Merge pull request #41088 from oxij/merge/master-to-staging-20180526

Merge master into staging

lib/systems/for-meta.nix

@@ -3,6 +3,8 @@ let
   inherit (lib.systems) parse;
   inherit (lib.systems.inspect) patterns;
 
+  abis = lib.mapAttrs (_: abi: builtins.removeAttrs abi [ "assertions" ]) parse.abis;
+
 in rec {
   all     = [ {} ]; # `{}` matches anything
   none    = [];

nixos/modules/module-list.nix

@@ -150,6 +150,7 @@
   ./security/rtkit.nix
   ./security/wrappers/default.nix
   ./security/sudo.nix
+  ./services/admin/oxidized.nix
   ./services/admin/salt/master.nix
   ./services/admin/salt/minion.nix
   ./services/amqp/activemq/default.nix

nixos/modules/profiles/base.nix

@@ -29,7 +29,6 @@
     # Hardware-related tools.
     pkgs.sdparm
     pkgs.hdparm
-    pkgs.dmraid
     pkgs.smartmontools # for diagnosing hard disks
     pkgs.pciutils
     pkgs.usbutils

nixos/modules/programs/shell.nix

@@ -23,39 +23,39 @@ in
     environment.shellInit =
       ''
         # Set up the per-user profile.
-        mkdir -m 0755 -p $NIX_USER_PROFILE_DIR
+        mkdir -m 0755 -p "$NIX_USER_PROFILE_DIR"
-        if test "$(stat --printf '%u' $NIX_USER_PROFILE_DIR)" != "$(id -u)"; then
+        if [ "$(stat --printf '%u' "$NIX_USER_PROFILE_DIR")" != "$(id -u)" ]; then
-            echo "WARNING: bad ownership on $NIX_USER_PROFILE_DIR" >&2
+            echo "WARNING: bad ownership on $NIX_USER_PROFILE_DIR, should be $(id -u)" >&2
         fi
 
-        if test -w $HOME; then
+        if [ -w "$HOME" ]; then
-          if ! test -L $HOME/.nix-profile; then
+          if ! [ -L "$HOME/.nix-profile" ]; then
-              if test "$USER" != root; then
+              if [ "$USER" != root ]; then
-                  ln -s $NIX_USER_PROFILE_DIR/profile $HOME/.nix-profile
+                  ln -s "$NIX_USER_PROFILE_DIR/profile" "$HOME/.nix-profile"
               else
                   # Root installs in the system-wide profile by default.
-                  ln -s /nix/var/nix/profiles/default $HOME/.nix-profile
+                  ln -s /nix/var/nix/profiles/default "$HOME/.nix-profile"
               fi
           fi
 
           # Subscribe the root user to the NixOS channel by default.
-          if [ "$USER" = root -a ! -e $HOME/.nix-channels ]; then
+          if [ "$USER" = root -a ! -e "$HOME/.nix-channels" ]; then
-              echo "${config.system.nixos.defaultChannel} nixos" > $HOME/.nix-channels
+              echo "${config.system.nixos.defaultChannel} nixos" > "$HOME/.nix-channels"
           fi
 
           # Create the per-user garbage collector roots directory.
-          NIX_USER_GCROOTS_DIR=/nix/var/nix/gcroots/per-user/$USER
+          NIX_USER_GCROOTS_DIR="/nix/var/nix/gcroots/per-user/$USER"
-          mkdir -m 0755 -p $NIX_USER_GCROOTS_DIR
+          mkdir -m 0755 -p "$NIX_USER_GCROOTS_DIR"
-          if test "$(stat --printf '%u' $NIX_USER_GCROOTS_DIR)" != "$(id -u)"; then
+          if [ "$(stat --printf '%u' "$NIX_USER_GCROOTS_DIR")" != "$(id -u)" ]; then
-              echo "WARNING: bad ownership on $NIX_USER_GCROOTS_DIR" >&2
+              echo "WARNING: bad ownership on $NIX_USER_GCROOTS_DIR, should be $(id -u)" >&2
           fi
 
           # Set up a default Nix expression from which to install stuff.
-          if [ ! -e $HOME/.nix-defexpr -o -L $HOME/.nix-defexpr ]; then
+          if [ ! -e "$HOME/.nix-defexpr" -o -L "$HOME/.nix-defexpr" ]; then
-              rm -f $HOME/.nix-defexpr
+              rm -f "$HOME/.nix-defexpr"
-              mkdir -p $HOME/.nix-defexpr
+              mkdir -p "$HOME/.nix-defexpr"
               if [ "$USER" != root ]; then
-                  ln -s /nix/var/nix/profiles/per-user/root/channels $HOME/.nix-defexpr/channels_root
+                  ln -s /nix/var/nix/profiles/per-user/root/channels "$HOME/.nix-defexpr/channels_root"
               fi
           fi
         fi

nixos/modules/services/admin/oxidized.nix

@@ -0,0 +1,116 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.services.oxidized;
+in
+{
+  options.services.oxidized = {
+    enable = mkEnableOption "the oxidized configuation backup service.";
+
+    user = mkOption {
+      type = types.str;
+      default = "oxidized";
+      description = ''
+        User under which the oxidized service runs.
+      '';
+    };
+
+    group = mkOption {
+      type = types.str;
+      default = "oxidized";
+      description = ''
+        Group under which the oxidized service runs.
+      '';
+    };
+
+    dataDir = mkOption {
+      type = types.path;
+      default = "/var/lib/oxidized";
+      description = "State directory for the oxidized service.";
+    };
+
+    configFile = mkOption {
+      type = types.path;
+      example = literalExample ''
+        pkgs.writeText "oxidized-config.yml" '''
+          ---
+          debug: true
+          use_syslog: true
+          input:
+            default: ssh
+            ssh:
+              secure: true
+          interval: 3600
+          model_map:
+            dell: powerconnect
+            hp: procurve
+          source:
+            default: csv
+            csv:
+              delimiter: !ruby/regexp /:/
+              file: "/var/lib/oxidized/.config/oxidized/router.db"
+              map:
+                name: 0
+                model: 1
+                username: 2
+                password: 3
+          pid: "/var/lib/oxidized/.config/oxidized/pid"
+          rest: 127.0.0.1:8888
+          retries: 3
+          # ... additional config
+        ''';
+      '';
+      description = ''
+        Path to the oxidized configuration file.
+      '';
+    };
+
+    routerDB = mkOption {
+      type = types.path;
+      example = literalExample ''
+        pkgs.writeText "oxidized-router.db" '''
+          hostname-sw1:powerconnect:username1:password2
+          hostname-sw2:procurve:username2:password2
+          # ... additional hosts
+        '''
+      '';
+      description = ''
+        Path to the file/database which contains the targets for oxidized.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    users.extraGroups.${cfg.group} = { };
+    users.extraUsers.${cfg.user} = {
+      description = "Oxidized service user";
+      group = cfg.group;
+      home = cfg.dataDir;
+      createHome = true;
+    };
+
+    systemd.services.oxidized = {
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      preStart = ''
+        mkdir -p ${cfg.dataDir}/.config/oxidized
+        cp -v ${cfg.routerDB} ${cfg.dataDir}/.config/oxidized/router.db
+        cp -v ${cfg.configFile} ${cfg.dataDir}/.config/oxidized/config
+      '';
+
+      serviceConfig = {
+        ExecStart = "${pkgs.oxidized}/bin/oxidized";
+        User = cfg.user;
+        Group = cfg.group;
+        UMask = "0077";
+        NoNewPrivileges = true;
+        Restart  = "always";
+        WorkingDirectory = cfg.dataDir;
+        KillSignal = "SIGKILL";
+      };
+    };
+  };
+}

nixos/modules/services/backup/borgbackup.nix

@@ -35,25 +35,26 @@ let
     ${cfg.preHook}
   '' + optionalString cfg.doInit ''
     # Run borg init if the repo doesn't exist yet
-    if ! borg list > /dev/null; then
+    if ! borg list $extraArgs > /dev/null; then
-      borg init \
+      borg init $extraArgs \
         --encryption ${cfg.encryption.mode} \
         $extraInitArgs
       ${cfg.postInit}
     fi
   '' + ''
-    borg create \
+    borg create $extraArgs \
       --compression ${cfg.compression} \
       --exclude-from ${mkExcludeFile cfg} \
       $extraCreateArgs \
       "::$archiveName$archiveSuffix" \
       ${escapeShellArgs cfg.paths}
   '' + optionalString cfg.appendFailedSuffix ''
-    borg rename "::$archiveName$archiveSuffix" "$archiveName"
+    borg rename $extraArgs \
+      "::$archiveName$archiveSuffix" "$archiveName"
   '' + ''
     ${cfg.postCreate}
   '' + optionalString (cfg.prune.keep != { }) ''
-    borg prune \
+    borg prune $extraArgs \
       ${mkKeepArgs cfg} \
       --prefix ${escapeShellArg cfg.prune.prefix} \
       $extraPruneArgs
@@ -85,13 +86,14 @@ let
         ProtectSystem = "strict";
         ReadWritePaths =
           [ "${userHome}/.config/borg" "${userHome}/.cache/borg" ]
+          ++ cfg.readWritePaths
           # Borg needs write access to repo if it is not remote
           ++ optional (isLocalPath cfg.repo) cfg.repo;
-        PrivateTmp = true;
+        PrivateTmp = cfg.privateTmp;
       };
       environment = {
         BORG_REPO = cfg.repo;
-        inherit (cfg) extraInitArgs extraCreateArgs extraPruneArgs;
+        inherit (cfg) extraArgs extraInitArgs extraCreateArgs extraPruneArgs;
       } // (mkPassEnv cfg) // cfg.environment;
       inherit (cfg) startAt;
     };
@@ -318,6 +320,30 @@ in {
             ];
           };
 
+          readWritePaths = mkOption {
+            type = with types; listOf path;
+            description = ''
+              By default, borg cannot write anywhere on the system but
+              <literal>$HOME/.config/borg</literal> and <literal>$HOME/.cache/borg</literal>.
+              If, for example, your preHook script needs to dump files
+              somewhere, put those directories here.
+            '';
+            default = [ ];
+            example = [
+              "/var/backup/mysqldump"
+            ];
+          };
+
+          privateTmp = mkOption {
+            type = types.bool;
+            description = ''
+              Set the <literal>PrivateTmp</literal> option for
+              the systemd-service. Set to false if you need sockets
+              or other files from global /tmp.
+            '';
+            default = true;
+          };
+
           doInit = mkOption {
             type = types.bool;
             description = ''
@@ -430,6 +456,16 @@ in {
             default = "";
           };
 
+          extraArgs = mkOption {
+            type = types.str;
+            description = ''
+              Additional arguments for all <command>borg</command> calls the
+              service has. Handle with care.
+            '';
+            default = "";
+            example = "--remote-path=/path/to/borg";
+          };
+
           extraInitArgs = mkOption {
             type = types.str;
             description = ''

nixos/modules/services/cluster/kubernetes/dashboard.nix

@@ -10,8 +10,9 @@ let
 
   image = pkgs.dockerTools.pullImage {
     imageName = name;
-    imageTag = version;
+    finalImageTag = version;
     sha256 = "11h0fz3wxp0f10fsyqaxjm7l2qg7xws50dv5iwlck5gb1fjmajad";
+    imageDigest = "sha256:e7984d10351601080bbc146635d51f0cfbea31ca6f0df323cf7a58cf2f6a68df";
   };
 in {
   options.services.kubernetes.addons.dashboard = {

nixos/modules/services/cluster/kubernetes/default.nix

@@ -279,7 +279,7 @@ in {
       tokenAuthFile = mkOption {
         description = ''
           Kubernetes apiserver token authentication file. See
-          <link xlink:href="https://kubernetes.io/docs/admin/authentication.html"/>
+          <link xlink:href="https://kubernetes.io/docs/reference/access-authn-authz/authentication"/>
         '';
         default = null;
         type = types.nullOr types.path;
@@ -288,7 +288,7 @@ in {
       basicAuthFile = mkOption {
         description = ''
           Kubernetes apiserver basic authentication file. See
-          <link xlink:href="https://kubernetes.io/docs/admin/authentication.html"/>
+          <link xlink:href="https://kubernetes.io/docs/reference/access-authn-authz/authentication"/>
         '';
         default = pkgs.writeText "users" ''
           kubernetes,admin,0
@@ -299,7 +299,7 @@ in {
       authorizationMode = mkOption {
         description = ''
           Kubernetes apiserver authorization mode (AlwaysAllow/AlwaysDeny/ABAC/RBAC). See
-          <link xlink:href="https://kubernetes.io/docs/admin/authorization.html"/>
+          <link xlink:href="https://kubernetes.io/docs/reference/access-authn-authz/authorization/"/>
         '';
         default = ["RBAC" "Node"];
         type = types.listOf (types.enum ["AlwaysAllow" "AlwaysDeny" "ABAC" "RBAC" "Node"]);
@@ -308,7 +308,7 @@ in {
       authorizationPolicy = mkOption {
         description = ''
           Kubernetes apiserver authorization policy file. See
-          <link xlink:href="https://kubernetes.io/docs/admin/authorization.html"/>
+          <link xlink:href="https://kubernetes.io/docs/reference/access-authn-authz/authorization/"/>
         '';
         default = [];
         type = types.listOf types.attrs;
@@ -332,7 +332,7 @@ in {
       runtimeConfig = mkOption {
         description = ''
           Api runtime configuration. See
-          <link xlink:href="https://kubernetes.io/docs/admin/cluster-management.html"/>
+          <link xlink:href="https://kubernetes.io/docs/tasks/administer-cluster/cluster-management/"/>
         '';
         default = "authentication.k8s.io/v1beta1=true";
         example = "api/all=false,api/v1=true";

nixos/modules/services/cluster/kubernetes/dns.nix

@@ -7,20 +7,23 @@ let
 
   k8s-dns-kube-dns = pkgs.dockerTools.pullImage {
     imageName = "gcr.io/google_containers/k8s-dns-kube-dns-amd64";
-    imageTag = version;
+    finalImageTag = version;
     sha256 = "0q97xfqrigrfjl2a9cxl5in619py0zv44gch09jm8gqjkxl80imp";
+    imageDigest = "sha256:40790881bbe9ef4ae4ff7fe8b892498eecb7fe6dcc22661402f271e03f7de344";
   };
 
   k8s-dns-dnsmasq-nanny = pkgs.dockerTools.pullImage {
     imageName = "gcr.io/google_containers/k8s-dns-dnsmasq-nanny-amd64";
-    imageTag = version;
+    finalImageTag = version;
     sha256 = "051w5ca4qb88mwva4hbnh9xzlsvv7k1mbk3wz50lmig2mqrqqx6c";
+    imageDigest = "sha256:aeeb994acbc505eabc7415187cd9edb38cbb5364dc1c2fc748154576464b3dc2";
   };
 
   k8s-dns-sidecar = pkgs.dockerTools.pullImage {
     imageName = "gcr.io/google_containers/k8s-dns-sidecar-amd64";
-    imageTag = version;
+    finalImageTag = version;
     sha256 = "1z0d129bcm8i2cqq36x5jhnrv9hirj8c6kjrmdav8vgf7py78vsm";
+    imageDigest = "sha256:97074c951046e37d3cbb98b82ae85ed15704a290cce66a8314e7f846404edde9";
   };
 
   cfg = config.services.kubernetes.addons.dns;

nixos/modules/services/computing/slurm/slurm.nix

@@ -13,6 +13,7 @@ let
       ${optionalString (cfg.nodeName != null) ''nodeName=${cfg.nodeName}''}
       ${optionalString (cfg.partitionName != null) ''partitionName=${cfg.partitionName}''}
       PlugStackConfig=${plugStackConfig}
+      ProctrackType=${cfg.procTrackType}
       ${cfg.extraConfig}
     '';
 
@@ -31,12 +32,20 @@ in
     services.slurm = {
 
       server = {
-        enable = mkEnableOption "slurm control daemon";
+        enable = mkOption {
-
+          type = types.bool;
+          default = false;
+          description = ''
+            Wether to enable the slurm control daemon.
+            Note that the standard authentication method is "munge".
+            The "munge" service needs to be provided with a password file in order for
+            slurm to work properly (see <literal>services.munge.password</literal>).
+          '';
+        };
       };
 
       client = {
-        enable = mkEnableOption "slurm rlient daemon";
+        enable = mkEnableOption "slurm client daemon";
 
       };
 
@@ -103,6 +112,16 @@ in
         '';
       };
 
+      procTrackType = mkOption {
+        type = types.string;
+        default = "proctrack/linuxproc";
+        description = ''
+          Plugin to be used for process tracking on a job step basis.
+          The slurmd daemon uses this mechanism to identify all processes
+          which are children of processes it spawns for a user job step.
+        '';
+      };
+
       extraConfig = mkOption {
         default = "";
         type = types.lines;
@@ -150,6 +169,8 @@ in
 
     environment.systemPackages = [ wrappedSlurm ];
 
+    services.munge.enable = mkDefault true;
+
     systemd.services.slurmd = mkIf (cfg.client.enable) {
       path = with pkgs; [ wrappedSlurm coreutils ]
         ++ lib.optional cfg.enableSrunX11 slurm-spank-x11;

nixos/modules/services/databases/mysql.nix

@@ -231,8 +231,10 @@ in
 
     environment.systemPackages = [mysql];
 
-    systemd.services.mysql =
+    systemd.services.mysql = let
-      { description = "MySQL Server";
+      hasNotify = (cfg.package == pkgs.mariadb);
+    in {
+        description = "MySQL Server";
 
         after = [ "network.target" ];
         wantedBy = [ "multi-user.target" ];
@@ -256,17 +258,16 @@ in
 
             mkdir -m 0755 -p ${cfg.pidDir}
             chown -R ${cfg.user} ${cfg.pidDir}
-
-            # Make the socket directory
-            mkdir -p /run/mysqld
-            chmod 0755 /run/mysqld
-            chown -R ${cfg.user} /run/mysqld
           '';
 
-        serviceConfig.ExecStart = "${mysql}/bin/mysqld --defaults-extra-file=${myCnf} ${mysqldOptions}";
+        serviceConfig = {
+          Type = if hasNotify then "notify" else "simple";
+          RuntimeDirectory = "mysqld";
+          ExecStart = "${mysql}/bin/mysqld --defaults-extra-file=${myCnf} ${mysqldOptions}";
+        };
 
-        postStart =
+        postStart = ''
-          ''
+          ${lib.optionalString (!hasNotify) ''
             # Wait until the MySQL server is available for use
             count=0
             while [ ! -e /run/mysqld/mysqld.sock ]
@@ -281,6 +282,7 @@ in
                 count=$((count++))
                 sleep 1
             done
+          ''}
 
             if [ -f /tmp/mysql_init ]
             then

nixos/modules/services/misc/gitlab.nix

@@ -129,6 +129,7 @@ let
         };
       };
       extra = {};
+      uploads.storage_path = cfg.statePath;
     };
   };
 
@@ -565,13 +566,9 @@ in {
 
         ${pkgs.openssl}/bin/openssl rand -hex 32 > ${cfg.statePath}/config/gitlab_shell_secret
 
-        # The uploads directory is hardcoded somewhere deep in rails. It is
-        # symlinked in the gitlab package to /run/gitlab/uploads to make it
-        # configurable
         mkdir -p /run/gitlab
-        mkdir -p ${cfg.statePath}/{log,uploads}
+        mkdir -p ${cfg.statePath}/log
         ln -sf ${cfg.statePath}/log /run/gitlab/log
-        ln -sf ${cfg.statePath}/uploads /run/gitlab/uploads
         ln -sf ${cfg.statePath}/tmp /run/gitlab/tmp
         ln -sf $GITLAB_SHELL_CONFIG_PATH /run/gitlab/shell-config.yml
         chown -R ${cfg.user}:${cfg.group} /run/gitlab
@@ -587,6 +584,8 @@ in {
           ln -sf ${smtpSettings} ${cfg.statePath}/config/initializers/smtp_settings.rb
         ''}
         ln -sf ${cfg.statePath}/config /run/gitlab/config
+        rm ${cfg.statePath}/lib
+        ln -sf ${pkgs.gitlab}/share/gitlab/lib ${cfg.statePath}/lib
         cp ${cfg.packages.gitlab}/share/gitlab/VERSION ${cfg.statePath}/VERSION
 
         # JSON is a subset of YAML
@@ -638,10 +637,6 @@ in {
         chmod -R ug+rwX,o-rwx ${cfg.statePath}/repositories
         chmod -R ug-s ${cfg.statePath}/repositories
         find ${cfg.statePath}/repositories -type d -print0 | xargs -0 chmod g+s
-        chmod 770 ${cfg.statePath}/uploads
-        chown -R ${cfg.user} ${cfg.statePath}/uploads
-        find ${cfg.statePath}/uploads -type f -exec chmod 0644 {} \;
-        find ${cfg.statePath}/uploads -type d -not -path ${cfg.statePath}/uploads -exec chmod 0770 {} \;
       '';
 
       serviceConfig = {

nixos/modules/services/misc/nixos-manual.nix

@@ -99,7 +99,7 @@ in
 
     services.nixosManual.browser = mkOption {
       type = types.path;
-      default = "${pkgs.w3m-nox}/bin/w3m";
+      default = "${pkgs.w3m-nographics}/bin/w3m";
       description = ''
         Browser used to show the manual.
       '';

nixos/modules/services/monitoring/dd-agent/dd-agent.nix

@@ -57,7 +57,7 @@ let
     instances:
       - use_mount: no
   '';
-  
+
   networkConfig = pkgs.writeText "network.yaml" ''
     init_config:
 
@@ -68,13 +68,13 @@ let
           - lo
           - lo0
   '';
-  
+
   postgresqlConfig = pkgs.writeText "postgres.yaml" cfg.postgresqlConfig;
   nginxConfig = pkgs.writeText "nginx.yaml" cfg.nginxConfig;
   mongoConfig = pkgs.writeText "mongo.yaml" cfg.mongoConfig;
   jmxConfig = pkgs.writeText "jmx.yaml" cfg.jmxConfig;
   processConfig = pkgs.writeText "process.yaml" cfg.processConfig;
-  
+
   etcfiles =
     let
       defaultConfd = import ./dd-agent-defaults.nix;
@@ -150,7 +150,7 @@ in {
       default = null;
       type = types.uniq (types.nullOr types.string);
     };
-    
+
     mongoConfig = mkOption {
       description = "MongoDB integration configuration";
       default = null;
@@ -166,7 +166,7 @@ in {
     processConfig = mkOption {
       description = ''
         Process integration configuration
- 
+
         See http://docs.datadoghq.com/integrations/process/
       '';
       default = null;
@@ -190,7 +190,7 @@ in {
 
     systemd.services.dd-agent = {
       description = "Datadog agent monitor";
-      path = [ pkgs."dd-agent" pkgs.python pkgs.sysstat pkgs.procps ];
+      path = [ pkgs."dd-agent" pkgs.python pkgs.sysstat pkgs.procps pkgs.gohai ];
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
         ExecStart = "${pkgs.dd-agent}/bin/dd-agent foreground";

nixos/modules/services/monitoring/prometheus/exporters/node.nix

@@ -27,6 +27,7 @@ in
   };
   serviceOpts = {
     serviceConfig = {
+      RuntimeDirectory = "prometheus-node-exporter";
       ExecStart = ''
         ${pkgs.prometheus-node-exporter}/bin/node_exporter \
           ${concatMapStringsSep " " (x: "--collector." + x) cfg.enabledCollectors} \

nixos/modules/services/network-filesystems/ipfs.nix

@@ -186,6 +186,14 @@ in {
         default = [];
       };
 
+      localDiscovery = mkOption {
+        type = types.bool;
+        description = ''Whether to enable local discovery for the ipfs daemon.
+          This will allow ipfs to scan ports on your local network. Some hosting services will ban you if you do this.
+        '';
+        default = true;
+      };
+
       serviceFdlimit = mkOption {
         type = types.nullOr types.int;
         default = null;
@@ -232,7 +240,13 @@ in {
       '';
       script = ''
         if [[ ! -f ${cfg.dataDir}/config ]]; then
-          ipfs init ${optionalString cfg.emptyRepo "-e"}
+          ipfs init ${optionalString cfg.emptyRepo "-e"} \
+            ${optionalString (! cfg.localDiscovery) "--profile=server"}
+        else
+          ${if cfg.localDiscovery
+            then "ipfs config profile apply local-discovery"
+            else "ipfs config profile apply server"
+          }
         fi
       '';
 

nixos/modules/services/web-apps/atlassian/crowd.nix

@@ -126,12 +126,13 @@ in
       };
 
       preStart = ''
-        mkdir -p ${cfg.home}/{logs,work,database}
+        rm -rf ${cfg.home}/work
+        mkdir -p ${cfg.home}/{logs,database,work}
 
         mkdir -p /run/atlassian-crowd
         ln -sf ${cfg.home}/{database,work,server.xml} /run/atlassian-crowd
 
-        chown -R ${cfg.user} ${cfg.home}
+        chown -R ${cfg.user}:${cfg.group} ${cfg.home}
 
         sed -e 's,port="8095",port="${toString cfg.listenPort}" address="${cfg.listenAddress}",' \
         '' + (lib.optionalString cfg.proxy.enable ''

nixos/modules/system/boot/loader/grub/grub.nix

@@ -308,10 +308,22 @@ in
         type = types.nullOr types.path;
         example = literalExample "./my-background.png";
         description = ''
-          Background image used for GRUB.  It must be a 640x480,
+          Background image used for GRUB.
+          Set to <literal>null</literal> to run GRUB in text mode.
+
+          <note><para>
+          For grub 1:
+          It must be a 640x480,
           14-colour image in XPM format, optionally compressed with
-          <command>gzip</command> or <command>bzip2</command>.  Set to
+          <command>gzip</command> or <command>bzip2</command>.
-          <literal>null</literal> to run GRUB in text mode.
+          </para></note>
+
+          <note><para>
+          For grub 2:
+          File must be one of .png, .tga, .jpg, or .jpeg. JPEG images must
+          not be progressive.
+          The image will be scaled if necessary to fit the screen.
+          </para></note>
         '';
       };
 

nixos/modules/system/boot/loader/grub/install-grub.pl

@@ -299,12 +299,16 @@ else {
         copy $font, "$bootPath/converted-font.pf2" or die "cannot copy $font to $bootPath\n";
     }
     if ($splashImage) {
-        # FIXME: GRUB 1.97 doesn't resize the background image if it
+        # Keeps the image's extension.
-        # doesn't match the video resolution.
+        my ($filename, $dirs, $suffix) = fileparse($splashImage, qr"\..[^.]*$");
-        copy $splashImage, "$bootPath/background.png" or die "cannot copy $splashImage to $bootPath\n";
+        # The module for jpg is jpeg.
+        if ($suffix eq ".jpg") {
+            $suffix = ".jpeg";
+        }
+        copy $splashImage, "$bootPath/background$suffix" or die "cannot copy $splashImage to $bootPath\n";
         $conf .= "
-            insmod png
+            insmod " . substr($suffix, 1) . "
-            if background_image " . $grubBoot->path . "/background.png; then
+            if background_image " . $grubBoot->path . "/background$suffix; then
               set color_normal=white/black
               set color_highlight=black/white
             else

nixos/modules/system/boot/timesyncd.nix

@@ -34,7 +34,7 @@ with lib;
 
     environment.etc."systemd/timesyncd.conf".text = ''
       [Time]
-      NTP=${concatStringsSep " " config.services.ntp.servers}
+      NTP=${concatStringsSep " " config.services.timesyncd.servers}
     '';
 
     users.extraUsers.systemd-timesync.uid = config.ids.uids.systemd-timesync;

nixos/release.nix

@@ -384,6 +384,7 @@ in rec {
   tests.sddm = callSubTests tests/sddm.nix {};
   tests.simple = callTest tests/simple.nix {};
   tests.slim = callTest tests/slim.nix {};
+  tests.slurm = callTest tests/slurm.nix {};
   tests.smokeping = callTest tests/smokeping.nix {};
   tests.snapper = callTest tests/snapper.nix {};
   tests.statsd = callTest tests/statsd.nix {};

nixos/tests/docker-tools.nix

@@ -45,5 +45,11 @@ import ./make-test.nix ({ pkgs, ... }: {
       $docker->succeed("docker load --input='${pkgs.dockerTools.examples.onTopOfPulledImage}'");
       $docker->succeed("docker run --rm ontopofpulledimage hello");
       $docker->succeed("docker rmi ontopofpulledimage");
+
+      # Regression test for issue #34779
+      $docker->succeed("docker load --input='${pkgs.dockerTools.examples.runAsRootExtraCommands}'");
+      $docker->succeed("docker run --rm runasrootextracommands cat extraCommands");
+      $docker->succeed("docker run --rm runasrootextracommands cat runAsRoot");
+      $docker->succeed("docker rmi '${pkgs.dockerTools.examples.runAsRootExtraCommands.imageName}'");
     '';
 })

nixos/tests/mysql.nix

@@ -19,7 +19,6 @@ import ./make-test.nix ({ pkgs, ...} : {
     startAll;
 
     $master->waitForUnit("mysql");
-    $master->sleep(10); # Hopefully this is long enough!!
     $master->succeed("echo 'use testdb; select * from tests' | mysql -u root -N | grep 4");
   '';
 })

nixos/tests/slurm.nix

@@ -20,7 +20,6 @@ in {
         # TODO slrumd port and slurmctld port should be configurations and
         # automatically allowed by the  firewall.
         networking.firewall.enable = false;
-        services.munge.enable = true;
         services.slurm = slurmconfig;
       };
     in {
@@ -28,7 +27,6 @@ in {
       { config, pkgs, ...}:
       {
         networking.firewall.enable = false;
-        services.munge.enable = true;
         services.slurm = {
           server.enable = true;
         } // slurmconfig;

pkgs/applications/audio/qjackctl/default.nix

@@ -1,14 +1,14 @@
 { stdenv, fetchurl, pkgconfig, alsaLib, libjack2, dbus, qtbase, qttools, qtx11extras }:
 
 stdenv.mkDerivation rec {
-  version = "0.5.0";
+  version = "0.5.1";
   name = "qjackctl-${version}";
 
   # some dependencies such as killall have to be installed additionally
 
   src = fetchurl {
     url = "mirror://sourceforge/qjackctl/${name}.tar.gz";
-    sha256 = "0lx81dfwanc10vrny1vzi0wx73ph82dlz99ffjzsigj3cqzz6x4s";
+    sha256 = "0jw1s4qh4qjxnysddjv3j2lchwlslj9p4iisv9i89d3m7pf1svs4";
   };
 
   buildInputs = [

pkgs/applications/misc/kitty/default.nix

@@ -5,7 +5,7 @@
 
 with python3Packages;
 buildPythonApplication rec {
-  version = "0.9.1";
+  version = "0.10.1";
   name = "kitty-${version}";
   format = "other";
 
@@ -13,7 +13,7 @@ buildPythonApplication rec {
     owner = "kovidgoyal";
     repo = "kitty";
     rev = "v${version}";
-    sha256 = "08j2k3852c64z4mgh1j0dgdj6c2alkckpav67lzg1lxsz3w2izh2";
+    sha256 = "1xwrrj0g70hh8zsjbd05x0js776xlf7c6mdsmrqlw4y7jfnlgl45";
   };
 
   buildInputs = [

pkgs/applications/misc/memo/default.nix

@@ -1,23 +1,34 @@
-{ fetchFromGitHub, ag, tree, stdenv, ... }:
+{ fetchFromGitHub, ag, tree, man, stdenv, 
+  pandocSupport ? true, pandoc ? null
+  , ... }:
+
+assert pandocSupport -> pandoc != null;
 
 stdenv.mkDerivation rec {
 
   name = "memo-${version}";
 
-  version = "0.2";
+  version = "0.4";
 
   src = fetchFromGitHub {
     owner  = "mrVanDalo";
     repo   = "memo";
     rev    = "${version}";
-    sha256 = "0mww4w5m6jv4s0krm74cccrz0vlr8rrwiv122jk67l1v9r80pchs";
+    sha256 = "06999nps46dxrjakvpin1d2zvfpjil69hb3bxagq29icalag3y2z";
   };
 
-  installPhase = ''
+  installPhase = let
+    pandocReplacement = if pandocSupport then
+      "pandoc_cmd=${pandoc}/bin/pandoc"
+    else
+      "#pandoc_cmd=pandoc";
+  in ''
     mkdir -p $out/{bin,share/man/man1,share/bash-completion/completions}
     substituteInPlace memo \
-      --replace "ack "  "${ag}/bin/ag " \
+      --replace "ack_cmd=ack"       "ack_cmd=${ag}/bin/ag" \
-      --replace "tree " "${tree}/bin/tree "
+      --replace "tree_cmd=tree"     "tree_cmd=${tree}/bin/tree" \
+      --replace "man_cmd=man"       "man_cmd=${man}/bin/man" \
+      --replace "pandoc_cmd=pandoc" "${pandocReplacement}"
     mv memo $out/bin/
     mv doc/memo.1 $out/share/man/man1/memo.1
     mv completion/memo.bash $out/share/bash-completion/completions/memo.sh

pkgs/applications/misc/zathura/core/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchpatch, meson, ninja, makeWrapper, pkgconfig
+{ stdenv, fetchurl, meson, ninja, makeWrapper, pkgconfig
 , appstream-glib, desktop-file-utils, python3
 , gtk, girara, ncurses, gettext, libxml2
 , file, sqlite, glib, texlive, libintl, libseccomp
@@ -11,20 +11,13 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "zathura-core-${version}";
-  version = "0.3.9";
+  version = "0.4.0";
 
   src = fetchurl {
     url = "https://pwmt.org/projects/zathura/download/zathura-${version}.tar.xz";
-    sha256 = "0z09kz92a2n8qqv3cy8bx5j5k612g2f9mmh4szqlc7yvi39aax1g";
+    sha256 = "1j0yah09adv3bsjhhbqra5lambal32svk8fxmf89wwmcqrcr4qma";
   };
 
-  patches = [
-    (fetchpatch {
-      url = https://git.pwmt.org/pwmt/zathura/commit/4223464db68529f9a2064ed760fb7746b3c0df6b.patch;
-      sha256 = "004j68b7c8alxzyx0d80lr5i43cgh7lbqm5fx3d77ihci7hdmxnw";
-    })
-  ];
-
   nativeBuildInputs = [
     meson ninja pkgconfig appstream-glib desktop-file-utils python3.pkgs.sphinx
     gettext makeWrapper libxml2

pkgs/applications/networking/gns3/default.nix

@@ -1,7 +1,7 @@
 { callPackage, stdenv }:
 
 let
-  stableVersion = "2.1.5";
+  stableVersion = "2.1.6";
   # Currently there is no preview version.
   previewVersion = stableVersion;
   addVersion = args:
@@ -10,8 +10,8 @@ let
     in args // { inherit version branch; };
   mkGui = args: callPackage (import ./gui.nix (addVersion args)) { };
   mkServer = args: callPackage (import ./server.nix (addVersion args)) { };
-  guiSrcHash = "1d7pwm36bqjm0d021z5qnx49v8zf4yi9jn5hn6zlbiqbz53l1x7l";
+  guiSrcHash = "0wrh0x5ig2x2pxyyf99z4bfiyxn19akyjic5kgf0pv2snifw2481";
-  serverSrcHash = "002pqm4jcm5qbbw1vnhjdrgysh7d6xmdl66605wz1vbp7xn5s961";
+  serverSrcHash = "0jy5700bshz54mdsh5qpcb2qrczg9isxhr4y0bmglrl23pywvisc";
 in {
   guiStable = mkGui {
     stable = true;

pkgs/applications/networking/instant-messengers/nheko/default.nix

@@ -1,4 +1,7 @@
-{ stdenv, fetchFromGitHub, fetchurl, cmake, doxygen, lmdb, qt5 }:
+{
+  lib, stdenv, fetchFromGitHub, fetchurl,
+  cmake, doxygen, lmdb, qt5, qtmacextras
+}:
 
 let
   json_hpp = fetchurl {
@@ -17,8 +20,8 @@ let
     src = fetchFromGitHub {
       owner = "mujx";
       repo = "matrix-structs";
-      rev = "690080daa3bc1984297c4d7103cde9ea07e2e0b7";
+      rev = "5e57c2385a79b6629d1998fec4a7c0baee23555e";
-      sha256 = "0l6mncpdbjmrzp5a3q1jv0sxf7bwl5ljslrcjca1j2bjjbqb61bz";
+      sha256 = "112b7gnvr04g1ak7fnc7ch7w2n825j4qkw0jb49xx06ag93nb6m6";
     };
 
     postUnpack = ''
@@ -47,19 +50,35 @@ let
 in
 stdenv.mkDerivation rec {
   name = "nheko-${version}";
-  version = "0.4.0";
+  version = "0.4.2";
 
   src = fetchFromGitHub {
     owner = "mujx";
     repo = "nheko";
     rev = "v${version}";
-    sha256 = "1yg6bk193mqj99x3sy0f20x3ggpl0ahrp36w6hhx7pyw5qm17342";
+    sha256 = "1z9dbvcgwafxr131a8447qkx97x8l93k32xa8xvajgvjlimqphqk";
   };
 
   # This patch is likely not strictly speaking needed, but will help detect when
   # a dependency is updated, so that the fetches up there can be updated too
   patches = [ ./external-deps.patch ];
 
+  # If, on Darwin, you encounter the error
+  #   error: must specify at least one argument for '...' parameter of variadic
+  #   macro [-Werror,-Wgnu-zero-variadic-macro-arguments]
+  # Then adding this parameter is likely the fix you want.
+  #
+  # However, it looks like either cmake doesn't honor this CFLAGS variable, or
+  # darwin's compiler doesn't have the same syntax as gcc for turning off
+  # -Werror selectively.
+  #
+  # Anyway, this is something that will have to be debugged with access to a
+  # darwin-based OS. Sorry about that!
+  #
+  #preConfigure = lib.optionalString stdenv.isDarwin ''
+  #  export CFLAGS=-Wno-error=gnu-zero-variadic-macro-arguments
+  #'';
+
   cmakeFlags = [
     "-DMATRIX_STRUCTS_LIBRARY=${matrix-structs}/lib/static/libmatrix_structs.a"
     "-DMATRIX_STRUCTS_INCLUDE_DIR=${matrix-structs}/include/matrix_structs"
@@ -71,7 +90,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     lmdb lmdbxx matrix-structs qt5.qtbase qt5.qtmultimedia qt5.qttools tweeny
-  ];
+  ] ++ lib.optional stdenv.isDarwin qtmacextras;
 
   enableParallelBuilding = true;
 

pkgs/applications/networking/instant-messengers/nheko/external-deps.patch

@@ -54,7 +54,7 @@ index cef00f6..e69de29 100644
 -  MatrixStructs
 -
 -  GIT_REPOSITORY https://github.com/mujx/matrix-structs
--  GIT_TAG 690080daa3bc1984297c4d7103cde9ea07e2e0b7
+-  GIT_TAG 5e57c2385a79b6629d1998fec4a7c0baee23555e
 -
 -  BUILD_IN_SOURCE 1
 -  SOURCE_DIR ${MATRIX_STRUCTS_ROOT}

pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix

@@ -14,7 +14,7 @@ in {
   stable = mkTelegram stableVersion;
   preview = mkTelegram (stableVersion // {
     stable = false;
-    version = "1.2.21";
+    version = "1.2.22";
-    sha256Hash = "0s7dywyz8p626741m32l4a90l1x01564xg2g10gvdb25s2phdfdl";
+    sha256Hash = "0kni4gb6z1c22bhx8z27q4934bg3dngk69xcwykbidm32ijmmsc5";
   });
 }

pkgs/applications/science/math/qalculate-gtk/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "qalculate-gtk-${version}";
-  version = "2.3.0";
+  version = "2.5.0";
 
   src = fetchurl {
     url = "https://github.com/Qalculate/qalculate-gtk/archive/v${version}.tar.gz";
-    sha256 = "0j5wp6bmnwkyxlvqci6ddg478a0ms93gicvycw0c6bkvs2gd77az";
+    sha256 = "1hwwsdk3mlzvg9fsnv0hpj0s1lfkhycwv3sx2yrjwffzphhmxs7a";
   };
 
   patchPhase = ''

pkgs/applications/science/spyder/default.nix

@@ -19,7 +19,7 @@ buildPythonApplication rec {
 
   # Somehow setuptools can't find pyqt5. Maybe because the dist-info folder is missing?
   postPatch = ''
-    substituteInPlace setup.py --replace 'pyqt5;python_version>="3"' ' '
+    sed -i -e '/pyqt5/d' setup.py
   '';
 
   propagatedBuildInputs = [

pkgs/applications/version-management/gitaly/Gemfile

@@ -3,17 +3,17 @@ source 'https://rubygems.org'
 gem 'rugged', '~> 0.27.0'
 gem 'github-linguist', '~> 5.3.3', require: 'linguist'
 gem 'gitlab-markup', '~> 1.6.2'
-gem 'gitaly-proto', '~> 0.95.0', require: 'gitaly'
+gem 'gitaly-proto', '~> 0.99.0', require: 'gitaly'
 gem 'activesupport', '~> 5.0.2'
 gem 'rdoc', '~> 4.2'
-gem 'gollum-lib', '~> 4.2', require: false
+gem 'gitlab-gollum-lib', '~> 4.2', require: false
-gem 'gollum-rugged_adapter', '~> 0.4.4', require: false
+gem 'gitlab-gollum-rugged_adapter', '~> 0.4.4', require: false
 gem 'grpc', '~> 1.10.0'
 gem 'sentry-raven', '~> 2.7.2', require: false
 
 # Detects the open source license the repository includes
 # This version needs to be in sync with GitLab CE/EE
-gem 'licensee', '~> 8.7.0'
+gem 'licensee', '~> 8.9.0'
 
 # Locked until https://github.com/google/protobuf/issues/4210 is closed
 gem 'google-protobuf', '= 3.5.1'

pkgs/applications/version-management/gitaly/Gemfile.lock

@@ -17,7 +17,7 @@ GEM
       multipart-post (>= 1.2, < 3)
     gemojione (3.3.0)
       json
-    gitaly-proto (0.95.0)
+    gitaly-proto (0.99.0)
       google-protobuf (~> 3.1)
       grpc (~> 1.10)
     github-linguist (5.3.3)
@@ -25,7 +25,18 @@ GEM
       escape_utils (~> 1.1.0)
       mime-types (>= 1.19)
       rugged (>= 0.25.1)
-    github-markup (1.6.1)
+    github-markup (1.7.0)
+    gitlab-gollum-lib (4.2.7.1)
+      gemojione (~> 3.2)
+      github-markup (~> 1.6)
+      gollum-grit_adapter (~> 1.0)
+      nokogiri (>= 1.6.1, < 2.0)
+      rouge (~> 2.1)
+      sanitize (~> 2.1)
+      stringex (~> 2.6)
+    gitlab-gollum-rugged_adapter (0.4.4)
+      mime-types (>= 1.15)
+      rugged (~> 0.25)
     gitlab-grit (2.8.2)
       charlock_holmes (~> 0.6)
       diff-lcs (~> 1.1)
@@ -38,17 +49,6 @@ GEM
       rubocop-rspec (~> 1.15)
     gollum-grit_adapter (1.0.1)
       gitlab-grit (~> 2.7, >= 2.7.1)
-    gollum-lib (4.2.7)
-      gemojione (~> 3.2)
-      github-markup (~> 1.6)
-      gollum-grit_adapter (~> 1.0)
-      nokogiri (>= 1.6.1, < 2.0)
-      rouge (~> 2.1)
-      sanitize (~> 2.1)
-      stringex (~> 2.6)
-    gollum-rugged_adapter (0.4.4)
-      mime-types (>= 1.15)
-      rugged (~> 0.25)
     google-protobuf (3.5.1)
     googleapis-common-protos-types (1.0.1)
       google-protobuf (~> 3.0)
@@ -67,7 +67,7 @@ GEM
     i18n (0.8.1)
     json (2.1.0)
     jwt (2.1.0)
-    licensee (8.7.0)
+    licensee (8.9.2)
       rugged (~> 0.24)
     little-plugger (1.1.4)
     logging (2.2.2)
@@ -81,7 +81,7 @@ GEM
     minitest (5.9.1)
     multi_json (1.13.1)
     multipart-post (2.0.0)
-    nokogiri (1.8.1)
+    nokogiri (1.8.2)
       mini_portile2 (~> 2.3.0)
     os (0.9.6)
     parallel (1.12.0)
@@ -130,7 +130,7 @@ GEM
       faraday (~> 0.9)
       jwt (>= 1.5, < 3.0)
       multi_json (~> 1.10)
-    stringex (2.7.1)
+    stringex (2.8.4)
     thread_safe (0.3.6)
     tzinfo (1.2.2)
       thread_safe (~> 0.1)
@@ -141,15 +141,15 @@ PLATFORMS
 
 DEPENDENCIES
   activesupport (~> 5.0.2)
-  gitaly-proto (~> 0.95.0)
+  gitaly-proto (~> 0.99.0)
   github-linguist (~> 5.3.3)
+  gitlab-gollum-lib (~> 4.2)
+  gitlab-gollum-rugged_adapter (~> 0.4.4)
   gitlab-markup (~> 1.6.2)
   gitlab-styles (~> 2.0.0)
-  gollum-lib (~> 4.2)
-  gollum-rugged_adapter (~> 0.4.4)
   google-protobuf (= 3.5.1)
   grpc (~> 1.10.0)
-  licensee (~> 8.7.0)
+  licensee (~> 8.9.0)
   rdoc (~> 4.2)
   rspec
   rugged (~> 0.27.0)

pkgs/applications/version-management/gitaly/default.nix

@@ -7,14 +7,14 @@ let
     gemdir = ./.;
   };
 in buildGoPackage rec {
-  version = "0.95.0";
+  version = "0.100.0";
   name = "gitaly-${version}";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitaly";
     rev = "v${version}";
-    sha256 = "0kadld8372vj0nm692mcn8j4ngph5gzzrzp8dmb4g26h10nq9k6a";
+    sha256 = "0lnyk3abk1jxhii4cx009w11fm082c3va0nnnnycghrmfkv2r1rs";
   };
 
   goPackagePath = "gitlab.com/gitlab-org/gitaly";

pkgs/applications/version-management/gitaly/gemset.nix

@@ -79,10 +79,10 @@
     dependencies = ["google-protobuf" "grpc"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0xwgi3902c89kx0fa176wz289nh67qm9bmx0yykrg5xx1lwk8a2j";
+      sha256 = "1y5sn60h71ssxmc8br32fqhgmfqxgrmdlg4vya8dyy37ai20f85z";
       type = "gem";
     };
-    version = "0.95.0";
+    version = "0.99.0";
   };
   github-linguist = {
     dependencies = ["charlock_holmes" "escape_utils" "mime-types" "rugged"];
@@ -96,10 +96,28 @@
   github-markup = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1nyb9ck2c9z5qi86n7r52w0m126qpnvc93yh35cn8bwsnkjqx0iq";
+      sha256 = "17g6g18gdjg63k75sfwiskjzl9i0hfcnrkcpb4fwrnb20v3jgswp";
       type = "gem";
     };
-    version = "1.6.1";
+    version = "1.7.0";
+  };
+  gitlab-gollum-lib = {
+    dependencies = ["gemojione" "github-markup" "gollum-grit_adapter" "nokogiri" "rouge" "sanitize" "stringex"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0lk5ly17a40xjz8b7l05b4hkrlnq8vawjy4szxl5w0hkaa24m97s";
+      type = "gem";
+    };
+    version = "4.2.7.1";
+  };
+  gitlab-gollum-rugged_adapter = {
+    dependencies = ["mime-types" "rugged"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0zk89c2ljv9skcxzwnr84rqxv3iam30n5liv5r8hgl0l67qbg1mg";
+      type = "gem";
+    };
+    version = "0.4.4";
   };
   gitlab-grit = {
     dependencies = ["charlock_holmes" "diff-lcs" "mime-types" "posix-spawn"];
@@ -136,24 +154,6 @@
     };
     version = "1.0.1";
   };
-  gollum-lib = {
-    dependencies = ["gemojione" "github-markup" "gollum-grit_adapter" "nokogiri" "rouge" "sanitize" "stringex"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1filwvjfj5q2m6w4q274ai36d6f0mrsv2l2khhk4bv1q6pqby2fq";
-      type = "gem";
-    };
-    version = "4.2.7";
-  };
-  gollum-rugged_adapter = {
-    dependencies = ["mime-types" "rugged"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0khfmakp65frlaj7ajs6ihqg4xi7yc9z96kpsf1b7giqi3fqhhv4";
-      type = "gem";
-    };
-    version = "0.4.4";
-  };
   google-protobuf = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -217,10 +217,10 @@
     dependencies = ["rugged"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1nhj0vx30llqyb7q52bwmrgy9xpjk3q48k98h0dvq83ym4v216a2";
+      sha256 = "0w6d2smhg3kzcx4m2ii06akakypwhiglansk51bpx290hhc8h3pc";
       type = "gem";
     };
-    version = "8.7.0";
+    version = "8.9.2";
   };
   little-plugger = {
     source = {
@@ -300,10 +300,10 @@
     dependencies = ["mini_portile2"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "105xh2zkr8nsyfaj2izaisarpnkrrl9000y3nyflg9cbzrfxv021";
+      sha256 = "05fm3xh462glvs0rwnfmc1spmgl4ljg2giifynbmwwqvl42zaaiq";
       type = "gem";
     };
-    version = "1.8.1";
+    version = "1.8.2";
   };
   os = {
     source = {
@@ -504,10 +504,10 @@
   stringex = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1zc93v00av643lc6njl09wwki7h5yqayhh1din8zqfylw814l1dv";
+      sha256 = "0c5dfrjzkskzfsdvwsviq4111rwwpbk9022nxwdidz014mky5vi1";
       type = "gem";
     };
-    version = "2.7.1";
+    version = "2.8.4";
   };
   thread_safe = {
     source = {

pkgs/applications/version-management/gitlab-workhorse/default.nix

@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitLab, git, go }:
 
 stdenv.mkDerivation rec {
-  version = "4.1.0";
+  version = "4.2.0";
   name = "gitlab-workhorse-${version}";
 
   srcs = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-workhorse";
     rev = "v${version}";
-    sha256 = "1yqmkpszcan5cawkl9cxjngcyqlqg061ihk31isar9ifbhpv9yfv";
+    sha256 = "11n43mfp7a59iq8k7sh9bnww3bq56ml2p6752csclg77xii6dzyy";
   };
 
   buildInputs = [ git go ];

pkgs/applications/version-management/gitlab/Gemfile

@@ -33,7 +33,7 @@ gem 'grape-route-helpers', '~> 2.1.0'
 gem 'faraday', '~> 0.12'
 
 # Authentication libraries
-gem 'devise', '~> 4.2'
+gem 'devise', '~> 4.4'
 gem 'doorkeeper', '~> 4.3'
 gem 'doorkeeper-openid_connect', '~> 1.3'
 gem 'omniauth', '~> 1.8'
@@ -41,7 +41,7 @@ gem 'omniauth-auth0', '~> 2.0.0'
 gem 'omniauth-azure-oauth2', '~> 0.0.9'
 gem 'omniauth-cas3', '~> 1.1.4'
 gem 'omniauth-facebook', '~> 4.0.0'
-gem 'omniauth-github', '~> 1.1.1'
+gem 'omniauth-github', '~> 1.3'
 gem 'omniauth-gitlab', '~> 1.0.2'
 gem 'omniauth-google-oauth2', '~> 0.5.3'
 gem 'omniauth-kerberos', '~> 0.3.0', group: :kerberos
@@ -51,7 +51,6 @@ gem 'omniauth-shibboleth', '~> 1.2.0'
 gem 'omniauth-twitter', '~> 1.4'
 gem 'omniauth_crowd', '~> 2.2.0'
 gem 'omniauth-authentiq', '~> 0.3.1'
-gem 'omniauth-jwt', '~> 0.0.2'
 gem 'rack-oauth2', '~> 1.2.1'
 gem 'jwt', '~> 1.5.6'
 
@@ -62,7 +61,7 @@ gem 'akismet', '~> 2.0'
 # Two-factor authentication
 gem 'devise-two-factor', '~> 3.0.0'
 gem 'rqrcode-rails3', '~> 0.1.7'
-gem 'attr_encrypted', '~> 3.0.0'
+gem 'attr_encrypted', '~> 3.1.0'
 gem 'u2f', '~> 0.2.1'
 
 # GitLab Pages
@@ -82,23 +81,16 @@ gem 'net-ldap'
 
 # Git Wiki
 # Required manually in config/initializers/gollum.rb to control load order
-# Before updating this gem, check if
+gem 'gitlab-gollum-lib', '~> 4.2', require: false
-# https://github.com/gollum/gollum-lib/pull/292 has been merged.
-# If it has, then remove the monkey patch for update_page, rename_page and raw_data_in_committer
-# in config/initializers/gollum.rb
-gem 'gollum-lib', '~> 4.2', require: false
 
-# Before updating this gem, check if
+gem 'gitlab-gollum-rugged_adapter', '~> 0.4.4', require: false
-# https://github.com/gollum/rugged_adapter/pull/28 has been merged.
-# If it has, then remove the monkey patch for tree_entry in config/initializers/gollum.rb
-gem 'gollum-rugged_adapter', '~> 0.4.4', require: false
 
 # Language detection
 gem 'github-linguist', '~> 5.3.3', require: 'linguist'
 
 # API
 gem 'grape', '~> 1.0'
-gem 'grape-entity', '~> 0.6.0'
+gem 'grape-entity', '~> 0.7.1'
 gem 'rack-cors', '~> 1.0.0', require: 'rack/cors'
 
 # Disable strong_params so that Mash does not respond to :permitted?
@@ -147,7 +139,7 @@ gem 'creole', '~> 0.5.0'
 gem 'wikicloth', '0.8.1'
 gem 'asciidoctor', '~> 1.5.6'
 gem 'asciidoctor-plantuml', '0.0.8'
-gem 'rouge', '~> 2.0'
+gem 'rouge', '~> 3.1'
 gem 'truncato', '~> 0.7.9'
 gem 'bootstrap_form', '~> 2.7.0'
 gem 'nokogiri', '~> 1.8.2'
@@ -192,6 +184,9 @@ gem 're2', '~> 1.1.1'
 
 gem 'version_sorter', '~> 2.1.0'
 
+# User agent parsing
+gem 'device_detector'
+
 # Cache
 gem 'redis-rails', '~> 5.0.2'
 
@@ -290,7 +285,6 @@ gem 'batch-loader', '~> 1.2.1'
 gem 'peek', '~> 1.0.1'
 gem 'peek-gc', '~> 0.0.2'
 gem 'peek-mysql2', '~> 1.1.0', group: :mysql
-gem 'peek-performance_bar', '~> 1.3.0'
 gem 'peek-pg', '~> 1.3.0', group: :postgres
 gem 'peek-rblineprof', '~> 0.2.0'
 gem 'peek-redis', '~> 1.2.0'
@@ -384,6 +378,7 @@ group :test do
   gem 'email_spec', '~> 1.6.0'
   gem 'json-schema', '~> 2.8.0'
   gem 'webmock', '~> 2.3.2'
+  gem 'rails-controller-testing' if rails5? # Rails5 only gem.
   gem 'test_after_commit', '~> 1.1' unless rails5? # Remove this gem when migrated to rails 5.0. It's been integrated to rails 5.0.
   gem 'sham_rack', '~> 1.3.6'
   gem 'concurrent-ruby', '~> 1.0.5'
@@ -421,8 +416,8 @@ group :ed25519 do
 end
 
 # Gitaly GRPC client
-gem 'gitaly-proto', '~> 0.94.0', require: 'gitaly'
+gem 'gitaly-proto', '~> 0.99.0', require: 'gitaly'
-gem 'grpc', '~> 1.10.0'
+gem 'grpc', '~> 1.11.0'
 
 # Locked until https://github.com/google/protobuf/issues/4210 is closed
 gem 'google-protobuf', '= 3.5.1'

pkgs/applications/version-management/gitlab/Gemfile.lock

@@ -66,7 +66,7 @@ GEM
       unf
     ast (2.4.0)
     atomic (1.1.99)
-    attr_encrypted (3.0.3)
+    attr_encrypted (3.1.0)
       encryptor (~> 3.0.0)
     attr_required (1.0.0)
     autoprefixer-rails (6.2.3)
@@ -143,7 +143,7 @@ GEM
     connection_pool (2.2.1)
     crack (0.4.3)
       safe_yaml (~> 1.0.0)
-    crass (1.0.3)
+    crass (1.0.4)
     creole (0.5.0)
     css_parser (1.5.0)
       addressable
@@ -161,10 +161,11 @@ GEM
       activerecord (>= 3.2.0, < 5.1)
     descendants_tracker (0.0.4)
       thread_safe (~> 0.3, >= 0.3.1)
-    devise (4.2.0)
+    device_detector (1.0.0)
+    devise (4.4.3)
       bcrypt (~> 3.0)
       orm_adapter (~> 0.1)
-      railties (>= 4.1.0, < 5.1)
+      railties (>= 4.1.0, < 6.0)
       responders
       warden (~> 1.2.3)
     devise-two-factor (3.0.0)
@@ -178,7 +179,7 @@ GEM
     docile (1.1.5)
     domain_name (0.5.20170404)
       unf (>= 0.0.5, < 1.0.0)
-    doorkeeper (4.3.1)
+    doorkeeper (4.3.2)
       railties (>= 4.2)
     doorkeeper-openid_connect (1.3.0)
       doorkeeper (~> 4.3)
@@ -206,7 +207,7 @@ GEM
       railties (>= 3.0.0)
     faraday (0.12.2)
       multipart-post (>= 1.2, < 3)
-    faraday_middleware (0.11.0.1)
+    faraday_middleware (0.12.2)
       faraday (>= 0.7.4, < 1.0)
     faraday_middleware-multi_json (0.0.6)
       faraday_middleware
@@ -290,19 +291,30 @@ GEM
       po_to_json (>= 1.0.0)
       rails (>= 3.2.0)
     gherkin-ruby (0.3.2)
-    gitaly-proto (0.94.0)
+    gitaly-proto (0.99.0)
       google-protobuf (~> 3.1)
-      grpc (~> 1.0)
+      grpc (~> 1.10)
     github-linguist (5.3.3)
       charlock_holmes (~> 0.7.5)
       escape_utils (~> 1.1.0)
       mime-types (>= 1.19)
       rugged (>= 0.25.1)
-    github-markup (1.6.1)
+    github-markup (1.7.0)
     gitlab-flowdock-git-hook (1.0.1)
       flowdock (~> 0.7)
       gitlab-grit (>= 2.4.1)
       multi_json
+    gitlab-gollum-lib (4.2.7.2)
+      gemojione (~> 3.2)
+      github-markup (~> 1.6)
+      gollum-grit_adapter (~> 1.0)
+      nokogiri (>= 1.6.1, < 2.0)
+      rouge (~> 3.1)
+      sanitize (~> 2.1)
+      stringex (~> 2.6)
+    gitlab-gollum-rugged_adapter (0.4.4)
+      mime-types (>= 1.15)
+      rugged (~> 0.25)
     gitlab-grit (2.8.2)
       charlock_holmes (~> 0.6)
       diff-lcs (~> 1.1)
@@ -322,17 +334,6 @@ GEM
       activesupport (>= 4.2.0)
     gollum-grit_adapter (1.0.1)
       gitlab-grit (~> 2.7, >= 2.7.1)
-    gollum-lib (4.2.7)
-      gemojione (~> 3.2)
-      github-markup (~> 1.6)
-      gollum-grit_adapter (~> 1.0)
-      nokogiri (>= 1.6.1, < 2.0)
-      rouge (~> 2.1)
-      sanitize (~> 2.1)
-      stringex (~> 2.6)
-    gollum-rugged_adapter (0.4.4)
-      mime-types (>= 1.15)
-      rugged (~> 0.25)
     gon (6.1.0)
       actionpack (>= 3.0)
       json
@@ -365,8 +366,8 @@ GEM
       rack (>= 1.3.0)
       rack-accept
       virtus (>= 1.0.0)
-    grape-entity (0.6.0)
+    grape-entity (0.7.1)
-      activesupport
+      activesupport (>= 4.0)
       multi_json (>= 1.3.2)
     grape-route-helpers (2.1.0)
       activesupport
@@ -374,7 +375,7 @@ GEM
       rake
     grape_logging (1.7.0)
       grape
-    grpc (1.10.0)
+    grpc (1.11.0)
       google-protobuf (~> 3.1)
       googleapis-common-protos-types (~> 1.0.0)
       googleauth (>= 0.5.1, < 0.7)
@@ -483,10 +484,11 @@ GEM
     logging (2.2.2)
       little-plugger (~> 1.1)
       multi_json (~> 1.10)
-    lograge (0.5.1)
+    lograge (0.10.0)
-      actionpack (>= 4, < 5.2)
+      actionpack (>= 4)
-      activesupport (>= 4, < 5.2)
+      activesupport (>= 4)
-      railties (>= 4, < 5.2)
+      railties (>= 4)
+      request_store (~> 1.0)
     loofah (2.2.2)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
@@ -544,9 +546,9 @@ GEM
       omniauth (~> 1.2)
     omniauth-facebook (4.0.0)
       omniauth-oauth2 (~> 1.2)
-    omniauth-github (1.1.2)
+    omniauth-github (1.3.0)
-      omniauth (~> 1.0)
+      omniauth (~> 1.5)
-      omniauth-oauth2 (~> 1.1)
+      omniauth-oauth2 (>= 1.4.0, < 2.0)
     omniauth-gitlab (1.0.2)
       omniauth (~> 1.0)
       omniauth-oauth2 (~> 1.0)
@@ -554,9 +556,6 @@ GEM
       jwt (>= 1.5)
       omniauth (>= 1.1.1)
       omniauth-oauth2 (>= 1.5)
-    omniauth-jwt (0.0.2)
-      jwt
-      omniauth (~> 1.1)
     omniauth-kerberos (0.3.0)
       omniauth-multipassword
       timfel-krb5-auth (~> 0.8)
@@ -587,7 +586,7 @@ GEM
     orm_adapter (0.5.0)
     os (0.9.6)
     parallel (1.12.1)
-    parser (2.5.0.5)
+    parser (2.5.1.0)
       ast (~> 2.4.0)
     parslet (1.5.0)
       blankslate (~> 2.0)
@@ -602,8 +601,6 @@ GEM
       atomic (>= 1.0.0)
       mysql2
       peek
-    peek-performance_bar (1.3.1)
-      peek (>= 0.1.0)
     peek-pg (1.3.0)
       concurrent-ruby
       concurrent-ruby-ext
@@ -649,7 +646,7 @@ GEM
       pry (>= 0.9.10)
     public_suffix (3.0.2)
     pyu-ruby-sasl (0.0.3.3)
-    rack (1.6.9)
+    rack (1.6.10)
     rack-accept (0.4.5)
       rack (>= 0.4)
     rack-attack (4.4.1)
@@ -697,7 +694,7 @@ GEM
     rainbow (2.2.2)
       rake
     raindrops (0.18.0)
-    rake (12.3.0)
+    rake (12.3.1)
     rb-fsevent (0.10.2)
     rb-inotify (0.9.10)
       ffi (>= 0.5.0, < 2)
@@ -738,8 +735,9 @@ GEM
       declarative-option (< 0.2.0)
       uber (< 0.2.0)
     request_store (1.3.1)
-    responders (2.3.0)
+    responders (2.4.0)
-      railties (>= 4.2.0, < 5.1)
+      actionpack (>= 4.2.0, < 5.3)
+      railties (>= 4.2.0, < 5.3)
     rest-client (2.0.2)
       http-cookie (>= 1.0.2, < 2.0)
       mime-types (>= 1.16, < 4.0)
@@ -747,7 +745,7 @@ GEM
     retriable (3.1.1)
     rinku (2.0.0)
     rotp (2.1.2)
-    rouge (2.2.1)
+    rouge (3.1.1)
     rqrcode (0.7.0)
       chunky_png
     rqrcode-rails3 (0.1.7)
@@ -907,7 +905,7 @@ GEM
     state_machines-activerecord (0.5.1)
       activerecord (>= 4.1, < 6.0)
       state_machines-activemodel (>= 0.5.0)
-    stringex (2.7.1)
+    stringex (2.8.4)
     sys-filesystem (1.1.6)
       ffi
     sysexits (1.2.0)
@@ -969,7 +967,7 @@ GEM
       descendants_tracker (~> 0.0, >= 0.0.3)
       equalizer (~> 0.0, >= 0.0.9)
     vmstat (2.3.0)
-    warden (1.2.6)
+    warden (1.2.7)
       rack (>= 1.0)
     webmock (2.3.2)
       addressable (>= 2.3.6)
@@ -1001,7 +999,7 @@ DEPENDENCIES
   asciidoctor (~> 1.5.6)
   asciidoctor-plantuml (= 0.0.8)
   asset_sync (~> 2.2.0)
-  attr_encrypted (~> 3.0.0)
+  attr_encrypted (~> 3.1.0)
   awesome_print (~> 1.2.0)
   babosa (~> 1.0.2)
   base32 (~> 0.3.0)
@@ -1030,7 +1028,8 @@ DEPENDENCIES
   database_cleaner (~> 1.5.0)
   deckar01-task_list (= 2.0.0)
   default_value_for (~> 3.0.0)
-  devise (~> 4.2)
+  device_detector
+  devise (~> 4.4)
   devise-two-factor (~> 3.0.0)
   diffy (~> 3.1.0)
   doorkeeper (~> 4.3)
@@ -1061,23 +1060,23 @@ DEPENDENCIES
   gettext (~> 3.2.2)
   gettext_i18n_rails (~> 1.8.0)
   gettext_i18n_rails_js (~> 1.3)
-  gitaly-proto (~> 0.94.0)
+  gitaly-proto (~> 0.99.0)
   github-linguist (~> 5.3.3)
   gitlab-flowdock-git-hook (~> 1.0.1)
+  gitlab-gollum-lib (~> 4.2)
+  gitlab-gollum-rugged_adapter (~> 0.4.4)
   gitlab-markup (~> 1.6.2)
   gitlab-styles (~> 2.3)
   gitlab_omniauth-ldap (~> 2.0.4)
-  gollum-lib (~> 4.2)
-  gollum-rugged_adapter (~> 0.4.4)
   gon (~> 6.1.0)
   google-api-client (~> 0.19.8)
   google-protobuf (= 3.5.1)
   gpgme
   grape (~> 1.0)
-  grape-entity (~> 0.6.0)
+  grape-entity (~> 0.7.1)
   grape-route-helpers (~> 2.1.0)
   grape_logging (~> 1.7)
-  grpc (~> 1.10.0)
+  grpc (~> 1.11.0)
   haml_lint (~> 0.26.0)
   hamlit (~> 2.6.1)
   hashie-forbidden_attributes
@@ -1115,10 +1114,9 @@ DEPENDENCIES
   omniauth-azure-oauth2 (~> 0.0.9)
   omniauth-cas3 (~> 1.1.4)
   omniauth-facebook (~> 4.0.0)
-  omniauth-github (~> 1.1.1)
+  omniauth-github (~> 1.3)
   omniauth-gitlab (~> 1.0.2)
   omniauth-google-oauth2 (~> 0.5.3)
-  omniauth-jwt (~> 0.0.2)
   omniauth-kerberos (~> 0.3.0)
   omniauth-oauth2-generic (~> 0.2.2)
   omniauth-saml (~> 1.10)
@@ -1129,7 +1127,6 @@ DEPENDENCIES
   peek (~> 1.0.1)
   peek-gc (~> 0.0.2)
   peek-mysql2 (~> 1.1.0)
-  peek-performance_bar (~> 1.3.0)
   peek-pg (~> 1.3.0)
   peek-rblineprof (~> 0.2.0)
   peek-redis (~> 1.2.0)
@@ -1160,7 +1157,7 @@ DEPENDENCIES
   redis-rails (~> 5.0.2)
   request_store (~> 1.3)
   responders (~> 2.0)
-  rouge (~> 2.0)
+  rouge (~> 3.1)
   rqrcode-rails3 (~> 0.1.7)
   rspec-parameterized
   rspec-rails (~> 3.6.0)

pkgs/applications/version-management/gitlab/default.nix

@@ -16,11 +16,11 @@ let
     };
   };
 
-  version = "10.7.0";
+  version = "10.8.0";
 
   gitlabDeb = fetchurl {
     url = "https://packages.gitlab.com/gitlab/gitlab-ce/packages/debian/jessie/gitlab-ce_${version}-ce.0_amd64.deb/download";
-    sha256 = "0dngh6gj8kkfcxn6ki9i96jg4x1x0vq3zzdimxz31g3j2zpd0ryz";
+    sha256 = "0j5jrlwfpgwfirjnqb9w4snl9w213kdxb1ajyrla211q603d4j34";
   };
 
 in
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     owner = "gitlabhq";
     repo = "gitlabhq";
     rev = "v${version}";
-    sha256 = "010xhzrp6svp2a4xzmzwl4x3hk9wc1frqr66lp8x58nfmvr8hdrg";
+    sha256 = "1idvi27xpghvvb3sv62afhcnnswvjlrbg5lld79a761kd4187cym";
   };
 
   buildInputs = [

pkgs/applications/version-management/gitlab/gemset.nix

@@ -201,10 +201,10 @@
     dependencies = ["encryptor"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1dikbf55wjqyzfb9p4xjkkkajwan569pmzljdf9c1fy4a94cd13d";
+      sha256 = "0ncv2az1zlj33bsllr6q1qdvbw42gv91lxq0ryclbv8l8xh841jg";
       type = "gem";
     };
-    version = "3.0.3";
+    version = "3.1.0";
   };
   attr_required = {
     source = {
@@ -554,10 +554,10 @@
   crass = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1czijxlagzpzwchr2ldrgfi7kywg08idjpq37ndcmwh4fmz72c4l";
+      sha256 = "0bpxzy6gjw9ggjynlxschbfsgmx8lv3zw1azkjvnb8b9i895dqfi";
       type = "gem";
     };
-    version = "1.0.3";
+    version = "1.0.4";
   };
   creole = {
     source = {
@@ -660,14 +660,22 @@
     };
     version = "0.0.4";
   };
+  device_detector = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0zbsjj1bgwmsiqiw6x5fzbzp25xc10c02s37ggl2635ha0qzn05q";
+      type = "gem";
+    };
+    version = "1.0.0";
+  };
   devise = {
     dependencies = ["bcrypt" "orm_adapter" "railties" "responders" "warden"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "045qw3186gkcm38wjbjhb7w2zycbqj85wfb1cdwvkqk8hf1a7dp0";
+      sha256 = "1xmxfhym0yxwb0zwmmzhdiykbpyqqm3id02g7rf3vcgbc1lqvdnj";
       type = "gem";
     };
-    version = "4.2.0";
+    version = "4.4.3";
   };
   devise-two-factor = {
     dependencies = ["activesupport" "attr_encrypted" "devise" "railties" "rotp"];
@@ -715,10 +723,10 @@
     dependencies = ["railties"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1yjbmkhpj25h6n5hi382gxna1303crr4v57w1ic23n0w8ll6jh0z";
+      sha256 = "022r03i830b2lvmr0xzlj6ivlvc1zr64hy4a4bsy3flv94da77rz";
       type = "gem";
     };
-    version = "4.3.1";
+    version = "4.3.2";
   };
   doorkeeper-openid_connect = {
     dependencies = ["doorkeeper" "json-jwt"];
@@ -859,10 +867,10 @@
     dependencies = ["faraday"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0bcarc90brm1y68bl957w483bddsy9idj2gghqnysk6bbxpsvm00";
+      sha256 = "1p7icfl28nvl8qqdsngryz1snqic9l8x6bk0dxd7ygn230y0k41d";
       type = "gem";
     };
-    version = "0.11.0.1";
+    version = "0.12.2";
   };
   faraday_middleware-multi_json = {
     dependencies = ["faraday_middleware" "multi_json"];
@@ -1130,10 +1138,10 @@
     dependencies = ["google-protobuf" "grpc"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1rnfswh0jpsiyzvsac7kwk9rpbpf4fcz9p2i8pamqamm3skgd4i6";
+      sha256 = "1y5sn60h71ssxmc8br32fqhgmfqxgrmdlg4vya8dyy37ai20f85z";
       type = "gem";
     };
-    version = "0.94.0";
+    version = "0.99.0";
   };
   github-linguist = {
     dependencies = ["charlock_holmes" "escape_utils" "mime-types" "rugged"];
@@ -1147,10 +1155,10 @@
   github-markup = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1nyb9ck2c9z5qi86n7r52w0m126qpnvc93yh35cn8bwsnkjqx0iq";
+      sha256 = "17g6g18gdjg63k75sfwiskjzl9i0hfcnrkcpb4fwrnb20v3jgswp";
       type = "gem";
     };
-    version = "1.6.1";
+    version = "1.7.0";
   };
   gitlab-flowdock-git-hook = {
     dependencies = ["flowdock" "gitlab-grit" "multi_json"];
@@ -1161,6 +1169,24 @@
     };
     version = "1.0.1";
   };
+  gitlab-gollum-lib = {
+    dependencies = ["gemojione" "github-markup" "gollum-grit_adapter" "nokogiri" "rouge" "sanitize" "stringex"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1a1dv8n33pj2il07c8z7gz5542iby0z2qwymv8yj1kcn4avs4dxv";
+      type = "gem";
+    };
+    version = "4.2.7.2";
+  };
+  gitlab-gollum-rugged_adapter = {
+    dependencies = ["mime-types" "rugged"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0zk89c2ljv9skcxzwnr84rqxv3iam30n5liv5r8hgl0l67qbg1mg";
+      type = "gem";
+    };
+    version = "0.4.4";
+  };
   gitlab-grit = {
     dependencies = ["charlock_holmes" "diff-lcs" "mime-types" "posix-spawn"];
     source = {
@@ -1214,24 +1240,6 @@
     };
     version = "1.0.1";
   };
-  gollum-lib = {
-    dependencies = ["gemojione" "github-markup" "gollum-grit_adapter" "nokogiri" "rouge" "sanitize" "stringex"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1filwvjfj5q2m6w4q274ai36d6f0mrsv2l2khhk4bv1q6pqby2fq";
-      type = "gem";
-    };
-    version = "4.2.7";
-  };
-  gollum-rugged_adapter = {
-    dependencies = ["mime-types" "rugged"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0khfmakp65frlaj7ajs6ihqg4xi7yc9z96kpsf1b7giqi3fqhhv4";
-      type = "gem";
-    };
-    version = "0.4.4";
-  };
   gon = {
     dependencies = ["actionpack" "json" "multi_json" "request_store"];
     source = {
@@ -1298,10 +1306,10 @@
     dependencies = ["activesupport" "multi_json"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "18jhjn1164z68xrjz23wf3qha3x9az086dr7p6405jv6rszyxihq";
+      sha256 = "1w78wylkhdkc0s6n6d20hggbb3pl3ladzzd5lx6ack2iswybx7b9";
       type = "gem";
     };
-    version = "0.6.0";
+    version = "0.7.1";
   };
   grape-route-helpers = {
     dependencies = ["activesupport" "grape" "rake"];
@@ -1325,10 +1333,10 @@
     dependencies = ["google-protobuf" "googleapis-common-protos-types" "googleauth"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "17wvqhjmldxph4li402rvfbyzi5455lzmfr2y19kq9ghrzjyad82";
+      sha256 = "1is4czi3i7y6zyxzyrpsma1z91axmc0jz2ngr6ckixqd3629npkz";
       type = "gem";
     };
-    version = "1.10.0";
+    version = "1.11.0";
   };
   haml = {
     dependencies = ["tilt"];
@@ -1694,13 +1702,13 @@
     version = "2.2.2";
   };
   lograge = {
-    dependencies = ["actionpack" "activesupport" "railties"];
+    dependencies = ["actionpack" "activesupport" "railties" "request_store"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1n08i1m4bn28vrc6gd642wzbyk2cdwahgcysd7pc2c7zd1ipqh0p";
+      sha256 = "00lcn7s3slfn32di4qwlx2yj5f9r2pcnd0naxrvqqwypcg1z2sdd";
       type = "gem";
     };
-    version = "0.5.1";
+    version = "0.10.0";
   };
   loofah = {
     dependencies = ["crass" "nokogiri"];
@@ -1984,10 +1992,10 @@
     dependencies = ["omniauth" "omniauth-oauth2"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1mbx3c8m1llhdxrqdciq8jh428bxj1nvf4yhziv2xqmqpjcqz617";
+      sha256 = "0yg7k4p95ybcsii17spqarl8rpfzkq0kb19ab6wl4lc922zgfbqc";
       type = "gem";
     };
-    version = "1.1.2";
+    version = "1.3.0";
   };
   omniauth-gitlab = {
     dependencies = ["omniauth" "omniauth-oauth2"];
@@ -2007,15 +2015,6 @@
     };
     version = "0.5.3";
   };
-  omniauth-jwt = {
-    dependencies = ["jwt" "omniauth"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0qxr95z5p7fs13mg04zp76ldplgk6n8fkwbn17mlzlry1ihcrgxr";
-      type = "gem";
-    };
-    version = "0.0.2";
-  };
   omniauth-kerberos = {
     dependencies = ["omniauth-multipassword" "timfel-krb5-auth"];
     source = {
@@ -2134,10 +2133,10 @@
     dependencies = ["ast"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1sj8dlqs5l2pa5y2412r4d5fi7qvf26n8vpciz7k9fy0ch327gdc";
+      sha256 = "1af7aa1c2npi8dkshgm3f8qyacabm94ckrdz7b8vd3f8zzswqzp9";
       type = "gem";
     };
-    version = "2.5.0.5";
+    version = "2.5.1.0";
   };
   parslet = {
     dependencies = ["blankslate"];
@@ -2183,15 +2182,6 @@
     };
     version = "1.1.0";
   };
-  peek-performance_bar = {
-    dependencies = ["peek"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1a0ly4p8xnrb3pnf273qq2d5bm2w19p829n4n2730rijd42pa2n4";
-      type = "gem";
-    };
-    version = "1.3.1";
-  };
   peek-pg = {
     dependencies = ["concurrent-ruby" "concurrent-ruby-ext" "peek" "pg"];
     source = {
@@ -2350,10 +2340,10 @@
   rack = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "03w1ri5l91q800f1bdcdl5rbagy7s4kml136b42s2lmxmznxhr07";
+      sha256 = "0in0amn0kwvzmi8h5zg6ijrx5wpsf8h96zrfmnk1kwh2ql4sxs2q";
       type = "gem";
     };
-    version = "1.6.9";
+    version = "1.6.10";
   };
   rack-accept = {
     dependencies = ["rack"];
@@ -2491,10 +2481,10 @@
   rake = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "190p7cs8zdn07mjj6xwwsdna3g0r98zs4crz7jh2j2q5b0nbxgjf";
+      sha256 = "1idi53jay34ba9j68c3mfr9wwkg3cd9qh0fn9cg42hv72c6q8dyg";
       type = "gem";
     };
-    version = "12.3.0";
+    version = "12.3.1";
   };
   rb-fsevent = {
     source = {
@@ -2670,13 +2660,13 @@
     version = "1.3.1";
   };
   responders = {
-    dependencies = ["railties"];
+    dependencies = ["actionpack" "railties"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "16h343srb6msivc2mpm1dbihsmniwvyc9jk3g4ip08g9fpmxfc2i";
+      sha256 = "1rhdyyvvm26f2l3fgwdp6xasfl2y0whwgy766bhdwz697mf78zfn";
       type = "gem";
     };
-    version = "2.3.0";
+    version = "2.4.0";
   };
   rest-client = {
     dependencies = ["http-cookie" "mime-types" "netrc"];
@@ -2714,10 +2704,10 @@
   rouge = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "02kpahk5nkc33yxnn75649kzxaz073wvazr2zyg491nndykgnvcs";
+      sha256 = "1sfhy0xxqjnzqa7qxmpz1bmy0mzcr55qyvi410gsb6d6i4ialbw3";
       type = "gem";
     };
-    version = "2.2.1";
+    version = "3.1.1";
   };
   rqrcode = {
     dependencies = ["chunky_png"];
@@ -3287,10 +3277,10 @@
   stringex = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1zc93v00av643lc6njl09wwki7h5yqayhh1din8zqfylw814l1dv";
+      sha256 = "0c5dfrjzkskzfsdvwsviq4111rwwpbk9022nxwdidz014mky5vi1";
       type = "gem";
     };
-    version = "2.7.1";
+    version = "2.8.4";
   };
   sys-filesystem = {
     dependencies = ["ffi"];
@@ -3558,10 +3548,10 @@
     dependencies = ["rack"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "04gpmnvkp312wxmsvvbq834iyab58vjmh6w4x4qpgh4p1lzkiq1l";
+      sha256 = "0va966lhpylcwbqb9n151kkihx30agh0a57mwjwdxyanll4s1q12";
       type = "gem";
     };
-    version = "1.2.6";
+    version = "1.2.7";
   };
   webmock = {
     dependencies = ["addressable" "crack" "hashdiff"];

pkgs/applications/video/kodi/plugins.nix

@@ -338,4 +338,26 @@ rec {
 
     extraBuildInputs = [ zlib ];
   };
+
+  osmc-skin = mkKodiPlugin rec {
+
+    plugin = "osmc-skin";
+    namespace = "skin.osmc";
+    version = "17.0.4";
+
+    src = fetchFromGitHub {
+      owner = "osmc";
+      repo = namespace;
+      rev = "a9268937f49286bab9fb49de430b8aafd7a60a9e";
+      sha256 = "1b3fm02annsq58pcfc985glrmh21rmqksdj3q8wn6gyza06jdf3v";
+    };
+
+    meta = with stdenv.lib; {
+      homepage = https://github.com/osmc/skin.osmc;
+      description = "The default skin for OSMC";
+      platforms = platforms.all;
+      maintainers = with maintainers; [ worldofpeace ];
+      license = licenses.cc-by-nc-sa-30;
+    };
+  };
 }

pkgs/applications/video/smplayer/default.nix

@@ -1,11 +1,11 @@
 { stdenv, fetchurl, qmake, qtscript }:
 
 stdenv.mkDerivation rec {
-  name = "smplayer-18.4.0";
+  name = "smplayer-18.5.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/smplayer/${name}.tar.bz2";
-    sha256 = "0q2fbg41djyxsy6jinlnidpcqxvs9bi91ga3fwlgnfh6kxsw2ldd";
+    sha256 = "0fxd8zmp5dyk7y9yymjhj2i5218nfvfqb4830pgzzjqz1zdax8rn";
   };
 
   buildInputs = [ qtscript ];

pkgs/applications/window-managers/qtile/0001-Substitution-vars-for-absolute-paths.patch

@@ -23,8 +23,8 @@ index f1133555..3e61204a 100644
  
      def _setup_xcursor_binding(self):
          try:
--            xcursor = ffi.dlopen('libxcb-cursor.so')
+-            xcursor = ffi.dlopen('libxcb-cursor.so.0')
-+            xcursor = ffi.dlopen('@xcb-cursor@/lib/libxcb-cursor.so')
++            xcursor = ffi.dlopen('@xcb-cursor@/lib/libxcb-cursor.so.0')
          except OSError:
              logger.warning("xcb-cursor not found, fallback to font pointer")
              return False

pkgs/applications/window-managers/qtile/0002-Restore-PATH-and-PYTHONPATH.patch

@@ -43,13 +43,13 @@ index 5316e0e7..272c6430 100755
      from libqtile.scripts import qtile_top
      qtile_top.main()
 diff --git a/libqtile/utils.py b/libqtile/utils.py
-index 36ed0a58..bca9eab3 100644
+index 550ed02677e..1358a66f3df 100644
 --- a/libqtile/utils.py
 +++ b/libqtile/utils.py
-@@ -240,3 +240,11 @@ def describe_attributes(obj, attrs, func=None):
+@@ -272,3 +272,11 @@ def safe_import(module_names, class_name, globals_, fallback=None):
-             pairs.append('%s=%s' % (attr, value))
+         logger.debug("%s", traceback.format_exc())
- 
+         if fallback:
-     return ', '.join(pairs)
+             globals_[class_name] = fallback(module_path, class_name, error)
 +
 +
 +def restore_os_environment():

pkgs/applications/window-managers/qtile/0003-Restart-executable.patch

@@ -1,13 +1,13 @@
 diff --git a/libqtile/manager.py b/libqtile/manager.py
-index 36518a74..9b6bdd02 100644
+index fc198e9bae7..860b97d8db1 100644
 --- a/libqtile/manager.py
 +++ b/libqtile/manager.py
-@@ -1386,7 +1386,7 @@ class Qtile(command.CommandObject):
+@@ -1402,7 +1402,7 @@ class Qtile(command.CommandObject):
+             logger.error("Unable to pickle qtile state")
          argv = [s for s in argv if not s.startswith('--with-state')]
          argv.append('--with-state=' + buf.getvalue().decode())
- 
+-        self._restart = (sys.executable, argv)
--        self.cmd_execute(sys.executable, argv)
++        self._restart = (os.environ.get("QTILE_WRAPPER", "@out@/bin/qtile"), argv[1:])
-+        self.cmd_execute(os.environ.get("QTILE_WRAPPER", "@out@/bin/qtile"), argv[1:])
+         self.stop()
  
      def cmd_spawn(self, cmd):
-         """Run cmd in a shell.

pkgs/applications/window-managers/qtile/default.nix

@@ -7,13 +7,13 @@ in
 
 python27Packages.buildPythonApplication rec {
   name = "qtile-${version}";
-  version = "0.10.7";
+  version = "0.11.1";
 
   src = fetchFromGitHub {
     owner = "qtile";
     repo = "qtile";
     rev = "v${version}";
-    sha256 = "18szgplyym0b65vnaa8nqzadq6q0mhsiky9g5hqhn7xzf4kykmj8";
+    sha256 = "1jw6mh9m5yrijhm218lc51sc89lc2ihvyx30jhrkxy2mzllhjgrs";
   };
 
   patches = [

pkgs/build-support/docker/default.nix

@@ -52,15 +52,7 @@ rec {
       outputHashAlgo = "sha256";
       outputHash = sha256;
 
-      # One of the dependencies of Skopeo uses a hardcoded /var/tmp for storing
+      nativeBuildInputs = lib.singleton (pkgs.skopeo);
-      # big image files, which is not available in sandboxed builds.
-      nativeBuildInputs = lib.singleton (pkgs.skopeo.overrideAttrs (drv: {
-        postPatch = (drv.postPatch or "") + ''
-          sed -i -e 's!/var/tmp!/tmp!g' \
-            vendor/github.com/containers/image/storage/storage_image.go \
-            vendor/github.com/containers/image/internal/tmpdir/tmpdir.go
-        '';
-      }));
       SSL_CERT_FILE = "${pkgs.cacert.out}/etc/ssl/certs/ca-bundle.crt";
 
       sourceURL = "docker://${imageName}@${imageDigest}";
@@ -360,7 +352,9 @@ rec {
     extraCommands ? ""
   }:
     # Generate an executable script from the `runAsRoot` text.
-    let runAsRootScript = shellScript "run-as-root.sh" runAsRoot;
+    let
+      runAsRootScript = shellScript "run-as-root.sh" runAsRoot;
+      extraCommandsScript = shellScript "extra-commands.sh" extraCommands;
     in runWithOverlay {
       name = "docker-layer-${name}";
 
@@ -398,7 +392,7 @@ rec {
       '';
 
       postUmount = ''
-        (cd layer; eval "${extraCommands}")
+        (cd layer; ${extraCommandsScript})
 
         echo "Packing layer..."
         mkdir $out

pkgs/build-support/docker/examples.nix

@@ -124,4 +124,16 @@ rec {
     fromImage = nixFromDockerHub;
     contents = [ pkgs.hello ];
   };
+
+  # 8. regression test for erroneous use of eval and string expansion.
+  # See issue #34779 and PR #40947 for details.
+  runAsRootExtraCommands = pkgs.dockerTools.buildImage {
+    name = "runAsRootExtraCommands";
+    contents = [ pkgs.coreutils ];
+    # The parens here are to create problematic bash to embed and eval. In case
+    # this is *embedded* into the script (with nix expansion) the initial quotes
+    # will close the string and the following parens are unexpected
+    runAsRoot = ''echo "(runAsRoot)" > runAsRoot'';
+    extraCommands = ''echo "(extraCommand)" > extraCommands'';
+  };
 }

pkgs/development/compilers/colm/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "colm-${version}";
-  version = "0.13.0.5";
+  version = "0.13.0.6";
 
   src = fetchurl {
     url = "http://www.colm.net/files/colm/${name}.tar.gz";
-    sha256 = "1320bx96ycd1xwww137cixrb983838wnrgkfsym8x5bnf5kj9rik";
+    sha256 = "0jd3qmqdm8yszy0yysbp3syk7pcbxvwzv9mibdwz7v9bv1nrai26";
   };
 
   nativeBuildInputs = [ makeWrapper asciidoc ];

pkgs/development/compilers/fstar/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "fstar-${version}";
-  version = "0.9.5.0";
+  version = "0.9.6.0";
 
   src = fetchFromGitHub {
     owner = "FStarLang";
     repo = "FStar";
     rev = "v${version}";
-    sha256 = "1pi2ny3kpmvm85x8w98anhjf0hp0wccc51m7v697qypn5cl4ydqk";
+    sha256 = "0wix7l229afkn6c6sk4nwkfq0nznsiqdkds4ixi2yyf72immwmmb";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -16,6 +16,7 @@ stdenv.mkDerivation rec {
   buildInputs = with ocamlPackages; [
     z3 ocaml findlib batteries menhir stdint
     zarith camlp4 yojson pprint
+    ulex ocaml-migrate-parsetree process ppx_deriving ppx_deriving_yojson ocamlbuild
   ];
 
   makeFlags = [ "PREFIX=$(out)" ];
@@ -26,8 +27,10 @@ stdenv.mkDerivation rec {
   '';
   buildFlags = "-C src/ocaml-output";
 
+  preInstall = ''
+    mkdir -p $out/lib/ocaml/${ocamlPackages.ocaml.version}/site-lib/fstarlib
+  '';
   installFlags = "-C src/ocaml-output";
-
   postInstall = ''
     wrapProgram $out/bin/fstar.exe --prefix PATH ":" "${z3}/bin"
   '';

pkgs/development/compilers/ghc/7.10.3.nix

@@ -24,6 +24,10 @@
 , # Whether to build dynamic libs for the standard library (on the target
   # platform). Static libs are always built.
   enableShared ? true
+
+, # What flavour to build. An empty string indicates no
+  # specific flavour and falls back to ghc default values.
+  ghcFlavour ? stdenv.lib.optionalString (targetPlatform != hostPlatform) "perf-cross"
 }:
 
 assert !enableIntegerSimple -> gmp != null;
@@ -42,11 +46,14 @@ let
   };
 
   buildMK = ''
+    BuildFlavour = ${ghcFlavour}
+    ifneq \"\$(BuildFlavour)\" \"\"
+    include mk/flavours/\$(BuildFlavour).mk
+    endif
     DYNAMIC_GHC_PROGRAMS = ${if enableShared then "YES" else "NO"}
   '' + stdenv.lib.optionalString enableIntegerSimple ''
     INTEGER_LIBRARY = integer-simple
   '' + stdenv.lib.optionalString (targetPlatform != hostPlatform) ''
-    BuildFlavour = perf-cross
     Stage1Only = YES
     HADDOCK_DOCS = NO
   '' + stdenv.lib.optionalString enableRelocatedStaticLibs ''
@@ -68,7 +75,6 @@ let
   targetCC = builtins.head toolsForTarget;
 
 in
-
 stdenv.mkDerivation rec {
   version = "7.10.3";
   name = "${targetPrefix}ghc-${version}";
@@ -87,6 +93,8 @@ stdenv.mkDerivation rec {
     ./relocation.patch
   ];
 
+  postPatch = "patchShebangs .";
+
   # GHC is a bit confused on its cross terminology.
   preConfigure = ''
     for env in $(env | grep '^TARGET_' | sed -E 's|\+?=.*||'); do
@@ -103,6 +111,7 @@ stdenv.mkDerivation rec {
     export RANLIB="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}ranlib"
     export READELF="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}readelf"
     export STRIP="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}strip"
+
     echo -n "${buildMK}" > mk/build.mk
     sed -i -e 's|-isysroot /Developer/SDKs/MacOSX10.5.sdk||' configure
   '' + stdenv.lib.optionalString (!stdenv.isDarwin) ''
@@ -133,7 +142,8 @@ stdenv.mkDerivation rec {
   strictDeps = true;
 
   nativeBuildInputs = [
-    ghc perl libxml2 libxslt docbook_xsl docbook_xml_dtd_45 docbook_xml_dtd_42 hscolour
+    perl libxml2 libxslt docbook_xsl docbook_xml_dtd_45 docbook_xml_dtd_42
+    ghc hscolour
   ];
 
   # For building runtime libs

pkgs/development/compilers/ghc/8.0.2.nix

@@ -23,6 +23,10 @@
 , # Whether to build dynamic libs for the standard library (on the target
   # platform). Static libs are always built.
   enableShared ? true
+
+, # What flavour to build. An empty string indicates no
+  # specific flavour and falls back to ghc default values.
+  ghcFlavour ? stdenv.lib.optionalString (targetPlatform != hostPlatform) "perf-cross"
 }:
 
 assert !enableIntegerSimple -> gmp != null;
@@ -36,11 +40,14 @@ let
     "${targetPlatform.config}-";
 
   buildMK = ''
+    BuildFlavour = ${ghcFlavour}
+    ifneq \"\$(BuildFlavour)\" \"\"
+    include mk/flavours/\$(BuildFlavour).mk
+    endif
     DYNAMIC_GHC_PROGRAMS = ${if enableShared then "YES" else "NO"}
   '' + stdenv.lib.optionalString enableIntegerSimple ''
     INTEGER_LIBRARY = integer-simple
   '' + stdenv.lib.optionalString (targetPlatform != hostPlatform) ''
-    BuildFlavour = perf-cross
     Stage1Only = YES
     HADDOCK_DOCS = NO
   '' + stdenv.lib.optionalString enableRelocatedStaticLibs ''
@@ -87,6 +94,8 @@ stdenv.mkDerivation rec {
     ++ stdenv.lib.optional stdenv.isDarwin ./ghc-8.0.2-no-cpp-warnings.patch
     ++ stdenv.lib.optional stdenv.isDarwin ./backport-dylib-command-size-limit.patch;
 
+  postPatch = "patchShebangs .";
+
   # GHC is a bit confused on its cross terminology.
   preConfigure = ''
     for env in $(env | grep '^TARGET_' | sed -E 's|\+?=.*||'); do
@@ -103,6 +112,7 @@ stdenv.mkDerivation rec {
     export RANLIB="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}ranlib"
     export READELF="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}readelf"
     export STRIP="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}strip"
+
     echo -n "${buildMK}" > mk/build.mk
     sed -i -e 's|-isysroot /Developer/SDKs/MacOSX10.5.sdk||' configure
   '' + stdenv.lib.optionalString (!stdenv.isDarwin) ''
@@ -132,7 +142,10 @@ stdenv.mkDerivation rec {
   # Make sure we never relax`$PATH` and hooks support for compatability.
   strictDeps = true;
 
-  nativeBuildInputs = [ ghc perl hscolour sphinx ];
+  nativeBuildInputs = [
+    perl sphinx
+    ghc hscolour
+  ];
 
   # For building runtime libs
   depsBuildTarget = toolsForTarget;
@@ -149,10 +162,11 @@ stdenv.mkDerivation rec {
   # that in turn causes GHCi to abort
   stripDebugFlags = [ "-S" ] ++ stdenv.lib.optional (!targetPlatform.isDarwin) "--keep-file-symbols";
 
-  # zsh and other shells are smart about `{ghc}` but bash isn't, and doesn't
-  # treat that as a unary `{x,y,z,..}` repetition.
   postInstall = ''
-    paxmark m $out/lib/${name}/bin/${if targetPlatform != hostPlatform then "ghc" else "{ghc,haddock}"}
+    for bin in "$out"/lib/${name}/bin/*; do
+      isELF "$bin" || continue
+      paxmark m "$bin"
+    done
 
     # Install the bash completion file.
     install -D -m 444 utils/completion/ghc.bash $out/share/bash-completion/completions/${targetPrefix}ghc

pkgs/development/compilers/ghc/8.2.2.nix

@@ -23,10 +23,11 @@
 
 , # Whether to build dynamic libs for the standard library (on the target
   # platform). Static libs are always built.
-  enableShared ?
+  enableShared ? true
-    !(targetPlatform.isDarwin
+
-      # On iOS, dynamic linking is not supported
+, # What flavour to build. An empty string indicates no
-      && (targetPlatform.isAarch64 || targetPlatform.isAarch32))
+  # specific flavour and falls back to ghc default values.
+  ghcFlavour ? stdenv.lib.optionalString (targetPlatform != hostPlatform) "perf-cross"
 , # Whether to backport https://phabricator.haskell.org/D4388 for
   # deterministic profiling symbol names, at the cost of a slightly
   # non-standard GHC API
@@ -44,11 +45,14 @@ let
     "${targetPlatform.config}-";
 
   buildMK = ''
+    BuildFlavour = ${ghcFlavour}
+    ifneq \"\$(BuildFlavour)\" \"\"
+    include mk/flavours/\$(BuildFlavour).mk
+    endif
     DYNAMIC_GHC_PROGRAMS = ${if enableShared then "YES" else "NO"}
   '' + stdenv.lib.optionalString enableIntegerSimple ''
     INTEGER_LIBRARY = integer-simple
   '' + stdenv.lib.optionalString (targetPlatform != hostPlatform) ''
-    BuildFlavour = perf-cross
     Stage1Only = YES
     HADDOCK_DOCS = NO
     BUILD_SPHINX_HTML = NO
@@ -151,7 +155,10 @@ stdenv.mkDerivation rec {
   # Make sure we never relax`$PATH` and hooks support for compatability.
   strictDeps = true;
 
-  nativeBuildInputs = [ alex autoconf autoreconfHook automake ghc happy hscolour perl python3 sphinx ];
+  nativeBuildInputs = [
+    autoconf autoreconfHook automake perl python3 sphinx
+    ghc alex happy hscolour
+  ];
 
   # For building runtime libs
   depsBuildTarget = toolsForTarget;
@@ -173,10 +180,11 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  # zsh and other shells are smart about `{ghc}` but bash isn't, and doesn't
-  # treat that as a unary `{x,y,z,..}` repetition.
   postInstall = ''
-    paxmark m $out/lib/${name}/bin/${if targetPlatform != hostPlatform then "ghc" else "{ghc,haddock}"}
+    for bin in "$out"/lib/${name}/bin/*; do
+      isELF "$bin" || continue
+      paxmark m "$bin"
+    done
 
     # Install the bash completion file.
     install -D -m 444 utils/completion/ghc.bash $out/share/bash-completion/completions/${targetPrefix}ghc

pkgs/development/compilers/ghc/8.4.2.nix

@@ -3,7 +3,7 @@
 
 # build-tools
 , bootPkgs, alex, happy
-, autoconf, automake, coreutils, fetchurl, fetchpatch, perl, python3
+, autoconf, automake, coreutils, fetchurl, fetchpatch, perl, python3, m4
 
 , libffi, libiconv ? null, ncurses
 
@@ -15,16 +15,21 @@
 
 , # If enabled, GHC will be built with the GPL-free but slower integer-simple
   # library instead of the faster but GPLed integer-gmp library.
-  enableIntegerSimple ? false, gmp ? null, m4
+  enableIntegerSimple ? false, gmp ? null
 
 , # If enabled, use -fPIC when compiling static libs.
   enableRelocatedStaticLibs ? targetPlatform != hostPlatform
 
 , # Whether to build dynamic libs for the standard library (on the target
   # platform). Static libs are always built.
-  enableShared ? !targetPlatform.useAndroidPrebuilt
+  enableShared ? !targetPlatform.isWindows && !targetPlatform.useAndroidPrebuilt
 
-, version ? "8.4.2"
+, # Whetherto build terminfo.
+  enableTerminfo ? !targetPlatform.isWindows
+
+, # What flavour to build. An empty string indicates no
+  # specific flavour and falls back to ghc default values.
+  ghcFlavour ? stdenv.lib.optionalString (targetPlatform != hostPlatform) "perf-cross"
 }:
 
 assert !enableIntegerSimple -> gmp != null;
@@ -38,11 +43,14 @@ let
     "${targetPlatform.config}-";
 
   buildMK = ''
+    BuildFlavour = ${ghcFlavour}
+    ifneq \"\$(BuildFlavour)\" \"\"
+    include mk/flavours/\$(BuildFlavour).mk
+    endif
     DYNAMIC_GHC_PROGRAMS = ${if enableShared then "YES" else "NO"}
   '' + stdenv.lib.optionalString enableIntegerSimple ''
     INTEGER_LIBRARY = integer-simple
   '' + stdenv.lib.optionalString (targetPlatform != hostPlatform) ''
-    BuildFlavour = perf-cross
     Stage1Only = YES
     HADDOCK_DOCS = NO
     BUILD_SPHINX_HTML = NO
@@ -55,9 +63,9 @@ let
   '';
 
   # Splicer will pull out correct variations
-  libDeps = platform: [ ncurses ]
+  libDeps = platform: stdenv.lib.optional enableTerminfo [ ncurses ]
     ++ stdenv.lib.optional (!enableIntegerSimple) gmp
-    ++ stdenv.lib.optional (platform.libc != "glibc") libiconv;
+    ++ stdenv.lib.optional (platform.libc != "glibc" && !targetPlatform.isWindows) libiconv;
 
   toolsForTarget =
     if hostPlatform == buildPlatform then
@@ -69,7 +77,7 @@ let
 
 in
 stdenv.mkDerivation rec {
-  inherit version;
+  version = "8.4.2";
   name = "${targetPrefix}ghc-${version}";
 
   src = fetchurl {
@@ -126,7 +134,7 @@ stdenv.mkDerivation rec {
     "--with-curses-includes=${ncurses.dev}/include" "--with-curses-libraries=${ncurses.out}/lib"
   ] ++ stdenv.lib.optional (targetPlatform == hostPlatform && ! enableIntegerSimple) [
     "--with-gmp-includes=${gmp.dev}/include" "--with-gmp-libraries=${gmp.out}/lib"
-  ] ++ stdenv.lib.optional (targetPlatform == hostPlatform && hostPlatform.libc != "glibc") [
+  ] ++ stdenv.lib.optional (targetPlatform == hostPlatform && hostPlatform.libc != "glibc" && !targetPlatform.isWindows) [
     "--with-iconv-includes=${libiconv}/include" "--with-iconv-libraries=${libiconv}/lib"
   ] ++ stdenv.lib.optionals (targetPlatform != hostPlatform) [
     "--enable-bootstrap-with-devel-snapshot"
@@ -142,7 +150,10 @@ stdenv.mkDerivation rec {
   # Make sure we never relax`$PATH` and hooks support for compatability.
   strictDeps = true;
 
-  nativeBuildInputs = [ ghc perl autoconf automake m4 happy alex python3 ];
+  nativeBuildInputs = [
+    perl autoconf automake m4 python3
+    ghc alex happy
+  ];
 
   # For building runtime libs
   depsBuildTarget = toolsForTarget;
@@ -161,10 +172,11 @@ stdenv.mkDerivation rec {
 
   checkTarget = "test";
 
-  # zsh and other shells are smart about `{ghc}` but bash isn't, and doesn't
-  # treat that as a unary `{x,y,z,..}` repetition.
   postInstall = ''
-    paxmark m $out/lib/${name}/bin/${if targetPlatform != hostPlatform then "ghc" else "{ghc,haddock}"}
+    for bin in "$out"/lib/${name}/bin/*; do
+      isELF "$bin" || continue
+      paxmark m "$bin"
+    done
 
     # Install the bash completion file.
     install -D -m 444 utils/completion/ghc.bash $out/share/bash-completion/completions/${targetPrefix}ghc

pkgs/development/compilers/ghc/head.nix

@@ -3,7 +3,7 @@
 
 # build-tools
 , bootPkgs, alex, happy
-, autoconf, automake, coreutils, fetchgit, perl, python3
+, autoconf, automake, coreutils, fetchgit, perl, python3, m4
 
 , libffi, libiconv ? null, ncurses
 
@@ -22,9 +22,15 @@
 
 , # Whether to build dynamic libs for the standard library (on the target
   # platform). Static libs are always built.
-  enableShared ? !targetPlatform.useAndroidPrebuilt
+  enableShared ? !targetPlatform.isWindows && !targetPlatform.useAndroidPrebuilt
+
+, # Whetherto build terminfo.
+  enableTerminfo ? !targetPlatform.isWindows
 
 , version ? "8.5.20180118"
+, # What flavour to build. An empty string indicates no
+  # specific flavour and falls back to ghc default values.
+  ghcFlavour ? stdenv.lib.optionalString (targetPlatform != hostPlatform) "perf-cross"
 }:
 
 assert !enableIntegerSimple -> gmp != null;
@@ -38,11 +44,14 @@ let
     "${targetPlatform.config}-";
 
   buildMK = ''
+    BuildFlavour = ${ghcFlavour}
+    ifneq \"\$(BuildFlavour)\" \"\"
+    include mk/flavours/\$(BuildFlavour).mk
+    endif
     DYNAMIC_GHC_PROGRAMS = ${if enableShared then "YES" else "NO"}
   '' + stdenv.lib.optionalString enableIntegerSimple ''
     INTEGER_LIBRARY = integer-simple
   '' + stdenv.lib.optionalString (targetPlatform != hostPlatform) ''
-    BuildFlavour = perf-cross
     Stage1Only = YES
     HADDOCK_DOCS = NO
     BUILD_SPHINX_HTML = NO
@@ -55,9 +64,9 @@ let
   '';
 
   # Splicer will pull out correct variations
-  libDeps = platform: [ ncurses ]
+  libDeps = platform: stdenv.lib.optional enableTerminfo [ ncurses ]
     ++ stdenv.lib.optional (!enableIntegerSimple) gmp
-    ++ stdenv.lib.optional (platform.libc != "glibc") libiconv;
+    ++ stdenv.lib.optional (platform.libc != "glibc" && !targetPlatform.isWindows) libiconv;
 
   toolsForTarget =
     if hostPlatform == buildPlatform then
@@ -123,7 +132,7 @@ stdenv.mkDerivation rec {
     "--with-curses-includes=${ncurses.dev}/include" "--with-curses-libraries=${ncurses.out}/lib"
   ] ++ stdenv.lib.optional (targetPlatform == hostPlatform && ! enableIntegerSimple) [
     "--with-gmp-includes=${gmp.dev}/include" "--with-gmp-libraries=${gmp.out}/lib"
-  ] ++ stdenv.lib.optional (targetPlatform == hostPlatform && hostPlatform.libc != "glibc") [
+  ] ++ stdenv.lib.optional (targetPlatform == hostPlatform && hostPlatform.libc != "glibc" && !targetPlatform.isWindows) [
     "--with-iconv-includes=${libiconv}/include" "--with-iconv-libraries=${libiconv}/lib"
   ] ++ stdenv.lib.optionals (targetPlatform != hostPlatform) [
     "--enable-bootstrap-with-devel-snapshot"
@@ -139,7 +148,10 @@ stdenv.mkDerivation rec {
   # Make sure we never relax`$PATH` and hooks support for compatability.
   strictDeps = true;
 
-  nativeBuildInputs = [ ghc perl autoconf automake happy alex python3 ];
+  nativeBuildInputs = [
+    perl autoconf automake m4 python3
+    ghc alex happy
+  ];
 
   # For building runtime libs
   depsBuildTarget = toolsForTarget;
@@ -158,10 +170,11 @@ stdenv.mkDerivation rec {
 
   checkTarget = "test";
 
-  # zsh and other shells are smart about `{ghc}` but bash isn't, and doesn't
-  # treat that as a unary `{x,y,z,..}` repetition.
   postInstall = ''
-    paxmark m $out/lib/${name}/bin/${if targetPlatform != hostPlatform then "ghc" else "{ghc,haddock}"}
+    for bin in "$out"/lib/${name}/bin/*; do
+      isELF "$bin" || continue
+      paxmark m "$bin"
+    done
 
     # Install the bash completion file.
     install -D -m 444 utils/completion/ghc.bash $out/share/bash-completion/completions/${targetPrefix}ghc

pkgs/development/haskell-modules/configuration-nix.nix

@@ -128,7 +128,7 @@ self: super: builtins.intersectAttrs super {
 
   # Prevents needing to add security_tool as a build tool to all of x509-system's
   # dependencies.
-  x509-system = if pkgs.stdenv.isDarwin && !pkgs.stdenv.cc.nativeLibc
+  x509-system = if pkgs.stdenv.targetPlatform.isDarwin && !pkgs.stdenv.cc.nativeLibc
     then let inherit (pkgs.darwin) security_tool;
       in pkgs.lib.overrideDerivation (addBuildDepend super.x509-system security_tool) (drv: {
         postPatch = (drv.postPatch or "") + ''

pkgs/development/haskell-modules/generic-builder.nix

@@ -19,6 +19,7 @@ in
 , buildTarget ? ""
 , buildTools ? [], libraryToolDepends ? [], executableToolDepends ? [], testToolDepends ? [], benchmarkToolDepends ? []
 , configureFlags ? []
+, buildFlags ? []
 , description ? ""
 , doCheck ? !isCross && stdenv.lib.versionOlder "7.4" ghc.version
 , doBenchmark ? false
@@ -31,7 +32,7 @@ in
 , enableSharedExecutables ? false
 , enableSharedLibraries ? ((ghc.isGhcjs or false) || stdenv.lib.versionOlder "7.7" ghc.version)
 , enableDeadCodeElimination ? (!stdenv.isDarwin)  # TODO: use -dead_strip for darwin
-, enableStaticLibraries ? true
+, enableStaticLibraries ? !hostPlatform.isWindows
 , enableHsc2hsViaAsm ? hostPlatform.isWindows && stdenv.lib.versionAtLeast ghc.version "8.4"
 , extraLibraries ? [], librarySystemDepends ? [], executableSystemDepends ? []
 , homepage ? "http://hackage.haskell.org/package/${pname}"
@@ -68,6 +69,10 @@ in
 
 assert editedCabalFile != null -> revision != null;
 
+# --enable-static does not work on windows. This is a bug in GHC.
+# --enable-static will pass -staticlib to ghc, which only works for mach-o and elf.
+assert hostPlatform.isWindows -> enableStaticLibraries == false;
+
 let
 
   inherit (stdenv.lib) optional optionals optionalString versionOlder versionAtLeast
@@ -126,6 +131,8 @@ let
   crossCabalFlagsString =
     stdenv.lib.optionalString isCross (" " + stdenv.lib.concatStringsSep " " crossCabalFlags);
 
+  buildFlagsString = optionalString (buildFlags != []) (" " + concatStringsSep " " buildFlags);
+
   defaultConfigureFlags = [
     "--verbose" "--prefix=$out" "--libdir=\\$prefix/lib/\\$compiler" "--libsubdir=\\$pkgid"
     (optionalString enableSeparateDataOutput "--datadir=$data/share/${ghc.name}")
@@ -169,18 +176,22 @@ let
                         optionals doCheck testPkgconfigDepends ++ optionals doBenchmark benchmarkPkgconfigDepends;
 
   nativeBuildInputs = [ ghc nativeGhc removeReferencesTo ] ++ optional (allPkgconfigDepends != []) pkgconfig ++
+                      setupHaskellDepends ++
                       buildTools ++ libraryToolDepends ++ executableToolDepends;
   propagatedBuildInputs = buildDepends ++ libraryHaskellDepends ++ executableHaskellDepends;
-  otherBuildInputs = setupHaskellDepends ++ extraLibraries ++ librarySystemDepends ++ executableSystemDepends ++
+  otherBuildInputs = extraLibraries ++ librarySystemDepends ++ executableSystemDepends ++
                      allPkgconfigDepends ++
                      optionals doCheck (testDepends ++ testHaskellDepends ++ testSystemDepends ++ testToolDepends) ++
                      optionals doBenchmark (benchmarkDepends ++ benchmarkHaskellDepends ++ benchmarkSystemDepends ++ benchmarkToolDepends);
+
   allBuildInputs = propagatedBuildInputs ++ otherBuildInputs;
 
   haskellBuildInputs = stdenv.lib.filter isHaskellPkg allBuildInputs;
   systemBuildInputs = stdenv.lib.filter isSystemPkg allBuildInputs;
 
-  ghcEnv = ghc.withPackages (p: haskellBuildInputs);
+  # When not cross compiling, also include Setup.hs dependencies.
+  ghcEnv = ghc.withPackages (p:
+    haskellBuildInputs ++ stdenv.lib.optional (!isCross) setupHaskellDepends);
 
   setupCommand = "./Setup";
 
@@ -190,6 +201,25 @@ let
 
   nativeGhcCommand = "${nativeGhc.targetPrefix}ghc";
 
+  buildPkgDb = ghcName: ''
+    if [ -d "$p/lib/${ghcName}/package.conf.d" ]; then
+      cp -f "$p/lib/${ghcName}/package.conf.d/"*.conf $packageConfDir/
+      continue
+    fi
+    if [ -d "$p/include" ]; then
+      configureFlags+=" --extra-include-dirs=$p/include"
+    fi
+    if [ -d "$p/lib" ]; then
+      configureFlags+=" --extra-lib-dirs=$p/lib"
+    fi
+  ''
+  # It is not clear why --extra-framework-dirs does work fine on Linux
+  + optionalString (!buildPlatform.isDarwin || versionAtLeast nativeGhc.version "8.0") ''
+    if [[ -d "$p/Library/Frameworks" ]]; then
+      configureFlags+=" --extra-framework-dirs=$p/Library/Frameworks"
+    fi
+  '';
+
 in
 
 assert allPkgconfigDepends != [] -> pkgconfig != null;
@@ -230,30 +260,37 @@ stdenv.mkDerivation ({
     echo "Build with ${ghc}."
     ${optionalString (hasActiveLibrary && hyperlinkSource) "export PATH=${hscolour}/bin:$PATH"}
 
+  '' + (optionalString (setupHaskellDepends != []) ''
+    setupPackageConfDir="$TMPDIR/setup-package.conf.d"
+    mkdir -p $setupPackageConfDir
+  '') + ''
     packageConfDir="$TMPDIR/package.conf.d"
     mkdir -p $packageConfDir
 
     setupCompileFlags="${concatStringsSep " " setupCompileFlags}"
     configureFlags="${concatStringsSep " " defaultConfigureFlags} $configureFlags"
+  ''
+  # We build the Setup.hs on the *build* machine, and as such should only add
+  # dependencies for the build machine.
+  #
+  # pkgs* arrays defined in stdenv/setup.hs
+  + (optionalString (setupHaskellDepends != []) ''
+    for p in "''${pkgsBuildBuild[@]}" "''${pkgsBuildHost[@]}" "''${pkgsBuildTarget[@]}"; do
+      ${buildPkgDb nativeGhc.name}
+    done
+    ${nativeGhcCommand}-pkg --${nativePackageDbFlag}="$setupPackageConfDir" recache
+  '')
 
-    # host.*Pkgs defined in stdenv/setup.hs
+    # For normal components
+  + ''
     for p in "''${pkgsHostHost[@]}" "''${pkgsHostTarget[@]}"; do
-      if [ -d "$p/lib/${ghc.name}/package.conf.d" ]; then
+      ${buildPkgDb ghc.name}
-        cp -f "$p/lib/${ghc.name}/package.conf.d/"*.conf $packageConfDir/
-        continue
-      fi
-      if [ -d "$p/include" ]; then
-        configureFlags+=" --extra-include-dirs=$p/include"
-      fi
-      if [ -d "$p/lib" ]; then
-        configureFlags+=" --extra-lib-dirs=$p/lib"
-      fi
     done
   ''
   # only use the links hack if we're actually building dylibs. otherwise, the
   # "dynamic-library-dirs" point to nonexistent paths, and the ln command becomes
   # "ln -s $out/lib/links", which tries to recreate the links dir and fails
-  + (optionalString (stdenv.isDarwin && enableSharedLibraries) ''
+  + (optionalString (stdenv.isDarwin && (enableSharedLibraries || enableSharedExecutables)) ''
     # Work around a limit in the macOS Sierra linker on the number of paths
     # referenced by any one dynamic library:
     #
@@ -282,7 +319,11 @@ stdenv.mkDerivation ({
     done
 
     echo setupCompileFlags: $setupCompileFlags
-    ${nativeGhcCommand} $setupCompileFlags --make -o Setup -odir $TMPDIR -hidir $TMPDIR $i
+    ${optionalString (setupHaskellDepends != [])
+       ''
+       echo GHC_PACKAGE_PATH="$setupPackageConfDir:"
+       GHC_PACKAGE_PATH="$setupPackageConfDir:" ''
+    }${nativeGhcCommand} $setupCompileFlags --make -o Setup -odir $TMPDIR -hidir $TMPDIR $i
 
     runHook postCompileBuildDriver
   '';
@@ -310,7 +351,7 @@ stdenv.mkDerivation ({
 
   buildPhase = ''
     runHook preBuild
-    ${setupCommand} build ${buildTarget}${crossCabalFlagsString}
+    ${setupCommand} build ${buildTarget}${crossCabalFlagsString}${buildFlagsString}
     runHook postBuild
   '';
 

pkgs/development/haskell-modules/lib.nix

@@ -131,6 +131,8 @@ rec {
    */
   appendConfigureFlag = drv: x: overrideCabal drv (drv: { configureFlags = (drv.configureFlags or []) ++ [x]; });
 
+  appendBuildFlag = drv: x: overrideCabal drv (drv: { buildFlags = (drv.buildFlags or []) ++ [x]; });
+  appendBuildFlags = drv: xs: overrideCabal drv (drv: { buildFlags = (drv.buildFlags or []) ++ xs; });
   /* removeConfigureFlag drv x is a Haskell package like drv, but with
      all cabal configure arguments that are equal to x removed.
 

pkgs/development/libraries/fplll/default.nix

@@ -4,12 +4,12 @@
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "fplll";
-  version = "5.2.0";
+  version = "5.2.1";
   src = fetchFromGitHub {
     owner = "${pname}";
     repo = "${pname}";
     rev = "${version}";
-    sha256 = "0931i4q49lzlifsg9zd8a2yzj626i1s2bqhkfxvcxv94c38s0nh1";
+    sha256 = "015qmrd7nfaysbv1hbwiprz9g6hnww1y1z1xw8f43ysb7k1b5nbg";
   };
   nativeBuildInputs = [autoconf automake libtool gettext autoreconfHook];
   buildInputs = [gmp mpfr];

pkgs/development/libraries/libqalculate/default.nix

@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   name = "libqalculate-${version}";
-  version = "2.3.0";
+  version = "2.5.0";
 
   src = fetchurl {
     url = "https://github.com/Qalculate/libqalculate/archive/v${version}.tar.gz";
-    sha256 = "1wrd9ajf00h1ja56r25vljjsgklg0qlzmziax7x26wjqkigc28iq";
+    sha256 = "0xs2qjr93k43p6j126xj20fgb1n2jv56rhgc211yv1l46crbqxfv";
   };
 
   outputs = [ "out" "dev" "doc" ];

pkgs/development/libraries/zookeeper_mt/default.nix

@@ -1,7 +1,7 @@
 { stdenv, zookeeper, bash }:
 
 stdenv.mkDerivation rec {
-   name = "zookeeper_mt";
+   name = "zookeeper_mt-${stdenv.lib.getVersion zookeeper}";
    
    src = zookeeper.src;
    

pkgs/development/libraries/zziplib/default.nix

@@ -13,8 +13,6 @@ stdenv.mkDerivation rec {
     sed -i -e s,--export-dynamic,, configure
   '';
 
-  # TODO: still an issue: https://github.com/gdraheim/zziplib/issues/27
-
   buildInputs = [ docbook_xml_dtd_412 perl python2 zip xmlto zlib ];
 
   # tests are broken (https://github.com/gdraheim/zziplib/issues/20),

pkgs/development/ocaml-modules/earley_ocaml/default.nix

@@ -0,0 +1,30 @@
+{ stdenv, fetchFromGitHub, which, ocaml, findlib, ocamlbuild, earley }:
+
+stdenv.mkDerivation rec {
+  version = "1.0.2";
+  name = "ocaml${ocaml.version}-earley_ocaml-${version}";
+  src = fetchFromGitHub {
+    owner = "rlepigre";
+    repo = "ocaml-earley-ocaml";
+    rev = "ocaml-earley-ocaml_${version}";
+    sha256 = "0f8kr49r2xfs7cbzps4r9i92ckhwssaiydam846jrky3z5djn2jc";
+  };
+
+  buildInputs = [ which ocaml findlib ocamlbuild ];
+
+  propagatedBuildInputs = [ earley ];
+
+  preBuild = "make";
+
+  createFindlibDestdir = true;
+
+  installFlags = [ "BINDIR=$(out)/bin" ];
+
+  meta = {
+    description = "Extensible OCaml parser to be used with Earley";
+    license = stdenv.lib.licenses.cecill-b;
+    maintainers = [ stdenv.lib.maintainers.vbgl ];
+    inherit (ocaml.meta) platforms;
+    inherit (src.meta) homepage;
+  };
+}

pkgs/development/python-modules/django-allauth/default.nix

@@ -0,0 +1,32 @@
+{ stdenv, buildPythonPackage, fetchFromGitHub, requests, requests_oauthlib
+, django, python-openid, mock, coverage }:
+
+buildPythonPackage rec {
+  pname = "django-allauth";
+  name = "${pname}-${version}";
+  version = "0.36.0";
+
+  # no tests on PyPI
+  src = fetchFromGitHub {
+    owner = "pennersr";
+    repo = pname;
+    rev = version;
+    sha256 = "1c863cmd521j6cwpyd50jxz5y62fdschrhm15jfqihicyr9imjan";
+  };
+
+  propagatedBuildInputs = [ requests requests_oauthlib django python-openid ];
+
+  checkInputs = [ coverage mock ];
+
+  doCheck = false;
+  checkPhase = ''
+    cd $NIX_BUILD_TOP/$sourceRoot
+    coverage run manage.py test allauth
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Integrated set of Django applications addressing authentication, registration, account management as well as 3rd party (social) account authentication";
+    homepage = https://www.intenct.nl/projects/django-allauth;
+    license = licenses.mit;
+  };
+}

pkgs/development/python-modules/django-gravatar2/default.nix

@@ -0,0 +1,20 @@
+{ stdenv, buildPythonPackage, fetchPypi }:
+
+buildPythonPackage rec {
+  pname = "django-gravatar2";
+  name = "${pname}-${version}";
+  version = "1.4.2";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1qsv40xywbqsf4mkrmsswrpzqd7nfljxpfiim9an2z3dykn5rka6";
+  };
+
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "Essential Gravatar support for Django";
+    homepage = https://github.com/twaddington/django-gravatar;
+    license = licenses.mit;
+  };
+}

pkgs/development/python-modules/fpylll/default.nix

@@ -1,5 +1,5 @@
 { lib
-, fetchPypi
+, fetchFromGitHub
 , buildPythonPackage
 , pkgconfig
 , gmp
@@ -14,11 +14,13 @@
 
 buildPythonPackage rec {
   pname = "fpylll";
-  version = "0.3.0dev";
+  version = "0.4.1dev";
 
-  src = fetchPypi {
+  src = fetchFromGitHub {
-    inherit pname version;
+    owner = "fplll";
-    sha256 = "0bjkh02fnxsrxwjzai8ij12zl2wq319z8y25sn9pvvzla5izgnp9";
+    repo = "fpylll";
+    rev = version;
+    sha256 = "01x2sqdv0sbjj4g4waj0hj4rcn4bq7h17442xaqwbznym9azmn9w";
   };
 
   buildInputs = [

pkgs/development/python-modules/jedi/default.nix

@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "jedi";
-  version = "0.11.1";
+  version = "0.12.0";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d6e799d04d1ade9459ed0f20de47c32f2285438956a677d083d3c98def59fa97";
+    sha256 = "1bcr7csx4xil1iwmk03d79jis0bkmgi9k0kir3xa4rmwqsagcwhr";
   };
 
   postPatch = ''

pkgs/development/python-modules/mypy/default.nix

@@ -1,6 +1,6 @@
-{ stdenv, fetchPypi, buildPythonApplication, lxml, typed-ast, psutil }:
+{ stdenv, fetchPypi, buildPythonPackage, lxml, typed-ast, psutil, isPy3k }:
 
-buildPythonApplication rec {
+buildPythonPackage rec {
   pname = "mypy";
   version = "0.600";
 
@@ -12,6 +12,8 @@ buildPythonApplication rec {
     sha256 = "1pd3kkz435wlvi9fwqbi3xag5zs59jcjqi6c9gzdjdn23friq9dw";
   };
 
+  disabled = !isPy3k;
+
   propagatedBuildInputs = [ lxml typed-ast psutil ];
 
   meta = with stdenv.lib; {

pkgs/development/python-modules/parso/default.nix

@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "parso";
-  version = "0.1.1";
+  version = "0.2.0";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5815f3fe254e5665f3c5d6f54f086c2502035cb631a91341591b5a564203cffb";
+    sha256 = "0lamywk6dm5xshlkdvxxf5j6fa2k2zpi7xagf0bwidaay3vnpgb2";
   };
 
   checkInputs = [ pytest ];
@@ -22,4 +22,4 @@ buildPythonPackage rec {
     license = lib.licenses.mit;
   };
 
-}
+}

pkgs/development/python-modules/pyls-isort/default.nix

@@ -0,0 +1,29 @@
+{ lib, buildPythonPackage, fetchFromGitHub
+, python-language-server, isort
+}:
+
+buildPythonPackage rec {
+  pname = "pyls-isort";
+  version = "0.1.1";
+
+  src = fetchFromGitHub {
+    owner = "paradoxxxzero";
+    repo = "pyls-isort";
+    rev = version;
+    sha256 = "0mf8c6dw5lsj9np20p0vrhr1yfycq2awjk2pil28l579xj9nr0dc";
+  };
+
+  # no tests
+  doCheck = false;
+
+  propagatedBuildInputs = [
+    isort python-language-server
+  ];
+
+  meta = with lib; {
+    homepage = https://github.com/palantir/python-language-server;
+    description = "An implementation of the Language Server Protocol for Python";
+    license = licenses.mit;
+    maintainers = [ maintainers.mic92 ];
+  };
+}

pkgs/development/python-modules/pyls-mypy/default.nix

@@ -0,0 +1,43 @@
+{ lib, buildPythonPackage, fetchFromGitHub, fetchpatch
+, future, python-language-server, mypy, configparser
+, pytest, mock, isPy3k, pytestcov, coverage
+}:
+
+buildPythonPackage rec {
+  pname = "pyls-mypy";
+  version = "0.1.2";
+
+  src = fetchFromGitHub {
+    owner = "tomv564";
+    repo = "pyls-mypy";
+    rev = version;
+    sha256 = "0wa038a8a8yj3wmrc7q909nj4b5d3lq70ysbw7rpsnyb0x06m826";
+  };
+
+  disabled = !isPy3k;
+
+  patches = [
+    # also part of https://github.com/tomv564/pyls-mypy/pull/10
+    (fetchpatch {
+      url = "https://github.com/Mic92/pyls-mypy/commit/4c727120d2cbd8bf2825e1491cd55175f03266d2.patch";
+      sha256 = "1dgn5z742swpxwknmgvm65jpxq9zwzhggw4nl6ys7yw8r49kqgrl";
+    })
+  ];
+
+  checkPhase = ''
+    HOME=$TEMPDIR pytest
+  '';
+
+  checkInputs = [ pytest mock pytestcov coverage ];
+
+  propagatedBuildInputs = [
+    mypy python-language-server future configparser
+  ];
+
+  meta = with lib; {
+    homepage = https://github.com/palantir/python-language-server;
+    description = "An implementation of the Language Server Protocol for Python";
+    license = licenses.mit;
+    maintainers = [ maintainers.mic92 ];
+  };
+}

pkgs/development/python-modules/pynmea2/default.nix

@@ -0,0 +1,21 @@
+{ lib, buildPythonPackage, fetchPypi, pytest }:
+
+buildPythonPackage rec {
+  pname = "pynmea2";
+  version = "1.12.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "185wxn8gag9whxmysspbh8s7wn3sh1glgf508w2zzwi4lklryl7i";
+  };
+
+  checkInputs = [ pytest ];
+  checkPhase = "pytest";
+
+  meta = {
+    homepage = https://github.com/Knio/pynmea2;
+    description = "Python library for the NMEA 0183 protcol";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ geistesk ];
+  };
+}

pkgs/development/python-modules/python-language-server/default.nix

@@ -0,0 +1,48 @@
+{ lib, buildPythonPackage, fetchFromGitHub, pythonOlder, isPy27
+, configparser, futures, future, jedi, pluggy
+, pytest, mock, pytestcov, coverage
+# The following packages are optional and
+# can be overwritten with null as your liking.
+# This also requires to disable tests.
+, rope ? null
+, mccabe ? null
+, pyflakes ? null
+, pycodestyle ? null
+, autopep8 ? null
+, yapf ? null
+, pydocstyle ? null
+}:
+
+buildPythonPackage rec {
+  pname = "python-language-server";
+  version = "0.18.0";
+
+  src = fetchFromGitHub {
+    owner = "palantir";
+    repo = "python-language-server";
+    rev = version;
+    sha256 = "0ig34bc0qm6gdj8xakmm3877lmf8ms7qg0xj8hay9gpgf8cz894s";
+  };
+
+  checkInputs = [
+    pytest mock pytestcov coverage
+    # rope is technically a dependency, but we don't add it by default since we
+    # already have jedi, which is the preferred option
+    rope
+  ];
+  checkPhase = ''
+    HOME=$TEMPDIR pytest
+  '';
+
+  propagatedBuildInputs = [
+    jedi pluggy mccabe pyflakes pycodestyle yapf pydocstyle future autopep8
+  ] ++ lib.optional (isPy27) [ configparser ]
+    ++ lib.optional (pythonOlder "3.2") [ futures ];
+
+  meta = with lib; {
+    homepage = https://github.com/palantir/python-language-server;
+    description = "An implementation of the Language Server Protocol for Python";
+    license = licenses.mit;
+    maintainers = [ maintainers.mic92 ];
+  };
+}

pkgs/development/python-modules/python-openid/default.nix

@@ -0,0 +1,20 @@
+{ stdenv, buildPythonPackage, fetchPypi }:
+
+buildPythonPackage rec {
+  pname = "python-openid";
+  name = "${pname}-${version}";
+  version = "2.2.5";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1vvhxlghjan01snfdc4k7ykd80vkyjgizwgg9bncnin8rqz1ricj";
+  };
+
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "OpenID support for modern servers and consumers";
+    homepage = http://github.com/openid/python-openid;
+    license = licenses.asl20;
+  };
+}

pkgs/development/python-modules/python3-openid/default.nix

@@ -0,0 +1,22 @@
+{ stdenv, buildPythonPackage, fetchPypi, defusedxml }:
+
+buildPythonPackage rec {
+  pname = "python3-openid";
+  name = "${pname}-${version}";
+  version = "3.1.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "00l5hrjh19740w00b3fnsqldnla41wbr2rics09dl4kyd1fkd3b2";
+  };
+
+  propagatedBuildInputs = [ defusedxml ];
+
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "OpenID support for modern servers and consumers";
+    homepage = http://github.com/necaris/python3-openid;
+    license = licenses.asl20;
+  };
+}

pkgs/development/python-modules/raven/default.nix

@@ -4,13 +4,13 @@
 
 buildPythonPackage rec {
   pname = "raven";
-  version = "6.7.0";
+  version = "6.8.0";
 
   src = fetchFromGitHub {
     owner = "getsentry";
     repo = "raven-python";
     rev = version;
-    sha256 = "0vb6zczfgrrh0qw5wlbvk703r11y091k6r53fbbhpbwh4hva30nx";
+    sha256 = "0d052nns0pf1bsazapnnrylvair37vhnjaifsdldddqv05ccfc57";
   };
 
   # way too many dependencies to run tests

pkgs/development/python-modules/torchvision/default.nix

@@ -4,10 +4,11 @@
 , numpy
 , pillow
 , pytorch
-, lib }:
+, lib
+}:
 
 buildPythonPackage rec {
-  version = "0.1.9";
+  version = "0.2.1";
   pname   = "torchvision";
   name    = "${pname}-${version}";
 
@@ -16,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit pname version;
     format = "wheel";
-    sha256 = "016rjfh9w1x4xpw15ryxsvq3j2li17nd3a7qslnf3241hc6vdcwf";
+    sha256 = "18gvdabkmzfjg47ns0lw38mf85ry28nq1mas5rzlwvb4l5zmw2ms";
   };
 
   propagatedBuildInputs = [ six numpy pillow pytorch ];

pkgs/development/ruby-modules/gem-config/default.nix

@@ -208,6 +208,13 @@ in
     ] ++ lib.optional stdenv.isDarwin "--with-iconv-dir=${libiconv}";
   };
 
+  oxidized = attrs: {
+    postInstall = ''
+      cd "$(cat "$out/nix-support/gem-meta/install-path")"
+      patch -p1 < ${../../../tools/admin/oxidized/temporary-x-series.patch}
+    '';
+  };
+
   pango = attrs: {
   nativeBuildInputs = [ pkgconfig ];
     buildInputs = [ gtk2 xorg.libXdmcp pcre xorg.libpthreadstubs ];

pkgs/development/tools/parsing/ragel/default.nix

@@ -43,8 +43,8 @@ in
   };
 
   ragelDev = generic {
-    version = "7.0.0.10";
+    version = "7.0.0.11";
-    sha256 = "1v4ddzxal4gf8l8nkn32qabba6nbpd2mg8sphgmdn8kaqv52nmj0";
+    sha256 = "0h2k9bfz9i7x9mvr9rbsrzz8fk17756zwwrkf3fppvm9ivzwdfh8";
     license = stdenv.lib.licenses.mit;
   };
 }

pkgs/development/tools/rust/cbindgen/default.nix

@@ -0,0 +1,22 @@
+{ stdenv, fetchFromGitHub, rustPlatform }:
+
+rustPlatform.buildRustPackage rec {
+  name = "rust-cbindgen-${version}";
+  version = "0.6.0";
+
+  src = fetchFromGitHub {
+    owner = "eqrion";
+    repo = "cbindgen";
+    rev = "v${version}";
+    sha256 = "0yzjbmdhhwbg551bm06xwwdjdm5kdqw37pgd7hals8qxb0dzmmh8";
+  };
+
+  cargoSha256 = "1ml4a7xp40l3bhfhpwdrwj3k99zhan9dzpkw71fa689xmv6pdj62";
+
+  meta = with stdenv.lib; {
+    description = "A project for generating C bindings from Rust code";
+    homepage = https://github.com/eqrion/cbindgen;
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ jtojnar ];
+  };
+}

pkgs/development/tools/skopeo/default.nix

@@ -5,13 +5,13 @@
 with stdenv.lib;
 
 let
-  version = "0.1.29";
+  version = "0.1.30";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "projectatomic";
     repo = "skopeo";
-    sha256 = "1lhzbyj2mm25x12s7g2jx4v8w19izjwlgx4lml13r5yy1spn65k2";
+    sha256 = "10lpiiki7mlhrp4bid40wys3lch7fars1whxsa5gy0frfgp89ghn";
   };
 
   defaultPolicyFile = runCommand "skopeo-default-policy.json" {} "cp ${src}/default-policy.json $out";
@@ -30,7 +30,11 @@ buildGoPackage rec {
   nativeBuildInputs = [ pkgconfig (lib.getBin go-md2man) ];
   buildInputs = [ gpgme libgpgerror devicemapper btrfs-progs ostree libselinux ];
 
-  buildFlagsArray = "-ldflags= -X github.com/projectatomic/skopeo/vendor/github.com/containers/image/signature.systemDefaultPolicyPath=${defaultPolicyFile}";
+  buildFlagsArray = ''
+    -ldflags=
+    -X github.com/projectatomic/skopeo/vendor/github.com/containers/image/signature.systemDefaultPolicyPath=${defaultPolicyFile}
+    -X github.com/projectatomic/skopeo/vendor/github.com/containers/image/internal/tmpdir.unixTempDirForBigFiles=/tmp
+  '';
 
   preBuild = ''
     export CGO_CFLAGS="-I${getDev gpgme}/include -I${getDev libgpgerror}/include -I${getDev devicemapper}/include -I${getDev btrfs-progs}/include"

pkgs/development/tools/yarn/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "yarn-${version}";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src = fetchzip {
     url = "https://github.com/yarnpkg/yarn/releases/download/v${version}/yarn-v${version}.tar.gz";
-    sha256 = "0bblp1jy4s9y5rpcqn40w61qwsmxr342xkcn7ykk88i7sng2cgfw";
+    sha256 = "00fxihv9ih40k6f21a7hb6vkx4h4m6ks0fbai5h9ssi0p4m5j3by";
   };
 
   buildInputs = [makeWrapper nodejs];

pkgs/os-specific/darwin/ios-sdk-pkgs/default.nix

@@ -6,6 +6,7 @@
 , wrapBintoolsWith
 , wrapCCWith
 , buildIosSdk, targetIosSdkPkgs
+, xcode
 }:
 
 let
@@ -21,11 +22,10 @@ iosPlatformArch = { parsed, ... }: {
 in
 
 rec {
-  # TODO(kmicklas): Make a pure version of this for each supported SDK version.
   sdk = rec {
     name = "ios-sdk";
     type = "derivation";
-    outPath = "/Applications/Xcode.app/Contents/Developer/Platforms/iPhone${sdkType}.platform/Developer/SDKs/iPhone${sdkType}${version}.sdk";
+    outPath = xcode + "/Contents/Developer/Platforms/iPhone${sdkType}.platform/Developer/SDKs/iPhone${sdkType}${version}.sdk";
 
     sdkType = if targetPlatform.isiPhoneSimulator then "Simulator" else "OS";
     version = targetPlatform.sdkVer;

pkgs/os-specific/darwin/xcode/default.nix

@@ -1,51 +1,48 @@
-{ stdenv, requireFile, xpwn }:
+{ stdenv, requireFile }:
 
-with stdenv.lib;
+let requireXcode = version: sha256:
+  let
+    xip = "Xcode_" + version +  ".xip";
+    # TODO(alexfmpe): Find out how to validate the .xip signature in Linux
+    unxip = if stdenv.isDarwin
+            then ''
+              open -W ${xip}
+              rm -rf ${xip}
+            ''
+            else ''
+              xar -xf ${xip}
+              rm -rf ${xip}
+              pbzx -n Content | cpio -i
+              rm Content Metadata
+            '';
+    app = requireFile rec {
+      name     = "Xcode.app";
+      url      = "https://download.developer.apple.com/Developer_Tools/Xcode_" + version + "/" + xip;
+      hashMode = "recursive";
+      inherit sha256;
+      message  = ''
+        Unfortunately, we cannot download ${name} automatically.
+        Please go to ${url}
+        to download it yourself, and add it to the Nix store by running the following commands."
+        Note: download (~ 5GB), extraction and storing of Xcode will take a while
 
-let
+        ${unxip}
-  osxVersion = "10.9";
+        nix-store --add-fixed --recursive sha256 Xcode.app
-in stdenv.mkDerivation rec {
+        rm -rf Xcode.app
-  name = "xcode-${version}";
+      '';
-  version = "5.1";
+    };
+    meta = with stdenv.lib; {
+      homepage = https://developer.apple.com/downloads/;
+      description = "Apple's XCode SDK";
+      license = licenses.unfree;
+      platforms = platforms.darwin ++ platforms.linux;
+    };
 
-  src = requireFile {
+  in app.overrideAttrs ( oldAttrs: oldAttrs // { inherit meta; });
-    name = "xcode_${version}.dmg";
-    url = meta.homepage;
-    sha256 = "70bb550cc14eca80b9825f4ae9bfbf7f076bb75777311be428bc30a7eb7a6f7e";
-  };
 
-  outputs = [ "out" "toolchain" ];
+in {
-
+  xcode_8_1 = requireXcode "8.1" "18xjvfipwzia66gm3r9p770xdd4r375vak7chw5vgqnv9yyjiq2n";
-
+  xcode_8_2 = requireXcode "8.2" "13nd1zsfqcp9hwp15hndr0rsbb8rgprrz7zr2ablj4697qca06m2";
-  unpackCmd = let
+  xcode_9_1 = requireXcode "9.1" "0ab1403wy84ys3yn26fj78cazhpnslmh3nzzp1wxib3mr1afjvic";
-    basePath = "Xcode.app/Contents/Developer/Platforms/MacOSX.platform";
+  xcode_9_2 = requireXcode "9.2" "1bgfgdp266cbbqf2axcflz92frzvhi0qw0jdkcw6r85kdpc8dj4c";
-    sdkPath = "${basePath}/Developer/SDKs";
-  in ''
-    ${xpwn}/bin/dmg extract "$curSrc" main.hfs > /dev/null
-    ${xpwn}/bin/hfsplus main.hfs extractall "${sdkPath}" > /dev/null
-  '';
-
-  setSourceRoot = "sourceRoot=MacOSX${osxVersion}.sdk";
-
-  patches = optional (osxVersion == "10.9") ./gcc-fix-enum-attributes.patch;
-
-  installPhase = ''
-    mkdir -p "$out/share/sysroot"
-    cp -a * "$out/share/sysroot/"
-    ln -s "$out/share/sysroot/usr/lib" "$out/lib"
-    ln -s "$out/share/sysroot/usr/include" "$out/include"
-
-    mkdir -p "$toolchain"
-    pushd "$toolchain"
-    ${xpwn}/bin/hfsplus "$(dirs +1)/../main.hfs" extractall \
-      Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr \
-      > /dev/null
-    popd
-  '';
-
-  meta = {
-    homepage = https://developer.apple.com/downloads/;
-    description = "Apple's XCode SDK";
-    license = stdenv.lib.licenses.unfree;
-  };
 }

pkgs/os-specific/linux/criu/default.nix

@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   name    = "criu-${version}";
-  version = "3.8.1";
+  version = "3.9";
 
   src = fetchurl {
     url    = "http://download.openvz.org/criu/${name}.tar.bz2";
-    sha256 = "0csyhsc5d6wkcjyvsp6h9x8zxn3zk574s84gfmy3gjagv3nwqd51";
+    sha256 = "0l71lmklr42pc2bj37pkp7y8va8bx42n9f6i4q4idsx4wrdd75fx";
   };
 
   enableParallelBuilding = true;

pkgs/os-specific/linux/kernel/linux-4.14.nix

@@ -3,13 +3,13 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.42";
+  version = "4.14.43";
 
   # branchVersion needs to be x.y
   extraMeta.branch = concatStrings (intersperse "." (take 2 (splitString "." version)));
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "00wh8ydawy6j18as28albzid88cm2aanzr8vz367jjp2k5pi00rb";
+    sha256 = "0jkikvjsrz7wk1zx57brzhhs15gbx022f1as4mn0017az7wc0gqk";
   };
 } // (args.argsOverride or {}))

pkgs/os-specific/linux/kernel/linux-4.16.nix

@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.16.10";
+  version = "4.16.11";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = concatStrings (intersperse "." (take 3 (splitString "." "${version}.0")));
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1gnf16p4rmibcn3wn5zp4pl2zmhgk4dg6718gvdr8vcffd87ksc0";
+    sha256 = "088931hgi5acm8nz19nd09skmamr3hhfb958374j30br6f94pfkd";
   };
 } // (args.argsOverride or {}))

pkgs/os-specific/linux/kernel/linux-4.9.nix

@@ -1,11 +1,11 @@
 { stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.101";
+  version = "4.9.102";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "005awyjylyp7di8cy269923j7wsvv74s42k7955fq0790wmx15dg";
+    sha256 = "1icx253l8s158d1ccn594ddkqdxch8jr0w6kbj00jn1dlmms6mfi";
   };
 } // (args.argsOverride or {}))

pkgs/os-specific/linux/syslinux/default.nix

@@ -50,6 +50,9 @@ stdenv.mkDerivation rec {
   postInstall = ''
     wrapProgram $out/bin/syslinux \
       --prefix PATH : "${mtools}/bin"
+
+    # Delete com32 headers to save space, nobody seems to be using them
+    rm -rf $out/share/syslinux/com32
   '';
 
   meta = with stdenv.lib; {

pkgs/servers/atlassian/confluence.nix

@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   name = "atlassian-confluence-${version}";
-  version = "6.6.1";
+  version = "6.8.0";
 
   src = fetchurl {
     url = "https://www.atlassian.com/software/confluence/downloads/binary/${name}.tar.gz";
-    sha256 = "0nb8rjzfd0fqd9k1yxa3dj7kxgh84dgbg9l8jyj59g74ym77qmw0";
+    sha256 = "07awdbkjxkk4rbnpbb5xfjp4125c33bwxncmydlgzgk5fzy6dg2w";
   };
 
   phases = [ "unpackPhase" "buildPhase" "installPhase" ];

pkgs/servers/atlassian/crowd.nix

@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   name = "atlassian-crowd-${version}";
-  version = "3.0.1";
+  version = "3.1.2";
 
   src = fetchurl {
     url = "https://www.atlassian.com/software/crowd/downloads/binary/${name}.tar.gz";
-    sha256 = "17pz0rgzdv40sbvzb9w6xmdg598m6gs7gsznfnxcy1j011cgg1wr";
+    sha256 = "0pnl0zl38827ckgxh4y1mnq3lr7bvd7v3ysdxxv3nfr5zya4xgki";
   };
 
   phases = [ "unpackPhase" "buildPhase" "installPhase" "fixupPhase" ];

pkgs/servers/atlassian/jira.nix

@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   name = "atlassian-jira-${version}";
-  version = "7.9.0";
+  version = "7.9.2";
 
   src = fetchurl {
     url = "https://downloads.atlassian.com/software/jira/downloads/atlassian-jira-software-${version}.tar.gz";
-    sha256 = "1xj04a78dhjzb2ms875lfg5s3qc8rw31fws92yhmbs0k1866g33b";
+    sha256 = "05976h6033v2w7d05qnigxmsrm33bg7gmgyzpvis8910fkxrhvhh";
   };
 
   phases = [ "unpackPhase" "buildPhase" "installPhase" "fixupPhase" ];

pkgs/servers/matrix-synapse/default.nix

@@ -26,13 +26,13 @@ let
   };
 in pythonPackages.buildPythonApplication rec {
   name = "matrix-synapse-${version}";
-  version = "0.28.1";
+  version = "0.30.0";
 
   src = fetchFromGitHub {
     owner = "matrix-org";
     repo = "synapse";
     rev = "v${version}";
-    sha256 = "1xgiprnhp893zc0g3i7wpwzgjy6q5nb858p0s6kcsca60vr9j6h0";
+    sha256 = "10ggv7669ngxs8py82k8z24874ga0ldcxvpp7xhjpbr1s0gw8zv8";
   };
 
   patches = [

pkgs/tools/admin/oxidized/Gemfile

@@ -0,0 +1,5 @@
+source 'https://rubygems.org'
+
+gem 'oxidized'
+gem 'oxidized-web'
+gem 'oxidized-script'

pkgs/tools/admin/oxidized/Gemfile.lock

@@ -0,0 +1,69 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    asetus (0.3.0)
+    backports (3.11.2)
+    emk-sinatra-url-for (0.2.1)
+      sinatra (>= 0.9.1.1)
+    ffi (1.9.23)
+    haml (4.0.7)
+      tilt
+    htmlentities (4.3.4)
+    multi_json (1.13.1)
+    net-ssh (4.1.0)
+    oxidized (0.21.0)
+      asetus (~> 0.1)
+      net-ssh (~> 4.1.0)
+      rugged (~> 0.21, >= 0.21.4)
+      slop (~> 3.5)
+    oxidized-script (0.5.0)
+      oxidized (~> 0.21.0)
+      slop (~> 3.5)
+    oxidized-web (0.9.3)
+      emk-sinatra-url-for (~> 0.2)
+      haml (~> 4.0)
+      htmlentities (~> 4.3)
+      oxidized (~> 0.21.0)
+      puma (~> 3)
+      sass (~> 3.3)
+      sinatra (~> 1.4, >= 1.4.6)
+      sinatra-contrib (~> 1.4, >= 1.4.6)
+    puma (3.11.3)
+    rack (1.6.9)
+    rack-protection (1.5.5)
+      rack
+    rack-test (1.0.0)
+      rack (>= 1.0, < 3)
+    rb-fsevent (0.10.3)
+    rb-inotify (0.9.10)
+      ffi (>= 0.5.0, < 2)
+    rugged (0.27.0)
+    sass (3.5.6)
+      sass-listen (~> 4.0.0)
+    sass-listen (4.0.0)
+      rb-fsevent (~> 0.9, >= 0.9.4)
+      rb-inotify (~> 0.9, >= 0.9.7)
+    sinatra (1.4.8)
+      rack (~> 1.5)
+      rack-protection (~> 1.4)
+      tilt (>= 1.3, < 3)
+    sinatra-contrib (1.4.7)
+      backports (>= 2.0)
+      multi_json
+      rack-protection
+      rack-test
+      sinatra (~> 1.4.0)
+      tilt (>= 1.3, < 3)
+    slop (3.6.0)
+    tilt (2.0.8)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  oxidized
+  oxidized-script
+  oxidized-web
+
+BUNDLED WITH
+   1.14.6

pkgs/tools/admin/oxidized/default.nix

@@ -0,0 +1,18 @@
+{ lib, fetchFromGitHub, ruby, git, bundlerApp }:
+
+bundlerApp rec {
+  pname = "oxidized";
+  gemdir = ./.;
+
+  inherit ruby;
+
+  exes = [ "oxidized" "oxidized-web" "oxidized-script" ];
+
+  meta = with lib; {
+    description = "Oxidized is a network device configuration backup tool. It's a RANCID replacement!";
+    homepage    = https://github.com/ytti/oxidized;
+    license     = licenses.asl20;
+    maintainers = [ maintainers.willibutz ];
+    platforms   = platforms.linux;
+  };
+}

pkgs/tools/admin/oxidized/gemset.nix

@@ -0,0 +1,206 @@
+{
+  asetus = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1zkr8cbp8klanqmhzz7qmimzlxh6zmsy98zb3s75af34l7znq790";
+      type = "gem";
+    };
+    version = "0.3.0";
+  };
+  backports = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0sw58rsz1hl821ia1jj3nnl3jr7xwfkcljgs56kpq3fakzcljcdz";
+      type = "gem";
+    };
+    version = "3.11.2";
+  };
+  emk-sinatra-url-for = {
+    dependencies = ["sinatra"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0rd5b1lraklv0hblzdnmw2z3dragfg0qqk7wxbpn58f8y7jxzjgj";
+      type = "gem";
+    };
+    version = "0.2.1";
+  };
+  ffi = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0zw6pbyvmj8wafdc7l5h7w20zkp1vbr2805ql5d941g2b20pk4zr";
+      type = "gem";
+    };
+    version = "1.9.23";
+  };
+  haml = {
+    dependencies = ["tilt"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0mrzjgkygvfii66bbylj2j93na8i89998yi01fin3whwqbvx0m1p";
+      type = "gem";
+    };
+    version = "4.0.7";
+  };
+  htmlentities = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1nkklqsn8ir8wizzlakncfv42i32wc0w9hxp00hvdlgjr7376nhj";
+      type = "gem";
+    };
+    version = "4.3.4";
+  };
+  multi_json = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1rl0qy4inf1mp8mybfk56dfga0mvx97zwpmq5xmiwl5r770171nv";
+      type = "gem";
+    };
+    version = "1.13.1";
+  };
+  net-ssh = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "013p5jb4wy0cq7x7036piw2a3s1i9p752ki1srx2m289mpz4ml3q";
+      type = "gem";
+    };
+    version = "4.1.0";
+  };
+  oxidized = {
+    dependencies = ["asetus" "net-ssh" "rugged" "slop"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0xqx0iawj2cm6083a61y43d6a76xaypiw0nkyirx02lhynq07yz0";
+      type = "gem";
+    };
+    version = "0.21.0";
+  };
+  oxidized-script = {
+    dependencies = ["oxidized" "slop"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "12c15gksrrar9kradcv6mx2d4a8ixa4lykszb4pcapiw5mi35mxp";
+      type = "gem";
+    };
+    version = "0.5.0";
+  };
+  oxidized-web = {
+    dependencies = ["emk-sinatra-url-for" "haml" "htmlentities" "oxidized" "puma" "sass" "sinatra" "sinatra-contrib"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "14s10pr8qaq6g19zi753igngp02li46k3nm5ap537r3743v1l4f9";
+      type = "gem";
+    };
+    version = "0.9.3";
+  };
+  puma = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "03313mnx8n6g9qs9l5zafqq90grrhq2nqrmjs8lsffi28mgd3cfd";
+      type = "gem";
+    };
+    version = "3.11.3";
+  };
+  rack = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "03w1ri5l91q800f1bdcdl5rbagy7s4kml136b42s2lmxmznxhr07";
+      type = "gem";
+    };
+    version = "1.6.9";
+  };
+  rack-protection = {
+    dependencies = ["rack"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0my0wlw4a5l3hs79jkx2xzv7djhajgf8d28k8ai1ddlnxxb0v7ss";
+      type = "gem";
+    };
+    version = "1.5.5";
+  };
+  rack-test = {
+    dependencies = ["rack"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1l799s5qr2qrshvrggq5ch3v235y491zfww07b39w4pj4vpa65l1";
+      type = "gem";
+    };
+    version = "1.0.0";
+  };
+  rb-fsevent = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1lm1k7wpz69jx7jrc92w3ggczkjyjbfziq5mg62vjnxmzs383xx8";
+      type = "gem";
+    };
+    version = "0.10.3";
+  };
+  rb-inotify = {
+    dependencies = ["ffi"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0yfsgw5n7pkpyky6a9wkf1g9jafxb0ja7gz0qw0y14fd2jnzfh71";
+      type = "gem";
+    };
+    version = "0.9.10";
+  };
+  rugged = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0q1krxgd0ql03x8m9m05x5sxizw5sc7lms7rkp44qf45grpdk3v3";
+      type = "gem";
+    };
+    version = "0.27.0";
+  };
+  sass = {
+    dependencies = ["sass-listen"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "19wyzp9qsg8hdkkxlsv713w0qmy66qrdp0shj42587ssx4qhrlag";
+      type = "gem";
+    };
+    version = "3.5.6";
+  };
+  sass-listen = {
+    dependencies = ["rb-fsevent" "rb-inotify"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0xw3q46cmahkgyldid5hwyiwacp590zj2vmswlll68ryvmvcp7df";
+      type = "gem";
+    };
+    version = "4.0.0";
+  };
+  sinatra = {
+    dependencies = ["rack" "rack-protection" "tilt"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0byxzl7rx3ki0xd7aiv1x8mbah7hzd8f81l65nq8857kmgzj1jqq";
+      type = "gem";
+    };
+    version = "1.4.8";
+  };
+  sinatra-contrib = {
+    dependencies = ["backports" "multi_json" "rack-protection" "rack-test" "sinatra" "tilt"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0vi3i0icbi2figiayxpvxbqpbn1syma7w4p4zw5mav1ln4c7jnfr";
+      type = "gem";
+    };
+    version = "1.4.7";
+  };
+  slop = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "00w8g3j7k7kl8ri2cf1m58ckxk8rn350gp4chfscmgv6pq1spk3n";
+      type = "gem";
+    };
+    version = "3.6.0";
+  };
+  tilt = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0020mrgdf11q23hm1ddd6fv691l51vi10af00f137ilcdb2ycfra";
+      type = "gem";
+    };
+    version = "2.0.8";
+  };
+}