networking.nat.enable {
 
+      assertions = [
+        { assertion = (cfg.dmzHost != null)    -> (cfg.externalInterface != null);
+          message = "networking.nat.dmzHost requires networking.nat.externalInterface";
+        }
+        { assertion = (cfg.forwardPorts != []) -> (cfg.externalInterface != null);
+          message = "networking.nat.forwardPorts requires networking.nat.externalInterface";
+        }
+      ];
+
       environment.systemPackages = [ pkgs.iptables ];
 
       boot = {

From ee1faf5881aeb0d1c17c4fd1e1882d5281ab1bef Mon Sep 17 00:00:00 2001
From: Pascal Wittmann <mail@pascal-wittmann.de>
Date: Sun, 10 Jun 2018 18:28:48 +0200
Subject: [PATCH 034/161] init perlPackages.SysMemInfo 0.99

---
 pkgs/top-level/perl-packages.nix | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 687237db61a..3c93486b102 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -14430,6 +14430,19 @@ let self = _self // overrides; _self = with self; {
     };
   };
 
+  SysMemInfo = buildPerlPackage rec {
+    name = "Sys-MemInfo-0.99";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/S/SC/SCRESTO/${name}.tar.gz";
+      sha256 = "0786319d3a3a8bae5d727939244bf17e140b714f52734d5e9f627203e4cf3e3b";
+    };
+    meta = {
+      description = "Memory informations";
+      maintainers = [ maintainers.pSub ];
+      license = with stdenv.lib.licenses; [ gpl2Plus ];
+    };
+  };
+
   SysCPU = buildPerlPackage rec {
     name = "Sys-CPU-0.61";
     src = fetchurl {

From 95a8cb3ade1ad0e2649f0f3128e90c53964af5e1 Mon Sep 17 00:00:00 2001
From: Pascal Wittmann <mail@pascal-wittmann.de>
Date: Sun, 10 Jun 2018 18:40:21 +0200
Subject: [PATCH 035/161] init perlPackages.GetoptArgvFile at 1.11

---
 pkgs/top-level/perl-packages.nix | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 3c93486b102..042a3130651 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -6512,6 +6512,18 @@ let self = _self // overrides; _self = with self; {
     doCheck = false; # seems to access the network
   };
 
+  GetoptArgvFile = buildPerlPackage rec {
+    name = "Getopt-ArgvFile-1.11";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/J/JS/JSTENZEL/${name}.tar.gz";
+      sha256 = "3709aa513ce6fd71d1a55a02e34d2f090017d5350a9bd447005653c9b0835b22";
+    };
+    meta = {
+      license = stdenv.lib.licenses.artistic1;
+      maintainers = [ maintainers.pSub ];
+    };
+  };
+
   GetoptLong = buildPerlPackage rec {
     name = "Getopt-Long-2.50";
     src = fetchurl {

From d2ea91a3db1d85a724bd1b92c9c8a47715a1fb0e Mon Sep 17 00:00:00 2001
From: MarcFontaine <MarcFontaine@users.noreply.github.com>
Date: Sat, 9 Jun 2018 13:00:01 +0200
Subject: [PATCH 036/161] unixcw : init at 3.5.1

---
 pkgs/applications/misc/unixcw/default.nix     |  37 +
 .../misc/unixcw/remove-use-of-dlopen.patch    | 677 ++++++++++++++++++
 pkgs/top-level/all-packages.nix               |   2 +
 3 files changed, 716 insertions(+)
 create mode 100644 pkgs/applications/misc/unixcw/default.nix
 create mode 100644 pkgs/applications/misc/unixcw/remove-use-of-dlopen.patch

diff --git a/pkgs/applications/misc/unixcw/default.nix b/pkgs/applications/misc/unixcw/default.nix
new file mode 100644
index 00000000000..2aeba5fb5f4
--- /dev/null
+++ b/pkgs/applications/misc/unixcw/default.nix
@@ -0,0 +1,37 @@
+{stdenv, fetchurl, libpulseaudio, alsaLib , pkgconfig, qt5}:
+stdenv.mkDerivation rec {
+  name = "unixcw-${version}";
+  version = "3.5.1";
+  src = fetchurl {
+    url = "mirror://sourceforge/unixcw/unixcw_${version}.orig.tar.gz";
+    sha256 ="5f3aacd8a26e16e6eff437c7ae1e9b389956fb137eeb3de24670ce05de479e7a";
+  };
+  patches = [
+    ./remove-use-of-dlopen.patch
+  ];
+  buildInputs = [libpulseaudio alsaLib pkgconfig qt5.qtbase];
+  CFLAGS   ="-lasound -lpulse-simple";
+
+  meta = with stdenv.lib; {
+    description = "sound characters as Morse code on the soundcard or console speaker";
+    longDescription = ''
+       unixcw is a project providing libcw library and a set of programs
+       using the library: cw, cwgen, cwcp and xcwcp.
+       The programs are intended for people who want to learn receiving
+       and sending Morse code.
+       unixcw is developed and tested primarily on GNU/Linux system.
+
+       cw  reads  characters  from  an input file, or from standard input,
+       and sounds each valid character as Morse code on either the system sound card,
+       or the system console speaker.
+       After it sounds a  character, cw  echoes it to standard output.
+       The input stream can contain embedded command strings.
+       These change the parameters used when sounding the Morse code.
+       cw reports any errors in  embedded  commands
+     '';
+    homepage = "http://unixcw.sourceforge.net";
+    maintainers = [ maintainers.mafo ];
+    license = licenses.gpl2;
+    platforms=platforms.linux;
+  };
+}
diff --git a/pkgs/applications/misc/unixcw/remove-use-of-dlopen.patch b/pkgs/applications/misc/unixcw/remove-use-of-dlopen.patch
new file mode 100644
index 00000000000..0475c008ba2
--- /dev/null
+++ b/pkgs/applications/misc/unixcw/remove-use-of-dlopen.patch
@@ -0,0 +1,677 @@
+From e4b91b5a7943a3b54f555ff2e0029b83bd96b131 Mon Sep 17 00:00:00 2001
+From: MarcFontaine <MarcFontaine@users.noreply.github.com>
+Date: Sat, 9 Jun 2018 11:02:11 +0200
+Subject: [PATCH] remove use of dlopen
+
+---
+ src/libcw/libcw_alsa.c | 215 ++++++++++---------------------------------------
+ src/libcw/libcw_pa.c   | 118 ++++-----------------------
+ 2 files changed, 56 insertions(+), 277 deletions(-)
+
+diff --git a/src/libcw/libcw_alsa.c b/src/libcw/libcw_alsa.c
+index a669c6e..17c306d 100644
+--- a/src/libcw/libcw_alsa.c
++++ b/src/libcw/libcw_alsa.c
+@@ -35,7 +35,6 @@
+ 
+ 
+ 
+-#include <dlfcn.h> /* dlopen() and related symbols */
+ #include <alsa/asoundlib.h>
+ 
+ 
+@@ -65,7 +64,6 @@ static const snd_pcm_format_t CW_ALSA_SAMPLE_FORMAT = SND_PCM_FORMAT_S16; /* "Si
+ 
+ 
+ static int  cw_alsa_set_hw_params_internal(cw_gen_t *gen, snd_pcm_hw_params_t *params);
+-static int  cw_alsa_dlsym_internal(void *handle);
+ static int  cw_alsa_write_internal(cw_gen_t *gen);
+ static int  cw_alsa_debug_evaluate_write_internal(cw_gen_t *gen, int rv);
+ static int  cw_alsa_open_device_internal(cw_gen_t *gen);
+@@ -80,56 +78,6 @@ static int  cw_alsa_print_params_internal(snd_pcm_hw_params_t *hw_params);
+ 
+ 
+ 
+-static struct {
+-	void *handle;
+-
+-	int (* snd_pcm_open)(snd_pcm_t **pcm, const char *name, snd_pcm_stream_t stream, int mode);
+-	int (* snd_pcm_close)(snd_pcm_t *pcm);
+-	int (* snd_pcm_prepare)(snd_pcm_t *pcm);
+-	int (* snd_pcm_drop)(snd_pcm_t *pcm);
+-	snd_pcm_sframes_t (* snd_pcm_writei)(snd_pcm_t *pcm, const void *buffer, snd_pcm_uframes_t size);
+-
+-	const char *(* snd_strerror)(int errnum);
+-
+-	int (* snd_pcm_hw_params_malloc)(snd_pcm_hw_params_t **ptr);
+-	int (* snd_pcm_hw_params_any)(snd_pcm_t *pcm, snd_pcm_hw_params_t *params);
+-	int (* snd_pcm_hw_params_set_format)(snd_pcm_t *pcm, snd_pcm_hw_params_t *params, snd_pcm_format_t val);
+-	int (* snd_pcm_hw_params_set_rate_near)(snd_pcm_t *pcm, snd_pcm_hw_params_t *params, unsigned int *val, int *dir);
+-	int (* snd_pcm_hw_params_set_access)(snd_pcm_t *pcm, snd_pcm_hw_params_t *params, snd_pcm_access_t _access);
+-	int (* snd_pcm_hw_params_set_channels)(snd_pcm_t *pcm, snd_pcm_hw_params_t *params, unsigned int val);
+-	int (* snd_pcm_hw_params)(snd_pcm_t *pcm, snd_pcm_hw_params_t *params);
+-	int (* snd_pcm_hw_params_get_periods)(const snd_pcm_hw_params_t *params, unsigned int *val, int *dir);
+-	int (* snd_pcm_hw_params_get_period_size)(const snd_pcm_hw_params_t *params, snd_pcm_uframes_t *frames, int *dir);
+-	int (* snd_pcm_hw_params_get_period_size_min)(const snd_pcm_hw_params_t *params, snd_pcm_uframes_t *frames, int *dir);
+-	int (* snd_pcm_hw_params_get_buffer_size)(const snd_pcm_hw_params_t *params, snd_pcm_uframes_t *val);
+-} cw_alsa = {
+-	.handle = NULL,
+-
+-	.snd_pcm_open = NULL,
+-	.snd_pcm_close = NULL,
+-	.snd_pcm_prepare = NULL,
+-	.snd_pcm_drop = NULL,
+-	.snd_pcm_writei = NULL,
+-
+-	.snd_strerror = NULL,
+-
+-	.snd_pcm_hw_params_malloc = NULL,
+-	.snd_pcm_hw_params_any = NULL,
+-	.snd_pcm_hw_params_set_format = NULL,
+-	.snd_pcm_hw_params_set_rate_near = NULL,
+-	.snd_pcm_hw_params_set_access = NULL,
+-	.snd_pcm_hw_params_set_channels = NULL,
+-	.snd_pcm_hw_params = NULL,
+-	.snd_pcm_hw_params_get_periods = NULL,
+-	.snd_pcm_hw_params_get_period_size = NULL,
+-	.snd_pcm_hw_params_get_period_size_min = NULL,
+-	.snd_pcm_hw_params_get_buffer_size = NULL
+-};
+-
+-
+-
+-
+-
+ 
+ /**
+    \brief Check if it is possible to open ALSA output
+@@ -144,34 +92,19 @@ static struct {
+ */
+ bool cw_is_alsa_possible(const char *device)
+ {
+-	const char *library_name = "libasound.so.2";
+-	if (!cw_dlopen_internal(library_name, &(cw_alsa.handle))) {
+-		cw_debug_msg ((&cw_debug_object), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_ERROR,
+-			      "cw_alsa: can't access ALSA library \"%s\"", library_name);
+-		return false;
+-	}
+-
+-	int rv = cw_alsa_dlsym_internal(cw_alsa.handle);
+-	if (rv < 0) {
+-		cw_debug_msg ((&cw_debug_object), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_ERROR,
+-			      "cw_alsa: failed to resolve ALSA symbol #%d, can't correctly load ALSA library", rv);
+-		dlclose(cw_alsa.handle);
+-		return false;
+-	}
+-
+-	const char *dev = device ? device : CW_DEFAULT_ALSA_DEVICE;
++        int rv;
++        const char *dev = device ? device : CW_DEFAULT_ALSA_DEVICE;
+ 	snd_pcm_t *alsa_handle;
+-	rv = cw_alsa.snd_pcm_open(&alsa_handle,
++	rv = snd_pcm_open(&alsa_handle,
+ 				  dev,                     /* name */
+ 				  SND_PCM_STREAM_PLAYBACK, /* stream (playback/capture) */
+ 				  0);                      /* mode, 0 | SND_PCM_NONBLOCK | SND_PCM_ASYNC */
+ 	if (rv < 0) {
+ 		cw_debug_msg ((&cw_debug_object), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_ERROR,
+ 			      "cw_alsa: can't open ALSA device \"%s\"", dev);
+-		dlclose(cw_alsa.handle);
+ 		return false;
+ 	} else {
+-		cw_alsa.snd_pcm_close(alsa_handle);
++		snd_pcm_close(alsa_handle);
+ 		return true;
+ 	}
+ }
+@@ -204,7 +137,7 @@ int cw_alsa_write_internal(cw_gen_t *gen)
+ 	/* Send audio buffer to ALSA.
+ 	   Size of correct and current data in the buffer is the same as
+ 	   ALSA's period, so there should be no underruns */
+-	int rv = cw_alsa.snd_pcm_writei(gen->alsa_data.handle, gen->buffer, gen->buffer_n_samples);
++	int rv = snd_pcm_writei(gen->alsa_data.handle, gen->buffer, gen->buffer_n_samples);
+ 	cw_alsa_debug_evaluate_write_internal(gen, rv);
+ 	/*
+ 	cw_debug_msg ((&cw_debug_object_dev), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_INFO,
+@@ -231,7 +164,7 @@ int cw_alsa_write_internal(cw_gen_t *gen)
+ */
+ int cw_alsa_open_device_internal(cw_gen_t *gen)
+ {
+-	int rv = cw_alsa.snd_pcm_open(&gen->alsa_data.handle,
++	int rv = snd_pcm_open(&gen->alsa_data.handle,
+ 				      gen->audio_device,       /* name */
+ 				      SND_PCM_STREAM_PLAYBACK, /* stream (playback/capture) */
+ 				      0);                      /* mode, 0 | SND_PCM_NONBLOCK | SND_PCM_ASYNC */
+@@ -251,7 +184,7 @@ int cw_alsa_open_device_internal(cw_gen_t *gen)
+ 	/* TODO: move this to cw_alsa_set_hw_params_internal(),
+ 	   deallocate hw_params */
+ 	snd_pcm_hw_params_t *hw_params = NULL;
+-	rv = cw_alsa.snd_pcm_hw_params_malloc(&hw_params);
++	rv = snd_pcm_hw_params_malloc(&hw_params);
+ 	if (rv < 0) {
+ 		cw_debug_msg ((&cw_debug_object), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_ERROR,
+ 			      "cw_alsa: can't allocate memory for ALSA hw params");
+@@ -265,7 +198,7 @@ int cw_alsa_open_device_internal(cw_gen_t *gen)
+ 		return CW_FAILURE;
+ 	}
+ 
+-	rv = cw_alsa.snd_pcm_prepare(gen->alsa_data.handle);
++	rv = snd_pcm_prepare(gen->alsa_data.handle);
+ 	if (rv < 0) {
+ 		cw_debug_msg ((&cw_debug_object), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_ERROR,
+ 			      "cw_alsa: can't prepare ALSA handler");
+@@ -275,7 +208,7 @@ int cw_alsa_open_device_internal(cw_gen_t *gen)
+ 	/* Get size for data buffer */
+ 	snd_pcm_uframes_t frames; /* period size in frames */
+ 	int dir = 1;
+-	rv = cw_alsa.snd_pcm_hw_params_get_period_size_min(hw_params, &frames, &dir);
++	rv = snd_pcm_hw_params_get_period_size_min(hw_params, &frames, &dir);
+ 	cw_debug_msg ((&cw_debug_object_dev), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_INFO,
+ 		      "cw_alsa: rv = %d, ALSA buffer size would be %u frames", rv, (unsigned int) frames);
+ 
+@@ -305,14 +238,11 @@ int cw_alsa_open_device_internal(cw_gen_t *gen)
+ void cw_alsa_close_device_internal(cw_gen_t *gen)
+ {
+ 	/* "Stop a PCM dropping pending frames. " */
+-	cw_alsa.snd_pcm_drop(gen->alsa_data.handle);
+-	cw_alsa.snd_pcm_close(gen->alsa_data.handle);
++	snd_pcm_drop(gen->alsa_data.handle);
++	snd_pcm_close(gen->alsa_data.handle);
+ 
+ 	gen->audio_device_is_open = false;
+ 
+-	if (cw_alsa.handle) {
+-		dlclose(cw_alsa.handle);
+-	}
+ 
+ #if CW_DEV_RAW_SINK
+ 	if (gen->dev_raw_sink != -1) {
+@@ -332,11 +262,11 @@ int cw_alsa_debug_evaluate_write_internal(cw_gen_t *gen, int rv)
+ 	if (rv == -EPIPE) {
+ 		cw_debug_msg ((&cw_debug_object), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_WARNING,
+ 			      "cw_alsa: underrun");
+-		cw_alsa.snd_pcm_prepare(gen->alsa_data.handle);
++		snd_pcm_prepare(gen->alsa_data.handle);
+ 	} else if (rv < 0) {
+ 		cw_debug_msg ((&cw_debug_object), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_WARNING,
+-			      "cw_alsa: writei: %s", cw_alsa.snd_strerror(rv));
+-		cw_alsa.snd_pcm_prepare(gen->alsa_data.handle);
++			      "cw_alsa: writei: %s", snd_strerror(rv));
++		snd_pcm_prepare(gen->alsa_data.handle);
+ 	} else if (rv != gen->buffer_n_samples) {
+ 		cw_debug_msg ((&cw_debug_object), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_WARNING,
+ 			      "cw_alsa: short write, %d != %d", rv, gen->buffer_n_samples);
+@@ -363,19 +293,19 @@ int cw_alsa_debug_evaluate_write_internal(cw_gen_t *gen, int rv)
+ int cw_alsa_set_hw_params_internal(cw_gen_t *gen, snd_pcm_hw_params_t *hw_params)
+ {
+ 	/* Get current hw configuration. */
+-	int rv = cw_alsa.snd_pcm_hw_params_any(gen->alsa_data.handle, hw_params);
++	int rv = snd_pcm_hw_params_any(gen->alsa_data.handle, hw_params);
+ 	if (rv < 0) {
+ 		cw_debug_msg ((&cw_debug_object), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_ERROR,
+-			      "cw_alsa: get current hw params: %s", cw_alsa.snd_strerror(rv));
++			      "cw_alsa: get current hw params: %s", snd_strerror(rv));
+ 		return CW_FAILURE;
+ 	}
+ 
+ 
+ 	/* Set the sample format */
+-	rv = cw_alsa.snd_pcm_hw_params_set_format(gen->alsa_data.handle, hw_params, CW_ALSA_SAMPLE_FORMAT);
++	rv = snd_pcm_hw_params_set_format(gen->alsa_data.handle, hw_params, CW_ALSA_SAMPLE_FORMAT);
+ 	if (rv < 0) {
+ 		cw_debug_msg ((&cw_debug_object), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_ERROR,
+-			      "cw_alsa: can't set sample format: %s", cw_alsa.snd_strerror(rv));
++			      "cw_alsa: can't set sample format: %s", snd_strerror(rv));
+ 		return CW_FAILURE;
+ 	}
+ 
+@@ -387,7 +317,7 @@ int cw_alsa_set_hw_params_internal(cw_gen_t *gen, snd_pcm_hw_params_t *hw_params
+ 	bool success = false;
+ 	for (int i = 0; cw_supported_sample_rates[i]; i++) {
+ 		rate = cw_supported_sample_rates[i];
+-		int rv = cw_alsa.snd_pcm_hw_params_set_rate_near(gen->alsa_data.handle, hw_params, &rate, &dir);
++		int rv = snd_pcm_hw_params_set_rate_near(gen->alsa_data.handle, hw_params, &rate, &dir);
+ 		if (!rv) {
+ 			if (rate != cw_supported_sample_rates[i]) {
+ 				cw_debug_msg ((&cw_debug_object_dev), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_WARNING, "cw_alsa: imprecise sample rate:");
+@@ -402,7 +332,7 @@ int cw_alsa_set_hw_params_internal(cw_gen_t *gen, snd_pcm_hw_params_t *hw_params
+ 
+ 	if (!success) {
+ 		cw_debug_msg ((&cw_debug_object), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_ERROR,
+-			      "cw_alsa: can't get sample rate: %s", cw_alsa.snd_strerror(rv));
++			      "cw_alsa: can't get sample rate: %s", snd_strerror(rv));
+ 		return CW_FAILURE;
+         } else {
+ 		cw_debug_msg ((&cw_debug_object_dev), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_INFO,
+@@ -410,18 +340,18 @@ int cw_alsa_set_hw_params_internal(cw_gen_t *gen, snd_pcm_hw_params_t *hw_params
+ 	}
+ 
+ 	/* Set PCM access type */
+-	rv = cw_alsa.snd_pcm_hw_params_set_access(gen->alsa_data.handle, hw_params, SND_PCM_ACCESS_RW_INTERLEAVED);
++	rv = snd_pcm_hw_params_set_access(gen->alsa_data.handle, hw_params, SND_PCM_ACCESS_RW_INTERLEAVED);
+ 	if (rv < 0) {
+ 		cw_debug_msg ((&cw_debug_object), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_ERROR,
+-			      "cw_alsa: can't set access type: %s", cw_alsa.snd_strerror(rv));
++			      "cw_alsa: can't set access type: %s", snd_strerror(rv));
+ 		return CW_FAILURE;
+ 	}
+ 
+ 	/* Set number of channels */
+-	rv = cw_alsa.snd_pcm_hw_params_set_channels(gen->alsa_data.handle, hw_params, CW_AUDIO_CHANNELS);
++	rv = snd_pcm_hw_params_set_channels(gen->alsa_data.handle, hw_params, CW_AUDIO_CHANNELS);
+ 	if (rv < 0) {
+ 		cw_debug_msg ((&cw_debug_object), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_ERROR,
+-			      "cw_alsa: can't set number of channels: %s", cw_alsa.snd_strerror(rv));
++			      "cw_alsa: can't set number of channels: %s", snd_strerror(rv));
+ 		return CW_FAILURE;
+ 	}
+ 
+@@ -496,7 +426,7 @@ int cw_alsa_set_hw_params_internal(cw_gen_t *gen, snd_pcm_hw_params_t *hw_params
+ 		snd_pcm_uframes_t accepted = 0; /* buffer size in frames  */
+ 		dir = 0;
+ 		for (snd_pcm_uframes_t val = 0; val < 10000; val++) {
+-			rv = cw_alsa.snd_pcm_hw_params_test_buffer_size(gen->alsa_data.handle, hw_params, val);
++			rv = snd_pcm_hw_params_test_buffer_size(gen->alsa_data.handle, hw_params, val);
+ 			if (rv == 0) {
+ 				cw_debug_msg ((&cw_debug_object_dev), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_INFO,
+ 					      "cw_alsa: accepted buffer size: %u", (unsigned int) accepted);
+@@ -507,10 +437,10 @@ int cw_alsa_set_hw_params_internal(cw_gen_t *gen, snd_pcm_hw_params_t *hw_params
+ 		}
+ 
+ 		if (accepted > 0) {
+-			rv = cw_alsa.snd_pcm_hw_params_set_buffer_size(gen->alsa_data.handle, hw_params, accepted);
++			rv = snd_pcm_hw_params_set_buffer_size(gen->alsa_data.handle, hw_params, accepted);
+ 			if (rv < 0) {
+ 				cw_debug_msg ((&cw_debug_object), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_ERROR,
+-					      "cw_alsa: can't set accepted buffer size %u: %s", (unsigned int) accepted, cw_alsa.snd_strerror(rv));
++					      "cw_alsa: can't set accepted buffer size %u: %s", (unsigned int) accepted, snd_strerror(rv));
+ 			}
+ 		} else {
+ 			cw_debug_msg ((&cw_debug_object), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_ERROR,
+@@ -526,7 +456,7 @@ int cw_alsa_set_hw_params_internal(cw_gen_t *gen, snd_pcm_hw_params_t *hw_params
+ 		/* this limit should be enough, "accepted" on my machine is 8 */
+ 		const unsigned int n_periods_max = 30;
+ 		for (unsigned int val = 1; val < n_periods_max; val++) {
+-			rv = cw_alsa.snd_pcm_hw_params_test_periods(gen->alsa_data.handle, hw_params, val, dir);
++			rv = snd_pcm_hw_params_test_periods(gen->alsa_data.handle, hw_params, val, dir);
+ 			if (rv == 0) {
+ 				accepted = val;
+ 				cw_debug_msg ((&cw_debug_object_dev), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_INFO,
+@@ -534,10 +464,10 @@ int cw_alsa_set_hw_params_internal(cw_gen_t *gen, snd_pcm_hw_params_t *hw_params
+ 			}
+ 		}
+ 		if (accepted > 0) {
+-			rv = cw_alsa.snd_pcm_hw_params_set_periods(gen->alsa_data.handle, hw_params, accepted, dir);
++			rv = snd_pcm_hw_params_set_periods(gen->alsa_data.handle, hw_params, accepted, dir);
+ 			if (rv < 0) {
+ 				cw_debug_msg ((&cw_debug_object_dev), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_ERROR,
+-					      "cw_alsa: can't set accepted number of periods %d: %s", accepted, cw_alsa.snd_strerror(rv));
++					      "cw_alsa: can't set accepted number of periods %d: %s", accepted, snd_strerror(rv));
+ 			}
+ 		} else {
+ 			cw_debug_msg ((&cw_debug_object), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_ERROR,
+@@ -549,7 +479,7 @@ int cw_alsa_set_hw_params_internal(cw_gen_t *gen, snd_pcm_hw_params_t *hw_params
+ 		/* Test period size */
+ 		dir = 0;
+ 		for (snd_pcm_uframes_t val = 0; val < 100000; val++) {
+-			rv = cw_alsa.snd_pcm_hw_params_test_period_size(gen->alsa_data.handle, hw_params, val, dir);
++			rv = snd_pcm_hw_params_test_period_size(gen->alsa_data.handle, hw_params, val, dir);
+ 			if (rv == 0) {
+ 				cw_debug_msg ((&cw_debug_object_dev), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_INFO,
+ 					      "cw_alsa: accepted period size: %lu", val);
+@@ -562,7 +492,7 @@ int cw_alsa_set_hw_params_internal(cw_gen_t *gen, snd_pcm_hw_params_t *hw_params
+ 		/* Test buffer time */
+ 		dir = 0;
+ 		for (unsigned int val = 0; val < 100000; val++) {
+-			rv = cw_alsa.snd_pcm_hw_params_test_buffer_time(gen->alsa_data.handle, hw_params, val, dir);
++			rv = snd_pcm_hw_params_test_buffer_time(gen->alsa_data.handle, hw_params, val, dir);
+ 			if (rv == 0) {
+ 				cw_debug_msg ((&cw_debug_object_dev), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_INFO,
+ 					      "cw_alsa: accepted buffer time: %d", val);
+@@ -573,10 +503,10 @@ int cw_alsa_set_hw_params_internal(cw_gen_t *gen, snd_pcm_hw_params_t *hw_params
+ #endif /* #if CW_ALSA_HW_BUFFER_CONFIG */
+ 
+ 	/* Save hw parameters to device */
+-	rv = cw_alsa.snd_pcm_hw_params(gen->alsa_data.handle, hw_params);
++	rv = snd_pcm_hw_params(gen->alsa_data.handle, hw_params);
+ 	if (rv < 0) {
+ 		cw_debug_msg ((&cw_debug_object), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_ERROR,
+-			      "cw_alsa: can't save hw parameters: %s", cw_alsa.snd_strerror(rv));
++			      "cw_alsa: can't save hw parameters: %s", snd_strerror(rv));
+ 		return CW_FAILURE;
+ 	} else {
+ 		return CW_SUCCESS;
+@@ -600,30 +530,30 @@ int cw_alsa_print_params_internal(snd_pcm_hw_params_t *hw_params)
+ 	unsigned int val = 0;
+ 	int dir = 0;
+ 
+-	int rv = cw_alsa.snd_pcm_hw_params_get_periods(hw_params, &val, &dir);
++	int rv = snd_pcm_hw_params_get_periods(hw_params, &val, &dir);
+ 	if (rv < 0) {
+ 		cw_debug_msg ((&cw_debug_object), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_ERROR,
+-			      "cw_alsa: can't get 'periods': %s", cw_alsa.snd_strerror(rv));
++			      "cw_alsa: can't get 'periods': %s", snd_strerror(rv));
+ 	} else {
+ 		cw_debug_msg ((&cw_debug_object_dev), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_INFO,
+ 			      "cw_alsa: 'periods' = %u", val);
+ 	}
+ 
+ 	snd_pcm_uframes_t period_size = 0;
+-	rv = cw_alsa.snd_pcm_hw_params_get_period_size(hw_params, &period_size, &dir);
++	rv = snd_pcm_hw_params_get_period_size(hw_params, &period_size, &dir);
+ 	if (rv < 0) {
+ 		cw_debug_msg ((&cw_debug_object), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_ERROR,
+-			      "cw_alsa: can't get 'period size': %s", cw_alsa.snd_strerror(rv));
++			      "cw_alsa: can't get 'period size': %s", snd_strerror(rv));
+ 	} else {
+ 		cw_debug_msg ((&cw_debug_object_dev), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_INFO,
+ 			      "cw_alsa: 'period size' = %u", (unsigned int) period_size);
+ 	}
+ 
+ 	snd_pcm_uframes_t buffer_size;
+-	rv = cw_alsa.snd_pcm_hw_params_get_buffer_size(hw_params, &buffer_size);
++	rv = snd_pcm_hw_params_get_buffer_size(hw_params, &buffer_size);
+ 	if (rv < 0) {
+ 		cw_debug_msg ((&cw_debug_object), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_ERROR,
+-			      "cw_alsa: can't get buffer size: %s", cw_alsa.snd_strerror(rv));
++			      "cw_alsa: can't get buffer size: %s", snd_strerror(rv));
+ 	} else {
+ 		cw_debug_msg ((&cw_debug_object_dev), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_INFO,
+ 			      "cw_alsa: 'buffer size' = %u", (unsigned int) buffer_size);
+@@ -642,70 +572,9 @@ int cw_alsa_print_params_internal(snd_pcm_hw_params_t *hw_params)
+ 
+ 
+ 
+-/**
+-   \brief Resolve/get symbols from ALSA library
+-
+-   Function resolves/gets addresses of few ALSA functions used by
+-   libcw and stores them in cw_alsa global variable.
+-
+-   On failure the function returns negative value, different for every
+-   symbol that the funciton failed to resolve. Function stops and returns
+-   on first failure.
+-
+-   \param handle - handle to open ALSA library
+-
+-   \return 0 on success
+-   \return negative value on failure
+-*/
+-static int cw_alsa_dlsym_internal(void *handle)
+-{
+-	*(void **) &(cw_alsa.snd_pcm_open)    = dlsym(handle, "snd_pcm_open");
+-	if (!cw_alsa.snd_pcm_open)    return -1;
+-	*(void **) &(cw_alsa.snd_pcm_close)   = dlsym(handle, "snd_pcm_close");
+-	if (!cw_alsa.snd_pcm_close)   return -2;
+-	*(void **) &(cw_alsa.snd_pcm_prepare) = dlsym(handle, "snd_pcm_prepare");
+-	if (!cw_alsa.snd_pcm_prepare) return -3;
+-	*(void **) &(cw_alsa.snd_pcm_drop)    = dlsym(handle, "snd_pcm_drop");
+-	if (!cw_alsa.snd_pcm_drop)    return -4;
+-	*(void **) &(cw_alsa.snd_pcm_writei)  = dlsym(handle, "snd_pcm_writei");
+-	if (!cw_alsa.snd_pcm_writei)  return -5;
+-
+-	*(void **) &(cw_alsa.snd_strerror) = dlsym(handle, "snd_strerror");
+-	if (!cw_alsa.snd_strerror) return -10;
+-
+-	*(void **) &(cw_alsa.snd_pcm_hw_params_malloc)               = dlsym(handle, "snd_pcm_hw_params_malloc");
+-	if (!cw_alsa.snd_pcm_hw_params_malloc)              return -20;
+-	*(void **) &(cw_alsa.snd_pcm_hw_params_any)                  = dlsym(handle, "snd_pcm_hw_params_any");
+-	if (!cw_alsa.snd_pcm_hw_params_any)                 return -21;
+-	*(void **) &(cw_alsa.snd_pcm_hw_params_set_format)           = dlsym(handle, "snd_pcm_hw_params_set_format");
+-	if (!cw_alsa.snd_pcm_hw_params_set_format)          return -22;
+-	*(void **) &(cw_alsa.snd_pcm_hw_params_set_rate_near)        = dlsym(handle, "snd_pcm_hw_params_set_rate_near");
+-	if (!cw_alsa.snd_pcm_hw_params_set_rate_near)       return -23;
+-	*(void **) &(cw_alsa.snd_pcm_hw_params_set_access)           = dlsym(handle, "snd_pcm_hw_params_set_access");
+-	if (!cw_alsa.snd_pcm_hw_params_set_access)          return -24;
+-	*(void **) &(cw_alsa.snd_pcm_hw_params_set_channels)         = dlsym(handle, "snd_pcm_hw_params_set_channels");
+-	if (!cw_alsa.snd_pcm_hw_params_set_channels)        return -25;
+-	*(void **) &(cw_alsa.snd_pcm_hw_params)                      = dlsym(handle, "snd_pcm_hw_params");
+-	if (!cw_alsa.snd_pcm_hw_params)                     return -26;
+-	*(void **) &(cw_alsa.snd_pcm_hw_params_get_periods)          = dlsym(handle, "snd_pcm_hw_params_get_periods");
+-	if (!cw_alsa.snd_pcm_hw_params_get_periods)         return -27;
+-	*(void **) &(cw_alsa.snd_pcm_hw_params_get_period_size)      = dlsym(handle, "snd_pcm_hw_params_get_period_size");
+-	if (!cw_alsa.snd_pcm_hw_params_get_period_size)     return -28;
+-	*(void **) &(cw_alsa.snd_pcm_hw_params_get_period_size_min)  = dlsym(handle, "snd_pcm_hw_params_get_period_size_min");
+-	if (!cw_alsa.snd_pcm_hw_params_get_period_size_min) return -29;
+-	*(void **) &(cw_alsa.snd_pcm_hw_params_get_buffer_size)      = dlsym(handle, "snd_pcm_hw_params_get_buffer_size");
+-	if (!cw_alsa.snd_pcm_hw_params_get_buffer_size)     return -30;
+-
+-	return 0;
+-}
+-
+-
+-
+-
+-
+ void cw_alsa_drop(cw_gen_t *gen)
+ {
+-	cw_alsa.snd_pcm_drop(gen->alsa_data.handle);
++	snd_pcm_drop(gen->alsa_data.handle);
+ 
+ 	return;
+ }
+@@ -721,7 +590,7 @@ void cw_alsa_drop(cw_gen_t *gen)
+ 
+ 
+ #include <stdbool.h>
+-#include "libcw_alsa.h"
++#include "libh"
+ 
+ 
+ 
+diff --git a/src/libcw/libcw_pa.c b/src/libcw/libcw_pa.c
+index 8269e9d..e190200 100644
+--- a/src/libcw/libcw_pa.c
++++ b/src/libcw/libcw_pa.c
+@@ -39,7 +39,6 @@
+ #include <unistd.h>
+ #include <stdlib.h>
+ #include <stdbool.h>
+-#include <dlfcn.h> /* dlopen() and related symbols */
+ #include <string.h>
+ #include <assert.h>
+ #include <sys/types.h>
+@@ -63,39 +62,12 @@ extern cw_debug_t cw_debug_object_dev;
+ 
+ 
+ static pa_simple *cw_pa_simple_new_internal(pa_sample_spec *ss, pa_buffer_attr *ba, const char *device, const char *stream_name, int *error);
+-static int        cw_pa_dlsym_internal(void *handle);
+ static int        cw_pa_open_device_internal(cw_gen_t *gen);
+ static void       cw_pa_close_device_internal(cw_gen_t *gen);
+ static int        cw_pa_write_internal(cw_gen_t *gen);
+ 
+ 
+ 
+-static struct {
+-	void *handle;
+-
+-	pa_simple *(* pa_simple_new)(const char *server, const char *name, pa_stream_direction_t dir, const char *dev, const char *stream_name, const pa_sample_spec *ss, const pa_channel_map *map, const pa_buffer_attr *attr, int *error);
+-	void       (* pa_simple_free)(pa_simple *s);
+-	int        (* pa_simple_write)(pa_simple *s, const void *data, size_t bytes, int *error);
+-	pa_usec_t  (* pa_simple_get_latency)(pa_simple *s, int *error);
+-	int        (* pa_simple_drain)(pa_simple *s, int *error);
+-
+-	size_t     (* pa_usec_to_bytes)(pa_usec_t t, const pa_sample_spec *spec);
+-	char      *(* pa_strerror)(int error);
+-} cw_pa = {
+-	.handle = NULL,
+-
+-	.pa_simple_new = NULL,
+-	.pa_simple_free = NULL,
+-	.pa_simple_write = NULL,
+-	.pa_simple_get_latency = NULL,
+-	.pa_simple_drain = NULL,
+-
+-	.pa_usec_to_bytes = NULL,
+-	.pa_strerror = NULL
+-};
+-
+-
+-
+ 
+ static const pa_sample_format_t CW_PA_SAMPLE_FORMAT = PA_SAMPLE_S16LE; /* Signed 16 bit, Little Endian */
+ static const int CW_PA_BUFFER_N_SAMPLES = 1024;
+@@ -117,21 +89,6 @@ static const int CW_PA_BUFFER_N_SAMPLES = 1024;
+ */
+ bool cw_is_pa_possible(const char *device)
+ {
+-	const char *library_name = "libpulse-simple.so";
+-	if (!cw_dlopen_internal(library_name, &(cw_pa.handle))) {
+-		cw_debug_msg ((&cw_debug_object), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_ERROR,
+-			      "libcw_pa: can't access PulseAudio library \"%s\"", library_name);
+-		return false;
+-	}
+-
+-	int rv = cw_pa_dlsym_internal(cw_pa.handle);
+-	if (rv < 0) {
+-		cw_debug_msg ((&cw_debug_object), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_ERROR,
+-			      "libcw_pa: failed to resolve PulseAudio symbol #%d, can't correctly load PulseAudio library", rv);
+-		dlclose(cw_pa.handle);
+-		return false;
+-	}
+-
+ 	const char *dev = (char *) NULL;
+ 	if (device && strcmp(device, CW_DEFAULT_PA_DEVICE)) {
+ 		dev = device;
+@@ -145,13 +102,10 @@ bool cw_is_pa_possible(const char *device)
+ 
+ 	if (!s) {
+ 		cw_debug_msg ((&cw_debug_object), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_ERROR,
+-			      "libcw_pa: can't connect to PulseAudio server: %s", cw_pa.pa_strerror(error));
+-		if (cw_pa.handle) {
+-			dlclose(cw_pa.handle);
+-		}
++			      "libcw_pa: can't connect to PulseAudio server: %s", pa_strerror(error));
+ 		return false;
+ 	} else {
+-		cw_pa.pa_simple_free(s);
++		pa_simple_free(s);
+ 		s = NULL;
+ 		return true;
+ 	}
+@@ -186,10 +140,10 @@ int cw_pa_write_internal(cw_gen_t *gen)
+ 
+ 	int error = 0;
+ 	size_t n_bytes = sizeof (gen->buffer[0]) * gen->buffer_n_samples;
+-	int rv = cw_pa.pa_simple_write(gen->pa_data.s, gen->buffer, n_bytes, &error);
++	int rv = pa_simple_write(gen->pa_data.s, gen->buffer, n_bytes, &error);
+ 	if (rv < 0) {
+ 		cw_debug_msg ((&cw_debug_object), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_ERROR,
+-			      "libcw_pa: pa_simple_write() failed: %s", cw_pa.pa_strerror(error));
++			      "libcw_pa: pa_simple_write() failed: %s", pa_strerror(error));
+ 	} else {
+ 		//cw_debug_msg ((&cw_debug_object_dev), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_INFO, "libcw_pa: written %d samples with PulseAudio", gen->buffer_n_samples);
+ 	}
+@@ -237,13 +191,13 @@ pa_simple *cw_pa_simple_new_internal(pa_sample_spec *ss, pa_buffer_attr *ba, con
+ 	}
+ 
+ 	// http://www.mail-archive.com/pulseaudio-tickets@mail.0pointer.de/msg03295.html
+-	ba->tlength = cw_pa.pa_usec_to_bytes(50*1000, ss);
+-	ba->minreq = cw_pa.pa_usec_to_bytes(0, ss);
+-	ba->maxlength = cw_pa.pa_usec_to_bytes(50*1000, ss);
++	ba->tlength = pa_usec_to_bytes(50*1000, ss);
++	ba->minreq = pa_usec_to_bytes(0, ss);
++	ba->maxlength = pa_usec_to_bytes(50*1000, ss);
+ 	/* ba->prebuf = ; */ /* ? */
+ 	/* ba->fragsize = sizeof(uint32_t) -1; */ /* not relevant to playback */
+ 
+-	pa_simple *s = cw_pa.pa_simple_new(NULL,                  /* server name (NULL for default) */
++	pa_simple *s = pa_simple_new(NULL,                  /* server name (NULL for default) */
+ 					   "libcw",               /* descriptive name of client (application name etc.) */
+ 					   PA_STREAM_PLAYBACK,    /* stream direction */
+ 					   dev,                   /* device/sink name (NULL for default) */
+@@ -258,47 +212,6 @@ pa_simple *cw_pa_simple_new_internal(pa_sample_spec *ss, pa_buffer_attr *ba, con
+ 
+ 
+ 
+-
+-
+-/**
+-   \brief Resolve/get symbols from PulseAudio library
+-
+-   Function resolves/gets addresses of few PulseAudio functions used by
+-   libcw and stores them in cw_pa global variable.
+-
+-   On failure the function returns negative value, different for every
+-   symbol that the funciton failed to resolve. Function stops and returns
+-   on first failure.
+-
+-   \param handle - handle to open PulseAudio library
+-
+-   \return 0 on success
+-   \return negative value on failure
+-*/
+-int cw_pa_dlsym_internal(void *handle)
+-{
+-	*(void **) &(cw_pa.pa_simple_new)         = dlsym(handle, "pa_simple_new");
+-	if (!cw_pa.pa_simple_new)         return -1;
+-	*(void **) &(cw_pa.pa_simple_free)        = dlsym(handle, "pa_simple_free");
+-	if (!cw_pa.pa_simple_free)        return -2;
+-	*(void **) &(cw_pa.pa_simple_write)       = dlsym(handle, "pa_simple_write");
+-	if (!cw_pa.pa_simple_write)       return -3;
+-	*(void **) &(cw_pa.pa_strerror)           = dlsym(handle, "pa_strerror");
+-	if (!cw_pa.pa_strerror)           return -4;
+-	*(void **) &(cw_pa.pa_simple_get_latency) = dlsym(handle, "pa_simple_get_latency");
+-	if (!cw_pa.pa_simple_get_latency) return -5;
+-	*(void **) &(cw_pa.pa_simple_drain)       = dlsym(handle, "pa_simple_drain");
+-	if (!cw_pa.pa_simple_drain)       return -6;
+-	*(void **) &(cw_pa.pa_usec_to_bytes)      = dlsym(handle, "pa_usec_to_bytes");
+-	if (!cw_pa.pa_usec_to_bytes)       return -7;
+-
+-	return 0;
+-}
+-
+-
+-
+-
+-
+ /**
+    \brief Open PulseAudio output, associate it with given generator
+ 
+@@ -325,16 +238,16 @@ int cw_pa_open_device_internal(cw_gen_t *gen)
+ 
+  	if (!gen->pa_data.s) {
+ 		cw_debug_msg ((&cw_debug_object_dev), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_ERROR,
+-			      "libcw_pa: can't connect to PulseAudio server: %s", cw_pa.pa_strerror(error));
++			      "libcw_pa: can't connect to PulseAudio server: %s", pa_strerror(error));
+ 		return false;
+ 	}
+ 
+ 	gen->buffer_n_samples = CW_PA_BUFFER_N_SAMPLES;
+ 	gen->sample_rate = gen->pa_data.ss.rate;
+ 
+-	if ((gen->pa_data.latency_usecs = cw_pa.pa_simple_get_latency(gen->pa_data.s, &error)) == (pa_usec_t) -1) {
++	if ((gen->pa_data.latency_usecs = pa_simple_get_latency(gen->pa_data.s, &error)) == (pa_usec_t) -1) {
+ 		cw_debug_msg ((&cw_debug_object_dev), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_ERROR,
+-			      "libcw_pa: pa_simple_get_latency() failed: %s", cw_pa.pa_strerror(error));
++			      "libcw_pa: pa_simple_get_latency() failed: %s", pa_strerror(error));
+ 	}
+ 
+ #if CW_DEV_RAW_SINK
+@@ -357,20 +270,17 @@ void cw_pa_close_device_internal(cw_gen_t *gen)
+ 	if (gen->pa_data.s) {
+ 		/* Make sure that every single sample was played */
+ 		int error;
+-		if (cw_pa.pa_simple_drain(gen->pa_data.s, &error) < 0) {
++		if (pa_simple_drain(gen->pa_data.s, &error) < 0) {
+ 			cw_debug_msg ((&cw_debug_object_dev), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_ERROR,
+-				      "libcw_pa: pa_simple_drain() failed: %s", cw_pa.pa_strerror(error));
++				      "libcw_pa: pa_simple_drain() failed: %s", pa_strerror(error));
+ 		}
+-		cw_pa.pa_simple_free(gen->pa_data.s);
++		pa_simple_free(gen->pa_data.s);
+ 		gen->pa_data.s = NULL;
+ 	} else {
+ 		cw_debug_msg ((&cw_debug_object_dev), CW_DEBUG_SOUND_SYSTEM, CW_DEBUG_WARNING,
+ 			      "libcw_pa: called the function for NULL PA sink");
+ 	}
+ 
+-	if (cw_pa.handle) {
+-		dlclose(cw_pa.handle);
+-	}
+ 
+ #if CW_DEV_RAW_SINK
+ 	if (gen->dev_raw_sink != -1) {
+-- 
+2.16.2
+
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b66a6492345..c0ab0625a4f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -21243,6 +21243,8 @@ with pkgs;
 
   unicode-paracode = callPackage ../tools/misc/unicode { };
 
+  unixcw = callPackage ../applications/misc/unixcw { };
+
   valauncher = callPackage ../applications/misc/valauncher { };
 
   vault = callPackage ../tools/security/vault { };

From 4e85c4ff277c883edf67d87d5d7d158a49dc4850 Mon Sep 17 00:00:00 2001
From: volth <volth@webmaster.ms>
Date: Sun, 10 Jun 2018 17:31:09 +0000
Subject: [PATCH 037/161] lib: add groupBy (#38612)

---
 lib/default.nix |  2 +-
 lib/lists.nix   | 36 ++++++++++++++++++++++++++++++++++++
 2 files changed, 37 insertions(+), 1 deletion(-)

diff --git a/lib/default.nix b/lib/default.nix
index 4ca2e2ea6e3..aca484d9a8e 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -76,7 +76,7 @@ let
       optional optionals toList range partition zipListsWith zipLists
       reverseList listDfs toposort sort naturalSort compareLists take
       drop sublist last init crossLists unique intersectLists
-      subtractLists mutuallyExclusive;
+      subtractLists mutuallyExclusive groupBy groupBy';
     inherit (strings) concatStrings concatMapStrings concatImapStrings
       intersperse concatStringsSep concatMapStringsSep
       concatImapStringsSep makeSearchPath makeSearchPathOutput
diff --git a/lib/lists.nix b/lib/lists.nix
index 5ec97f5a07f..194e1c200ec 100644
--- a/lib/lists.nix
+++ b/lib/lists.nix
@@ -250,6 +250,42 @@ rec {
       else { right = t.right; wrong = [h] ++ t.wrong; }
     ) { right = []; wrong = []; });
 
+  /* Splits the elements of a list into many lists, using the return value of a predicate.
+     Predicate should return a string which becomes keys of attrset `groupBy' returns.
+
+     `groupBy'' allows to customise the combining function and initial value
+
+     Example:
+       groupBy (x: boolToString (x > 2)) [ 5 1 2 3 4 ]
+       => { true = [ 5 3 4 ]; false = [ 1 2 ]; }
+       groupBy (x: x.name) [ {name = "icewm"; script = "icewm &";}
+                             {name = "xfce";  script = "xfce4-session &";}
+                             {name = "icewm"; script = "icewmbg &";}
+                             {name = "mate";  script = "gnome-session &";}
+                           ]
+       => { icewm = [ { name = "icewm"; script = "icewm &"; }
+                      { name = "icewm"; script = "icewmbg &"; } ];
+            mate  = [ { name = "mate";  script = "gnome-session &"; } ];
+            xfce  = [ { name = "xfce";  script = "xfce4-session &"; } ];
+          }
+
+
+     groupBy' allows to customise the combining function and initial value
+
+     Example:
+       groupBy' builtins.add 0 (x: boolToString (x > 2)) [ 5 1 2 3 4 ]
+       => { true = 12; false = 3; }
+  */
+  groupBy' = op: nul: pred: lst:
+    foldl' (r: e:
+              let
+                key = pred e;
+              in
+                r // { ${key} = op (r.${key} or nul) e; }
+           ) {} lst;
+
+  groupBy = groupBy' (sum: e: sum ++ [e]) [];
+
   /* Merges two lists of the same size together. If the sizes aren't the same
      the merging stops at the shortest. How both lists are merged is defined
      by the first argument.

From f13812989415708c99c1a60f6cde088608a58864 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Sun, 10 Jun 2018 10:34:52 -0700
Subject: [PATCH 038/161] xmr-stak: 2.4.3 -> 2.4.4 (#41506)

Semi-automatic update generated by https://github.com/ryantm/nixpkgs-update tools.

This update was made based on information from https://repology.org/metapackage/xmr-stak/versions.

These checks were done:

- built on NixOS
- /nix/store/bfj12k7pz2bj2jzx3swkmz2kk3dfqx5p-xmr-stak-2.4.4/bin/xmr-stak passed the binary check.
- Warning: no invocation of /nix/store/bfj12k7pz2bj2jzx3swkmz2kk3dfqx5p-xmr-stak-2.4.4/bin/libxmrstak_opencl_backend.so had a zero exit code or showed the expected version
- 1 of 2 passed binary check by having a zero exit code.
- 0 of 2 passed binary check by having the new version present in output.
- found 2.4.4 with grep in /nix/store/bfj12k7pz2bj2jzx3swkmz2kk3dfqx5p-xmr-stak-2.4.4
- directory tree listing: https://gist.github.com/5ef7f1fd13c10bef56522a028b52c82e
- du listing: https://gist.github.com/be63ac59af2a152db46085c4509cdcd3
---
 pkgs/applications/misc/xmr-stak/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/misc/xmr-stak/default.nix b/pkgs/applications/misc/xmr-stak/default.nix
index 51fd2ee8064..5dcaeb1226e 100644
--- a/pkgs/applications/misc/xmr-stak/default.nix
+++ b/pkgs/applications/misc/xmr-stak/default.nix
@@ -12,13 +12,13 @@ in
 
 stdenv'.mkDerivation rec {
   name = "xmr-stak-${version}";
-  version = "2.4.3";
+  version = "2.4.4";
 
   src = fetchFromGitHub {
     owner = "fireice-uk";
     repo = "xmr-stak";
     rev = "${version}";
-    sha256 = "0plks4yyd9gjnfg7sfsgsvdgczkbghf5xjwb8bzv01f0fndn10r1";
+    sha256 = "1j75466hfs18w05k64yb60pw865ah226vjib46qr1wb1mcd82i5s";
   };
 
   NIX_CFLAGS_COMPILE = "-O3";

From 1f6f12381416daa0f54da13555619a58c6f133fb Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Sun, 10 Jun 2018 10:50:06 -0700
Subject: [PATCH 039/161] chromedriver: 2.38 -> 2.39 (#41580)

Semi-automatic update generated by https://github.com/ryantm/nixpkgs-update tools.

This update was made based on information from https://repology.org/metapackage/chromedriver/versions.

These checks were done:

- built on NixOS
- /nix/store/r7ai8p033gdhncxsfjjy3rb8qmcsvpqx-chromedriver-2.39/bin/chromedriver passed the binary check.
- Warning: no invocation of /nix/store/r7ai8p033gdhncxsfjjy3rb8qmcsvpqx-chromedriver-2.39/bin/.chromedriver-wrapped had a zero exit code or showed the expected version
- 1 of 2 passed binary check by having a zero exit code.
- 0 of 2 passed binary check by having the new version present in output.
- found 2.39 with grep in /nix/store/r7ai8p033gdhncxsfjjy3rb8qmcsvpqx-chromedriver-2.39
- directory tree listing: https://gist.github.com/ed47d14dfe1661b73d2d877b6e790579
- du listing: https://gist.github.com/63dc7bb82190375bce025de50ed2d6fa
---
 pkgs/development/tools/selenium/chromedriver/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/selenium/chromedriver/default.nix b/pkgs/development/tools/selenium/chromedriver/default.nix
index d865a20fbb9..f140c1a7450 100644
--- a/pkgs/development/tools/selenium/chromedriver/default.nix
+++ b/pkgs/development/tools/selenium/chromedriver/default.nix
@@ -6,7 +6,7 @@ let
   allSpecs = {
     "x86_64-linux" = {
       system = "linux64";
-      sha256 = "1h7avlns00hd44ayi53lvdj2l85h9higky0jk7bad07hm39nagks";
+      sha256 = "1rkdlf9v5lciaq3yp7cp2vwmca612vngbcnz55ck76jgx6rknh3g";
     };
 
     "x86_64-darwin" = {
@@ -28,7 +28,7 @@ let
 in
 stdenv.mkDerivation rec {
   name = "chromedriver-${version}";
-  version = "2.38";
+  version = "2.39";
 
   src = fetchurl {
     url = "http://chromedriver.storage.googleapis.com/${version}/chromedriver_${spec.system}.zip";

From 187878d0f1d0aa76ca28c4462b0a1dcf6484b44b Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Sun, 10 Jun 2018 10:51:11 -0700
Subject: [PATCH 040/161] acpica-tools: 20180508 -> 20180531 (#41575)

Semi-automatic update generated by https://github.com/ryantm/nixpkgs-update tools.

This update was made based on information from https://repology.org/metapackage/acpica-tools/versions.

These checks were done:

- built on NixOS
- /nix/store/x1sw7fxqaqayhy9hyvh57xc2zjg5d4yw-acpica-tools-20180531/bin/acpibin passed the binary check.
- /nix/store/x1sw7fxqaqayhy9hyvh57xc2zjg5d4yw-acpica-tools-20180531/bin/acpidump passed the binary check.
- /nix/store/x1sw7fxqaqayhy9hyvh57xc2zjg5d4yw-acpica-tools-20180531/bin/acpiexec passed the binary check.
- /nix/store/x1sw7fxqaqayhy9hyvh57xc2zjg5d4yw-acpica-tools-20180531/bin/acpihelp passed the binary check.
- /nix/store/x1sw7fxqaqayhy9hyvh57xc2zjg5d4yw-acpica-tools-20180531/bin/acpinames passed the binary check.
- /nix/store/x1sw7fxqaqayhy9hyvh57xc2zjg5d4yw-acpica-tools-20180531/bin/acpixtract passed the binary check.
- 6 of 6 passed binary check by having a zero exit code.
- 0 of 6 passed binary check by having the new version present in output.
- directory tree listing: https://gist.github.com/0bdfbe66fba66901dbdc08214997cf2d
- du listing: https://gist.github.com/28d13e951134d3565b807bef5d9610ec
---
 pkgs/tools/system/acpica-tools/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/system/acpica-tools/default.nix b/pkgs/tools/system/acpica-tools/default.nix
index edb7828f95b..c9a33bc64e0 100644
--- a/pkgs/tools/system/acpica-tools/default.nix
+++ b/pkgs/tools/system/acpica-tools/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "acpica-tools-${version}";
-  version = "20180508";
+  version = "20180531";
 
   src = fetchurl {
     url = "https://acpica.org/sites/acpica/files/acpica-unix-${version}.tar.gz";
-    sha256 = "1n7lqmv77kg28drahvxzybwl9v4hzwi8i7xkpgliclfcp5ff909b";
+    sha256 = "0rbn0anxs6r1ks1lgaxqhiv2kqgh4f1fq5qi2kdv7hir82mdqv4g";
   };
 
   NIX_CFLAGS_COMPILE = "-O3";

From c78ae4251f0ce38480d768960e9b98edd552783a Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Sun, 10 Jun 2018 10:52:31 -0700
Subject: [PATCH 041/161] altcoins.litecoin: 0.15.1 -> 0.16.0 (#41545)

Semi-automatic update generated by https://github.com/ryantm/nixpkgs-update tools.

This update was made based on information from https://repology.org/metapackage/litecoin/versions.

These checks were done:

- built on NixOS
- /nix/store/27nwgb0f89hmkhfd4rs7lp78dhdnmkd3-litecoin-0.16.0/bin/litecoind passed the binary check.
- /nix/store/27nwgb0f89hmkhfd4rs7lp78dhdnmkd3-litecoin-0.16.0/bin/litecoin-cli passed the binary check.
- /nix/store/27nwgb0f89hmkhfd4rs7lp78dhdnmkd3-litecoin-0.16.0/bin/litecoin-tx passed the binary check.
- /nix/store/27nwgb0f89hmkhfd4rs7lp78dhdnmkd3-litecoin-0.16.0/bin/test_litecoin passed the binary check.
- /nix/store/27nwgb0f89hmkhfd4rs7lp78dhdnmkd3-litecoin-0.16.0/bin/bench_litecoin passed the binary check.
- Warning: no invocation of /nix/store/27nwgb0f89hmkhfd4rs7lp78dhdnmkd3-litecoin-0.16.0/bin/litecoin-qt had a zero exit code or showed the expected version
- Warning: no invocation of /nix/store/27nwgb0f89hmkhfd4rs7lp78dhdnmkd3-litecoin-0.16.0/bin/test_litecoin-qt had a zero exit code or showed the expected version
- 5 of 7 passed binary check by having a zero exit code.
- 0 of 7 passed binary check by having the new version present in output.
- found 0.16.0 with grep in /nix/store/27nwgb0f89hmkhfd4rs7lp78dhdnmkd3-litecoin-0.16.0
- directory tree listing: https://gist.github.com/c4a75d440e40edc63d7f86819e60beda
- du listing: https://gist.github.com/72a199fee6e78c7261e85fc15fa3c1d6
---
 pkgs/applications/altcoins/litecoin.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/altcoins/litecoin.nix b/pkgs/applications/altcoins/litecoin.nix
index 12cf5dcb71c..b930923e8f4 100644
--- a/pkgs/applications/altcoins/litecoin.nix
+++ b/pkgs/applications/altcoins/litecoin.nix
@@ -8,13 +8,13 @@ with stdenv.lib;
 stdenv.mkDerivation rec {
 
   name = "litecoin" + (toString (optional (!withGui) "d")) + "-" + version;
-  version = "0.15.1";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "litecoin-project";
     repo = "litecoin";
     rev = "v${version}";
-    sha256 = "01q0lj0grabyfh67ar984m9lv9xs0rakadkci8jpfbp8xw166r40";
+    sha256 = "1g79sbplkn2bnb17i2kyh1d64bjl3ihbx83n0xssvjaajn56hbzw";
   };
 
   nativeBuildInputs = [ pkgconfig autoreconfHook ];

From ea806634934eca67db796ccd0887b2d37a9a5b9a Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Sun, 10 Jun 2018 10:56:41 -0700
Subject: [PATCH 042/161] chirp: 20180519 -> 20180606 (#41717)

Semi-automatic update generated by https://github.com/ryantm/nixpkgs-update tools.

This update was made based on information from https://repology.org/metapackage/chirp-daily/versions.

These checks were done:

- built on NixOS
- Warning: no invocation of /nix/store/i289vfzp7kk8h7q27cxcyfsp92yjsgk6-chirp-daily-20180606/bin/.chirpw-wrapped had a zero exit code or showed the expected version
- Warning: no invocation of /nix/store/i289vfzp7kk8h7q27cxcyfsp92yjsgk6-chirp-daily-20180606/bin/chirpw had a zero exit code or showed the expected version
- 0 of 2 passed binary check by having a zero exit code.
- 0 of 2 passed binary check by having the new version present in output.
- found 20180606 with grep in /nix/store/i289vfzp7kk8h7q27cxcyfsp92yjsgk6-chirp-daily-20180606
- directory tree listing: https://gist.github.com/17376dee8e40c9f3de24818bb3278341
- du listing: https://gist.github.com/aefa3450ce2ed4ccd781360dc0a1de4e
---
 pkgs/applications/misc/chirp/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/misc/chirp/default.nix b/pkgs/applications/misc/chirp/default.nix
index 90d7ecd082c..7004b247667 100644
--- a/pkgs/applications/misc/chirp/default.nix
+++ b/pkgs/applications/misc/chirp/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   name = "chirp-daily-${version}";
-  version = "20180519";
+  version = "20180606";
 
   src = fetchurl {
     url = "https://trac.chirp.danplanet.com/chirp_daily/daily-${version}/${name}.tar.gz";
-    sha256 = "1sb4cw95lcj2cdfzzgnwjgmnpk2nqjys4am5qvj4pnh0x447sznv";
+    sha256 = "1v1s02675gyghhxasp4pxjrifkgshc82p99haxph1yzkq7gsf03w";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From 95120f51092da50b2fed1f79afc966440b222fe3 Mon Sep 17 00:00:00 2001
From: "nagato.pain" <iuns@outlook.fr>
Date: Sun, 10 Jun 2018 11:04:20 -0700
Subject: [PATCH 043/161] pythonPakchages.python-hosts: init at 0.4.1

---
 .../python-modules/python-hosts/default.nix   | 33 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 35 insertions(+)
 create mode 100644 pkgs/development/python-modules/python-hosts/default.nix

diff --git a/pkgs/development/python-modules/python-hosts/default.nix b/pkgs/development/python-modules/python-hosts/default.nix
new file mode 100644
index 00000000000..08c617d750c
--- /dev/null
+++ b/pkgs/development/python-modules/python-hosts/default.nix
@@ -0,0 +1,33 @@
+{ stdenv, buildPythonPackage, fetchPypi, pyyaml, pytest, pytestcov }:
+
+buildPythonPackage rec {
+  pname = "python-hosts";
+  version = "0.4.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "4a169a4669bddb720c032ef0132203ff8a7b6646266f7e6ab349177bab02b3ba";
+  };
+
+  # win_inet_pton is required for windows support
+  prePatch = ''
+    substituteInPlace setup.py --replace "install_requires=['win_inet_pton']," ""
+    substituteInPlace python_hosts/utils.py --replace "import win_inet_pton" ""
+  '';
+
+  checkInputs = [ pyyaml pytest pytestcov ];
+
+  # Removing 1 test file (it requires internet connection) and keeping the other two
+  checkPhase = ''
+    pytest tests/test_hosts_entry.py
+    pytest tests/test_utils.py
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A library for managing a hosts file. It enables adding and removing entries, or importing them from a file or URL";
+    homepage = https://github.com/jonhadfield/python-hosts;
+    license = licenses.mit;
+    maintainers = with maintainers; [ psyanticy ];
+  };
+}
+
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 0a230853087..a0a3953804a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -410,6 +410,8 @@ in {
 
   pytest-tornado = callPackage ../development/python-modules/pytest-tornado { };
 
+  python-hosts = callPackage ../development/python-modules/python-hosts { };
+
   python-openid = callPackage (if isPy3k
     then ../development/python-modules/python3-openid
     else ../development/python-modules/python-openid) { };

From 1daa77160e92b372503c29e22bb82b1c263445ea Mon Sep 17 00:00:00 2001
From: Tristan Helmich <fadenb@users.noreply.github.com>
Date: Sun, 10 Jun 2018 20:10:01 +0200
Subject: [PATCH 044/161] tomcat service: fix webapps default option (#40657)

The old package tomcat.webapps does not exist
---
 nixos/modules/services/web-servers/tomcat.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/web-servers/tomcat.nix b/nixos/modules/services/web-servers/tomcat.nix
index aa94e0e976c..5abbbf09059 100644
--- a/nixos/modules/services/web-servers/tomcat.nix
+++ b/nixos/modules/services/web-servers/tomcat.nix
@@ -109,8 +109,8 @@ in
 
       webapps = mkOption {
         type = types.listOf types.package;
-        default = [ tomcat.webapps ];
-        defaultText = "[ tomcat.webapps ]";
+        default = [ tomcat85.webapps ];
+        defaultText = "[ tomcat85.webapps ]";
         description = "List containing WAR files or directories with WAR files which are web applications to be deployed on Tomcat";
       };
 

From 7a5e440d56a138a6c2a0e1f856a9dff2bb4c7394 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Sun, 10 Jun 2018 13:20:03 -0500
Subject: [PATCH 045/161] fira: update url

---
 pkgs/data/fonts/fira/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/data/fonts/fira/default.nix b/pkgs/data/fonts/fira/default.nix
index cddb8cd726a..ce6e011d8a6 100644
--- a/pkgs/data/fonts/fira/default.nix
+++ b/pkgs/data/fonts/fira/default.nix
@@ -3,17 +3,17 @@
 fetchzip rec {
   name = "fira-4.106";
 
-  url = http://www.carrois.com/downloads/fira_4_1/FiraFonts4106.zip;
+  url = https://github.com/mozilla/Fira/archive/4.106.zip;
 
   postFetch = ''
     mkdir -p $out/share/fonts
-    unzip -j $downloadedFile \*.otf -d $out/share/fonts/opentype
+    unzip -j $downloadedFile Fira-4.106/otf/FiraSans\*.otf -d $out/share/fonts/opentype
   '';
 
-  sha256 = "174nwmpvxqg1qjfj6h3yvrphs1s3n6zricdh27iaxilajm0ilbgs";
+  sha256 = "0c97nmihcq0ki7ywj8zn048a2bgrszc61lb9p0djfi65ar52jab4";
 
   meta = with stdenv.lib; {
-    homepage = http://www.carrois.com/fira-4-1/;
+    homepage = https://mozilla.github.io/Fira/;
     description = "Sans-serif font for Firefox OS";
     longDescription = ''
       Fira Sans is a sans-serif font designed by Erik Spiekermann,

From 55e0d5853175134d3c791887cac61d384858e34c Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Sun, 10 Jun 2018 13:21:23 -0500
Subject: [PATCH 046/161] fira-mono: update url

---
 pkgs/data/fonts/fira-mono/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/data/fonts/fira-mono/default.nix b/pkgs/data/fonts/fira-mono/default.nix
index 4fc6aab9510..2f50a83a70b 100644
--- a/pkgs/data/fonts/fira-mono/default.nix
+++ b/pkgs/data/fonts/fira-mono/default.nix
@@ -3,17 +3,17 @@
 fetchzip {
   name = "fira-mono-3.206";
 
-  url = http://www.carrois.com/downloads/fira_mono_3_2/FiraMonoFonts3206.zip;
+  url = https://github.com/mozilla/Fira/archive/4.106.zip;
 
   postFetch = ''
     mkdir -p $out/share/fonts
-    unzip -j $downloadedFile \*.otf -d $out/share/fonts/opentype
+    unzip -j $downloadedFile Fira-4.106/otf/FiraMono\*.otf -d $out/share/fonts/opentype
   '';
 
-  sha256 = "0m4kdjh4xjyznybpgh21a0gibv4wsxq0rqyl3wv942zk6mclmgdf";
+  sha256 = "1ci3fxhdwabvfj4nl16pwcgqnh7s2slp8vblribk8zkpx8cbp1dj";
 
   meta = with stdenv.lib; {
-    homepage = http://www.carrois.com/fira-4-1/;
+    homepage = https://mozilla.github.io/Fira/;
     description = "Monospace font for Firefox OS";
     longDescription = ''
       Fira Mono is a monospace font designed by Erik Spiekermann,

From e7af719b96874f70e712087f1c4de9bf48098424 Mon Sep 17 00:00:00 2001
From: Frank Doepper <woffs@woffs.de>
Date: Sun, 10 Jun 2018 20:37:28 +0200
Subject: [PATCH 047/161] loadwatch: 1.1 -> 1.1-1-g6d2544c

adopted the source and fixed the compiler warnings
---
 pkgs/tools/system/loadwatch/default.nix | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/pkgs/tools/system/loadwatch/default.nix b/pkgs/tools/system/loadwatch/default.nix
index ea1de93b270..eb7f1e3bb59 100644
--- a/pkgs/tools/system/loadwatch/default.nix
+++ b/pkgs/tools/system/loadwatch/default.nix
@@ -1,10 +1,11 @@
-{ stdenv, fetchurl, ... }:
+{ stdenv, fetchgit, ... }:
 
 stdenv.mkDerivation {
-  name = "loadwatch-1.1";
-  src = fetchurl {
-    url = "mirror://debian/pool/main/l/loadwatch/loadwatch_1.0+1.1alpha1.orig.tar.gz";
-    sha256 = "1abjl3cy4sa4ivdm7wghv9rq93h8kix4wjbiv7pb906rdqs4881a";
+  name = "loadwatch-1.1-1-g6d2544c";
+  src = fetchgit {
+    url = "git://woffs.de/git/fd/loadwatch.git";
+    sha256 = "1bhw5ywvhyb6snidsnllfpdi1migy73wg2gchhsfbcpm8aaz9c9b";
+    rev = "6d2544c0caaa8a64bbafc3f851e06b8056c30e6e";
   };
   installPhase = ''
     mkdir -p $out/bin

From d81ab0ab7d30c6ccff6d045494bc630781760705 Mon Sep 17 00:00:00 2001
From: Benjamin Hipple <bhipple@protonmail.com>
Date: Sun, 10 Jun 2018 14:56:20 -0400
Subject: [PATCH 048/161] alsa: setup mirrors for src downloads (#41761)

This commit adds a list of supported mirrors for all alsa projects, as described
on the download section of the alsa-project hompage:
http://alsa-project.org/main/index.php/Download
---
 pkgs/build-support/fetchurl/mirrors.nix          | 8 ++++++++
 pkgs/os-specific/linux/alsa-firmware/default.nix | 7 ++-----
 pkgs/os-specific/linux/alsa-lib/default.nix      | 5 +----
 pkgs/os-specific/linux/alsa-oss/default.nix      | 5 +----
 pkgs/os-specific/linux/alsa-plugins/default.nix  | 5 +----
 pkgs/os-specific/linux/alsa-tools/default.nix    | 5 +----
 pkgs/os-specific/linux/alsa-utils/default.nix    | 6 +-----
 7 files changed, 15 insertions(+), 26 deletions(-)

diff --git a/pkgs/build-support/fetchurl/mirrors.nix b/pkgs/build-support/fetchurl/mirrors.nix
index cc015f9d604..2d177353153 100644
--- a/pkgs/build-support/fetchurl/mirrors.nix
+++ b/pkgs/build-support/fetchurl/mirrors.nix
@@ -405,4 +405,12 @@ rec {
     http://repo1.maven.org/maven2/
     http://central.maven.org/maven2/
   ];
+
+  # Alsa Project
+  alsa = [
+     ftp://ftp.alsa-project.org/pub/
+     http://alsa.cybermirror.org/
+     http://www.mirrorservice.org/sites/ftp.alsa-project.org/pub/
+     http://alsa.mirror.fr/
+  ];
 }
diff --git a/pkgs/os-specific/linux/alsa-firmware/default.nix b/pkgs/os-specific/linux/alsa-firmware/default.nix
index 5871d1c6990..fb312b6bcb0 100644
--- a/pkgs/os-specific/linux/alsa-firmware/default.nix
+++ b/pkgs/os-specific/linux/alsa-firmware/default.nix
@@ -4,10 +4,7 @@ stdenv.mkDerivation rec {
   name = "alsa-firmware-1.0.29";
 
   src = fetchurl {
-    urls = [
-      "ftp://ftp.alsa-project.org/pub/firmware/${name}.tar.bz2"
-      "http://alsa.cybermirror.org/firmware/${name}.tar.bz2"
-    ];
+    url = "mirror://alsa/firmware/${name}.tar.bz2";
     sha256 = "0gfcyj5anckjn030wcxx5v2xk2s219nyf99s9m833275b5wz2piw";
   };
 
@@ -28,7 +25,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
-    homepage = http://www.alsa-project.org/main/index.php/Main_Page;
+    homepage = http://www.alsa-project.org/;
     description = "Soundcard firmwares from the alsa project";
     license = stdenv.lib.licenses.gpl2Plus;
     platforms = stdenv.lib.platforms.linux;
diff --git a/pkgs/os-specific/linux/alsa-lib/default.nix b/pkgs/os-specific/linux/alsa-lib/default.nix
index c2c612db542..41b43afc242 100644
--- a/pkgs/os-specific/linux/alsa-lib/default.nix
+++ b/pkgs/os-specific/linux/alsa-lib/default.nix
@@ -4,10 +4,7 @@ stdenv.mkDerivation rec {
   name = "alsa-lib-1.1.6";
 
   src = fetchurl {
-    urls = [
-     "ftp://ftp.alsa-project.org/pub/lib/${name}.tar.bz2"
-     "http://alsa.cybermirror.org/lib/${name}.tar.bz2"
-    ];
+    url = "mirror://alsa/lib/${name}.tar.bz2";
     sha256 = "096pwrnhj36yndldvs2pj4r871zhcgisks0is78f1jkjn9sd4b2z";
   };
 
diff --git a/pkgs/os-specific/linux/alsa-oss/default.nix b/pkgs/os-specific/linux/alsa-oss/default.nix
index 5cd937a3792..a13e178e418 100644
--- a/pkgs/os-specific/linux/alsa-oss/default.nix
+++ b/pkgs/os-specific/linux/alsa-oss/default.nix
@@ -4,10 +4,7 @@ stdenv.mkDerivation rec {
   name = "alsa-oss-1.1.6";
 
   src = fetchurl {
-    urls = [
-      "ftp://ftp.alsa-project.org/pub/oss-lib/${name}.tar.bz2"
-      "http://alsa.cybermirror.org/oss-lib/${name}.tar.bz2"
-    ];
+    url = "mirror://alsa/oss-lib/${name}.tar.bz2";
     sha256 = "1sj512wyci5qv8cisps96xngh7y9r5mv18ybqnazy18zwr1zgly3";
   };
 
diff --git a/pkgs/os-specific/linux/alsa-plugins/default.nix b/pkgs/os-specific/linux/alsa-plugins/default.nix
index f57f84b293b..9012f32f31d 100644
--- a/pkgs/os-specific/linux/alsa-plugins/default.nix
+++ b/pkgs/os-specific/linux/alsa-plugins/default.nix
@@ -4,10 +4,7 @@ stdenv.mkDerivation rec {
   name = "alsa-plugins-1.1.6";
 
   src = fetchurl {
-    urls = [
-      "ftp://ftp.alsa-project.org/pub/plugins/${name}.tar.bz2"
-      "http://alsa.cybermirror.org/plugins/${name}.tar.bz2"
-    ];
+    url = "mirror://alsa/plugins/${name}.tar.bz2";
     sha256 = "04qcwkisbh0d6lnh0rw1k6n869fbs6zbfq6yvb41rymiwgmk27bg";
   };
 
diff --git a/pkgs/os-specific/linux/alsa-tools/default.nix b/pkgs/os-specific/linux/alsa-tools/default.nix
index 67cae46164f..1ce94d14803 100644
--- a/pkgs/os-specific/linux/alsa-tools/default.nix
+++ b/pkgs/os-specific/linux/alsa-tools/default.nix
@@ -7,10 +7,7 @@ stdenv.mkDerivation rec {
   version = "1.1.6";
 
   src = fetchurl {
-    urls = [
-      "ftp://ftp.alsa-project.org/pub/tools/${name}.tar.bz2"
-      "http://alsa.cybermirror.org/tools/${name}.tar.bz2"
-    ];
+    url = "mirror://alsa/tools/${name}.tar.bz2";
     sha256 = "09rjb6hw1mn9y1jfdfj5djncgc2cr5wfps83k56rf6k4zg14v76n";
   };
 
diff --git a/pkgs/os-specific/linux/alsa-utils/default.nix b/pkgs/os-specific/linux/alsa-utils/default.nix
index b8498c096d3..376c42a8f9b 100644
--- a/pkgs/os-specific/linux/alsa-utils/default.nix
+++ b/pkgs/os-specific/linux/alsa-utils/default.nix
@@ -5,10 +5,7 @@ stdenv.mkDerivation rec {
   version = "1.1.6";
 
   src = fetchurl {
-    urls = [
-      "ftp://ftp.alsa-project.org/pub/utils/${name}.tar.bz2"
-      "http://alsa.cybermirror.org/utils/${name}.tar.bz2"
-    ];
+    url = "mirror://alsa/utils/${name}.tar.bz2";
     sha256 = "0vnkyymgwj9rfdb11nvab30dnfrylmakdfildxl0y8mj836awp0m";
   };
 
@@ -27,7 +24,6 @@ stdenv.mkDerivation rec {
   meta = {
     homepage = http://www.alsa-project.org/;
     description = "ALSA, the Advanced Linux Sound Architecture utils";
-
     longDescription = ''
       The Advanced Linux Sound Architecture (ALSA) provides audio and
       MIDI functionality to the Linux-based operating system.

From 5a216cd7ed6e6c6e3694e1708ad3d499cb0b9d99 Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Sun, 10 Jun 2018 15:06:24 -0400
Subject: [PATCH 049/161] ghcjs: disable some checks

---
 pkgs/development/haskell-modules/configuration-ghcjs.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/haskell-modules/configuration-ghcjs.nix b/pkgs/development/haskell-modules/configuration-ghcjs.nix
index c0468673467..8462ab254c2 100644
--- a/pkgs/development/haskell-modules/configuration-ghcjs.nix
+++ b/pkgs/development/haskell-modules/configuration-ghcjs.nix
@@ -201,4 +201,7 @@ self: super:
   # triggers an internal pattern match failure in haddock
   # https://github.com/haskell/haddock/issues/553
   wai = dontHaddock super.wai;
+
+  base-orphans = dontCheck super.base-orphans;
+  distributive = dontCheck super.distributive;
 }

From e544e4f564f69c89fc38fbd161648084b4f57c4f Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Sat, 9 Jun 2018 16:22:34 -0400
Subject: [PATCH 050/161] configuration-common.nix: fix incorrect override

---
 pkgs/development/haskell-modules/configuration-common.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index ad07da83c4e..425b48f9ad6 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -348,7 +348,7 @@ self: super: {
   itanium-abi = dontCheck super.itanium-abi;
   katt = dontCheck super.katt;
   language-slice = dontCheck super.language-slice;
-  language-nix = overrideCabal super.language-nix (drv: { broken = pkgs.stdenv.isLinux && pkgs.stdenv.isi686; }); # Tests crash on 32-bit linux; see https://github.com/peti/language-nix/issues/4
+  language-nix = if pkgs.stdenv.isi686 then dontCheck super.language-nix else super.language-nix;
   ldap-client = dontCheck super.ldap-client;
   lensref = dontCheck super.lensref;
   lucid = dontCheck super.lucid; #https://github.com/chrisdone/lucid/issues/25

From 3c2bbe217c4bbc67cfdf3912317d5a19b3994f69 Mon Sep 17 00:00:00 2001
From: volth <volth@webmaster.ms>
Date: Sun, 10 Jun 2018 19:25:48 +0000
Subject: [PATCH 051/161] lib: bitAnd, bitOr, bitXor (bitsize-agnostic fallback
 function) (#41491)

* lib: bitAnd, bitOr, bitXor

* lib: test for bitAnd, bitOr, bitXor

* lib: bitsize-agnostic zipIntBits

* lib: bitNot

* lib: bitNot
---
 lib/default.nix    |  8 ++++----
 lib/tests/misc.nix | 15 ++++++++++++++
 lib/trivial.nix    | 49 ++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 68 insertions(+), 4 deletions(-)

diff --git a/lib/default.nix b/lib/default.nix
index aca484d9a8e..c1a4a1e39a8 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -56,10 +56,10 @@ let
       hasAttr head isAttrs isBool isInt isList isString length
       lessThan listToAttrs pathExists readFile replaceStrings seq
       stringLength sub substring tail;
-    inherit (trivial) id const concat or and boolToString mergeAttrs
-      flip mapNullable inNixShell min max importJSON warn info
-      nixpkgsVersion version mod compare splitByAndCompare
-      functionArgs setFunctionArgs isFunction;
+    inherit (trivial) id const concat or and bitAnd bitOr bitXor bitNot
+      boolToString mergeAttrs flip mapNullable inNixShell min max
+      importJSON warn info nixpkgsVersion version mod compare
+      splitByAndCompare functionArgs setFunctionArgs isFunction;
 
     inherit (fixedPoints) fix fix' extends composeExtensions
       makeExtensible makeExtensibleWithCustomName;
diff --git a/lib/tests/misc.nix b/lib/tests/misc.nix
index c683df7d7ca..eab20d0f14d 100644
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@@ -45,6 +45,21 @@ runTests {
     expected = true;
   };
 
+  testBitAnd = {
+    expr = (bitAnd 3 10);
+    expected = 2;
+  };
+
+  testBitOr = {
+    expr = (bitOr 3 10);
+    expected = 11;
+  };
+
+  testBitXor = {
+    expr = (bitXor 3 10);
+    expected = 9;
+  };
+
 # STRINGS
 
   testConcatMapStrings = {
diff --git a/lib/trivial.nix b/lib/trivial.nix
index 251cb796db0..0bcefcbc28d 100644
--- a/lib/trivial.nix
+++ b/lib/trivial.nix
@@ -1,4 +1,41 @@
 { lib }:
+let
+  zipIntBits = f: x: y:
+    let
+      # (intToBits 6) -> [ 0 1 1 ]
+      intToBits = x:
+        if x == 0 || x == -1 then
+          []
+        else
+          let
+            headbit  = if (x / 2) * 2 != x then 1 else 0;          # x & 1
+            tailbits = if x < 0 then ((x + 1) / 2) - 1 else x / 2; # x >> 1
+          in
+            [headbit] ++ (intToBits tailbits);
+
+      # (bitsToInt [ 0 1 1 ] 0) -> 6
+      # (bitsToInt [ 0 1 0 ] 1) -> -6
+      bitsToInt = l: signum:
+        if l == [] then
+          (if signum == 0 then 0 else -1)
+        else
+          (builtins.head l) + (2 * (bitsToInt (builtins.tail l) signum));
+
+      xsignum = if x < 0 then 1 else 0;
+      ysignum = if y < 0 then 1 else 0;
+      zipListsWith' = fst: snd:
+        if fst==[] && snd==[] then
+          []
+        else if fst==[] then
+          [(f xsignum             (builtins.head snd))] ++ (zipListsWith' []                  (builtins.tail snd))
+        else if snd==[] then
+          [(f (builtins.head fst) ysignum            )] ++ (zipListsWith' (builtins.tail fst) []                 )
+        else
+          [(f (builtins.head fst) (builtins.head snd))] ++ (zipListsWith' (builtins.tail fst) (builtins.tail snd));
+    in
+      assert (builtins.isInt x) && (builtins.isInt y);
+      bitsToInt (zipListsWith' (intToBits x) (intToBits y)) (f xsignum ysignum);
+in
 rec {
 
   /* The identity function
@@ -31,6 +68,18 @@ rec {
   /* boolean “and” */
   and = x: y: x && y;
 
+  /* bitwise “and” */
+  bitAnd = builtins.bitAnd or zipIntBits (a: b: if a==1 && b==1 then 1 else 0);
+
+  /* bitwise “or” */
+  bitOr = builtins.bitOr or zipIntBits (a: b: if a==1 || b==1 then 1 else 0);
+
+  /* bitwise “xor” */
+  bitXor = builtins.bitXor or zipIntBits (a: b: if a!=b then 1 else 0);
+
+  /* bitwise “not” */
+  bitNot = builtins.sub (-1);
+
   /* Convert a boolean to a string.
      Note that toString on a bool returns "1" and "".
   */

From 1abc0537b6e1e0bae4520703e7a60917af531eb7 Mon Sep 17 00:00:00 2001
From: Andreas Rammhold <andreas@rammhold.de>
Date: Sun, 10 Jun 2018 21:30:52 +0200
Subject: [PATCH 052/161] gnupg: 2.2.7 -> 2.2.8

This addresses CVE-2018-12020. The details can be retrived from the
changelog [1].

[1] https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000425.html
---
 pkgs/tools/security/gnupg/22.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/security/gnupg/22.nix b/pkgs/tools/security/gnupg/22.nix
index 0f575d748b6..f28d57fa62b 100644
--- a/pkgs/tools/security/gnupg/22.nix
+++ b/pkgs/tools/security/gnupg/22.nix
@@ -15,11 +15,11 @@ assert guiSupport -> pinentry != null;
 stdenv.mkDerivation rec {
   name = "gnupg-${version}";
 
-  version = "2.2.7";
+  version = "2.2.8";
 
   src = fetchurl {
     url = "mirror://gnupg/gnupg/${name}.tar.bz2";
-    sha256 = "0vlpis0q7gvq9mhdc43hkyn3cdriz4mwgj20my3gyzpgwqg3cnyr";
+    sha256 = "1k8dnnfs9888yp713l7kg2jg110lw47s4krx0njna6fjrsw4qyvp";
   };
 
   nativeBuildInputs = [ pkgconfig ];

From 17d765058560cf3fb323b26249be8a1ebef06884 Mon Sep 17 00:00:00 2001
From: Benjamin Hipple <bhipple@protonmail.com>
Date: Sun, 10 Jun 2018 16:01:05 -0400
Subject: [PATCH 053/161] mupdf: apply CVE-2018-10289 patch (#41802)

Fixes mupdf issue in https://github.com/NixOS/nixpkgs/issues/41748 by applying
patch from https://bugs.ghostscript.com/show_bug.cgi?id=699271
---
 pkgs/applications/misc/mupdf/default.nix | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/pkgs/applications/misc/mupdf/default.nix b/pkgs/applications/misc/mupdf/default.nix
index fbc7da07021..a8458e3432c 100644
--- a/pkgs/applications/misc/mupdf/default.nix
+++ b/pkgs/applications/misc/mupdf/default.nix
@@ -23,12 +23,15 @@ in stdenv.mkDerivation rec {
   };
 
   patches = [
+    (fetchpatch {
+      # CVE-2018-10289
+      url = "https://bugs.ghostscript.com/attachment.cgi?id=15230";
+      sha256 = "0jmpacxd9930g6k57kda9jrcrbk75whdlv8xwmqg5jwn848qvy4q";
+    })
   ]
-
-  # Use shared libraries to decrease size
-  ++ stdenv.lib.optional (!stdenv.isDarwin) ./mupdf-1.13-shared_libs-1.patch
-
-  ++ stdenv.lib.optional stdenv.isDarwin ./darwin.patch
+    # Use shared libraries to decrease size
+    ++ stdenv.lib.optional (!stdenv.isDarwin) ./mupdf-1.13-shared_libs-1.patch
+    ++ stdenv.lib.optional stdenv.isDarwin ./darwin.patch
   ;
 
   postPatch = ''

From 2c89b0585db5b2614c080fadde08cc094d46d299 Mon Sep 17 00:00:00 2001
From: Ryan Mulligan <ryan@ryantm.com>
Date: Sun, 10 Jun 2018 13:06:27 -0700
Subject: [PATCH 054/161] ssl-cert-check: init at 3.31 (#41734)

---
 pkgs/tools/admin/ssl-cert-check/default.nix | 59 +++++++++++++++++++++
 pkgs/top-level/all-packages.nix             |  2 +
 2 files changed, 61 insertions(+)
 create mode 100644 pkgs/tools/admin/ssl-cert-check/default.nix

diff --git a/pkgs/tools/admin/ssl-cert-check/default.nix b/pkgs/tools/admin/ssl-cert-check/default.nix
new file mode 100644
index 00000000000..8d30307af2d
--- /dev/null
+++ b/pkgs/tools/admin/ssl-cert-check/default.nix
@@ -0,0 +1,59 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, makeWrapper
+, openssl
+, which
+, gnugrep
+, gnused
+, gawk
+, mktemp
+, coreutils
+, findutils
+}:
+
+stdenv.mkDerivation rec {
+  pname = "ssl-cert-check";
+  name = "${pname}-${version}";
+  version = "3.31";
+
+  src = fetchFromGitHub {
+    owner = "Matty9191";
+    repo = pname;
+    rev = "698c1996d05152cfaf2a1a3df4cc70482411fac8";
+    sha256 = "0jvi9phs0ngfwrj9zixb03v9byavbwxx8xkp0h5m98qppn1kvl3n";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  buildInputs = [
+    openssl
+    which
+    gnugrep
+    mktemp
+    gawk
+    gnused
+    coreutils
+    findutils
+  ];
+
+  prePatch = ''
+    substituteInPlace $pname --replace PATH= NOT_PATH=
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp $pname $out/bin/$pname
+    wrapProgram $out/bin/$pname \
+      --set PATH "${stdenv.lib.makeBinPath buildInputs}"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "a Bourne shell script that can be used to report on expiring SSL certificates";
+    homepage = https://github.com/Matty9191/ssl-cert-check;
+    license = licenses.gpl2;
+    maintainers = [ maintainers.ryantm ];
+    platforms = platforms.linux;
+  };
+
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1bc8820981e..5e138285e82 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -19571,6 +19571,8 @@ with pkgs;
 
   springLobby = callPackage ../games/spring/springlobby.nix { };
 
+  ssl-cert-check = callPackage ../tools/admin/ssl-cert-check { };
+
   stardust = callPackage ../games/stardust {};
 
   stockfish = callPackage ../games/stockfish { };

From 67b6b251347c287dd311d27a467c5dc5dd42e794 Mon Sep 17 00:00:00 2001
From: Profpatsch <mail@profpatsch.de>
Date: Sun, 10 Jun 2018 22:19:40 +0200
Subject: [PATCH 055/161] slic3r: add missing perl dependencies

---
 pkgs/applications/misc/slic3r/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/applications/misc/slic3r/default.nix b/pkgs/applications/misc/slic3r/default.nix
index 8624cc9dda5..21b55e6e7a0 100644
--- a/pkgs/applications/misc/slic3r/default.nix
+++ b/pkgs/applications/misc/slic3r/default.nix
@@ -21,6 +21,7 @@ stdenv.mkDerivation rec {
     MathConvexHullMonotoneChain MathGeometryVoronoi MathPlanePath Moo
     IOStringy ClassXSAccessor Wx GrowlGNTP NetDBus ImportInto XMLSAX
     ExtUtilsMakeMaker OpenGL WxGLCanvas ModuleBuild LWP
+    ExtUtilsCppGuess ModuleBuildWithXSpp ExtUtilsTypemapsDefault
   ];
 
   desktopItem = makeDesktopItem {

From 35ce5c1c8e5228f43cde083f897ac9da9f24031c Mon Sep 17 00:00:00 2001
From: Izorkin <Izorkin@gmail.com>
Date: Sun, 10 Jun 2018 23:50:36 +0300
Subject: [PATCH 056/161] maxscale: init at 2.1.17 (#33835)

---
 lib/licenses.nix                            | 10 +++
 pkgs/tools/networking/maxscale/default.nix  | 87 +++++++++++++++++++++
 pkgs/tools/networking/maxscale/getopt.patch | 11 +++
 pkgs/top-level/all-packages.nix             |  4 +
 4 files changed, 112 insertions(+)
 create mode 100644 pkgs/tools/networking/maxscale/default.nix
 create mode 100644 pkgs/tools/networking/maxscale/getopt.patch

diff --git a/lib/licenses.nix b/lib/licenses.nix
index 767fd89b948..a0b0f8727af 100644
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@@ -99,6 +99,16 @@ lib.mapAttrs (n: v: v // { shortName = n; }) rec {
     fullName = ''BSD 4-clause "Original" or "Old" License'';
   };
 
+  bsl10 = {
+    fullName = "Business Source License 1.0";
+    url = https://mariadb.com/bsl10;
+  };
+
+  bsl11 = {
+    fullName = "Business Source License 1.1";
+    url = https://mariadb.com/bsl11;
+  };
+
   clArtistic = spdx {
     spdxId = "ClArtistic";
     fullName = "Clarified Artistic License";
diff --git a/pkgs/tools/networking/maxscale/default.nix b/pkgs/tools/networking/maxscale/default.nix
new file mode 100644
index 00000000000..425e531419e
--- /dev/null
+++ b/pkgs/tools/networking/maxscale/default.nix
@@ -0,0 +1,87 @@
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, gcc, glibc
+, bison2, curl, flex, gperftools, jansson, jemalloc, kerberos, lua, mariadb
+, ncurses, openssl, pcre, pcre2, perl, rabbitmq-c, sqlite, tcl
+, libaio, libedit, libtool, libui, libuuid, zlib
+}:
+
+stdenv.mkDerivation rec {
+  name = "maxscale-${version}";
+  version = "2.1.17";
+
+  src = fetchFromGitHub {
+    owner = "mariadb-corporation";
+    repo = "MaxScale";
+    rev = "${name}";
+    sha256 = "161kc6aqqj3z509q4qwvsd86h06hlyzdask4gawn2ij0h3ca58q6";
+  };
+
+  nativeBuildInputs = [ cmake pkgconfig ];
+
+  buildInputs = [
+    bison2 curl flex gperftools jansson jemalloc kerberos lua mariadb.connector-c
+    ncurses openssl pcre pcre2 perl rabbitmq-c sqlite tcl
+    libaio libedit libtool libui libuuid zlib
+  ];
+
+  patches = [ ./getopt.patch ];
+
+  preConfigure = ''
+    for i in `grep -l -R '#include <getopt.h>' .`; do
+      substituteInPlace $i --replace "#include <getopt.h>" "#include <${glibc.dev}/include/getopt.h>"
+    done
+ '';
+
+  cmakeFlags = [
+    "-DUSE_C99=YES"
+    "-DDEFAULT_ADMIN_USER=root"
+    "-DWITH_MAXSCALE_CNF=YES"
+    "-DSTATIC_EMBEDDED=YES"
+    "-DBUILD_RABBITMQ=YES"
+    "-DBUILD_BINLOG=YES"
+    "-DBUILD_CDC=NO"
+    "-DBUILD_MMMON=YES"
+    "-DBUILD_LUAFILTER=YES"
+    "-DLUA_LIBRARIES=${lua}/lib"
+    "-DLUA_INCLUDE_DIR=${lua}/include"
+    "-DGCOV=NO"
+    "-DWITH_SCRIPTS=OFF"
+    "-DBUILD_TESTS=NO"
+    "-DBUILD_TOOLS=NO"
+    "-DPROFILE=NO"
+    "-DWITH_TCMALLOC=YES"
+    "-DWITH_JEMALLOC=YES"
+    "-DINSTALL_EXPERIMENTAL=YES"
+    "-DTARGET_COMPONENT=all"
+  ];
+
+  CFLAGS = "-std=gnu99";
+
+  enableParallelBuilding = false;
+
+  dontStrip = true;
+
+  postInstall = ''
+    find $out/bin -type f -perm -0100 | while read f1; do
+      patchelf \
+        --set-rpath "$(patchelf --print-rpath $f1):${mariadb.connector-c}/lib/mariadb:$out/lib/maxscale" \
+        --set-interpreter "$(cat ${stdenv.cc}/nix-support/dynamic-linker)" $f1 \
+        && patchelf --shrink-rpath $f1
+    done
+
+    find $out/lib/maxscale -type f -perm -0100 | while read f2; do
+      patchelf \
+        --set-rpath "$(patchelf --print-rpath $f2)":$out/lib/maxscale $f2
+    done
+
+    mv $out/share/maxscale/create_grants $out/bin
+    rm -rf $out/{etc,var}
+  '';
+
+  meta = with stdenv.lib; {
+     description = ''MaxScale database proxy extends MariaDB Server's high availability'';
+     homepage = https://mariadb.com/products/technology/maxscale;
+     license = licenses.bsl11;
+     platforms = platforms.linux;
+     maintainers = with maintainers; [ izorkin ];
+ };
+}
diff --git a/pkgs/tools/networking/maxscale/getopt.patch b/pkgs/tools/networking/maxscale/getopt.patch
new file mode 100644
index 00000000000..db09a8e8f1e
--- /dev/null
+++ b/pkgs/tools/networking/maxscale/getopt.patch
@@ -0,0 +1,11 @@
+--- a/server/core/maxpasswd.c   2018-01-12 05:06:49.000000000 -0500
++++ b/server/core/maxpasswd.c   2018-01-12 06:50:18.518000000 -0500
+@@ -25,6 +25,7 @@
+
+ #include <maxscale/cdefs.h>
+
++#include <getopt.h>
+ #include <stdio.h>
+ #include <errno.h>
+ #include <sys/stat.h>
+
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5e138285e82..4d6703eb295 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -17226,6 +17226,10 @@ with pkgs;
 
   maxlib = callPackage ../applications/audio/pd-plugins/maxlib { };
 
+  maxscale = callPackage ../tools/networking/maxscale {
+    stdenv = overrideCC stdenv gcc6;
+  };
+
   pdfdiff = callPackage ../applications/misc/pdfdiff { };
 
   mupdf = callPackage ../applications/misc/mupdf { };

From 530b287d6d95bad21e745f1271498cb8f258f0cb Mon Sep 17 00:00:00 2001
From: Elis Hirwing <elis@hirwing.se>
Date: Sun, 10 Jun 2018 10:58:03 +0200
Subject: [PATCH 057/161] sequeler: 0.5.4 -> 0.5.5

Changelog: https://github.com/Alecaddd/sequeler/releases/tag/v0.5.5

They also happened to switch away from cmake.
---
 pkgs/applications/misc/sequeler/default.nix | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/pkgs/applications/misc/sequeler/default.nix b/pkgs/applications/misc/sequeler/default.nix
index 2c8753efcd7..82b73f58e8d 100644
--- a/pkgs/applications/misc/sequeler/default.nix
+++ b/pkgs/applications/misc/sequeler/default.nix
@@ -1,10 +1,10 @@
 { stdenv, fetchFromGitHub
-, cmake, ninja, pkgconfig, vala, gobjectIntrospection, gettext, wrapGAppsHook
-, gtk3, glib, granite, libgee, libgda, gtksourceview, libxml2 }:
+, meson, ninja, pkgconfig, vala, gobjectIntrospection, gettext, wrapGAppsHook
+, gtk3, glib, granite, libgee, libgda, gtksourceview, libxml2, libsecret }:
 
 
 let
-  version = "0.5.4";
+  version = "0.5.5";
   sqlGda = libgda.override {
     mysqlSupport = true;
     postgresSupport = true;
@@ -17,12 +17,17 @@ in stdenv.mkDerivation rec {
     owner = "Alecaddd";
     repo = "sequeler";
     rev = "v${version}";
-    sha256 = "05c7y6xdyq3h9bn90pbz03jhy9kabmgpxi4zz0i26q0qphljskbx";
+    sha256 = "0jv7nx9k1qw2i3cmg0vnahz4qfam03xypas975x40icqd3bhfgj3";
   };
 
-  nativeBuildInputs = [ cmake ninja pkgconfig vala gobjectIntrospection gettext wrapGAppsHook ];
+  nativeBuildInputs = [ meson ninja pkgconfig vala gobjectIntrospection gettext wrapGAppsHook ];
 
-  buildInputs = [ gtk3 glib granite libgee sqlGda gtksourceview libxml2 ];
+  buildInputs = [ gtk3 glib granite libgee sqlGda gtksourceview libxml2 libsecret ];
+
+  postPatch = ''
+    chmod +x meson/post_install.py
+    patchShebangs meson/post_install.py
+  '';
 
   meta = with stdenv.lib; {
     description = "Friendly SQL Client";

From aa46b1ec0ecb498716813549fe4de479b8f5e893 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Sun, 10 Jun 2018 23:08:50 +0200
Subject: [PATCH 058/161] nixos/autosuggestions: add module (#41397)

The `zsh-autosuggestions` package provides several configuration options
such as a different highlight style (like `fg=cyan` which is easier to
read).

With `rename.nix` the old `programs.zsh.enableAutosuggestions` is still
functional, but yields the following warning like this during evaluation:

```
trace: warning: The option `programs.zsh.enableAutosuggestions' defined in `<unknown-file>' has been renamed to `programs.zsh.autosuggestions.enable'.
```

The module provides the most common `zsh-autosuggestions` (highlight
style and strategy) as options that will be written into the interactive
shell init (`/etc/zshrc` by default). Further configuration options can
be declared using the `extraConfig` attr set:

```
{
  programs.zsh.autosuggestions.extraConfig = {
    "ZSH_AUTOSUGGEST_BUFFER_MAX_SIZE" = "buffer_size";
  };
}
```

A full list of available configuration options for `zsh-autosuggestions`
can be viewed here: https://github.com/zsh-users/zsh-autosuggestions/blob/v0.4.3/README.md
---
 nixos/modules/module-list.nix                 |  1 +
 .../programs/zsh/zsh-autosuggestions.nix      | 60 +++++++++++++++++++
 nixos/modules/programs/zsh/zsh.nix            | 11 ----
 nixos/modules/rename.nix                      |  2 +
 4 files changed, 63 insertions(+), 11 deletions(-)
 create mode 100644 nixos/modules/programs/zsh/zsh-autosuggestions.nix

diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index da4c21296ff..71e0bf1461f 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -127,6 +127,7 @@
   ./programs/zsh/oh-my-zsh.nix
   ./programs/zsh/zsh.nix
   ./programs/zsh/zsh-autoenv.nix
+  ./programs/zsh/zsh-autosuggestions.nix
   ./programs/zsh/zsh-syntax-highlighting.nix
   ./rename.nix
   ./security/acme.nix
diff --git a/nixos/modules/programs/zsh/zsh-autosuggestions.nix b/nixos/modules/programs/zsh/zsh-autosuggestions.nix
new file mode 100644
index 00000000000..416f4c9c675
--- /dev/null
+++ b/nixos/modules/programs/zsh/zsh-autosuggestions.nix
@@ -0,0 +1,60 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.programs.zsh.autosuggestions;
+in
+{
+  options.programs.zsh.autosuggestions = {
+
+    enable = mkEnableOption "zsh-autosuggestions";
+
+    highlightStyle = mkOption {
+      type = types.str;
+      default = "fg=8"; # https://github.com/zsh-users/zsh-autosuggestions/tree/v0.4.3#suggestion-highlight-style
+      description = "Highlight style for suggestions ({fore,back}ground color)";
+      example = "fg=cyan";
+    };
+
+    strategy = mkOption {
+      type = types.enum [ "default" "match_prev_cmd" ];
+      default = "default";
+      description = ''
+        Set ZSH_AUTOSUGGEST_STRATEGY to choose the strategy for generating suggestions.
+        There are currently two to choose from:
+
+          * default: Chooses the most recent match.
+          * match_prev_cmd: Chooses the most recent match whose preceding history item matches
+            the most recently executed command (more info). Note that this strategy won't work as
+            expected with ZSH options that don't preserve the history order such as
+            HIST_IGNORE_ALL_DUPS or HIST_EXPIRE_DUPS_FIRST.
+      '';
+    };
+
+    extraConfig = mkOption {
+      type = with types; attrsOf str;
+      default = {};
+      description = "Attribute set with additional configuration values";
+      example = literalExample ''
+        {
+          "ZSH_AUTOSUGGEST_BUFFER_MAX_SIZE" = "20";
+        }
+      '';
+    };
+
+  };
+
+  config = mkIf cfg.enable {
+
+    programs.zsh.interactiveShellInit = ''
+      source ${pkgs.zsh-autosuggestions}/share/zsh-autosuggestions/zsh-autosuggestions.zsh
+
+      export ZSH_AUTOSUGGEST_HIGHLIGHT_STYLE="${cfg.highlightStyle}"
+      export ZSH_AUTOSUGGEST_STRATEGY="${cfg.strategy}"
+
+      ${concatStringsSep "\n" (mapAttrsToList (key: value: ''export ${key}="${value}"'') cfg.extraConfig)}
+    '';
+
+  };
+}
diff --git a/nixos/modules/programs/zsh/zsh.nix b/nixos/modules/programs/zsh/zsh.nix
index 662b463d572..42d4e1d4ada 100644
--- a/nixos/modules/programs/zsh/zsh.nix
+++ b/nixos/modules/programs/zsh/zsh.nix
@@ -87,13 +87,6 @@ in
         type = types.bool;
       };
 
-      enableAutosuggestions = mkOption {
-        default = false;
-        description = ''
-          Enable zsh-autosuggestions
-        '';
-        type = types.bool;
-      };
     };
 
   };
@@ -168,10 +161,6 @@ in
 
         ${optionalString cfg.enableCompletion "autoload -U compinit && compinit"}
 
-        ${optionalString (cfg.enableAutosuggestions)
-          "source ${pkgs.zsh-autosuggestions}/share/zsh-autosuggestions/zsh-autosuggestions.zsh"
-        }
-
         ${cfge.interactiveShellInit}
 
         ${cfg.interactiveShellInit}
diff --git a/nixos/modules/rename.nix b/nixos/modules/rename.nix
index b15dd84999a..9b9e9e7109d 100644
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@@ -247,6 +247,8 @@ with lib;
     (mkRenamedOptionModule [ "programs" "zsh" "oh-my-zsh" "custom" ] [ "programs" "zsh" "ohMyZsh" "custom" ])
     (mkRenamedOptionModule [ "programs" "zsh" "oh-my-zsh" "plugins" ] [ "programs" "zsh" "ohMyZsh" "plugins" ])
 
+    (mkRenamedOptionModule [ "programs" "zsh" "enableAutosuggestions" ] [ "programs" "zsh" "autosuggestions" "enable" ])
+
     # Xen
     (mkRenamedOptionModule [ "virtualisation" "xen" "qemu-package" ] [ "virtualisation" "xen" "package-qemu" ])
 

From 1ef6d3fe62f861619ed257fa145b2b8ce3fa7d9e Mon Sep 17 00:00:00 2001
From: jraygauthier <jraygauthier@users.noreply.github.com>
Date: Sun, 10 Jun 2018 17:57:42 -0400
Subject: [PATCH 059/161] tiscamera: Init at 0.9.1 (#41738)

---
 .../allow-pipeline-stop-in-trigger-mode.patch | 48 +++++++++
 pkgs/os-specific/linux/tiscamera/default.nix  | 98 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 +
 3 files changed, 148 insertions(+)
 create mode 100644 pkgs/os-specific/linux/tiscamera/allow-pipeline-stop-in-trigger-mode.patch
 create mode 100644 pkgs/os-specific/linux/tiscamera/default.nix

diff --git a/pkgs/os-specific/linux/tiscamera/allow-pipeline-stop-in-trigger-mode.patch b/pkgs/os-specific/linux/tiscamera/allow-pipeline-stop-in-trigger-mode.patch
new file mode 100644
index 00000000000..48a520f6ec3
--- /dev/null
+++ b/pkgs/os-specific/linux/tiscamera/allow-pipeline-stop-in-trigger-mode.patch
@@ -0,0 +1,48 @@
+diff --git a/src/gstreamer-1.0/gsttcamsrc.cpp b/src/gstreamer-1.0/gsttcamsrc.cpp
+index d482e1e..e36afd8 100644
+--- a/src/gstreamer-1.0/gsttcamsrc.cpp
++++ b/src/gstreamer-1.0/gsttcamsrc.cpp
+@@ -1112,6 +1112,7 @@ bool gst_tcam_src_init_camera (GstTcamSrc* self)
+ 
+ static void gst_tcam_src_close_camera (GstTcamSrc* self)
+ {
++    GST_INFO("Closing device");
+     if (self->device != NULL)
+     {
+         self->device->dev->stop_stream();
+@@ -1156,7 +1157,7 @@ static gboolean gst_tcam_src_stop (GstBaseSrc* src)
+ 
+     self->device->dev->stop_stream();
+     gst_element_send_event(GST_ELEMENT(self), gst_event_new_eos());
+-    GST_DEBUG_OBJECT (self, "Stopped acquisition");
++    GST_DEBUG("Stopped acquisition");
+ 
+     return TRUE;
+ }
+@@ -1556,6 +1557,18 @@ static void gst_tcam_src_get_property (GObject* object,
+ }
+ 
+ 
++static gboolean gst_tcam_src_unlock (GstBaseSrc* src)
++{
++    GstTcamSrc* self = GST_TCAM_SRC(src);
++
++    self->is_running = FALSE;
++
++    self->cv.notify_all();
++
++    return TRUE;
++}
++
++
+ static void gst_tcam_src_class_init (GstTcamSrcClass* klass)
+ {
+     GObjectClass *gobject_class = G_OBJECT_CLASS (klass);
+@@ -1616,6 +1629,7 @@ static void gst_tcam_src_class_init (GstTcamSrcClass* klass)
+     gstbasesrc_class->fixate = gst_tcam_src_fixate_caps;
+     gstbasesrc_class->start = gst_tcam_src_start;
+     gstbasesrc_class->stop = gst_tcam_src_stop;
++    gstbasesrc_class->unlock = gst_tcam_src_unlock;
+     gstbasesrc_class->negotiate = gst_tcam_src_negotiate;
+     gstbasesrc_class->get_times = gst_tcam_src_get_times;
+ 
diff --git a/pkgs/os-specific/linux/tiscamera/default.nix b/pkgs/os-specific/linux/tiscamera/default.nix
new file mode 100644
index 00000000000..d4d6ae18ce6
--- /dev/null
+++ b/pkgs/os-specific/linux/tiscamera/default.nix
@@ -0,0 +1,98 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, pkgconfig
+, pcre
+, tinyxml
+, libusb1
+, libzip
+, glib
+, gobjectIntrospection
+, gst_all_1
+, libwebcam
+}:
+
+stdenv.mkDerivation rec {
+  pname = "tiscamera";
+  version = "0.9.1";
+  name = "${pname}-${version}";
+
+  src = fetchFromGitHub {
+    owner = "TheImagingSource";
+    repo = pname;
+    rev = "v-${name}";
+    sha256 = "143yp6bpzj3rqfnrcnlrcwggay37fg6rkphh4w9y9v7v4wllzf87";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkgconfig
+  ];
+
+  buildInputs = [
+    pcre
+    tinyxml
+    libusb1
+    libzip
+    glib
+    gobjectIntrospection
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
+    libwebcam
+  ];
+
+
+  cmakeFlags = [
+    "-DBUILD_ARAVIS=OFF" # For GigE support. Won't need it as our camera is usb.
+    "-DBUILD_GST_1_0=ON"
+    "-DBUILD_TOOLS=ON"
+    "-DBUILD_V4L2=ON"
+    "-DBUILD_LIBUSB=ON"
+  ];
+
+
+  patches = [
+    ./allow-pipeline-stop-in-trigger-mode.patch # To be removed next release.
+  ];
+
+  postPatch = ''
+    substituteInPlace ./data/udev/80-theimagingsource-cameras.rules \
+      --replace "/usr/bin/uvcdynctrl" "${libwebcam}/bin/uvcdynctrl" \
+      --replace "/path/to/tiscamera/uvc-extensions" "$out/share/uvcdynctrl/data/199e"
+
+    substituteInPlace ./src/BackendLoader.cpp \
+      --replace '"libtcam-v4l2.so"' "\"$out/lib/tcam-0/libtcam-v4l2.so\"" \
+      --replace '"libtcam-aravis.so"' "\"$out/lib/tcam-0/libtcam-aravis.so\"" \
+      --replace '"libtcam-libusb.so"' "\"$out/lib/tcam-0/libtcam-libusb.so\""
+  '';
+
+  preConfigure = ''
+    cmakeFlagsArray=(
+      $cmakeFlagsArray
+      "-DCMAKE_INSTALL_PREFIX=$out"
+      "-DTCAM_INSTALL_UDEV=$out/lib/udev/rules.d"
+      "-DTCAM_INSTALL_UVCDYNCTRL=$out/share/uvcdynctrl/data/199e"
+      "-DTCAM_INSTALL_GST_1_0=$out/lib/gstreamer-1.0"
+      "-DTCAM_INSTALL_GIR=$out/share/gir-1.0"
+      "-DTCAM_INSTALL_TYPELIB=$out/lib/girepository-1.0"
+      "-DTCAM_INSTALL_SYSTEMD=$out/etc/systemd/system"
+    )
+  '';
+
+
+  # There are gobject introspection commands launched as part of the build. Those have a runtime
+  # dependency on `libtcam` (which itself is built as part of this build). In order to allow
+  # that, we set the dynamic linker's path to point on the build time location of the library.
+  preBuild = ''
+    export LD_LIBRARY_PATH=$PWD/src:$LD_LIBRARY_PATH
+  '';
+
+  meta = with lib; {
+    description = "The Linux sources and UVC firmwares for The Imaging Source cameras";
+    homepage = https://github.com/TheImagingSource/tiscamera;
+    license = with licenses; [ asl20 ];
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ jraygauthier ];
+  };
+}
\ No newline at end of file
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 038bd0c2219..e2b28d0207d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11824,6 +11824,8 @@ with pkgs;
 
   tinyxml-2 = callPackage ../development/libraries/tinyxml-2 { };
 
+  tiscamera = callPackage ../os-specific/linux/tiscamera { };
+
   tivodecode = callPackage ../applications/video/tivodecode { };
 
   tix = callPackage ../development/libraries/tix { };

From 8d488247e11a0820c667ecdaa72a04a7a4585f42 Mon Sep 17 00:00:00 2001
From: Tobias Happ <Gerschtli@users.noreply.github.com>
Date: Mon, 11 Jun 2018 00:08:08 +0200
Subject: [PATCH 060/161] atom: patchelf ctags binary (#41811)

---
 pkgs/applications/editors/atom/default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/editors/atom/default.nix b/pkgs/applications/editors/atom/default.nix
index a68c841d53b..b13e9fe1258 100644
--- a/pkgs/applications/editors/atom/default.nix
+++ b/pkgs/applications/editors/atom/default.nix
@@ -35,6 +35,8 @@ let
       patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
         --set-rpath "${atomEnv.libPath}" \
         $share/resources/app/apm/bin/node
+      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+        $out/share/atom/resources/app.asar.unpacked/node_modules/symbols-view/vendor/ctags-linux
 
       dugite=$share/resources/app.asar.unpacked/node_modules/dugite
       rm -f $dugite/git/bin/git
@@ -53,7 +55,7 @@ let
       homepage = https://atom.io/;
       license = licenses.mit;
       maintainers = with maintainers; [ offline nequissimus synthetica ysndr ];
-      platforms = [ "x86_64-linux" ];
+      platforms = platforms.x86_64;
     };
   };
 in stdenv.lib.mapAttrs common {

From 0b3f13d442642b9ea154b7cba88131a60bc1e54d Mon Sep 17 00:00:00 2001
From: Ruben Maher <ruben@maher.fyi>
Date: Sun, 10 Jun 2018 22:18:31 +0000
Subject: [PATCH 061/161] pkgs/qemu: tell qemu where to find smbd if
 smbdSupport is true (#41615)

---
 pkgs/applications/virtualization/qemu/default.nix | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index 8c429ff1d06..05d8c1edec2 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -15,6 +15,7 @@
 , xenSupport ? false, xen
 , openGLSupport ? sdlSupport, mesa_noglu, epoxy, libdrm
 , virglSupport ? openGLSupport, virglrenderer
+, smbdSupport ? false, samba
 , hostCpuOnly ? false
 , nixosTestRunner ? false
 }:
@@ -63,7 +64,8 @@ stdenv.mkDerivation rec {
     ++ optionals stdenv.isLinux [ alsaLib libaio libcap_ng libcap attr ]
     ++ optionals xenSupport [ xen ]
     ++ optionals openGLSupport [ mesa_noglu epoxy libdrm ]
-    ++ optionals virglSupport [ virglrenderer ];
+    ++ optionals virglSupport [ virglrenderer ]
+    ++ optionals smbdSupport [ samba ];
 
   enableParallelBuilding = true;
 
@@ -100,8 +102,7 @@ stdenv.mkDerivation rec {
   '';
 
   configureFlags =
-    [ "--smbd=smbd" # use `smbd' from $PATH
-      "--audio-drv-list=${audio}"
+    [ "--audio-drv-list=${audio}"
       "--sysconfdir=/etc"
       "--localstatedir=/var"
     ]
@@ -117,7 +118,8 @@ stdenv.mkDerivation rec {
     ++ optional gtkSupport "--enable-gtk"
     ++ optional xenSupport "--enable-xen"
     ++ optional openGLSupport "--enable-opengl"
-    ++ optional virglSupport "--enable-virglrenderer";
+    ++ optional virglSupport "--enable-virglrenderer"
+    ++ optional smbdSupport "--smbd=${samba}/bin/smbd";
 
   doCheck = false; # tries to access /dev
 

From 4d8c0313b893fb079c1e29b850114b0ceca9df9d Mon Sep 17 00:00:00 2001
From: Edmund Wu <22758444+eadwu@users.noreply.github.com>
Date: Sun, 10 Jun 2018 18:23:30 -0400
Subject: [PATCH 062/161] nixos/vscode-with-extensions: add desktop file
 (#41803)

---
 pkgs/applications/editors/vscode/with-extensions.nix | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/editors/vscode/with-extensions.nix b/pkgs/applications/editors/vscode/with-extensions.nix
index c54c8a4277f..9b0d69ae65a 100644
--- a/pkgs/applications/editors/vscode/with-extensions.nix
+++ b/pkgs/applications/editors/vscode/with-extensions.nix
@@ -12,7 +12,7 @@
         # When the extension is already available in the default extensions set.
         vscodeExtensions = with vscode-extensions; [
           bbenoist.Nix
-        ]   
+        ]
 
         # Concise version from the vscode market place when not available in the default set.
         ++ vscode-utils.extensionsFromVscodeMarketplace [
@@ -26,11 +26,11 @@
       }
       ~~~
 
-      This expression should fetch 
+      This expression should fetch
        -  the *nix* vscode extension from whatever source defined in the
           default nixpkgs extensions set `vscodeExtensions`.
 
-       -  the *code-runner* vscode extension from the marketplace using the 
+       -  the *code-runner* vscode extension from the marketplace using the
           following url:
 
           ~~~
@@ -72,6 +72,11 @@ runCommand "${wrappedPkgName}-with-extensions-${wrappedPkgVersion}" {
   meta = vscode.meta;
 } ''
   mkdir -p "$out/bin"
+  mkdir -p "$out/share/applications"
+  mkdir -p "$out/share/pixmaps"
+
+  ln -sT "${vscode}/share/applications/code.desktop" "$out/share/applications/code.desktop"
+  ln -sT "${vscode}/share/pixmaps/code.png" "$out/share/pixmaps/code.png"
   ${if [] == vscodeExtensions
     then ''
       ln -sT "${vscode}/bin/${wrappedExeName}" "$out/bin/${exeName}"

From 895e4c2687858b1f9f1cb2b6b7b190245cf97c62 Mon Sep 17 00:00:00 2001
From: Tobias Happ <Gerschtli@users.noreply.github.com>
Date: Mon, 11 Jun 2018 00:24:13 +0200
Subject: [PATCH 063/161] dwm-status: init at 0.4.0 (#41726)

---
 .../window-managers/dwm/dwm-status.nix        | 30 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 ++
 2 files changed, 32 insertions(+)
 create mode 100644 pkgs/applications/window-managers/dwm/dwm-status.nix

diff --git a/pkgs/applications/window-managers/dwm/dwm-status.nix b/pkgs/applications/window-managers/dwm/dwm-status.nix
new file mode 100644
index 00000000000..a8d69987e33
--- /dev/null
+++ b/pkgs/applications/window-managers/dwm/dwm-status.nix
@@ -0,0 +1,30 @@
+{ stdenv, rustPlatform, fetchFromGitHub, dbus, gdk_pixbuf, libnotify, pkgconfig }:
+
+rustPlatform.buildRustPackage rec {
+  name = "dwm-status-${version}";
+  version = "0.4.0";
+
+  src = fetchFromGitHub {
+    owner = "Gerschtli";
+    repo = "dwm-status";
+    rev = version;
+    sha256 = "0nw0iz78mnrmgpc471yjv7yzsaf7346mwjp6hm5kbsdclvrdq9d7";
+  };
+
+  buildInputs = [
+    dbus
+    gdk_pixbuf
+    libnotify
+    pkgconfig
+  ];
+
+  cargoSha256 = "0169k91pb7ipvi0m71cmkppp1klgp5ghampa7x0fxkyrvrf0dvqg";
+
+  meta = with stdenv.lib; {
+    description = "DWM status service which dynamically updates when needed";
+    homepage = https://github.com/Gerschtli/dwm-status;
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ gerschtli ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e2b28d0207d..9f3dcf8db67 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15437,6 +15437,8 @@ with pkgs;
     patches = config.dwm.patches or [];
   };
 
+  dwm-status = callPackage ../applications/window-managers/dwm/dwm-status.nix { };
+
   dynamips = callPackage ../applications/virtualization/dynamips { };
 
   evilwm = callPackage ../applications/window-managers/evilwm {

From 8f89f81b62771d2f613c657f6988efe5ddf57980 Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Sun, 10 Jun 2018 19:01:18 -0400
Subject: [PATCH 064/161] dfhack: add submodules

---
 pkgs/games/dwarf-fortress/dfhack/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/games/dwarf-fortress/dfhack/default.nix b/pkgs/games/dwarf-fortress/dfhack/default.nix
index a77f50a5171..86d61d948f5 100644
--- a/pkgs/games/dwarf-fortress/dfhack/default.nix
+++ b/pkgs/games/dwarf-fortress/dfhack/default.nix
@@ -39,8 +39,9 @@ in stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "DFHack";
     repo = "dfhack";
-    sha256 = "0srgymyd57hk9iffhi2i0ra5vzw2vzlpzn4042yb90vqpmvz2zrj";
+    sha256 = "15hz90lfg7asgm4bqa2yi2lkwzrljphb42q6616sriwzs66xia6h";
     rev = version;
+    fetchSubmodules = true;
   };
 
   nativeBuildInputs = [ cmake perl XMLLibXML XMLLibXSLT fakegit ];

From 7170ab84339708b96bf12a912a36d6e0e1f712bb Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Sun, 10 Jun 2018 19:10:25 -0400
Subject: [PATCH 065/161] dfhack: add SDL to buildInputs

---
 pkgs/games/dwarf-fortress/dfhack/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/games/dwarf-fortress/dfhack/default.nix b/pkgs/games/dwarf-fortress/dfhack/default.nix
index 86d61d948f5..11964c627da 100644
--- a/pkgs/games/dwarf-fortress/dfhack/default.nix
+++ b/pkgs/games/dwarf-fortress/dfhack/default.nix
@@ -1,6 +1,7 @@
 { stdenv, hostPlatform, lib, fetchFromGitHub, cmake, writeScriptBin, callPackage
 , perl, XMLLibXML, XMLLibXSLT, zlib
 , enableStoneSense ? false,  allegro5, libGLU_combined
+, SDL
 }:
 
 let
@@ -46,7 +47,7 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake perl XMLLibXML XMLLibXSLT fakegit ];
   # We don't use system libraries because dfhack needs old C++ ABI.
-  buildInputs = [ zlib ]
+  buildInputs = [ zlib SDL ]
              ++ lib.optionals enableStoneSense [ allegro5 libGLU_combined ];
 
   preConfigure = ''

From 97e8bcc925c6c848bf22c75daaa66f7eff1e2101 Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Sun, 10 Jun 2018 19:21:36 -0400
Subject: [PATCH 066/161] dwarf-therapist: supports darwin

---
 pkgs/games/dwarf-fortress/dwarf-therapist/default.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/games/dwarf-fortress/dwarf-therapist/default.nix b/pkgs/games/dwarf-fortress/dwarf-therapist/default.nix
index 2e54258c4be..305f3cdb1fa 100644
--- a/pkgs/games/dwarf-fortress/dwarf-therapist/default.nix
+++ b/pkgs/games/dwarf-fortress/dwarf-therapist/default.nix
@@ -14,11 +14,16 @@ stdenv.mkDerivation rec {
   buildInputs = [ qtbase qtdeclarative ];
   nativeBuildInputs = [ texlive cmake ninja ];
 
+  installPhase = if stdenv.isDarwin then ''
+    mkdir -p $out/Applications
+    cp -r DwarfTherapist.app $out/Applications
+  '' else null;
+
   meta = with stdenv.lib; {
     description = "Tool to manage dwarves in in a running game of Dwarf Fortress";
     maintainers = with maintainers; [ the-kenny abbradar bendlas ];
     license = licenses.mit;
-    platforms = [ "x86_64-linux" "i686-linux" ];
+    platforms = platforms.unix;
     homepage = https://github.com/Dwarf-Therapist/Dwarf-Therapist;
   };
 }

From 03ca9eeaa2e79a86e6a18d2953d08da0c53854ee Mon Sep 17 00:00:00 2001
From: Okina Matara <okinan@chiru.no>
Date: Sat, 9 Jun 2018 09:32:10 -0500
Subject: [PATCH 067/161] dolphinEmuMaster: 20180430 -> 20180609

---
 pkgs/misc/emulators/dolphin-emu/master.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/misc/emulators/dolphin-emu/master.nix b/pkgs/misc/emulators/dolphin-emu/master.nix
index 5d4e22fefae..cc746cad55e 100644
--- a/pkgs/misc/emulators/dolphin-emu/master.nix
+++ b/pkgs/misc/emulators/dolphin-emu/master.nix
@@ -20,12 +20,12 @@ assert dolphin-wxgui || dolphin-qtgui;
 assert !(dolphin-wxgui && dolphin-qtgui);
 
 stdenv.mkDerivation rec {
-  name = "dolphin-emu-20180430";
+  name = "dolphin-emu-20180609";
   src = fetchFromGitHub {
     owner = "dolphin-emu";
     repo = "dolphin";
-    rev = "ad098283c023b0f5f0d314c646bc5d5756c35e3d";
-    sha256 = "17fv3vz0nc5jax1bbl4wny1kzsshbbhms82dxd8rzcwwvd2ad1g7";
+    rev = "1d87584d69e3fdd730502127274fcbd85cebd591";
+    sha256 = "0sxzmmv8gvfsy96p1x1aya1cpq0237gip3zkl4bks4grgxf8958b";
   };
 
   cmakeFlags = [

From 45af94bfb97d5540641d25fb4385e74f04208a39 Mon Sep 17 00:00:00 2001
From: Okina Matara <okinan@chiru.no>
Date: Sat, 9 Jun 2018 11:32:22 -0500
Subject: [PATCH 068/161] dolphinEmuMaster: Enable Vulkan Dolphin did not have
 access to the Vulkan libs before, now it does.

---
 pkgs/misc/emulators/dolphin-emu/master.nix | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/pkgs/misc/emulators/dolphin-emu/master.nix b/pkgs/misc/emulators/dolphin-emu/master.nix
index cc746cad55e..2798306c300 100644
--- a/pkgs/misc/emulators/dolphin-emu/master.nix
+++ b/pkgs/misc/emulators/dolphin-emu/master.nix
@@ -1,10 +1,8 @@
-{ stdenv, fetchFromGitHub, pkgconfig, cmake, bluez, ffmpeg, libao, libGLU_combined, gtk2, glib
+{ stdenv, fetchFromGitHub, pkgconfig, cmake, makeWrapper, bluez, ffmpeg, libao, libGLU_combined, gtk2, glib
 , pcre, gettext, libpthreadstubs, libXrandr, libXext, libXxf86vm, libXinerama, libSM, readline
-, openal, libXdmcp, portaudio, libusb, libevdev
+, openal, libXdmcp, portaudio, libusb, libevdev, curl, qt5
+, vulkan-loader ? null
 , libpulseaudio ? null
-, curl
-
-, qt5
 # - Inputs used for Darwin
 , CoreBluetooth, cf-private, ForceFeedback, IOKit, OpenGL
 , wxGTK
@@ -38,13 +36,14 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  nativeBuildInputs = [ cmake pkgconfig ];
+  nativeBuildInputs = [ cmake pkgconfig ]
+                      ++ stdenv.lib.optionals stdenv.isLinux [ makeWrapper ];
 
   buildInputs = [ curl ffmpeg libao libGLU_combined gtk2 glib pcre
                   gettext libpthreadstubs libXrandr libXext libXxf86vm libXinerama libSM readline openal
                   libXdmcp portaudio libusb libpulseaudio libpng hidapi
                 ] ++ stdenv.lib.optionals stdenv.isDarwin [ wxGTK CoreBluetooth cf-private ForceFeedback IOKit OpenGL ]
-                  ++ stdenv.lib.optionals stdenv.isLinux  [ bluez libevdev  ]
+                  ++ stdenv.lib.optionals stdenv.isLinux [ bluez libevdev vulkan-loader ]
                   ++ stdenv.lib.optionals dolphin-qtgui [ qt5.qtbase ];
 
   # - Change install path to Applications relative to $out
@@ -59,6 +58,11 @@ stdenv.mkDerivation rec {
     mkdir -p "$out/Applications"
   '';
 
+  postInstall = stdenv.lib.optionalString stdenv.isLinux ''
+    wrapProgram $out/bin/dolphin-emu-nogui --prefix LD_LIBRARY_PATH : ${vulkan-loader}/lib
+    wrapProgram $out/bin/dolphin-emu-wx --prefix LD_LIBRARY_PATH : ${vulkan-loader}/lib
+  '';
+
   meta = {
     homepage = http://dolphin-emu.org/;
     description = "Gamecube/Wii/Triforce emulator for x86_64 and ARM";

From 6af1426421c743b952f0202ff081930d12f2357c Mon Sep 17 00:00:00 2001
From: Matthew Justin Bauer <mjbauer95@gmail.com>
Date: Sun, 10 Jun 2018 20:04:29 -0400
Subject: [PATCH 069/161] bind: only include libcap on linux

---
 pkgs/servers/dns/bind/default.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/dns/bind/default.nix b/pkgs/servers/dns/bind/default.nix
index d424d510cd2..b0fb29677f9 100644
--- a/pkgs/servers/dns/bind/default.nix
+++ b/pkgs/servers/dns/bind/default.nix
@@ -24,7 +24,8 @@ stdenv.mkDerivation rec {
     stdenv.lib.optional stdenv.isDarwin ./darwin-openssl-linking-fix.patch;
 
   nativeBuildInputs = [ perl ];
-  buildInputs = [ libcap libtool libxml2 openssl ]
+  buildInputs = [ libtool libxml2 openssl ]
+    ++ lib.optional stdenv.isLinux libcap
     ++ lib.optional enableSeccomp libseccomp
     ++ lib.optional enablePython python3;
 
@@ -34,7 +35,6 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--localstatedir=/var"
-    "--with-libcap=${libcap.dev}"
     "--with-libtool"
     "--with-libxml2=${libxml2.dev}"
     "--with-openssl=${openssl.dev}"
@@ -54,7 +54,8 @@ stdenv.mkDerivation rec {
     "--with-gost"
     "--without-eddsa"
     "--with-aes"
-  ] ++ lib.optional enableSeccomp "--enable-seccomp";
+  ] ++ lib.optional stdenv.isLinux "--with-libcap=${libcap.dev}"
+    ++ lib.optional enableSeccomp "--enable-seccomp";
 
   postInstall = ''
     moveToOutput bin/bind9-config $dev

From 4b213588f9fcf303110ca3f6b8b85c212aa23ea8 Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Sun, 10 Jun 2018 20:29:40 -0400
Subject: [PATCH 070/161] ffmpeg: needs gcc

https://hydra.nixos.org/build/75640051/nixlog/2
---
 pkgs/top-level/all-packages.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 94434b54292..9d3c2e42f55 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8967,12 +8967,15 @@ with pkgs;
 
   ffmpeg_0_10 = callPackage ../development/libraries/ffmpeg/0.10.nix {
     inherit (darwin.apple_sdk.frameworks) Cocoa;
+    stdenv = gccStdenv;
   };
   ffmpeg_1_2 = callPackage ../development/libraries/ffmpeg/1.2.nix {
     inherit (darwin.apple_sdk.frameworks) Cocoa;
+    stdenv = gccStdenv;
   };
   ffmpeg_2_8 = callPackage ../development/libraries/ffmpeg/2.8.nix {
     inherit (darwin.apple_sdk.frameworks) Cocoa;
+    stdenv = gccStdenv;
   };
   ffmpeg_3_4 = callPackage ../development/libraries/ffmpeg/3.4.nix {
     inherit (darwin.apple_sdk.frameworks) Cocoa CoreMedia;
@@ -8980,6 +8983,7 @@ with pkgs;
   };
   ffmpeg_4 = callPackage ../development/libraries/ffmpeg/4.nix {
     inherit (darwin.apple_sdk.frameworks) Cocoa CoreMedia;
+    stdenv = gccStdenv;
   };
 
   # Aliases

From 7e63a205da67bd2fd55e0372a780ca262fb77358 Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Sun, 10 Jun 2018 20:31:06 -0400
Subject: [PATCH 071/161] treewide: disable some darwin checks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Some network tests frequently fail on darwin. It’s easiest to disable
them for now.
---
 pkgs/development/libraries/libcouchbase/default.nix     | 2 +-
 pkgs/development/python-modules/mygpoclient/default.nix | 2 ++
 pkgs/tools/networking/mitmproxy/default.nix             | 2 ++
 3 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/libcouchbase/default.nix b/pkgs/development/libraries/libcouchbase/default.nix
index bf72ec76725..8474b387d85 100644
--- a/pkgs/development/libraries/libcouchbase/default.nix
+++ b/pkgs/development/libraries/libcouchbase/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake pkgconfig ];
   buildInputs = [ libevent openssl ];
 
-  doCheck = true;
+  doCheck = (!stdenv.isDarwin);
   checkPhase = "ctest";
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/python-modules/mygpoclient/default.nix b/pkgs/development/python-modules/mygpoclient/default.nix
index 097898a2d84..5f30316eb71 100644
--- a/pkgs/development/python-modules/mygpoclient/default.nix
+++ b/pkgs/development/python-modules/mygpoclient/default.nix
@@ -17,6 +17,8 @@ buildPythonPackage rec {
     nosetests
   '';
 
+  doCheck = (!stdenv.isDarwin);
+
   meta = with stdenv.lib; {
     description = "A gpodder.net client library";
     longDescription = ''
diff --git a/pkgs/tools/networking/mitmproxy/default.nix b/pkgs/tools/networking/mitmproxy/default.nix
index 5f7537eda18..d3b62d3259c 100644
--- a/pkgs/tools/networking/mitmproxy/default.nix
+++ b/pkgs/tools/networking/mitmproxy/default.nix
@@ -18,6 +18,8 @@ buildPythonPackage rec {
     sed 's/>=\([0-9]\.\?\)\+\( \?, \?<\([0-9]\.\?\)\+\)\?//' -i setup.py
   '';
 
+  doCheck = (!stdenv.isDarwin);
+
   checkPhase = ''
     export HOME=$(mktemp -d)
     export LC_CTYPE=en_US.UTF-8

From 8eabbf1f17c438d065e27ee3f495c15bbd2ad0af Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Sun, 10 Jun 2018 20:32:17 -0400
Subject: [PATCH 072/161] dnsperf: supports darwin

---
 pkgs/tools/networking/dnsperf/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/networking/dnsperf/default.nix b/pkgs/tools/networking/dnsperf/default.nix
index 97aad141239..b978925c62b 100644
--- a/pkgs/tools/networking/dnsperf/default.nix
+++ b/pkgs/tools/networking/dnsperf/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, bind, libseccomp, zlib, openssl }:
+{ stdenv, fetchurl, bind, libseccomp, zlib, openssl, libcap }:
 
 stdenv.mkDerivation rec {
   name = "dnsperf-${version}";
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "man" "doc" ];
 
-  buildInputs = [ bind libseccomp zlib openssl ];
+  buildInputs = [ bind zlib openssl ]
+              ++ stdenv.lib.optional stdenv.isLinux [ libcap libseccomp ];
 
   postInstall = ''
     mkdir -p "$out/share/doc/"
@@ -29,4 +30,3 @@ stdenv.mkDerivation rec {
     maintainers = [ maintainers.vcunat ];
   };
 }
-

From f522c9c3b93224d56683542a7a105fe9f522d6ea Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Sun, 10 Jun 2018 20:32:31 -0400
Subject: [PATCH 073/161] dxx-rebirth: disable format hardening

---
 pkgs/games/dxx-rebirth/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/games/dxx-rebirth/default.nix b/pkgs/games/dxx-rebirth/default.nix
index b780d5327f2..9dde1da868d 100644
--- a/pkgs/games/dxx-rebirth/default.nix
+++ b/pkgs/games/dxx-rebirth/default.nix
@@ -37,6 +37,8 @@ in stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  hardeningDisable = [ "format" ];
+
   buildPhase = ''
     runHook preBuild
 

From 7eb169a2574ecccd8647ce6048da6d74aded1edf Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Sun, 10 Jun 2018 20:34:40 -0400
Subject: [PATCH 074/161] avian: use no error

Currently a warning breaks an otherwise working package
---
 pkgs/development/compilers/avian/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/compilers/avian/default.nix b/pkgs/development/compilers/avian/default.nix
index 4dc384f70a3..387ae906b88 100644
--- a/pkgs/development/compilers/avian/default.nix
+++ b/pkgs/development/compilers/avian/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ zlib jdk ]
     ++ stdenv.lib.optionals stdenv.isDarwin [ CoreServices Foundation ];
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-error";
+  NIX_CFLAGS_COMPILE = "-Wno-error";
 
   postPatch = ''
     substituteInPlace makefile \

From a444dcad030800e3d05850425bc89457f7bf0e89 Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Sun, 10 Jun 2018 21:00:31 -0400
Subject: [PATCH 075/161] linux-copperhead: LTS based on regular 4.14

---
 .../linux/kernel/copperhead-4-14.patch        | 2864 +++++++++++++++++
 pkgs/os-specific/linux/kernel/linux-4.14.nix  |    5 +-
 pkgs/os-specific/linux/kernel/patches.nix     |    5 +
 pkgs/top-level/all-packages.nix               |   14 +-
 4 files changed, 2880 insertions(+), 8 deletions(-)
 create mode 100644 pkgs/os-specific/linux/kernel/copperhead-4-14.patch

diff --git a/pkgs/os-specific/linux/kernel/copperhead-4-14.patch b/pkgs/os-specific/linux/kernel/copperhead-4-14.patch
new file mode 100644
index 00000000000..78112d164f0
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/copperhead-4-14.patch
@@ -0,0 +1,2864 @@
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 0380a45ecf4b..39956a3ef645 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -490,16 +490,6 @@
+			nosocket -- Disable socket memory accounting.
+			nokmem -- Disable kernel memory accounting.
+
+-	checkreqprot	[SELINUX] Set initial checkreqprot flag value.
+-			Format: { "0" | "1" }
+-			See security/selinux/Kconfig help text.
+-			0 -- check protection applied by kernel (includes
+-				any implied execute protection).
+-			1 -- check protection requested by application.
+-			Default value is set via a kernel config option.
+-			Value can be changed at runtime via
+-				/selinux/checkreqprot.
+-
+	cio_ignore=	[S390]
+			See Documentation/s390/CommonIO for details.
+	clk_ignore_unused
+@@ -2899,6 +2889,11 @@
+			the specified number of seconds.  This is to be used if
+			your oopses keep scrolling off the screen.
+
++	extra_latent_entropy
++			Enable a very simple form of latent entropy extraction
++			from the first 4GB of memory as the bootmem allocator
++			passes the memory pages to the buddy allocator.
++
+	pcbit=		[HW,ISDN]
+
+	pcd.		[PARIDE]
+diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt
+index 694968c7523c..002d86416ef8 100644
+--- a/Documentation/sysctl/kernel.txt
++++ b/Documentation/sysctl/kernel.txt
+@@ -91,6 +91,7 @@ show up in /proc/sys/kernel:
+ - sysctl_writes_strict
+ - tainted
+ - threads-max
++- tiocsti_restrict
+ - unknown_nmi_panic
+ - watchdog
+ - watchdog_thresh
+@@ -999,6 +1000,26 @@ available RAM pages threads-max is reduced accordingly.
+
+ ==============================================================
+
++tiocsti_restrict:
++
++This toggle indicates whether unprivileged users are prevented
++from using the TIOCSTI ioctl to inject commands into other processes
++which share a tty session.
++
++When tiocsti_restrict is set to (0) there are no restrictions(accept
++the default restriction of only being able to injection commands into
++one's own tty). When tiocsti_restrict is set to (1), users must
++have CAP_SYS_ADMIN to use the TIOCSTI ioctl.
++
++When user namespaces are in use, the check for the capability
++CAP_SYS_ADMIN is done against the user namespace that originally
++opened the tty.
++
++The kernel config option CONFIG_SECURITY_TIOCSTI_RESTRICT sets the
++default value of tiocsti_restrict.
++
++==============================================================
++
+ unknown_nmi_panic:
+
+ The value in this file affects behavior of handling NMI. When the
+diff --git a/Makefile b/Makefile
+index 787cf6605209..e4fda5330730 100644
+--- a/Makefile
++++ b/Makefile
+@@ -710,6 +710,9 @@ endif
+ KBUILD_CFLAGS += $(stackp-flag)
+
+ ifeq ($(cc-name),clang)
++ifdef CONFIG_LOCAL_INIT
++KBUILD_CFLAGS   += -fsanitize=local-init
++endif
+ KBUILD_CPPFLAGS += $(call cc-option,-Qunused-arguments,)
+ KBUILD_CFLAGS += $(call cc-disable-warning, unused-variable)
+ KBUILD_CFLAGS += $(call cc-disable-warning, format-invalid-specifier)
+diff --git a/arch/Kconfig b/arch/Kconfig
+index 400b9e1b2f27..4637096f7902 100644
+--- a/arch/Kconfig
++++ b/arch/Kconfig
+@@ -440,6 +440,11 @@ config GCC_PLUGIN_LATENT_ENTROPY
+	  is some slowdown of the boot process (about 0.5%) and fork and
+	  irq processing.
+
++	  When extra_latent_entropy is passed on the kernel command line,
++	  entropy will be extracted from up to the first 4GB of RAM while the
++	  runtime memory allocator is being initialized.  This costs even more
++	  slowdown of the boot process.
++
+	  Note that entropy extracted this way is not cryptographically
+	  secure!
+
+@@ -533,7 +538,7 @@ config CC_STACKPROTECTOR
+ choice
+	prompt "Stack Protector buffer overflow detection"
+	depends on HAVE_CC_STACKPROTECTOR
+-	default CC_STACKPROTECTOR_NONE
++	default CC_STACKPROTECTOR_STRONG
+	help
+	  This option turns on the "stack-protector" GCC feature. This
+	  feature puts, at the beginning of functions, a canary value on
+@@ -735,7 +740,7 @@ config ARCH_MMAP_RND_BITS
+	int "Number of bits to use for ASLR of mmap base address" if EXPERT
+	range ARCH_MMAP_RND_BITS_MIN ARCH_MMAP_RND_BITS_MAX
+	default ARCH_MMAP_RND_BITS_DEFAULT if ARCH_MMAP_RND_BITS_DEFAULT
+-	default ARCH_MMAP_RND_BITS_MIN
++	default ARCH_MMAP_RND_BITS_MAX
+	depends on HAVE_ARCH_MMAP_RND_BITS
+	help
+	  This value can be used to select the number of bits to use to
+@@ -769,7 +774,7 @@ config ARCH_MMAP_RND_COMPAT_BITS
+	int "Number of bits to use for ASLR of mmap base address for compatible applications" if EXPERT
+	range ARCH_MMAP_RND_COMPAT_BITS_MIN ARCH_MMAP_RND_COMPAT_BITS_MAX
+	default ARCH_MMAP_RND_COMPAT_BITS_DEFAULT if ARCH_MMAP_RND_COMPAT_BITS_DEFAULT
+-	default ARCH_MMAP_RND_COMPAT_BITS_MIN
++	default ARCH_MMAP_RND_COMPAT_BITS_MAX
+	depends on HAVE_ARCH_MMAP_RND_COMPAT_BITS
+	help
+	  This value can be used to select the number of bits to use to
+@@ -952,6 +957,7 @@ config ARCH_HAS_REFCOUNT
+
+ config REFCOUNT_FULL
+	bool "Perform full reference count validation at the expense of speed"
++	default y
+	help
+	  Enabling this switches the refcounting infrastructure from a fast
+	  unchecked atomic_t implementation to a fully state checked
+diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
+index 2d5f7aca156d..aa4839a74c6a 100644
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -918,6 +918,7 @@ endif
+
+ config ARM64_SW_TTBR0_PAN
+	bool "Emulate Privileged Access Never using TTBR0_EL1 switching"
++	default y
+	help
+	  Enabling this option prevents the kernel from accessing
+	  user-space memory directly by pointing TTBR0_EL1 to a reserved
+@@ -1044,6 +1045,7 @@ config RANDOMIZE_BASE
+	bool "Randomize the address of the kernel image"
+	select ARM64_MODULE_PLTS if MODULES
+	select RELOCATABLE
++	default y
+	help
+	  Randomizes the virtual address at which the kernel image is
+	  loaded, as a security feature that deters exploit attempts
+diff --git a/arch/arm64/Kconfig.debug b/arch/arm64/Kconfig.debug
+index cc6bd559af85..01d5442d4722 100644
+--- a/arch/arm64/Kconfig.debug
++++ b/arch/arm64/Kconfig.debug
+@@ -45,6 +45,7 @@ config ARM64_RANDOMIZE_TEXT_OFFSET
+ config DEBUG_WX
+	bool "Warn on W+X mappings at boot"
+	select ARM64_PTDUMP_CORE
++	default y
+	---help---
+	  Generate a warning if any W+X mappings are found at boot.
+
+diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig
+index 34480e9af2e7..26304242250c 100644
+--- a/arch/arm64/configs/defconfig
++++ b/arch/arm64/configs/defconfig
+@@ -1,4 +1,3 @@
+-CONFIG_SYSVIPC=y
+ CONFIG_POSIX_MQUEUE=y
+ CONFIG_AUDIT=y
+ CONFIG_NO_HZ_IDLE=y
+diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h
+index 33be513ef24c..6f0c0e3ef0dd 100644
+--- a/arch/arm64/include/asm/elf.h
++++ b/arch/arm64/include/asm/elf.h
+@@ -114,10 +114,10 @@
+
+ /*
+  * This is the base location for PIE (ET_DYN with INTERP) loads. On
+- * 64-bit, this is above 4GB to leave the entire 32-bit address
++ * 64-bit, this is raised to 4GB to leave the entire 32-bit address
+  * space open for things that want to use the area for 32-bit pointers.
+  */
+-#define ELF_ET_DYN_BASE		(2 * TASK_SIZE_64 / 3)
++#define ELF_ET_DYN_BASE		0x100000000UL
+
+ #ifndef __ASSEMBLY__
+
+@@ -158,10 +158,10 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
+ /* 1GB of VA */
+ #ifdef CONFIG_COMPAT
+ #define STACK_RND_MASK			(test_thread_flag(TIF_32BIT) ? \
+-						0x7ff >> (PAGE_SHIFT - 12) : \
+-						0x3ffff >> (PAGE_SHIFT - 12))
++						((1UL << mmap_rnd_compat_bits) - 1) >> (PAGE_SHIFT - 12) : \
++						((1UL << mmap_rnd_bits) - 1) >> (PAGE_SHIFT - 12))
+ #else
+-#define STACK_RND_MASK			(0x3ffff >> (PAGE_SHIFT - 12))
++#define STACK_RND_MASK			(((1UL << mmap_rnd_bits) - 1) >> (PAGE_SHIFT - 12))
+ #endif
+
+ #ifdef __AARCH64EB__
+diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
+index 9e773732520c..91359f45b5fc 100644
+--- a/arch/arm64/kernel/process.c
++++ b/arch/arm64/kernel/process.c
+@@ -419,9 +419,9 @@ unsigned long arch_align_stack(unsigned long sp)
+ unsigned long arch_randomize_brk(struct mm_struct *mm)
+ {
+	if (is_compat_task())
+-		return randomize_page(mm->brk, SZ_32M);
++		return mm->brk + get_random_long() % SZ_32M + PAGE_SIZE;
+	else
+-		return randomize_page(mm->brk, SZ_1G);
++		return mm->brk + get_random_long() % SZ_1G + PAGE_SIZE;
+ }
+
+ /*
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index 7483cd514c32..835a86c45fb0 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -1153,8 +1153,7 @@ config VM86
+        default X86_LEGACY_VM86
+
+ config X86_16BIT
+-	bool "Enable support for 16-bit segments" if EXPERT
+-	default y
++	bool "Enable support for 16-bit segments"
+	depends on MODIFY_LDT_SYSCALL
+	---help---
+	  This option is required by programs like Wine to run 16-bit
+@@ -2228,7 +2227,7 @@ config COMPAT_VDSO
+ choice
+	prompt "vsyscall table for legacy applications"
+	depends on X86_64
+-	default LEGACY_VSYSCALL_EMULATE
++	default LEGACY_VSYSCALL_NONE
+	help
+	  Legacy user code that does not know how to find the vDSO expects
+	  to be able to issue three syscalls by calling fixed addresses in
+@@ -2318,8 +2317,7 @@ config CMDLINE_OVERRIDE
+	  be set to 'N' under normal conditions.
+
+ config MODIFY_LDT_SYSCALL
+-	bool "Enable the LDT (local descriptor table)" if EXPERT
+-	default y
++	bool "Enable the LDT (local descriptor table)"
+	---help---
+	  Linux can allow user programs to install a per-process x86
+	  Local Descriptor Table (LDT) using the modify_ldt(2) system
+diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug
+index 6293a8768a91..add82e0f1df3 100644
+--- a/arch/x86/Kconfig.debug
++++ b/arch/x86/Kconfig.debug
+@@ -101,6 +101,7 @@ config EFI_PGT_DUMP
+ config DEBUG_WX
+	bool "Warn on W+X mappings at boot"
+	select X86_PTDUMP_CORE
++	default y
+	---help---
+	  Generate a warning if any W+X mappings are found at boot.
+
+diff --git a/arch/x86/configs/x86_64_defconfig b/arch/x86/configs/x86_64_defconfig
+index e32fc1f274d8..d08acc76502a 100644
+--- a/arch/x86/configs/x86_64_defconfig
++++ b/arch/x86/configs/x86_64_defconfig
+@@ -1,5 +1,4 @@
+ # CONFIG_LOCALVERSION_AUTO is not set
+-CONFIG_SYSVIPC=y
+ CONFIG_POSIX_MQUEUE=y
+ CONFIG_BSD_PROCESS_ACCT=y
+ CONFIG_TASKSTATS=y
+diff --git a/arch/x86/entry/vdso/vma.c b/arch/x86/entry/vdso/vma.c
+index 1911310959f8..bba8dbbc07a8 100644
+--- a/arch/x86/entry/vdso/vma.c
++++ b/arch/x86/entry/vdso/vma.c
+@@ -203,55 +203,9 @@ static int map_vdso(const struct vdso_image *image, unsigned long addr)
+ }
+
+ #ifdef CONFIG_X86_64
+-/*
+- * Put the vdso above the (randomized) stack with another randomized
+- * offset.  This way there is no hole in the middle of address space.
+- * To save memory make sure it is still in the same PTE as the stack
+- * top.  This doesn't give that many random bits.
+- *
+- * Note that this algorithm is imperfect: the distribution of the vdso
+- * start address within a PMD is biased toward the end.
+- *
+- * Only used for the 64-bit and x32 vdsos.
+- */
+-static unsigned long vdso_addr(unsigned long start, unsigned len)
+-{
+-	unsigned long addr, end;
+-	unsigned offset;
+-
+-	/*
+-	 * Round up the start address.  It can start out unaligned as a result
+-	 * of stack start randomization.
+-	 */
+-	start = PAGE_ALIGN(start);
+-
+-	/* Round the lowest possible end address up to a PMD boundary. */
+-	end = (start + len + PMD_SIZE - 1) & PMD_MASK;
+-	if (end >= TASK_SIZE_MAX)
+-		end = TASK_SIZE_MAX;
+-	end -= len;
+-
+-	if (end > start) {
+-		offset = get_random_int() % (((end - start) >> PAGE_SHIFT) + 1);
+-		addr = start + (offset << PAGE_SHIFT);
+-	} else {
+-		addr = start;
+-	}
+-
+-	/*
+-	 * Forcibly align the final address in case we have a hardware
+-	 * issue that requires alignment for performance reasons.
+-	 */
+-	addr = align_vdso_addr(addr);
+-
+-	return addr;
+-}
+-
+ static int map_vdso_randomized(const struct vdso_image *image)
+ {
+-	unsigned long addr = vdso_addr(current->mm->start_stack, image->size-image->sym_vvar_start);
+-
+-	return map_vdso(image, addr);
++	return map_vdso(image, 0);
+ }
+ #endif
+
+diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
+index 3a091cea36c5..0931c05a3348 100644
+--- a/arch/x86/include/asm/elf.h
++++ b/arch/x86/include/asm/elf.h
+@@ -249,11 +249,11 @@ extern int force_personality32;
+
+ /*
+  * This is the base location for PIE (ET_DYN with INTERP) loads. On
+- * 64-bit, this is above 4GB to leave the entire 32-bit address
++ * 64-bit, this is raised to 4GB to leave the entire 32-bit address
+  * space open for things that want to use the area for 32-bit pointers.
+  */
+ #define ELF_ET_DYN_BASE		(mmap_is_ia32() ? 0x000400000UL : \
+-						  (DEFAULT_MAP_WINDOW / 3 * 2))
++						  0x100000000UL)
+
+ /* This yields a mask that user programs can use to figure out what
+    instruction set this CPU supports.  This could be done in user space,
+@@ -312,8 +312,8 @@ extern unsigned long get_mmap_base(int is_legacy);
+
+ #ifdef CONFIG_X86_32
+
+-#define __STACK_RND_MASK(is32bit) (0x7ff)
+-#define STACK_RND_MASK (0x7ff)
++#define __STACK_RND_MASK(is32bit) ((1UL << mmap_rnd_bits) - 1)
++#define STACK_RND_MASK ((1UL << mmap_rnd_bits) - 1)
+
+ #define ARCH_DLINFO		ARCH_DLINFO_IA32
+
+@@ -322,7 +322,11 @@ extern unsigned long get_mmap_base(int is_legacy);
+ #else /* CONFIG_X86_32 */
+
+ /* 1GB for 64bit, 8MB for 32bit */
+-#define __STACK_RND_MASK(is32bit) ((is32bit) ? 0x7ff : 0x3fffff)
++#ifdef CONFIG_COMPAT
++#define __STACK_RND_MASK(is32bit) ((is32bit) ? (1UL << mmap_rnd_compat_bits) - 1 : (1UL << mmap_rnd_bits) - 1)
++#else
++#define __STACK_RND_MASK(is32bit) ((1UL << mmap_rnd_bits) - 1)
++#endif
+ #define STACK_RND_MASK __STACK_RND_MASK(mmap_is_ia32())
+
+ #define ARCH_DLINFO							\
+@@ -380,5 +384,4 @@ struct va_alignment {
+ } ____cacheline_aligned;
+
+ extern struct va_alignment va_align;
+-extern unsigned long align_vdso_addr(unsigned long);
+ #endif /* _ASM_X86_ELF_H */
+diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
+index 704f31315dde..bb82b6344a7b 100644
+--- a/arch/x86/include/asm/tlbflush.h
++++ b/arch/x86/include/asm/tlbflush.h
+@@ -253,6 +253,7 @@ static inline void cr4_set_bits(unsigned long mask)
+	unsigned long cr4;
+
+	cr4 = this_cpu_read(cpu_tlbstate.cr4);
++	BUG_ON(cr4 != __read_cr4());
+	if ((cr4 | mask) != cr4) {
+		cr4 |= mask;
+		this_cpu_write(cpu_tlbstate.cr4, cr4);
+@@ -266,6 +267,7 @@ static inline void cr4_clear_bits(unsigned long mask)
+	unsigned long cr4;
+
+	cr4 = this_cpu_read(cpu_tlbstate.cr4);
++	BUG_ON(cr4 != __read_cr4());
+	if ((cr4 & ~mask) != cr4) {
+		cr4 &= ~mask;
+		this_cpu_write(cpu_tlbstate.cr4, cr4);
+@@ -278,6 +280,7 @@ static inline void cr4_toggle_bits(unsigned long mask)
+	unsigned long cr4;
+
+	cr4 = this_cpu_read(cpu_tlbstate.cr4);
++	BUG_ON(cr4 != __read_cr4());
+	cr4 ^= mask;
+	this_cpu_write(cpu_tlbstate.cr4, cr4);
+	__write_cr4(cr4);
+@@ -386,6 +389,7 @@ static inline void __native_flush_tlb_global(void)
+	raw_local_irq_save(flags);
+
+	cr4 = this_cpu_read(cpu_tlbstate.cr4);
++	BUG_ON(cr4 != __read_cr4());
+	/* toggle PGE */
+	native_write_cr4(cr4 ^ X86_CR4_PGE);
+	/* write old PGE again and flush TLBs */
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index 48e98964ecad..a94dc690612f 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -1637,7 +1637,6 @@ void cpu_init(void)
+	wrmsrl(MSR_KERNEL_GS_BASE, 0);
+	barrier();
+
+-	x86_configure_nx();
+	x2apic_setup();
+
+	/*
+diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
+index 988a98f34c66..dc36d2d9078a 100644
+--- a/arch/x86/kernel/process.c
++++ b/arch/x86/kernel/process.c
+@@ -40,6 +40,8 @@
+ #include <asm/desc.h>
+ #include <asm/prctl.h>
+ #include <asm/spec-ctrl.h>
++#include <asm/elf.h>
++#include <linux/sizes.h>
+
+ /*
+  * per-CPU TSS segments. Threads are completely 'soft' on Linux,
+@@ -719,7 +721,10 @@ unsigned long arch_align_stack(unsigned long sp)
+
+ unsigned long arch_randomize_brk(struct mm_struct *mm)
+ {
+-	return randomize_page(mm->brk, 0x02000000);
++	if (mmap_is_ia32())
++		return mm->brk + get_random_long() % SZ_32M + PAGE_SIZE;
++	else
++		return mm->brk + get_random_long() % SZ_1G + PAGE_SIZE;
+ }
+
+ /*
+diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c
+index a63fe77b3217..e1085e76043e 100644
+--- a/arch/x86/kernel/sys_x86_64.c
++++ b/arch/x86/kernel/sys_x86_64.c
+@@ -54,13 +54,6 @@ static unsigned long get_align_bits(void)
+	return va_align.bits & get_align_mask();
+ }
+
+-unsigned long align_vdso_addr(unsigned long addr)
+-{
+-	unsigned long align_mask = get_align_mask();
+-	addr = (addr + align_mask) & ~align_mask;
+-	return addr | get_align_bits();
+-}
+-
+ static int __init control_va_addr_alignment(char *str)
+ {
+	/* guard against enabling this on other CPU families */
+@@ -122,10 +115,7 @@ static void find_start_end(unsigned long addr, unsigned long flags,
+	}
+
+	*begin	= get_mmap_base(1);
+-	if (in_compat_syscall())
+-		*end = task_size_32bit();
+-	else
+-		*end = task_size_64bit(addr > DEFAULT_MAP_WINDOW);
++	*end	= get_mmap_base(0);
+ }
+
+ unsigned long
+@@ -206,7 +196,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+
+	info.flags = VM_UNMAPPED_AREA_TOPDOWN;
+	info.length = len;
+-	info.low_limit = PAGE_SIZE;
++	info.low_limit = get_mmap_base(1);
+	info.high_limit = get_mmap_base(0);
+
+	/*
+diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c
+index 3141e67ec24c..e93173193f60 100644
+--- a/arch/x86/mm/init_32.c
++++ b/arch/x86/mm/init_32.c
+@@ -558,7 +558,7 @@ static void __init pagetable_init(void)
+	permanent_kmaps_init(pgd_base);
+ }
+
+-pteval_t __supported_pte_mask __read_mostly = ~(_PAGE_NX | _PAGE_GLOBAL);
++pteval_t __supported_pte_mask __ro_after_init = ~(_PAGE_NX | _PAGE_GLOBAL);
+ EXPORT_SYMBOL_GPL(__supported_pte_mask);
+
+ /* user-defined highmem size */
+@@ -865,7 +865,7 @@ int arch_remove_memory(u64 start, u64 size)
+ #endif
+ #endif
+
+-int kernel_set_to_readonly __read_mostly;
++int kernel_set_to_readonly __ro_after_init;
+
+ void set_kernel_text_rw(void)
+ {
+@@ -917,12 +917,11 @@ void mark_rodata_ro(void)
+	unsigned long start = PFN_ALIGN(_text);
+	unsigned long size = PFN_ALIGN(_etext) - start;
+
++	kernel_set_to_readonly = 1;
+	set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT);
+	printk(KERN_INFO "Write protecting the kernel text: %luk\n",
+		size >> 10);
+
+-	kernel_set_to_readonly = 1;
+-
+ #ifdef CONFIG_CPA_DEBUG
+	printk(KERN_INFO "Testing CPA: Reverting %lx-%lx\n",
+		start, start+size);
+diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
+index 642357aff216..8bbf93ce3cd2 100644
+--- a/arch/x86/mm/init_64.c
++++ b/arch/x86/mm/init_64.c
+@@ -65,7 +65,7 @@
+  * around without checking the pgd every time.
+  */
+
+-pteval_t __supported_pte_mask __read_mostly = ~0;
++pteval_t __supported_pte_mask __ro_after_init = ~0;
+ EXPORT_SYMBOL_GPL(__supported_pte_mask);
+
+ int force_personality32;
+@@ -1185,7 +1185,7 @@ void __init mem_init(void)
+	mem_init_print_info(NULL);
+ }
+
+-int kernel_set_to_readonly;
++int kernel_set_to_readonly __ro_after_init;
+
+ void set_kernel_text_rw(void)
+ {
+@@ -1234,9 +1234,8 @@ void mark_rodata_ro(void)
+
+	printk(KERN_INFO "Write protecting the kernel read-only data: %luk\n",
+	       (end - start) >> 10);
+-	set_memory_ro(start, (end - start) >> PAGE_SHIFT);
+-
+	kernel_set_to_readonly = 1;
++	set_memory_ro(start, (end - start) >> PAGE_SHIFT);
+
+	/*
+	 * The rodata/data/bss/brk section (but not the kernel text!)
+diff --git a/block/blk-softirq.c b/block/blk-softirq.c
+index 01e2b353a2b9..9aeddca4a29f 100644
+--- a/block/blk-softirq.c
++++ b/block/blk-softirq.c
+@@ -20,7 +20,7 @@ static DEFINE_PER_CPU(struct list_head, blk_cpu_done);
+  * Softirq action handler - move entries to local list and loop over them
+  * while passing them to the queue registered handler.
+  */
+-static __latent_entropy void blk_done_softirq(struct softirq_action *h)
++static __latent_entropy void blk_done_softirq(void)
+ {
+	struct list_head *cpu_list, local_list;
+
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 473f150d6b22..65a65f9824ed 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -5141,7 +5141,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
+	struct ata_port *ap;
+	unsigned int tag;
+
+-	WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
++	BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
+	ap = qc->ap;
+
+	qc->flags = 0;
+@@ -5158,7 +5158,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc)
+	struct ata_port *ap;
+	struct ata_link *link;
+
+-	WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
++	BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
+	WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE));
+	ap = qc->ap;
+	link = qc->dev->link;
+diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
+index c28dca0c613d..d4813f0d25ca 100644
+--- a/drivers/char/Kconfig
++++ b/drivers/char/Kconfig
+@@ -9,7 +9,6 @@ source "drivers/tty/Kconfig"
+
+ config DEVMEM
+	bool "/dev/mem virtual device support"
+-	default y
+	help
+	  Say Y here if you want to support the /dev/mem device.
+	  The /dev/mem device is used to access areas of physical
+@@ -568,7 +567,6 @@ config TELCLOCK
+ config DEVPORT
+	bool "/dev/port character device"
+	depends on ISA || PCI
+-	default y
+	help
+	  Say Y here if you want to support the /dev/port device. The /dev/port
+	  device is similar to /dev/mem, but for I/O ports.
+diff --git a/drivers/media/dvb-frontends/cx24116.c b/drivers/media/dvb-frontends/cx24116.c
+index e105532bfba8..e07d52bb9b62 100644
+--- a/drivers/media/dvb-frontends/cx24116.c
++++ b/drivers/media/dvb-frontends/cx24116.c
+@@ -1462,7 +1462,7 @@ static int cx24116_tune(struct dvb_frontend *fe, bool re_tune,
+	return cx24116_read_status(fe, status);
+ }
+
+-static int cx24116_get_algo(struct dvb_frontend *fe)
++static enum dvbfe_algo cx24116_get_algo(struct dvb_frontend *fe)
+ {
+	return DVBFE_ALGO_HW;
+ }
+diff --git a/drivers/media/dvb-frontends/cx24117.c b/drivers/media/dvb-frontends/cx24117.c
+index d37cb7762bd6..97e0feff0ede 100644
+--- a/drivers/media/dvb-frontends/cx24117.c
++++ b/drivers/media/dvb-frontends/cx24117.c
+@@ -1555,7 +1555,7 @@ static int cx24117_tune(struct dvb_frontend *fe, bool re_tune,
+	return cx24117_read_status(fe, status);
+ }
+
+-static int cx24117_get_algo(struct dvb_frontend *fe)
++static enum dvbfe_algo cx24117_get_algo(struct dvb_frontend *fe)
+ {
+	return DVBFE_ALGO_HW;
+ }
+diff --git a/drivers/media/dvb-frontends/cx24120.c b/drivers/media/dvb-frontends/cx24120.c
+index 7f11dcc94d85..01da670760ba 100644
+--- a/drivers/media/dvb-frontends/cx24120.c
++++ b/drivers/media/dvb-frontends/cx24120.c
+@@ -1491,7 +1491,7 @@ static int cx24120_tune(struct dvb_frontend *fe, bool re_tune,
+	return cx24120_read_status(fe, status);
+ }
+
+-static int cx24120_get_algo(struct dvb_frontend *fe)
++static enum dvbfe_algo cx24120_get_algo(struct dvb_frontend *fe)
+ {
+	return DVBFE_ALGO_HW;
+ }
+diff --git a/drivers/media/dvb-frontends/cx24123.c b/drivers/media/dvb-frontends/cx24123.c
+index 1d59d1d3bd82..41cd0e9ea199 100644
+--- a/drivers/media/dvb-frontends/cx24123.c
++++ b/drivers/media/dvb-frontends/cx24123.c
+@@ -1005,7 +1005,7 @@ static int cx24123_tune(struct dvb_frontend *fe,
+	return retval;
+ }
+
+-static int cx24123_get_algo(struct dvb_frontend *fe)
++static enum dvbfe_algo cx24123_get_algo(struct dvb_frontend *fe)
+ {
+	return DVBFE_ALGO_HW;
+ }
+diff --git a/drivers/media/dvb-frontends/cxd2820r_core.c b/drivers/media/dvb-frontends/cxd2820r_core.c
+index f6ebbb47b9b2..3e0d8cbd76da 100644
+--- a/drivers/media/dvb-frontends/cxd2820r_core.c
++++ b/drivers/media/dvb-frontends/cxd2820r_core.c
+@@ -403,7 +403,7 @@ static enum dvbfe_search cxd2820r_search(struct dvb_frontend *fe)
+	return DVBFE_ALGO_SEARCH_ERROR;
+ }
+
+-static int cxd2820r_get_frontend_algo(struct dvb_frontend *fe)
++static enum dvbfe_algo cxd2820r_get_frontend_algo(struct dvb_frontend *fe)
+ {
+	return DVBFE_ALGO_CUSTOM;
+ }
+diff --git a/drivers/media/dvb-frontends/mb86a20s.c b/drivers/media/dvb-frontends/mb86a20s.c
+index e8ac8c3e2ec0..e0f4ba8302d1 100644
+--- a/drivers/media/dvb-frontends/mb86a20s.c
++++ b/drivers/media/dvb-frontends/mb86a20s.c
+@@ -2055,7 +2055,7 @@ static void mb86a20s_release(struct dvb_frontend *fe)
+	kfree(state);
+ }
+
+-static int mb86a20s_get_frontend_algo(struct dvb_frontend *fe)
++static enum dvbfe_algo mb86a20s_get_frontend_algo(struct dvb_frontend *fe)
+ {
+         return DVBFE_ALGO_HW;
+ }
+diff --git a/drivers/media/dvb-frontends/s921.c b/drivers/media/dvb-frontends/s921.c
+index 274544a3ae0e..9ef9b9bc1bd2 100644
+--- a/drivers/media/dvb-frontends/s921.c
++++ b/drivers/media/dvb-frontends/s921.c
+@@ -464,7 +464,7 @@ static int s921_tune(struct dvb_frontend *fe,
+	return rc;
+ }
+
+-static int s921_get_algo(struct dvb_frontend *fe)
++static enum dvbfe_algo s921_get_algo(struct dvb_frontend *fe)
+ {
+	return DVBFE_ALGO_HW;
+ }
+diff --git a/drivers/media/pci/bt8xx/dst.c b/drivers/media/pci/bt8xx/dst.c
+index 7166d2279465..fa682f9fdc4b 100644
+--- a/drivers/media/pci/bt8xx/dst.c
++++ b/drivers/media/pci/bt8xx/dst.c
+@@ -1657,7 +1657,7 @@ static int dst_tune_frontend(struct dvb_frontend* fe,
+	return 0;
+ }
+
+-static int dst_get_tuning_algo(struct dvb_frontend *fe)
++static enum dvbfe_algo dst_get_tuning_algo(struct dvb_frontend *fe)
+ {
+	return dst_algo ? DVBFE_ALGO_HW : DVBFE_ALGO_SW;
+ }
+diff --git a/drivers/media/pci/pt1/va1j5jf8007s.c b/drivers/media/pci/pt1/va1j5jf8007s.c
+index f75f69556be7..d913a6050e8c 100644
+--- a/drivers/media/pci/pt1/va1j5jf8007s.c
++++ b/drivers/media/pci/pt1/va1j5jf8007s.c
+@@ -98,7 +98,7 @@ static int va1j5jf8007s_read_snr(struct dvb_frontend *fe, u16 *snr)
+	return 0;
+ }
+
+-static int va1j5jf8007s_get_frontend_algo(struct dvb_frontend *fe)
++static enum dvbfe_algo va1j5jf8007s_get_frontend_algo(struct dvb_frontend *fe)
+ {
+	return DVBFE_ALGO_HW;
+ }
+diff --git a/drivers/media/pci/pt1/va1j5jf8007t.c b/drivers/media/pci/pt1/va1j5jf8007t.c
+index 63fda79a75c0..4115c3ccd4a8 100644
+--- a/drivers/media/pci/pt1/va1j5jf8007t.c
++++ b/drivers/media/pci/pt1/va1j5jf8007t.c
+@@ -88,7 +88,7 @@ static int va1j5jf8007t_read_snr(struct dvb_frontend *fe, u16 *snr)
+	return 0;
+ }
+
+-static int va1j5jf8007t_get_frontend_algo(struct dvb_frontend *fe)
++static enum dvbfe_algo va1j5jf8007t_get_frontend_algo(struct dvb_frontend *fe)
+ {
+	return DVBFE_ALGO_HW;
+ }
+diff --git a/drivers/misc/lkdtm_core.c b/drivers/misc/lkdtm_core.c
+index 981b3ef71e47..9883da1da383 100644
+--- a/drivers/misc/lkdtm_core.c
++++ b/drivers/misc/lkdtm_core.c
+@@ -78,7 +78,7 @@ static irqreturn_t jp_handle_irq_event(unsigned int irq,
+	return 0;
+ }
+
+-static void jp_tasklet_action(struct softirq_action *a)
++static void jp_tasklet_action(void)
+ {
+	lkdtm_handler();
+	jprobe_return();
+diff --git a/drivers/tty/Kconfig b/drivers/tty/Kconfig
+index b811442c5ce6..4f62a63cbcb1 100644
+--- a/drivers/tty/Kconfig
++++ b/drivers/tty/Kconfig
+@@ -122,7 +122,6 @@ config UNIX98_PTYS
+
+ config LEGACY_PTYS
+	bool "Legacy (BSD) PTY support"
+-	default y
+	---help---
+	  A pseudo terminal (PTY) is a software device consisting of two
+	  halves: a master and a slave. The slave device behaves identical to
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index 562d31073f9a..2184b9b5485f 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -171,6 +171,7 @@ static void free_tty_struct(struct tty_struct *tty)
+	put_device(tty->dev);
+	kfree(tty->write_buf);
+	tty->magic = 0xDEADDEAD;
++	put_user_ns(tty->owner_user_ns);
+	kfree(tty);
+ }
+
+@@ -2154,11 +2155,19 @@ static int tty_fasync(int fd, struct file *filp, int on)
+  *	FIXME: may race normal receive processing
+  */
+
++int tiocsti_restrict = IS_ENABLED(CONFIG_SECURITY_TIOCSTI_RESTRICT);
++
+ static int tiocsti(struct tty_struct *tty, char __user *p)
+ {
+	char ch, mbz = 0;
+	struct tty_ldisc *ld;
+
++	if (tiocsti_restrict &&
++		!ns_capable(tty->owner_user_ns, CAP_SYS_ADMIN)) {
++		dev_warn_ratelimited(tty->dev,
++			"Denied TIOCSTI ioctl for non-privileged process\n");
++		return -EPERM;
++	}
+	if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
+		return -EPERM;
+	if (get_user(ch, p))
+@@ -2841,6 +2850,7 @@ struct tty_struct *alloc_tty_struct(struct tty_driver *driver, int idx)
+	tty->index = idx;
+	tty_line_name(driver, idx, tty->name);
+	tty->dev = tty_get_device(tty);
++	tty->owner_user_ns = get_user_ns(current_user_ns());
+
+	return tty;
+ }
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 442be7f312f6..788557d5c454 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -38,6 +38,8 @@
+ #define USB_VENDOR_GENESYS_LOGIC		0x05e3
+ #define HUB_QUIRK_CHECK_PORT_AUTOSUSPEND	0x01
+
++extern int deny_new_usb;
++
+ /* Protect struct usb_device->state and ->children members
+  * Note: Both are also protected by ->dev.sem, except that ->state can
+  * change to USB_STATE_NOTATTACHED even when the semaphore isn't held. */
+@@ -4806,6 +4808,12 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
+			goto done;
+		return;
+	}
++
++	if (deny_new_usb) {
++		dev_err(&port_dev->dev, "denied insert of USB device on port %d\n", port1);
++		goto done;
++	}
++
+	if (hub_is_superspeed(hub->hdev))
+		unit_load = 150;
+	else
+diff --git a/fs/exec.c b/fs/exec.c
+index 0da4d748b4e6..69fcee853363 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -62,6 +62,7 @@
+ #include <linux/oom.h>
+ #include <linux/compat.h>
+ #include <linux/vmalloc.h>
++#include <linux/random.h>
+
+ #include <linux/uaccess.h>
+ #include <asm/mmu_context.h>
+@@ -321,6 +322,8 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
+	arch_bprm_mm_init(mm, vma);
+	up_write(&mm->mmap_sem);
+	bprm->p = vma->vm_end - sizeof(void *);
++	if (randomize_va_space)
++		bprm->p ^= get_random_int() & ~PAGE_MASK;
+	return 0;
+ err:
+	up_write(&mm->mmap_sem);
+diff --git a/fs/namei.c b/fs/namei.c
+index 0b46b858cd42..3ae8e72341da 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -902,8 +902,8 @@ static inline void put_link(struct nameidata *nd)
+		path_put(&last->link);
+ }
+
+-int sysctl_protected_symlinks __read_mostly = 0;
+-int sysctl_protected_hardlinks __read_mostly = 0;
++int sysctl_protected_symlinks __read_mostly = 1;
++int sysctl_protected_hardlinks __read_mostly = 1;
+
+ /**
+  * may_follow_link - Check symlink following for unsafe situations
+diff --git a/fs/nfs/Kconfig b/fs/nfs/Kconfig
+index 5f93cfacb3d1..cea0d7d3b23e 100644
+--- a/fs/nfs/Kconfig
++++ b/fs/nfs/Kconfig
+@@ -195,4 +195,3 @@ config NFS_DEBUG
+	bool
+	depends on NFS_FS && SUNRPC_DEBUG
+	select CRC32
+-	default y
+diff --git a/fs/pipe.c b/fs/pipe.c
+index 8ef7d7bef775..b82f305ec13d 100644
+--- a/fs/pipe.c
++++ b/fs/pipe.c
+@@ -38,7 +38,7 @@ unsigned int pipe_max_size = 1048576;
+ /*
+  * Minimum pipe size, as required by POSIX
+  */
+-unsigned int pipe_min_size = PAGE_SIZE;
++unsigned int pipe_min_size __read_only = PAGE_SIZE;
+
+ /* Maximum allocatable pages per user. Hard limit is unset by default, soft
+  * matches default values.
+diff --git a/fs/proc/Kconfig b/fs/proc/Kconfig
+index 1ade1206bb89..60b0f76dec47 100644
+--- a/fs/proc/Kconfig
++++ b/fs/proc/Kconfig
+@@ -39,7 +39,6 @@ config PROC_KCORE
+ config PROC_VMCORE
+	bool "/proc/vmcore support"
+	depends on PROC_FS && CRASH_DUMP
+-	default y
+         help
+         Exports the dump image of crashed kernel in ELF format.
+
+diff --git a/fs/stat.c b/fs/stat.c
+index 873785dae022..d3c2ada8b9c7 100644
+--- a/fs/stat.c
++++ b/fs/stat.c
+@@ -40,8 +40,13 @@ void generic_fillattr(struct inode *inode, struct kstat *stat)
+	stat->gid = inode->i_gid;
+	stat->rdev = inode->i_rdev;
+	stat->size = i_size_read(inode);
+-	stat->atime = inode->i_atime;
+-	stat->mtime = inode->i_mtime;
++	if (is_sidechannel_device(inode) && !capable_noaudit(CAP_MKNOD)) {
++		stat->atime = inode->i_ctime;
++		stat->mtime = inode->i_ctime;
++	} else {
++		stat->atime = inode->i_atime;
++		stat->mtime = inode->i_mtime;
++	}
+	stat->ctime = inode->i_ctime;
+	stat->blksize = i_blocksize(inode);
+	stat->blocks = inode->i_blocks;
+@@ -75,9 +80,14 @@ int vfs_getattr_nosec(const struct path *path, struct kstat *stat,
+	stat->result_mask |= STATX_BASIC_STATS;
+	request_mask &= STATX_ALL;
+	query_flags &= KSTAT_QUERY_FLAGS;
+-	if (inode->i_op->getattr)
+-		return inode->i_op->getattr(path, stat, request_mask,
+-					    query_flags);
++	if (inode->i_op->getattr) {
++		int retval = inode->i_op->getattr(path, stat, request_mask, query_flags);
++		if (!retval && is_sidechannel_device(inode) && !capable_noaudit(CAP_MKNOD)) {
++			stat->atime = stat->ctime;
++			stat->mtime = stat->ctime;
++		}
++		return retval;
++	}
+
+	generic_fillattr(inode, stat);
+	return 0;
+diff --git a/include/linux/cache.h b/include/linux/cache.h
+index 750621e41d1c..e7157c18c62c 100644
+--- a/include/linux/cache.h
++++ b/include/linux/cache.h
+@@ -31,6 +31,8 @@
+ #define __ro_after_init __attribute__((__section__(".data..ro_after_init")))
+ #endif
+
++#define __read_only __ro_after_init
++
+ #ifndef ____cacheline_aligned
+ #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
+ #endif
+diff --git a/include/linux/capability.h b/include/linux/capability.h
+index f640dcbc880c..2b4f5d651f19 100644
+--- a/include/linux/capability.h
++++ b/include/linux/capability.h
+@@ -207,6 +207,7 @@ extern bool has_capability_noaudit(struct task_struct *t, int cap);
+ extern bool has_ns_capability_noaudit(struct task_struct *t,
+				      struct user_namespace *ns, int cap);
+ extern bool capable(int cap);
++extern bool capable_noaudit(int cap);
+ extern bool ns_capable(struct user_namespace *ns, int cap);
+ extern bool ns_capable_noaudit(struct user_namespace *ns, int cap);
+ #else
+@@ -232,6 +233,10 @@ static inline bool capable(int cap)
+ {
+	return true;
+ }
++static inline bool capable_noaudit(int cap)
++{
++	return true;
++}
+ static inline bool ns_capable(struct user_namespace *ns, int cap)
+ {
+	return true;
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index cc613f20e5a6..7606596d6c2e 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -3392,4 +3392,15 @@ static inline bool dir_relax_shared(struct inode *inode)
+ extern bool path_noexec(const struct path *path);
+ extern void inode_nohighmem(struct inode *inode);
+
++extern int device_sidechannel_restrict;
++
++static inline bool is_sidechannel_device(const struct inode *inode)
++{
++	umode_t mode;
++	if (!device_sidechannel_restrict)
++		return false;
++	mode = inode->i_mode;
++	return ((S_ISCHR(mode) || S_ISBLK(mode)) && (mode & (S_IROTH | S_IWOTH)));
++}
++
+ #endif /* _LINUX_FS_H */
+diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h
+index bdaf22582f6e..326ff15d4637 100644
+--- a/include/linux/fsnotify.h
++++ b/include/linux/fsnotify.h
+@@ -181,6 +181,9 @@ static inline void fsnotify_access(struct file *file)
+	struct inode *inode = path->dentry->d_inode;
+	__u32 mask = FS_ACCESS;
+
++	if (is_sidechannel_device(inode))
++		return;
++
+	if (S_ISDIR(inode->i_mode))
+		mask |= FS_ISDIR;
+
+@@ -199,6 +202,9 @@ static inline void fsnotify_modify(struct file *file)
+	struct inode *inode = path->dentry->d_inode;
+	__u32 mask = FS_MODIFY;
+
++	if (is_sidechannel_device(inode))
++		return;
++
+	if (S_ISDIR(inode->i_mode))
+		mask |= FS_ISDIR;
+
+diff --git a/include/linux/gfp.h b/include/linux/gfp.h
+index b041f94678de..a5e0175c79e0 100644
+--- a/include/linux/gfp.h
++++ b/include/linux/gfp.h
+@@ -518,9 +518,9 @@ extern struct page *alloc_pages_vma(gfp_t gfp_mask, int order,
+ extern unsigned long __get_free_pages(gfp_t gfp_mask, unsigned int order);
+ extern unsigned long get_zeroed_page(gfp_t gfp_mask);
+
+-void *alloc_pages_exact(size_t size, gfp_t gfp_mask);
++void *alloc_pages_exact(size_t size, gfp_t gfp_mask) __attribute__((alloc_size(1)));
+ void free_pages_exact(void *virt, size_t size);
+-void * __meminit alloc_pages_exact_nid(int nid, size_t size, gfp_t gfp_mask);
++void * __meminit alloc_pages_exact_nid(int nid, size_t size, gfp_t gfp_mask) __attribute__((alloc_size(1)));
+
+ #define __get_free_page(gfp_mask) \
+		__get_free_pages((gfp_mask), 0)
+diff --git a/include/linux/highmem.h b/include/linux/highmem.h
+index 776f90f3a1cd..3f5c47000059 100644
+--- a/include/linux/highmem.h
++++ b/include/linux/highmem.h
+@@ -191,6 +191,13 @@ static inline void clear_highpage(struct page *page)
+	kunmap_atomic(kaddr);
+ }
+
++static inline void verify_zero_highpage(struct page *page)
++{
++	void *kaddr = kmap_atomic(page);
++	BUG_ON(memchr_inv(kaddr, 0, PAGE_SIZE));
++	kunmap_atomic(kaddr);
++}
++
+ static inline void zero_user_segments(struct page *page,
+	unsigned start1, unsigned end1,
+	unsigned start2, unsigned end2)
+diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
+index 69c238210325..ee487ea4f48f 100644
+--- a/include/linux/interrupt.h
++++ b/include/linux/interrupt.h
+@@ -485,7 +485,7 @@ extern const char * const softirq_to_name[NR_SOFTIRQS];
+
+ struct softirq_action
+ {
+-	void	(*action)(struct softirq_action *);
++	void	(*action)(void);
+ };
+
+ asmlinkage void do_softirq(void);
+@@ -500,7 +500,7 @@ static inline void do_softirq_own_stack(void)
+ }
+ #endif
+
+-extern void open_softirq(int nr, void (*action)(struct softirq_action *));
++extern void __init open_softirq(int nr, void (*action)(void));
+ extern void softirq_init(void);
+ extern void __raise_softirq_irqoff(unsigned int nr);
+
+diff --git a/include/linux/kobject_ns.h b/include/linux/kobject_ns.h
+index df32d2508290..c992d130b94d 100644
+--- a/include/linux/kobject_ns.h
++++ b/include/linux/kobject_ns.h
+@@ -46,7 +46,7 @@ struct kobj_ns_type_operations {
+	void (*drop_ns)(void *);
+ };
+
+-int kobj_ns_type_register(const struct kobj_ns_type_operations *ops);
++int __init kobj_ns_type_register(const struct kobj_ns_type_operations *ops);
+ int kobj_ns_type_registered(enum kobj_ns_type type);
+ const struct kobj_ns_type_operations *kobj_child_ns_ops(struct kobject *parent);
+ const struct kobj_ns_type_operations *kobj_ns_ops(struct kobject *kobj);
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index f23215854c80..98df98c44cc0 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -525,7 +525,7 @@ static inline int is_vmalloc_or_module_addr(const void *x)
+ }
+ #endif
+
+-extern void *kvmalloc_node(size_t size, gfp_t flags, int node);
++extern void *kvmalloc_node(size_t size, gfp_t flags, int node) __attribute__((alloc_size(1)));
+ static inline void *kvmalloc(size_t size, gfp_t flags)
+ {
+	return kvmalloc_node(size, flags, NUMA_NO_NODE);
+diff --git a/include/linux/percpu.h b/include/linux/percpu.h
+index 296bbe49d5d1..b26652c9a98d 100644
+--- a/include/linux/percpu.h
++++ b/include/linux/percpu.h
+@@ -129,7 +129,7 @@ extern int __init pcpu_page_first_chunk(size_t reserved_size,
+				pcpu_fc_populate_pte_fn_t populate_pte_fn);
+ #endif
+
+-extern void __percpu *__alloc_reserved_percpu(size_t size, size_t align);
++extern void __percpu *__alloc_reserved_percpu(size_t size, size_t align) __attribute__((alloc_size(1)));
+ extern bool __is_kernel_percpu_address(unsigned long addr, unsigned long *can_addr);
+ extern bool is_kernel_percpu_address(unsigned long addr);
+
+@@ -137,8 +137,8 @@ extern bool is_kernel_percpu_address(unsigned long addr);
+ extern void __init setup_per_cpu_areas(void);
+ #endif
+
+-extern void __percpu *__alloc_percpu_gfp(size_t size, size_t align, gfp_t gfp);
+-extern void __percpu *__alloc_percpu(size_t size, size_t align);
++extern void __percpu *__alloc_percpu_gfp(size_t size, size_t align, gfp_t gfp) __attribute__((alloc_size(1)));
++extern void __percpu *__alloc_percpu(size_t size, size_t align) __attribute__((alloc_size(1)));
+ extern void free_percpu(void __percpu *__pdata);
+ extern phys_addr_t per_cpu_ptr_to_phys(void *addr);
+
+diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
+index 8e22f24ded6a..b7fecdfa6de5 100644
+--- a/include/linux/perf_event.h
++++ b/include/linux/perf_event.h
+@@ -1165,6 +1165,11 @@ extern int perf_cpu_time_max_percent_handler(struct ctl_table *table, int write,
+ int perf_event_max_stack_handler(struct ctl_table *table, int write,
+				 void __user *buffer, size_t *lenp, loff_t *ppos);
+
++static inline bool perf_paranoid_any(void)
++{
++	return sysctl_perf_event_paranoid > 2;
++}
++
+ static inline bool perf_paranoid_tracepoint_raw(void)
+ {
+	return sysctl_perf_event_paranoid > -1;
+diff --git a/include/linux/slab.h b/include/linux/slab.h
+index ae5ed6492d54..fd0786124504 100644
+--- a/include/linux/slab.h
++++ b/include/linux/slab.h
+@@ -146,8 +146,8 @@ void memcg_destroy_kmem_caches(struct mem_cgroup *);
+ /*
+  * Common kmalloc functions provided by all allocators
+  */
+-void * __must_check __krealloc(const void *, size_t, gfp_t);
+-void * __must_check krealloc(const void *, size_t, gfp_t);
++void * __must_check __krealloc(const void *, size_t, gfp_t) __attribute__((alloc_size(2)));
++void * __must_check krealloc(const void *, size_t, gfp_t) __attribute((alloc_size(2)));
+ void kfree(const void *);
+ void kzfree(const void *);
+ size_t ksize(const void *);
+@@ -324,7 +324,7 @@ static __always_inline int kmalloc_index(size_t size)
+ }
+ #endif /* !CONFIG_SLOB */
+
+-void *__kmalloc(size_t size, gfp_t flags) __assume_kmalloc_alignment __malloc;
++void *__kmalloc(size_t size, gfp_t flags) __assume_kmalloc_alignment __malloc __attribute__((alloc_size(1)));
+ void *kmem_cache_alloc(struct kmem_cache *, gfp_t flags) __assume_slab_alignment __malloc;
+ void kmem_cache_free(struct kmem_cache *, void *);
+
+@@ -348,7 +348,7 @@ static __always_inline void kfree_bulk(size_t size, void **p)
+ }
+
+ #ifdef CONFIG_NUMA
+-void *__kmalloc_node(size_t size, gfp_t flags, int node) __assume_kmalloc_alignment __malloc;
++void *__kmalloc_node(size_t size, gfp_t flags, int node) __assume_kmalloc_alignment __malloc __attribute__((alloc_size(1)));
+ void *kmem_cache_alloc_node(struct kmem_cache *, gfp_t flags, int node) __assume_slab_alignment __malloc;
+ #else
+ static __always_inline void *__kmalloc_node(size_t size, gfp_t flags, int node)
+@@ -473,7 +473,7 @@ static __always_inline void *kmalloc_large(size_t size, gfp_t flags)
+  * for general use, and so are not documented here. For a full list of
+  * potential flags, always refer to linux/gfp.h.
+  */
+-static __always_inline void *kmalloc(size_t size, gfp_t flags)
++static __always_inline __attribute__((alloc_size(1))) void *kmalloc(size_t size, gfp_t flags)
+ {
+	if (__builtin_constant_p(size)) {
+		if (size > KMALLOC_MAX_CACHE_SIZE)
+@@ -513,7 +513,7 @@ static __always_inline int kmalloc_size(int n)
+	return 0;
+ }
+
+-static __always_inline void *kmalloc_node(size_t size, gfp_t flags, int node)
++static __always_inline __attribute__((alloc_size(1))) void *kmalloc_node(size_t size, gfp_t flags, int node)
+ {
+ #ifndef CONFIG_SLOB
+	if (__builtin_constant_p(size) &&
+diff --git a/include/linux/slub_def.h b/include/linux/slub_def.h
+index 39fa09bcde23..0b7a48cd883b 100644
+--- a/include/linux/slub_def.h
++++ b/include/linux/slub_def.h
+@@ -120,6 +120,11 @@ struct kmem_cache {
+	unsigned long random;
+ #endif
+
++#ifdef CONFIG_SLAB_CANARY
++	unsigned long random_active;
++	unsigned long random_inactive;
++#endif
++
+ #ifdef CONFIG_NUMA
+	/*
+	 * Defragmentation by allocating from a remote node.
+diff --git a/include/linux/string.h b/include/linux/string.h
+index cfd83eb2f926..b9ecb42c762d 100644
+--- a/include/linux/string.h
++++ b/include/linux/string.h
+@@ -234,10 +234,16 @@ void __read_overflow2(void) __compiletime_error("detected read beyond size of ob
+ void __read_overflow3(void) __compiletime_error("detected read beyond size of object passed as 3rd parameter");
+ void __write_overflow(void) __compiletime_error("detected write beyond size of object passed as 1st parameter");
+
++#ifdef CONFIG_FORTIFY_SOURCE_STRICT_STRING
++#define __string_size(p) __builtin_object_size(p, 1)
++#else
++#define __string_size(p) __builtin_object_size(p, 0)
++#endif
++
+ #if !defined(__NO_FORTIFY) && defined(__OPTIMIZE__) && defined(CONFIG_FORTIFY_SOURCE)
+ __FORTIFY_INLINE char *strncpy(char *p, const char *q, __kernel_size_t size)
+ {
+-	size_t p_size = __builtin_object_size(p, 0);
++	size_t p_size = __string_size(p);
+	if (__builtin_constant_p(size) && p_size < size)
+		__write_overflow();
+	if (p_size < size)
+@@ -247,7 +253,7 @@ __FORTIFY_INLINE char *strncpy(char *p, const char *q, __kernel_size_t size)
+
+ __FORTIFY_INLINE char *strcat(char *p, const char *q)
+ {
+-	size_t p_size = __builtin_object_size(p, 0);
++	size_t p_size = __string_size(p);
+	if (p_size == (size_t)-1)
+		return __builtin_strcat(p, q);
+	if (strlcat(p, q, p_size) >= p_size)
+@@ -258,7 +264,7 @@ __FORTIFY_INLINE char *strcat(char *p, const char *q)
+ __FORTIFY_INLINE __kernel_size_t strlen(const char *p)
+ {
+	__kernel_size_t ret;
+-	size_t p_size = __builtin_object_size(p, 0);
++	size_t p_size = __string_size(p);
+
+	/* Work around gcc excess stack consumption issue */
+	if (p_size == (size_t)-1 ||
+@@ -273,7 +279,7 @@ __FORTIFY_INLINE __kernel_size_t strlen(const char *p)
+ extern __kernel_size_t __real_strnlen(const char *, __kernel_size_t) __RENAME(strnlen);
+ __FORTIFY_INLINE __kernel_size_t strnlen(const char *p, __kernel_size_t maxlen)
+ {
+-	size_t p_size = __builtin_object_size(p, 0);
++	size_t p_size = __string_size(p);
+	__kernel_size_t ret = __real_strnlen(p, maxlen < p_size ? maxlen : p_size);
+	if (p_size <= ret && maxlen != ret)
+		fortify_panic(__func__);
+@@ -285,8 +291,8 @@ extern size_t __real_strlcpy(char *, const char *, size_t) __RENAME(strlcpy);
+ __FORTIFY_INLINE size_t strlcpy(char *p, const char *q, size_t size)
+ {
+	size_t ret;
+-	size_t p_size = __builtin_object_size(p, 0);
+-	size_t q_size = __builtin_object_size(q, 0);
++	size_t p_size = __string_size(p);
++	size_t q_size = __string_size(q);
+	if (p_size == (size_t)-1 && q_size == (size_t)-1)
+		return __real_strlcpy(p, q, size);
+	ret = strlen(q);
+@@ -306,8 +312,8 @@ __FORTIFY_INLINE size_t strlcpy(char *p, const char *q, size_t size)
+ __FORTIFY_INLINE char *strncat(char *p, const char *q, __kernel_size_t count)
+ {
+	size_t p_len, copy_len;
+-	size_t p_size = __builtin_object_size(p, 0);
+-	size_t q_size = __builtin_object_size(q, 0);
++	size_t p_size = __string_size(p);
++	size_t q_size = __string_size(q);
+	if (p_size == (size_t)-1 && q_size == (size_t)-1)
+		return __builtin_strncat(p, q, count);
+	p_len = strlen(p);
+@@ -420,8 +426,8 @@ __FORTIFY_INLINE void *kmemdup(const void *p, size_t size, gfp_t gfp)
+ /* defined after fortified strlen and memcpy to reuse them */
+ __FORTIFY_INLINE char *strcpy(char *p, const char *q)
+ {
+-	size_t p_size = __builtin_object_size(p, 0);
+-	size_t q_size = __builtin_object_size(q, 0);
++	size_t p_size = __string_size(p);
++	size_t q_size = __string_size(q);
+	if (p_size == (size_t)-1 && q_size == (size_t)-1)
+		return __builtin_strcpy(p, q);
+	memcpy(p, q, strlen(q) + 1);
+diff --git a/include/linux/tty.h b/include/linux/tty.h
+index 1dd587ba6d88..9a9a04fb641d 100644
+--- a/include/linux/tty.h
++++ b/include/linux/tty.h
+@@ -13,6 +13,7 @@
+ #include <uapi/linux/tty.h>
+ #include <linux/rwsem.h>
+ #include <linux/llist.h>
++#include <linux/user_namespace.h>
+
+
+ /*
+@@ -335,6 +336,7 @@ struct tty_struct {
+	/* If the tty has a pending do_SAK, queue it here - akpm */
+	struct work_struct SAK_work;
+	struct tty_port *port;
++	struct user_namespace *owner_user_ns;
+ } __randomize_layout;
+
+ /* Each of a tty's open files has private_data pointing to tty_file_private */
+@@ -344,6 +346,8 @@ struct tty_file_private {
+	struct list_head list;
+ };
+
++extern int tiocsti_restrict;
++
+ /* tty magic number */
+ #define TTY_MAGIC		0x5401
+
+diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h
+index 1e5d8c392f15..66d0e49c9987 100644
+--- a/include/linux/vmalloc.h
++++ b/include/linux/vmalloc.h
+@@ -68,19 +68,19 @@ static inline void vmalloc_init(void)
+ }
+ #endif
+
+-extern void *vmalloc(unsigned long size);
+-extern void *vzalloc(unsigned long size);
+-extern void *vmalloc_user(unsigned long size);
+-extern void *vmalloc_node(unsigned long size, int node);
+-extern void *vzalloc_node(unsigned long size, int node);
+-extern void *vmalloc_exec(unsigned long size);
+-extern void *vmalloc_32(unsigned long size);
+-extern void *vmalloc_32_user(unsigned long size);
+-extern void *__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot);
++extern void *vmalloc(unsigned long size) __attribute__((alloc_size(1)));
++extern void *vzalloc(unsigned long size) __attribute__((alloc_size(1)));
++extern void *vmalloc_user(unsigned long size) __attribute__((alloc_size(1)));
++extern void *vmalloc_node(unsigned long size, int node) __attribute__((alloc_size(1)));
++extern void *vzalloc_node(unsigned long size, int node) __attribute__((alloc_size(1)));
++extern void *vmalloc_exec(unsigned long size) __attribute__((alloc_size(1)));
++extern void *vmalloc_32(unsigned long size) __attribute__((alloc_size(1)));
++extern void *vmalloc_32_user(unsigned long size) __attribute__((alloc_size(1)));
++extern void *__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot) __attribute__((alloc_size(1)));
+ extern void *__vmalloc_node_range(unsigned long size, unsigned long align,
+			unsigned long start, unsigned long end, gfp_t gfp_mask,
+			pgprot_t prot, unsigned long vm_flags, int node,
+-			const void *caller);
++			const void *caller) __attribute__((alloc_size(1)));
+ #ifndef CONFIG_MMU
+ extern void *__vmalloc_node_flags(unsigned long size, int node, gfp_t flags);
+ static inline void *__vmalloc_node_flags_caller(unsigned long size, int node,
+diff --git a/init/Kconfig b/init/Kconfig
+index 46075327c165..0c78750bc76d 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -309,6 +309,7 @@ config USELIB
+ config AUDIT
+	bool "Auditing support"
+	depends on NET
++	default y
+	help
+	  Enable auditing infrastructure that can be used with another
+	  kernel subsystem, such as SELinux (which requires this for
+@@ -1052,6 +1053,12 @@ config CC_OPTIMIZE_FOR_SIZE
+
+ endchoice
+
++config LOCAL_INIT
++	bool "Zero uninitialized locals"
++	help
++	  Zero-fill uninitialized local variables, other than variable-length
++	  arrays. Requires compiler support.
++
+ config SYSCTL
+	bool
+
+@@ -1361,8 +1368,7 @@ config SHMEM
+	  which may be appropriate on small systems without swap.
+
+ config AIO
+-	bool "Enable AIO support" if EXPERT
+-	default y
++	bool "Enable AIO support"
+	help
+	  This option enables POSIX asynchronous I/O which may by used
+	  by some high performance threaded applications. Disabling
+@@ -1491,7 +1497,7 @@ config VM_EVENT_COUNTERS
+
+ config SLUB_DEBUG
+	default y
+-	bool "Enable SLUB debugging support" if EXPERT
++	bool "Enable SLUB debugging support"
+	depends on SLUB && SYSFS
+	help
+	  SLUB has extensive debug support features. Disabling these can
+@@ -1515,7 +1521,6 @@ config SLUB_MEMCG_SYSFS_ON
+
+ config COMPAT_BRK
+	bool "Disable heap randomization"
+-	default y
+	help
+	  Randomizing heap placement makes heap exploits harder, but it
+	  also breaks ancient binaries (including anything libc5 based).
+@@ -1562,7 +1567,6 @@ endchoice
+
+ config SLAB_MERGE_DEFAULT
+	bool "Allow slab caches to be merged"
+-	default y
+	help
+	  For reduced kernel memory fragmentation, slab caches can be
+	  merged when they share the same size and other characteristics.
+@@ -1575,9 +1579,9 @@ config SLAB_MERGE_DEFAULT
+	  command line.
+
+ config SLAB_FREELIST_RANDOM
+-	default n
+	depends on SLAB || SLUB
+	bool "SLAB freelist randomization"
++	default y
+	help
+	  Randomizes the freelist order used on creating new pages. This
+	  security feature reduces the predictability of the kernel slab
+@@ -1586,12 +1590,56 @@ config SLAB_FREELIST_RANDOM
+ config SLAB_FREELIST_HARDENED
+	bool "Harden slab freelist metadata"
+	depends on SLUB
++	default y
+	help
+	  Many kernel heap attacks try to target slab cache metadata and
+	  other infrastructure. This options makes minor performance
+	  sacrifies to harden the kernel slab allocator against common
+	  freelist exploit methods.
+
++config SLAB_HARDENED
++	default y
++	depends on SLUB
++	bool "Hardened SLAB infrastructure"
++	help
++          Make minor performance sacrifices to harden the kernel slab
++          allocator.
++
++config SLAB_CANARY
++	depends on SLUB
++	depends on !SLAB_MERGE_DEFAULT
++	bool "SLAB canaries"
++	default y
++	help
++	  Place canaries at the end of kernel slab allocations, sacrificing
++	  some performance and memory usage for security.
++
++	  Canaries can detect some forms of heap corruption when allocations
++	  are freed and as part of the HARDENED_USERCOPY feature. It provides
++	  basic use-after-free detection for HARDENED_USERCOPY.
++
++	  Canaries absorb small overflows (rendering them harmless), mitigate
++	  non-NUL terminated C string overflows on 64-bit via a guaranteed zero
++	  byte and provide basic double-free detection.
++
++config SLAB_SANITIZE
++	bool "Sanitize SLAB allocations"
++	depends on SLUB
++	default y
++	help
++	  Zero fill slab allocations on free, reducing the lifetime of
++	  sensitive data and helping to mitigate use-after-free bugs.
++
++	  For slabs with debug poisoning enabling, this has no impact.
++
++config SLAB_SANITIZE_VERIFY
++	depends on SLAB_SANITIZE && PAGE_SANITIZE
++	default y
++	bool "Verify sanitized SLAB allocations"
++	help
++	  Verify that newly allocated slab allocations are zeroed to detect
++	  write-after-free bugs.
++
+ config SLUB_CPU_PARTIAL
+	default y
+	depends on SLUB && SMP
+diff --git a/kernel/audit.c b/kernel/audit.c
+index 5b34d3114af4..e57930192ce1 100644
+--- a/kernel/audit.c
++++ b/kernel/audit.c
+@@ -1573,6 +1573,9 @@ static int __init audit_enable(char *str)
+	audit_default = !!simple_strtol(str, NULL, 0);
+	if (!audit_default)
+		audit_initialized = AUDIT_DISABLED;
++        else
++		audit_initialized = AUDIT_UNINITIALIZED;
++
+	audit_enabled = audit_default;
+	audit_ever_enabled = !!audit_enabled;
+
+diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
+index d203a5d6b726..2a6c3e2c57a6 100644
+--- a/kernel/bpf/core.c
++++ b/kernel/bpf/core.c
+@@ -539,7 +539,7 @@ void __weak bpf_jit_free(struct bpf_prog *fp)
+	bpf_prog_unlock_free(fp);
+ }
+
+-int bpf_jit_harden __read_mostly;
++int bpf_jit_harden __read_mostly = 2;
+
+ static int bpf_jit_blind_insn(const struct bpf_insn *from,
+			      const struct bpf_insn *aux,
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index 4e933219fec6..0f37db32a2b1 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -37,7 +37,7 @@ static DEFINE_SPINLOCK(prog_idr_lock);
+ static DEFINE_IDR(map_idr);
+ static DEFINE_SPINLOCK(map_idr_lock);
+
+-int sysctl_unprivileged_bpf_disabled __read_mostly;
++int sysctl_unprivileged_bpf_disabled __read_mostly = 1;
+
+ static const struct bpf_map_ops * const bpf_map_types[] = {
+ #define BPF_PROG_TYPE(_id, _ops)
+diff --git a/kernel/capability.c b/kernel/capability.c
+index 1e1c0236f55b..452062fe45ce 100644
+--- a/kernel/capability.c
++++ b/kernel/capability.c
+@@ -431,6 +431,12 @@ bool capable(int cap)
+	return ns_capable(&init_user_ns, cap);
+ }
+ EXPORT_SYMBOL(capable);
++
++bool capable_noaudit(int cap)
++{
++	return ns_capable_noaudit(&init_user_ns, cap);
++}
++EXPORT_SYMBOL(capable_noaudit);
+ #endif /* CONFIG_MULTIUSER */
+
+ /**
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index cb8274d7824f..c1b3d232b0a4 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -397,8 +397,13 @@ static cpumask_var_t perf_online_mask;
+  *   0 - disallow raw tracepoint access for unpriv
+  *   1 - disallow cpu events for unpriv
+  *   2 - disallow kernel profiling for unpriv
++ *   3 - disallow all unpriv perf event use
+  */
++#ifdef CONFIG_SECURITY_PERF_EVENTS_RESTRICT
++int sysctl_perf_event_paranoid __read_mostly = 3;
++#else
+ int sysctl_perf_event_paranoid __read_mostly = 2;
++#endif
+
+ /* Minimum for 512 kiB + 1 user control page */
+ int sysctl_perf_event_mlock __read_mostly = 512 + (PAGE_SIZE / 1024); /* 'free' kiB per user */
+@@ -9941,6 +9946,9 @@ SYSCALL_DEFINE5(perf_event_open,
+	if (flags & ~PERF_FLAG_ALL)
+		return -EINVAL;
+
++	if (perf_paranoid_any() && !capable(CAP_SYS_ADMIN))
++		return -EACCES;
++
+	err = perf_copy_attr(attr_uptr, &attr);
+	if (err)
+		return err;
+diff --git a/kernel/fork.c b/kernel/fork.c
+index 98c91bd341b4..dbb9540ee61c 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -102,6 +102,11 @@
+
+ #define CREATE_TRACE_POINTS
+ #include <trace/events/task.h>
++#ifdef CONFIG_USER_NS
++extern int unprivileged_userns_clone;
++#else
++#define unprivileged_userns_clone 0
++#endif
+
+ /*
+  * Minimum number of threads to boot the kernel
+@@ -1554,6 +1559,10 @@ static __latent_entropy struct task_struct *copy_process(
+	if ((clone_flags & (CLONE_NEWUSER|CLONE_FS)) == (CLONE_NEWUSER|CLONE_FS))
+		return ERR_PTR(-EINVAL);
+
++	if ((clone_flags & CLONE_NEWUSER) && !unprivileged_userns_clone)
++		if (!capable(CAP_SYS_ADMIN))
++			return ERR_PTR(-EPERM);
++
+	/*
+	 * Thread groups must share signals as well, and detached threads
+	 * can only be started up within the thread group.
+@@ -2347,6 +2356,12 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
+	if (unshare_flags & CLONE_NEWNS)
+		unshare_flags |= CLONE_FS;
+
++	if ((unshare_flags & CLONE_NEWUSER) && !unprivileged_userns_clone) {
++		err = -EPERM;
++		if (!capable(CAP_SYS_ADMIN))
++			goto bad_unshare_out;
++	}
++
+	err = check_unshare_flags(unshare_flags);
+	if (err)
+		goto bad_unshare_out;
+diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
+index 0972a8e09d08..00dde7aad47a 100644
+--- a/kernel/power/snapshot.c
++++ b/kernel/power/snapshot.c
+@@ -1136,7 +1136,7 @@ void free_basic_memory_bitmaps(void)
+
+ void clear_free_pages(void)
+ {
+-#ifdef CONFIG_PAGE_POISONING_ZERO
++#if defined(CONFIG_PAGE_POISONING_ZERO) || defined(CONFIG_PAGE_SANITIZE)
+	struct memory_bitmap *bm = free_pages_map;
+	unsigned long pfn;
+
+@@ -1153,7 +1153,7 @@ void clear_free_pages(void)
+	}
+	memory_bm_position_reset(bm);
+	pr_info("PM: free pages cleared after restore\n");
+-#endif /* PAGE_POISONING_ZERO */
++#endif /* PAGE_POISONING_ZERO || PAGE_SANITIZE */
+ }
+
+ /**
+diff --git a/kernel/rcu/tiny.c b/kernel/rcu/tiny.c
+index a64eee0db39e..4d7de378fe4c 100644
+--- a/kernel/rcu/tiny.c
++++ b/kernel/rcu/tiny.c
+@@ -164,7 +164,7 @@ static void __rcu_process_callbacks(struct rcu_ctrlblk *rcp)
+	}
+ }
+
+-static __latent_entropy void rcu_process_callbacks(struct softirq_action *unused)
++static __latent_entropy void rcu_process_callbacks(void)
+ {
+	__rcu_process_callbacks(&rcu_sched_ctrlblk);
+	__rcu_process_callbacks(&rcu_bh_ctrlblk);
+diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
+index 3e3650e94ae6..7ecd7a5d04b3 100644
+--- a/kernel/rcu/tree.c
++++ b/kernel/rcu/tree.c
+@@ -2918,7 +2918,7 @@ __rcu_process_callbacks(struct rcu_state *rsp)
+ /*
+  * Do RCU core processing for the current CPU.
+  */
+-static __latent_entropy void rcu_process_callbacks(struct softirq_action *unused)
++static __latent_entropy void rcu_process_callbacks(void)
+ {
+	struct rcu_state *rsp;
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 5c09ddf8c832..f5db6ece105a 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -8986,7 +8986,7 @@ static void nohz_idle_balance(struct rq *this_rq, enum cpu_idle_type idle) { }
+  * run_rebalance_domains is triggered when needed from the scheduler tick.
+  * Also triggered for nohz idle balancing (with nohz_balancing_kick set).
+  */
+-static __latent_entropy void run_rebalance_domains(struct softirq_action *h)
++static __latent_entropy void run_rebalance_domains(void)
+ {
+	struct rq *this_rq = this_rq();
+	enum cpu_idle_type idle = this_rq->idle_balance ?
+diff --git a/kernel/softirq.c b/kernel/softirq.c
+index e89c3b0cff6d..0d3ebd520931 100644
+--- a/kernel/softirq.c
++++ b/kernel/softirq.c
+@@ -53,7 +53,7 @@ irq_cpustat_t irq_stat[NR_CPUS] ____cacheline_aligned;
+ EXPORT_SYMBOL(irq_stat);
+ #endif
+
+-static struct softirq_action softirq_vec[NR_SOFTIRQS] __cacheline_aligned_in_smp;
++static struct softirq_action softirq_vec[NR_SOFTIRQS] __ro_after_init __aligned(PAGE_SIZE);
+
+ DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
+
+@@ -281,7 +281,7 @@ asmlinkage __visible void __softirq_entry __do_softirq(void)
+		kstat_incr_softirqs_this_cpu(vec_nr);
+
+		trace_softirq_entry(vec_nr);
+-		h->action(h);
++		h->action();
+		trace_softirq_exit(vec_nr);
+		if (unlikely(prev_count != preempt_count())) {
+			pr_err("huh, entered softirq %u %s %p with preempt_count %08x, exited with %08x?\n",
+@@ -444,7 +444,7 @@ void __raise_softirq_irqoff(unsigned int nr)
+	or_softirq_pending(1UL << nr);
+ }
+
+-void open_softirq(int nr, void (*action)(struct softirq_action *))
++void __init open_softirq(int nr, void (*action)(void))
+ {
+	softirq_vec[nr].action = action;
+ }
+@@ -486,7 +486,7 @@ void __tasklet_hi_schedule(struct tasklet_struct *t)
+ }
+ EXPORT_SYMBOL(__tasklet_hi_schedule);
+
+-static __latent_entropy void tasklet_action(struct softirq_action *a)
++static __latent_entropy void tasklet_action(void)
+ {
+	struct tasklet_struct *list;
+
+@@ -522,7 +522,7 @@ static __latent_entropy void tasklet_action(struct softirq_action *a)
+	}
+ }
+
+-static __latent_entropy void tasklet_hi_action(struct softirq_action *a)
++static __latent_entropy void tasklet_hi_action(void)
+ {
+	struct tasklet_struct *list;
+
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index 069550540a39..822783a174aa 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -66,6 +66,7 @@
+ #include <linux/kexec.h>
+ #include <linux/bpf.h>
+ #include <linux/mount.h>
++#include <linux/tty.h>
+
+ #include <linux/uaccess.h>
+ #include <asm/processor.h>
+@@ -98,12 +99,19 @@
+ #if defined(CONFIG_SYSCTL)
+
+ /* External variables not in a header file. */
++#if IS_ENABLED(CONFIG_USB)
++int deny_new_usb __read_mostly = 0;
++EXPORT_SYMBOL(deny_new_usb);
++#endif
+ extern int suid_dumpable;
+ #ifdef CONFIG_COREDUMP
+ extern int core_uses_pid;
+ extern char core_pattern[];
+ extern unsigned int core_pipe_limit;
+ #endif
++#ifdef CONFIG_USER_NS
++extern int unprivileged_userns_clone;
++#endif
+ extern int pid_max;
+ extern int pid_max_min, pid_max_max;
+ extern int percpu_pagelist_fraction;
+@@ -115,40 +123,43 @@ extern int sysctl_nr_trim_pages;
+
+ /* Constants used for minimum and  maximum */
+ #ifdef CONFIG_LOCKUP_DETECTOR
+-static int sixty = 60;
++static int sixty __read_only = 60;
+ #endif
+
+-static int __maybe_unused neg_one = -1;
++static int __maybe_unused neg_one __read_only = -1;
+
+ static int zero;
+-static int __maybe_unused one = 1;
+-static int __maybe_unused two = 2;
+-static int __maybe_unused four = 4;
+-static unsigned long one_ul = 1;
+-static int one_hundred = 100;
+-static int one_thousand = 1000;
++static int __maybe_unused one __read_only = 1;
++static int __maybe_unused two __read_only = 2;
++static int __maybe_unused four __read_only = 4;
++static unsigned long one_ul __read_only = 1;
++static int one_hundred __read_only = 100;
++static int one_thousand __read_only = 1000;
+ #ifdef CONFIG_PRINTK
+-static int ten_thousand = 10000;
++static int ten_thousand __read_only = 10000;
+ #endif
+ #ifdef CONFIG_PERF_EVENTS
+-static int six_hundred_forty_kb = 640 * 1024;
++static int six_hundred_forty_kb __read_only = 640 * 1024;
+ #endif
+
+ /* this is needed for the proc_doulongvec_minmax of vm_dirty_bytes */
+-static unsigned long dirty_bytes_min = 2 * PAGE_SIZE;
++static unsigned long dirty_bytes_min __read_only = 2 * PAGE_SIZE;
+
+ /* this is needed for the proc_dointvec_minmax for [fs_]overflow UID and GID */
+-static int maxolduid = 65535;
+-static int minolduid;
++static int maxolduid __read_only = 65535;
++static int minolduid __read_only;
+
+-static int ngroups_max = NGROUPS_MAX;
++static int ngroups_max __read_only = NGROUPS_MAX;
+ static const int cap_last_cap = CAP_LAST_CAP;
+
+ /*this is needed for proc_doulongvec_minmax of sysctl_hung_task_timeout_secs */
+ #ifdef CONFIG_DETECT_HUNG_TASK
+-static unsigned long hung_task_timeout_max = (LONG_MAX/HZ);
++static unsigned long hung_task_timeout_max __read_only = (LONG_MAX/HZ);
+ #endif
+
++int device_sidechannel_restrict __read_mostly = 1;
++EXPORT_SYMBOL(device_sidechannel_restrict);
++
+ #ifdef CONFIG_INOTIFY_USER
+ #include <linux/inotify.h>
+ #endif
+@@ -286,19 +297,19 @@ static struct ctl_table sysctl_base_table[] = {
+ };
+
+ #ifdef CONFIG_SCHED_DEBUG
+-static int min_sched_granularity_ns = 100000;		/* 100 usecs */
+-static int max_sched_granularity_ns = NSEC_PER_SEC;	/* 1 second */
+-static int min_wakeup_granularity_ns;			/* 0 usecs */
+-static int max_wakeup_granularity_ns = NSEC_PER_SEC;	/* 1 second */
++static int min_sched_granularity_ns __read_only = 100000;		/* 100 usecs */
++static int max_sched_granularity_ns __read_only = NSEC_PER_SEC;	/* 1 second */
++static int min_wakeup_granularity_ns __read_only;			/* 0 usecs */
++static int max_wakeup_granularity_ns __read_only = NSEC_PER_SEC;	/* 1 second */
+ #ifdef CONFIG_SMP
+-static int min_sched_tunable_scaling = SCHED_TUNABLESCALING_NONE;
+-static int max_sched_tunable_scaling = SCHED_TUNABLESCALING_END-1;
++static int min_sched_tunable_scaling __read_only = SCHED_TUNABLESCALING_NONE;
++static int max_sched_tunable_scaling __read_only = SCHED_TUNABLESCALING_END-1;
+ #endif /* CONFIG_SMP */
+ #endif /* CONFIG_SCHED_DEBUG */
+
+ #ifdef CONFIG_COMPACTION
+-static int min_extfrag_threshold;
+-static int max_extfrag_threshold = 1000;
++static int min_extfrag_threshold __read_only;
++static int max_extfrag_threshold __read_only = 1000;
+ #endif
+
+ static struct ctl_table kern_table[] = {
+@@ -512,6 +523,15 @@ static struct ctl_table kern_table[] = {
+		.proc_handler	= proc_dointvec,
+	},
+ #endif
++#ifdef CONFIG_USER_NS
++	{
++		.procname	= "unprivileged_userns_clone",
++		.data		= &unprivileged_userns_clone,
++		.maxlen		= sizeof(int),
++		.mode		= 0644,
++		.proc_handler	= proc_dointvec,
++	},
++#endif
+ #ifdef CONFIG_PROC_SYSCTL
+	{
+		.procname	= "tainted",
+@@ -853,6 +873,37 @@ static struct ctl_table kern_table[] = {
+		.extra1		= &zero,
+		.extra2		= &two,
+	},
++#endif
++#if defined CONFIG_TTY
++	{
++		.procname	= "tiocsti_restrict",
++		.data		= &tiocsti_restrict,
++		.maxlen		= sizeof(int),
++		.mode		= 0644,
++		.proc_handler	= proc_dointvec_minmax_sysadmin,
++		.extra1		= &zero,
++		.extra2		= &one,
++	},
++#endif
++	{
++		.procname	= "device_sidechannel_restrict",
++		.data		= &device_sidechannel_restrict,
++		.maxlen		= sizeof(int),
++		.mode		= 0644,
++		.proc_handler	= proc_dointvec_minmax_sysadmin,
++		.extra1		= &zero,
++		.extra2		= &one,
++	},
++#if IS_ENABLED(CONFIG_USB)
++	{
++		.procname	= "deny_new_usb",
++		.data		= &deny_new_usb,
++		.maxlen		= sizeof(int),
++		.mode		= 0644,
++		.proc_handler	= proc_dointvec_minmax_sysadmin,
++		.extra1		= &zero,
++		.extra2		= &one,
++	},
+ #endif
+	{
+		.procname	= "ngroups_max",
+diff --git a/kernel/time/timer.c b/kernel/time/timer.c
+index 9fe525f410bf..6a85b0e1292e 100644
+--- a/kernel/time/timer.c
++++ b/kernel/time/timer.c
+@@ -1624,7 +1624,7 @@ static inline void __run_timers(struct timer_base *base)
+ /*
+  * This function runs timers and the timer-tq in bottom half context.
+  */
+-static __latent_entropy void run_timer_softirq(struct softirq_action *h)
++static __latent_entropy void run_timer_softirq(void)
+ {
+	struct timer_base *base = this_cpu_ptr(&timer_bases[BASE_STD]);
+
+diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
+index c490f1e4313b..dd03bd39d7bf 100644
+--- a/kernel/user_namespace.c
++++ b/kernel/user_namespace.c
+@@ -24,6 +24,9 @@
+ #include <linux/projid.h>
+ #include <linux/fs_struct.h>
+
++/* sysctl */
++int unprivileged_userns_clone;
++
+ static struct kmem_cache *user_ns_cachep __read_mostly;
+ static DEFINE_MUTEX(userns_state_mutex);
+
+diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
+index 62d0e25c054c..3953072277eb 100644
+--- a/lib/Kconfig.debug
++++ b/lib/Kconfig.debug
+@@ -937,6 +937,7 @@ endmenu # "Debug lockups and hangs"
+
+ config PANIC_ON_OOPS
+	bool "Panic on Oops"
++	default y
+	help
+	  Say Y here to enable the kernel to panic when it oopses. This
+	  has the same effect as setting oops=panic on the kernel command
+@@ -946,7 +947,7 @@ config PANIC_ON_OOPS
+	  anything erroneous after an oops which could result in data
+	  corruption or other issues.
+
+-	  Say N if unsure.
++	  Say Y if unsure.
+
+ config PANIC_ON_OOPS_VALUE
+	int
+@@ -1319,6 +1320,7 @@ config DEBUG_BUGVERBOSE
+ config DEBUG_LIST
+	bool "Debug linked list manipulation"
+	depends on DEBUG_KERNEL || BUG_ON_DATA_CORRUPTION
++	default y
+	help
+	  Enable this to turn on extended checks in the linked-list
+	  walking routines.
+@@ -1932,6 +1934,7 @@ config MEMTEST
+ config BUG_ON_DATA_CORRUPTION
+	bool "Trigger a BUG when data corruption is detected"
+	select DEBUG_LIST
++	default y
+	help
+	  Select this option if the kernel should BUG when it encounters
+	  data corruption in kernel memory structures when they get checked
+@@ -1952,7 +1955,7 @@ config STRICT_DEVMEM
+	bool "Filter access to /dev/mem"
+	depends on MMU && DEVMEM
+	depends on ARCH_HAS_DEVMEM_IS_ALLOWED
+-	default y if TILE || PPC
++	default y
+	---help---
+	  If this option is disabled, you allow userspace (root) access to all
+	  of memory, including kernel and userspace memory. Accidental
+@@ -1971,6 +1974,7 @@ config STRICT_DEVMEM
+ config IO_STRICT_DEVMEM
+	bool "Filter I/O access to /dev/mem"
+	depends on STRICT_DEVMEM
++	default y
+	---help---
+	  If this option is disabled, you allow userspace (root) access to all
+	  io-memory regardless of whether a driver is actively using that
+diff --git a/lib/irq_poll.c b/lib/irq_poll.c
+index 86a709954f5a..6f15787fcb1b 100644
+--- a/lib/irq_poll.c
++++ b/lib/irq_poll.c
+@@ -75,7 +75,7 @@ void irq_poll_complete(struct irq_poll *iop)
+ }
+ EXPORT_SYMBOL(irq_poll_complete);
+
+-static void __latent_entropy irq_poll_softirq(struct softirq_action *h)
++static void __latent_entropy irq_poll_softirq(void)
+ {
+	struct list_head *list = this_cpu_ptr(&blk_cpu_iopoll);
+	int rearm = 0, budget = irq_poll_budget;
+diff --git a/lib/kobject.c b/lib/kobject.c
+index 34f847252c02..4fda329de614 100644
+--- a/lib/kobject.c
++++ b/lib/kobject.c
+@@ -956,9 +956,9 @@ EXPORT_SYMBOL_GPL(kset_create_and_add);
+
+
+ static DEFINE_SPINLOCK(kobj_ns_type_lock);
+-static const struct kobj_ns_type_operations *kobj_ns_ops_tbl[KOBJ_NS_TYPES];
++static const struct kobj_ns_type_operations *kobj_ns_ops_tbl[KOBJ_NS_TYPES] __ro_after_init;
+
+-int kobj_ns_type_register(const struct kobj_ns_type_operations *ops)
++int __init kobj_ns_type_register(const struct kobj_ns_type_operations *ops)
+ {
+	enum kobj_ns_type type = ops->type;
+	int error;
+diff --git a/lib/nlattr.c b/lib/nlattr.c
+index 3d8295c85505..3fa3b3409d69 100644
+--- a/lib/nlattr.c
++++ b/lib/nlattr.c
+@@ -341,6 +341,8 @@ int nla_memcpy(void *dest, const struct nlattr *src, int count)
+ {
+	int minlen = min_t(int, count, nla_len(src));
+
++	BUG_ON(minlen < 0);
++
+	memcpy(dest, nla_data(src), minlen);
+	if (count > minlen)
+		memset(dest + minlen, 0, count - minlen);
+diff --git a/lib/vsprintf.c b/lib/vsprintf.c
+index 86c3385b9eb3..c482070e379b 100644
+--- a/lib/vsprintf.c
++++ b/lib/vsprintf.c
+@@ -1591,7 +1591,7 @@ char *device_node_string(char *buf, char *end, struct device_node *dn,
+	return widen_string(buf, buf - buf_start, end, spec);
+ }
+
+-int kptr_restrict __read_mostly;
++int kptr_restrict __read_mostly = 2;
+
+ /*
+  * Show a '%p' thing.  A kernel extension is that the '%p' is followed
+diff --git a/mm/Kconfig b/mm/Kconfig
+index 59efbd3337e0..c070e14ec83d 100644
+--- a/mm/Kconfig
++++ b/mm/Kconfig
+@@ -319,7 +319,8 @@ config KSM
+ config DEFAULT_MMAP_MIN_ADDR
+         int "Low address space to protect from user allocation"
+	depends on MMU
+-        default 4096
++	default 32768 if ARM || (ARM64 && COMPAT)
++	default 65536
+         help
+	  This is the portion of low virtual memory which should be protected
+	  from userspace allocation.  Keeping a user from writing to low pages
+diff --git a/mm/mmap.c b/mm/mmap.c
+index 11f96fad5271..632e7f9a710e 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -220,6 +220,13 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
+
+	newbrk = PAGE_ALIGN(brk);
+	oldbrk = PAGE_ALIGN(mm->brk);
++	/* properly handle unaligned min_brk as an empty heap */
++	if (min_brk & ~PAGE_MASK) {
++		if (brk == min_brk)
++			newbrk -= PAGE_SIZE;
++		if (mm->brk == min_brk)
++			oldbrk -= PAGE_SIZE;
++	}
+	if (oldbrk == newbrk)
+		goto set_brk;
+
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 1d7693c35424..8963a3b4d37c 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -67,6 +67,7 @@
+ #include <linux/ftrace.h>
+ #include <linux/lockdep.h>
+ #include <linux/nmi.h>
++#include <linux/random.h>
+
+ #include <asm/sections.h>
+ #include <asm/tlbflush.h>
+@@ -98,6 +99,15 @@ int _node_numa_mem_[MAX_NUMNODES];
+ DEFINE_MUTEX(pcpu_drain_mutex);
+ DEFINE_PER_CPU(struct work_struct, pcpu_drain);
+
++bool __meminitdata extra_latent_entropy;
++
++static int __init setup_extra_latent_entropy(char *str)
++{
++	extra_latent_entropy = true;
++	return 0;
++}
++early_param("extra_latent_entropy", setup_extra_latent_entropy);
++
+ #ifdef CONFIG_GCC_PLUGIN_LATENT_ENTROPY
+ volatile unsigned long latent_entropy __latent_entropy;
+ EXPORT_SYMBOL(latent_entropy);
+@@ -1063,6 +1073,13 @@ static __always_inline bool free_pages_prepare(struct page *page,
+		debug_check_no_obj_freed(page_address(page),
+					   PAGE_SIZE << order);
+	}
++
++	if (IS_ENABLED(CONFIG_PAGE_SANITIZE)) {
++		int i;
++		for (i = 0; i < (1 << order); i++)
++			clear_highpage(page + i);
++	}
++
+	arch_free_page(page, order);
+	kernel_poison_pages(page, 1 << order, 0);
+	kernel_map_pages(page, 1 << order, 0);
+@@ -1278,6 +1295,21 @@ static void __init __free_pages_boot_core(struct page *page, unsigned int order)
+	__ClearPageReserved(p);
+	set_page_count(p, 0);
+
++	if (extra_latent_entropy && !PageHighMem(page) && page_to_pfn(page) < 0x100000) {
++		unsigned long hash = 0;
++		size_t index, end = PAGE_SIZE * nr_pages / sizeof hash;
++		const unsigned long *data = lowmem_page_address(page);
++
++		for (index = 0; index < end; index++)
++			hash ^= hash + data[index];
++#ifdef CONFIG_GCC_PLUGIN_LATENT_ENTROPY
++		latent_entropy ^= hash;
++		add_device_randomness((const void *)&latent_entropy, sizeof(latent_entropy));
++#else
++		add_device_randomness((const void *)&hash, sizeof(hash));
++#endif
++	}
++
+	page_zone(page)->managed_pages += nr_pages;
+	set_page_refcounted(page);
+	__free_pages(page, order);
+@@ -1718,8 +1750,8 @@ static inline int check_new_page(struct page *page)
+
+ static inline bool free_pages_prezeroed(void)
+ {
+-	return IS_ENABLED(CONFIG_PAGE_POISONING_ZERO) &&
+-		page_poisoning_enabled();
++	return IS_ENABLED(CONFIG_PAGE_SANITIZE) ||
++		(IS_ENABLED(CONFIG_PAGE_POISONING_ZERO) && page_poisoning_enabled());
+ }
+
+ #ifdef CONFIG_DEBUG_VM
+@@ -1776,6 +1808,11 @@ static void prep_new_page(struct page *page, unsigned int order, gfp_t gfp_flags
+
+	post_alloc_hook(page, order, gfp_flags);
+
++	if (IS_ENABLED(CONFIG_PAGE_SANITIZE_VERIFY)) {
++		for (i = 0; i < (1 << order); i++)
++			verify_zero_highpage(page + i);
++	}
++
+	if (!free_pages_prezeroed() && (gfp_flags & __GFP_ZERO))
+		for (i = 0; i < (1 << order); i++)
+			clear_highpage(page + i);
+diff --git a/mm/slab.h b/mm/slab.h
+index 485d9fbb8802..436461588804 100644
+--- a/mm/slab.h
++++ b/mm/slab.h
+@@ -311,7 +311,11 @@ static inline bool is_root_cache(struct kmem_cache *s)
+ static inline bool slab_equal_or_root(struct kmem_cache *s,
+				      struct kmem_cache *p)
+ {
++#ifdef CONFIG_SLAB_HARDENED
++	return p == s;
++#else
+	return true;
++#endif
+ }
+
+ static inline const char *cache_name(struct kmem_cache *s)
+@@ -363,18 +367,26 @@ static inline struct kmem_cache *cache_from_obj(struct kmem_cache *s, void *x)
+	 * to not do even the assignment. In that case, slab_equal_or_root
+	 * will also be a constant.
+	 */
+-	if (!memcg_kmem_enabled() &&
++	if (!IS_ENABLED(CONFIG_SLAB_HARDENED) &&
++	    !memcg_kmem_enabled() &&
+	    !unlikely(s->flags & SLAB_CONSISTENCY_CHECKS))
+		return s;
+
+	page = virt_to_head_page(x);
++#ifdef CONFIG_SLAB_HARDENED
++	BUG_ON(!PageSlab(page));
++#endif
+	cachep = page->slab_cache;
+	if (slab_equal_or_root(cachep, s))
+		return cachep;
+
+	pr_err("%s: Wrong slab cache. %s but object is from %s\n",
+	       __func__, s->name, cachep->name);
++#ifdef CONFIG_BUG_ON_DATA_CORRUPTION
++	BUG_ON(1);
++#else
+	WARN_ON_ONCE(1);
++#endif
+	return s;
+ }
+
+@@ -399,7 +411,7 @@ static inline size_t slab_ksize(const struct kmem_cache *s)
+	 * back there or track user information then we can
+	 * only use the space before that information.
+	 */
+-	if (s->flags & (SLAB_TYPESAFE_BY_RCU | SLAB_STORE_USER))
++	if ((s->flags & (SLAB_TYPESAFE_BY_RCU | SLAB_STORE_USER)) || IS_ENABLED(CONFIG_SLAB_CANARY))
+		return s->inuse;
+	/*
+	 * Else we can use all the padding etc for the allocation
+diff --git a/mm/slab_common.c b/mm/slab_common.c
+index 65212caa1f2a..d8bf8a75f445 100644
+--- a/mm/slab_common.c
++++ b/mm/slab_common.c
+@@ -26,10 +26,10 @@
+
+ #include "slab.h"
+
+-enum slab_state slab_state;
++enum slab_state slab_state __ro_after_init;
+ LIST_HEAD(slab_caches);
+ DEFINE_MUTEX(slab_mutex);
+-struct kmem_cache *kmem_cache;
++struct kmem_cache *kmem_cache __ro_after_init;
+
+ static LIST_HEAD(slab_caches_to_rcu_destroy);
+ static void slab_caches_to_rcu_destroy_workfn(struct work_struct *work);
+@@ -49,7 +49,7 @@ static DECLARE_WORK(slab_caches_to_rcu_destroy_work,
+ /*
+  * Merge control. If this is set then no merging of slab caches will occur.
+  */
+-static bool slab_nomerge = !IS_ENABLED(CONFIG_SLAB_MERGE_DEFAULT);
++static bool slab_nomerge __ro_after_init = !IS_ENABLED(CONFIG_SLAB_MERGE_DEFAULT);
+
+ static int __init setup_slab_nomerge(char *str)
+ {
+@@ -927,7 +927,7 @@ EXPORT_SYMBOL(kmalloc_dma_caches);
+  * of two cache sizes there. The size of larger slabs can be determined using
+  * fls.
+  */
+-static s8 size_index[24] = {
++static s8 size_index[24] __ro_after_init = {
+	3,	/* 8 */
+	4,	/* 16 */
+	5,	/* 24 */
+diff --git a/mm/slub.c b/mm/slub.c
+index 41c01690d116..591dd60d37f3 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -125,6 +125,16 @@ static inline int kmem_cache_debug(struct kmem_cache *s)
+ #endif
+ }
+
++static inline bool has_sanitize(struct kmem_cache *s)
++{
++	return IS_ENABLED(CONFIG_SLAB_SANITIZE) && !(s->flags & (SLAB_TYPESAFE_BY_RCU | SLAB_POISON));
++}
++
++static inline bool has_sanitize_verify(struct kmem_cache *s)
++{
++	return IS_ENABLED(CONFIG_SLAB_SANITIZE_VERIFY) && has_sanitize(s);
++}
++
+ void *fixup_red_left(struct kmem_cache *s, void *p)
+ {
+	if (kmem_cache_debug(s) && s->flags & SLAB_RED_ZONE)
+@@ -297,6 +307,35 @@ static inline void set_freepointer(struct kmem_cache *s, void *object, void *fp)
+	*(void **)freeptr_addr = freelist_ptr(s, fp, freeptr_addr);
+ }
+
++#ifdef CONFIG_SLAB_CANARY
++static inline unsigned long *get_canary(struct kmem_cache *s, void *object)
++{
++	if (s->offset)
++		return object + s->offset + sizeof(void *);
++	return object + s->inuse;
++}
++
++static inline unsigned long get_canary_value(const void *canary, unsigned long value)
++{
++	return (value ^ (unsigned long)canary) & CANARY_MASK;
++}
++
++static inline void set_canary(struct kmem_cache *s, void *object, unsigned long value)
++{
++	unsigned long *canary = get_canary(s, object);
++	*canary = get_canary_value(canary, value);
++}
++
++static inline void check_canary(struct kmem_cache *s, void *object, unsigned long value)
++{
++	unsigned long *canary = get_canary(s, object);
++	BUG_ON(*canary != get_canary_value(canary, value));
++}
++#else
++#define set_canary(s, object, value)
++#define check_canary(s, object, value)
++#endif
++
+ /* Loop over all objects in a slab */
+ #define for_each_object(__p, __s, __addr, __objects) \
+	for (__p = fixup_red_left(__s, __addr); \
+@@ -484,13 +523,13 @@ static inline void *restore_red_left(struct kmem_cache *s, void *p)
+  * Debug settings:
+  */
+ #if defined(CONFIG_SLUB_DEBUG_ON)
+-static int slub_debug = DEBUG_DEFAULT_FLAGS;
++static int slub_debug __ro_after_init = DEBUG_DEFAULT_FLAGS;
+ #else
+-static int slub_debug;
++static int slub_debug __ro_after_init;
+ #endif
+
+-static char *slub_debug_slabs;
+-static int disable_higher_order_debug;
++static char *slub_debug_slabs __ro_after_init;
++static int disable_higher_order_debug __ro_after_init;
+
+ /*
+  * slub is about to manipulate internal object metadata.  This memory lies
+@@ -550,6 +589,9 @@ static struct track *get_track(struct kmem_cache *s, void *object,
+	else
+		p = object + s->inuse;
+
++	if (IS_ENABLED(CONFIG_SLAB_CANARY))
++		p = (void *)p + sizeof(void *);
++
+	return p + alloc;
+ }
+
+@@ -688,6 +730,9 @@ static void print_trailer(struct kmem_cache *s, struct page *page, u8 *p)
+	else
+		off = s->inuse;
+
++	if (IS_ENABLED(CONFIG_SLAB_CANARY))
++		off += sizeof(void *);
++
+	if (s->flags & SLAB_STORE_USER)
+		off += 2 * sizeof(struct track);
+
+@@ -817,6 +862,9 @@ static int check_pad_bytes(struct kmem_cache *s, struct page *page, u8 *p)
+		/* Freepointer is placed after the object. */
+		off += sizeof(void *);
+
++	if (IS_ENABLED(CONFIG_SLAB_CANARY))
++		off += sizeof(void *);
++
+	if (s->flags & SLAB_STORE_USER)
+		/* We also have user information there */
+		off += 2 * sizeof(struct track);
+@@ -1416,8 +1464,9 @@ static void setup_object(struct kmem_cache *s, struct page *page,
+				void *object)
+ {
+	setup_object_debug(s, page, object);
++	set_canary(s, object, s->random_inactive);
+	kasan_init_slab_obj(s, object);
+-	if (unlikely(s->ctor)) {
++	if (unlikely(s->ctor) && !has_sanitize_verify(s)) {
+		kasan_unpoison_object_data(s, object);
+		s->ctor(object);
+		kasan_poison_object_data(s, object);
+@@ -2717,9 +2766,21 @@ static __always_inline void *slab_alloc_node(struct kmem_cache *s,
+		stat(s, ALLOC_FASTPATH);
+	}
+
+-	if (unlikely(gfpflags & __GFP_ZERO) && object)
++	if (has_sanitize_verify(s) && object) {
++		size_t offset = s->offset ? 0 : sizeof(void *);
++		BUG_ON(memchr_inv(object + offset, 0, s->object_size - offset));
++		if (s->ctor)
++			s->ctor(object);
++		if (unlikely(gfpflags & __GFP_ZERO) && offset)
++			memset(object, 0, sizeof(void *));
++	} else if (unlikely(gfpflags & __GFP_ZERO) && object)
+		memset(object, 0, s->object_size);
+
++	if (object) {
++		check_canary(s, object, s->random_inactive);
++		set_canary(s, object, s->random_active);
++	}
++
+	slab_post_alloc_hook(s, gfpflags, 1, &object);
+
+	return object;
+@@ -2926,6 +2987,27 @@ static __always_inline void do_slab_free(struct kmem_cache *s,
+	void *tail_obj = tail ? : head;
+	struct kmem_cache_cpu *c;
+	unsigned long tid;
++	bool sanitize = has_sanitize(s);
++
++	if (IS_ENABLED(CONFIG_SLAB_CANARY) || sanitize) {
++		__maybe_unused int offset = s->offset ? 0 : sizeof(void *);
++		void *x = head;
++
++		while (1) {
++			check_canary(s, x, s->random_active);
++			set_canary(s, x, s->random_inactive);
++
++			if (sanitize) {
++				memset(x + offset, 0, s->object_size - offset);
++				if (!IS_ENABLED(CONFIG_SLAB_SANITIZE_VERIFY) && s->ctor)
++					s->ctor(x);
++			}
++			if (x == tail_obj)
++				break;
++			x = get_freepointer(s, x);
++		}
++	}
++
+ redo:
+	/*
+	 * Determine the currently cpus per cpu slab.
+@@ -3104,7 +3186,7 @@ int kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t size,
+			  void **p)
+ {
+	struct kmem_cache_cpu *c;
+-	int i;
++	int i, k;
+
+	/* memcg and kmem_cache debug support */
+	s = slab_pre_alloc_hook(s, flags);
+@@ -3141,13 +3223,29 @@ int kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t size,
+	local_irq_enable();
+
+	/* Clear memory outside IRQ disabled fastpath loop */
+-	if (unlikely(flags & __GFP_ZERO)) {
++	if (has_sanitize_verify(s)) {
++		int j;
++
++		for (j = 0; j < i; j++) {
++			size_t offset = s->offset ? 0 : sizeof(void *);
++			BUG_ON(memchr_inv(p[j] + offset, 0, s->object_size - offset));
++			if (s->ctor)
++				s->ctor(p[j]);
++			if (unlikely(flags & __GFP_ZERO) && offset)
++				memset(p[j], 0, sizeof(void *));
++		}
++	} else if (unlikely(flags & __GFP_ZERO)) {
+		int j;
+
+		for (j = 0; j < i; j++)
+			memset(p[j], 0, s->object_size);
+	}
+
++	for (k = 0; k < i; k++) {
++		check_canary(s, p[k], s->random_inactive);
++		set_canary(s, p[k], s->random_active);
++	}
++
+	/* memcg and kmem_cache debug support */
+	slab_post_alloc_hook(s, flags, size, p);
+	return i;
+@@ -3179,9 +3277,9 @@ EXPORT_SYMBOL(kmem_cache_alloc_bulk);
+  * and increases the number of allocations possible without having to
+  * take the list_lock.
+  */
+-static int slub_min_order;
+-static int slub_max_order = PAGE_ALLOC_COSTLY_ORDER;
+-static int slub_min_objects;
++static int slub_min_order __ro_after_init;
++static int slub_max_order __ro_after_init = PAGE_ALLOC_COSTLY_ORDER;
++static int slub_min_objects __ro_after_init;
+
+ /*
+  * Calculate the order of allocation given an slab object size.
+@@ -3351,6 +3449,7 @@ static void early_kmem_cache_node_alloc(int node)
+	init_object(kmem_cache_node, n, SLUB_RED_ACTIVE);
+	init_tracking(kmem_cache_node, n);
+ #endif
++	set_canary(kmem_cache_node, n, kmem_cache_node->random_active);
+	kasan_kmalloc(kmem_cache_node, n, sizeof(struct kmem_cache_node),
+		      GFP_KERNEL);
+	init_kmem_cache_node(n);
+@@ -3507,6 +3606,9 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order)
+		size += sizeof(void *);
+	}
+
++	if (IS_ENABLED(CONFIG_SLAB_CANARY))
++		size += sizeof(void *);
++
+ #ifdef CONFIG_SLUB_DEBUG
+	if (flags & SLAB_STORE_USER)
+		/*
+@@ -3577,6 +3679,10 @@ static int kmem_cache_open(struct kmem_cache *s, unsigned long flags)
+ #ifdef CONFIG_SLAB_FREELIST_HARDENED
+	s->random = get_random_long();
+ #endif
++#ifdef CONFIG_SLAB_CANARY
++	s->random_active = get_random_long();
++	s->random_inactive = get_random_long();
++#endif
+
+	if (need_reserve_slab_rcu && (s->flags & SLAB_TYPESAFE_BY_RCU))
+		s->reserved = sizeof(struct rcu_head);
+@@ -3841,6 +3947,8 @@ const char *__check_heap_object(const void *ptr, unsigned long n,
+		offset -= s->red_left_pad;
+	}
+
++	check_canary(s, (void *)ptr - offset, s->random_active);
++
+	/* Allow address range falling entirely within object size. */
+	if (offset <= object_size && n <= object_size - offset)
+		return NULL;
+@@ -3859,7 +3967,11 @@ static size_t __ksize(const void *object)
+	page = virt_to_head_page(object);
+
+	if (unlikely(!PageSlab(page))) {
++#ifdef CONFIG_BUG_ON_DATA_CORRUPTION
++		BUG_ON(!PageCompound(page));
++#else
+		WARN_ON(!PageCompound(page));
++#endif
+		return PAGE_SIZE << compound_order(page);
+	}
+
+@@ -4724,7 +4836,7 @@ enum slab_stat_type {
+ #define SO_TOTAL	(1 << SL_TOTAL)
+
+ #ifdef CONFIG_MEMCG
+-static bool memcg_sysfs_enabled = IS_ENABLED(CONFIG_SLUB_MEMCG_SYSFS_ON);
++static bool memcg_sysfs_enabled __ro_after_init = IS_ENABLED(CONFIG_SLUB_MEMCG_SYSFS_ON);
+
+ static int __init setup_slub_memcg_sysfs(char *str)
+ {
+diff --git a/mm/swap.c b/mm/swap.c
+index a77d68f2c1b6..d1f1d75f4d1f 100644
+--- a/mm/swap.c
++++ b/mm/swap.c
+@@ -92,6 +92,13 @@ static void __put_compound_page(struct page *page)
+	if (!PageHuge(page))
+		__page_cache_release(page);
+	dtor = get_compound_page_dtor(page);
++	if (!PageHuge(page))
++		BUG_ON(dtor != free_compound_page
++#ifdef CONFIG_TRANSPARENT_HUGEPAGE
++			&& dtor != free_transhuge_page
++#endif
++		);
++
+	(*dtor)(page);
+ }
+
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 6ca771f2f25b..6da2c9c3e6a5 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -4095,7 +4095,7 @@ int netif_rx_ni(struct sk_buff *skb)
+ }
+ EXPORT_SYMBOL(netif_rx_ni);
+
+-static __latent_entropy void net_tx_action(struct softirq_action *h)
++static __latent_entropy void net_tx_action(void)
+ {
+	struct softnet_data *sd = this_cpu_ptr(&softnet_data);
+
+@@ -5609,7 +5609,7 @@ static int napi_poll(struct napi_struct *n, struct list_head *repoll)
+	return work;
+ }
+
+-static __latent_entropy void net_rx_action(struct softirq_action *h)
++static __latent_entropy void net_rx_action(void)
+ {
+	struct softnet_data *sd = this_cpu_ptr(&softnet_data);
+	unsigned long time_limit = jiffies +
+diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
+index f48fe6fc7e8c..d78c52835c08 100644
+--- a/net/ipv4/Kconfig
++++ b/net/ipv4/Kconfig
+@@ -261,6 +261,7 @@ config IP_PIMSM_V2
+
+ config SYN_COOKIES
+	bool "IP: TCP syncookie support"
++	default y
+	---help---
+	  Normal TCP/IP networking is open to an attack known as "SYN
+	  flooding". This denial-of-service attack prevents legitimate remote
+diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
+index 54deaa1066cf..211f97bd5ee3 100644
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -37,6 +37,7 @@ static int vmlinux_section_warnings = 1;
+ static int warn_unresolved = 0;
+ /* How a symbol is exported */
+ static int sec_mismatch_count = 0;
++static int writable_fptr_count = 0;
+ static int sec_mismatch_verbose = 1;
+ static int sec_mismatch_fatal = 0;
+ /* ignore missing files */
+@@ -965,6 +966,7 @@ enum mismatch {
+	ANY_EXIT_TO_ANY_INIT,
+	EXPORT_TO_INIT_EXIT,
+	EXTABLE_TO_NON_TEXT,
++	DATA_TO_TEXT
+ };
+
+ /**
+@@ -1091,6 +1093,12 @@ static const struct sectioncheck sectioncheck[] = {
+	.good_tosec = {ALL_TEXT_SECTIONS , NULL},
+	.mismatch = EXTABLE_TO_NON_TEXT,
+	.handler = extable_mismatch_handler,
++},
++/* Do not reference code from writable data */
++{
++	.fromsec = { DATA_SECTIONS, NULL },
++	.bad_tosec = { ALL_TEXT_SECTIONS, NULL },
++	.mismatch = DATA_TO_TEXT
+ }
+ };
+
+@@ -1240,10 +1248,10 @@ static Elf_Sym *find_elf_symbol(struct elf_info *elf, Elf64_Sword addr,
+			continue;
+		if (ELF_ST_TYPE(sym->st_info) == STT_SECTION)
+			continue;
+-		if (sym->st_value == addr)
+-			return sym;
+		/* Find a symbol nearby - addr are maybe negative */
+		d = sym->st_value - addr;
++		if (d == 0)
++			return sym;
+		if (d < 0)
+			d = addr - sym->st_value;
+		if (d < distance) {
+@@ -1402,7 +1410,11 @@ static void report_sec_mismatch(const char *modname,
+	char *prl_from;
+	char *prl_to;
+
+-	sec_mismatch_count++;
++	if (mismatch->mismatch == DATA_TO_TEXT)
++		writable_fptr_count++;
++	else
++		sec_mismatch_count++;
++
+	if (!sec_mismatch_verbose)
+		return;
+
+@@ -1526,6 +1538,14 @@ static void report_sec_mismatch(const char *modname,
+		fatal("There's a special handler for this mismatch type, "
+		      "we should never get here.");
+		break;
++	case DATA_TO_TEXT:
++#if 0
++		fprintf(stderr,
++		"The %s %s:%s references\n"
++		"the %s %s:%s%s\n",
++		from, fromsec, fromsym, to, tosec, tosym, to_p);
++#endif
++		break;
+	}
+	fprintf(stderr, "\n");
+ }
+@@ -2539,6 +2559,14 @@ int main(int argc, char **argv)
+		}
+	}
+	free(buf.p);
++	if (writable_fptr_count) {
++		if (!sec_mismatch_verbose) {
++			warn("modpost: Found %d writable function pointer(s).\n"
++			     "To see full details build your kernel with:\n"
++			     "'make CONFIG_DEBUG_SECTION_MISMATCH=y'\n",
++			     writable_fptr_count);
++		}
++	}
+
+	return err;
+ }
+diff --git a/security/Kconfig b/security/Kconfig
+index 87f2a6f842fd..7bdbb7edf5bf 100644
+--- a/security/Kconfig
++++ b/security/Kconfig
+@@ -8,7 +8,7 @@ source security/keys/Kconfig
+
+ config SECURITY_DMESG_RESTRICT
+	bool "Restrict unprivileged access to the kernel syslog"
+-	default n
++	default y
+	help
+	  This enforces restrictions on unprivileged users reading the kernel
+	  syslog via dmesg(8).
+@@ -18,10 +18,34 @@ config SECURITY_DMESG_RESTRICT
+
+	  If you are unsure how to answer this question, answer N.
+
++config SECURITY_PERF_EVENTS_RESTRICT
++	bool "Restrict unprivileged use of performance events"
++	depends on PERF_EVENTS
++	default y
++	help
++	  If you say Y here, the kernel.perf_event_paranoid sysctl
++	  will be set to 3 by default, and no unprivileged use of the
++	  perf_event_open syscall will be permitted unless it is
++	  changed.
++
++config SECURITY_TIOCSTI_RESTRICT
++	bool "Restrict unprivileged use of tiocsti command injection"
++	default y
++	help
++	  This enforces restrictions on unprivileged users injecting commands
++	  into other processes which share a tty session using the TIOCSTI
++	  ioctl. This option makes TIOCSTI use require CAP_SYS_ADMIN.
++
++	  If this option is not selected, no restrictions will be enforced
++	  unless the tiocsti_restrict sysctl is explicitly set to (1).
++
++	  If you are unsure how to answer this question, answer N.
++
+ config SECURITY
+	bool "Enable different security models"
+	depends on SYSFS
+	depends on MULTIUSER
++	default y
+	help
+	  This allows you to choose different security modules to be
+	  configured into your kernel.
+@@ -48,6 +72,7 @@ config SECURITYFS
+ config SECURITY_NETWORK
+	bool "Socket and Networking Security Hooks"
+	depends on SECURITY
++	default y
+	help
+	  This enables the socket and networking security hooks.
+	  If enabled, a security module can use these hooks to
+@@ -155,6 +180,7 @@ config HARDENED_USERCOPY
+	depends on HAVE_HARDENED_USERCOPY_ALLOCATOR
+	select BUG
+	imply STRICT_DEVMEM
++	default y
+	help
+	  This option checks for obviously wrong memory regions when
+	  copying memory to/from the kernel (via copy_to_user() and
+@@ -178,10 +204,36 @@ config HARDENED_USERCOPY_PAGESPAN
+ config FORTIFY_SOURCE
+	bool "Harden common str/mem functions against buffer overflows"
+	depends on ARCH_HAS_FORTIFY_SOURCE
++	default y
+	help
+	  Detect overflows of buffers in common string and memory functions
+	  where the compiler can determine and validate the buffer sizes.
+
++config FORTIFY_SOURCE_STRICT_STRING
++	bool "Harden common functions against buffer overflows"
++	depends on FORTIFY_SOURCE
++	depends on EXPERT
++	help
++	  Perform stricter overflow checks catching overflows within objects
++	  for common C string functions rather than only between objects.
++
++	  This is not yet intended for production use, only bug finding.
++
++config PAGE_SANITIZE
++	bool "Sanitize pages"
++	default y
++	help
++	  Zero fill page allocations on free, reducing the lifetime of
++	  sensitive data and helping to mitigate use-after-free bugs.
++
++config PAGE_SANITIZE_VERIFY
++	bool "Verify sanitized pages"
++	depends on PAGE_SANITIZE
++	default y
++	help
++	  Verify that newly allocated pages are zeroed to detect
++	  write-after-free bugs.
++
+ config STATIC_USERMODEHELPER
+	bool "Force all usermode helper calls through a single binary"
+	help
+diff --git a/security/selinux/Kconfig b/security/selinux/Kconfig
+index 8af7a690eb40..6539694b0fd3 100644
+--- a/security/selinux/Kconfig
++++ b/security/selinux/Kconfig
+@@ -2,7 +2,7 @@ config SECURITY_SELINUX
+	bool "NSA SELinux Support"
+	depends on SECURITY_NETWORK && AUDIT && NET && INET
+	select NETWORK_SECMARK
+-	default n
++	default y
+	help
+	  This selects NSA Security-Enhanced Linux (SELinux).
+	  You will also need a policy configuration and a labeled filesystem.
+@@ -79,23 +79,3 @@ config SECURITY_SELINUX_AVC_STATS
+	  This option collects access vector cache statistics to
+	  /selinux/avc/cache_stats, which may be monitored via
+	  tools such as avcstat.
+-
+-config SECURITY_SELINUX_CHECKREQPROT_VALUE
+-	int "NSA SELinux checkreqprot default value"
+-	depends on SECURITY_SELINUX
+-	range 0 1
+-	default 0
+-	help
+-	  This option sets the default value for the 'checkreqprot' flag
+-	  that determines whether SELinux checks the protection requested
+-	  by the application or the protection that will be applied by the
+-	  kernel (including any implied execute for read-implies-exec) for
+-	  mmap and mprotect calls.  If this option is set to 0 (zero),
+-	  SELinux will default to checking the protection that will be applied
+-	  by the kernel.  If this option is set to 1 (one), SELinux will
+-	  default to checking the protection requested by the application.
+-	  The checkreqprot flag may be changed from the default via the
+-	  'checkreqprot=' boot parameter.  It may also be changed at runtime
+-	  via /selinux/checkreqprot if authorized by policy.
+-
+-	  If you are unsure how to answer this question, answer 0.
+diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h
+index 1649cd18eb0b..067f35559aa7 100644
+--- a/security/selinux/include/objsec.h
++++ b/security/selinux/include/objsec.h
+@@ -150,6 +150,6 @@ struct pkey_security_struct {
+	u32	sid;	/* SID of pkey */
+ };
+
+-extern unsigned int selinux_checkreqprot;
++extern const unsigned int selinux_checkreqprot;
+
+ #endif /* _SELINUX_OBJSEC_H_ */
+diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
+index 00eed842c491..8f7b8d7e6f91 100644
+--- a/security/selinux/selinuxfs.c
++++ b/security/selinux/selinuxfs.c
+@@ -41,16 +41,7 @@
+ #include "objsec.h"
+ #include "conditional.h"
+
+-unsigned int selinux_checkreqprot = CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
+-
+-static int __init checkreqprot_setup(char *str)
+-{
+-	unsigned long checkreqprot;
+-	if (!kstrtoul(str, 0, &checkreqprot))
+-		selinux_checkreqprot = checkreqprot ? 1 : 0;
+-	return 1;
+-}
+-__setup("checkreqprot=", checkreqprot_setup);
++const unsigned int selinux_checkreqprot;
+
+ static DEFINE_MUTEX(sel_mutex);
+
+@@ -610,10 +601,9 @@ static ssize_t sel_write_checkreqprot(struct file *file, const char __user *buf,
+		return PTR_ERR(page);
+
+	length = -EINVAL;
+-	if (sscanf(page, "%u", &new_value) != 1)
++	if (sscanf(page, "%u", &new_value) != 1 || new_value)
+		goto out;
+
+-	selinux_checkreqprot = new_value ? 1 : 0;
+	length = count;
+ out:
+	kfree(page);
+diff --git a/security/yama/Kconfig b/security/yama/Kconfig
+index 96b27405558a..485c1b85c325 100644
+--- a/security/yama/Kconfig
++++ b/security/yama/Kconfig
+@@ -1,7 +1,7 @@
+ config SECURITY_YAMA
+	bool "Yama support"
+	depends on SECURITY
+-	default n
++	default y
+	help
+	  This selects Yama, which extends DAC support with additional
+	  system-wide security settings beyond regular Linux discretionary
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 786709d5328..8acc374b2d4 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -1,10 +1,13 @@
-{ stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, modDirVersionArg ? null, ... } @ args:
 
 with stdenv.lib;
 
 buildLinux (args // rec {
   version = "4.14.48";
 
+  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
+  modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
+
   # branchVersion needs to be x.y
   extraMeta.branch = concatStrings (intersperse "." (take 2 (splitString "." version)));
 
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index c22762bde7c..69495e5fc43 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -28,6 +28,11 @@ rec {
     patch = ./tag-hardened.patch;
   };
 
+  copperhead_4_14 = rec {
+    name = "copperhead-4.14";
+    patch = ./copperhead-4-14.patch;
+  };
+
   copperhead_4_16 = rec {
     name = "copperhead-4.16";
     patch = ./copperhead-4-16.patch;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9d3c2e42f55..2f4dfe46aac 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -13499,13 +13499,13 @@ with pkgs;
       ];
   };
 
-  linux_copperhead_lts = callPackage ../os-specific/linux/kernel/linux-copperhead-lts.nix {
-    kernelPatches = with kernelPatches; [
-      bridge_stp_helper
-      modinst_arg_list_too_long
-      tag_hardened
-    ];
-  };
+  linux_copperhead_lts = (linux_4_14.override {
+    kernelPatches = linux_4_14.kernelPatches ++ [
+      kernelPatches.copperhead_4_14
+      kernelPatches.tag_hardened
+     ];
+    modDirVersionArg = linux_4_14.modDirVersion + "-hardened";
+  });
 
   linux_copperhead_stable = (linux_4_16.override {
     kernelPatches = linux_4_16.kernelPatches ++ [

From 2391e836f9d74b71af53a1e40a26af2d50470ba8 Mon Sep 17 00:00:00 2001
From: Yegor Timoshenko <yegortimoshenko@riseup.net>
Date: Mon, 11 Jun 2018 01:23:05 +0000
Subject: [PATCH 076/161] wireguard-go: drop redundant relative import patch

---
 pkgs/tools/networking/wireguard-go/default.nix | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/pkgs/tools/networking/wireguard-go/default.nix b/pkgs/tools/networking/wireguard-go/default.nix
index 62ea3d64468..cbd28b6954a 100644
--- a/pkgs/tools/networking/wireguard-go/default.nix
+++ b/pkgs/tools/networking/wireguard-go/default.nix
@@ -13,11 +13,6 @@ buildGoPackage rec {
 
   goDeps = ./deps.nix;
 
-  postPatch = ''
-    # Replace local imports so that go tools do not trip on them
-    find . -name '*.go' -exec sed -i '/import (/,/)/s@"./@"${goPackagePath}/@' {} \;
-  '';
-
   meta = with stdenv.lib; {
     description = "Userspace Go implementation of WireGuard";
     homepage = https://git.zx2c4.com/wireguard-go/about/;

From 4d486949019bf51691228a09ee21cbab69982dc4 Mon Sep 17 00:00:00 2001
From: Tobias Happ <tobias.happ@gmx.de>
Date: Mon, 11 Jun 2018 01:57:59 +0200
Subject: [PATCH 077/161] dwm-status: add xsetroot and alsaUtils as runtime
 deps

---
 .../window-managers/dwm/dwm-status.nix        | 20 ++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/pkgs/applications/window-managers/dwm/dwm-status.nix b/pkgs/applications/window-managers/dwm/dwm-status.nix
index a8d69987e33..4a46d4ef7ba 100644
--- a/pkgs/applications/window-managers/dwm/dwm-status.nix
+++ b/pkgs/applications/window-managers/dwm/dwm-status.nix
@@ -1,4 +1,9 @@
-{ stdenv, rustPlatform, fetchFromGitHub, dbus, gdk_pixbuf, libnotify, pkgconfig }:
+{ stdenv, lib, rustPlatform, fetchFromGitHub, dbus, gdk_pixbuf, libnotify, makeWrapper, pkgconfig, xorg, alsaUtils }:
+
+let
+  runtimeDeps = [ xorg.xsetroot ]
+    ++ lib.optional (alsaUtils != null) alsaUtils;
+in
 
 rustPlatform.buildRustPackage rec {
   name = "dwm-status-${version}";
@@ -11,15 +16,16 @@ rustPlatform.buildRustPackage rec {
     sha256 = "0nw0iz78mnrmgpc471yjv7yzsaf7346mwjp6hm5kbsdclvrdq9d7";
   };
 
-  buildInputs = [
-    dbus
-    gdk_pixbuf
-    libnotify
-    pkgconfig
-  ];
+  nativeBuildInputs = [ makeWrapper pkgconfig ];
+  buildInputs = [ dbus gdk_pixbuf libnotify ];
 
   cargoSha256 = "0169k91pb7ipvi0m71cmkppp1klgp5ghampa7x0fxkyrvrf0dvqg";
 
+  postInstall = ''
+    wrapProgram $out/bin/dwm-status \
+      --prefix "PATH" : "${stdenv.lib.makeBinPath runtimeDeps}"
+  '';
+
   meta = with stdenv.lib; {
     description = "DWM status service which dynamically updates when needed";
     homepage = https://github.com/Gerschtli/dwm-status;

From 5962d0d5f3cc2994204cff26d7e189d9d91eef14 Mon Sep 17 00:00:00 2001
From: Ben Gamari <ben@smart-cactus.org>
Date: Sun, 10 Jun 2018 21:30:23 -0400
Subject: [PATCH 078/161] cmake: Only apply application-services.patch with
 3.11

The patch doesn't apply with earlier versions. Fixes #41816.
---
 pkgs/development/tools/build-managers/cmake/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/tools/build-managers/cmake/default.nix b/pkgs/development/tools/build-managers/cmake/default.nix
index 051b8107703..438aa81a9d0 100644
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@@ -58,7 +58,7 @@ stdenv.mkDerivation rec {
   # Don't search in non-Nix locations such as /usr, but do search in our libc.
   patches = [ ./search-path-3.9.patch ]
     # Don't depend on frameworks.
-    ++ optional useSharedLibraries ./application-services.patch  # TODO: remove conditional
+    ++ optional (useSharedLibraries && majorVersion == "3.11") ./application-services.patch  # TODO: remove conditional
     ++ optional stdenv.isCygwin ./3.2.2-cygwin.patch;
 
   outputs = [ "out" ];

From a26d9e3ba8680865fea4b2cb906e7de954f3aa27 Mon Sep 17 00:00:00 2001
From: Yegor Timoshenko <yegortimoshenko@riseup.net>
Date: Mon, 11 Jun 2018 01:48:00 +0000
Subject: [PATCH 079/161] Readd --retry 3

---
 pkgs/build-support/fetchurl/builder.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/build-support/fetchurl/builder.sh b/pkgs/build-support/fetchurl/builder.sh
index 530864742f6..f9bc8b602f4 100644
--- a/pkgs/build-support/fetchurl/builder.sh
+++ b/pkgs/build-support/fetchurl/builder.sh
@@ -12,6 +12,7 @@ curl=(
     curl
     --location
     --max-redirs 20
+    --retry 3
     --disable-epsv
     --cookie-jar cookies
     --insecure

From 5a232b0f5b71814bdf60c757c4edd2b535bff487 Mon Sep 17 00:00:00 2001
From: Yegor Timoshenko <yegortimoshenko@riseup.net>
Date: Mon, 11 Jun 2018 01:50:06 +0000
Subject: [PATCH 080/161] Leverage lib.release

---
 pkgs/build-support/fetchurl/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/build-support/fetchurl/default.nix b/pkgs/build-support/fetchurl/default.nix
index f74465be9b4..88d89feb823 100644
--- a/pkgs/build-support/fetchurl/default.nix
+++ b/pkgs/build-support/fetchurl/default.nix
@@ -133,7 +133,7 @@ stdenvNoCC.mkDerivation {
 
   impureEnvVars = impureEnvVars ++ netrcImpureEnvVars;
 
-  nixpkgsVersion = lib.fileContents ../../../.version;
+  nixpkgsVersion = lib.release;
 
   # Doing the download on a remote machine just duplicates network
   # traffic, so don't do that.

From f44012ba10537e1a2a94b2be443a86e4dd0ad38f Mon Sep 17 00:00:00 2001
From: Yegor Timoshenko <yegortimoshenko@riseup.net>
Date: Mon, 11 Jun 2018 02:14:18 +0000
Subject: [PATCH 081/161] lib.release -> lib.trivial.release

---
 pkgs/build-support/fetchurl/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/build-support/fetchurl/default.nix b/pkgs/build-support/fetchurl/default.nix
index 88d89feb823..5f0c1384c79 100644
--- a/pkgs/build-support/fetchurl/default.nix
+++ b/pkgs/build-support/fetchurl/default.nix
@@ -133,7 +133,7 @@ stdenvNoCC.mkDerivation {
 
   impureEnvVars = impureEnvVars ++ netrcImpureEnvVars;
 
-  nixpkgsVersion = lib.release;
+  nixpkgsVersion = lib.trivial.release;
 
   # Doing the download on a remote machine just duplicates network
   # traffic, so don't do that.

From b0cb40ed4bc2eee7b1c6c0bf9f02621002a29957 Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Sun, 10 Jun 2018 21:15:09 -0400
Subject: [PATCH 082/161] samba: support darwin

- add macos patch
---
 pkgs/servers/samba/4.x.nix | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/pkgs/servers/samba/4.x.nix b/pkgs/servers/samba/4.x.nix
index ba7e9c923e3..ee14ec6443b 100644
--- a/pkgs/servers/samba/4.x.nix
+++ b/pkgs/servers/samba/4.x.nix
@@ -1,4 +1,5 @@
 { lib, stdenv, fetchurl, python, pkgconfig, perl, libxslt, docbook_xsl
+, fetchpatch
 , docbook_xml_dtd_42, docbook_xml_dtd_45, readline, talloc
 , popt, iniparser, libbsd, libarchive, libiconv, gettext
 , krb5Full, zlib, openldap, cups, pam, avahi, acl, libaio, fam, libceph, glusterfs
@@ -13,6 +14,8 @@
 , enableRegedit ? true
 , enableCephFS ? false
 , enableGlusterFS ? false
+, enableAcl ? (!stdenv.isDarwin)
+, enablePam ? (!stdenv.isDarwin)
 }:
 
 with lib;
@@ -32,14 +35,18 @@ stdenv.mkDerivation rec {
     [ ./4.x-no-persistent-install.patch
       ./patch-source3__libads__kerberos_keytab.c.patch
       ./4.x-no-persistent-install-dynconfig.patch
+      (fetchpatch {
+        url = "https://patch-diff.githubusercontent.com/raw/samba-team/samba/pull/107.patch";
+        sha256 = "0r6q34vjj0bdzmcbnrkad9rww58k4krbwicv4gs1g3dj49skpvd6";
+      })
     ];
 
   buildInputs =
     [ python pkgconfig perl libxslt docbook_xsl docbook_xml_dtd_42 /*
       docbook_xml_dtd_45 */ readline talloc popt iniparser
-      libbsd libarchive zlib acl fam libiconv gettext libunwind krb5Full
+      libbsd libarchive zlib fam libiconv gettext libunwind krb5Full
     ]
-    ++ optionals stdenv.isLinux [ libaio pam systemd ]
+    ++ optionals stdenv.isLinux [ libaio systemd ]
     ++ optionals (enableInfiniband && stdenv.isLinux) [ libibverbs librdmacm ]
     ++ optional enableLDAP openldap
     ++ optional (enablePrinting && stdenv.isLinux) cups
@@ -47,7 +54,9 @@ stdenv.mkDerivation rec {
     ++ optional enableDomainController gnutls
     ++ optional enableRegedit ncurses
     ++ optional (enableCephFS && stdenv.isLinux) libceph
-    ++ optional (enableGlusterFS && stdenv.isLinux) glusterfs;
+    ++ optional (enableGlusterFS && stdenv.isLinux) glusterfs
+    ++ optional enableAcl acl
+    ++ optional enablePam pam;
 
   postPatch = ''
     # Removes absolute paths in scripts
@@ -67,7 +76,9 @@ stdenv.mkDerivation rec {
       "--localstatedir=/var"
     ]
     ++ optional (!enableDomainController) "--without-ad-dc"
-    ++ optionals (!enableLDAP) [ "--without-ldap" "--without-ads" ];
+    ++ optionals (!enableLDAP) [ "--without-ldap" "--without-ads" ]
+    ++ optional (!enableAcl) "--without-acl-support"
+    ++ optional (!enablePam) "--without-pam";
 
   # To build in parallel.
   buildPhase = "python buildtools/bin/waf build -j $NIX_BUILD_CORES";

From eca521aea7a745c848698d8097ad1e6213c1ad05 Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Sun, 10 Jun 2018 21:16:44 -0400
Subject: [PATCH 083/161] libcanberra: supports darwin

---
 .../libraries/libcanberra/default.nix         | 21 ++++++++++++++-----
 pkgs/top-level/all-packages.nix               |  8 +++++--
 2 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/libraries/libcanberra/default.nix b/pkgs/development/libraries/libcanberra/default.nix
index 83f86c40c0d..0d1772d0c54 100644
--- a/pkgs/development/libraries/libcanberra/default.nix
+++ b/pkgs/development/libraries/libcanberra/default.nix
@@ -1,5 +1,7 @@
-{ stdenv, fetchurl, pkgconfig, libtool, gtk ? null, libcap
-, alsaLib, libpulseaudio, gst_all_1, libvorbis }:
+{ stdenv, lib, fetchurl, fetchpatch, pkgconfig, libtool
+, gtk ? null
+, libpulseaudio, gst_all_1, libvorbis, libcap
+, withAlsa ? stdenv.isLinux, alsaLib }:
 
 stdenv.mkDerivation rec {
   name = "libcanberra-0.30";
@@ -11,11 +13,20 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig libtool ];
   buildInputs = [
-    alsaLib libpulseaudio libvorbis gtk libcap
-  ] ++ (with gst_all_1; [ gstreamer gst-plugins-base ]);
+    libpulseaudio libvorbis gtk
+  ] ++ (with gst_all_1; [ gstreamer gst-plugins-base ])
+    ++ lib.optional stdenv.isLinux libcap
+    ++ lib.optional withAlsa alsaLib;
 
   configureFlags = "--disable-oss";
 
+  patchFlags = "-p0";
+  patches = stdenv.lib.optional stdenv.isDarwin
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/macports/macports-ports/master/audio/libcanberra/files/patch-configure.diff";
+      sha256 = "1f7h7ifpqvbfhqygn1b7klvwi80zmpv3538vbmq7ql7bkf1q8h31";
+    });
+
   postInstall = ''
     for f in $out/lib/*.la; do
       sed 's|-lltdl|-L${libtool.lib}/lib -lltdl|' -i $f
@@ -42,6 +53,6 @@ stdenv.mkDerivation rec {
     license = stdenv.lib.licenses.lgpl2Plus;
 
     maintainers = [ ];
-    platforms = stdenv.lib.platforms.gnu ++ stdenv.lib.platforms.linux;  # arbitrary choice
+    platforms = stdenv.lib.platforms.unix;
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2f4dfe46aac..01539ccda6f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9809,8 +9809,12 @@ with pkgs;
   };
 
   libcanberra = callPackage ../development/libraries/libcanberra { };
-  libcanberra-gtk3 = pkgs.libcanberra.override { gtk = pkgs.gtk3; };
-  libcanberra-gtk2 = pkgs.libcanberra-gtk3.override { gtk = pkgs.gtk2; };
+  libcanberra-gtk3 = pkgs.libcanberra.override {
+    gtk = gtk3;
+  };
+  libcanberra-gtk2 = pkgs.libcanberra-gtk3.override {
+    gtk = gtk2.override { gdktarget = "x11"; };
+  };
 
   libcanberra_kde = if (config.kde_runtime.libcanberraWithoutGTK or true)
     then pkgs.libcanberra

From 7f3db0dd7275c05e779fcb8506478e62278e8e6f Mon Sep 17 00:00:00 2001
From: volth <volth@volth.com>
Date: Mon, 11 Jun 2018 07:46:04 +0000
Subject: [PATCH 084/161] perlPackages.JSON: fix cross-compilation

---
 pkgs/top-level/perl-packages.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 042a3130651..2ee454f0958 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -8171,6 +8171,10 @@ let self = _self // overrides; _self = with self; {
       url = mirror://cpan/authors/id/I/IS/ISHIGAKI/JSON-2.97001.tar.gz;
       sha256 = "0nlgdzy40q26z8qhwngsd461glyai8dpwaccyhiljmrkaqwdjxz2";
     };
+    # Do not abort cross-compilation on failure to load native JSON module into host perl
+    preConfigure = ''
+      substituteInPlace Makefile.PL --replace "exit 0;" ""
+    '';
     meta = {
       description = "JSON (JavaScript Object Notation) encoder/decoder";
       license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];

From 93cbb9b72fed5076d4d0038f14625be4debde255 Mon Sep 17 00:00:00 2001
From: Uli Baum <xeji@cat3.de>
Date: Mon, 11 Jun 2018 11:02:54 +0200
Subject: [PATCH 085/161] nixos/tomcat: fix eval error introduced by #40657

---
 nixos/modules/services/web-servers/tomcat.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/web-servers/tomcat.nix b/nixos/modules/services/web-servers/tomcat.nix
index 5abbbf09059..bc713a08f18 100644
--- a/nixos/modules/services/web-servers/tomcat.nix
+++ b/nixos/modules/services/web-servers/tomcat.nix
@@ -109,8 +109,8 @@ in
 
       webapps = mkOption {
         type = types.listOf types.package;
-        default = [ tomcat85.webapps ];
-        defaultText = "[ tomcat85.webapps ]";
+        default = [ tomcat.webapps ];
+        defaultText = "[ pkgs.tomcat85.webapps ]";
         description = "List containing WAR files or directories with WAR files which are web applications to be deployed on Tomcat";
       };
 

From 979ac47cd8164f1e4215e5ff4c11c3d5170cf50e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rolf=20Schr=C3=B6der?= <rolf.schr@gmail.com>
Date: Mon, 11 Jun 2018 11:24:07 +0200
Subject: [PATCH 086/161] doc/languages-frameworks/python.section.md: fix typo
 (#41824)

---
 doc/languages-frameworks/python.section.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index 7a48bbaeeee..d291b44c309 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -973,7 +973,7 @@ stdenv.mkDerivation {
     # the following packages are related to the dependencies of your python
     # project.
     # In this particular example the python modules listed in the
-    # requirements.tx require the following packages to be installed locally
+    # requirements.txt require the following packages to be installed locally
     # in order to compile any binary extensions they may require.
     #
     taglib

From 63a5b85b2a29615765dd235fb11233ea4c2ae223 Mon Sep 17 00:00:00 2001
From: Orivej Desh <orivej@gmx.fr>
Date: Mon, 11 Jun 2018 08:09:09 +0000
Subject: [PATCH 087/161] cctz: init at 2.2

---
 pkgs/development/libraries/cctz/default.nix | 27 +++++++++++++++++++++
 pkgs/top-level/all-packages.nix             |  2 ++
 2 files changed, 29 insertions(+)
 create mode 100644 pkgs/development/libraries/cctz/default.nix

diff --git a/pkgs/development/libraries/cctz/default.nix b/pkgs/development/libraries/cctz/default.nix
new file mode 100644
index 00000000000..e61b5840cf9
--- /dev/null
+++ b/pkgs/development/libraries/cctz/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  name = "cctz-${version}";
+  version = "2.2";
+
+  src = fetchFromGitHub {
+    owner = "google";
+    repo = "cctz";
+    rev = "v${version}";
+    sha256 = "0liiqz1swfc019rzfaa9y5kavs2hwabs2vnwbn9jfczhyxy34y89";
+  };
+
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  installTargets = [ "install_hdrs" "install_shared_lib" ];
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/google/cctz;
+    description = "C++ library for translating between absolute and civil times";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ orivej ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 01539ccda6f..2d64ae178d8 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8724,6 +8724,8 @@ with pkgs;
 
   ccrtp_1_8 = callPackage ../development/libraries/ccrtp/1.8.nix { };
 
+  cctz = callPackage ../development/libraries/cctz { };
+
   celt = callPackage ../development/libraries/celt {};
   celt_0_7 = callPackage ../development/libraries/celt/0.7.nix {};
   celt_0_5_1 = callPackage ../development/libraries/celt/0.5.1.nix {};

From 796fa8190e3bb398aa322fbe27da2f4c7b0e1e8b Mon Sep 17 00:00:00 2001
From: Orivej Desh <orivej@gmx.fr>
Date: Mon, 11 Jun 2018 08:37:06 +0000
Subject: [PATCH 088/161] clickhouse: 1.1.54310 -> 1.1.54385

---
 pkgs/servers/clickhouse/default.nix      | 20 ++++++++------------
 pkgs/servers/clickhouse/find-mysql.patch | 11 +++++++++++
 2 files changed, 19 insertions(+), 12 deletions(-)
 create mode 100644 pkgs/servers/clickhouse/find-mysql.patch

diff --git a/pkgs/servers/clickhouse/default.nix b/pkgs/servers/clickhouse/default.nix
index f4a6b47a45a..58a178a8b2e 100644
--- a/pkgs/servers/clickhouse/default.nix
+++ b/pkgs/servers/clickhouse/default.nix
@@ -1,34 +1,30 @@
-{ stdenv, fetchFromGitHub, cmake, libtool, boost, double-conversion, gperftools
-, icu, mysql, lz4, openssl, poco, re2, rdkafka, readline, sparsehash, unixODBC
-, zookeeper_mt, zstd }:
+{ stdenv, fetchFromGitHub, cmake, libtool, boost, cctz, double-conversion, gperftools
+, icu, lz4, mysql, openssl, poco, re2, rdkafka, readline, sparsehash, unixODBC, zstd
+}:
 
 stdenv.mkDerivation rec {
   name = "clickhouse-${version}";
 
-  version = "1.1.54310";
+  version = "1.1.54385";
 
   src = fetchFromGitHub {
     owner = "yandex";
     repo = "ClickHouse";
     rev = "v${version}-stable";
-    sha256 = "167pihqak8ip7bmlyrbzl9x3mpn381j8v7pl7nhrl9bfnzgrq69v";
+    sha256 = "0s290xnx9dil2lbxdir5p5zmakvq5h523gdwax2cb37606wg8yj7";
   };
 
-  patches = [ ./termcap.patch ];
+  patches = [ ./find-mysql.patch ./termcap.patch ];
 
   nativeBuildInputs = [ cmake libtool ];
 
   buildInputs = [
-    boost double-conversion gperftools icu mysql.connector-c lz4 openssl poco
-    re2 rdkafka readline sparsehash unixODBC zookeeper_mt zstd
+    boost cctz double-conversion gperftools icu lz4 mysql.connector-c openssl poco
+    re2 rdkafka readline sparsehash unixODBC zstd
   ];
 
   cmakeFlags = [ "-DENABLE_TESTS=OFF" "-DUNBUNDLED=ON" "-DUSE_STATIC_LIBRARIES=OFF" ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=unused-function" ];
-
-  enableParallelBuilding = true;
-
   meta = with stdenv.lib; {
     homepage = https://clickhouse.yandex/;
     description = "Column-oriented database management system";
diff --git a/pkgs/servers/clickhouse/find-mysql.patch b/pkgs/servers/clickhouse/find-mysql.patch
new file mode 100644
index 00000000000..3a5ec5181d1
--- /dev/null
+++ b/pkgs/servers/clickhouse/find-mysql.patch
@@ -0,0 +1,11 @@
+--- a/libs/libmysqlxx/cmake/find_mysqlclient.cmake
++++ b/libs/libmysqlxx/cmake/find_mysqlclient.cmake
+@@ -24,7 +24,7 @@ if (ENABLE_MYSQL)
+     if (USE_STATIC_LIBRARIES)
+         find_library (STATIC_MYSQLCLIENT_LIB mariadbclient mysqlclient PATHS ${MYSQL_LIB_PATHS})
+     else ()
+-        find_library (MYSQLCLIENT_LIBRARIES mariadbclient mysqlclient PATHS ${MYSQL_LIB_PATHS})
++        find_library (MYSQLCLIENT_LIBRARIES mariadbclient mysqlclient PATH_SUFFIXES mysql PATHS ${MYSQL_LIB_PATHS})
+     endif ()
+ 
+     if (MYSQL_INCLUDE_DIR AND (STATIC_MYSQLCLIENT_LIB OR MYSQLCLIENT_LIBRARIES))

From ed657a98c76a427d9c6a485ecb912386f6157a5d Mon Sep 17 00:00:00 2001
From: Frank Doepper <github@woffs.de>
Date: Mon, 11 Jun 2018 11:41:59 +0200
Subject: [PATCH 089/161] nwipe: init at 0.24 (#41664)

* nwipe: init at 0.24

* nwipe: cleanup deps
---
 pkgs/tools/security/nwipe/default.nix | 22 ++++++++++++++++++++++
 pkgs/top-level/all-packages.nix       |  2 ++
 2 files changed, 24 insertions(+)
 create mode 100644 pkgs/tools/security/nwipe/default.nix

diff --git a/pkgs/tools/security/nwipe/default.nix b/pkgs/tools/security/nwipe/default.nix
new file mode 100644
index 00000000000..214ffccc7ae
--- /dev/null
+++ b/pkgs/tools/security/nwipe/default.nix
@@ -0,0 +1,22 @@
+{ stdenv, fetchFromGitHub, ncurses, parted, automake, autoconf, pkgconfig }:
+
+stdenv.mkDerivation rec {
+  version = "0.24";
+  name = "nwipe-${version}";
+  src = fetchFromGitHub {
+    owner = "martijnvanbrummelen";
+    repo = "nwipe";
+    rev = "v${version}";
+    sha256 = "0zminjngz98b4jl1ii6ssa7pkmf4xw6mmk8apxz3xr68cps12ls0";
+  };
+  nativeBuildInputs = [ automake autoconf pkgconfig ];
+  buildInputs = [ ncurses parted ];
+  preConfigure = "sh init.sh || :";
+  meta = with stdenv.lib; {
+    description = "Securely erase disks";
+    homepage = https://github.com/martijnvanbrummelen/nwipe;
+    license = licenses.gpl2;
+    maintainers = [ maintainers.woffs ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2d64ae178d8..5f7228c1410 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1388,6 +1388,8 @@ with pkgs;
 
   nrsc5 = callPackage ../applications/misc/nrsc5 { };
 
+  nwipe = callPackage ../tools/security/nwipe { };
+
   onboard = callPackage ../applications/misc/onboard { };
 
   optar = callPackage ../tools/graphics/optar {};

From 2443a602de62b6735e40daaf3d8e52fcef68716c Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Mon, 11 Jun 2018 12:01:34 +0200
Subject: [PATCH 090/161] libgtop: fix darwin build

---
 pkgs/development/libraries/libgtop/default.nix | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/libgtop/default.nix b/pkgs/development/libraries/libgtop/default.nix
index 656395b8867..6498014aee8 100644
--- a/pkgs/development/libraries/libgtop/default.nix
+++ b/pkgs/development/libraries/libgtop/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, glib, pkgconfig, perl, gettext, gobjectIntrospection, libintl, gnome3 }:
+{ stdenv, fetchurl, fetchpatch, glib, pkgconfig, perl, gettext, gobjectIntrospection, libintl, libtool, gnome3, gtk-doc }:
 let
   pname = "libgtop";
   version = "2.38.0";
@@ -11,8 +11,20 @@ stdenv.mkDerivation rec {
     sha256 = "04mnxgzyb26wqk6qij4iw8cxwl82r8pcsna5dg8vz2j3pdi0wv2g";
   };
 
+  patches = [
+    # Fix darwin build
+    (fetchpatch {
+        url = https://gitlab.gnome.org/GNOME/libgtop/commit/42b049f338363f92c1e93b4549fc944098eae674.patch;
+        sha256 = "0kf9ihgb0wqji6dcvg36s6igkh7b79k6y1n7w7wzsxya84x3hhyn";
+      })
+  ];
+
   propagatedBuildInputs = [ glib ];
-  nativeBuildInputs = [ pkgconfig perl gettext gobjectIntrospection ];
+  nativeBuildInputs = [ pkgconfig gnome3.gnome-common libtool gtk-doc perl gettext gobjectIntrospection ];
+
+  preConfigure = ''
+    ./autogen.sh
+  '';
 
   passthru = {
     updateScript = gnome3.updateScript {
@@ -24,6 +36,6 @@ stdenv.mkDerivation rec {
     description = "A library that reads information about processes and the running system";
     license = licenses.gpl2Plus;
     maintainers = gnome3.maintainers;
-    platforms = with platforms; linux ++ darwin;
+    platforms = platforms.unix;
   };
 }

From 3df3e155f0d5082416f4b73beebd9d73817d3c50 Mon Sep 17 00:00:00 2001
From: Daniel Frank <git@danielfrank.net>
Date: Mon, 11 Jun 2018 12:02:40 +0200
Subject: [PATCH 091/161] firefox-bin: 60.0.1 -> 60.0.2 critical security
 update

---
 .../browsers/firefox-bin/release_sources.nix  | 786 +++++++++---------
 1 file changed, 393 insertions(+), 393 deletions(-)

diff --git a/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix b/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
index 32adb56c931..184cfcdce3e 100644
--- a/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
@@ -1,985 +1,985 @@
 {
-  version = "60.0.1";
+  version = "60.0.2";
   sources = [
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/ach/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/ach/firefox-60.0.2.tar.bz2";
       locale = "ach";
       arch = "linux-x86_64";
-      sha512 = "ca1638e32f121b1f366d89934e5516ee23cbe249596a7600f5ba1986fcb014d9125d24d3d7a38f251aa9fb527d368001ccc0af80063a7f3abb02a2a920bc7fd7";
+      sha512 = "68e9831e3814f7bce96365a88c1fb00d1955ea0e45f67a698ad0ec7f193684a9fb1ef0b145e212215cc5028c2065232badc27db328aa20a20d558bf1464eff1a";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/af/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/af/firefox-60.0.2.tar.bz2";
       locale = "af";
       arch = "linux-x86_64";
-      sha512 = "f693b42ee4380fa6c0505fb7971984dcb466ef2a1ce90c09e8088e758f1aef5d3ee790ac578737523ba93f2866dcc92722852579cf4cc5898e66adf28ce17495";
+      sha512 = "26985220e2fb20110ed9e71382290554eb279505471952f0557e69aaca64b6c7602b0d405c3ba0f4ac451963d4727f62f2cb525f9fe279e5380f5e146352288b";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/an/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/an/firefox-60.0.2.tar.bz2";
       locale = "an";
       arch = "linux-x86_64";
-      sha512 = "4858341f974d45c982a9c3c8285de2932db81c8dbdd124272e7aaafc0e4712f613aec5e4929ad0182c1801850fc394ebeda38f08a40e71e29ce111c17abbfc7d";
+      sha512 = "68a80541f18686b3060b49dad145775436fa318ab5ed18229d6e6e9a807dd4de777326595b214cfd31dc8a482f48798ddb5eae1a4433ca54236bc8d98898c90e";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/ar/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/ar/firefox-60.0.2.tar.bz2";
       locale = "ar";
       arch = "linux-x86_64";
-      sha512 = "dcbe81e9b0910c44530f9b8f33876c8e2df6ca314172f268c9b5cc53010f5f4024b37929a726d4c138033596d904596a6040b6770e796d20a9a8999ff3e84ecc";
+      sha512 = "0579222cde4a1ffb006c7322aba80556bcda4eaf592302cc2af52d178f90dfbeefb021e1097ea992eb3dde1c03b43145831a0dae325523abe2b5ef72da9cea1c";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/as/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/as/firefox-60.0.2.tar.bz2";
       locale = "as";
       arch = "linux-x86_64";
-      sha512 = "4420f102bc6d665ddb568d3a27001cb91ddd76ac20ebe65c4c6fe58d92b2b9406a47c492c2f5ed4da42a48355e30a982c81da2b756826d239d443179bd6deec1";
+      sha512 = "27cb434d6c9b2eda3ca08daa2d89a7b1f81815f7605984fe6ed4803196beb7eee844e79c1064a71cfcf5e3b113606a76b557c2bef54064410ecdaf732ccdfe30";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/ast/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/ast/firefox-60.0.2.tar.bz2";
       locale = "ast";
       arch = "linux-x86_64";
-      sha512 = "5294a33939e40bc868041952830593fafb27f7be2eb7fc163571a6d08c7ccf19443f177bd73e4a3bed96d73103d2fb696810982648abfe300973c7ca7c6677d8";
+      sha512 = "9eeee72b3bd390f8e7978dfe0b8f03d0b5745197d50ca85f764c64a0bccc7a95db872dab3416f73f44ac9c9e1cc6a096f7a2154b2e8f6e4fcb0ceab48598e7ec";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/az/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/az/firefox-60.0.2.tar.bz2";
       locale = "az";
       arch = "linux-x86_64";
-      sha512 = "272fe5c3c276e9f3cc9554ebada40a90762af24cf6652a5fb9541f41aad964358471f2c19f94b3c1ad59eaf93a4ee507617f4ec299d4601c41d72a6620d0cd3b";
+      sha512 = "dc94785cf955366ba94cce3bb6435a1aa635cbf65e4cd8cb6ac5330470d84d2349b6ff22b9d3b6d6b5a47c4bcd53f9f615913ea476a7555b196c5c39b5adb808";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/be/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/be/firefox-60.0.2.tar.bz2";
       locale = "be";
       arch = "linux-x86_64";
-      sha512 = "75689bbdb2f678ed36b265696d21d6f9becd7658001e15bbd8bd306e683b69d4762ac1cb27ddbb12638f7e626927e36fc0a16cc7b98479c5f2e21769dcd9cd06";
+      sha512 = "79af55191ede8277e94482823e9a54ff0f6f3448c6b0753742977feaac66301ca7d368ffe2ac8b63ae1ea053ee9f9a1ed3228c3ce644bbdf9853cdda7b278830";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/bg/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/bg/firefox-60.0.2.tar.bz2";
       locale = "bg";
       arch = "linux-x86_64";
-      sha512 = "33b7aa767bb6c234dcb8406eb7eee3160424192dc1a76b9c1c7beee1de42d1c623ad009ab714e60c62e07bbb087cc1b08feec7628361739380a767bb7b43a020";
+      sha512 = "d286cd0e6b40a9b71caad4c86892484fce60f57fb6ce946fd63179336181bdac9fedb4a92bcd19a5ded08a21dff256d005cb08d13bf3728aed5e663f5a1220de";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/bn-BD/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/bn-BD/firefox-60.0.2.tar.bz2";
       locale = "bn-BD";
       arch = "linux-x86_64";
-      sha512 = "3c6fdfe39d61fd681fa3d30a4ea1c1ef7988a1345912592a79b9622f18d1106ab96e099fe56b428568467c0c63b56e2cc09bc5fe2a9705478f458d5de0f36433";
+      sha512 = "8d0c40bdfc4d191bdc3a4f5900217259c89cad292fd053878b6c4c98407ba0582ada5abdd3839b225f063fc4cdff13c96cc61609478b9f8a18a1c88b5d271605";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/bn-IN/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/bn-IN/firefox-60.0.2.tar.bz2";
       locale = "bn-IN";
       arch = "linux-x86_64";
-      sha512 = "d9c67926f2df8faae64a6d9848a3823bd4968cafa1caaaf8b2713db2656c0a6c82dfc16eca9741c274994178ea46a7325b5f72a11ecafddacd8cf4df45683a89";
+      sha512 = "c3a05e4a932b19841fadb04b20dda770077cff4b45543b2b3d8a78f092e856843941f070eb338455b22b04d6683161fee1b65b1b432de4dafac987b40d91cdec";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/br/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/br/firefox-60.0.2.tar.bz2";
       locale = "br";
       arch = "linux-x86_64";
-      sha512 = "a0ad58a34f85b254d5985a1bc6a2a0003a91773ba43408a45998098b98fe104b9f09e4d4e9bc9ab7ec9cd378692beb6e9f7aa4d2e55b49630c807bf0f9d158dd";
+      sha512 = "ce729cfe0ee8b308aac5252b74c562a57e0d6ab63b9971b7345e1695e95b1946d2e621d686cfa0d64e44e3e591a15d1357b91928c1376816cd8e34293d16091f";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/bs/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/bs/firefox-60.0.2.tar.bz2";
       locale = "bs";
       arch = "linux-x86_64";
-      sha512 = "3c24cba1629f4458832d09df121c897fa08c6c3a02ddb42d4e232207086525ff0dd01adc8e133c4ed2b6fc909907efd87f985cf0bc1d27fed18055ec566403f2";
+      sha512 = "05559ec50f02f4a2865c65dc315f80c28c83b3091d38cba68f58f3dc461d8f15dc4c597f8f9e851cda79e2d8398afa905b8249822b55c9af3f92b65bb7cd4c13";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/ca/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/ca/firefox-60.0.2.tar.bz2";
       locale = "ca";
       arch = "linux-x86_64";
-      sha512 = "75d63bd285257a1f8a6dd97981914fbe0886d77abebc237f08abb498a34bd1f129e38afd6fdbdce3da3d7dab5a7138e1da883ffad0ca31f954da68fc3d273ed4";
+      sha512 = "45d7ac493bcd7f9950041e66e9f3146814dc624facfab77a5f1efd601b8725e400297b319fbe440f8578f5c5e02dfdf56dece55fdd3ebda10512f0e74ba8cc03";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/cak/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/cak/firefox-60.0.2.tar.bz2";
       locale = "cak";
       arch = "linux-x86_64";
-      sha512 = "d79aaa1c8833f2fa9c9612efb8e5b7a02805c37f1fc45db6f7fc2f6288c48f75880ff46b9ddd96be7f05b674a8201f3c1bcbd36d0deafd9072aee5dce8f18ab1";
+      sha512 = "d96b4cb7dc50b01ff35cfd4c5921ab91d045410a38cf251cba3ea5236f9e4823e872b292dc1b1528cfc0249b93ed43f40ff6d6356bbde6daf560e6b8a8eed2e3";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/cs/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/cs/firefox-60.0.2.tar.bz2";
       locale = "cs";
       arch = "linux-x86_64";
-      sha512 = "8b01b051a92320457c9364ab0f28761a7dc574b35777098bb773c9b0ec64d8947a76a2bf3c58b3b4a073e392f7d07b4f804994854c6f625a9e9dc51cad9bf914";
+      sha512 = "d7a511b8fb9fcbaf484eb9723fed9b82003539458010ee46526951aa9378e2c93c96811b14812fc8bde4a615e8524cc48c17beca20f185f666351b794e6d6026";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/cy/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/cy/firefox-60.0.2.tar.bz2";
       locale = "cy";
       arch = "linux-x86_64";
-      sha512 = "9f0e601b41e8f698de134d17d84f1b43d8f91d3319041482fe698fce34c8bcaa0da31e1e113fde72e1760bd93dc11dded02fbc917d69cf1ab008518e54c491dc";
+      sha512 = "efccda54fc035a09af67144577e32e27e61b4ef619c46bd1a87b65a699a8427c2ed93b6044949740025ba46d0b937e50a73b57f5b378d442c56c7acba86a5752";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/da/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/da/firefox-60.0.2.tar.bz2";
       locale = "da";
       arch = "linux-x86_64";
-      sha512 = "dc4280c4e4f7e51befe4adc002d6875f9bdc7d4cb592335134d5b0df18462b6fe54817dbfa2815375e8947bf76d81ab9ccec31b7b36f07ca2b11ec04b3bbf728";
+      sha512 = "586828d3e81a355287fa3f2c9be5fb5f3a23b61a393089112921e9e6b239e630f45d6051f921307c21e1ad600a087bcd5ffabeccf5b5fab9041683f7cf9e0c42";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/de/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/de/firefox-60.0.2.tar.bz2";
       locale = "de";
       arch = "linux-x86_64";
-      sha512 = "f9c7e6f1b83616883c74ba8fca5d21b793a811868e15e40611c93312f76ca8d8c37c4222454a8a71bce47d1d30e8596ed5907eb9300c3b5a957ae49249808c7c";
+      sha512 = "6db7cc3f2a8e157faec6a27e0cf99be78ef957ffa92238ea60d3b65d41d403b3478b8fde7f27817b91285b7efb2e9b76be3ebdf40ef1ab886e8ddd3b8abde0d0";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/dsb/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/dsb/firefox-60.0.2.tar.bz2";
       locale = "dsb";
       arch = "linux-x86_64";
-      sha512 = "fc41281038372262d135de8004a1d7b03a3c8047fc20ab0e6856b696eee3260328a64b59212a809eb03cad7efd58fadda422e44153e7c8e33415d0efe5321c63";
+      sha512 = "397ef9d40697d2cd33cdb31afd08060623cfaf1dfc2445afc21ac667f8e90bd26dc1ec9693c6d40bc5aefe7a04606e702f6e6c6fabdb2c7517f0488c96ed004b";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/el/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/el/firefox-60.0.2.tar.bz2";
       locale = "el";
       arch = "linux-x86_64";
-      sha512 = "5a5f2d3f2f83e8c3a4bf358cc9611f1279fbf218f24c4e5aff69efcbe4b27ae08b955bafafe3a73ae1caa05914bd4ad739f1292344d9434f1f486f5e615645dd";
+      sha512 = "d7e4d7521624a0f4f13287aedb9289e0bbc601f6c199819e83fb71836e0a8d754b32f71cba835f4a71d00029fe8dfbf1d44ae120b8943356c39a9507f2cf482e";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/en-GB/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/en-GB/firefox-60.0.2.tar.bz2";
       locale = "en-GB";
       arch = "linux-x86_64";
-      sha512 = "19b09722af085bdb016a12cc586ec9d32371d293f3c5be660efdb792e2d894d339600cef27325759f0489a0b3a4000123685c19db5b6d933d3f4f51244cd4f90";
+      sha512 = "e767e6c72fc29c0c7baf9abd956b6608dec7c8e7d2a45772a341d894e9076960a6e03adbafacd8ae7555a5db38940df570bb802035584be1e62e63d8bed5147a";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/en-US/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/en-US/firefox-60.0.2.tar.bz2";
       locale = "en-US";
       arch = "linux-x86_64";
-      sha512 = "2f7c14e1ef94ad4751c7382d7b012fcd36787ee1045918226cb3b0fdbb08508fa986181f54e304df12fdb8d49aadd62afc936f5855939437a7f9d8860976398c";
+      sha512 = "58075442850d5e34a7eaa78e008a6f80321a09fbaa5bed698394659bc468d799d299ddad888b1def0d6b74899671e98e7aa918f247a57c42cd605b05276a9156";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/en-ZA/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/en-ZA/firefox-60.0.2.tar.bz2";
       locale = "en-ZA";
       arch = "linux-x86_64";
-      sha512 = "04661ad52e94ad5e8967e21a460fe1e25cc08f9f0f108e9fe55633d4fdaaf23df133b1b73388146c496285d8562b57d38603100f45c4d81787ec02d4c4b6f0f6";
+      sha512 = "422bc4d9695da1ed5c9269f9067d331d0b6c0849b12c61140e07bc7b475f121d07c97c0007f9e33e724451c63a25b9352326a6a321c3eea8506ab4a07ed67e74";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/eo/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/eo/firefox-60.0.2.tar.bz2";
       locale = "eo";
       arch = "linux-x86_64";
-      sha512 = "bb1bd451569e1a4f116b458bb9d020d046b556c7335589dd6aa13f2a941b4ebbd197fa25728607f8bcfeacb610a94943d01d05b072f212346a5b74e96071f157";
+      sha512 = "d2f11b0d0f660305073570840975165a0900970fa63c28646eaba94709da0977229c3a77280d731ad98ef5c17e5d7ea230eb816c3248c25d4466afb9edaffe46";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/es-AR/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/es-AR/firefox-60.0.2.tar.bz2";
       locale = "es-AR";
       arch = "linux-x86_64";
-      sha512 = "8b175a74a9688a50adc42a13b4ff4c137b34f09c571606d9a25080a8134640bfc8e0ef757ff88e90428153002d5c71f6dd339c54320520976669c264004a6743";
+      sha512 = "11a83e2ca6deb717659b845f850aaf3f0b90b4bf784ca8f2f095197c2c3c42c26c69488ab9dba3ce4b1bed4e89cacd8366ae9a3ce0cc96c02978c9bd6a55c3e5";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/es-CL/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/es-CL/firefox-60.0.2.tar.bz2";
       locale = "es-CL";
       arch = "linux-x86_64";
-      sha512 = "7561ea580fa411d7c4a8c4cc6bed455f3287a55a843484d20431aa81f7d08b42386287e3cbf5fe7751f528945d9ed70b922cbaaa0f5cde74ff030101d897447a";
+      sha512 = "2e1fdb10a04b771d8b29c9651a1984f1656ba54e7d8905bd625c9832093a69db054adba3a14ac28d92bd5706379757f2d9d66a03c57cce099ffd5d29b96d9379";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/es-ES/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/es-ES/firefox-60.0.2.tar.bz2";
       locale = "es-ES";
       arch = "linux-x86_64";
-      sha512 = "3f7dea40f758a29ac6cdc8dc9e78ab4fde698c7f8d5369670ae31ef3a09819dd40e28296e2c05caa57e95bf4238f6c162fb81fff6d2bcb4a2ebf26eaad3a225a";
+      sha512 = "879380e144dade8568e49f74ee1b9e14bed86549cf6f8f6b98e84d9db72829ea28c36ddf53804bf697f16f74a86153b7071fa1056bd568533846ff2f46cb0e9b";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/es-MX/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/es-MX/firefox-60.0.2.tar.bz2";
       locale = "es-MX";
       arch = "linux-x86_64";
-      sha512 = "2ef05c4095c02c22769098c837cabc435d2d84ec60b7ce09682c6625117c93e294bd00877379561728117e33d5991a0272cf48044a035964eb5d9df6167586d3";
+      sha512 = "dd87e44a2d1fc27666710a1c16fc52f8b7e075cefd6ee9039bb092d9e4341542256f458695c7e6df6c0f7e9380f867845f68d9c62a2f961d84922f74e8bd26fc";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/et/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/et/firefox-60.0.2.tar.bz2";
       locale = "et";
       arch = "linux-x86_64";
-      sha512 = "445158a41339640365d8101bf4473dc77df38f8c965a75f66ba8ef48172e6bd21d6813025192a7f98d451b50078faf5485f95b826af566c3e5215a10df2cbcce";
+      sha512 = "1663bd14ab53722348ebb233aae275f291647c903c2756ac52bb4396bc0f946c0d9e851c0f88df32484f77d03404895ffa68ee0fc88955efc49c9693a1876102";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/eu/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/eu/firefox-60.0.2.tar.bz2";
       locale = "eu";
       arch = "linux-x86_64";
-      sha512 = "7760ad9243be37fbf1aa727afda348f8b4460eb4726d1402e2da82b3165f208eee21b786adde20e7c11aeb5567c6e379210874b0eba75a86f5c88486b4c48c2d";
+      sha512 = "42ec88730a68821186a7b5f750631a03490fb7c77b6ee31e7090b4dbeb36abf02fecfe301ed31e41eb0959b31677c994a40997a713488aac8f4657db4dc497ca";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/fa/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/fa/firefox-60.0.2.tar.bz2";
       locale = "fa";
       arch = "linux-x86_64";
-      sha512 = "38fff9451b7fc7a027a5cf646ea6666a9519ae57f31ea77da8560777e485fcafa27e5203ce184916a725449384ce7531f41ba5f38d30a05004093c932c052ebb";
+      sha512 = "382c8b844ea58a7ea4a340ca209c7a1bf381c14373023cbfc10b60d7aba900a96c4b71128f59e5bfdddf03b3560e7d8b89bd5792b130341ba49274a051ebd041";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/ff/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/ff/firefox-60.0.2.tar.bz2";
       locale = "ff";
       arch = "linux-x86_64";
-      sha512 = "efed066528af1466f750af19ac816f64031220618cd1c35e8c2041b6d94e0b3fe894780dda51c22e75eb49d4a0f3013c6de9557167de22b85ab4d72bb44d6729";
+      sha512 = "ba2fe6d770b7faf3922210b32f8a34d054a06c4640197b5d63fdee55905438aa4a75bb87666fdf106e03e4444727114caccca2a5dd9fb0fa20f475cecb903224";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/fi/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/fi/firefox-60.0.2.tar.bz2";
       locale = "fi";
       arch = "linux-x86_64";
-      sha512 = "95d8c34ba47b0fbf2b112764c5f2dff684f9e207c839eef45a2443500de6f30b72ded618e116d784b6b315028df8cceb1efe11d3dc08b1af4a0466c016854c73";
+      sha512 = "0c7d80a8e04f693df8cd3e374d0a1fdb65b25615fb0cfd2a73b0f78257f8774057062493ad1224ebf852ddd3128e9bea945d9520be2c188089b86de36f169dd1";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/fr/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/fr/firefox-60.0.2.tar.bz2";
       locale = "fr";
       arch = "linux-x86_64";
-      sha512 = "108fa3054bec0877f35594c6c5f22d5d5bce3eaf5e74e5a1843bcb7592ff84b67160065b32962497577cf59b5375f0bcf75d4676c4e7201712589050a018e00b";
+      sha512 = "cf798f34be131f30193ebfdc061edfc7a18b3793bf68b63d3d5c0b98b6208bca1173c3a785240f07f3c6cb1ca912e25043bfe407ad6eae30f480e4f9c8868f4b";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/fy-NL/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/fy-NL/firefox-60.0.2.tar.bz2";
       locale = "fy-NL";
       arch = "linux-x86_64";
-      sha512 = "9dddf9cc3be7557e495e712f542f5f3f40ef205c893b5773217ff13e93cc83d35c7d7fa3611ebd1223a9cde4308cc8b4d0d0ba8879072e9dbc1d1433b972ae15";
+      sha512 = "0a2698c1740ab303a100e09f5d5ecb28eb042199cbb3705aa11f57aed331e5bf71cf8709d9c8ba4693b0fdb8fd9597006f961bd481ad2baef6ebe42c7c6cf32f";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/ga-IE/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/ga-IE/firefox-60.0.2.tar.bz2";
       locale = "ga-IE";
       arch = "linux-x86_64";
-      sha512 = "a2539cd2e7ec2f8898c98a27e7e70772d42a14a435279e33f2fe192189253e8c0d92814d25d3b2e5a5c66ac02ba6745b5feee1045c965398781fa86b19c68b0c";
+      sha512 = "21ac54f135b1dae3f128a6e2fe8376384e951e64c019930cad82346a8d7b827e62e6caf62892194d0b3b7257d66bee9c4bfe4184c5cc146094f26c497f1066ef";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/gd/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/gd/firefox-60.0.2.tar.bz2";
       locale = "gd";
       arch = "linux-x86_64";
-      sha512 = "dbfcbdd6bf0ddcf535821268d0c7fe59541387647124a7b95243babb1ba02e34dbfc3956808aea1bafe5f301a7c31382eb958e3da21a476c7961f44b4055bd4b";
+      sha512 = "19bf6f1905b8fa6b1efb0a4fc6dd35ae3dece610651abc8b927f0527ee0ce48074cddb840331b639069fda5509a7c0248d9862e45d318aebda4cfd747b966511";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/gl/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/gl/firefox-60.0.2.tar.bz2";
       locale = "gl";
       arch = "linux-x86_64";
-      sha512 = "743c417dcb7bfb4027b0f56ff9c2561888bb7a66b0399e713bc65255f6283f9f33736abbfb449030cada641b085ed9d6a5a7010c60ada1002802f4cf6f3fedbf";
+      sha512 = "8ec3abe16c1af9419bf67c295b624483713332cc1de8363d99c383d6ade93b3778718f2572b00360a890aaa01a0e5104537277e616e2762d15a4736fd27bc2b2";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/gn/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/gn/firefox-60.0.2.tar.bz2";
       locale = "gn";
       arch = "linux-x86_64";
-      sha512 = "319eb86fac5e121e27a55386d3b9b79a07e4c766ac999ea387e03619f85e1c9a194dc4bc6cb56d66203ae647f6cede6bba81e65c4bace35baec986a18d79045f";
+      sha512 = "f5c2bedd34e595759aa9ea229576fd8590a4f777ef5826a2758273bb2b7c27aaad4fcf3e719f3b67237186b46528eeadbf8dd42e514b685e5f1b7ed2ad01df56";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/gu-IN/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/gu-IN/firefox-60.0.2.tar.bz2";
       locale = "gu-IN";
       arch = "linux-x86_64";
-      sha512 = "37a5b54f94b5532d8bbaff537642bce1ca3822697821b84df523d9ecbeecd991aa2302c65a1f31883e7a0f9519347a3bb5995bc17208e1a56d8c98897fd1d2b9";
+      sha512 = "e42965223cd29e97b1d13e242b640300d16b1234e8598fb3fd0cf2b3c572ed83284cec727ee189ab918c0d6e287c2682af56d6f44b332b6b8af6cce8dce2c936";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/he/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/he/firefox-60.0.2.tar.bz2";
       locale = "he";
       arch = "linux-x86_64";
-      sha512 = "7a9cae5f7a7aebbf25908509efae41430f6f24d91d406964f83da585762cc078caf508750a562683e1f782bd805ba24b59327d1807badf63462a19955230aef2";
+      sha512 = "9d63b78a18612f28b9e9bb8f5ddd9df7c5a28ddb559d8145d04ad873e644814009e4d803a09025528833b9c59e93896be941ddfd403561dcb9adaec99ab3692e";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/hi-IN/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/hi-IN/firefox-60.0.2.tar.bz2";
       locale = "hi-IN";
       arch = "linux-x86_64";
-      sha512 = "99ed2ea7f0aaaf214d3d4e60ff1fefefee09c42d5aaee85690d0c4e9832cab67f23b4d3f5eff8f46a936ab91922bb32ccc801db06c1cfaee4bdea3e60df3a2b0";
+      sha512 = "6631cf0c4c7520c2c9b06fe6998eeaff68b80940c7263ca1026a22a7f308709be1ab4fb7fc91873ee6be3d4d9b854bece812065247422a59089796e1929fdbb9";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/hr/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/hr/firefox-60.0.2.tar.bz2";
       locale = "hr";
       arch = "linux-x86_64";
-      sha512 = "ea4814ad10720b0685713ea2d670c65713e453693b1d6ab95eb55e1ce418f398549ffdbbec172955d0141f275caa424c75bbcb326b736013dd8741511cba9488";
+      sha512 = "dce0bd4a071829106d675901a948948326f2aa2b7bde74314370241e3388a826fbe2b0fbcf7fe3b4bc91dc1291783ad04fdb7fc6fbabfdf75a79214d77d12e36";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/hsb/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/hsb/firefox-60.0.2.tar.bz2";
       locale = "hsb";
       arch = "linux-x86_64";
-      sha512 = "2e89edffaebcf69580fdb83c92830b091956d2ddd2d523885d0cbb858f3a958661c47e65e82a5f4f832751b215d568f985632a466e52cc23254ebf0b0276cdbb";
+      sha512 = "27d82d26e0f64bc17d38116855871f27ed01c2869f853c546211cf5cf55f40730d04a536eeac2d61deb6a6bd4cb492311af289e05b30eb3f24a7415b6bdd11a8";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/hu/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/hu/firefox-60.0.2.tar.bz2";
       locale = "hu";
       arch = "linux-x86_64";
-      sha512 = "d00f603275a624ad6ded66f71b287e38afc8c4904b194fa0c71ab4f148ce2ddeda286eadc1b2395c316a4ace7aa7ea39e6f50ae8b8177bcafd60774661295e23";
+      sha512 = "e0ce9800431237dd5db846456d8430bf2a694b24291cdca3ebc87b6c7e2b34f04408490f32e44c8c0b68091f71e83e91139844d6a31223340c05f5d73bffd8ce";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/hy-AM/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/hy-AM/firefox-60.0.2.tar.bz2";
       locale = "hy-AM";
       arch = "linux-x86_64";
-      sha512 = "da238fd6afbb3bbd7586f9f057ccb53d5dd8068fc12ce6ced6602384ede890b71e964c0c516b776154f5de358b1bf6b06daf91526dd8fd334bc6fb8fa650bc1a";
+      sha512 = "46f37fac95294a3bb6fdb32d0f4e75c41afa0aca75d2de76045f4ab2bc9ed37f89fce12491ea5fa95bb95cc87c9e5d402be1b89937636c5139c81babaae19de1";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/ia/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/ia/firefox-60.0.2.tar.bz2";
       locale = "ia";
       arch = "linux-x86_64";
-      sha512 = "dad9d2b95fa47fc1b34aa9bd47f785e7640eaf44ee51dc0cee8df6897939e3c77977c60b7a8fd3427b23dddb10bf4d0758b3ba08d305c61f7b42dab6b490a6fd";
+      sha512 = "ab31636a827ec54f309d30fa4a991dc56f24c4eadf305dc318f31c8074d64e057cdb02f657b5b164a58c9ef42fdeee9fd96fa5bd6644c8a003247dfdb6f6380d";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/id/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/id/firefox-60.0.2.tar.bz2";
       locale = "id";
       arch = "linux-x86_64";
-      sha512 = "17f8ceee4f31a8a37684d1319f9b84685c05f3f2aa0ba3a8801c4132c2f61755ef9427eeffdb38420829e92fbbd24dcbe54906de59d89ff149f055ede61b751d";
+      sha512 = "8e3a627bc5664d3899a968305818ada76446d3fc59eac235462875d49eb671c7abb9a381f92c1bdd5d31f0f01f948588b09643cb8faac4d7ec596c71262c7102";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/is/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/is/firefox-60.0.2.tar.bz2";
       locale = "is";
       arch = "linux-x86_64";
-      sha512 = "9dc8a651bcf460e48a64661dea924d56d48e37424579b369ce4bce113d3a3405fd65f542096c8d199a2a3db42463dc28964fe92c42419c8aa5020084b82059a9";
+      sha512 = "7d182df6343c0470888ff4def117ac60a719a3750dfa4728c5bb4b2e5098fc8bde959b2caf4d96d54b1d0b5d6ac32f553f70b28660351c8e0fb03b5612cd5487";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/it/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/it/firefox-60.0.2.tar.bz2";
       locale = "it";
       arch = "linux-x86_64";
-      sha512 = "49a8881a2ae10544db31aba2a8f54bce5948ad25a47f8bd221d8982f12fa66cc7caa43e8c1963cc3ed156ded31bcc331ca0b2f784655c7ef0d8af89d7fd2c271";
+      sha512 = "9b8429e135116f297a45b1fce0e2e9a57e133c3469d97201d1f5af51bd2073c17379494f3caafda39bead076edda3d0f834e67cda5fc6fef9baa5a77083e4449";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/ja/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/ja/firefox-60.0.2.tar.bz2";
       locale = "ja";
       arch = "linux-x86_64";
-      sha512 = "9af0675507f54ec12924c29e051fa4727ea7b380ebcbb8fac1a91481c0405585b4e593324f72b4778538f0acc0efe8878f21f16a02272c5b02acc5ba7be7245c";
+      sha512 = "03fc2e537ed8e8ad35d345d0b41c1f42429ffff5c5bfcd53396f4f8e86722dfd17ba2656749fe56757d026389332c906d576152372a2a6b99f2259608250d2b5";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/ka/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/ka/firefox-60.0.2.tar.bz2";
       locale = "ka";
       arch = "linux-x86_64";
-      sha512 = "c5b52b448bdb19945baab604b820d383f48cf75a3fef2b8d734f0874d7aa8ba1e3ac6493e9892d8003371fde1bec8405cb1bb0991656b8d9d537e8c0b77a062d";
+      sha512 = "4a97083ddd8884e2a57a16f2efc0938a85f5b55097962ee857630ebecf10237de24e7c0f59741da32e69af47b49f41bdb198fdfb4cddfa6c2a83ab139caea960";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/kab/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/kab/firefox-60.0.2.tar.bz2";
       locale = "kab";
       arch = "linux-x86_64";
-      sha512 = "7f93bb78f7e57004fc22863d7dcd40f9407e32a606ff07bbc20a3e4e8d348720fff541d72d962d119eab70998925cdb81ab816086bb8d95c4724a9c02a723587";
+      sha512 = "bde834fabe3bd6fefe6cf819a30c650d868050a1d72353a0e6e370d90b46c71845ac20aefb0ad51c3a828d730a3b94ef9932ee80ad792e2bff003f31245ec465";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/kk/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/kk/firefox-60.0.2.tar.bz2";
       locale = "kk";
       arch = "linux-x86_64";
-      sha512 = "fc60ad4c8c2db9252e4975534a50b373bd5b223ea8ae6e6d2a7a07bbaa4834d078ef2756b40dcbab2cc4dc1bdb5feb1def890021c1d44620a179dbb10ec2ab28";
+      sha512 = "8c154331e3b5e3a340f4fd36774f4f4ece2d4608800551de2ea77e9ad863582fe79819a147a14d99f456ac50bb3b5dfc4ffc75d97ddbf575b009f35ddb0c50f6";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/km/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/km/firefox-60.0.2.tar.bz2";
       locale = "km";
       arch = "linux-x86_64";
-      sha512 = "c6a544c825f3895ec390275e823da876113d74e16fe3c61838c55afae38b9ba7abdc05e28d1b66bdd3477be0e4b0b792fa2244eb6dfa7aa4a189da438badd823";
+      sha512 = "17103daa05445ab59e030101521e02405352e1f026b51ee554cba1fa88cd2cece673d34f58deec55de3f55316782dbf64121248490689c576d04cc05a1b8d5c3";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/kn/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/kn/firefox-60.0.2.tar.bz2";
       locale = "kn";
       arch = "linux-x86_64";
-      sha512 = "c42366e72d38cbe3301d52ec5c6e34d5b623d5f1a06e8309cdacb5ed6b6a3a356034cbe95ccc5c6a8b320dd41e8a92564b66effddab4a03476dacf00acab3fc9";
+      sha512 = "6baa49a08395761ed0979a34b8eb94c0b8011b956f74561253f1fa0a972a9c5de5c1f4ffe3317515ea80092684b9ea95817a6cff3783bf398c216f66ac032c9b";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/ko/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/ko/firefox-60.0.2.tar.bz2";
       locale = "ko";
       arch = "linux-x86_64";
-      sha512 = "4e05c5d8956661956581acd8bbd93eebaa84b6d5972da34b976bb6f654a06d1d0286504350b89dc43988675a3a9c57890dcec81c4a39ad87e0fbd0593a0e1d63";
+      sha512 = "119a4829d184d034ca5fccbdc91627fc06670cea54282df77e87b362d172615ce445e37947a12948fe692e611e05a1b5ded785ce69df6c933e9a9cff234c9a81";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/lij/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/lij/firefox-60.0.2.tar.bz2";
       locale = "lij";
       arch = "linux-x86_64";
-      sha512 = "68120d34a56f65afe99930e32c0b35660c36b38d61e5f60f7ad5da131b1c95d02e241124379c11b6287d2f8794191d27ef1fff1f5c4eed5dd3a5df6f5a2183cb";
+      sha512 = "ee2b2a3b8e7805d7fe42aff4b9892348dda1ec422f70260095b155667bf2cb0bac3cb4c646319f2c567268a8aeee3c3c7f7998dc779cc00b24a28ea275d99461";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/lt/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/lt/firefox-60.0.2.tar.bz2";
       locale = "lt";
       arch = "linux-x86_64";
-      sha512 = "149ee7cedc772534427202309ec4060e8187a847b79dd686096d5ec2c44b1a0656e8c3099606e921942e8c426d0206551fa5952dc0e9abd1d510320fee26926a";
+      sha512 = "5d3fc60ca0a2d60b45a74718bb28c4a6bf8c92187bf1b5976b827e461af5944ef403d00e93e03ee06f9cf5cd57f40ca1a4d1041c95751d4cd1882c2bcedc92df";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/lv/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/lv/firefox-60.0.2.tar.bz2";
       locale = "lv";
       arch = "linux-x86_64";
-      sha512 = "0e630d9a09895fdb06c6893d7f9f3bfe3c3832d4a1682e2f12ee89611570b6bbca695bafd8dcfa583525645db86a156bfcf97afb575c44c19f801a43edd824cb";
+      sha512 = "9072bec1c1f4c11a3c8bd21e6217122d08efe8547dff19e0addd5ac4fc56299225af583bba8d6779537b16c9a443219438fc90801b8e1e0c9d639a350f0243d2";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/mai/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/mai/firefox-60.0.2.tar.bz2";
       locale = "mai";
       arch = "linux-x86_64";
-      sha512 = "6c3dc9e2230a3f7d74390e00e661eca28306996cb8d5379ee7fde818dc09beb813ae5ccf09319510a1df84e3ebd45b7f1a8a08e776d046e39a69f724fbd79da9";
+      sha512 = "d7d989e9d0c274dfda2579c0e3cbba346ed42d6cfefb950d43a49a8c2ded83810de1eede4e894d6d440a4d03f2db239c92a30fd3ffa51232705f8b4cba31e0f6";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/mk/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/mk/firefox-60.0.2.tar.bz2";
       locale = "mk";
       arch = "linux-x86_64";
-      sha512 = "60353c437af1ed116c5d16a4e5d57a1b99016a36eeca8f8e4e8379553a5374cea543dd8a9864e448028b2f188ae16180590da7e199ef96fad604e172fa1f6e55";
+      sha512 = "924afa02079162cc4014f92b851089f8589a56336dc5fd2cbe62e2372c751792427fa0e592d173a74064bf5371807382ec34a6a6b798cbcc11ee1a36a9197d62";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/ml/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/ml/firefox-60.0.2.tar.bz2";
       locale = "ml";
       arch = "linux-x86_64";
-      sha512 = "6065d13e781728dcf587a1389d3893ee69e7e49b601cccb293e2c13dd5e0b5b039ddcef5de3b8b61baf30aa0e994f44eed6f29b38c94b3b24df88f102b0721fd";
+      sha512 = "3a1e5ac314136ac109b6a32db1a31e2d6a4b905e53095c867e219ae19b570774f3a5ce37a462e43bdf55175b867fd1cdfbddd81e4297f7423bf56fa2656bbff2";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/mr/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/mr/firefox-60.0.2.tar.bz2";
       locale = "mr";
       arch = "linux-x86_64";
-      sha512 = "ddaf770f926ffcb612bef6169cbf073ed4c624635d00db6edd3ac6c6051ebd9ab926ae48f2a9b92a5816c6aa2e6b5ed33ea90827f18c70b7364bc33d6ff9174d";
+      sha512 = "a99e311c5639651758142628bcfe50e0006192406896dd7aa18ae86dd9fe4602116235c19e28ea1a5c5623b8d361bcb7ac02b411318952c6c77b10b539aa314d";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/ms/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/ms/firefox-60.0.2.tar.bz2";
       locale = "ms";
       arch = "linux-x86_64";
-      sha512 = "4b9f1e63cfce7b99e05d54f99b7d42255f2e2875718e2ba0e173a7aa53113ed990f1547ecafd508a8547b696f036ec88826260545ab7a6b03d4acde8afbd1fc4";
+      sha512 = "3803232c95c80362108a5bbaf5b9fd22618c483dfadab329db8d320919aea977f1cdad2d60d8add0e3b0f8eb3c8acb0c2e211b974ef775f1fa1c176d131a1e2c";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/my/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/my/firefox-60.0.2.tar.bz2";
       locale = "my";
       arch = "linux-x86_64";
-      sha512 = "a82103f7dc6880e8e81ec3f0f9b07af4dc13de369eb87398dc977f2935387e489c6e61ff2f5a2c883d5d69ec24cd556bc44c722592d432a3a8f82420fadf11d0";
+      sha512 = "67adc587a51d48b3baf4727554dceb26364f14fffae8fa8d9311bf07846b54726112951f1773149689cc9326a559d9e1a55169eb1ea4fe5be6aa590b9d0a3185";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/nb-NO/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/nb-NO/firefox-60.0.2.tar.bz2";
       locale = "nb-NO";
       arch = "linux-x86_64";
-      sha512 = "4a68aabf3a6a085a8a7abfe705ee67b724243696e63bbd5a9324a1a39c2765db0c75d1fd8b652b78982702702fa1997831945e2eb56b059efe55d64d351723d6";
+      sha512 = "79979c32e08eb9a5f9b239569f7c8cd992b1efbe6da9236e3f9365111cce74213f4ab7f95f716bdf3029c28733f0939bbd9a6eb95a9cc76285c605895062bac0";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/ne-NP/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/ne-NP/firefox-60.0.2.tar.bz2";
       locale = "ne-NP";
       arch = "linux-x86_64";
-      sha512 = "760c819b44b1b2d694ddd5841a97f586c46fe2661c18a2d9f6831ae24a1f67a90beaf5592d8dccba35868a0e608f80b0a652f9c3af8e01601dbfe771d35c38d2";
+      sha512 = "8cbd0ed2f0df776eae187acc8f53d1b750fd46e43780d9adf8d31dfb7116ba11021b4b31c71637205927aa751436a20f2faf7545bd1573d210a6e7ab5da24257";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/nl/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/nl/firefox-60.0.2.tar.bz2";
       locale = "nl";
       arch = "linux-x86_64";
-      sha512 = "698c765c19647bbd6cf55e3812501131720ffdb485058e90e79446b5310d056ee09162253ee334535ff0eff2d544748385ea88d3bc1fb3bfa0044d4eefac8f07";
+      sha512 = "f0912f2e0765499baba808d340502fc463441b8b61fdc803088fae9c74cf13a27d5ce91af8b6d2fda542d560042ea3d58abedf42c7eabc4ea6536684859c6747";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/nn-NO/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/nn-NO/firefox-60.0.2.tar.bz2";
       locale = "nn-NO";
       arch = "linux-x86_64";
-      sha512 = "5cd75409e8f952a681cf7485860a0c45bcb77a9b6f3d645f27b34560802772917a8d29eb465b8eca2fafdaa5db1cfd5a37ef2219cd14444296c81b1c53008375";
+      sha512 = "995c0f9329260083030972f55fd8d9dc32441f91b647ac2a2b38dc8dba179504beefaf4726af2f73a07b0fc142e1b33589e60c67a88796ec47f101a55f015a96";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/oc/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/oc/firefox-60.0.2.tar.bz2";
       locale = "oc";
       arch = "linux-x86_64";
-      sha512 = "765bee0da88cdf168a37521e94249e14dfc80f72248e9d6805b098af8d99801ba38b96eadd6461bfa523fc2bb9999652ca2309ae9fa9202a5e5e00d4aecb506c";
+      sha512 = "2d34652d6a56441ed9709ef0191bd252621b14102a7155e2b6d8cab85c4c084a6f9fa336a32991cf329b4ee3c86b3d3dd1ee23c98428170a12d4247a1d06c096";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/or/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/or/firefox-60.0.2.tar.bz2";
       locale = "or";
       arch = "linux-x86_64";
-      sha512 = "06fdff27a007b45357d17f77fb22b589bd2f0d07866e0f64f00af46a1403f7375df82cda101997d008882232ba34043f26e0e8db0f796bfe30d442eb990ddfec";
+      sha512 = "bf74dafd4428103e68b34e5ef4b92befccc2b56b7a92f0d8e0fc8deb03a916efffb62fe4e99431f5708a6fd76cd989bf603c954fef3f7a67e86b2959d2753e68";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/pa-IN/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/pa-IN/firefox-60.0.2.tar.bz2";
       locale = "pa-IN";
       arch = "linux-x86_64";
-      sha512 = "8a416b28b1f2d73865d151480ff329843e53ad45dea6a1e931fa6426d1d448d47b6ef2e8cf2125d7e03c69bbed90351bf6fe65036be490dbe7688598eb01a8ff";
+      sha512 = "f68daf5975093eb806325f543154e3238c3c2b30c9c4d9be4ce69710bd648212cb66be8cae7d4dc032fdb347c51f8e45634598389f1ae3be0c71d30fb470c135";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/pl/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/pl/firefox-60.0.2.tar.bz2";
       locale = "pl";
       arch = "linux-x86_64";
-      sha512 = "df635d41fc27ccab2eb30d6b73effe6ee33a44f543fa0f7cdfcb9e2ba8a70ba3a5608a914bb80bd4f450b623d3d6b05e0d9cb250a660560cbefdf98d501425b6";
+      sha512 = "15374f8179f3fc589fde99deeb3ed473de8d84de22b23a1f94f396204897c65be1e32c712f778404c2eed424e87a92370a8d0c96dcfc65e41b96efece65adfb1";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/pt-BR/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/pt-BR/firefox-60.0.2.tar.bz2";
       locale = "pt-BR";
       arch = "linux-x86_64";
-      sha512 = "b5e23c79428ab50ee97ceb79305331cb36b19f9f76b8473a53f83e669178eecbf06fcf79d067923147fda14863d56bdc157d1123b50cf64841ef3d8fd77f7cd8";
+      sha512 = "2d6b73fffbbe446e36b880b13b22bc1bd0a2412011492763f358ff2f8ad443fc6e2e13ef96fbcae2c6dd79da6d4ac65e94274c0bf9f12d77bb35610406571e04";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/pt-PT/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/pt-PT/firefox-60.0.2.tar.bz2";
       locale = "pt-PT";
       arch = "linux-x86_64";
-      sha512 = "03e3dc135b4d0d8c74ed9cd087edebdf26b256768adbf42d3a8e6745b438a9e617d717d9fa68533d9aa5e7c07c64ed42540b5005cd1b36fa04e9912b4e046090";
+      sha512 = "60e7955064ca76af41ad750ae6026095d0b6eceef085764bc98a98767346f2ed3220d299d26929ba6f52e831475cfa1805c04ce6c111f8c18a1a72ebcb8d2ed3";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/rm/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/rm/firefox-60.0.2.tar.bz2";
       locale = "rm";
       arch = "linux-x86_64";
-      sha512 = "74884aa4baf61bef8707eb94c9cd523707426ee5c5e280a2f18ddc1cb5535d15a83c7125b4734e3472c9e0ffcf2a8aa7837b9c150ecfc2b1767ee42750cd2a3c";
+      sha512 = "8d83ad0e764694e1dad897f0505ea6ee143fd4a6aa99c44b9b33d51c624e24d1e6e217b760f487405bffad5f4626f22bf2233706c9c4579551cf8c89b06cc1a3";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/ro/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/ro/firefox-60.0.2.tar.bz2";
       locale = "ro";
       arch = "linux-x86_64";
-      sha512 = "d245c0322e0a4d94b3a837c75c8b800505c82472363202520fdc99d0db04b2830bbf522bf1cc63285d103a0fab22083b8dba93c1117df78ec8ccb6c03cb36633";
+      sha512 = "1d2c5671fb18d34d9bd10efc8be7b37d7ddd30fd383f5abdb77213b3a60a6ea1d704c8dce1dc52e446e3bdf7a4e13910d52de6e378a33607fd30f39c7f05c258";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/ru/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/ru/firefox-60.0.2.tar.bz2";
       locale = "ru";
       arch = "linux-x86_64";
-      sha512 = "1ff03c04e419498d3e2ea565c02f4716f41370fc97c24166e54d6a07d92ad6f0ffb6ba13f708e4079d00a4c98fc24e36c278414c7b638e29cc7e5f2891417348";
+      sha512 = "296e4545d7763140417e3e7811f4d6baa82656fe09fcfae6251d4499a82558b5a7d18230c317cd97fb4cf324574f21997179b4072721761f1084a358167a35e1";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/si/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/si/firefox-60.0.2.tar.bz2";
       locale = "si";
       arch = "linux-x86_64";
-      sha512 = "4467d0a6a69d7ce89e1849d1cfaa81f2588cf8019e50a5fac6f292a2a50c55750130e885334659f834190969636ab74a3af97d6175be5f88e45b97cb772a55e5";
+      sha512 = "7dfdfb6762002596aaa59f20e080cbf62ee91e5ce5fdd01bc13a31535c573657cbae106080b4a0e1276d45c47c28140cbd74316fa1e74b6d70a8267c405405a8";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/sk/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/sk/firefox-60.0.2.tar.bz2";
       locale = "sk";
       arch = "linux-x86_64";
-      sha512 = "1060fbd4bf7f83c851d74773ce0277ebcb7f22769ef95b75775d7546b3fbad930e2a04deead17d37e5bee69f39aa978b65c41e20862235209528bb91a776550c";
+      sha512 = "b1900128dd080b8e90e0c2100d785c011e9a035372910964b3af28337e3280aa8f764b18897c13a2ffe19e2bd0874529b40174ba8f274f88a4d043cb8c36e5b3";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/sl/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/sl/firefox-60.0.2.tar.bz2";
       locale = "sl";
       arch = "linux-x86_64";
-      sha512 = "75f0d0a4af65fc3f3992cd859c7f7f7a9292aa4f0e1906fd4e7bb4106edad80f3cf086cd843bb526cf2958cdfd94403fd110c83d232c533b105e7a79b6b01b06";
+      sha512 = "093aa2ff706482696258bb10a890a0ab72d887f020a2925463acd0990af84d831b35c3a3934ece503e53f228a2980d3529b936a6fe496040633c14c0fc0e6474";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/son/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/son/firefox-60.0.2.tar.bz2";
       locale = "son";
       arch = "linux-x86_64";
-      sha512 = "4f5a8dbd2c60874a4158a4f78b66377a193265751c1f7629836c789ce0abb83de85ff1bee97ab8708ef86bb123d0d2ea5bbb2bb21fcdc52950e1c1164fc13684";
+      sha512 = "25d73d62ffcbccd85d81791522614c176db531cfa0f6836fc57dab2ec86a3b05032e1cf7b00ac7d70408cba63c35e4e86e199cd04fe488318492c2caa37983c0";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/sq/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/sq/firefox-60.0.2.tar.bz2";
       locale = "sq";
       arch = "linux-x86_64";
-      sha512 = "5b226608e43a7fe4ae8f23eced67af9f512adda9f70c4f33b81f0a4e779e78e9301bb5e95a4b4362ee79a04ac5da81c36005c5b4e903d40f6f4af84b5503c113";
+      sha512 = "c67e29f65bdd0f9a72f0639d19b706391e4a0d56440f3692a5a8afd0dfe86ccdfcb4c326e5b54642ff3302a4b0b4a762a7f430c6371a93fe66cb727b65a5fdee";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/sr/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/sr/firefox-60.0.2.tar.bz2";
       locale = "sr";
       arch = "linux-x86_64";
-      sha512 = "143de2c6f87385f71deb0faf6db20cfa5680c5e3f682e89456602f05494624d22db9c577b92934cda98e041f27682103d1755864b0dec5bc3b2b6d9121133532";
+      sha512 = "eae557a85e5e0b20476176af094ff982c6c60769572022fa14faf22e25f6bec666aadabc10ffa7f90aba440cd94a5c09b8e72aabb228451d3bbd1e600f89454f";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/sv-SE/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/sv-SE/firefox-60.0.2.tar.bz2";
       locale = "sv-SE";
       arch = "linux-x86_64";
-      sha512 = "09e52958d73ec2b32331109a1f1d9798493cecae739fde6542dc4d6ba026b4d2e1d1f3816b4d2b16d71faa3a3840417329b97eb7a8c0fac2cd168b159a61eb7f";
+      sha512 = "b153121ff96e9e8a86498e8aa78f826817cee24f9ccd72a8ec7450add844f61a6695f8b77c8852b9f3f96da80e5942ab65dd969a28ab55c4fdd0412b136dd7bf";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/ta/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/ta/firefox-60.0.2.tar.bz2";
       locale = "ta";
       arch = "linux-x86_64";
-      sha512 = "72b0e1a7b94eccade119f7e4b251b803f4f0c54783faeb506649b9048d663698e084e15664baccfa79ad2f6c6238a19c1bc61bcf840fbf003df94cd62ef38deb";
+      sha512 = "e10827d43a9ddf6b6b1ea5b64d7c926ea3301f677bd2331d933e9b9802d1916302aefe64a150e153b1bd68a5550f06e3e4bbfe7897e13bc619494a7d73b983fe";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/te/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/te/firefox-60.0.2.tar.bz2";
       locale = "te";
       arch = "linux-x86_64";
-      sha512 = "0478768a0e6b228ad924dcda9dca83fbe2d51646503db931ae4600bd107fa15c8f1bcfd4034b6201a72debf561a815c28c54396a45100dacb68d9f04c2c0a45f";
+      sha512 = "733f5df11ce22c674b3cdd81134932e1f267931c7e1a1b363e4240c8e9e348dadab8f2728c0c55a08e43f3e1960d4949c57a674bcd7462546fa96582902cebe6";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/th/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/th/firefox-60.0.2.tar.bz2";
       locale = "th";
       arch = "linux-x86_64";
-      sha512 = "499aa56d62d5293e050bc67a50feefaf5019385291e4d3a602f35c1e8b58937acaea893a36d4d77e0e4eacacc3c406054b9e81bfe8cdb27c687b4cc6efcf1b2e";
+      sha512 = "2cca4fd4d3d1427f35b96d7adfffa899d1aff349f404458c00539a44506c016cdb8410ed1f759a0b8c3ad96d1b5d115ee6d2cac09a8c45ada12abda710e61e0b";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/tr/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/tr/firefox-60.0.2.tar.bz2";
       locale = "tr";
       arch = "linux-x86_64";
-      sha512 = "8c3f26b9d37e47e3445fb14ca547f143961f19eab66c93ee4a560828a4bed3c773fe09d2e77c350effd76e0a0c447a0121c9ed29774a5ed93de3d707891a024e";
+      sha512 = "cf5bfd757efb74339126a5e412c7f4c9d44c1590ea3516ca138d3044bb765d6ecb5d700ea4ba3b1f1035f798d1eee29e14c1e71ba0be17da15edcce307740fba";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/uk/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/uk/firefox-60.0.2.tar.bz2";
       locale = "uk";
       arch = "linux-x86_64";
-      sha512 = "ef7a776d6aadd6d9c70594260679810325a4cbd11002bedf5e7d58d36bfc82f72c3c2c352f0d693292992ad6bf9fc323e5947183f6c713f85c353ebe72203b7f";
+      sha512 = "54b532c38324fb4d8140a48305397aba97cfcf7d4cca9835046c6cafe2da1a206de82dbc0c3c7caec7f37e4363422443d39c6dec5633db9039f2bc04aa456bfa";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/ur/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/ur/firefox-60.0.2.tar.bz2";
       locale = "ur";
       arch = "linux-x86_64";
-      sha512 = "9096d21d134c2e55d694ea9a6e06a669e636b15fc4532bcda12b9944d38eef325e256106004e6f9fa503f5590e5077da5f72a535b8887501a53d4a8c9c0c4c55";
+      sha512 = "02e14dfc408e70cb22fef6fffaac8c88d38d305de04c882e9ecb0f1f25c272ce7d9bee77b8c988cfefe2b52a3a6ff592638c327810a1aa3b70b1865fa94e522e";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/uz/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/uz/firefox-60.0.2.tar.bz2";
       locale = "uz";
       arch = "linux-x86_64";
-      sha512 = "d856195097a7923d42a7efb257a9758ce4bb5ec3d93de798bfcea1ff20dbbe1664d71fcd8bc72dc9592bb4c4e8e45a041164fb9b9174c2c75e2c04ade968e532";
+      sha512 = "0e2d467f53c3276ce96e974e22681981392437741b72cdc11b486f28896c95f1f86d48a6661803d6143d160656e0b566f2304b25ebac587cd657749022193353";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/vi/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/vi/firefox-60.0.2.tar.bz2";
       locale = "vi";
       arch = "linux-x86_64";
-      sha512 = "7ce9b59b89c77e289b56ee8b358409aa6bca3c47b6be004a38037f7c156834213dc5704e1ffabe3fa86f1ba89243abb6efa2fba31eb5bd1f4d95e0f225d0253d";
+      sha512 = "5bd6d080d82d897ae2b48a636143ea7f502f473b6738180a51207dabf57fb9e440aca16f13d1c190aa623adfed3ec61d5839f918ddf43be83b6989d10ddaa418";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/xh/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/xh/firefox-60.0.2.tar.bz2";
       locale = "xh";
       arch = "linux-x86_64";
-      sha512 = "7dfc5627038c97188e4875af30cb88baea359463d5bd47d11440c9f33f84ad4168d860e947e90c104ac647a09f3134892a394b8a8435639f71f7bb9edd92bcae";
+      sha512 = "9865055d2f4f841ac84acdbe7c3d839e245599511f075292825e3076ec01ac28b7863c3ba90802fec98a940dc8bd892d9d77cc420e4257cf0885f1020f70d89a";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/zh-CN/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/zh-CN/firefox-60.0.2.tar.bz2";
       locale = "zh-CN";
       arch = "linux-x86_64";
-      sha512 = "75d8a96eac39c0c60814718929997e9d4a60a2fd273ceab744bead7164d6bbdbd8057a94a3310709da7b6287549cd44f6d7dabc4bba1bfe1f48f3345193cd142";
+      sha512 = "85a313bfa3faba33f25fe469a59c3f4eb21ffc5f1de524ef4db0e6fa4ca7e9d22dc359592646ceeefb11fdb50649fbe9fb852c2f9afc7ee1ff2d971f2f587313";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-x86_64/zh-TW/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-x86_64/zh-TW/firefox-60.0.2.tar.bz2";
       locale = "zh-TW";
       arch = "linux-x86_64";
-      sha512 = "d0465db2b3aa8a52d8e60c480605c069c31f0fcf80cc757980022bb538c0509b99563ce7fd06f2660dc8169dcd3fb6a8681859218365a3ef2ea822eebeb29e12";
+      sha512 = "361b5b6680819e9c34e35921e95676dbb91d461d24c8d046b5369ff31796ea5d713de08114b2e34b0c06ae6f182c042bd51c58eaf7dbfbeeb26f5a0e12ab0d39";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/ach/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/ach/firefox-60.0.2.tar.bz2";
       locale = "ach";
       arch = "linux-i686";
-      sha512 = "7770772e90d57f9bfe30a5f965cd89fe367ded55c4fc146da547d150c85d0fbe906fa092c2a62ae8df3cccd5702e6a7b1b1680e0522e3164d1df20d2538993e0";
+      sha512 = "47795903b41b7580991c0a5bdc51c9e6675955d4831cd15a75a97853eaf428bfe111f9c4268433564884583e5251510e5cad14e09d7be009791a03a0dcbef8ba";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/af/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/af/firefox-60.0.2.tar.bz2";
       locale = "af";
       arch = "linux-i686";
-      sha512 = "c615df0582484ce23cb16556cda202cdd81056d197a78be02b31d3f71059644378c2e24cd42b4afcbb0b610a3f25d87aa1178671ba04437a0885cd90b0954f97";
+      sha512 = "1a833d81c580e26a337f7471bdc4df4bf2f4966705e18c09cc07d4da54208bf94f77b2a0abdb6b81f1e175acb902cb61317aed313af9e374f2b2e6c57e4c1f2f";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/an/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/an/firefox-60.0.2.tar.bz2";
       locale = "an";
       arch = "linux-i686";
-      sha512 = "ab0fd2292c5aac5ec5e1669c49f0aa6568f0c8d0bbea8c20c18ead6a52e88ddf08e3ca44e24386a9a0102f0bd7eec12b9e2b9e6713a3958cf13bd978106f7009";
+      sha512 = "72be8c1502c3e5c610d3e09d557ddae5dc74a9d16b8b6a2458f2cfb3e1e1d04e86404e53427a0ec9de37f7fb35a3a1e12a8f308ea80c527c7203e111710cfc09";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/ar/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/ar/firefox-60.0.2.tar.bz2";
       locale = "ar";
       arch = "linux-i686";
-      sha512 = "dac0df9a18f1a7d01c1caf05e17edbffa6029733c6d439c26fed0b12d1fa8ad325fa10ccca51cde25ada1f76e338c0e6a8792e400f0ae44771231a3a49a33a8d";
+      sha512 = "6b332c3933b875cbbb93f337470b51f59d8039c0d15028e3f3f9da87c5d540ba6df194d704deb9e3caa5b31fca9d9f35e75d2fde94d56890c542055133341285";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/as/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/as/firefox-60.0.2.tar.bz2";
       locale = "as";
       arch = "linux-i686";
-      sha512 = "d57627a4cfad823602cf5e243c5a1c1d8e5e7fd5cbbd345cac1db7ca23947fbe0dfc8a4dad223c6af8b5059f3544a34afde8502ea29f9ed6e41623ce4d856f98";
+      sha512 = "65f3267e3d3d1abd89db670027ebfbf8daa73b3ae29d80ebab904bdec746d2934221ad8f8c20867671ea709252b69287399f2560fc8f08f78c0693f288daec20";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/ast/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/ast/firefox-60.0.2.tar.bz2";
       locale = "ast";
       arch = "linux-i686";
-      sha512 = "32bd3dcfa0a8c63605aefe54a3c96f2dea826d41edce8c71bdc4da5eaffc2b303c8f1c057ce0a4c6ce5d853d4ef55484b5dacb51f27dad5e50b96cdeaa2298c1";
+      sha512 = "c242edbe7b54803085e9ebc8194bbcf0679905dc0546944a02dfd1bfd8c3dcfa455111b433bda497dc901f4916d34164e1645bb07a2b60c5b36721d7592a374f";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/az/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/az/firefox-60.0.2.tar.bz2";
       locale = "az";
       arch = "linux-i686";
-      sha512 = "e94f419ec6a34100242babf4afbbf23b98106748b7c2f02b83ff4b0a396bf5e003ec1bb3ed36feeeff82c79fb17c18918ee6e9ddc038ffccc0e121dcaf0eb1f4";
+      sha512 = "a1a8639450e2c15348bbfdc26d8f2625231a3002465e44fe8a4027f1f5d0518e5b1f46a3d37ec9e091628d7222cc447b7b6017680c39922adc2e0bd3e89b1d84";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/be/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/be/firefox-60.0.2.tar.bz2";
       locale = "be";
       arch = "linux-i686";
-      sha512 = "b23cc179f2c4c5b3d79f6009d87f4772dedba67150e014b792a5d892fd1e09a413ed405d86f82e9f74a1c2e36ab76b2a9e41bd49dc7d16483749d195b56791de";
+      sha512 = "4aded5865bb90684fe5e6b4e99176865449181b07001d8af83225231f89efe25f6c0a13bc15bab54e746c822c44e0bf4a8d21e667a944f7f42348b015a9ccd8c";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/bg/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/bg/firefox-60.0.2.tar.bz2";
       locale = "bg";
       arch = "linux-i686";
-      sha512 = "0d8abaa490719185579d4c24b02ce38971191ec13bdd1798966364c2f9fc118bf46dfa4ae0621d1c6427beeb03f487a1ebccb0a4e49d6ec93372397de56c4851";
+      sha512 = "b044c84cd726a5955f9436599102af13f30f637505bf1ed309213ba37c887f1d06bdb902a37a415f73d98c126b41661fbf4ee17c5a3c5dc1e7ce4a24b40f61e1";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/bn-BD/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/bn-BD/firefox-60.0.2.tar.bz2";
       locale = "bn-BD";
       arch = "linux-i686";
-      sha512 = "db9e15472c21880a07e1337e92fde44ec19a8f6297992b589f20bc05ec37140c41d65097f1759734b9ac13b75c806996e17c70bd5fd0bbe65e3acd6a0bb0a854";
+      sha512 = "efe45227912af62be3f34fb24ed8d5a428c5ac90ec08e88e5469ceb3a812994c56ff8cafc3095256123adb9c9ec48b397de8ba13cc026ed7e33b0c8cc73e40f0";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/bn-IN/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/bn-IN/firefox-60.0.2.tar.bz2";
       locale = "bn-IN";
       arch = "linux-i686";
-      sha512 = "2017273b405a8ff2b9bb1d1c1120c74679a1583ddee9f32e4643f62ef22fd3174e4e01f22e374af92b9821a550b8711d2b65987c71b44215236c161827f679b0";
+      sha512 = "2e19b119cab38130823555d66178a4cbadb74d91e45206529d151b289557916f9bcceb267990b00c116810d1ca8bf8d7de69bfb27bc71e829a61dc314d8e80cf";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/br/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/br/firefox-60.0.2.tar.bz2";
       locale = "br";
       arch = "linux-i686";
-      sha512 = "9e7648e312d78397bdc06b0a6921f76acf1916c28c8ae05aa9dc7c70c83d522898ef7e2e847cc3c0cbb19553a572ada7914b60424a46d57c0d7fc207941af3dc";
+      sha512 = "953922e625bad5f64471b87ba8eb646d3db6790594cf79ff0cbeda6a5bf88ec93ea793599704c6dc4e08d433c2aee4930ae345a002e015183c19d0d0c9261b9e";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/bs/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/bs/firefox-60.0.2.tar.bz2";
       locale = "bs";
       arch = "linux-i686";
-      sha512 = "6e93cd48d03f87e027e913199e0e7b99f5d66d2d81a4d7da52b8f6a38b9b1e43d5ac5ffa56a6eb46c921a695f1826c6f5b936d4622aab3501e6132da26395888";
+      sha512 = "84b0cdef75a3043de34851d74a2e8cb5229bc2d6482beae51917ae4122231cac9e9e7756009654adb47eee673cd2aae251f836a66067eaa08cc2853275517fea";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/ca/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/ca/firefox-60.0.2.tar.bz2";
       locale = "ca";
       arch = "linux-i686";
-      sha512 = "0e49140d11167e2b6c7d15f75f2b121ab44afffaf1af9135012314c9234af25555a5e18a7ae866d3219e6c0c6752f7ae313f66c7312959fc101c32e417feaed1";
+      sha512 = "9e1f5d10e6d73576c634b749e90e7d787dd0d74d1260a9dcf24b9744d08f89174ce4f5240f8347e4b8d6fba74a8a7b48b2acf98269636830d04d345046c5aa4a";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/cak/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/cak/firefox-60.0.2.tar.bz2";
       locale = "cak";
       arch = "linux-i686";
-      sha512 = "75c5532e9ee936aa24c5fad77c96fb8aa9e84d3531ac6d36330fd3c324c8bdf13f2e7f815d844e639fd06096c6203e4253c9d97e0c7a564b0b393543a892e56d";
+      sha512 = "fc7d14aba77866645e56b8f1407a9aa8eb129bb4243ebefbb69c131a2b8f8c6f2ba5d12c82af0f44a0f24f2d25ea68c5e6418e5691629cca02f65e0d481b3711";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/cs/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/cs/firefox-60.0.2.tar.bz2";
       locale = "cs";
       arch = "linux-i686";
-      sha512 = "32835014bb3b7acb93d566710bf52ebb3bde52f9c17f4b4de64ec598e4a40b9ee8644a2c1866a48aa6598ace07969912eeb09a47811d67d6cb317078e8e99e99";
+      sha512 = "8998b61aaffece4ac65475d97f1d2ee1427b5e9162368d5aaa2ce1c1fb44ba1e306251aa256b8e3b6561dbc07ba1861f33d99a272f0eecd58a9c382be7d19088";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/cy/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/cy/firefox-60.0.2.tar.bz2";
       locale = "cy";
       arch = "linux-i686";
-      sha512 = "7b29c7e69a18e817828fd7cfc05faee51a9f9bd1b229a1943443cc3676b4a3e8daf4b52232633c713f0cc3ec4d9ef43a6dae0ec1dcec66caf0ab9d67b1be9467";
+      sha512 = "2f4c2ed89e5d5a916002712854f0ced27ae19c99ab7167ea3e6b03283b587899d80092e0de853e890fdb16f61f3a51f89565d65ed7d59486d34fd80e1141c062";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/da/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/da/firefox-60.0.2.tar.bz2";
       locale = "da";
       arch = "linux-i686";
-      sha512 = "41aa2e220651b92b8aef3e868d1b9080d1872841d5b82cafa7c1f2d1b0db063c487198949643d89fa0121bfa4287b7dcda99c245f8095b1f3dd86bfe960ab257";
+      sha512 = "6c878c5e1f4dfa4e513703ab31ab56192cfc6634bb13118826b1db3d5848b512cecf988ec1e9aa7a43d5530325f4ca3cd2af908491b3143d646f0f559c231c02";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/de/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/de/firefox-60.0.2.tar.bz2";
       locale = "de";
       arch = "linux-i686";
-      sha512 = "7d25282bb59a627dcf09b39ca15777253593c4b91e61e6f9d4d2138426cf8ee16f6d8e509398824d8697e42eb301db29e6843eebfad5eaee1fdaaba5fbe7f76c";
+      sha512 = "8b3720e6c9e8b096785763aea4657cfbe7f8ba3e3bf245a66ea5d50d4c6150a2c3985303306fd3899b19f9296297adedae834bfc295141c7282ad5671cde96da";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/dsb/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/dsb/firefox-60.0.2.tar.bz2";
       locale = "dsb";
       arch = "linux-i686";
-      sha512 = "1f1245297135c1c1550db1ceb110546bc0b436ceaf364bbcd531f6df4770ab694c1602de9f39bf0d9083dccdefa1d5fea21cf9f4e46925cf1357bcc5043f8926";
+      sha512 = "4cd36f313fc95288cf3b691f8dc1db891c80c0fd61359d208f9d2734c67586e9b2001fa167a37804ef96bab35318f78415596a7b43c42c9c77ab08e76c45f36c";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/el/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/el/firefox-60.0.2.tar.bz2";
       locale = "el";
       arch = "linux-i686";
-      sha512 = "58763f729f19722446e87dc7f0e8044993f9cff5b7f707c3d1256628d00011c48973f4408a8cbca67551b621f67256a9596d91f353ecd82482e3b9278fe8b687";
+      sha512 = "193402a98b08cefce18d412ac0d0f950307a4ee58f00e9b4e685b82b8bdfdcf14e3ac6dc5d9cb2a2afdb81221ce1b2c5ddcaa2df90eeb6412ef13afc1db702b8";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/en-GB/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/en-GB/firefox-60.0.2.tar.bz2";
       locale = "en-GB";
       arch = "linux-i686";
-      sha512 = "d51d6942aaed323fd82eb833a84ee13e4ce8b2d7c461a5bd1f2f48b2b1ae8c9d900280bd21a2891455bf17711f01cbbe70e793f18e3a0c2e9b15cec274c3da1b";
+      sha512 = "861405ba50462d0b4535ebeb053af0c999c1c5bc525ed57bbb2172334bce4b315b0abeef92adc8cd0cd92ca16ab527500f7fb5027656d8b14f6f682733ab257b";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/en-US/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/en-US/firefox-60.0.2.tar.bz2";
       locale = "en-US";
       arch = "linux-i686";
-      sha512 = "6c849a9fe358e06c9db01fcc1f811c9cce59cfc150423dcbf8f83eb1407113378b25641de67a8ce8bfeea4930937fd0ff4e919648ef80b219f84eebc3ebee546";
+      sha512 = "0838d4a6fa9151992e84227a06e40793ce832cc78761ecdc4b5a6ca2d73aa3bc63ff89f50d56a0ead39f53f2586ca9e889f251b6e18dec814e351bf2e10a80f1";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/en-ZA/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/en-ZA/firefox-60.0.2.tar.bz2";
       locale = "en-ZA";
       arch = "linux-i686";
-      sha512 = "42280dcb3627c457097887b51a2530eaf32850c4b01e25c62fde1c89e3cc8392ad29ee72ed8cdec11d78f776e4d720235e4f33b21883cef0c4c99823f26c7c10";
+      sha512 = "574336acbba05e99120e7ad89bb3c756273a87dc713992ac25c2e2c82cb0e6c3fda0db5224f595ef1ad34e27e3777842bc92cb5c50a763585d75e8f03dfd9c28";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/eo/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/eo/firefox-60.0.2.tar.bz2";
       locale = "eo";
       arch = "linux-i686";
-      sha512 = "0ada2ad4b8ef63b0881d1249b29a39aca65bf2714614e5c074d80d8901124a54d63ec5af4301ffe1483f4e70c6cfcb62db398042b8d12005aca7d95079588065";
+      sha512 = "b47678bbefc275cb8e45f779691c2c0b3854bb585818f1c682011cc6519db65f130e5e525e6a03682dec25025fbd2b55d54981ea3bdacc877ecdd084aea4563e";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/es-AR/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/es-AR/firefox-60.0.2.tar.bz2";
       locale = "es-AR";
       arch = "linux-i686";
-      sha512 = "5c548ab1b0ddbf832d0ae42ff5bc6457ff7aee08b8ac3e94ef65a0e3ab326bfdf6f85be8745fca64e66efd2b45ee992499ccfff963ae21308519fca1bc72cfb5";
+      sha512 = "ec3fe28cd5ab8a3e89ef41dc69dcc43299205fcd7b40f00aaa8abe14f1640967ae17cf9ae1532aab98026b0dc95ba252091a605509a6d2c589fab89a0568c746";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/es-CL/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/es-CL/firefox-60.0.2.tar.bz2";
       locale = "es-CL";
       arch = "linux-i686";
-      sha512 = "509acc1e54e03aadf6c2b1b21d0366d52fa02a51f1983107ef88a7a175226021a574bbdeccc5715bd63ad596f934fa69e1c10bc0122359409632d06bde63f14a";
+      sha512 = "800bc8202782eece7dc580e25a8b4927c1d25afc229ab4dcadf17ef22a6f4a7364faae6b94e6f42c6c64c8e4ce6b7002d6d7fdcb24d26a66c7d01dfeb792b0af";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/es-ES/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/es-ES/firefox-60.0.2.tar.bz2";
       locale = "es-ES";
       arch = "linux-i686";
-      sha512 = "e23028c9a8234744001b267ba43899b2740b63e5655ff289d1e45b1132f3fa97e28d7d800bdeaf2d016ede782432db8f7cae1dd8598eaffba3899c9f7a99ff37";
+      sha512 = "8f12e56ee683e437929d0d8332addfc302351eb5af1aee86ee7c99552145f58f7a2657b1c5ba855150793099ee15aa1c2d64b3b9dc43dc94ed2ea63405da20df";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/es-MX/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/es-MX/firefox-60.0.2.tar.bz2";
       locale = "es-MX";
       arch = "linux-i686";
-      sha512 = "a5974914bf0e664ee4dfc0ca2697be5971563e24249adb6b7a7528be67329ec43005fa77acf9bd51970776e9da110019d8bc353a4d6cbce3a27c122399c88cb3";
+      sha512 = "ad8baab24975aad8179e2352fd41ba6833d66bd4898c3cda4399952275ab64ba55733997a1d4d3d27e409a41771da224661bd771f07b0f628f7779a437fddb0b";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/et/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/et/firefox-60.0.2.tar.bz2";
       locale = "et";
       arch = "linux-i686";
-      sha512 = "9701a3d97558c3a6946294aa3196d816ada9c721d72993a2b10be24640d48ec37c5675abe3a42df9ca986e8b92f3fffabe0649d3be335e2e557f39f63d454997";
+      sha512 = "ce6edb6e5995308f129683e66fe6ac8b13c8aa53de6b04e4890e462f046b1bc8c143553d6673464f8a06fddd4c8087ce150d2b3944b34042160ae1f88546130e";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/eu/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/eu/firefox-60.0.2.tar.bz2";
       locale = "eu";
       arch = "linux-i686";
-      sha512 = "119c5b59dd5520017334db3ff95511ca8ab2d674dfbc85f0cd6f77fac919bbc0e99af18c59f05fb6cdf75f6015cb83ac24d15d0cf4ae3a2b5ed7564c8bc7bf9d";
+      sha512 = "ab1909d7b4b98e45540c8020b098e83a368991fb29321fbb0529bdb2e7f5f3dd3f77f2959be0b337ea321a235cd5196f9b11eaf552f958bc11cb7ad5178f9c44";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/fa/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/fa/firefox-60.0.2.tar.bz2";
       locale = "fa";
       arch = "linux-i686";
-      sha512 = "c45fa6ace31733812411d597362bc56f4672fb7a8bd9b127eb288d7ddd2de3e129721c2ec44a08d8adbc8c15672328ef62384e0139a1e37c6a12ba9ae35ceb7f";
+      sha512 = "5f638eb2d1724d09a4aab1e2498dc4d9f0d4dcb5233a7b18f2d55b35a4177d6b24a8531d951384b220399fc4ff21a784dbb81f15e631d4842cf38a80038fe4bb";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/ff/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/ff/firefox-60.0.2.tar.bz2";
       locale = "ff";
       arch = "linux-i686";
-      sha512 = "cf96e6cdc941ec347036b5d737d0060a892220ebe6f72a71354a21099a7c82a0fd337bfeb6e6eba53d95af88754687888abc4dfa307348d5073315692a4f3496";
+      sha512 = "cdf22582e20445050c345d52c9f5775c0a24bad1d58695ba17393aff540a1228d62edc0bbe7dbca92b2e5e973369b660154ba87c56864df06f327e989af6838c";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/fi/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/fi/firefox-60.0.2.tar.bz2";
       locale = "fi";
       arch = "linux-i686";
-      sha512 = "0b4bc6fc0559c05b92e42bcd11513ae20d2101384189ffcff337cb017bfbc5a90151e5c4b8bfe29442ffddfb48eba552a06b3a1db24f7dbb78ff45bfc6a4b5f2";
+      sha512 = "81d32de0d3e685b0591609211a99d955d1621797126f67a8da0a97ea8592f10156bb734fb04b1f69e6463734cfa95a3203e8bfd9c872c769315069a37ae99fd5";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/fr/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/fr/firefox-60.0.2.tar.bz2";
       locale = "fr";
       arch = "linux-i686";
-      sha512 = "0ce803471b565c8ca715b1700a54be80894205434060751c31d8696d1716f3d3b8fc19c5a0baa82e78f7ffe0df462780e479597c975d2c476b10540de1e98656";
+      sha512 = "0fb48cb32013307a3c4b7d5b8c55ccfb7aac43461b59ac477972008548298d10e38716cc90ee8f7acd65f0b1e3338ebc4cabb5cd6deac7b10a48627fd3ea1040";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/fy-NL/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/fy-NL/firefox-60.0.2.tar.bz2";
       locale = "fy-NL";
       arch = "linux-i686";
-      sha512 = "3dae49cc320f46622ec92d7ad948455a1861f8986cfe9b98bc73035fa41ae44c9b150b9223c037c87c42c5d93c62bdff40784010d2e7f8ee6ee8fb7725c3ee55";
+      sha512 = "a21caa506e164a3f94938d619474357ec1de4ed7cdd8b4c67ee19393145d505edee38bf1bdbd16e051fe38b93ee0bbfedf6c7d05d98b8cc9b3b7672d9b158f5e";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/ga-IE/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/ga-IE/firefox-60.0.2.tar.bz2";
       locale = "ga-IE";
       arch = "linux-i686";
-      sha512 = "9bc562d1e432e6e45e56de1238b61f27303fe5b475f0ab0528e44f7c15424911b6b699b08e0386dec8cc7c15df9345b7690361b24b9d467841df63d5677392f6";
+      sha512 = "28691393cfd33fce28c50746b2c28b7774997fe081a99ccc72009145d0de8cf9d96ac51964ec0771cbe80084a28c793e8c0d82000b3d9d6cb49fddca68f669ee";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/gd/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/gd/firefox-60.0.2.tar.bz2";
       locale = "gd";
       arch = "linux-i686";
-      sha512 = "fd343b25a8f07fd3d5f276372bdeea05bd9692b761051c9fa968beafb6518619ccc40e2d69ef00737ed4da23f092363ba575099137aec85dfb7f6a813384ca7f";
+      sha512 = "2d9c360ef849818d9e7e971cd091fa02ba594b287a7d8ba15dc08868577bc64bcc8ce9d74be4e0f3a8114aef8e7beff4d4382ffb2df8958512f87dc5de9d1ebb";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/gl/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/gl/firefox-60.0.2.tar.bz2";
       locale = "gl";
       arch = "linux-i686";
-      sha512 = "2be7fd719d946a96325e684a14247ea344e9c5e096378f02629f87bcc1180d01010cf46f3baa4edc2cebeb4fb99aa5e1d79c24e7b2d1c4d5da1c747ae884be3c";
+      sha512 = "5de56badcbd8f57fe3ae322445bb48684b684d1d714aa5a6225ae512677f10ff91146d1b3a947f31c49247fa47563b14497cef956d4a0cc852f7753d7ea71a39";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/gn/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/gn/firefox-60.0.2.tar.bz2";
       locale = "gn";
       arch = "linux-i686";
-      sha512 = "d19176ca380d778ed407db04712d51098b57090487564ffefbe0d2e25c4a35596e3ba2b10b9d179e886f38a4d3a4fbdfa7454116a49ec82b6701678c3af7d8dd";
+      sha512 = "d7221acd23f9371c6e802af6f8ac4c90933b58a24183247274251aaed5bd6dfe393205c07618b59b765c2988762978522bb03178fc7868eaf9eb0cb34b6456fb";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/gu-IN/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/gu-IN/firefox-60.0.2.tar.bz2";
       locale = "gu-IN";
       arch = "linux-i686";
-      sha512 = "d219e58d9699ff8b3d87822421f032fbcb4f8c3dd7c13b928e7e8a1661d0672cc1582ea55fb348fb168641307d430d66aaa7912e32a9ac1c78091e3f46867723";
+      sha512 = "79c9501dc94fd32642862a5dff4c8bacbb450b29bc85ce6f072e65ec369ce43714aecb1f847b24335970fb0b9c9d27646b353c2bcdfe2a537df3b461c79c2d53";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/he/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/he/firefox-60.0.2.tar.bz2";
       locale = "he";
       arch = "linux-i686";
-      sha512 = "cf2e5f7f7da94e75f26be5fb6c9e90d089dbab94779fa026ab61f87bbbb0e6ae75e16160c65f19de809bf6527b9d8a92bb0cec97ad18657b07ebb107b88edd6c";
+      sha512 = "6dd09c5cd1767726cc4112e499163d868f472fd93902d3d0079ed5e82598c94242944bc9451f5c6c8bce0d5c338870300052e10595c7c1614c1f239ef9f8d419";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/hi-IN/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/hi-IN/firefox-60.0.2.tar.bz2";
       locale = "hi-IN";
       arch = "linux-i686";
-      sha512 = "08626ae0313f7227eb144bd264a6f9c7d2e041b88fce8f1ea182bfdf438496ecc1899d9caf76bf00b6ea25604fa6032807766a93de088764e17a2c8449bd548c";
+      sha512 = "0ca10d1d30ffeb595dc8182fe29b26c554b9daf8d24ee294fa9a08cd326c1dbdb3c90a12b10aefb973da9f44e9056ab49b25fec11eaa81ffb6639c71be50b16c";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/hr/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/hr/firefox-60.0.2.tar.bz2";
       locale = "hr";
       arch = "linux-i686";
-      sha512 = "1c9e3ae0e271ed1ed332fe1c6f820cd0ebf0cb01e86ec713b9523a7247efb8ddd4c6d5f0dd93d5522adab2e18e1bcf9ed44ed2a86be03643f1836e260b498524";
+      sha512 = "3ec45a85761e7c6b0805d0ea8769ab2a6793214a910cb808ee5ef0f7024ad7820607c0d2daa005628318abed609c445fc795b876a8d9bd2ea6cc15e386220805";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/hsb/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/hsb/firefox-60.0.2.tar.bz2";
       locale = "hsb";
       arch = "linux-i686";
-      sha512 = "669c3c36fc77359edabced7532e558d0f4e24fef66766b49ca71b4f32d19cc3a1856fc92b716de8507d742905fcb82d6d23f62d542f5adf151a95b99068c7195";
+      sha512 = "25594b1b0f7db9650f8f14174b686bf753a52f9a0f8065ed57d180bfc77d3bff3cc5d5d6ca80ed68544302e7ba57c46decdb375bca0231f7ada63796bb1c076b";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/hu/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/hu/firefox-60.0.2.tar.bz2";
       locale = "hu";
       arch = "linux-i686";
-      sha512 = "c84788b5f7c670e0a0afda91f47d91f51a40e4441522e049b850bed89908363c74dfea7c9023bf3d54068c1fcdb7752f327f57b6f8812e880363881434f893f7";
+      sha512 = "c1e28b2ffd1141cfe9f10dea4067afd7785f3b5ac2a0ce0f0cfc53aa6d202f829365c14815d97d65c77b4e22d0caa358c541f9ae8c36764087a3a7db22d03a4a";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/hy-AM/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/hy-AM/firefox-60.0.2.tar.bz2";
       locale = "hy-AM";
       arch = "linux-i686";
-      sha512 = "ca81e92cc2ddf30c55dbf7124c4f11f0c2dc00466d17e8f518d2969ae57e04e2a543118756bae3e55bc72e668bc9e78ea1e11d952fb233e43941560720cfa90c";
+      sha512 = "70bfe9318fc3bc993f8ec8949db3bc1b58a20c8f6850da35a2c99076b5770c4edf54f8e527337558dc8f01a3c9725c6c2706159f570a9968f26bf2eb9b5d8318";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/ia/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/ia/firefox-60.0.2.tar.bz2";
       locale = "ia";
       arch = "linux-i686";
-      sha512 = "8914b9e45e37602eec6aa20a77ed5c9cf618b0c5d789fbe1821d13ea909148606923d1acbb79006c3fc3e38a4657e926eab02d91a1f47717a9b6f527c935c629";
+      sha512 = "3e7b3920911f48fb0a81921a41dd7c62b0c65b94e5b21e4c5e6df96d0061d328649459183abd0d4c927764b86797ae64d65020d7f2db620007d7e16e235771bb";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/id/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/id/firefox-60.0.2.tar.bz2";
       locale = "id";
       arch = "linux-i686";
-      sha512 = "ccdc3eceb51e7ee33f3a49bbb752055bd000152dfe3af1bf9bd7d8a617e217c8615bea4c3ce1d8bb51ab60477956867f5ce93bad472da47fbf47404ab0db9524";
+      sha512 = "ccf32223bdf491481688a38e1532c42885525db9a727722f6a0a203dccfc3d3e77a010a1d5d34dbf30d2c30f74aef894268d4945b7a12293b79447b542477e16";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/is/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/is/firefox-60.0.2.tar.bz2";
       locale = "is";
       arch = "linux-i686";
-      sha512 = "802c8d9b77678bdf051633b19a452544028a4be76fde686240a78fad9d25dc7ed38de0c58b54fbe214bcdc46e0cd1b6f2cad5ec646a8fabe3e8c7072b84b627a";
+      sha512 = "15579492f3b431b6871cecef270888273b9bb54eb59975379fc2d9af1310b26dbf0fd198bd0a83e2e3df068a908828f0c9e35d27a53c3a91b946140d8b43b63a";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/it/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/it/firefox-60.0.2.tar.bz2";
       locale = "it";
       arch = "linux-i686";
-      sha512 = "44cc35fb9e6375739c5e88bc8e7489c15a80faa9d0327ffb2793916d2674cf71a4b237a41073f05477fcb142bdac8d4ada684ce2101027f551a7241eb46bb7b9";
+      sha512 = "a9cfd0c8d01a068a83ae1c5b8068aa88dfbeffe343cf6ffb80ac4a5ebd70304fb4123303f16f57dff3988abd558f182aa67185283c49e7e281d4da13862a4bd0";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/ja/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/ja/firefox-60.0.2.tar.bz2";
       locale = "ja";
       arch = "linux-i686";
-      sha512 = "8daac42dcb02ad640a56196ce500b9528c4fbc2a562549f08d76bfd990e51dc2c938a99becd26860c659e4bdaf90465d6c9c909f6cea95030c61839adc79a4a7";
+      sha512 = "6869eb392e8121c97142179073d2b119d8bfb3a596a143b0657ad8c4f93f766e08c1f4f248b5e501eb7ca071eb32ff49ac1450d7ac81e106c6529bf56d531e91";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/ka/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/ka/firefox-60.0.2.tar.bz2";
       locale = "ka";
       arch = "linux-i686";
-      sha512 = "2cd50870e0ebad8d385b5e1feffa546dbdee31c2916277c36afa9835d01f9e9dc1d7d4c0f386d4baca38eef11a6c0b1cf1657bc7588a1cd5512e894b12acb9d7";
+      sha512 = "f364df168243ddbb311b109ede41fb62b047d1048b16211155183fe0b3f1921d2b069e6194e0734fc0f24835831ecefd4986634d3c11e4da362ecab10f63114a";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/kab/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/kab/firefox-60.0.2.tar.bz2";
       locale = "kab";
       arch = "linux-i686";
-      sha512 = "8c292f95480d21ad521df9e4fbbd580306c2615705a37a75ceaffc8f6ca5a24648fa1e0bc97006c34a38b6e58a523a487953c414395c1bef8f58c11b68bdf5e5";
+      sha512 = "866ea971d180d0f2b9dca2bae7c8a83f9f1e455ab28f05b47d4586c3cc4d5476a8fd83409cdc3b609b2377b2d98d23ec1345dee4c560125c69338986a95897f0";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/kk/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/kk/firefox-60.0.2.tar.bz2";
       locale = "kk";
       arch = "linux-i686";
-      sha512 = "285e6bb268d6b9968d9a0d2cda10c82a790be9d0dde686ba3c0230d84029eae28943e1edf70188fb32c96a7712f13ed9087eac57d690bae222736593515e80e3";
+      sha512 = "9e846ef6bdfbdb4b28ca4cbf0134441642a18f017a8fc517c20079558c0d114bd91978e48d087c591e748ccfca8aafa7d0c4e636e668c94bdb30e88521800ae7";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/km/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/km/firefox-60.0.2.tar.bz2";
       locale = "km";
       arch = "linux-i686";
-      sha512 = "a939d51066e185a68170bd7c3d21523c4e3c5d69189822496ddbde0bda46ffba3728211efcebb89808ca6d70d76ba12547bfdea8c8fb3420000dbe39fecb8232";
+      sha512 = "ca93997adbce2a9668e4330a26769e01d683b6a41c43dd987d296d824785fb5346c16405506dd026ee00563029d9a48417aa160f9acb8c72e941c5aca33aa487";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/kn/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/kn/firefox-60.0.2.tar.bz2";
       locale = "kn";
       arch = "linux-i686";
-      sha512 = "2207b6883e5dc506d556f8f79bc773f304168029b3282835282296c8b2104ebee6a12e5b1f3887645d366339bc026e53021a004bbab893e3e0362ca28921c78d";
+      sha512 = "591edfcd032e824266fb0424be8a78bd28c70f54db3ba80e33dc1f457e478c42ac8c0f3567ce8a0555e26300e00a34bc74799151fa0b7db75ca1c663a9d42663";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/ko/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/ko/firefox-60.0.2.tar.bz2";
       locale = "ko";
       arch = "linux-i686";
-      sha512 = "02b13260a74edecb18543679e8d0f969d95b40f87dc237f39465399ddfb5cdd66293408ffda594a53a6514a83ee120c464f3827064b6a286187916109eb0cb03";
+      sha512 = "bfa982f8c26ce1e250d161a4b551af9a9caf24a9161369e98ee5008e00caa593b75375672b5e6a20c3e53dade495b19760464946307985548faa23849adc3231";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/lij/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/lij/firefox-60.0.2.tar.bz2";
       locale = "lij";
       arch = "linux-i686";
-      sha512 = "2386a05577d90599c48c04083ef1305d84b7a88b6cf22eb331fcda80ef5678755f7d60f418c053dda9aa992aab5ac6ada99bc5e76afca9cec1dd0d250313d277";
+      sha512 = "9bcd9838cb300fe9d9022506ba33a69fcbb56faab21aab9772b203d93cf5e675cdd243b3359971ee9bf4b005144af46429a87e14024486d34d4c40d93b9d1f90";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/lt/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/lt/firefox-60.0.2.tar.bz2";
       locale = "lt";
       arch = "linux-i686";
-      sha512 = "6eac885d100539167429293655033e86387d50fddc6d6702f5b9e8ee6f21758e3bf01e340c4dee702958851cdf89c3159ed940545b2d439f8d32a90bc3c272a4";
+      sha512 = "bb29197b64fb02099e78e3e1a4ebafbffb6c3f5e8993abbe955988388cfdd1a9b2aaf85380c01e27e73d4ac304ed983186b961c30dff3742562e0bf16b5d3782";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/lv/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/lv/firefox-60.0.2.tar.bz2";
       locale = "lv";
       arch = "linux-i686";
-      sha512 = "984840eff4cf03915d04ca12ed78ce06db9c765db069d2cb647d3b795f8fbe6927f6abfa5d8ccc1c2806f10ab45fa7d612a08f4a0aee1b129c9aa4ad31bf4613";
+      sha512 = "8abadf90fe91dc5b28a883b06f7baa672479a3068b0113c6852ca6bce73c7df93857d0499481717cf3ca67ce42c8386797c6f119da1e9f7922e1bd51010edd98";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/mai/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/mai/firefox-60.0.2.tar.bz2";
       locale = "mai";
       arch = "linux-i686";
-      sha512 = "b063a79532ec9345751d69a41a1e3542256c2b623532a524724eda4f04aba6f5174c568cb45f60e332b1224f3cc0f9a0e641e455e3668cbbb52048571715a559";
+      sha512 = "11221d95a3295d260d98308b7107fecb5cff9d2a183d47834eaaef54cd0798f792ffb266d3c5bd6b636a9d4010713239222053027edc3c667aa6a66c687d7b9f";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/mk/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/mk/firefox-60.0.2.tar.bz2";
       locale = "mk";
       arch = "linux-i686";
-      sha512 = "944882edf6c53dc02682733d50dd09c1df3b06c8bb32e05ee1307504936ced2d408623b7ec6588aac3a26e5c82861cf5bb4db44cd4462c9fd8d9fe62dec19743";
+      sha512 = "c22a6866443a6414690e822991551fd5b6324bb8f46e79f10dcca7ff782ac78e620c4010d0ce9f58d622b84ceffeba39304cdc6fbfadd4587602bd7ffff07cae";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/ml/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/ml/firefox-60.0.2.tar.bz2";
       locale = "ml";
       arch = "linux-i686";
-      sha512 = "b206d4ceffcf460c73b31326ce2a7cc5d8fefd851a3d824a0012793d0bb0cd773b6abfda81cfcb721f11b3f6b4f38de727a04ab2a32a56f3f7ab7abde6632d3a";
+      sha512 = "c8c1b1d59e086a72604a1c0e29e3e461400d30df32c1ea25a9ab93b4399ee81171c6d69909d81aaae7ecf035e97fed9c01f0f70076472b1a575d73bf0549c095";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/mr/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/mr/firefox-60.0.2.tar.bz2";
       locale = "mr";
       arch = "linux-i686";
-      sha512 = "965c85edf69d05c96f3f23b987376c3747dfe9694af92f925c405a42544ac8a2992782c7aea60bce3fab4072db153b37e0f2873a4f42e564e821731eefd05400";
+      sha512 = "c5c27cf8ca4d17787d8a04d3d8717be10f6e9dc34c3a21e8735964feca4a1691a0121969cb2cac390a26c7c0b2d2f92ee30178cb2ab8e78a680d0538ce2bfff7";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/ms/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/ms/firefox-60.0.2.tar.bz2";
       locale = "ms";
       arch = "linux-i686";
-      sha512 = "ae5938803a9acc6871577d6629579c0bd5ac4d7404e87cfe373876b94204d5af1110425400f9a7642b13bf2a68f32f2c485c8b9e3565f4d3c49ffd967a8e6df0";
+      sha512 = "32ab67c932acf0b590208073ff979cfe106bd145dfb8587bdd1a05346f72d3bb1145d89ec15c896c5b778af1de347408b78ca2db7aa97874f09e4d9df380cf77";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/my/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/my/firefox-60.0.2.tar.bz2";
       locale = "my";
       arch = "linux-i686";
-      sha512 = "4fb3ac47fcd3b7b36bb66fa24ac82bf9ade26fbadf8eea125b78fced6222ae0f2c3c45638b3511b630b50e27fce70739733fbb357744ba89febd16544703b356";
+      sha512 = "464b6c86338813edad14e475e98d4c949d4ace87466993095fde6555c17d518e3a29e933912ab46170336803d21739dd606d29e33ffd4935c8442f8e2ce805ca";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/nb-NO/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/nb-NO/firefox-60.0.2.tar.bz2";
       locale = "nb-NO";
       arch = "linux-i686";
-      sha512 = "c469e49346a29b8b2bb87b6d3be37f72be7db18977a9085240184a66cced8da5c8a62d09c84424985418e106d8cc1a2359ce8778e515430188ff6921d403b42f";
+      sha512 = "67161cfeb83ecad1711c3debff0bda66a6dff009b41f3f54553db7fe1b7300f938db6943bab64a8cca1da43f1802da6744969fc2f69132039e76bfedc8121850";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/ne-NP/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/ne-NP/firefox-60.0.2.tar.bz2";
       locale = "ne-NP";
       arch = "linux-i686";
-      sha512 = "5374a889f9ae7934c4138b4742dfe50c360858e460b7e348be5ba7196f001453466c84b8bb55e8c1178a194e9500831684f50866c13ccfdd6228a8fb4d17e607";
+      sha512 = "402aadebb20816fc03418a2be1c48b2e4deac3405b0ad12e9c59ddeeaf9c2fc7140d904bd88670ffc7fbf736ed00b762f963a5c640f42fe1fb7333c51928dcea";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/nl/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/nl/firefox-60.0.2.tar.bz2";
       locale = "nl";
       arch = "linux-i686";
-      sha512 = "f937a25191c60c973b0676cc9ad993c07c221dbdc3c3f794c8cfbb2981ebe4d85b0450702b5c7270f47f6daa7b55bb4fb617e113686bc7b496811f5304ae8053";
+      sha512 = "54bb6529777cfc9767120ccbf1ce9664184a86b4701fb101a8e3de6fa3dba3bd8b72459f703ae40fd4d4bd10e031d98d1e15f9e35c05bf60af4434b41e9545d8";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/nn-NO/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/nn-NO/firefox-60.0.2.tar.bz2";
       locale = "nn-NO";
       arch = "linux-i686";
-      sha512 = "d95de4ef017c0fb951fcf8c90488acc63f5fa82ec7c72bc87f02aa4f2f4f75c2f4cf1a805958fadacd65759e68fef1be21181ad8511c6d1158bbf331c72b97d2";
+      sha512 = "a5dd42fade8f41331c3ad9c2bcc32285da8395f0d3e86f503fcb260b37d1e626971aa34652e0b560b80efbaef18c40a735ba4bdecf1d5ad949c9d18661023daf";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/oc/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/oc/firefox-60.0.2.tar.bz2";
       locale = "oc";
       arch = "linux-i686";
-      sha512 = "d4757d7a79b953a9aa92363c7fc40a7545fd7dcfa5ed03ee45af2b48b71b74a0fcbb841fd580244e6ddcc392c6fd105fbaaa03e42256522e2b51e6b18f433fb3";
+      sha512 = "46ab7215df1645d03a690011762be1a476b04a1f4f5d3e547f2f4d48c6f64ba38444b83be943b8f8fef62f84dbcd98115c36980150cbf83d86225226040cb5b7";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/or/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/or/firefox-60.0.2.tar.bz2";
       locale = "or";
       arch = "linux-i686";
-      sha512 = "e5d6ec46f23bb31fd32ec5bf58049d7d948fb7632a198fdac34c004c23b58d2bb08c163e4b53e789529d1f6232fd050142a0c84d7d43d1d334ad3b66857a747e";
+      sha512 = "91ca8c4b451a2d6bd75dfc5b530e7ccb790bc91c3d04f0da6993fa16ff5c8a5f8b8a74f7876b08131df44221f024aa08d58b4579f67e8d12e0d5be20883fbc06";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/pa-IN/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/pa-IN/firefox-60.0.2.tar.bz2";
       locale = "pa-IN";
       arch = "linux-i686";
-      sha512 = "bc2d7ef61b866fae30e6b2fe6c542e206e879d4d0edeff4764a635c9927430cd763e6e907d8676914a5dc95d7a670958f332a62d09517446cfa1a32ebbc858df";
+      sha512 = "f85da93963692bff4f17edd06246bd3ede76c7f66086966e90765b349e98f82ed1f658cad95ce1248fa9bc729b9b8b7df86bdc048ef0eee3fd273681b6f40e62";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/pl/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/pl/firefox-60.0.2.tar.bz2";
       locale = "pl";
       arch = "linux-i686";
-      sha512 = "c8ee365012576e66468c848d232af3d28796fc7bb8a2971e953ae0f4783b3eee06bd4c1da5725732ee5bd964c2447d1d3cd11041f5d56d88877fc36a6a568dab";
+      sha512 = "00515cef6d86aea1c4c4c431928b0eaace34896c737f9e806a0f6afd6d5dc710fe021da689ed9db6032aea67d6a7221dc4d7e77050cf8a43981b685fbefe36f4";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/pt-BR/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/pt-BR/firefox-60.0.2.tar.bz2";
       locale = "pt-BR";
       arch = "linux-i686";
-      sha512 = "e708e25ba08c0ba92981c0abd27b170086fd7e54be5604ba5b6c4be47012d4cc467f5ee81e5a50ee1ccf413d5e4e3fa29fafca0ce84d4b35001e59e46afa796b";
+      sha512 = "21c7a2dab5140350d1bbc152283570f8e00f917c282ee90a9ada6b9f5f8019ef7771b32b147d96aed297b621279b2cff3cb521fc53dce28797defe8f1ef3fe1b";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/pt-PT/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/pt-PT/firefox-60.0.2.tar.bz2";
       locale = "pt-PT";
       arch = "linux-i686";
-      sha512 = "5a227d1954a93f35d83b7f89b48d6fef10f1ce09c239eb84a3fbf76b2c93f03ecb0890a9c18bc2d2edb01fece405aeafe16ced0420ef8b8ff90efb232d13569b";
+      sha512 = "db33d53d2917b7a04756cdf70770dfcaa6b8b6e9f427e8a68e977871c7b1735a837668310eac9ad1d7e9c4f53e906a4d4b36b3d87368ebc793e092295cb11721";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/rm/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/rm/firefox-60.0.2.tar.bz2";
       locale = "rm";
       arch = "linux-i686";
-      sha512 = "9f2caae925cebb42c49c4c2b139dcfd961174aa8a4dd4d323b65d84b6acbef5beb1e5c844f09454d6fa3af882758137d452ba1cbad5cf017a8b54766f4967ba1";
+      sha512 = "a22582c2eb28b85c3607bd71c69611d710679fce2889b98c5a56b1bf3f086edd9d7f063b87cc1b7cd4467331e2e8ba38bf003af80d98fc0a2fc828c3b253d01e";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/ro/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/ro/firefox-60.0.2.tar.bz2";
       locale = "ro";
       arch = "linux-i686";
-      sha512 = "a24ffa5fb4f05bb700025df13384ca5f57183eb94d9826fa82560dc45d50a05c3f96c7c58fb1f609e1efdf3b9d3b86bd720a044d5c5c0ae8886e1d4218189635";
+      sha512 = "116e904c566c0b744876262545c9ef300bf48a70ec39378aeb961229aa13e37a1c78d68b39bf3c138090101e75ad793c83f428a14dab0f3c186718d3f5f2a883";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/ru/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/ru/firefox-60.0.2.tar.bz2";
       locale = "ru";
       arch = "linux-i686";
-      sha512 = "e256695c13cdce7fbd0650561c2e68ca7b3c6eafef5c451b54db67ebd6dc0c14f1c84622cc2550a573932b4ef1ffe20d1608a2d36d3fe0033ec18399ca80448d";
+      sha512 = "54c9561ef96fb69d8dd7b067e51fafab2d15e186c71192689f161b7370e2816cc42894fdf4f16829725cbe79e3456c3159f0c8cd9524c6c3c1c3d0f98dae9191";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/si/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/si/firefox-60.0.2.tar.bz2";
       locale = "si";
       arch = "linux-i686";
-      sha512 = "b42ffbb1c3948555320d89e7732c145061b91453ed6f70a7d334754264ede63759201ff36bf94b1e33814c0d171541e450f8eb53ef95e8c5320d0e408475ba5c";
+      sha512 = "ffdc8cd3e78b002ebfea0d77508a785a183a2aee8dc82390d68b12e4d43bba8104b9b31d355758c8d729da4b5b9ff095995da11409fae799b4648e85e1cc2fb7";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/sk/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/sk/firefox-60.0.2.tar.bz2";
       locale = "sk";
       arch = "linux-i686";
-      sha512 = "d224b3ae2edeea852e2d26314b3f8d22d7c048eebd540107281b2863c23dd7c7caeab9ec814c90434da515e912acfea35d5331beede5b9e6bc74ec77ca8e8781";
+      sha512 = "e4701fde9df51ae565a9a2383a8e16f723aa804f1f2b0195f055556f733004b1e86978c43398e2673658306dc3fe60c03e360f62a7da5a368f15f5d587724308";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/sl/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/sl/firefox-60.0.2.tar.bz2";
       locale = "sl";
       arch = "linux-i686";
-      sha512 = "c3c1ae0ce8858d1dfeba2e56d9b92769ab06585c86519f754f3ac97a527816bbf7c56df6e8055c04e7b06370c1b9c397ca522991c5f23371ef4e76fb3811cd23";
+      sha512 = "e41b1d96ae7587f5290337b4334367473cb43ff6aa5930e64cb1d10214c53e75dc3cd108a82125b2faa0f6de4df2e694ba53c94738cebfdc88cf75081ca9b24c";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/son/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/son/firefox-60.0.2.tar.bz2";
       locale = "son";
       arch = "linux-i686";
-      sha512 = "7622a3c211e34c48185e5756168378d60bbfb52784cb9b4e1b37d9e985d92d3d88ba6b29b750578136db9beb5f2123cb1b7c9f47d4b8139b0441b92884620c4a";
+      sha512 = "68bb8f49c522dded8735a6f8441a872f12463250e5c0e4630168717dce47fee9e4700afc5e8a31cb2f03173eb0298162edf6feb6cd2be77a2b4de4f2d796bd52";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/sq/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/sq/firefox-60.0.2.tar.bz2";
       locale = "sq";
       arch = "linux-i686";
-      sha512 = "8f4f30bd858bba7c2e90655821395522f6a96e38ff169334b034f182162294af8ca2d00da375e03c3e18e1c96c113333ec4f7d41ac01d385a12a7acb3e188653";
+      sha512 = "ddf584e9ecda9fe2ef5628c659dfc7033422fbce93c89efdca5628eadd45ebf505cbdb3e75bb915624347bc29dfa0a463d1a219ecdb7d4e6fe2c77c2d6d8138c";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/sr/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/sr/firefox-60.0.2.tar.bz2";
       locale = "sr";
       arch = "linux-i686";
-      sha512 = "00b4b3ef5d8217d7acfb2504c86338ca729f9ca3b69f2a0616def97ca88bcf61f2669f1a4e4acf4ccf5473db08de53c4308a342cc3ce944634743fdc1b8e5a11";
+      sha512 = "e5c99851e05b27217afc50a5bdbaac42f873292b9b1a84e3e8513d680f00154b701a70e0478884158b04786829c7f818bc35e4016dc5125875f0a1abdb46322a";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/sv-SE/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/sv-SE/firefox-60.0.2.tar.bz2";
       locale = "sv-SE";
       arch = "linux-i686";
-      sha512 = "287ae1efdc8ec6a34165bd4588b51c0f81203685d47ed59c01922e87d7d9aae9ab23b1351a7297a493d45645635c2da7458b245ef56991e7ec928fe264576e57";
+      sha512 = "464ace4c70f5e49afce830e045cb178f0aaec18dd89b77a67c68afcd7f45cd28c7b957a11cda861b322839c2ff89186ff1c1a72318c26c3f37ac24245ec6fe40";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/ta/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/ta/firefox-60.0.2.tar.bz2";
       locale = "ta";
       arch = "linux-i686";
-      sha512 = "fde55160176bf7f5c016d7d780e8a78e556ba6d04e1703e6fd6e90ffa278b23822855e8e26a7b86ff38cf006dad3042ea9cd7d4f75b810efa5f543ac28126f6a";
+      sha512 = "a7d7fa0c8209843ebb828885cef9307a1789ceb4db0658cfd4cb6e56d076a35d49616780961930b6b1db3673bf2911fec895f51dff273174ae639cf4d1fe66e5";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/te/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/te/firefox-60.0.2.tar.bz2";
       locale = "te";
       arch = "linux-i686";
-      sha512 = "5cd75ab1ed134ceae22c0020d753cae351caabf513a025dfe30ab3b146f5c693cdf202f5cb4f48a00fafdfe6584ff693d383a5a3f973e307e9ef056e61bcc43e";
+      sha512 = "db0c7ff33692523ddd9b220d0de9f99e8482bf4461f6b4b49fe541b7678655dea28d578ad1099b748751203bf5acdc9437c84094338fc8cdc1a5fdb97a629918";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/th/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/th/firefox-60.0.2.tar.bz2";
       locale = "th";
       arch = "linux-i686";
-      sha512 = "037b7e200bb6246e3d95983f5cd9451a10c54be0fcbbf30ec35ddc115395cf8fda3274a212285bbb1dcadd69f3efaab60606345765ed3f69471c5ea2d47c467e";
+      sha512 = "56261fea968b32fb84a1ffeffb25e6cece838087ec0f9a3764b87a2d307ab8fb23f269faff67a4586c85182ba171c1810d8a070d6ee74d348d855cca8845ac0d";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/tr/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/tr/firefox-60.0.2.tar.bz2";
       locale = "tr";
       arch = "linux-i686";
-      sha512 = "d2cd7b818c64a6529387d5bf540174aee44b5e863479978b15aac20fe62d102f231d2f1367454c5ddf9f3009776e6176fca8d96eeb221730a477c4fced4b45d7";
+      sha512 = "eacc87cadf7f6b75caa70740e90be2ba31cfd52c2e328bc4e9e7a5b8cf489a441573ba8294519fa81443418d2fa6150e7912c1115c26748654f58a0a368fa2c7";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/uk/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/uk/firefox-60.0.2.tar.bz2";
       locale = "uk";
       arch = "linux-i686";
-      sha512 = "4f8ed8dbd4f7bc8184ee4c128382a5ccc5dd6b93840199657a6a2ce5e6ffa5b192d7e17d50ea4a4631f2ef0a5fa225506de953a03e92b4f51e731c436d4d2b11";
+      sha512 = "be21d5d297ca1f1dc8e26ad01c92671a3b9c059448288b887eff025f2d3f2bf8d286bd9414d23abe3ca77809d001aeb2a415432807b1f2d47315335d23e31239";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/ur/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/ur/firefox-60.0.2.tar.bz2";
       locale = "ur";
       arch = "linux-i686";
-      sha512 = "4c8db3bf7affc403705bcb5c4da7685a43cc6119e02f3efe8fa499bc22da18a6f43f7d720fe07c32d226d97e6f92ea1611f153d85f7ebd25c038e938acaa3da8";
+      sha512 = "5511ef18b96bbbff93bf18c9cbeb2bcc502a2f07e35a32927827d4fced3695672975b4f776f76e5c5c1a4aa657c6732bc25bb720e3dede1268a91c8a733297cd";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/uz/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/uz/firefox-60.0.2.tar.bz2";
       locale = "uz";
       arch = "linux-i686";
-      sha512 = "933c279629ce254da1f7886825a934413a129e2371eb72a8999dc846e0cee12648e68ea9f3b01264aea4c1b5fb2f9081e039b02bc7f5c808307135e8675e05f7";
+      sha512 = "88292030b13663e8cdd34d4164de670842468e697de38ca7183405f762c1d042353aaf3b0c2a7e05c2fb00694ddae426131c7d997659cacddb9a488f828eebec";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/vi/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/vi/firefox-60.0.2.tar.bz2";
       locale = "vi";
       arch = "linux-i686";
-      sha512 = "c2bd138c1edd4425ee7f9cf341cb01d2ef04c1924185c8632a7b2e8ce3c87b4847611827dedfd826ad12028d486a27536c2053b9a677edcf74232183f36a49d7";
+      sha512 = "ec40fe4059a9a6b68a62d805cf991cbe68bc4a11bc8a391828fad86ba99f6b0ae49ae4d570dc60101ee269be47c9a31b25c525f3b865582b9b8e368bcb9408d8";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/xh/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/xh/firefox-60.0.2.tar.bz2";
       locale = "xh";
       arch = "linux-i686";
-      sha512 = "2ee93f40b882c52b80297075864a079b9a91ad30f9fbb64d64d4eeddf9cee31b717d4fbf59d25c8fd40944a2df2f0b67e95d1a57cb1031277429a7fe97be0d05";
+      sha512 = "22b5e517485f0f84f8d4bda8157d55f52e18a5e59a0f054b061eb3a9cd61389dccc9d90c65f973bd451c82a9119ff4c0337f38f69db4889e88707f3c9c7216cc";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/zh-CN/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/zh-CN/firefox-60.0.2.tar.bz2";
       locale = "zh-CN";
       arch = "linux-i686";
-      sha512 = "1ab340e9827d84d757f7b88c165ff07ab2d6202cdf939b6a50d40e23d09c002a49daaf9d4e7b90fdf20cfe36160e2d6518fcedf455de5a9f49c05badd6f0cb69";
+      sha512 = "6bf2308be0c3c701cbaa19f31ad2ba2c574e3c27eddd5cfee1cf42db267db21d0b1ffcd9d87ac7d430a800581d60c09d98b121359c01b4a31b1354d348ad8905";
     }
-    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.1/linux-i686/zh-TW/firefox-60.0.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/firefox/releases/60.0.2/linux-i686/zh-TW/firefox-60.0.2.tar.bz2";
       locale = "zh-TW";
       arch = "linux-i686";
-      sha512 = "3886ef200481d8f0dcb4add628144dfda705edeea37f1560fdeee7a45e797b75b885a2e590193d59f84d13b2c848c42d0e0f94986d3f4c514a9410e6924a71f4";
+      sha512 = "9e7eca205c77c73dea4ff79cdff1f7ce8a83f87453fd1b421dc8bb684693569c602a74995cf2fd2c6a98f5f920642b395312b5c3a1eba49b9b5aa170c21c9f2e";
     }
     ];
 }

From 4c3352896edb398ab29ce583a270ef3a8f2b905e Mon Sep 17 00:00:00 2001
From: volth <volth@volth.com>
Date: Mon, 11 Jun 2018 10:35:02 +0000
Subject: [PATCH 092/161] nixos/initrd-network: support hetzner

---
 nixos/modules/system/boot/initrd-network.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/system/boot/initrd-network.nix b/nixos/modules/system/boot/initrd-network.nix
index 33862b0965c..384ae909b70 100644
--- a/nixos/modules/system/boot/initrd-network.nix
+++ b/nixos/modules/system/boot/initrd-network.nix
@@ -12,6 +12,7 @@ let
       if [ "$1" = bound ]; then
         ip address add "$ip/$mask" dev "$interface"
         if [ -n "$router" ]; then
+          ip route add "$router" dev "$interface" # just in case if "$router" is not within "$ip/$mask" (e.g. Hetzner Cloud)
           ip route add default via "$router" dev "$interface"
         fi
         if [ -n "$dns" ]; then

From f115afa5d5e34e0edeeb8c4399e77a4d8c47f086 Mon Sep 17 00:00:00 2001
From: Michael Bishop <cleverca22@gmail.com>
Date: Mon, 11 Jun 2018 07:40:26 -0300
Subject: [PATCH 093/161] ntp: fix a missed syscall in seccomp

ntpd uses openat to adjust the drift file, which it only does after a few hours of uptime
---
 pkgs/tools/networking/ntp/seccomp.patch | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/tools/networking/ntp/seccomp.patch b/pkgs/tools/networking/ntp/seccomp.patch
index 28de2f01d07..872bf8e7fcc 100644
--- a/pkgs/tools/networking/ntp/seccomp.patch
+++ b/pkgs/tools/networking/ntp/seccomp.patch
@@ -34,11 +34,12 @@ diff -urN ntp-4.2.8p10.orig/ntpd/ntpd.c ntp-4.2.8p10/ntpd/ntpd.c
  	SCMP_SYS(madvise),
  	SCMP_SYS(mmap),
  	SCMP_SYS(mmap2),
-@@ -1211,6 +1216,7 @@
+@@ -1211,6 +1216,8 @@
  	SCMP_SYS(select),
  	SCMP_SYS(setitimer),
  	SCMP_SYS(setsid),
 +        SCMP_SYS(setsockopt),
++        SCMP_SYS(openat),
  	SCMP_SYS(sigprocmask),
  	SCMP_SYS(sigreturn),
  	SCMP_SYS(socketcall),

From 0cc063ebaea2a75c4fe7fe7c4e02b56609c14aad Mon Sep 17 00:00:00 2001
From: Kamil Chmielewski <kamil.chm@gmail.com>
Date: Mon, 11 Jun 2018 15:09:29 +0200
Subject: [PATCH 094/161] ponyc: 0.22.6 -> 0.23.0 (#41833)

https://github.com/ponylang/ponyc/issues/2764
---
 pkgs/development/compilers/ponyc/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/ponyc/default.nix b/pkgs/development/compilers/ponyc/default.nix
index 061b9b8639d..cc993af8208 100644
--- a/pkgs/development/compilers/ponyc/default.nix
+++ b/pkgs/development/compilers/ponyc/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation ( rec {
   name = "ponyc-${version}";
-  version = "0.22.6";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "ponylang";
     repo = "ponyc";
     rev = version;
-    sha256 = "05y0qcfdyzv6cgizhbg6yl7rrlbfbkcr0jmxjlzhvhz7dypk20cl";
+    sha256 = "1m0zvl30926652akyzpvy5m7jn35697d5mkg3xbn3yqwbsfk4yhk";
   };
 
   buildInputs = [ llvm makeWrapper which ];

From 9f7cb7da185aed80a3afa825d9f2db51c0843ab1 Mon Sep 17 00:00:00 2001
From: Andrea Bedini <andrea@kzn.io>
Date: Thu, 7 Jun 2018 21:52:24 +0800
Subject: [PATCH 095/161] andreabedini: adding myself as a maintainer

---
 maintainers/maintainer-list.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index e11e7edcc69..9b6c415eb78 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -393,6 +393,11 @@
     github = "andir";
     name = "Andreas Rammhold";
   };
+  andreabedini = {
+    email = "andrea@kzn.io";
+    github = "andreabedini";
+    name = "Andrea Bedini";
+  };
   andres = {
     email = "ksnixos@andres-loeh.de";
     github = "kosmikus";

From b7a6dbec9c885d9da5a9592118e6a299b7a92cc5 Mon Sep 17 00:00:00 2001
From: Andrea Bedini <andrea@kzn.io>
Date: Thu, 7 Jun 2018 22:05:22 +0800
Subject: [PATCH 096/161] pythonPackage.aws-sam-translator: init -> 1.5.4

---
 .../aws-sam-translator/default.nix            | 38 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 40 insertions(+)
 create mode 100644 pkgs/development/python-modules/aws-sam-translator/default.nix

diff --git a/pkgs/development/python-modules/aws-sam-translator/default.nix b/pkgs/development/python-modules/aws-sam-translator/default.nix
new file mode 100644
index 00000000000..514ccc7f619
--- /dev/null
+++ b/pkgs/development/python-modules/aws-sam-translator/default.nix
@@ -0,0 +1,38 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, isPy3k
+, boto3
+, enum34
+, jsonschema
+, six
+}:
+
+buildPythonPackage rec {
+  pname = "aws-sam-translator";
+  version = "1.5.4";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "9d8a25e058c78d2cef5c07aec7f98cbc2070dbfc2eb6a2e102a16beafd14e3ca";
+  };
+
+  # Tests are not included in the PyPI package
+  doCheck = false;
+
+  disabled = isPy3k;
+
+  propagatedBuildInputs = [
+    boto3
+    enum34
+    jsonschema
+    six
+  ];
+
+  meta = {
+    homepage = https://github.com/awslabs/serverless-application-model;
+    description = "Python library to transform SAM templates into AWS CloudFormation templates";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.andreabedini ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 031746346b9..c2802874370 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -197,6 +197,8 @@ in {
 
   automat = callPackage ../development/python-modules/automat { };
 
+  aws-sam-translator = callPackage ../development/python-modules/aws-sam-translator { };
+
   aws-xray-sdk = callPackage ../development/python-modules/aws-xray-sdk { };
 
   # packages defined elsewhere

From 340bc74a2b54e181eb04a77357e93c31d680fcb7 Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Mon, 11 Jun 2018 10:28:13 -0400
Subject: [PATCH 097/161] ghcjs: remove old-time

This attribute is no longer available
---
 pkgs/development/haskell-modules/configuration-ghcjs.nix | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/pkgs/development/haskell-modules/configuration-ghcjs.nix b/pkgs/development/haskell-modules/configuration-ghcjs.nix
index 8462ab254c2..0482d03ba8f 100644
--- a/pkgs/development/haskell-modules/configuration-ghcjs.nix
+++ b/pkgs/development/haskell-modules/configuration-ghcjs.nix
@@ -23,13 +23,6 @@ self: super:
       };
   in stage1 // stage2 // {
 
-  old-time = overrideCabal stage2.old-time (drv: {
-    postPatch = ''
-      ${pkgs.autoconf}/bin/autoreconf --install --force --verbose
-    '';
-    buildTools = pkgs.lib.optional pkgs.stdenv.isDarwin pkgs.darwin.libiconv;
-  });
-
   network = addBuildTools super.network (pkgs.lib.optional pkgs.stdenv.isDarwin pkgs.darwin.libiconv);
   zlib = addBuildTools super.zlib (pkgs.lib.optional pkgs.stdenv.isDarwin pkgs.darwin.libiconv);
   unix-compat = addBuildTools super.unix-compat (pkgs.lib.optional pkgs.stdenv.isDarwin pkgs.darwin.libiconv);

From e3875883ccd35ce72e7a9c1d976d3756f5934e2c Mon Sep 17 00:00:00 2001
From: Tuomas Tynkkynen <tuomas@tuxera.com>
Date: Mon, 11 Jun 2018 17:35:17 +0300
Subject: [PATCH 098/161] libbass: Fix src hash

---
 pkgs/development/libraries/audio/libbass/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/audio/libbass/default.nix b/pkgs/development/libraries/audio/libbass/default.nix
index 4c2918c922d..703679ba3a5 100644
--- a/pkgs/development/libraries/audio/libbass/default.nix
+++ b/pkgs/development/libraries/audio/libbass/default.nix
@@ -11,7 +11,7 @@ let
         x86_64-linux = "x64/libbass.so";
       };
       urlpath = "bass${version}-linux.zip";
-      sha256 = "1a2z9isabkymz7qmkgklbjpj2wxkvv1cngfp9aj0c9178v97pjd7";
+      sha256 = "0alxx7knkvzwwifqrmzavafwq53flja7s1ckaabk6p2ir2f0j5cp";
     };
 
     bass_fx = {

From de117c1ef99f7c21a67b16148076bbe6219f5a81 Mon Sep 17 00:00:00 2001
From: SLNOS <anonymous@wired>
Date: Fri, 15 Jun 2018 00:00:00 +0000
Subject: [PATCH 099/161] tor-browser: 52.8.0esr-7.5-1 -> 52.8.1esr-7.5-1

---
 .../applications/networking/browsers/firefox/packages.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/applications/networking/browsers/firefox/packages.nix b/pkgs/applications/networking/browsers/firefox/packages.nix
index 9cdbcb8b4ce..3421174c387 100644
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@@ -156,16 +156,16 @@ in rec {
 
   tor-browser-7-5 = common (rec {
     pname = "tor-browser";
-    version = "7.5.4";
+    version = "7.5.5";
     isTorBrowserLike = true;
 
     # FIXME: fetchFromGitHub is not ideal, unpacked source is >900Mb
     src = fetchFromGitHub {
       owner = "SLNOS";
       repo  = "tor-browser";
-      # branch "tor-browser-52.8.0esr-7.5-1-slnos"
-      rev   = "dbaabe129d2982bee00a753146fbe610fec0ca50";
-      sha256 = "0j60vz18bwabqbzv0r1id3vcyh3832mzx6cg5r7x5c03s5hn40a4";
+      # branch "tor-browser-52.8.1esr-7.5-1-slnos"
+      rev   = "08e246847f0ccbee42f61d9449344d461c886cf1";
+      sha256 = "023k7427g2hqkpdsw1h384djlyy6jyidpssrrwzbs3qv4s13slah";
     };
 
     patches = nixpkgsPatches;

From bb3984f7099602a8b25ccf08f7dd977d99e35822 Mon Sep 17 00:00:00 2001
From: SLNOS <anonymous@wired>
Date: Fri, 15 Jun 2018 00:00:00 +0000
Subject: [PATCH 100/161] tor-browser: drop 7.0.x expression

---
 .../networking/browsers/firefox/packages.nix    | 17 -----------------
 1 file changed, 17 deletions(-)

diff --git a/pkgs/applications/networking/browsers/firefox/packages.nix b/pkgs/applications/networking/browsers/firefox/packages.nix
index 3421174c387..f2cb0864efd 100644
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@@ -137,23 +137,6 @@ rec {
 
 in rec {
 
-  tor-browser-7-0 = common (rec {
-    pname = "tor-browser";
-    version = "7.0.1";
-    isTorBrowserLike = true;
-
-    # FIXME: fetchFromGitHub is not ideal, unpacked source is >900Mb
-    src = fetchFromGitHub {
-      owner = "SLNOS";
-      repo  = "tor-browser";
-      # branch "tor-browser-52.5.0esr-7.0-1-slnos";
-      rev   = "830ff8d622ef20345d83f386174f790b0fc2440d";
-      sha256 = "169mjkr0bp80yv9nzza7kay7y2k03lpnx71h4ybcv9ygxgzdgax5";
-    };
-
-    patches = nixpkgsPatches;
-  } // commonAttrs) {};
-
   tor-browser-7-5 = common (rec {
     pname = "tor-browser";
     version = "7.5.5";

From cb7f7fd094ec6a4c335086b1b438845ee83c2034 Mon Sep 17 00:00:00 2001
From: Florian Klink <flokli@flokli.de>
Date: Mon, 11 Jun 2018 17:07:45 +0200
Subject: [PATCH 101/161] pythonPackages.GitPython: set path to git executable

---
 pkgs/development/python-modules/GitPython/default.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/GitPython/default.nix b/pkgs/development/python-modules/GitPython/default.nix
index c2f3706923a..89b941c34fc 100644
--- a/pkgs/development/python-modules/GitPython/default.nix
+++ b/pkgs/development/python-modules/GitPython/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi, gitdb2, mock, nose, ddt }:
+{ lib, buildPythonPackage, fetchPypi, git, gitdb2, mock, nose, ddt }:
 
 buildPythonPackage rec {
   version = "2.1.9";
@@ -12,6 +12,10 @@ buildPythonPackage rec {
   checkInputs = [ mock nose ddt ];
   propagatedBuildInputs = [ gitdb2 ];
 
+  postPatch = ''
+    sed -i "s|^refresh()$|refresh(path='${git}/bin/git')|" git/__init__.py
+  '';
+
   # Tests require a git repo
   doCheck = false;
 

From 55282f339b946fe7bf652dbe70120cd6ed46fe7e Mon Sep 17 00:00:00 2001
From: Matthew Justin Bauer <mjbauer95@gmail.com>
Date: Mon, 11 Jun 2018 11:19:31 -0400
Subject: [PATCH 102/161] unix-tools: add glibc

---
 pkgs/top-level/unix-tools.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/top-level/unix-tools.nix b/pkgs/top-level/unix-tools.nix
index 64979ba3234..1bcf93754cd 100644
--- a/pkgs/top-level/unix-tools.nix
+++ b/pkgs/top-level/unix-tools.nix
@@ -83,6 +83,9 @@ let
       linux = pkgs.nettools;
       darwin = pkgs.darwin.network_cmds;
     };
+    locale = {
+      linux = pkgs.glibc;
+    };
     logger = {
       linux = pkgs.utillinux;
     };

From 2b1daeb28534ab80ec7095a4ec139fff97643e0b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?=
 <robert.schuetz@stud.uni-heidelberg.de>
Date: Mon, 11 Jun 2018 17:22:24 +0200
Subject: [PATCH 103/161] borgbackup: 1.1.5 -> 1.1.6

---
 pkgs/tools/backup/borg/default.nix | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/pkgs/tools/backup/borg/default.nix b/pkgs/tools/backup/borg/default.nix
index 6de4d3d859e..0d11ba394e6 100644
--- a/pkgs/tools/backup/borg/default.nix
+++ b/pkgs/tools/backup/borg/default.nix
@@ -2,18 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "borgbackup";
-  version = "1.1.5";
+  version = "1.1.6";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "4356e6c712871f389e3cb1d6382e341ea635f9e5c65de1cd8fcd103d0fb66d3d";
+    sha256 = "a1d2e474c85d3ad3d59b3f8209b5549653c88912082ea0159d27a2e80c910930";
   };
 
-  postPatch = ''
-    # loosen constraint on msgpack version, only 0.5.0 had problems
-    sed -i "s/'msgpack-python.*'/'msgpack-python'/g" setup.py
-  '';
-
   nativeBuildInputs = with python3Packages; [
     # For building documentation:
     sphinx guzzle_sphinx_theme

From 5f165fd2fc84f17ad9a5e1ef1b55fd824d87cc11 Mon Sep 17 00:00:00 2001
From: Will Dietz <w@wdtz.org>
Date: Tue, 5 Jun 2018 20:09:36 -0500
Subject: [PATCH 104/161] mendeley: 1.18 -> 1.19.1

1.19 had show-stopper bugs,
but 1.19.1 seems to work well :).
---
 pkgs/applications/office/mendeley/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/office/mendeley/default.nix b/pkgs/applications/office/mendeley/default.nix
index 15a57ba9de4..cf40392c6dd 100644
--- a/pkgs/applications/office/mendeley/default.nix
+++ b/pkgs/applications/office/mendeley/default.nix
@@ -42,14 +42,14 @@ let
     then "i386"
     else "amd64";
 
-  shortVersion = "1.18-stable";
+  shortVersion = "1.19.1-stable";
 
   version = "${shortVersion}_${arch}";
 
   url = "http://desktop-download.mendeley.com/download/apt/pool/main/m/mendeleydesktop/mendeleydesktop_${version}.deb";
   sha256 = if stdenv.system == arch32
-    then "046v1j4sc6m0bf89f52zsg8riygrhldplyih5p0cjhcsd45q6fx8"
-    else "072fppgxhiryb6m1fb4qvq8nbblx88xpknnklygch1sw0lyks69h";
+    then "0fcyl5i8xdgb5j0x1643qc0j74d8p11jczvqmgqkqh0wgid1y1ad"
+    else "1dzwa2cnn9xakrhhq159fhh71gw5wlbf017rrikdlia694m8akq6";
 
   deps = [
     qtbase

From 3e766a56c4c2ef14ae734b56897aeb4b98c8998b Mon Sep 17 00:00:00 2001
From: Mitsuhiro Nakamura <m.nacamura@gmail.com>
Date: Mon, 11 Jun 2018 19:26:52 +0900
Subject: [PATCH 105/161] trash-cli: enable darwin build

---
 pkgs/tools/misc/trash-cli/default.nix | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/pkgs/tools/misc/trash-cli/default.nix b/pkgs/tools/misc/trash-cli/default.nix
index 77308ecf2ed..113c7e127d4 100644
--- a/pkgs/tools/misc/trash-cli/default.nix
+++ b/pkgs/tools/misc/trash-cli/default.nix
@@ -1,8 +1,6 @@
 { stdenv, fetchFromGitHub, fetchpatch, coreutils
 , python3, python3Packages, substituteAll }:
 
-assert stdenv.isLinux;
-
 python3Packages.buildPythonApplication rec {
   name = "trash-cli-${version}";
   version = "0.17.1.14";
@@ -19,7 +17,8 @@ python3Packages.buildPythonApplication rec {
     (substituteAll {
       src = ./nix-paths.patch;
       df = "${coreutils}/bin/df";
-      libc = "${stdenv.cc.libc.out}/lib/libc.so.6";
+      libc = let ext = if stdenv.isDarwin then ".dylib" else ".so.6";
+             in "${stdenv.cc.libc}/lib/libc${ext}";
     })
 
     # Fix build on Python 3.6.
@@ -37,7 +36,7 @@ python3Packages.buildPythonApplication rec {
     homepage = https://github.com/andreafrancia/trash-cli;
     description = "Command line tool for the desktop trash can";
     maintainers = [ maintainers.rycee ];
-    platforms = platforms.all;
+    platforms = platforms.unix;
     license = licenses.gpl2;
   };
 }

From 6d4069964f6c1db91fa674bdc0798dde065092db Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Sun, 25 Feb 2018 14:12:21 +0100
Subject: [PATCH 106/161] libbytesize: init at 1.3

---
 .../libraries/libbytesize/default.nix         | 31 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 ++
 2 files changed, 33 insertions(+)
 create mode 100644 pkgs/development/libraries/libbytesize/default.nix

diff --git a/pkgs/development/libraries/libbytesize/default.nix b/pkgs/development/libraries/libbytesize/default.nix
new file mode 100644
index 00000000000..f1dcf60b3b9
--- /dev/null
+++ b/pkgs/development/libraries/libbytesize/default.nix
@@ -0,0 +1,31 @@
+{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, gettext
+, gtk-doc, libxslt, docbook_xml_dtd_43, docbook_xsl
+, python3, pcre, gmp, mpfr
+}:
+
+let
+  version = "1.3";
+in stdenv.mkDerivation rec {
+  name = "libbytesize-${version}";
+
+  src = fetchFromGitHub {
+    owner = "storaged-project";
+    repo = "libbytesize";
+    rev = version;
+    sha256 = "1ys5d8rya8x4q34gn1hr96z7797s9gdzah0y0d7g84x5x6k50p30";
+  };
+
+  outputs = [ "out" "dev" "devdoc" ];
+
+  nativeBuildInputs = [ autoreconfHook pkgconfig gettext gtk-doc libxslt docbook_xml_dtd_43 docbook_xsl python3 ];
+
+  buildInputs = [ pcre gmp mpfr ];
+
+  meta = with stdenv.lib; {
+    description = "A tiny library providing a C “class” for working with arbitrary big sizes in bytes";
+    homepage = src.meta.homepage;
+    license = licenses.lgpl2Plus;
+    maintainers = with maintainers; [];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index bc48df43f40..7f785900056 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9798,6 +9798,8 @@ with pkgs;
 
   libburn = callPackage ../development/libraries/libburn { };
 
+  libbytesize = callPackage ../development/libraries/libbytesize { };
+
   libcaca = callPackage ../development/libraries/libcaca {
     inherit (xorg) libX11 libXext;
   };

From f78ca4715b39c0c4924451d1e5bf9e497604a77f Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Sun, 25 Feb 2018 14:51:00 +0100
Subject: [PATCH 107/161] volume_key: init at 0.3.9

---
 .../libraries/volume-key/default.nix          | 38 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 +
 2 files changed, 40 insertions(+)
 create mode 100644 pkgs/development/libraries/volume-key/default.nix

diff --git a/pkgs/development/libraries/volume-key/default.nix b/pkgs/development/libraries/volume-key/default.nix
new file mode 100644
index 00000000000..53faf07623e
--- /dev/null
+++ b/pkgs/development/libraries/volume-key/default.nix
@@ -0,0 +1,38 @@
+{ stdenv, fetchgit, fetchpatch, autoreconfHook, pkgconfig, gettext, python2
+, swig, glib, utillinux, cryptsetup, nss, gpgme
+}:
+
+let
+  version = "0.3.10";
+in stdenv.mkDerivation rec {
+  name = "volume_key-${version}";
+
+  src = fetchgit {
+    url = https://pagure.io/volume_key.git;
+    rev = "ece1ce305234da454e330905c615ec474d9781c5";
+    sha256 = "16qdi5s6ycsh0iyc362gly7ggrwamky8i0zgbd4ajp3ymk9vqdva";
+  };
+
+  outputs = [ "out" "man" "dev" ];
+
+  nativeBuildInputs = [ autoreconfHook pkgconfig gettext python2 swig ];
+
+  buildInputs = [ glib cryptsetup nss utillinux gpgme ];
+
+  patches = [
+    # Use pkg-config for locating Python.h
+    # https://pagure.io/volume_key/pull-request/12
+    (fetchpatch {
+      url = https://pagure.io/fork/cathay4t/volume_key/c/8eda66d3b734ea335e37cf9d7d173b9e8ebe2fd9.patch;
+      sha256 = "01lr1zijk0imkk681zynm4w5ad3y6c9vdrmrzaib7w7ima75iczr";
+    })
+  ];
+
+  meta = with stdenv.lib; {
+    description = "A library for manipulating storage volume encryption keys and storing them separately from volumes to handle forgotten passphrases, and the associated command-line tool";
+    homepage = https://pagure.io/volume_key/;
+    license = licenses.gpl2;
+    maintainers = with maintainers; [];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 7f785900056..5ad6cda7b11 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5512,6 +5512,8 @@ with pkgs;
 
   vobsub2srt = callPackage ../tools/cd-dvd/vobsub2srt { };
 
+  volume_key = callPackage ../development/libraries/volume-key { };
+
   vorbisgain = callPackage ../tools/misc/vorbisgain { };
 
   vpnc = callPackage ../tools/networking/vpnc { };

From 1034ef2193bbdb5624341a92fc923fa20142e3a5 Mon Sep 17 00:00:00 2001
From: Florian Klink <flokli@flokli.de>
Date: Wed, 30 May 2018 01:31:16 +0200
Subject: [PATCH 108/161] libndctl: init at 60.3

---
 .../libraries/libndctl/default.nix            | 40 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 +
 2 files changed, 42 insertions(+)
 create mode 100644 pkgs/development/libraries/libndctl/default.nix

diff --git a/pkgs/development/libraries/libndctl/default.nix b/pkgs/development/libraries/libndctl/default.nix
new file mode 100644
index 00000000000..fa48fc390aa
--- /dev/null
+++ b/pkgs/development/libraries/libndctl/default.nix
@@ -0,0 +1,40 @@
+{ stdenv, fetchFromGitHub, autoreconfHook, autoconf, automake, asciidoc, docbook_xsl, docbook_xml_dtd_45, libxslt, xmlto, pkgconfig, json_c, kmod, which, systemd, utillinux
+}:
+
+let
+  version = "60.3";
+in stdenv.mkDerivation rec {
+  name = "libndctl-${version}";
+
+  src = fetchFromGitHub {
+    owner = "pmem";
+    repo = "ndctl";
+    rev = "v${version}";
+    sha256 = "0w19yh6f9skf5zy4bhdjlrn3wdx5xx9cq8j6h04cmw4nla6zj9ar";
+  };
+
+  outputs = [ "out" "man" "dev" ];
+
+  nativeBuildInputs = [
+    autoreconfHook asciidoc pkgconfig xmlto docbook_xml_dtd_45 docbook_xsl libxslt
+  ];
+
+  buildInputs = [
+    json_c kmod systemd utillinux
+  ];
+
+  preAutoreconf = ''
+    substituteInPlace configure.ac --replace "which" "${which}/bin/which"
+    substituteInPlace git-version --replace /bin/bash ${stdenv.shell}
+    substituteInPlace git-version-gen --replace /bin/sh ${stdenv.shell}
+    echo "m4_define([GIT_VERSION], [${version}])" > version.m4;
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Utility library for managing the libnvdimm (non-volatile memory device) sub-system in the Linux kernel";
+    homepage = https://github.com/pmem/ndctl;
+    license = licenses.lgpl21;
+    maintainers = with maintainers; [];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5ad6cda7b11..4128933ad15 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10354,6 +10354,8 @@ with pkgs;
 
   libmx = callPackage ../development/libraries/libmx { };
 
+  libndctl = callPackage ../development/libraries/libndctl { };
+
   libnet = callPackage ../development/libraries/libnet { };
 
   libnetfilter_conntrack = callPackage ../development/libraries/libnetfilter_conntrack { };

From 058b0e7a47f1ef99569a2dc3eb321bc9410cc309 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Sun, 25 Feb 2018 13:52:38 +0100
Subject: [PATCH 109/161] libblockdev: init at 2.17

---
 .../libraries/libblockdev/default.nix         | 39 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 +
 2 files changed, 41 insertions(+)
 create mode 100644 pkgs/development/libraries/libblockdev/default.nix

diff --git a/pkgs/development/libraries/libblockdev/default.nix b/pkgs/development/libraries/libblockdev/default.nix
new file mode 100644
index 00000000000..077efe299ec
--- /dev/null
+++ b/pkgs/development/libraries/libblockdev/default.nix
@@ -0,0 +1,39 @@
+{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, gtk-doc, libxslt, docbook_xsl
+, docbook_xml_dtd_43, python3, gobjectIntrospection, glib, libudev, kmod, parted
+, cryptsetup, devicemapper, dmraid, utillinux, libbytesize, libndctl, nss, volume_key
+}:
+
+let
+  version = "2.17";
+in stdenv.mkDerivation rec {
+  name = "libblockdev-${version}";
+
+  src = fetchFromGitHub {
+    owner = "storaged-project";
+    repo = "libblockdev";
+    rev = "${version}-1";
+    sha256 = "14f52cj2qcnm8i2zb57qfpdk3kij2gb3xgqkbvidmf6sjicq84z2";
+  };
+
+  outputs = [ "out" "dev" "devdoc" ];
+
+  postPatch = ''
+    patchShebangs scripts
+  '';
+
+  nativeBuildInputs = [
+    autoreconfHook pkgconfig gtk-doc libxslt docbook_xsl docbook_xml_dtd_43 python3 gobjectIntrospection
+  ];
+
+  buildInputs = [
+    glib libudev kmod parted cryptsetup devicemapper dmraid utillinux libbytesize libndctl nss volume_key
+  ];
+
+  meta = with stdenv.lib; {
+    description = "A library for manipulating block devices";
+    homepage = http://storaged.org/libblockdev/;
+    license = licenses.lgpl2Plus; # lgpl2Plus for the library, gpl2Plus for the utils
+    maintainers = with maintainers; [];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4128933ad15..e9f24b91331 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9790,6 +9790,8 @@ with pkgs;
 
   libbdplus = callPackage ../development/libraries/libbdplus { };
 
+  libblockdev = callPackage ../development/libraries/libblockdev { };
+
   libblocksruntime = callPackage ../development/libraries/libblocksruntime { };
 
   libbluray = callPackage ../development/libraries/libbluray { };

From 41b140cb25a2e10d94107393bd41509564f2fb82 Mon Sep 17 00:00:00 2001
From: Florian Klink <flokli@flokli.de>
Date: Wed, 30 May 2018 00:19:46 +0200
Subject: [PATCH 110/161] =?UTF-8?q?udisks2:=202.1.6=20=E2=86=92=202.7.6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

supersedes #35551
closes #34999

/cc https://github.com/NixOS/nixpkgs/pull/38382
---
 pkgs/os-specific/linux/udisks/2-default.nix   |  80 ++++++-----
 pkgs/os-specific/linux/udisks/fix-paths.patch | 131 ++++++++++++++++++
 2 files changed, 178 insertions(+), 33 deletions(-)
 create mode 100644 pkgs/os-specific/linux/udisks/fix-paths.patch

diff --git a/pkgs/os-specific/linux/udisks/2-default.nix b/pkgs/os-specific/linux/udisks/2-default.nix
index a057cb3c101..6bb12c2c792 100644
--- a/pkgs/os-specific/linux/udisks/2-default.nix
+++ b/pkgs/os-specific/linux/udisks/2-default.nix
@@ -1,43 +1,55 @@
-{ stdenv, fetchurl, pkgconfig, intltool, gnused
-, expat, acl, systemd, glib, libatasmart, polkit
-, libxslt, docbook_xsl, utillinux, mdadm, libgudev
-, gobjectIntrospection
+{ stdenv, fetchFromGitHub, substituteAll, libtool, pkgconfig, intltool, gnused
+, gnome3, gtk-doc, acl, systemd, glib, libatasmart, polkit, coreutils, bash
+, expat, libxslt, docbook_xsl, utillinux, mdadm, libgudev, libblockdev, parted
+, gobjectIntrospection, docbook_xml_dtd_412, docbook_xml_dtd_43
+, libxfs, f2fs-tools, dosfstools, e2fsprogs, btrfs-progs, exfat, nilfs-utils, udftools, ntfs3g
 }:
 
-stdenv.mkDerivation rec {
-  name = "udisks-2.1.8";
+let
+  version = "2.7.6";
+in stdenv.mkDerivation rec {
+  name = "udisks-${version}";
 
-  src = fetchurl {
-    url = "http://udisks.freedesktop.org/releases/${name}.tar.bz2";
-    sha256 = "1nkxhnqh39c9pzvm4zfj50rgv6apqawdx09bv3sfaxrah4a6jhfs";
+  src = fetchFromGitHub {
+    owner = "storaged-project";
+    repo = "udisks";
+    rev = name;
+    sha256 = "16kf104vv2xbk8cdgaqygszcl69d7lz9gf3vmi7ggywn7nfbp2ks";
   };
 
-  outputs = [ "out" "man" "dev" ];
+  outputs = [ "out" "man" "dev" "devdoc" ];
 
-  patches = [ ./force-path.patch ];
+  patches = [
+    (substituteAll {
+      src = ./fix-paths.patch;
+      bash = "${bash}/bin/bash";
+      blkid = "${utillinux}/bin/blkid";
+      false = "${coreutils}/bin/false";
+      mdadm = "${mdadm}/bin/mdadm";
+      sed = "${gnused}/bin/sed";
+      sh = "${bash}/bin/sh";
+      sleep = "${coreutils}/bin/sleep";
+      true = "${coreutils}/bin/true";
+    })
+    (substituteAll {
+      src = ./force-path.patch;
+      path = stdenv.lib.makeBinPath [ btrfs-progs coreutils dosfstools e2fsprogs exfat f2fs-tools nilfs-utils libxfs ntfs3g parted utillinux ];
+    })
+  ];
 
-  # FIXME remove /var/run/current-system/sw/* references
-  # FIXME add references to parted, cryptsetup, etc (see the sources)
-  postPatch =
-    ''
-      substituteInPlace src/main.c --replace \
-        "@path@" \
-        "${utillinux}/bin:${mdadm}/bin:/run/current-system/sw/bin"
-      substituteInPlace data/80-udisks2.rules \
-        --replace "/bin/sh" "${stdenv.shell}" \
-        --replace "/sbin/mdadm" "${mdadm}/bin/mdadm" \
-        --replace " sed " " ${gnused}/bin/sed "
-  '' + stdenv.lib.optionalString stdenv.hostPlatform.isMusl ''
-      substituteInPlace udisks/udisksclient.c \
-        --replace 'defined( __GNUC_PREREQ)' 1 \
-        --replace '__GNUC_PREREQ(4,6)' 1
-  '';
+  nativeBuildInputs = [
+    pkgconfig gnome3.gnome-common libtool intltool gobjectIntrospection
+    gtk-doc libxslt docbook_xml_dtd_412 docbook_xml_dtd_43 docbook_xsl
+  ];
 
-  nativeBuildInputs = [ pkgconfig intltool gobjectIntrospection ];
+  buildInputs = [
+    expat libgudev libblockdev acl systemd glib libatasmart polkit
+  ];
 
-  buildInputs = [ libxslt docbook_xsl libgudev expat acl systemd glib libatasmart polkit ];
+  preConfigure = "./autogen.sh";
 
   configureFlags = [
+    "--enable-gtk-doc"
     "--localstatedir=/var"
     "--with-systemdsystemunitdir=$(out)/etc/systemd/system"
     "--with-udevdir=$(out)/lib/udev"
@@ -50,9 +62,11 @@ stdenv.mkDerivation rec {
 
   doCheck = false; # fails
 
-  meta = {
-    homepage = http://www.freedesktop.org/wiki/Software/udisks;
-    description = "A daemon and command-line utility for querying and manipulating storage devices";
-    platforms = stdenv.lib.platforms.linux;
+  meta = with stdenv.lib; {
+    description = "A daemon, tools and libraries to access and manipulate disks, storage devices and technologies";
+    homepage = https://www.freedesktop.org/wiki/Software/udisks/;
+    license = licenses.gpl2Plus; # lgpl2Plus for the library, gpl2Plus for the tools & daemon
+    maintainers = with maintainers; [];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/udisks/fix-paths.patch b/pkgs/os-specific/linux/udisks/fix-paths.patch
new file mode 100644
index 00000000000..c2744c3b42e
--- /dev/null
+++ b/pkgs/os-specific/linux/udisks/fix-paths.patch
@@ -0,0 +1,131 @@
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -1,6 +1,6 @@
+ ## Process this file with automake to produce Makefile.in
+ 
+-SHELL = /bin/bash
++SHELL = @bash@
+ .SHELLFLAGS = -o pipefail -c
+ 
+ PYTHON ?= python3
+--- a/data/80-udisks2.rules
++++ b/data/80-udisks2.rules
+@@ -17,9 +17,9 @@
+ #
+ # TODO: file bug against mdadm(8) to have --export-prefix option that can be used with e.g. UDISKS_MD_MEMBER
+ #
+-SUBSYSTEM=="block", ENV{ID_FS_USAGE}=="raid", ENV{ID_FS_TYPE}=="linux_raid_member", ENV{UDISKS_MD_MEMBER_LEVEL}=="", IMPORT{program}="/bin/sh -c '/sbin/mdadm --examine --export $tempnode | /bin/sed s/^MD_/UDISKS_MD_MEMBER_/g'"
++SUBSYSTEM=="block", ENV{ID_FS_USAGE}=="raid", ENV{ID_FS_TYPE}=="linux_raid_member", ENV{UDISKS_MD_MEMBER_LEVEL}=="", IMPORT{program}="@sh@ -c '@mdadm@ --examine --export $tempnode | @sed@ s/^MD_/UDISKS_MD_MEMBER_/g'"
+ 
+-SUBSYSTEM=="block", KERNEL=="md*", ENV{DEVTYPE}!="partition", IMPORT{program}="/bin/sh -c '/sbin/mdadm --detail --export $tempnode | /bin/sed s/^MD_/UDISKS_MD_/g'"
++SUBSYSTEM=="block", KERNEL=="md*", ENV{DEVTYPE}!="partition", IMPORT{program}="@sh@ -c '@mdadm@ --detail --export $tempnode | @sed@ s/^MD_/UDISKS_MD_/g'"
+ 
+ LABEL="udisks_probe_end"
+ 
+--- a/modules/zram/udiskslinuxmanagerzram.c
++++ b/modules/zram/udiskslinuxmanagerzram.c
+@@ -250,7 +250,7 @@
+ 
+       g_snprintf (tmp, 255, "zram%" G_GUINT64_FORMAT, i);
+       filename = g_build_filename (PACKAGE_ZRAMCONF_DIR, tmp, NULL);
+-      contents = g_strdup_printf ("#!/bin/bash\n\n"
++      contents = g_strdup_printf ("#!@bash@\n\n"
+                                   "ZRAM_NUM_STR=%" G_GUINT64_FORMAT "\n"
+                                   "ZRAM_DEV_SIZE=%" G_GUINT64_FORMAT "\n"
+                                   "SWAP=n\n",
+--- a/src/tests/install-udisks/runtest.sh
++++ b/src/tests/install-udisks/runtest.sh
+@@ -1,4 +1,4 @@
+-#!/bin/bash
++#!@bash@
+ # vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ #
+--- a/src/tests/integration-test
++++ b/src/tests/integration-test
+@@ -414,7 +414,7 @@
+                 f.write('KERNEL=="sr*", ENV{DISK_EJECT_REQUEST}!="?*", '
+                         'ATTRS{model}=="scsi_debug*", '
+                         'ENV{ID_CDROM_MEDIA}=="?*", '
+-                        'IMPORT{program}="/sbin/blkid -o udev -p -u noraid $tempnode"\n')
++                        'IMPORT{program}="@blkid@ -o udev -p -u noraid $tempnode"\n')
+             # reload udev
+             subprocess.call('sync; pkill --signal HUP udevd || '
+                             'pkill --signal HUP systemd-udevd',
+@@ -1079,7 +1079,7 @@
+         self.assertFalse(os.access(f, os.X_OK))
+ 
+         f = os.path.join(mount_point, 'simple.exe')
+-        shutil.copy('/bin/bash', f)
++        shutil.copy('@bash@', f)
+         self.assertTrue(os.access(f, os.R_OK))
+         self.assertTrue(os.access(f, os.W_OK))
+         self.assertTrue(os.access(f, os.X_OK))
+@@ -1092,7 +1092,7 @@
+         self.assertFalse(os.access(f, os.X_OK))
+ 
+         f = os.path.join(mount_point, 'subdir', 'subdir.exe')
+-        shutil.copy('/bin/bash', f)
++        shutil.copy('@bash@', f)
+         self.assertTrue(os.access(f, os.R_OK))
+         self.assertTrue(os.access(f, os.W_OK))
+         self.assertTrue(os.access(f, os.X_OK))
+--- a/src/tests/storadectl/runtest.sh
++++ b/src/tests/storadectl/runtest.sh
+@@ -1,4 +1,4 @@
+-#!/bin/bash
++#!@bash@
+ # vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ #
+--- a/src/tests/test.c
++++ b/src/tests/test.c
+@@ -71,7 +71,7 @@
+ {
+   UDisksSpawnedJob *job;
+ 
+-  job = udisks_spawned_job_new ("/bin/true", NULL, getuid (), geteuid (), NULL, NULL);
++  job = udisks_spawned_job_new ("@true@", NULL, getuid (), geteuid (), NULL, NULL);
+   udisks_spawned_job_start (job);
+   _g_assert_signal_received (job, "completed", G_CALLBACK (on_completed_expect_success), NULL);
+   g_object_unref (job);
+@@ -84,10 +84,10 @@
+ {
+   UDisksSpawnedJob *job;
+ 
+-  job = udisks_spawned_job_new ("/bin/false", NULL, getuid (), geteuid (), NULL, NULL);
++  job = udisks_spawned_job_new ("@false@", NULL, getuid (), geteuid (), NULL, NULL);
+   udisks_spawned_job_start (job);
+   _g_assert_signal_received (job, "completed", G_CALLBACK (on_completed_expect_failure),
+-                             (gpointer) "Command-line `/bin/false' exited with non-zero exit status 1: ");
++                             (gpointer) "Command-line `@false@' exited with non-zero exit status 1: ");
+   g_object_unref (job);
+ }
+ 
+@@ -119,7 +119,7 @@
+ 
+   cancellable = g_cancellable_new ();
+   g_cancellable_cancel (cancellable);
+-  job = udisks_spawned_job_new ("/bin/true", NULL, getuid (), geteuid (), NULL, cancellable);
++  job = udisks_spawned_job_new ("@true@", NULL, getuid (), geteuid (), NULL, cancellable);
+   udisks_spawned_job_start (job);
+   _g_assert_signal_received (job, "completed", G_CALLBACK (on_completed_expect_failure),
+                              (gpointer) "Operation was cancelled (g-io-error-quark, 19)");
+@@ -145,7 +145,7 @@
+   GCancellable *cancellable;
+ 
+   cancellable = g_cancellable_new ();
+-  job = udisks_spawned_job_new ("/bin/sleep 0.5", NULL, getuid (), geteuid (), NULL, cancellable);
++  job = udisks_spawned_job_new ("@sleep@ 0.5", NULL, getuid (), geteuid (), NULL, cancellable);
+   udisks_spawned_job_start (job);
+   g_timeout_add (10, on_timeout, cancellable); /* 10 msec */
+   g_main_loop_run (loop);
+@@ -199,7 +199,7 @@
+ {
+   UDisksSpawnedJob *job;
+ 
+-  job = udisks_spawned_job_new ("/bin/sleep 1000", NULL, getuid (), geteuid (), NULL, NULL /* GCancellable */);
++  job = udisks_spawned_job_new ("@sleep@ 1000", NULL, getuid (), geteuid (), NULL, NULL /* GCancellable */);
+   udisks_spawned_job_start (job);
+   g_object_unref (job);
+ }

From 69f832d2eef66a95304a05306ea682598d2caa82 Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Mon, 4 Jun 2018 11:48:13 -0400
Subject: [PATCH 111/161] llvm: fix darwin cross bootstrapping cmake

Cmake needs to be listed as a build package for cross splicing to
work correctly.
---
 pkgs/top-level/all-packages.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5f7228c1410..043d8cd19aa 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6788,8 +6788,8 @@ with pkgs;
     inherit (stdenvAdapters) overrideCC;
     buildLlvmTools = buildPackages.llvmPackages_5.tools;
     targetLlvmLibraries = targetPackages.llvmPackages_5.libraries;
-  } // stdenv.lib.optionalAttrs stdenv.isDarwin {
-    cmake = cmake.override {
+  } // stdenv.lib.optionalAttrs (stdenv.isDarwin && hostPlatform == buildPlatform) {
+    cmake = buildPackages.cmake.override {
       isBootstrap = true;
       majorVersion = "3.9"; # 3.10.2: 'ApplicationServices/ApplicationServices.h' file not found
     };

From f550fa4a72951346493666fea7171732496d2d7f Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Mon, 11 Jun 2018 09:47:12 -0700
Subject: [PATCH 112/161] fwts: 18.03.00 -> 18.05.00 (#41563)

Semi-automatic update generated by https://github.com/ryantm/nixpkgs-update tools.

This update was made based on information from https://repology.org/metapackage/fwts/versions.

These checks were done:

- built on NixOS
- /nix/store/v5wy7231jv43gnni4s3jcq0lz1qx21bs-fwts-18.05.00/bin/fwts passed the binary check.
- Warning: no invocation of /nix/store/v5wy7231jv43gnni4s3jcq0lz1qx21bs-fwts-18.05.00/bin/kernelscan had a zero exit code or showed the expected version
- 1 of 2 passed binary check by having a zero exit code.
- 0 of 2 passed binary check by having the new version present in output.
- found 18.05.00 with grep in /nix/store/v5wy7231jv43gnni4s3jcq0lz1qx21bs-fwts-18.05.00
- directory tree listing: https://gist.github.com/8fb4995cd885cdeea7a35d51b7edca3b
- du listing: https://gist.github.com/8cc61b948b8e0aa4a1a8088464c5536d
---
 pkgs/os-specific/linux/fwts/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/fwts/default.nix b/pkgs/os-specific/linux/fwts/default.nix
index c02bfb1615c..a3d8d0a0eec 100644
--- a/pkgs/os-specific/linux/fwts/default.nix
+++ b/pkgs/os-specific/linux/fwts/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   name = "fwts-${version}";
-  version = "18.03.00";
+  version = "18.05.00";
 
   src = fetchzip {
     url = "http://fwts.ubuntu.com/release/fwts-V${version}.tar.gz";
-    sha256 = "1f2gdnaygsj0spd6a559bzf3wii7l59k3sk49rjbbdb9g77nkhg2";
+    sha256 = "0ixc82zdv4cfj8g2mwd851fc47cpjj81mwjhn00n5wddb9cxmgkj";
     stripRoot = false;
   };
 

From c358e1ded90fb05fc628e397f71848fe1467aec6 Mon Sep 17 00:00:00 2001
From: Florian Klink <flokli@flokli.de>
Date: Mon, 11 Jun 2018 16:45:25 +0200
Subject: [PATCH 113/161] python3Packages.click: fix 'locale' path

importing click shells out to 'locale', which currently needs to be in
PATH. Fix by setting patching locale command at runtime.
---
 pkgs/development/python-modules/click/default.nix     |  8 +++++++-
 pkgs/development/python-modules/click/fix-paths.patch | 11 +++++++++++
 2 files changed, 18 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/development/python-modules/click/fix-paths.patch

diff --git a/pkgs/development/python-modules/click/default.nix b/pkgs/development/python-modules/click/default.nix
index d5dfba61010..295c6d51955 100644
--- a/pkgs/development/python-modules/click/default.nix
+++ b/pkgs/development/python-modules/click/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildPythonPackage, fetchPypi, pytest }:
+{ stdenv, buildPythonPackage, fetchPypi, substituteAll, glibc, pytest }:
 
 buildPythonPackage rec {
   pname = "click";
@@ -9,6 +9,12 @@ buildPythonPackage rec {
     sha256 = "02qkfpykbq35id8glfgwc38yc430427yd05z1wc5cnld8zgicmgi";
   };
 
+  patches = stdenv.lib.optionals (stdenv.isLinux && !stdenv.hostPlatform.isMusl)
+    (substituteAll {
+      src = ./fix-paths.patch;
+      locale = "${glibc.bin}/bin/locale";
+    });
+
   buildInputs = [ pytest ];
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/click/fix-paths.patch b/pkgs/development/python-modules/click/fix-paths.patch
new file mode 100644
index 00000000000..04719871b76
--- /dev/null
+++ b/pkgs/development/python-modules/click/fix-paths.patch
@@ -0,0 +1,11 @@
+--- a/click/_unicodefun.py	2018-06-11 15:08:59.369358278 +0200
++++ b/click/_unicodefun.py	2018-06-11 15:09:09.342325998 +0200
+@@ -60,7 +60,7 @@
+     extra = ''
+     if os.name == 'posix':
+         import subprocess
+-        rv = subprocess.Popen(['locale', '-a'], stdout=subprocess.PIPE,
++        rv = subprocess.Popen(['@locale@', '-a'], stdout=subprocess.PIPE,
+                               stderr=subprocess.PIPE).communicate()[0]
+         good_locales = set()
+         has_c_utf8 = False

From f431f209d7b207a6c0c487fbd6e1a30d52fe769b Mon Sep 17 00:00:00 2001
From: Jan Malakhovski <oxij@oxij.org>
Date: Mon, 11 Jun 2018 17:16:53 +0000
Subject: [PATCH 114/161] uim: 1.8.6-20180501-git -> 1.8.8 (#41850)

---
 pkgs/tools/inputmethods/uim/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/inputmethods/uim/default.nix b/pkgs/tools/inputmethods/uim/default.nix
index 1bdbef2fde6..b8510b102cb 100644
--- a/pkgs/tools/inputmethods/uim/default.nix
+++ b/pkgs/tools/inputmethods/uim/default.nix
@@ -38,15 +38,15 @@ assert withFFI -> libffi != null;
 assert withMisc -> libeb != null;
 
 stdenv.mkDerivation rec {
-  version = "1.8.6-20180501-git";
+  version = "1.8.8";
   name = "uim-${version}";
 
   src = fetchFromGitHub {
     owner = "uim";
     repo = "uim";
-    rev = "c79432cb5aba3a67fb7e7557f4817c749865cc8a";
+    rev = "2c0958c9c505a87e70e344c2192e2e5123c71ea5";
     fetchSubmodules = true;
-    sha256 = "12rznfwq1mh750i18bl1743c51akyyvy6la5rgrxmrnp0mha9ba5";
+    sha256 = "1hkjxi5r49gcna37m3jvykny5hz9ram4y8a3q7lw4qzr52mz9pdp";
   };
 
   nativeBuildInputs = [

From c80e0fbb08748b560270a647e468447602c4edc2 Mon Sep 17 00:00:00 2001
From: Sarah Brofeldt <sbrofeldt@gmail.com>
Date: Mon, 11 Jun 2018 19:45:34 +0200
Subject: [PATCH 115/161] docker: Ensure references to go are removed from
 docker-containerd (#41849)

---
 pkgs/applications/virtualization/docker/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index 2ab2bd02219..1a2c850f156 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -27,7 +27,7 @@ rec {
       patches = [];
     });
 
-    docker-containerd = containerd.overrideAttrs (oldAttrs: rec {
+    docker-containerd = (containerd.override { inherit go; }).overrideAttrs (oldAttrs: rec {
       name = "docker-containerd";
       src = fetchFromGitHub {
         owner = "docker";

From b4c38a51742136e7c0b22dbdbee2c87763eed67d Mon Sep 17 00:00:00 2001
From: Michael Raskin <7c6f434c@mail.ru>
Date: Mon, 11 Jun 2018 20:04:25 +0200
Subject: [PATCH 116/161] mariadb: galera: there is no galera_new_cluster

---
 pkgs/servers/sql/mariadb/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/servers/sql/mariadb/default.nix b/pkgs/servers/sql/mariadb/default.nix
index 7b7aaa5597f..817ed9d1180 100644
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@@ -167,6 +167,7 @@ everything = stdenv.mkDerivation (common // {
     rm -r "$out"/data # Don't need testing data
     rm "$out"/share/man/man1/mysql-test-run.pl.1
     rm "$out"/bin/rcmysql
+  '' + optionalString (! stdenv.isDarwin) ''
     sed -i 's/-mariadb/-mysql/' "$out"/bin/galera_new_cluster
   '';
 

From a176f5e702c8b6df1e8c4e4be657e254874ee925 Mon Sep 17 00:00:00 2001
From: Tobias Happ <Gerschtli@users.noreply.github.com>
Date: Mon, 11 Jun 2018 20:01:01 +0200
Subject: [PATCH 117/161] pythonPackages.pdf2image: init at 0.1.13 (#41741)

---
 .../python-modules/pdf2image/default.nix      | 21 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 23 insertions(+)
 create mode 100644 pkgs/development/python-modules/pdf2image/default.nix

diff --git a/pkgs/development/python-modules/pdf2image/default.nix b/pkgs/development/python-modules/pdf2image/default.nix
new file mode 100644
index 00000000000..373bedaa110
--- /dev/null
+++ b/pkgs/development/python-modules/pdf2image/default.nix
@@ -0,0 +1,21 @@
+{ stdenv, buildPythonPackage, fetchPypi, pillow, poppler_utils }:
+
+buildPythonPackage rec {
+  pname = "pdf2image";
+  version = "0.1.13";
+
+  buildInputs = [ pillow poppler_utils ];
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "784928038588059e00c7f97e5608047cb754b6ec8fd10e7551e7ad0f40d2cd56";
+  };
+
+  meta = with stdenv.lib; {
+    description = "A python module that wraps the pdftoppm utility to convert PDF to PIL Image object";
+    homepage = https://github.com/Belval/pdf2image;
+    license = licenses.mit;
+    maintainers = with maintainers; [ gerschtli ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index a2b0b218a4b..5c694f4d801 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -319,6 +319,8 @@ in {
 
   outcome = callPackage ../development/python-modules/outcome {};
 
+  pdf2image = callPackage ../development/python-modules/pdf2image { };
+
   pdfminer = callPackage ../development/python-modules/pdfminer_six { };
 
   plantuml = callPackage ../tools/misc/plantuml { };

From 2f73a373db44d3bce716eff0b6ba49437a79c3e1 Mon Sep 17 00:00:00 2001
From: Izorkin <Izorkin@gmail.com>
Date: Mon, 11 Jun 2018 21:03:09 +0300
Subject: [PATCH 118/161] asio: add old version 1.10.8 (#41822)

---
 pkgs/development/libraries/asio/1.10.nix    |  6 +++++
 pkgs/development/libraries/asio/1.12.nix    |  6 +++++
 pkgs/development/libraries/asio/default.nix | 21 -----------------
 pkgs/development/libraries/asio/generic.nix | 25 +++++++++++++++++++++
 pkgs/top-level/all-packages.nix             |  4 +++-
 5 files changed, 40 insertions(+), 22 deletions(-)
 create mode 100644 pkgs/development/libraries/asio/1.10.nix
 create mode 100644 pkgs/development/libraries/asio/1.12.nix
 delete mode 100644 pkgs/development/libraries/asio/default.nix
 create mode 100644 pkgs/development/libraries/asio/generic.nix

diff --git a/pkgs/development/libraries/asio/1.10.nix b/pkgs/development/libraries/asio/1.10.nix
new file mode 100644
index 00000000000..f63fbbd495c
--- /dev/null
+++ b/pkgs/development/libraries/asio/1.10.nix
@@ -0,0 +1,6 @@
+{callPackage, ... } @ args:
+
+callPackage ./generic.nix (args // {
+  version = "1.10.8";
+  sha256 = "0jgdl4fxw0hwy768rl3lhdc0czz7ak7czf3dg10j21pdpfpfvpi6";
+})
diff --git a/pkgs/development/libraries/asio/1.12.nix b/pkgs/development/libraries/asio/1.12.nix
new file mode 100644
index 00000000000..94fe4c70367
--- /dev/null
+++ b/pkgs/development/libraries/asio/1.12.nix
@@ -0,0 +1,6 @@
+{callPackage, ... } @ args:
+
+callPackage ./generic.nix (args // {
+  version = "1.12.1";
+  sha256 = "0nln45662kg799ykvqx5m9z9qcsmadmgg6r5najryls7x16in2d9";
+})
diff --git a/pkgs/development/libraries/asio/default.nix b/pkgs/development/libraries/asio/default.nix
deleted file mode 100644
index 1126b4a7f2c..00000000000
--- a/pkgs/development/libraries/asio/default.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{stdenv, fetchurl, boost, openssl}:
-
-stdenv.mkDerivation rec {
-  name = "asio-1.12.1";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/asio/${name}.tar.bz2";
-    sha256 = "0nln45662kg799ykvqx5m9z9qcsmadmgg6r5najryls7x16in2d9";
-  };
-
-  propagatedBuildInputs = [ boost ];
-  buildInputs = [ openssl ];
-
-  meta = {
-    homepage = http://asio.sourceforge.net/;
-    description = "Cross-platform C++ library for network and low-level I/O programming";
-    license = stdenv.lib.licenses.boost;
-    platforms = stdenv.lib.platforms.unix;
-  };
-
-}
diff --git a/pkgs/development/libraries/asio/generic.nix b/pkgs/development/libraries/asio/generic.nix
new file mode 100644
index 00000000000..58dd4f61423
--- /dev/null
+++ b/pkgs/development/libraries/asio/generic.nix
@@ -0,0 +1,25 @@
+{stdenv, fetchurl, boost, openssl
+, version, sha256, ...
+}:
+
+with stdenv.lib;
+
+stdenv.mkDerivation {
+  name = "asio-${version}";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/asio/asio-${version}.tar.bz2";
+    inherit sha256;
+  };
+
+  propagatedBuildInputs = [ boost ];
+
+  buildInputs = [ openssl ];
+
+  meta = {
+    homepage = http://asio.sourceforge.net/;
+    description = "Cross-platform C++ library for network and low-level I/O programming";
+    license = licenses.boost;
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3c0bd69419a..4e73f598157 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8607,7 +8607,9 @@ with pkgs;
 
   assimp = callPackage ../development/libraries/assimp { };
 
-  asio = callPackage ../development/libraries/asio { };
+  asio = asio_1_12;
+  asio_1_10 = callPackage ../development/libraries/asio/1.10.nix { };
+  asio_1_12 = callPackage ../development/libraries/asio/1.12.nix { };
 
   aspell = callPackage ../development/libraries/aspell { };
 

From fd97db43bcb05e37f6bb77f363f1e1e239d9de53 Mon Sep 17 00:00:00 2001
From: Orivej Desh <orivej@gmx.fr>
Date: Mon, 11 Jun 2018 18:11:02 +0000
Subject: [PATCH 119/161] pruneLibtoolFiles: init setup hook (#41819)

A .la file specifies linker flags to link with the library it describes. Its
"dependency_libs" field lists the libraries that this library depends upon.
This list often contains "-l" flags without corresponding "-L" flags. Many
packages in Nixpkgs deal with this in one of these ways:
- delete .la file [1]
- clear dependency_libs [2]
- add -L flags to dependency_libs [3]
- propagate dependencies [4]

Sometimes "dependency_libs" contain wrong "-L" flags pointing to the "dev"
output with headers rather than to the main output with libraries. They have to
be edited or deleted to reduce closure size [5].

Deleting .la files is often but not always safe [6].  Atomatically deleting as
many of them as possible is complex [7].  Deleting .la files that describe
shared rather than static libraries is probably safe; but clearing their
"dependency_libs" field achieves the same effect with less potential for
unintended consequences.  This is the approach that may be enabled for all
Nixpkgs.

[1] https://github.com/NixOS/nixpkgs/commit/2a79d296d3de74da77b49ca8dc9d356b1a7a1c8d
[2] https://github.com/NixOS/nixpkgs/commit/c83a53098599c49ec57823bf655ce8b45f6aea10
[3] https://github.com/NixOS/nixpkgs/commit/9e0dcf3bd9fcfeed576132b9101b866aa3cb76ff
[4] https://github.com/NixOS/nixpkgs/commit/01134e698fdfb3b61f8ab8ec3bf13e0718f63955
[5] https://github.com/NixOS/nixpkgs/commit/f6c73f1e37c735abb686d07449f349b796c54cf8
[6] https://wiki.gentoo.org/wiki/Project:Quality_Assurance/Handling_Libtool_Archives
[7] https://github.com/gentoo/gentoo/blob/fb1f2435/eclass/ltprune.eclass
---
 .../setup-hooks/prune-libtool-files.sh        | 22 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  3 +++
 2 files changed, 25 insertions(+)
 create mode 100644 pkgs/build-support/setup-hooks/prune-libtool-files.sh

diff --git a/pkgs/build-support/setup-hooks/prune-libtool-files.sh b/pkgs/build-support/setup-hooks/prune-libtool-files.sh
new file mode 100644
index 00000000000..d75812e05b6
--- /dev/null
+++ b/pkgs/build-support/setup-hooks/prune-libtool-files.sh
@@ -0,0 +1,22 @@
+# Clear dependency_libs in libtool files for shared libraries.
+
+# Shared libraries already encode their dependencies with locations.  .la
+# files do not always encode those locations, and sometimes encode the
+# locations in the wrong Nix output. .la files are not needed for shared
+# libraries, but without dependency_libs they do not hurt either.
+
+fixupOutputHooks+=(_pruneLibtoolFiles)
+
+_pruneLibtoolFiles() {
+    if [ "$dontPruneLibtoolFiles" ]; then
+       return
+    fi
+
+    # Libtool uses "dlname" and "library_names" fields for shared libraries and
+    # the "old_library" field for static libraries.  We are processing only
+    # those .la files that do not describe static libraries.
+    find "$prefix" -type f -name '*.la' \
+         -exec grep -q '^# Generated by libtool' {} \; \
+         -exec grep -q "^old_library=''" {} \; \
+         -exec sed -i {} -e "/^dependency_libs='[^']/ c dependency_libs='' #pruned" \;
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4e73f598157..04c11b8208b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -344,6 +344,9 @@ with pkgs;
 
   pathsFromGraph = ../build-support/kernel/paths-from-graph.pl;
 
+  pruneLibtoolFiles = makeSetupHook { name = "prune-libtool-files"; }
+    ../build-support/setup-hooks/prune-libtool-files.sh;
+
   closureInfo = callPackage ../build-support/closure-info.nix { };
 
   setupSystemdUnits = callPackage ../build-support/setup-systemd-units.nix { };

From 1705428cf90ee90ee5e7cdca8555a0f39ff39b13 Mon Sep 17 00:00:00 2001
From: Izorkin <Izorkin@gmail.com>
Date: Mon, 11 Jun 2018 21:42:53 +0300
Subject: [PATCH 120/161] mariadb galera: fix build (#41813)

---
 pkgs/servers/sql/mariadb/default.nix | 6 +++---
 pkgs/top-level/all-packages.nix      | 1 +
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/sql/mariadb/default.nix b/pkgs/servers/sql/mariadb/default.nix
index 817ed9d1180..fee35a62333 100644
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@@ -2,7 +2,7 @@
 , libiconv, openssl, pcre, boost, judy, bison, libxml2
 , libaio, libevent, groff, jemalloc, cracklib, systemd, numactl, perl
 , fixDarwinDylibNames, cctools, CoreServices
-, asio, buildEnv, check, qt4, scons
+, asio, buildEnv, check, scons
 }:
 
 with stdenv.lib;
@@ -225,7 +225,7 @@ galera = stdenv.mkDerivation rec {
     sha256 = "11pfc85z29jk0h6g6bmi3hdv4in4yb00xsr2r0qm1b0y7m2wq3ra";
   };
 
-  buildInputs = [ asio boost check openssl qt4 scons ];
+  buildInputs = [ asio boost check openssl scons ];
 
   patchPhase = ''
     substituteInPlace SConstruct \
@@ -233,7 +233,7 @@ galera = stdenv.mkDerivation rec {
   '';
 
   preConfigure = ''
-    export CPPFLAGS="-I${asio}/include  -I${boost.dev}/include -I${check}/include -I${openssl.dev}/include"
+    export CPPFLAGS="-I${asio}/include -I${boost.dev}/include -I${check}/include -I${openssl.dev}/include"
     export LIBPATH="${galeraLibs}/lib"
   '';
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 04c11b8208b..b0884fe5688 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12800,6 +12800,7 @@ with pkgs;
   rpcbind = callPackage ../servers/rpcbind { };
 
   mariadb = callPackage ../servers/sql/mariadb {
+    asio = asio_1_10;
     inherit (darwin) cctools;
     inherit (pkgs.darwin.apple_sdk.frameworks) CoreServices;
   };

From d64b85983bf0eee87f47733c8e80709f8f7dd0a7 Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Mon, 11 Jun 2018 14:44:49 -0400
Subject: [PATCH 121/161] netbsd.locale: init

---
 pkgs/os-specific/bsd/netbsd/default.nix  |  7 ++
 pkgs/os-specific/bsd/netbsd/locale.patch | 85 ++++++++++++++++++++++++
 2 files changed, 92 insertions(+)
 create mode 100644 pkgs/os-specific/bsd/netbsd/locale.patch

diff --git a/pkgs/os-specific/bsd/netbsd/default.nix b/pkgs/os-specific/bsd/netbsd/default.nix
index 950694d0bfe..aae11b6affc 100644
--- a/pkgs/os-specific/bsd/netbsd/default.nix
+++ b/pkgs/os-specific/bsd/netbsd/default.nix
@@ -600,4 +600,11 @@ in rec {
     makeFlags = [ "BINDIR=/share" ];
   };
 
+  locale = netBSDDerivation {
+    path = "usr.bin/locale";
+    version = "7.1.2";
+    sha256 = "0kk6v9k2bygq0wf9gbinliqzqpzs9bgxn0ndyl2wcv3hh2bmsr9p";
+    patches = [ ./locale.patch ];
+  };
+
 }
diff --git a/pkgs/os-specific/bsd/netbsd/locale.patch b/pkgs/os-specific/bsd/netbsd/locale.patch
new file mode 100644
index 00000000000..1df9eb38562
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/locale.patch
@@ -0,0 +1,85 @@
+--- a/locale.c	2018-06-11 14:39:06.449762000 -0400
++++ b/locale.c	2018-06-11 14:42:28.461122899 -0400
+@@ -56,14 +56,8 @@
+ #include <stringlist.h>
+ #include <unistd.h>
+ 
+-#include "citrus_namespace.h"
+-#include "citrus_region.h"
+-#include "citrus_lookup.h"
+-#include "setlocale_local.h"
+-
+ /* Local prototypes */
+ void	init_locales_list(void);
+-void	init_locales_list_alias(void);
+ void	list_charmaps(void);
+ void	list_locales(void);
+ const char *lookup_localecat(int);
+@@ -221,6 +215,8 @@
+ };
+ #define NKWINFO (sizeof(kwinfo)/sizeof(kwinfo[0]))
+ 
++const char *_PathLocale = NULL;
++
+ int
+ main(int argc, char *argv[])
+ {
+@@ -411,8 +407,7 @@
+ 	while ((dp = readdir(dirp)) != NULL) {
+ 		/* exclude "." and "..", _LOCALE_ALIAS_NAME */
+ 		if ((dp->d_name[0] != '.' || (dp->d_name[1] != '\0' &&
+-		    (dp->d_name[1] != '.' ||  dp->d_name[2] != '\0'))) &&
+-		    strcmp(_LOCALE_ALIAS_NAME, dp->d_name) != 0) {
++		    (dp->d_name[1] != '.' ||  dp->d_name[2] != '\0')))) {
+ 			s = strdup(dp->d_name);
+ 			if (s == NULL)
+ 				err(1, "could not allocate memory");
+@@ -431,48 +426,10 @@
+ 	if (sl_find(locales, "C") == NULL)
+ 		sl_add(locales, "C");
+ 
+-	init_locales_list_alias();
+-
+ 	/* make output nicer, sort the list */
+ 	qsort(locales->sl_str, locales->sl_cur, sizeof(char *), scmp);
+ }
+ 
+-void
+-init_locales_list_alias(void)
+-{
+-	char aliaspath[PATH_MAX];
+-	struct _lookup *hlookup;
+-	struct _region key, dat;
+-	size_t n;
+-	char *s, *t;
+-
+-	_DIAGASSERT(locales != NULL);
+-	_DIAGASSERT(_PathLocale != NULL);
+-
+-	(void)snprintf(aliaspath, sizeof(aliaspath),
+-		"%s/" _LOCALE_ALIAS_NAME, _PathLocale);
+-
+-	if (_lookup_seq_open(&hlookup, aliaspath,
+-	    _LOOKUP_CASE_SENSITIVE) == 0) {
+-		while (_lookup_seq_next(hlookup, &key, &dat) == 0) {
+-			n = _region_size((const struct _region *)&key);
+-			s = _region_head((const struct _region *)&key);
+-			for (t = s; n > 0 && *s!= '/'; --n, ++s);
+-			n = (size_t)(s - t);
+-			s = malloc(n + 1);
+-			if (s == NULL)
+-				err(1, "could not allocate memory");
+-			memcpy(s, t, n);
+-			s[n] = '\0';
+-			if (sl_find(locales, s) == NULL)
+-				sl_add(locales, s);
+-			else
+-				free(s);
+-		}
+-		_lookup_seq_close(hlookup);
+-	}
+-}
+-
+ /*
+  * Show current locale status, depending on environment variables
+  */

From 1b46c4b2a463aa22f68260d2f96506e9cb817a18 Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Mon, 11 Jun 2018 14:46:46 -0400
Subject: [PATCH 122/161] click: fix locale in darwin

unixtools.locale is used
---
 pkgs/development/python-modules/click/default.nix | 9 +++++----
 pkgs/top-level/all-packages.nix                   | 2 +-
 pkgs/top-level/unix-tools.nix                     | 1 +
 3 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/click/default.nix b/pkgs/development/python-modules/click/default.nix
index 295c6d51955..4a96ef7f673 100644
--- a/pkgs/development/python-modules/click/default.nix
+++ b/pkgs/development/python-modules/click/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildPythonPackage, fetchPypi, substituteAll, glibc, pytest }:
+{ stdenv, buildPythonPackage, fetchPypi, substituteAll, locale, pytest }:
 
 buildPythonPackage rec {
   pname = "click";
@@ -9,11 +9,12 @@ buildPythonPackage rec {
     sha256 = "02qkfpykbq35id8glfgwc38yc430427yd05z1wc5cnld8zgicmgi";
   };
 
-  patches = stdenv.lib.optionals (stdenv.isLinux && !stdenv.hostPlatform.isMusl)
+  patches = [
     (substituteAll {
       src = ./fix-paths.patch;
-      locale = "${glibc.bin}/bin/locale";
-    });
+      locale = "${locale}/bin/locale";
+    })
+  ];
 
   buildInputs = [ pytest ];
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b0884fe5688..b6d0f369532 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -21639,7 +21639,7 @@ with pkgs;
   unixtools = recurseIntoAttrs (callPackages ./unix-tools.nix { });
   inherit (unixtools) hexdump ps logger eject umount
                       mount wall hostname more sysctl getconf
-                      getent;
+                      getent locale;
 
   fts = if hostPlatform.isMusl then netbsd.fts else null;
 
diff --git a/pkgs/top-level/unix-tools.nix b/pkgs/top-level/unix-tools.nix
index 1bcf93754cd..362715e8262 100644
--- a/pkgs/top-level/unix-tools.nix
+++ b/pkgs/top-level/unix-tools.nix
@@ -85,6 +85,7 @@ let
     };
     locale = {
       linux = pkgs.glibc;
+      darwin = pkgs.netbsd.locale;
     };
     logger = {
       linux = pkgs.utillinux;

From fb2c132db488befd2b3f104e6b6fea7babf77e3c Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@nix.build>
Date: Mon, 11 Jun 2018 20:12:22 +0200
Subject: [PATCH 123/161] nixos/no-x-libs: Switch to using nixpkgs.overlays

The usage of nixpkgs.config.packageOverrides is deprecated and we do
have overlays since quite a while.

Signed-off-by: aszlig <aszlig@nix.build>
Cc: @edolstra
---
 nixos/modules/config/no-x-libs.nix | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/nixos/modules/config/no-x-libs.nix b/nixos/modules/config/no-x-libs.nix
index a20910353f3..c7a6c943bc2 100644
--- a/nixos/modules/config/no-x-libs.nix
+++ b/nixos/modules/config/no-x-libs.nix
@@ -26,16 +26,16 @@ with lib;
 
     fonts.fontconfig.enable = false;
 
-    nixpkgs.config.packageOverrides = pkgs: {
-      dbus = pkgs.dbus.override { x11Support = false; };
-      networkmanager-fortisslvpn = pkgs.networkmanager-fortisslvpn.override { withGnome = false; };
-      networkmanager-l2tp = pkgs.networkmanager-l2tp.override { withGnome = false; };
-      networkmanager-openconnect = pkgs.networkmanager-openconnect.override { withGnome = false; };
-      networkmanager-openvpn = pkgs.networkmanager-openvpn.override { withGnome = false; };
-      networkmanager-vpnc = pkgs.networkmanager-vpnc.override { withGnome = false; };
-      networkmanager-iodine = pkgs.networkmanager-iodine.override { withGnome = false; };
-      pinentry = pkgs.pinentry_ncurses;
-      gobjectIntrospection = pkgs.gobjectIntrospection.override { x11Support = false; };
-    };
+    nixpkgs.overlays = singleton (const (super: {
+      dbus = super.dbus.override { x11Support = false; };
+      networkmanager-fortisslvpn = super.networkmanager-fortisslvpn.override { withGnome = false; };
+      networkmanager-l2tp = super.networkmanager-l2tp.override { withGnome = false; };
+      networkmanager-openconnect = super.networkmanager-openconnect.override { withGnome = false; };
+      networkmanager-openvpn = super.networkmanager-openvpn.override { withGnome = false; };
+      networkmanager-vpnc = super.networkmanager-vpnc.override { withGnome = false; };
+      networkmanager-iodine = super.networkmanager-iodine.override { withGnome = false; };
+      pinentry = super.pinentry_ncurses;
+      gobjectIntrospection = super.gobjectIntrospection.override { x11Support = false; };
+    }));
   };
 }

From d1a2853933b49f3798c35b7cf8382bb788ee0320 Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@nix.build>
Date: Mon, 11 Jun 2018 20:55:28 +0200
Subject: [PATCH 124/161] pinentry: Fix .override for pinentry_*

When you evaluate nixos/tests/simple.nix, you'll run into an infinite
recursion since 41b140cb25a2e10d94107393bd41509564f2fb82.

The reason is that udisks2 now pulls in gnupg because it now depends on
libblockdev, which in turn depends on volume_key and that depends on
gnupg.

Nevertheless, it's not the real reason, because this only means, that
since gnupg is now pulled into the closure of a basic nixos
configuration the real problem becomes visible:

In nixos/modules/config/no-x-libs.nix there is an overlay which does
something like this:

  nixpkgs.overlays = singleton (const (super: {
    pinentry = super.pinentry_ncurses;
  }));

Now since pinentry_ncurses is already using pinentry.override we get an
infinite recursion because now the pinentry attribute refers to
pinentry_ncurses, which by itself is again referring to pinentry.

This is solved by using the self.pinentry.override instead, so that the
override used by pinentry_ncurses doesn't use the attribute from the
overlay.

Signed-off-by: aszlig <aszlig@nix.build>
Cc: @ttuegel
Signed-off-by: aszlig <aszlig@nix.build>
---
 pkgs/top-level/all-packages.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b6d0f369532..d652824d8b9 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4440,23 +4440,23 @@ with pkgs;
     libcap = if stdenv.isDarwin then null else libcap;
   };
 
-  pinentry_ncurses = pinentry.override {
+  pinentry_ncurses = self.pinentry.override {
     gtk2 = null;
   };
 
-  pinentry_emacs = pinentry.override {
+  pinentry_emacs = self.pinentry.override {
     enableEmacs = true;
   };
 
-  pinentry_gnome = pinentry.override {
+  pinentry_gnome = self.pinentry.override {
     gcr = gnome3.gcr;
   };
 
-  pinentry_qt4 = pinentry.override {
+  pinentry_qt4 = self.pinentry.override {
     qt = qt4;
   };
 
-  pinentry_qt5 = pinentry.override {
+  pinentry_qt5 = self.pinentry.override {
     qt = qt5.qtbase;
   };
 

From c8cc418b8db79b8376c0da1e4f15ecba731b6dd6 Mon Sep 17 00:00:00 2001
From: "nagato.pain" <iuns@outlook.fr>
Date: Mon, 11 Jun 2018 06:24:20 -0700
Subject: [PATCH 125/161] pythonPackages.deap: init at 1.2.2

---
 .../python-modules/deap/default.nix           | 26 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 28 insertions(+)
 create mode 100644 pkgs/development/python-modules/deap/default.nix

diff --git a/pkgs/development/python-modules/deap/default.nix b/pkgs/development/python-modules/deap/default.nix
new file mode 100644
index 00000000000..fbc915c8eb0
--- /dev/null
+++ b/pkgs/development/python-modules/deap/default.nix
@@ -0,0 +1,26 @@
+{ stdenv, buildPythonPackage, fetchPypi, python, numpy, matplotlib }:
+
+buildPythonPackage rec {
+  pname = "deap";
+  version = "1.2.2";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "95c63e66d755ec206c80fdb2908851c0bef420ee8651ad7be4f0578e9e909bcf";
+  };
+
+  propagatedBuildInputs = [ numpy matplotlib ];
+
+  checkPhase = ''
+    ${python.interpreter} setup.py nosetests --verbosity=3
+  '';
+
+  meta = with stdenv.lib; {
+    description = "DEAP is a novel evolutionary computation framework for rapid prototyping and testing of ideas.";
+    homepage = https://github.com/DEAP/deap;
+    license = licenses.lgpl3;
+    maintainers = with maintainers; [ psyanticy ];
+  };
+
+}
+
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 5aea6571d2b..556ace9fb48 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -237,6 +237,8 @@ in {
 
   dbfread = callPackage ../development/python-modules/dbfread { };
 
+  deap = callPackage ../development/python-modules/deap { };
+
   dkimpy = callPackage ../development/python-modules/dkimpy { };
 
   diff_cover = callPackage ../development/python-modules/diff_cover { };

From fb7f515be795784e12c5694e8fd48f3457180264 Mon Sep 17 00:00:00 2001
From: "nagato.pain" <iuns@outlook.fr>
Date: Mon, 11 Jun 2018 05:58:49 -0700
Subject: [PATCH 126/161] pythonPackages.pynisher: init at 0.4.2

---
 .../python-modules/pynisher/default.nix       | 25 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 27 insertions(+)
 create mode 100644 pkgs/development/python-modules/pynisher/default.nix

diff --git a/pkgs/development/python-modules/pynisher/default.nix b/pkgs/development/python-modules/pynisher/default.nix
new file mode 100644
index 00000000000..f389bee2158
--- /dev/null
+++ b/pkgs/development/python-modules/pynisher/default.nix
@@ -0,0 +1,25 @@
+{ stdenv, buildPythonPackage, fetchPypi, psutil, docutils }:
+
+buildPythonPackage rec {
+  pname = "pynisher";
+  version = "0.4.2";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0sqa3zzqcr4vl5yhnafw1y187z62m4alajggc7dm2riw2ihd9kxl";
+  };
+
+  propagatedBuildInputs = [ psutil docutils ];
+
+  # no tests in the Pypi archive
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "The pynisher is a little module intended to limit a functions resources.";
+    homepage = https://github.com/sfalkner/pynisher;
+    license = licenses.mit;
+    maintainers = with maintainers; [ psyanticy ];
+  };
+
+}
+
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 5aea6571d2b..04ffcd0f5ed 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -392,6 +392,8 @@ in {
     inherit (pkgs.llvmPackages) openmp;
   };
 
+  pynisher = callPackage ../development/python-modules/pynisher { };
+
   pyparser = callPackage ../development/python-modules/pyparser { };
 
   pyqt4 = callPackage ../development/python-modules/pyqt/4.x.nix {

From 06673cba3169787611b82cdc2751c3766609f1a4 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <infinisil@icloud.com>
Date: Mon, 11 Jun 2018 21:30:36 +0200
Subject: [PATCH 127/161] fix rofi wrapper only passing along binary

---
 pkgs/applications/misc/rofi/wrapper.nix | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/pkgs/applications/misc/rofi/wrapper.nix b/pkgs/applications/misc/rofi/wrapper.nix
index 44c6f892bf5..17bbf1583c4 100644
--- a/pkgs/applications/misc/rofi/wrapper.nix
+++ b/pkgs/applications/misc/rofi/wrapper.nix
@@ -1,14 +1,19 @@
 { stdenv, rofi-unwrapped, makeWrapper, theme ? null, lib }:
 
+if theme == null then rofi-unwrapped else
 stdenv.mkDerivation {
   name = "rofi-${rofi-unwrapped.version}";
   buildInputs = [ makeWrapper ];
   preferLocalBuild = true;
-  passthru = { unwrapped = rofi-unwrapped; };
+  passthru.unwrapped = rofi-unwrapped;
   buildCommand = ''
-    mkdir -p $out/bin
-    ln -s ${rofi-unwrapped}/bin/rofi $out/bin/rofi
-    ${lib.optionalString (theme != null) ''wrapProgram $out/bin/rofi --add-flags "-theme ${theme}"''}
+    mkdir $out
+    ln -s ${rofi-unwrapped}/* $out
+    rm $out/bin
+    mkdir $out/bin
+    ln -s ${rofi-unwrapped}/bin/* $out/bin
+    rm $out/bin/rofi
+    makeWrapper ${rofi-unwrapped}/bin/rofi $out/bin/rofi --add-flags "-theme ${theme}"
   '';
 
   meta = rofi-unwrapped.meta // {

From 812decd5c1abe497d44d7752fb295b69d6eed100 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Mon, 11 Jun 2018 15:51:57 -0400
Subject: [PATCH 128/161] ghc: Default integer-simple usage based one whether
 GNU MP is available

The user's choice is still always respected
---
 pkgs/development/compilers/ghc/7.10.3.nix | 4 +---
 pkgs/development/compilers/ghc/8.0.2.nix  | 4 +---
 pkgs/development/compilers/ghc/8.2.2.nix  | 4 +---
 pkgs/development/compilers/ghc/8.4.2.nix  | 4 +---
 pkgs/development/compilers/ghc/head.nix   | 4 +---
 pkgs/development/libraries/gmp/6.x.nix    | 1 +
 pkgs/top-level/haskell-packages.nix       | 1 -
 7 files changed, 6 insertions(+), 16 deletions(-)

diff --git a/pkgs/development/compilers/ghc/7.10.3.nix b/pkgs/development/compilers/ghc/7.10.3.nix
index 2565afab334..3dd320e0257 100644
--- a/pkgs/development/compilers/ghc/7.10.3.nix
+++ b/pkgs/development/compilers/ghc/7.10.3.nix
@@ -16,7 +16,7 @@
 
 , # If enabled, GHC will be built with the GPL-free but slower integer-simple
   # library instead of the faster but GPLed integer-gmp library.
-  enableIntegerSimple ? false, gmp ? null
+  enableIntegerSimple ? !(gmp.meta.available or false), gmp
 
 , # If enabled, use -fPIC when compiling static libs.
   enableRelocatedStaticLibs ? targetPlatform != hostPlatform
@@ -30,8 +30,6 @@
   ghcFlavour ? stdenv.lib.optionalString (targetPlatform != hostPlatform) "perf-cross"
 }:
 
-assert !enableIntegerSimple -> gmp != null;
-
 let
   inherit (bootPkgs) ghc;
 
diff --git a/pkgs/development/compilers/ghc/8.0.2.nix b/pkgs/development/compilers/ghc/8.0.2.nix
index 4aa9f3fc81c..53c5a218cb1 100644
--- a/pkgs/development/compilers/ghc/8.0.2.nix
+++ b/pkgs/development/compilers/ghc/8.0.2.nix
@@ -15,7 +15,7 @@
 
 , # If enabled, GHC will be built with the GPL-free but slower integer-simple
   # library instead of the faster but GPLed integer-gmp library.
-  enableIntegerSimple ? false, gmp ? null
+  enableIntegerSimple ? !(gmp.meta.available or false), gmp
 
 , # If enabled, use -fPIC when compiling static libs.
   enableRelocatedStaticLibs ? targetPlatform != hostPlatform
@@ -29,8 +29,6 @@
   ghcFlavour ? stdenv.lib.optionalString (targetPlatform != hostPlatform) "perf-cross"
 }:
 
-assert !enableIntegerSimple -> gmp != null;
-
 let
   inherit (bootPkgs) ghc;
 
diff --git a/pkgs/development/compilers/ghc/8.2.2.nix b/pkgs/development/compilers/ghc/8.2.2.nix
index 87de0fd53f6..4e9eff06f26 100644
--- a/pkgs/development/compilers/ghc/8.2.2.nix
+++ b/pkgs/development/compilers/ghc/8.2.2.nix
@@ -16,7 +16,7 @@
 
 , # If enabled, GHC will be built with the GPL-free but slower integer-simple
   # library instead of the faster but GPLed integer-gmp library.
-  enableIntegerSimple ? false, gmp ? null
+  enableIntegerSimple ? !(gmp.meta.available or false), gmp
 
 , # If enabled, use -fPIC when compiling static libs.
   enableRelocatedStaticLibs ? targetPlatform != hostPlatform
@@ -34,8 +34,6 @@
   deterministicProfiling ? false
 }:
 
-assert !enableIntegerSimple -> gmp != null;
-
 let
   inherit (bootPkgs) ghc;
 
diff --git a/pkgs/development/compilers/ghc/8.4.2.nix b/pkgs/development/compilers/ghc/8.4.2.nix
index 9a57161d3a7..d793f0b391a 100644
--- a/pkgs/development/compilers/ghc/8.4.2.nix
+++ b/pkgs/development/compilers/ghc/8.4.2.nix
@@ -15,7 +15,7 @@
 
 , # If enabled, GHC will be built with the GPL-free but slower integer-simple
   # library instead of the faster but GPLed integer-gmp library.
-  enableIntegerSimple ? false, gmp ? null
+  enableIntegerSimple ? !(gmp.meta.available or false), gmp
 
 , # If enabled, use -fPIC when compiling static libs.
   enableRelocatedStaticLibs ? targetPlatform != hostPlatform
@@ -32,8 +32,6 @@
   ghcFlavour ? stdenv.lib.optionalString (targetPlatform != hostPlatform) "perf-cross"
 }:
 
-assert !enableIntegerSimple -> gmp != null;
-
 let
   inherit (bootPkgs) ghc;
 
diff --git a/pkgs/development/compilers/ghc/head.nix b/pkgs/development/compilers/ghc/head.nix
index c9effb90ac3..c128891ec38 100644
--- a/pkgs/development/compilers/ghc/head.nix
+++ b/pkgs/development/compilers/ghc/head.nix
@@ -15,7 +15,7 @@
 
 , # If enabled, GHC will be built with the GPL-free but slower integer-simple
   # library instead of the faster but GPLed integer-gmp library.
-  enableIntegerSimple ? false, gmp ? null
+  enableIntegerSimple ? !(gmp.meta.available or false), gmp
 
 , # If enabled, use -fPIC when compiling static libs.
   enableRelocatedStaticLibs ? targetPlatform != hostPlatform
@@ -33,8 +33,6 @@
   ghcFlavour ? stdenv.lib.optionalString (targetPlatform != hostPlatform) "perf-cross"
 }:
 
-assert !enableIntegerSimple -> gmp != null;
-
 let
   inherit (bootPkgs) ghc;
 
diff --git a/pkgs/development/libraries/gmp/6.x.nix b/pkgs/development/libraries/gmp/6.x.nix
index 551e7e5e1f6..2635aed3eac 100644
--- a/pkgs/development/libraries/gmp/6.x.nix
+++ b/pkgs/development/libraries/gmp/6.x.nix
@@ -75,6 +75,7 @@ let self = stdenv.mkDerivation rec {
          asymptotically faster algorithms.
       '';
 
+    broken = with stdenv.hostPlatform; useAndroidPrebuilt || useiOSPrebuilt;
     platforms = platforms.all;
     maintainers = [ maintainers.peti maintainers.vrthra ];
   };
diff --git a/pkgs/top-level/haskell-packages.nix b/pkgs/top-level/haskell-packages.nix
index 7ec9da39a9c..c5f0378049e 100644
--- a/pkgs/top-level/haskell-packages.nix
+++ b/pkgs/top-level/haskell-packages.nix
@@ -8,7 +8,6 @@ let
   integerSimpleExcludes = [
     "ghc7103Binary"
     "ghc821Binary"
-    "ghcCross"
     "ghcjs"
     "ghcjs710"
     "ghcjs80"

From 1ba43328da2d97c31d01a82b2e18cc9a1f3267ec Mon Sep 17 00:00:00 2001
From: Augustin Borsu <a.borsu@gmail.com>
Date: Mon, 11 Jun 2018 23:01:47 +0200
Subject: [PATCH 129/161] nextcloud: 13.03 -> 13.04 (#41859)

---
 pkgs/servers/nextcloud/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/nextcloud/default.nix b/pkgs/servers/nextcloud/default.nix
index fb43643f903..0121d748129 100644
--- a/pkgs/servers/nextcloud/default.nix
+++ b/pkgs/servers/nextcloud/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name= "nextcloud-${version}";
-  version = "13.0.3";
+  version = "13.0.4";
 
   src = fetchurl {
     url = "https://download.nextcloud.com/server/releases/${name}.tar.bz2";
-    sha256 = "1r4k3vbjxm07mlm430hmp61dx052ikgzw0bqlmg09p8011a6fdhq";
+    sha256 = "18d514145fcddc86f48d0a5fa4a0d4b07617135a1b23107137a6ea3ed519bd54";
   };
 
   installPhase = ''

From 184c31323c32110c9f82962dd73c6d2ba5a2dfc7 Mon Sep 17 00:00:00 2001
From: "nagato.pain" <iuns@outlook.fr>
Date: Mon, 11 Jun 2018 13:34:09 -0700
Subject: [PATCH 130/161] pythonPackages.spglib: init at 1.10.3.65

---
 .../python-modules/spglib/default.nix         | 27 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 29 insertions(+)
 create mode 100644 pkgs/development/python-modules/spglib/default.nix

diff --git a/pkgs/development/python-modules/spglib/default.nix b/pkgs/development/python-modules/spglib/default.nix
new file mode 100644
index 00000000000..07273d0fa0d
--- /dev/null
+++ b/pkgs/development/python-modules/spglib/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, buildPythonPackage, fetchPypi, numpy, python }:
+
+buildPythonPackage rec {
+  pname = "spglib";
+  version = "1.10.3.65";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "55b49227835396b2bcd6afe724e9f37202ad0f61e273bedebd5bf740bad2e8e3";
+  };
+
+  propagatedBuildInputs = [ numpy ];
+
+  checkPhase = ''
+    cd test
+    ${python.interpreter} -m unittest discover -bv
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Python bindings for C library for finding and handling crystal symmetries";
+    homepage = https://atztogo.github.io/spglib;
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ psyanticy ];
+  };
+
+}
+
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 5aea6571d2b..0133161c416 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -456,6 +456,8 @@ in {
 
   sip = callPackage ../development/python-modules/sip { };
 
+  spglib = callPackage ../development/python-modules/spglib { };
+
   supervise_api = callPackage ../development/python-modules/supervise_api { };
 
   syncserver = callPackage ../development/python-modules/syncserver {};

From 04f22d19ab222cd39f3c698725c443bf1d5cfeea Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Mon, 11 Jun 2018 14:05:30 -0700
Subject: [PATCH 131/161] talloc: 2.1.12 -> 2.1.13 (#41659)

Semi-automatic update generated by https://github.com/ryantm/nixpkgs-update tools.

This update was made based on information from https://repology.org/metapackage/talloc/versions.

These checks were done:

- built on NixOS

- 0 of 0 passed binary check by having a zero exit code.
- 0 of 0 passed binary check by having the new version present in output.
- found 2.1.13 with grep in /nix/store/dh0bxr8awamjll8i560hmvb4af9rwaqm-talloc-2.1.13
- directory tree listing: https://gist.github.com/46726887933b375281d7cb71039f3e5d
- du listing: https://gist.github.com/f8d42f485b4878cfa49f7d617c9f7242
---
 pkgs/development/libraries/talloc/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/talloc/default.nix b/pkgs/development/libraries/talloc/default.nix
index 1d6818276eb..e8f0d61b2f4 100644
--- a/pkgs/development/libraries/talloc/default.nix
+++ b/pkgs/development/libraries/talloc/default.nix
@@ -3,11 +3,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "talloc-2.1.12";
+  name = "talloc-2.1.13";
 
   src = fetchurl {
     url = "mirror://samba/talloc/${name}.tar.gz";
-    sha256 = "0jv0ri9vj93fczzgl7rn7xvnfgl2kfx4x85cr8h8v52yh7v0qz4q";
+    sha256 = "0iv09iv385x69gfzvassq6m3y0rd8ncylls95dm015xdy3drkww4";
   };
 
   nativeBuildInputs = [ pkgconfig ];

From c41705f87cd3d6139410f1b1a81d941c8fdeecd4 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Mon, 11 Jun 2018 14:11:03 -0700
Subject: [PATCH 132/161] fvwm: 2.6.7 -> 2.6.8 (#41565)

Semi-automatic update generated by https://github.com/ryantm/nixpkgs-update tools.

This update was made based on information from https://repology.org/metapackage/fvwm/versions.

These checks were done:

- built on NixOS
- /nix/store/kycw0a7gqxh0v7lxq001j9sjysnz1v6h-fvwm-2.6.8/bin/fvwm2 passed the binary check.
- /nix/store/kycw0a7gqxh0v7lxq001j9sjysnz1v6h-fvwm-2.6.8/bin/fvwm-perllib passed the binary check.
- /nix/store/kycw0a7gqxh0v7lxq001j9sjysnz1v6h-fvwm-2.6.8/bin/fvwm-convert-2.6 passed the binary check.
- /nix/store/kycw0a7gqxh0v7lxq001j9sjysnz1v6h-fvwm-2.6.8/bin/fvwm-menu-xlock passed the binary check.
- /nix/store/kycw0a7gqxh0v7lxq001j9sjysnz1v6h-fvwm-2.6.8/bin/fvwm-menu-directory passed the binary check.
- Warning: no invocation of /nix/store/kycw0a7gqxh0v7lxq001j9sjysnz1v6h-fvwm-2.6.8/bin/fvwm-menu-desktop had a zero exit code or showed the expected version
- /nix/store/kycw0a7gqxh0v7lxq001j9sjysnz1v6h-fvwm-2.6.8/bin/fvwm-menu-headlines passed the binary check.
- Warning: no invocation of /nix/store/kycw0a7gqxh0v7lxq001j9sjysnz1v6h-fvwm-2.6.8/bin/xpmroot had a zero exit code or showed the expected version
- /nix/store/kycw0a7gqxh0v7lxq001j9sjysnz1v6h-fvwm-2.6.8/bin/fvwm passed the binary check.
- /nix/store/kycw0a7gqxh0v7lxq001j9sjysnz1v6h-fvwm-2.6.8/bin/FvwmCommand passed the binary check.
- Warning: no invocation of /nix/store/kycw0a7gqxh0v7lxq001j9sjysnz1v6h-fvwm-2.6.8/bin/fvwm-root had a zero exit code or showed the expected version
- /nix/store/kycw0a7gqxh0v7lxq001j9sjysnz1v6h-fvwm-2.6.8/bin/fvwm-config passed the binary check.
- /nix/store/kycw0a7gqxh0v7lxq001j9sjysnz1v6h-fvwm-2.6.8/bin/fvwm-bug passed the binary check.
- 10 of 13 passed binary check by having a zero exit code.
- 3 of 13 passed binary check by having the new version present in output.
- found 2.6.8 with grep in /nix/store/kycw0a7gqxh0v7lxq001j9sjysnz1v6h-fvwm-2.6.8
- directory tree listing: https://gist.github.com/94e21d8ab3a4808980c94f1fbb20f1b6
- du listing: https://gist.github.com/6db3d3e079f7808b93a1bbc20e5f396e
---
 pkgs/applications/window-managers/fvwm/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/window-managers/fvwm/default.nix b/pkgs/applications/window-managers/fvwm/default.nix
index 0b9c286aa9d..20a95f36cee 100644
--- a/pkgs/applications/window-managers/fvwm/default.nix
+++ b/pkgs/applications/window-managers/fvwm/default.nix
@@ -9,12 +9,12 @@ assert gestures -> libstroke != null;
 
 stdenv.mkDerivation rec {
   pname = "fvwm";
-  version = "2.6.7";
+  version = "2.6.8";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "https://github.com/fvwmorg/fvwm/releases/download/${version}/${name}.tar.gz";
-    sha256 = "01654d5abdcde6dac131cae9befe5cf6f01f9f7524d097c3b0f316e39f84ef73";
+    sha256 = "0hgkkdzcqjnaabvv9cnh0bz90nnjskbhjg9qnzpi2x0mbliwjdpv";
   };
 
   nativeBuildInputs = [ pkgconfig ];

From fe8c812b47d64716184a24211a8fd20ba4672f86 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Mon, 11 Jun 2018 14:12:15 -0700
Subject: [PATCH 133/161] guake: 3.2.1 -> 3.2.2 (#41705)

Semi-automatic update generated by https://github.com/ryantm/nixpkgs-update tools.

This update was made based on information from https://repology.org/metapackage/guake/versions.

These checks were done:

- built on NixOS
- /nix/store/6bf1rgshbaq4696dch9py3ngz96f9k5a-guake-3.2.2/bin/guake passed the binary check.
- /nix/store/6bf1rgshbaq4696dch9py3ngz96f9k5a-guake-3.2.2/bin/..guake-wrapped-wrapped passed the binary check.
- /nix/store/6bf1rgshbaq4696dch9py3ngz96f9k5a-guake-3.2.2/bin/.guake-wrapped passed the binary check.
- 3 of 3 passed binary check by having a zero exit code.
- 0 of 3 passed binary check by having the new version present in output.
- found 3.2.2 with grep in /nix/store/6bf1rgshbaq4696dch9py3ngz96f9k5a-guake-3.2.2
- directory tree listing: https://gist.github.com/f55ea51bdc3ebebdb32210c0cae4f235
- du listing: https://gist.github.com/6b55cea09584855b2518fdc90469b1bf
---
 pkgs/applications/misc/guake/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/misc/guake/default.nix b/pkgs/applications/misc/guake/default.nix
index c34f0e48f3e..dc9b0c29aa1 100644
--- a/pkgs/applications/misc/guake/default.nix
+++ b/pkgs/applications/misc/guake/default.nix
@@ -2,7 +2,7 @@
 , gtk3, keybinder3, libnotify, libutempter, vte }:
 
 let
-  version = "3.2.1";
+  version = "3.2.2";
 in python3.pkgs.buildPythonApplication rec {
   name = "guake-${version}";
   format = "other";
@@ -11,7 +11,7 @@ in python3.pkgs.buildPythonApplication rec {
     owner = "Guake";
     repo = "guake";
     rev = version;
-    sha256 = "0qzrkmjizpc3kirvhml62wya1sr3pbig25nfcrfhk1hhr3jxq17s";
+    sha256 = "1wx8vghn0h52xryyn6cf9z1lbwsk766lhff162szbaxlxyl6xsc0";
   };
 
   nativeBuildInputs = [ gettext gobjectIntrospection wrapGAppsHook python3.pkgs.pip glibcLocales ];

From 8df3b7225f5735198845954bfe88aceedfdb5598 Mon Sep 17 00:00:00 2001
From: Vladyslav Mykhailichenko <dywedir@pm.me>
Date: Tue, 12 Jun 2018 01:10:56 +0300
Subject: [PATCH 134/161] hyperfine: 1.0.0 -> 1.1.0

---
 pkgs/tools/misc/hyperfine/default.nix | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/pkgs/tools/misc/hyperfine/default.nix b/pkgs/tools/misc/hyperfine/default.nix
index 0b04ee1e281..d9c255d2a7a 100644
--- a/pkgs/tools/misc/hyperfine/default.nix
+++ b/pkgs/tools/misc/hyperfine/default.nix
@@ -1,16 +1,14 @@
 { stdenv, fetchFromGitHub, rustPlatform }:
 
-with rustPlatform;
-
-buildRustPackage rec {
+rustPlatform.buildRustPackage rec {
   name = "hyperfine-${version}";
-  version = "1.0.0";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner  = "sharkdp";
     repo   = "hyperfine";
     rev    = "refs/tags/v${version}";
-    sha256 = "0prmnhyp20w71l3mjqgdr38q94cqr1xayzgj7ibbq2hdick4w5nn";
+    sha256 = "13h43sjp059yq3bmdbb9i1082fkx5yzmhrkf5kpkxhnyn67xbdsg";
   };
 
   cargoSha256 = "0saf0hl21ba2ckqbsw64908nvs0x1rjrnm73ackzpmv5pi9j567s";

From 4b649a99d8461c980e7028a693387dc48033c1f7 Mon Sep 17 00:00:00 2001
From: Matthew Justin Bauer <mjbauer95@gmail.com>
Date: Mon, 11 Jun 2018 18:55:44 -0400
Subject: [PATCH 135/161] openzwave: disable format hardening

Closes #41865

Thanks to @cawilliamso
---
 pkgs/development/libraries/openzwave/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/libraries/openzwave/default.nix b/pkgs/development/libraries/openzwave/default.nix
index 63c51996b22..087a22dd61b 100644
--- a/pkgs/development/libraries/openzwave/default.nix
+++ b/pkgs/development/libraries/openzwave/default.nix
@@ -19,6 +19,8 @@ in stdenv.mkDerivation rec {
 
   buildInputs = [ systemd ];
 
+  hardeningDisable = [ "format" ];
+
   enableParallelBuilding = true;
 
   installPhase = ''

From 3808c0a76297061f44267189adf01fe6ef75a2b6 Mon Sep 17 00:00:00 2001
From: Lev <lev@singularitynet.io>
Date: Mon, 11 Jun 2018 15:56:55 -0700
Subject: [PATCH 136/161] go-ethereum: 1.8.8 -> 1.8.10

---
 pkgs/applications/altcoins/go-ethereum.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/altcoins/go-ethereum.nix b/pkgs/applications/altcoins/go-ethereum.nix
index 021764f5023..9917ffdf9c0 100644
--- a/pkgs/applications/altcoins/go-ethereum.nix
+++ b/pkgs/applications/altcoins/go-ethereum.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "go-ethereum-${version}";
-  version = "1.8.8";
+  version = "1.8.10";
   goPackagePath = "github.com/ethereum/go-ethereum";
 
   # Fix for usb-related segmentation faults on darwin
@@ -27,7 +27,7 @@ buildGoPackage rec {
     owner = "ethereum";
     repo = "go-ethereum";
     rev = "v${version}";
-    sha256 = "059nd2jvklziih679dd4cd34xjpj1ci7fha83wv86xjz61awyb16";
+    sha256 = "1n36pz4y3xa4d46mynym98bra79qx5n9lb29chyxfpvi5fmprdg1";
   };
 
   meta = with stdenv.lib; {

From 0eb9b21f707be41bfe4b85c13965344e1fa36820 Mon Sep 17 00:00:00 2001
From: Will Dietz <w@wdtz.org>
Date: Mon, 11 Jun 2018 17:58:45 -0500
Subject: [PATCH 137/161] diffoscope: 91 -> 95

---
 pkgs/tools/misc/diffoscope/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/misc/diffoscope/default.nix b/pkgs/tools/misc/diffoscope/default.nix
index 1987c6aed0a..e2e2f66f558 100644
--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@@ -8,12 +8,12 @@
 
 python3Packages.buildPythonApplication rec {
   name = "diffoscope-${version}";
-  version = "91";
+  version = "95";
 
   src = fetchgit {
     url    = "https://anonscm.debian.org/git/reproducible/diffoscope.git";
     rev    = "refs/tags/${version}";
-    sha256 = "16xqy71115cj4kws6bkcjm98nlaff3a32fz82rn2l1xk9w9n3dnz";
+    sha256 = "1x06krs3lp41x5w2l8ck8g47il3qzlclyphw9a2wv71sqkb5zxzi";
   };
 
   patches = [

From 47348e20d1cc80066724e7d7569215c35799500d Mon Sep 17 00:00:00 2001
From: Cole Mickens <cole.mickens@gmail.com>
Date: Mon, 11 Jun 2018 17:43:18 -0700
Subject: [PATCH 138/161] neovim: 0.2.2 -> 0.3.0

---
 pkgs/applications/editors/neovim/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/neovim/default.nix b/pkgs/applications/editors/neovim/default.nix
index b090b0c84f9..f1d0a023798 100644
--- a/pkgs/applications/editors/neovim/default.nix
+++ b/pkgs/applications/editors/neovim/default.nix
@@ -11,13 +11,13 @@ let
 
   neovim = stdenv.mkDerivation rec {
     name = "neovim-unwrapped-${version}";
-    version = "0.2.2";
+    version = "0.3.0";
 
     src = fetchFromGitHub {
       owner = "neovim";
       repo = "neovim";
       rev = "v${version}";
-      sha256 = "1dxr29d0hyag7snbww5s40as90412qb61rgj7gd9rps1iccl9gv4";
+      sha256 = "10c8y309fdwvr3d9n6vm1f2c0k6pzicnhc64l2dvbw1lnabp04vv";
     };
 
     enableParallelBuilding = true;

From 04d3e130b8d11f046bae38be9731900e92cb0d1c Mon Sep 17 00:00:00 2001
From: adisbladis <adis@blad.is>
Date: Tue, 12 Jun 2018 14:09:31 +0800
Subject: [PATCH 139/161] pythonPackages.warrant: Fix compat with pip 10

Fixes #41866
---
 pkgs/development/python-modules/warrant/default.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/warrant/default.nix b/pkgs/development/python-modules/warrant/default.nix
index ac83430fbae..c152271af33 100644
--- a/pkgs/development/python-modules/warrant/default.nix
+++ b/pkgs/development/python-modules/warrant/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchFromGitHub, fetchPypi
+{ lib, buildPythonPackage, fetchFromGitHub, fetchPypi, fetchpatch
 , mock
 , boto3, envs, python-jose, requests }:
 
@@ -14,6 +14,14 @@ buildPythonPackage rec {
     sha256 = "0gw3crg64p1zx3k5js0wh0x5bldgs7viy4g8hld9xbka8q0374hi";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "fix-pip10-compat.patch";
+      url = " https://github.com/capless/warrant/commit/ae17d17d9888b9218a8facf6f6ad0bf4adae9a12.patch";
+      sha256 = "1lvqi2qfa3kxdz05ab2lc7xnd3piyvvnz9kla2jl4pchi876z17c";
+    })
+  ];
+
   # this needs to go when 0.6.2 or later is released
   postPatch = ''
     substituteInPlace requirements.txt \

From 7e1f9da6bce9352bed5cb1af829f2b6b24876f11 Mon Sep 17 00:00:00 2001
From: Jean-Philippe Bernardy <jeanphilippe.bernardy@gmail.com>
Date: Tue, 12 Jun 2018 09:11:56 +0200
Subject: [PATCH 140/161] python.packages.tensorflow: repair postFixup phase

Remove an extra dot.
Fixes #41163
---
 pkgs/development/python-modules/tensorflow/bin.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/tensorflow/bin.nix b/pkgs/development/python-modules/tensorflow/bin.nix
index 785cff5b8b7..21b21f174d0 100644
--- a/pkgs/development/python-modules/tensorflow/bin.nix
+++ b/pkgs/development/python-modules/tensorflow/bin.nix
@@ -71,7 +71,7 @@ in buildPythonPackage rec {
   lib.optionalString (stdenv.isLinux) ''
     rrPath="$out/${python.sitePackages}/tensorflow/:${rpath}"
     internalLibPath="$out/${python.sitePackages}/tensorflow/python/_pywrap_tensorflow_internal.so"
-    find $out -name '*.${stdenv.hostPlatform.extensions.sharedLibrary}' -exec patchelf --set-rpath "$rrPath" {} \;
+    find $out -name '*${stdenv.hostPlatform.extensions.sharedLibrary}' -exec patchelf --set-rpath "$rrPath" {} \;
   '';
 
 

From a44a9fdad612aff807239cd72eb765a6f6350b1b Mon Sep 17 00:00:00 2001
From: Cole Mickens <cole.mickens@gmail.com>
Date: Tue, 12 Jun 2018 02:03:23 -0700
Subject: [PATCH 141/161] azure: stop carrying qemu-220 patch

---
 nixos/modules/virtualisation/azure-image.nix       |  4 ++--
 .../azure-qemu-220-no-etc-install.patch            | 14 --------------
 pkgs/build-support/vm/default.nix                  | 10 ----------
 pkgs/tools/admin/azure-cli/default.nix             |  0
 4 files changed, 2 insertions(+), 26 deletions(-)
 delete mode 100644 nixos/modules/virtualisation/azure-qemu-220-no-etc-install.patch
 create mode 100644 pkgs/tools/admin/azure-cli/default.nix

diff --git a/nixos/modules/virtualisation/azure-image.nix b/nixos/modules/virtualisation/azure-image.nix
index cb756842f36..dd2108ccc37 100644
--- a/nixos/modules/virtualisation/azure-image.nix
+++ b/nixos/modules/virtualisation/azure-image.nix
@@ -2,13 +2,13 @@
 
 with lib;
 let
-  diskSize = 30720;
+  diskSize = 2048;
 in
 {
   system.build.azureImage = import ../../lib/make-disk-image.nix {
     name = "azure-image";
     postVM = ''
-      ${pkgs.vmTools.qemu-220}/bin/qemu-img convert -f raw -o subformat=fixed -O vpc $diskImage $out/disk.vhd
+      ${pkgs.vmTools.qemu}/bin/qemu-img convert -f raw -o subformat=fixed,force_size -O vpc $diskImage $out/disk.vhd
     '';
     configFile = ./azure-config-user.nix;
     format = "raw";
diff --git a/nixos/modules/virtualisation/azure-qemu-220-no-etc-install.patch b/nixos/modules/virtualisation/azure-qemu-220-no-etc-install.patch
deleted file mode 100644
index 81d29feea3d..00000000000
--- a/nixos/modules/virtualisation/azure-qemu-220-no-etc-install.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff --git a/Makefile b/Makefile
-index d6b9dc1..ce7c493 100644
---- a/Makefile
-+++ b/Makefile
-@@ -384,8 +384,7 @@ install-confdir:
- install-sysconfig: install-datadir install-confdir
- 	$(INSTALL_DATA) $(SRC_PATH)/sysconfigs/target/target-x86_64.conf "$(DESTDIR)$(qemu_confdir)"
- 
--install: all $(if $(BUILD_DOCS),install-doc) install-sysconfig \
--install-datadir install-localstatedir
-+install: all $(if $(BUILD_DOCS),install-doc) install-datadir
- ifneq ($(TOOLS),)
- 	$(call install-prog,$(TOOLS),$(DESTDIR)$(bindir))
- endif
diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index 622fba0686f..9cdcc2a752d 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -14,16 +14,6 @@ rec {
 
   qemu = pkgs.qemu_kvm;
 
-  qemu-220 = lib.overrideDerivation pkgs.qemu_kvm (attrs: rec {
-    version = "2.2.0";
-    src = fetchurl {
-      url = "http://wiki.qemu.org/download/qemu-${version}.tar.bz2";
-      sha256 = "1703c3scl5n07gmpilg7g2xzyxnr7jczxgx6nn4m8kv9gin9p35n";
-    };
-    patches = [ ../../../nixos/modules/virtualisation/azure-qemu-220-no-etc-install.patch ];
-  });
-
-
   modulesClosure = makeModulesClosure {
     inherit kernel rootModules;
     firmware = kernel;
diff --git a/pkgs/tools/admin/azure-cli/default.nix b/pkgs/tools/admin/azure-cli/default.nix
new file mode 100644
index 00000000000..e69de29bb2d

From b494ef4db685b7abb3cb4618aa6efdcf341f5ff0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Tue, 12 Jun 2018 10:16:55 +0100
Subject: [PATCH 142/161] neovim: add missing libiconv

---
 pkgs/applications/editors/neovim/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/editors/neovim/default.nix b/pkgs/applications/editors/neovim/default.nix
index f1d0a023798..f47688b8280 100644
--- a/pkgs/applications/editors/neovim/default.nix
+++ b/pkgs/applications/editors/neovim/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, gettext, libmsgpack, libtermkey
+{ stdenv, fetchFromGitHub, cmake, gettext, libmsgpack, libtermkey, libiconv
 , libtool, libuv, luaPackages, ncurses, perl, pkgconfig
 , unibilium, vimUtils, xsel, gperf, callPackage
 , libvterm-neovim
@@ -32,6 +32,7 @@ let
       luaPackages.lua
       gperf
     ] ++ optional withJemalloc jemalloc
+      ++ optional stdenv.isDarwin libiconv
       ++ lualibs;
 
     nativeBuildInputs = [

From 6fb9d1121a529e33100abe670ad40119079794db Mon Sep 17 00:00:00 2001
From: Simon Lackerbauer <simon@lackerbauer.com>
Date: Tue, 12 Jun 2018 12:11:40 +0200
Subject: [PATCH 143/161] gshogi: init at 0.5.1 (#41840)

---
 pkgs/games/gshogi/default.nix   | 37 +++++++++++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix |  2 ++
 2 files changed, 39 insertions(+)
 create mode 100644 pkgs/games/gshogi/default.nix

diff --git a/pkgs/games/gshogi/default.nix b/pkgs/games/gshogi/default.nix
new file mode 100644
index 00000000000..9759eb8956a
--- /dev/null
+++ b/pkgs/games/gshogi/default.nix
@@ -0,0 +1,37 @@
+{ stdenv, buildPythonApplication, fetchFromGitHub
+, gtk3, gobjectIntrospection
+, wrapGAppsHook, python3Packages }:
+
+buildPythonApplication rec {
+  pname = "gshogi";
+  version = "0.5.1";
+
+  src = fetchFromGitHub {
+    owner = "johncheetham";
+    repo = "gshogi";
+    rev = "v${version}";
+    sha256 = "06vgndfgwyfi50wg3cw92zspc9z0k7xn2pp6qsjih0l5yih8iwqh";
+  };
+
+  doCheck = false;  # no tests available
+
+  buildInputs = [
+    gtk3
+    gobjectIntrospection
+  ];
+
+  nativeBuildInputs = [ wrapGAppsHook ];
+
+  propagatedBuildInputs = with python3Packages; [
+    pygobject3
+    pycairo
+  ];
+
+  meta = with stdenv.lib; {
+    description = "A graphical implementation of the Shogi board game, also known as Japanese Chess";
+    homepage = http://johncheetham.com/projects/gshogi/;
+    license = licenses.gpl3;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.ciil ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d652824d8b9..10c6e2bbce1 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -19326,6 +19326,8 @@ with pkgs;
 
   gogui = callPackage ../games/gogui {};
 
+  gshogi = python3Packages.callPackage ../games/gshogi {};
+
   gtetrinet = callPackage ../games/gtetrinet {
     inherit (gnome2) GConf libgnome libgnomeui;
   };

From dbdad4b44ba9866223a402d3df5969519d2366ab Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <Mic92@users.noreply.github.com>
Date: Tue, 12 Jun 2018 13:21:56 +0100
Subject: [PATCH 144/161] maintainers/create-azure.sh: remove hydra.nixos.org
 as binary cache (#41883)

---
 nixos/maintainers/scripts/azure/create-azure.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/maintainers/scripts/azure/create-azure.sh b/nixos/maintainers/scripts/azure/create-azure.sh
index a834566be8f..2b22cb53661 100755
--- a/nixos/maintainers/scripts/azure/create-azure.sh
+++ b/nixos/maintainers/scripts/azure/create-azure.sh
@@ -5,4 +5,4 @@ export NIXOS_CONFIG=$(dirname $(readlink -f $0))/../../../modules/virtualisation
 export TIMESTAMP=$(date +%Y%m%d%H%M)
 
 nix-build '<nixpkgs/nixos>' \
-   -A config.system.build.azureImage --argstr system x86_64-linux -o azure --option extra-binary-caches https://hydra.nixos.org -j 10
+   -A config.system.build.azureImage --argstr system x86_64-linux -o azure -j 10

From b25a2c961466c152f27830022c4d4e645d5e5584 Mon Sep 17 00:00:00 2001
From: volth <volth@webmaster.ms>
Date: Tue, 12 Jun 2018 12:29:25 +0000
Subject: [PATCH 145/161] nixos/unbound: add restart (#41885)

---
 nixos/modules/services/networking/unbound.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/services/networking/unbound.nix b/nixos/modules/services/networking/unbound.nix
index f069a9883a7..07936faaa13 100644
--- a/nixos/modules/services/networking/unbound.nix
+++ b/nixos/modules/services/networking/unbound.nix
@@ -60,7 +60,7 @@ in
       };
 
       interfaces = mkOption {
-        default = [ "127.0.0.1" "::1" ];
+        default = [ "127.0.0.1" ] ++ optional config.networking.enableIPv6 "::1";
         type = types.listOf types.str;
         description = "What addresses the server should listen on.";
       };
@@ -112,8 +112,8 @@ in
         mkdir -m 0755 -p ${stateDir}/dev/
         cp ${confFile} ${stateDir}/unbound.conf
         ${optionalString cfg.enableRootTrustAnchor ''
-        ${pkgs.unbound}/bin/unbound-anchor -a ${rootTrustAnchorFile} || echo "Root anchor updated!"
-        chown unbound ${stateDir} ${rootTrustAnchorFile}
+          ${pkgs.unbound}/bin/unbound-anchor -a ${rootTrustAnchorFile} || echo "Root anchor updated!"
+          chown unbound ${stateDir} ${rootTrustAnchorFile}
         ''}
         touch ${stateDir}/dev/random
         ${pkgs.utillinux}/bin/mount --bind -n /dev/urandom ${stateDir}/dev/random
@@ -126,6 +126,8 @@ in
         ProtectSystem = true;
         ProtectHome = true;
         PrivateDevices = true;
+        Restart = "always";
+        RestartSec = "5s";
       };
     };
 

From f077e5f87ccf7387c7df3e7fe6ba329be9b5addb Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Tue, 12 Jun 2018 08:54:55 -0400
Subject: [PATCH 146/161] linux: 4.14.48 -> 4.14.49

---
 pkgs/os-specific/linux/kernel/linux-4.14.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 8acc374b2d4..79bc8e51093 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.48";
+  version = "4.14.49";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1f92pz92mf0x9jfv3qf4w40i78l053f2qh2n8p2sbrqzc67n1840";
+    sha256 = "1xrvklrh0zf3ma61qkbng2495j4bcvif45l8bm5074pk3rrlk7y6";
   };
 } // (args.argsOverride or {}))

From 388b57ac87d11791dc7055fed4ced12d62ec244d Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Tue, 12 Jun 2018 08:55:05 -0400
Subject: [PATCH 147/161] linux: 4.16.14 -> 4.16.15

---
 pkgs/os-specific/linux/kernel/linux-4.16.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-4.16.nix b/pkgs/os-specific/linux/kernel/linux-4.16.nix
index 0a06c4dd434..2643faac48a 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.16.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.16.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.16.14";
+  version = "4.16.15";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1h6zjnwpdyqk9fp72c35565lhw00kpjl55faakwx7xsxfpyvc25p";
+    sha256 = "0v13g5ancr85hr24y7xagjn9w168h2d87m4m4hr4a2i45mrsdwjq";
   };
 } // (args.argsOverride or {}))

From 91cda44cf9ed208e24fd5b80c1d7df2886cfba2a Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Tue, 12 Jun 2018 08:55:21 -0400
Subject: [PATCH 148/161] linux: 4.17 -> 4.17.1

---
 pkgs/os-specific/linux/kernel/linux-4.17.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-4.17.nix b/pkgs/os-specific/linux/kernel/linux-4.17.nix
index b360e98f0c0..ca8abcc0ef1 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.17.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.17.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.17";
+  version = "4.17.1";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "04yd7hnsdyaq4xmrgg7509qjf09k1dy6k1p8qqfrdspajvc1valz";
+    sha256 = "0w3hma7k4nwjp1zsfgn2i18dsmmdn1lxccqx3vapwsz6pjy3ygy9";
   };
 } // (args.argsOverride or {}))

From d79a5057d3cad9f3bca569c39090e06114d75946 Mon Sep 17 00:00:00 2001
From: volth <volth@webmaster.ms>
Date: Tue, 12 Jun 2018 13:14:15 +0000
Subject: [PATCH 149/161] nixos/nat: optional networking.nat.externalInterface
 (#41864)

to prevent "cannot coerce null to string" raise before the assertions are checked
---
 nixos/modules/services/networking/nat.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/networking/nat.nix b/nixos/modules/services/networking/nat.nix
index c27ae3f66f6..89d8590093d 100644
--- a/nixos/modules/services/networking/nat.nix
+++ b/nixos/modules/services/networking/nat.nix
@@ -50,7 +50,7 @@ let
     # NAT from external ports to internal ports.
     ${concatMapStrings (fwd: ''
       iptables -w -t nat -A nixos-nat-pre \
-        -i ${cfg.externalInterface} -p ${fwd.proto} \
+        -i ${toString cfg.externalInterface} -p ${fwd.proto} \
         --dport ${builtins.toString fwd.sourcePort} \
         -j DNAT --to-destination ${fwd.destination}
 
@@ -81,7 +81,7 @@ let
 
     ${optionalString (cfg.dmzHost != null) ''
       iptables -w -t nat -A nixos-nat-pre \
-        -i ${cfg.externalInterface} -j DNAT \
+        -i ${toString cfg.externalInterface} -j DNAT \
         --to-destination ${cfg.dmzHost}
     ''}
 

From 35191af2e65c84eb5b5fcd49473891ddba5aa91b Mon Sep 17 00:00:00 2001
From: Andrea Bedini <andreabedini@users.noreply.github.com>
Date: Tue, 12 Jun 2018 21:15:06 +0800
Subject: [PATCH 150/161] aws-sam-cli: init at 0.3.0 (#41877)

---
 .../development/tools/aws-sam-cli/default.nix | 37 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 +
 2 files changed, 39 insertions(+)
 create mode 100644 pkgs/development/tools/aws-sam-cli/default.nix

diff --git a/pkgs/development/tools/aws-sam-cli/default.nix b/pkgs/development/tools/aws-sam-cli/default.nix
new file mode 100644
index 00000000000..85307d58704
--- /dev/null
+++ b/pkgs/development/tools/aws-sam-cli/default.nix
@@ -0,0 +1,37 @@
+{ lib
+, python
+}:
+
+with python;
+
+pkgs.buildPythonApplication rec {
+  pname = "aws-sam-cli";
+  version = "0.3.0";
+
+  src = pkgs.fetchPypi {
+    inherit pname version;
+    sha256 = "7e7275a34e7e9d926198fd9516404310faa2a9681b7a8b0c8b2f9aa31aeb1bfb";
+  };
+
+  # Tests are not included in the PyPI package
+  doCheck = false;
+
+  propagatedBuildInputs = with pkgs; [
+    aws-sam-translator
+    boto3
+    click
+    cookiecutter
+    docker
+    enum34
+    flask
+    pyyaml
+    six
+  ];
+
+  meta = with lib; {
+    homepage = https://github.com/awslabs/aws-sam-cli;
+    description = "CLI tool for local development and testing of Serverless applications";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ andreabedini ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 10c6e2bbce1..b034411921b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -571,6 +571,8 @@ with pkgs;
 
   aws_shell = pythonPackages.callPackage ../tools/admin/aws_shell { };
 
+  aws-sam-cli = callPackage ../development/tools/aws-sam-cli { };
+
   aws-vault = callPackage ../tools/admin/aws-vault { };
 
   iamy = callPackage ../tools/admin/iamy { };

From 499a9dabaaa12cb1a5a8732d80eca49cd9893bfb Mon Sep 17 00:00:00 2001
From: Michael Weiss <dev.primeos@gmail.com>
Date: Tue, 12 Jun 2018 15:36:47 +0200
Subject: [PATCH 151/161] gns3Packages.{server,gui}{Stable,Preview}: 2.1.6 ->
 2.1.7

---
 pkgs/applications/networking/gns3/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/gns3/default.nix b/pkgs/applications/networking/gns3/default.nix
index 91bcfc73f2c..9123477bb3e 100644
--- a/pkgs/applications/networking/gns3/default.nix
+++ b/pkgs/applications/networking/gns3/default.nix
@@ -1,7 +1,7 @@
 { callPackage, stdenv }:
 
 let
-  stableVersion = "2.1.6";
+  stableVersion = "2.1.7";
   # Currently there is no preview version.
   previewVersion = stableVersion;
   addVersion = args:
@@ -10,8 +10,8 @@ let
     in args // { inherit version branch; };
   mkGui = args: callPackage (import ./gui.nix (addVersion args)) { };
   mkServer = args: callPackage (import ./server.nix (addVersion args)) { };
-  guiSrcHash = "0wrh0x5ig2x2pxyyf99z4bfiyxn19akyjic5kgf0pv2snifw2481";
-  serverSrcHash = "0jy5700bshz54mdsh5qpcb2qrczg9isxhr4y0bmglrl23pywvisc";
+  guiSrcHash = "10zf429zjzf7v4y9r7mmkp42kh5ppmqinhvwqzb7jmsrpv2cnxj6";
+  serverSrcHash = "056swz6ygqdi37asah51v1yy0ky8q0p32vf7dxs697hd7nv78aqj";
 in {
   guiStable = mkGui {
     stable = true;

From 92ab620a4cb9bfa674c8ca17c226b4be97023076 Mon Sep 17 00:00:00 2001
From: Michael Weiss <dev.primeos@gmail.com>
Date: Tue, 12 Jun 2018 15:48:07 +0200
Subject: [PATCH 152/161] tdesktop: 1.3.0 -> 1.3.7

tdesktopPackages.preview: 1.3.4 -> 1.3.7
---
 .../instant-messengers/telegram/tdesktop/default.nix        | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
index 071f82a8cbe..3e0e60594f8 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
@@ -4,8 +4,8 @@ let
   mkTelegram = args: qt5.callPackage (import ./generic.nix args) { };
   stableVersion = {
     stable = true;
-    version = "1.3.0";
-    sha256Hash = "1h5zcvd58bjm02b0rfb7fx1nx1gmzdlk1854lm6kg1hd6mqrrb0i";
+    version = "1.3.7";
+    sha256Hash = "1rwnqgla061icvyvw8gxqd7qki1jnq0f46hvyffp74ng5r1b6wjg";
     # svn log svn://svn.archlinux.org/community/telegram-desktop/trunk
     archPatchesRevision = "310557";
     archPatchesHash = "1v134dal3xiapgh3akfr61vh62j24m9vkb62kckwvap44iqb0hlk";
@@ -14,7 +14,5 @@ in {
   stable = mkTelegram stableVersion;
   preview = mkTelegram (stableVersion // {
     stable = false;
-    version = "1.3.4";
-    sha256Hash = "17xdzyl7jb5g69a2h6fyk67z7s6h2dqjg8j478px6n0br1n420wk";
   });
 }

From fb5e8a87a06c34448c318015acabb6d5d1b00c6e Mon Sep 17 00:00:00 2001
From: Michael Weiss <dev.primeos@gmail.com>
Date: Tue, 12 Jun 2018 15:52:13 +0200
Subject: [PATCH 153/161] androidStudioPackages.{dev,canary}: 3.2.0.16 ->
 3.2.0.17

---
 pkgs/applications/editors/android-studio/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index 5e37ba47fa5..ea5dce4fa1a 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -13,9 +13,9 @@ let
     sha256Hash = "196yaswbxh2nd83gimjxr8ggr5xkdxq7n3xlh6ax73v59pj4hryq";
   };
   latestVersion = {
-    version = "3.2.0.16"; # "Android Studio 3.2 Canary 17"
-    build = "181.4823740";
-    sha256Hash = "04282zd28kn2a4rjsi0ikx4bc9ab668xm7cc87ga60pzyg5gmmgk";
+    version = "3.2.0.17"; # "Android Studio 3.2 Canary 18"
+    build = "181.4830125";
+    sha256Hash = "14yarl1vqhy21ljrn5k2dy8z0y407g9nqw4lqzjbxb7zmascnlx4";
   };
 in rec {
   # Old alias

From ce0f4a1b9383667ad6ac6c2b61a435e0bf650892 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Tue, 12 Jun 2018 10:09:43 -0700
Subject: [PATCH 154/161] libupnp: 1.6.21 -> 1.8.3 (#41684)

Semi-automatic update generated by https://github.com/ryantm/nixpkgs-update tools.

This update was made based on information from https://repology.org/metapackage/libupnp/versions.

These checks were done:

- built on NixOS

- 0 of 0 passed binary check by having a zero exit code.
- 0 of 0 passed binary check by having the new version present in output.
- found 1.8.3 with grep in /nix/store/ymhnn5lpxcs62nkzd1m42yaqqa7iwy66-libupnp-1.8.3
- directory tree listing: https://gist.github.com/c259447b3ed649aa6f8b474103c44f2c
- du listing: https://gist.github.com/4c95913fe86ccf5adf874748002bc31d
---
 pkgs/development/libraries/pupnp/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/pupnp/default.nix b/pkgs/development/libraries/pupnp/default.nix
index fd738faf507..018a57ad057 100644
--- a/pkgs/development/libraries/pupnp/default.nix
+++ b/pkgs/development/libraries/pupnp/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "libupnp-${version}";
-  version = "1.6.21";
+  version = "1.8.3";
 
   src = fetchFromGitHub {
     owner = "mrjimenez";
     repo = "pupnp";
     rev = "release-${version}";
-    sha256 = "07ksfhadinaa20542gblrxi9pqz0v6y70a836hp3qr4037id4nm9";
+    sha256 = "1w0kfq1pg3y2wl6gwkm1w872g0qz29w1z9wj08xxmwnk5mkpvsrl";
   };
 
   nativeBuildInputs = [ autoreconfHook ];

From 7cb01d58b22a163e2075c567ef6f470d5d5a2f99 Mon Sep 17 00:00:00 2001
From: Ben Wolsieffer <benwolsieffer@gmail.com>
Date: Sun, 27 May 2018 12:19:39 -0400
Subject: [PATCH 155/161] platforms/raspberrypi: enable kernelAutoModules

---
 lib/systems/platforms.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/systems/platforms.nix b/lib/systems/platforms.nix
index f624a5c140a..8027f6b9fc1 100644
--- a/lib/systems/platforms.nix
+++ b/lib/systems/platforms.nix
@@ -170,7 +170,8 @@ rec {
     kernelBaseConfig = "bcm2835_defconfig";
     kernelDTB = true;
     kernelArch = "arm";
-    kernelAutoModules = false;
+    kernelAutoModules = true;
+    kernelPreferBuiltin = true;
     kernelExtraConfig = ''
       # Disable OABI to have seccomp_filter (required for systemd)
       # https://github.com/raspberrypi/firmware/issues/651

From f45fd23bd12c01786d4401ce608b946fec7de69e Mon Sep 17 00:00:00 2001
From: Yurii Rashkovskii <yrashk@gmail.com>
Date: Tue, 12 Jun 2018 10:55:33 -0700
Subject: [PATCH 156/161] sit: 0.3.2 -> 0.4.0 (#41863)

---
 .../version-management/sit/aarch64-isel.patch |  9 --------
 .../version-management/sit/default.nix        | 21 ++++++++++++-------
 pkgs/top-level/all-packages.nix               |  4 +++-
 3 files changed, 16 insertions(+), 18 deletions(-)
 delete mode 100644 pkgs/applications/version-management/sit/aarch64-isel.patch

diff --git a/pkgs/applications/version-management/sit/aarch64-isel.patch b/pkgs/applications/version-management/sit/aarch64-isel.patch
deleted file mode 100644
index 411922cfd8e..00000000000
--- a/pkgs/applications/version-management/sit/aarch64-isel.patch
+++ /dev/null
@@ -1,9 +0,0 @@
-diff --git a/.cargo/config b/.cargo/config
-new file mode 100644
-index 0000000..15e7649
---- /dev/null
-+++ b/.cargo/config
-@@ -0,0 +1,3 @@
-+# https://github.com/rust-lang/rust/issues/50516
-+[target.'cfg(all(debug_assertions, target_arch = "aarch64"))']
-+rustflags = ["-C", "llvm-args=-fast-isel"]
diff --git a/pkgs/applications/version-management/sit/default.nix b/pkgs/applications/version-management/sit/default.nix
index e189241531d..75368bd8846 100644
--- a/pkgs/applications/version-management/sit/default.nix
+++ b/pkgs/applications/version-management/sit/default.nix
@@ -1,25 +1,30 @@
-{ stdenv, fetchFromGitHub, rustPlatform, cmake, libzip }:
+{ stdenv, fetchFromGitHub, rustPlatform, cmake, libzip, gnupg, 
+  # Darwin
+  libiconv, CoreFoundation, Security }:
 
 rustPlatform.buildRustPackage rec {
   name = "sit-${version}";
-  version = "0.3.2";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
-    owner = "sit-it";
+    owner = "sit-fyi";
     repo = "sit";
     rev = "v${version}";
-    sha256 = "0lhl4rrfmsi76498mg5si2xagl8l2pi5d92dxhsyzszpwn5jdp57";
+    sha256 = "10ycs6vc7mfzxnxrki09xn974pcwh196h1pfnsds98x6r87hxkpn";
   };
 
-  buildInputs = [ cmake libzip ];
+  buildInputs = [ cmake libzip gnupg ] ++
+    (if stdenv.isDarwin then [ libiconv CoreFoundation Security ] else []);
 
-  cargoSha256 = "102haqix13nwcncng1s8qkw68spn6fhh3vysk2nbahw6f78zczqg";
+  preCheck = ''
+    export HOME=$(mktemp -d)
+  '';
 
-  patches = [ ./aarch64-isel.patch ];
+  cargoSha256 = "023anmnprxbsvqww1b1bdyfhbhjh1ah2kc67cdihvdvi4lqdmbia";
 
   meta = with stdenv.lib; {
     description = "Serverless Information Tracker";
-    homepage = https://sit.sh/;
+    homepage = https://sit.fyi/;
     license = with licenses; [ asl20 /* or */ mit ];
     maintainers = with maintainers; [ dywedir yrashk ];
     platforms = platforms.all;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b034411921b..d03db66265d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4994,7 +4994,9 @@ with pkgs;
 
   sisco.lv2 = callPackage ../applications/audio/sisco.lv2 { };
 
-  sit = callPackage ../applications/version-management/sit { };
+  sit = callPackage ../applications/version-management/sit {
+    inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
+  };
 
   skippy-xd = callPackage ../tools/X11/skippy-xd {};
 

From eb6189e154bed8695397e9bc94dadc00759cfc41 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Tue, 12 Jun 2018 21:15:48 +0200
Subject: [PATCH 157/161] tinc_pre: 1.1pre15 -> 1.1pre16

---
 pkgs/tools/networking/tinc/pre.nix | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/pkgs/tools/networking/tinc/pre.nix b/pkgs/tools/networking/tinc/pre.nix
index 0f5fd283692..db4b6a2281d 100644
--- a/pkgs/tools/networking/tinc/pre.nix
+++ b/pkgs/tools/networking/tinc/pre.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   name = "tinc-${version}";
-  version = "1.1pre15";
+  version = "1.1pre16";
 
   src = fetchgit {
     rev = "refs/tags/release-${version}";
     url = "git://tinc-vpn.org/tinc";
-    sha256 = "1msym63jpipvzb5dn8yn8yycrii43ncfq6xddxh2ifrakr48l6y5";
+    sha256 = "03dsm1kxagq8srskzg649xyhbdqbbqxc84pdwrz7yakpa9m6225c";
   };
 
   outputs = [ "out" "man" "info" ];
@@ -23,10 +23,6 @@ stdenv.mkDerivation rec {
     sed -i '/AC_INIT/s/m4_esyscmd_s.*/${version})/' configure.ac
   '';
 
-  postInstall = ''
-    rm $out/bin/tinc-gui
-  '';
-
   configureFlags = [
     "--sysconfdir=/etc"
     "--localstatedir=/var"

From 1677759a7bb48b37ab101a1c31a7a2641ab90c35 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Tue, 12 Jun 2018 21:21:11 +0200
Subject: [PATCH 158/161] tinc: 1.0.33 -> 10.0.34

---
 pkgs/tools/networking/tinc/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/networking/tinc/default.nix b/pkgs/tools/networking/tinc/default.nix
index 4f6bec9c008..9ef5ff2a4f0 100644
--- a/pkgs/tools/networking/tinc/default.nix
+++ b/pkgs/tools/networking/tinc/default.nix
@@ -1,12 +1,12 @@
 {stdenv, fetchurl, lzo, openssl, zlib}:
 
 stdenv.mkDerivation rec {
-  version = "1.0.33";
+  version = "1.0.34";
   name = "tinc-${version}";
 
   src = fetchurl {
     url = "http://www.tinc-vpn.org/packages/tinc-${version}.tar.gz";
-    sha256 = "1x0hpfz13vn4pl6dcpnls6xq3rfcbdsg90awcfn53ijb8k35svvz";
+    sha256 = "1nngdp2x5kykrgh13q5wjry8m82vahqv53csvlb22ifxvrhrnfn0";
   };
 
   buildInputs = [ lzo openssl zlib ];

From 5f116f189e415352c8138ffea841d0dcec6ac900 Mon Sep 17 00:00:00 2001
From: Austin Seipp <aseipp@pobox.com>
Date: Mon, 11 Jun 2018 02:52:34 -0500
Subject: [PATCH 159/161] opae: init at 1.0.0

OPAE is a software toolchain and for integration and use of programmable
accelerators, currently supporting Intel Arria 10 and Stratix 10 FPGAs.

This package only contains the userspace software SDK tools and C
libraries -- not the OPAE Linux drivers.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
---
 pkgs/development/libraries/opae/default.nix | 44 +++++++++++++++++++++
 pkgs/top-level/all-packages.nix             |  2 +
 2 files changed, 46 insertions(+)
 create mode 100644 pkgs/development/libraries/opae/default.nix

diff --git a/pkgs/development/libraries/opae/default.nix b/pkgs/development/libraries/opae/default.nix
new file mode 100644
index 00000000000..b60a53e55ca
--- /dev/null
+++ b/pkgs/development/libraries/opae/default.nix
@@ -0,0 +1,44 @@
+{ stdenv, fetchFromGitHub, cmake
+, libuuid, json_c
+, doxygen, perl, python2, python2Packages
+}:
+
+stdenv.mkDerivation rec {
+  name    = "opae-${version}";
+  version = "1.0.0";
+
+  # the tag has a silly name for some reason. drop this in the future if
+  # possible
+  tver    = "${version}-5";
+
+  src = fetchFromGitHub {
+    owner  = "opae";
+    repo   = "opae-sdk";
+    rev    = "refs/tags/${tver}";
+    sha256 = "1dmkpnr9dqxwjhbdzx2r3fdfylvinda421yyg319am5gzlysxwi8";
+  };
+
+  doCheck = false;
+
+  nativeBuildInputs = [ cmake doxygen perl python2Packages.sphinx ];
+  buildInputs = [ libuuid json_c python2 ];
+
+  # Set the Epoch to 1980; otherwise the Python wheel/zip code
+  # gets very angry
+  preConfigure = ''
+    find . -type f | while read file; do
+      touch -d @315532800 $file;
+    done
+  '';
+
+  cmakeFlags = [ "-DBUILD_ASE=1" ];
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "Open Programmable Acceleration Engine SDK";
+    homepage    = https://01.org/opae;
+    license     = licenses.bsd3;
+    platforms   = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ thoughtpolice ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d03db66265d..718041ee753 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4241,6 +4241,8 @@ with pkgs;
 
   update-resolv-conf = callPackage ../tools/networking/openvpn/update-resolv-conf.nix { };
 
+  opae = callPackage ../development/libraries/opae { };
+
   openvswitch = callPackage ../os-specific/linux/openvswitch { };
 
   optipng = callPackage ../tools/graphics/optipng {

From e701948f5a3bfc4cc389ece5fcc2d25d3aec983a Mon Sep 17 00:00:00 2001
From: Joachim Fasting <joachifm@fastmail.fm>
Date: Tue, 12 Jun 2018 22:19:27 +0200
Subject: [PATCH 160/161] tor: 0.3.3.6 -> 0.3.3.7

---
 pkgs/tools/security/tor/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/security/tor/default.nix b/pkgs/tools/security/tor/default.nix
index 795925a221c..3efba58ea11 100644
--- a/pkgs/tools/security/tor/default.nix
+++ b/pkgs/tools/security/tor/default.nix
@@ -15,11 +15,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "tor-0.3.3.6";
+  name = "tor-0.3.3.7";
 
   src = fetchurl {
     url = "https://dist.torproject.org/${name}.tar.gz";
-    sha256 = "1drk2h8zd05xrfpx7xn77pcxz0hs4nrq6figw56qk5gkvgv5kg4r";
+    sha256 = "036ybfvldj7yfci9ipjki8smpzyxdg8c5r12bghc9yxdqh9basza";
   };
 
   outputs = [ "out" "geoip" ];

From 4d5565e87e134ccdb9e245c1753b086e2b0a20e7 Mon Sep 17 00:00:00 2001
From: Orivej Desh <orivej@gmx.fr>
Date: Tue, 12 Jun 2018 20:40:32 +0000
Subject: [PATCH 161/161] pcsclite: clean up after #41790

---
 pkgs/tools/security/pcsclite/default.nix | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/pkgs/tools/security/pcsclite/default.nix b/pkgs/tools/security/pcsclite/default.nix
index a2c6ff52663..bf5856aec35 100644
--- a/pkgs/tools/security/pcsclite/default.nix
+++ b/pkgs/tools/security/pcsclite/default.nix
@@ -6,9 +6,7 @@ stdenv.mkDerivation rec {
   version = "1.8.23";
 
   src = fetchurl {
-    # This URL changes in unpredictable ways, so it is not sensible
-    # to put a version variable in there.
-    url = "https://pcsclite.apdu.fr/files/pcsc-lite-1.8.23.tar.bz2";
+    url = "https://pcsclite.apdu.fr/files/pcsc-lite-${version}.tar.bz2";
     sha256 = "1jc9ws5ra6v3plwraqixin0w0wfxj64drahrbkyrrwzghqjjc9ss";
   };
 
@@ -36,7 +34,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Middleware to access a smart card using SCard API (PC/SC)";
-    homepage = http://pcsclite.alioth.debian.org/;
+    homepage = https://pcsclite.apdu.fr/;
     license = licenses.bsd3;
     maintainers = with maintainers; [ viric wkennington ];
     platforms = with platforms; unix;