Merge staging into staging-next

maintainers/maintainer-list.nix

@@ -93,6 +93,11 @@
     github = "adolfogc";
     name = "Adolfo E. García Castro";
   };
+  aepsil0n = {
+    email = "eduard.bopp@aepsil0n.de";
+    github = "aepsil0n";
+    name = "Eduard Bopp";
+  };
   aespinosa = {
     email = "allan.espinosa@outlook.com";
     github = "aespinosa";

nixos/modules/rename.nix

@@ -37,7 +37,15 @@ with lib;
     (mkRenamedOptionModule [ "services" "kubernetes" "addons" "dashboard" "enableRBAC" ] [ "services" "kubernetes" "addons" "dashboard" "rbac" "enable" ])
     (mkRenamedOptionModule [ "services" "logstash" "address" ] [ "services" "logstash" "listenAddress" ])
     (mkRenamedOptionModule [ "services" "mpd" "network" "host" ] [ "services" "mpd" "network" "listenAddress" ])
-    (mkRenamedOptionModule [ "services" "neo4j" "host" ] [ "services" "neo4j" "listenAddress" ])
+    (mkRenamedOptionModule [ "services" "neo4j" "host" ] [ "services" "neo4j" "defaultListenAddress" ])
+    (mkRenamedOptionModule [ "services" "neo4j" "listenAddress" ] [ "services" "neo4j" "defaultListenAddress" ])
+    (mkRenamedOptionModule [ "services" "neo4j" "enableBolt" ] [ "services" "neo4j" "bolt" "enable" ])
+    (mkRenamedOptionModule [ "services" "neo4j" "enableHttps" ] [ "services" "neo4j" "https" "enable" ])
+    (mkRenamedOptionModule [ "services" "neo4j" "certDir" ] [ "services" "neo4j" "directories" "certificates" ])
+    (mkRenamedOptionModule [ "services" "neo4j" "dataDir" ] [ "services" "neo4j" "directories" "home" ])
+    (mkRemovedOptionModule [ "services" "neo4j" "port" ] "Use services.neo4j.http.listenAddress instead.")
+    (mkRemovedOptionModule [ "services" "neo4j" "boltPort" ] "Use services.neo4j.bolt.listenAddress instead.")
+    (mkRemovedOptionModule [ "services" "neo4j" "httpsPort" ] "Use services.neo4j.https.listenAddress instead.")
     (mkRenamedOptionModule [ "services" "shout" "host" ] [ "services" "shout" "listenAddress" ])
     (mkRenamedOptionModule [ "services" "sslh" "host" ] [ "services" "sslh" "listenAddress" ])
     (mkRenamedOptionModule [ "services" "statsd" "host" ] [ "services" "statsd" "listenAddress" ])

nixos/modules/services/databases/neo4j.nix

@@ -1,32 +1,87 @@
-{ config, lib, pkgs, ... }:
+{ config, options, lib, pkgs, ... }:
 
 with lib;
 
 let
   cfg = config.services.neo4j;
+  certDirOpt = options.services.neo4j.directories.certificates;
+  isDefaultPathOption = opt: isOption opt && opt.type == types.path && opt.highestPrio >= 1500;
+
+  sslPolicies = mapAttrsToList (
+    name: conf: ''
+      dbms.ssl.policy.${name}.allow_key_generation=${boolToString conf.allowKeyGeneration}
+      dbms.ssl.policy.${name}.base_directory=${conf.baseDirectory}
+      ${optionalString (conf.ciphers != null) ''
+        dbms.ssl.policy.${name}.ciphers=${concatStringsSep "," conf.ciphers}
+      ''}
+      dbms.ssl.policy.${name}.client_auth=${conf.clientAuth}
+      ${if length (splitString "/" conf.privateKey) > 1 then
+        ''dbms.ssl.policy.${name}.private_key=${conf.privateKey}''
+      else
+        ''dbms.ssl.policy.${name}.private_key=${conf.baseDirectory}/${conf.privateKey}''
+      }
+      ${if length (splitString "/" conf.privateKey) > 1 then
+        ''dbms.ssl.policy.${name}.public_certificate=${conf.publicCertificate}''
+      else
+        ''dbms.ssl.policy.${name}.public_certificate=${conf.baseDirectory}/${conf.publicCertificate}''
+      }
+      dbms.ssl.policy.${name}.revoked_dir=${conf.revokedDir}
+      dbms.ssl.policy.${name}.tls_versions=${concatStringsSep "," conf.tlsVersions}
+      dbms.ssl.policy.${name}.trust_all=${boolToString conf.trustAll}
+      dbms.ssl.policy.${name}.trusted_dir=${conf.trustedDir}
+    ''
+  ) cfg.ssl.policies;
 
   serverConfig = pkgs.writeText "neo4j.conf" ''
-    dbms.directories.data=${cfg.dataDir}/data
+    # General
-    dbms.directories.certificates=${cfg.certDir}
+    dbms.allow_upgrade=${boolToString cfg.allowUpgrade}
-    dbms.directories.logs=${cfg.dataDir}/logs
+    dbms.connectors.default_listen_address=${cfg.defaultListenAddress}
-    dbms.directories.plugins=${cfg.dataDir}/plugins
+    dbms.read_only=${boolToString cfg.readOnly}
-    dbms.connector.http.type=HTTP
+    ${optionalString (cfg.workerCount > 0) ''
-    dbms.connector.http.enabled=true
+      dbms.threads.worker_count=${toString cfg.workerCount}
-    dbms.connector.http.address=${cfg.listenAddress}:${toString cfg.port}
-    ${optionalString cfg.enableBolt ''
-      dbms.connector.bolt.type=BOLT
-      dbms.connector.bolt.enabled=true
-      dbms.connector.bolt.tls_level=OPTIONAL
-      dbms.connector.bolt.address=${cfg.listenAddress}:${toString cfg.boltPort}
     ''}
-    ${optionalString cfg.enableHttps ''
+
-      dbms.connector.https.type=HTTP
+    # Directories
-      dbms.connector.https.enabled=true
+    dbms.directories.certificates=${cfg.directories.certificates}
-      dbms.connector.https.encryption=TLS
+    dbms.directories.data=${cfg.directories.data}
-      dbms.connector.https.address=${cfg.listenAddress}:${toString cfg.httpsPort}
+    dbms.directories.logs=${cfg.directories.home}/logs
+    dbms.directories.plugins=${cfg.directories.plugins}
+    ${optionalString (cfg.constrainLoadCsv) ''
+      dbms.directories.import=${cfg.directories.imports}
     ''}
-    dbms.shell.enabled=true
+
-    ${cfg.extraServerConfig}
+    # HTTP Connector
+    ${optionalString (cfg.http.enable) ''
+      dbms.connector.http.enabled=${boolToString cfg.http.enable}
+      dbms.connector.http.listen_address=${cfg.http.listenAddress}
+    ''}
+    ${optionalString (!cfg.http.enable) ''
+      # It is not possible to disable the HTTP connector. To fully prevent
+      # clients from connecting to HTTP, block the HTTP port (7474 by default)
+      # via firewall. listen_address is set to the loopback interface to
+      # prevent remote clients from connecting.
+      dbms.connector.http.listen_address=127.0.0.1
+    ''}
+
+    # HTTPS Connector
+    dbms.connector.https.enabled=${boolToString cfg.https.enable}
+    dbms.connector.https.listen_address=${cfg.https.listenAddress}
+    https.ssl_policy=${cfg.https.sslPolicy}
+
+    # BOLT Connector
+    dbms.connector.bolt.enabled=${boolToString cfg.bolt.enable}
+    dbms.connector.bolt.listen_address=${cfg.bolt.listenAddress}
+    bolt.ssl_policy=${cfg.bolt.sslPolicy}
+    dbms.connector.bolt.tls_level=${cfg.bolt.tlsLevel}
+
+    # neo4j-shell
+    dbms.shell.enabled=${boolToString cfg.shell.enable}
+
+    # SSL Policies
+    ${concatStringsSep "\n" sslPolicies}
+
+    # Default retention policy from neo4j.conf
+    dbms.tx_log.rotation.retention_policy=1 days
 
     # Default JVM parameters from neo4j.conf
     dbms.jvm.additional=-XX:+UseG1GC
@@ -36,8 +91,14 @@ let
     dbms.jvm.additional=-XX:+TrustFinalNonStaticFields
     dbms.jvm.additional=-XX:+DisableExplicitGC
     dbms.jvm.additional=-Djdk.tls.ephemeralDHKeySize=2048
-
+    dbms.jvm.additional=-Djdk.tls.rejectClientInitiatedRenegotiation=true
     dbms.jvm.additional=-Dunsupported.dbms.udc.source=tarball
+
+    # Usage Data Collector
+    dbms.udc.enabled=${boolToString cfg.udc.enable}
+
+    # Extra Configuration
+    ${cfg.extraServerConfig}
   '';
 
 in {
@@ -45,105 +106,547 @@ in {
   ###### interface
 
   options.services.neo4j = {
+
     enable = mkOption {
-      description = "Whether to enable neo4j.";
-      default = false;
       type = types.bool;
+      default = false;
+      description = ''
+        Whether to enable Neo4j Community Edition.
+      '';
     };
 
-    package = mkOption {
+    allowUpgrade = mkOption {
-      description = "Neo4j package to use.";
+      type = types.bool;
-      default = pkgs.neo4j;
+      default = false;
-      defaultText = "pkgs.neo4j";
+      description = ''
-      type = types.package;
+        Allow upgrade of Neo4j database files from an older version.
+      '';
     };
 
-    listenAddress = mkOption {
+    constrainLoadCsv = mkOption {
-      description = "Neo4j listen address.";
+      type = types.bool;
-      default = "127.0.0.1";
-      type = types.str;
-    };
-
-    port = mkOption {
-      description = "Neo4j port to listen for HTTP traffic.";
-      default = 7474;
-      type = types.int;
-    };
-
-    enableBolt = mkOption {
-      description = "Enable bolt for Neo4j.";
       default = true;
-      type = types.bool;
+      description = ''
+        Sets the root directory for file URLs used with the Cypher
+        <literal>LOAD CSV</literal> clause to be that defined by
+        <option>directories.imports</option>. It restricts
+        access to only those files within that directory and its
+        subdirectories.
+        </para>
+        <para>
+        Setting this option to <literal>false</literal> introduces
+        possible security problems.
+      '';
     };
 
-    boltPort = mkOption {
+    defaultListenAddress = mkOption {
-      description = "Neo4j port to listen for BOLT traffic.";
+      type = types.str;
-      default = 7687;
+      default = "127.0.0.1";
-      type = types.int;
+      description = ''
-    };
+        Default network interface to listen for incoming connections. To
-
+        listen for connections on all interfaces, use "0.0.0.0".
-    enableHttps = mkOption {
+        </para>
-      description = "Enable https for Neo4j.";
+        <para>
-      default = false;
+        Specifies the default IP address and address part of connector
-      type = types.bool;
+        specific <option>listenAddress</option> options. To bind specific
-    };
+        connectors to a specific network interfaces, specify the entire
-
+        <option>listenAddress</option> option for that connector.
-    httpsPort = mkOption {
+      '';
-      description = "Neo4j port to listen for HTTPS traffic.";
-      default = 7473;
-      type = types.int;
-    };
-
-    certDir = mkOption {
-      description = "Neo4j TLS certificates directory.";
-      default = "${cfg.dataDir}/certificates";
-      type = types.path;
-    };
-
-    dataDir = mkOption {
-      description = "Neo4j data directory.";
-      default = "/var/lib/neo4j";
-      type = types.path;
     };
 
     extraServerConfig = mkOption {
-      description = "Extra configuration for neo4j server.";
-      default = "";
       type = types.lines;
+      default = "";
+      description = ''
+        Extra configuration for Neo4j Community server. Refer to the
+        <link xlink:href="https://neo4j.com/docs/operations-manual/current/reference/configuration-settings/">complete reference</link>
+        of Neo4j configuration settings.
+      '';
     };
+
+    package = mkOption {
+      type = types.package;
+      default = pkgs.neo4j;
+      defaultText = "pkgs.neo4j";
+      description = ''
+        Neo4j package to use.
+      '';
+    };
+
+    readOnly = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Only allow read operations from this Neo4j instance.
+      '';
+    };
+
+    workerCount = mkOption {
+      type = types.ints.between 0 44738;
+      default = 0;
+      description = ''
+        Number of Neo4j worker threads, where the default of
+        <literal>0</literal> indicates a worker count equal to the number of
+        available processors.
+      '';
+    };
+
+    bolt = {
+      enable = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Enable the BOLT connector for Neo4j. Setting this option to
+          <literal>false</literal> will stop Neo4j from listening for incoming
+          connections on the BOLT port (7687 by default).
+        '';
+      };
+
+      listenAddress = mkOption {
+        type = types.str;
+        default = ":7687";
+        description = ''
+          Neo4j listen address for BOLT traffic. The listen address is
+          expressed in the format <literal>&lt;ip-address&gt;:&lt;port-number&gt;</literal>.
+        '';
+      };
+
+      sslPolicy = mkOption {
+        type = types.str;
+        default = "legacy";
+        description = ''
+          Neo4j SSL policy for BOLT traffic.
+          </para>
+          <para>
+          The legacy policy is a special policy which is not defined in
+          the policy configuration section, but rather derives from
+          <option>directories.certificates</option> and
+          associated files (by default: <filename>neo4j.key</filename> and
+          <filename>neo4j.cert</filename>). Its use will be deprecated.
+          </para>
+          <para>
+          Note: This connector must be configured to support/require
+          SSL/TLS for the legacy policy to actually be utilized. See
+          <option>bolt.tlsLevel</option>.
+        '';
+      };
+
+      tlsLevel = mkOption {
+        type = types.enum [ "REQUIRED" "OPTIONAL" "DISABLED" ];
+        default = "OPTIONAL";
+        description = ''
+          SSL/TSL requirement level for BOLT traffic.
+        '';
+      };
+    };
+
+    directories = {
+      certificates = mkOption {
+        type = types.path;
+        default = "${cfg.directories.home}/certificates";
+        description = ''
+          Directory for storing certificates to be used by Neo4j for
+          TLS connections.
+          </para>
+          <para>
+          When setting this directory to something other than its default,
+          ensure the directory's existence, and that read/write permissions are
+          given to the Neo4j daemon user <literal>neo4j</literal>.
+          </para>
+          <para>
+          Note that changing this directory from its default will prevent
+          the directory structure required for each SSL policy from being
+          automatically generated. A policy's directory structure as defined by
+          its <option>baseDirectory</option>,<option>revokedDir</option> and
+          <option>trustedDir</option> must then be setup manually. The
+          existence of these directories is mandatory, as well as the presence
+          of the certificate file and the private key. Ensure the correct
+          permissions are set on these directories and files.
+        '';
+      };
+
+      data = mkOption {
+        type = types.path;
+        default = "${cfg.directories.home}/data";
+        description = ''
+          Path of the data directory. You must not configure more than one
+          Neo4j installation to use the same data directory.
+          </para>
+          <para>
+          When setting this directory to something other than its default,
+          ensure the directory's existence, and that read/write permissions are
+          given to the Neo4j daemon user <literal>neo4j</literal>.
+        '';
+      };
+
+      home = mkOption {
+        type = types.path;
+        default = "/var/lib/neo4j";
+        description = ''
+          Path of the Neo4j home directory. Other default directories are
+          subdirectories of this path. This directory will be created if
+          non-existent, and its ownership will be <command>chown</command> to
+          the Neo4j daemon user <literal>neo4j</literal>.
+        '';
+      };
+
+      imports = mkOption {
+        type = types.path;
+        default = "${cfg.directories.home}/import";
+        description = ''
+          The root directory for file URLs used with the Cypher
+          <literal>LOAD CSV</literal> clause. Only meaningful when
+          <option>constrainLoadCvs</option> is set to
+          <literal>true</literal>.
+          </para>
+          <para>
+          When setting this directory to something other than its default,
+          ensure the directory's existence, and that read permission is
+          given to the Neo4j daemon user <literal>neo4j</literal>.
+        '';
+      };
+
+      plugins = mkOption {
+        type = types.path;
+        default = "${cfg.directories.home}/plugins";
+        description = ''
+          Path of the database plugin directory. Compiled Java JAR files that
+          contain database procedures will be loaded if they are placed in
+          this directory.
+          </para>
+          <para>
+          When setting this directory to something other than its default,
+          ensure the directory's existence, and that read permission is
+          given to the Neo4j daemon user <literal>neo4j</literal>.
+        '';
+      };
+    };
+
+    http = {
+      enable = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          The HTTP connector is required for Neo4j, and cannot be disabled.
+          Setting this option to <literal>false</literal> will force the HTTP
+          connector's <option>listenAddress</option> to the loopback
+          interface to prevent connection of remote clients. To prevent all
+          clients from connecting, block the HTTP port (7474 by default) by
+          firewall.
+        '';
+      };
+
+      listenAddress = mkOption {
+        type = types.str;
+        default = ":7474";
+        description = ''
+          Neo4j listen address for HTTP traffic. The listen address is
+          expressed in the format <literal>&lt;ip-address&gt;:&lt;port-number&gt;</literal>.
+        '';
+      };
+    };
+
+    https = {
+      enable = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Enable the HTTPS connector for Neo4j. Setting this option to
+          <literal>false</literal> will stop Neo4j from listening for incoming
+          connections on the HTTPS port (7473 by default).
+        '';
+      };
+
+      listenAddress = mkOption {
+        type = types.str;
+        default = ":7473";
+        description = ''
+          Neo4j listen address for HTTPS traffic. The listen address is
+          expressed in the format <literal>&lt;ip-address&gt;:&lt;port-number&gt;</literal>.
+        '';
+      };
+
+      sslPolicy = mkOption {
+        type = types.str;
+        default = "legacy";
+        description = ''
+          Neo4j SSL policy for HTTPS traffic.
+          </para>
+          <para>
+          The legacy policy is a special policy which is not defined in the
+          policy configuration section, but rather derives from
+          <option>directories.certificates</option> and
+          associated files (by default: <filename>neo4j.key</filename> and
+          <filename>neo4j.cert</filename>). Its use will be deprecated.
+        '';
+      };
+    };
+
+    shell = {
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Enable a remote shell server which Neo4j Shell clients can log in to.
+          Only applicable to <command>neo4j-shell</command>.
+        '';
+      };
+    };
+
+    ssl.policies = mkOption {
+      type = with types; attrsOf (submodule ({ name, config, options, ... }: {
+        options = {
+
+          allowKeyGeneration = mkOption {
+            type = types.bool;
+            default = false;
+            description = ''
+              Allows the generation of a private key and associated self-signed
+              certificate. Only performed when both objects cannot be found for
+              this policy. It is recommended to turn this off again after keys
+              have been generated.
+              </para>
+              <para>
+              The public certificate is required to be duplicated to the
+              directory holding trusted certificates as defined by the
+              <option>trustedDir</option> option.
+              </para>
+              <para>
+              Keys should in general be generated and distributed offline by a
+              trusted certificate authority and not by utilizing this mode.
+            '';
+          };
+
+          baseDirectory = mkOption {
+            type = types.path;
+            default = "${cfg.directories.certificates}/${name}";
+            description = ''
+              The mandatory base directory for cryptographic objects of this
+              policy. This path is only automatically generated when this
+              option as well as <option>directories.certificates</option> are
+              left at their default. Ensure read/write permissions are given
+              to the Neo4j daemon user <literal>neo4j</literal>.
+              </para>
+              <para>
+              It is also possible to override each individual
+              configuration with absolute paths. See the
+              <option>privateKey</option> and <option>publicCertificate</option>
+              policy options.
+            '';
+          };
+
+          ciphers = mkOption {
+            type = types.nullOr (types.listOf types.str);
+            default = null;
+            description = ''
+              Restrict the allowed ciphers of this policy to those defined
+              here. The default ciphers are those of the JVM platform.
+            '';
+          };
+
+          clientAuth = mkOption {
+            type = types.enum [ "NONE" "OPTIONAL" "REQUIRE" ];
+            default = "REQUIRE";
+            description = ''
+              The client authentication stance for this policy.
+            '';
+          };
+
+          privateKey = mkOption {
+            type = types.str;
+            default = "private.key";
+            description = ''
+              The name of private PKCS #8 key file for this policy to be found
+              in the <option>baseDirectory</option>, or the absolute path to
+              the key file. It is mandatory that a key can be found or generated.
+            '';
+          };
+
+          publicCertificate = mkOption {
+            type = types.str;
+            default = "public.crt";
+            description = ''
+              The name of public X.509 certificate (chain) file in PEM format
+              for this policy to be found in the <option>baseDirectory</option>,
+              or the absolute path to the certificate file. It is mandatory
+              that a certificate can be found or generated.
+              </para>
+              <para>
+              The public certificate is required to be duplicated to the
+              directory holding trusted certificates as defined by the
+              <option>trustedDir</option> option.
+            '';
+          };
+
+          revokedDir = mkOption {
+            type = types.path;
+            default = "${config.baseDirectory}/revoked";
+            description = ''
+              Path to directory of CRLs (Certificate Revocation Lists) in
+              PEM format. Must be an absolute path. The existence of this
+              directory is mandatory and will need to be created manually when:
+              setting this option to something other than its default; setting
+              either this policy's <option>baseDirectory</option> or
+              <option>directories.certificates</option> to something other than
+              their default. Ensure read/write permissions are given to the
+              Neo4j daemon user <literal>neo4j</literal>.
+            '';
+          };
+
+          tlsVersions = mkOption {
+            type = types.listOf types.str;
+            default = [ "TLSv1.2" ];
+            description = ''
+              Restrict the TLS protocol versions of this policy to those
+              defined here.
+            '';
+          };
+
+          trustAll = mkOption {
+            type = types.bool;
+            default = false;
+            description = ''
+              Makes this policy trust all remote parties. Enabling this is not
+              recommended and the policy's trusted directory will be ignored.
+              Use of this mode is discouraged. It would offer encryption but
+              no security.
+            '';
+          };
+
+          trustedDir = mkOption {
+            type = types.path;
+            default = "${config.baseDirectory}/trusted";
+            description = ''
+              Path to directory of X.509 certificates in PEM format for
+              trusted parties. Must be an absolute path. The existence of this
+              directory is mandatory and will need to be created manually when:
+              setting this option to something other than its default; setting
+              either this policy's <option>baseDirectory</option> or
+              <option>directories.certificates</option> to something other than
+              their default. Ensure read/write permissions are given to the
+              Neo4j daemon user <literal>neo4j</literal>.
+              </para>
+              <para>
+              The public certificate as defined by
+              <option>publicCertificate</option> is required to be duplicated
+              to this directory.
+            '';
+          };
+
+          directoriesToCreate = mkOption {
+            type = types.listOf types.path;
+            internal = true;
+            readOnly = true;
+            description = ''
+              Directories of this policy that will be created automatically
+              when the certificates directory is left at its default value.
+              This includes all options of type path that are left at their
+              default value.
+            '';
+          };
+
+        };
+
+        config.directoriesToCreate = optionals
+          (certDirOpt.highestPrio >= 1500 && options.baseDirectory.highestPrio >= 1500)
+          (map (opt: opt.value) (filter isDefaultPathOption (attrValues options)));
+
+      }));
+      default = {};
+      description = ''
+        Defines the SSL policies for use with Neo4j connectors. Each attribute
+        of this set defines a policy, with the attribute name defining the name
+        of the policy and its namespace. Refer to the operations manual section
+        on Neo4j's
+        <link xlink:href="https://neo4j.com/docs/operations-manual/current/security/ssl-framework/">SSL Framework</link>
+        for further details.
+      '';
+    };
+
+    udc = {
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Enable the Usage Data Collector which Neo4j uses to collect usage
+          data. Refer to the operations manual section on the
+          <link xlink:href="https://neo4j.com/docs/operations-manual/current/configuration/usage-data-collector/">Usage Data Collector</link>
+          for more information.
+        '';
+      };
+    };
+
   };
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config =
-    systemd.services.neo4j = {
+    let
-      description = "Neo4j Daemon";
+      # Assertion helpers
-      wantedBy = [ "multi-user.target" ];
+      policyNameList = attrNames cfg.ssl.policies;
-      after = [ "network.target" ];
+      validPolicyNameList = [ "legacy" ] ++ policyNameList;
-      environment = {
+      validPolicyNameString = concatStringsSep ", " validPolicyNameList;
-        NEO4J_HOME = "${cfg.package}/share/neo4j";
+
-        NEO4J_CONF = "${cfg.dataDir}/conf";
+      # Capture various directories left at their default so they can be created.
+      defaultDirectoriesToCreate = map (opt: opt.value) (filter isDefaultPathOption (attrValues options.services.neo4j.directories));
+      policyDirectoriesToCreate = concatMap (pol: pol.directoriesToCreate) (attrValues cfg.ssl.policies);
+    in
+
+    mkIf cfg.enable {
+      assertions = [
+        { assertion = !elem "legacy" policyNameList;
+          message = "The policy 'legacy' is special to Neo4j, and its name is reserved."; }
+        { assertion = elem cfg.bolt.sslPolicy validPolicyNameList;
+          message = "Invalid policy assigned: `services.neo4j.bolt.sslPolicy = \"${cfg.bolt.sslPolicy}\"`, defined policies are: ${validPolicyNameString}"; }
+        { assertion = elem cfg.https.sslPolicy validPolicyNameList;
+          message = "Invalid policy assigned: `services.neo4j.https.sslPolicy = \"${cfg.https.sslPolicy}\"`, defined policies are: ${validPolicyNameString}"; }
+      ];
+
+      systemd.services.neo4j = {
+        description = "Neo4j Daemon";
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" ];
+        environment = {
+          NEO4J_HOME = "${cfg.package}/share/neo4j";
+          NEO4J_CONF = "${cfg.directories.home}/conf";
+        };
+        serviceConfig = {
+          ExecStart = "${cfg.package}/bin/neo4j console";
+          User = "neo4j";
+          PermissionsStartOnly = true;
+          LimitNOFILE = 40000;
+        };
+
+        preStart = ''
+          # Directories Setup
+          #   Always ensure home exists with nested conf, logs directories.
+          mkdir -m 0700 -p ${cfg.directories.home}/{conf,logs}
+
+          #   Create other sub-directories and policy directories that have been left at their default.
+          ${concatMapStringsSep "\n" (
+            dir: ''
+              mkdir -m 0700 -p ${dir}
+          '') (defaultDirectoriesToCreate ++ policyDirectoriesToCreate)}
+
+          # Place the configuration where Neo4j can find it.
+          ln -fs ${serverConfig} ${cfg.directories.home}/conf/neo4j.conf
+
+          # Ensure neo4j user ownership
+          chown -R neo4j ${cfg.directories.home}
+        '';
       };
-      serviceConfig = {
+
-        ExecStart = "${cfg.package}/bin/neo4j console";
+      environment.systemPackages = [ cfg.package ];
-        User = "neo4j";
+
-        PermissionsStartOnly = true;
+      users.users = singleton {
-        LimitNOFILE = 40000;
+        name = "neo4j";
+        uid = config.ids.uids.neo4j;
+        description = "Neo4j daemon user";
+        home = cfg.directories.home;
       };
-      preStart = ''
-        mkdir -m 0700 -p ${cfg.dataDir}/{data/graph.db,conf,logs}
-        ln -fs ${serverConfig} ${cfg.dataDir}/conf/neo4j.conf
-        if [ "$(id -u)" = 0 ]; then chown -R neo4j ${cfg.dataDir}; fi
-      '';
     };
 
-    environment.systemPackages = [ cfg.package ];
+  meta = {
-
+    maintainers = with lib.maintainers; [ patternspandemic ];
-    users.users = singleton {
-      name = "neo4j";
-      uid = config.ids.uids.neo4j;
-      description = "Neo4j daemon user";
-      home = cfg.dataDir;
-    };
   };
 }

pkgs/applications/altcoins/parity-ui/env.nix

@@ -1,6 +1,6 @@
 { stdenv, lib, zlib, glib, alsaLib, dbus, gtk2, atk, pango, freetype, fontconfig
 , libgnome-keyring3, gdk_pixbuf, gvfs, cairo, cups, expat, libgpgerror, nspr
-, nss, xorg, libcap, systemd, libnotify, libsecret, gnome3 }:
+, nss, xorg, libcap, systemd, libnotify, libsecret, gnome2 }:
 
 let
   packages = [
@@ -9,7 +9,7 @@ let
     xorg.libXrender xorg.libX11 xorg.libXext xorg.libXdamage xorg.libXtst
     xorg.libXcomposite xorg.libXi xorg.libXfixes xorg.libXrandr
     xorg.libXcursor xorg.libxkbfile xorg.libXScrnSaver libcap systemd libnotify
-    xorg.libxcb libsecret gnome3.gconf
+    xorg.libxcb libsecret gnome2.GConf
   ];
 
   libPathNative = lib.makeLibraryPath packages;

pkgs/applications/editors/lighttable/default.nix

@@ -1,12 +1,12 @@
 { stdenv, fetchurl, zlib, glib, alsaLib, makeDesktopItem
 , dbus, gtk2, atk, pango, freetype, fontconfig, libgnome-keyring3, gdk_pixbuf
-, cairo, cups, expat, libgpgerror, nspr, gnome3, nss, xorg, systemd, libnotify
+, cairo, cups, expat, libgpgerror, nspr, gnome2, nss, xorg, systemd, libnotify
 }:
 
 let
   libPath = stdenv.lib.makeLibraryPath [
       stdenv.cc.cc zlib glib dbus gtk2 atk pango freetype libgnome-keyring3 nss
-      fontconfig gdk_pixbuf cairo cups expat libgpgerror alsaLib nspr gnome3.gconf
+      fontconfig gdk_pixbuf cairo cups expat libgpgerror alsaLib nspr gnome2.GConf
       xorg.libXrender xorg.libX11 xorg.libXext xorg.libXdamage xorg.libXtst
       xorg.libXcomposite xorg.libXi xorg.libXfixes libnotify xorg.libXrandr
       xorg.libXcursor

pkgs/applications/editors/typora/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, dpkg, lib, glib, dbus, makeWrapper, gnome3, gtk3, atk, cairo, pango
+{ stdenv, fetchurl, dpkg, lib, glib, dbus, makeWrapper, gnome2, gnome3, gtk3, atk, cairo, pango
 , gdk_pixbuf, freetype, fontconfig, nspr, nss, xorg, alsaLib, cups, expat, udev, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
     rpath = stdenv.lib.makeLibraryPath [
       alsaLib
-      gnome3.gconf
+      gnome2.GConf
       gdk_pixbuf
       pango
       gnome3.defaultIconTheme

pkgs/applications/misc/gksu/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, gtk2, gnome3, libgksu,
+{ stdenv, fetchurl, pkgconfig, gtk2, gnome2, gnome3, libgksu,
   intltool, libstartup_notification, gtk-doc, wrapGAppsHook
 }:
 
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    gtk2 gnome3.gconf libstartup_notification gnome3.libgnome-keyring
+    gtk2 gnome2.GConf libstartup_notification gnome3.libgnome-keyring
   ];
 
   propagatedBuildInputs = [

pkgs/applications/misc/hyper/default.nix

@@ -1,11 +1,11 @@
-{ stdenv, lib, fetchurl, dpkg, atk, glib, pango, gdk_pixbuf, gnome3, gtk2, cairo
+{ stdenv, lib, fetchurl, dpkg, atk, glib, pango, gdk_pixbuf, gnome2, gtk2, cairo
 , freetype, fontconfig, dbus, libXi, libXcursor, libXdamage, libXrandr
 , libXcomposite, libXext, libXfixes, libXrender, libX11, libXtst, libXScrnSaver
 , libxcb, nss, nspr, alsaLib, cups, expat, libudev, libpulseaudio }:
 
 let
   libPath = stdenv.lib.makeLibraryPath [
-    stdenv.cc.cc gtk2 gnome3.gconf atk glib pango gdk_pixbuf cairo freetype fontconfig dbus
+    stdenv.cc.cc gtk2 gnome2.GConf atk glib pango gdk_pixbuf cairo freetype fontconfig dbus
     libXi libXcursor libXdamage libXrandr libXcomposite libXext libXfixes libxcb
     libXrender libX11 libXtst libXScrnSaver nss nspr alsaLib cups expat libudev libpulseaudio
   ];

pkgs/applications/misc/octoprint/default.nix

@@ -4,7 +4,13 @@ let
 
   pythonPackages = python2.pkgs.override {
     overrides = self: super: with self; {
-      backports_ssl_match_hostname = self.backports_ssl_match_hostname_3_4_0_2;
+      backports_ssl_match_hostname = super.backports_ssl_match_hostname.overridePythonAttrs (oldAttrs: rec {
+        version = "3.4.0.2";
+        src = oldAttrs.src.override {
+          inherit version;
+          sha256 = "07410e7fb09aab7bdaf5e618de66c3dac84e2e3d628352814dc4c37de321d6ae";
+        };
+      });
 
       flask = super.flask.overridePythonAttrs (oldAttrs: rec {
         version = "0.12.4";

pkgs/applications/misc/pdfmod/default.nix

@@ -1,6 +1,6 @@
 { stdenv, fetchurl, fetchpatch, pkgconfig, gnome-doc-utils, intltool, lib
 , mono, gtk-sharp-2_0, gnome-sharp, hyena
-, which, makeWrapper, glib, gnome3, poppler, wrapGAppsHook
+, which, makeWrapper, glib, gnome2, poppler, wrapGAppsHook
 }:
 
 stdenv.mkDerivation rec {
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
       --add-flags "$out/lib/pdfmod/PdfMod.exe" \
       --prefix MONO_GAC_PREFIX : ${gtk-sharp-2_0} \
       --prefix MONO_GAC_PREFIX : ${gnome-sharp} \
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ glib gnome-sharp gnome3.gconf gtk-sharp-2_0 gtk-sharp-2_0.gtk poppler ]}
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ glib gnome-sharp gnome2.GConf gtk-sharp-2_0 gtk-sharp-2_0.gtk poppler ]}
   '';
 
   dontStrip = true;

pkgs/applications/misc/simplenote/default.nix

@@ -1,6 +1,6 @@
 { fetchurl, stdenv, lib, zlib, glib, alsaLib, dbus, gtk2, atk, pango, freetype, fontconfig
 , libgnome-keyring3, gdk_pixbuf, gvfs, cairo, cups, expat, libgpgerror, nspr
-, nss, xorg, libcap, systemd, libnotify ,libXScrnSaver, gnome3 }:
+, nss, xorg, libcap, systemd, libnotify ,libXScrnSaver, gnome2 }:
 
  stdenv.mkDerivation rec {
 
@@ -19,7 +19,7 @@
       fontconfig gdk_pixbuf cairo cups expat libgpgerror alsaLib nspr nss
       xorg.libXrender xorg.libX11 xorg.libXext xorg.libXdamage xorg.libXtst
       xorg.libXcomposite xorg.libXi xorg.libXfixes xorg.libXrandr
-      xorg.libXcursor libcap systemd libnotify libXScrnSaver gnome3.gconf
+      xorg.libXcursor libcap systemd libnotify libXScrnSaver gnome2.GConf
       xorg.libxcb
     ];
 

pkgs/applications/misc/terminus/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, dpkg, gnome3, gtk2, atk, glib, pango, gdk_pixbuf, cairo
+{ stdenv, lib, fetchurl, dpkg, gnome2, gtk2, atk, glib, pango, gdk_pixbuf, cairo
 , freetype, fontconfig, dbus, libXi, libXcursor, libXdamage, libXrandr
 , libXcomposite, libXext, libXfixes, libXrender, libX11, libXtst, libXScrnSaver
 , libxcb, makeWrapper, nodejs
@@ -8,7 +8,7 @@ let
   libPath = stdenv.lib.makeLibraryPath [
     stdenv.cc.cc gtk2 atk glib pango gdk_pixbuf cairo freetype fontconfig dbus
     libXi libXcursor libXdamage libXrandr libXcomposite libXext libXfixes libxcb
-    libXrender libX11 libXtst libXScrnSaver gnome3.gconf nss nspr alsaLib cups expat libudev libpulseaudio
+    libXrender libX11 libXtst libXScrnSaver gnome2.GConf nss nspr alsaLib cups expat libudev libpulseaudio
   ];
 in
 stdenv.mkDerivation rec {

pkgs/applications/networking/browsers/opera/default.nix

@@ -11,7 +11,7 @@
 , freetype
 , gdk_pixbuf
 , glib
-, gnome3
+, gnome2
 , gtk3
 , libX11
 , libxcb
@@ -55,7 +55,7 @@ let
     freetype.out
     gdk_pixbuf.out
     glib.out
-    gnome3.gconf
+    gnome2.GConf
     gtk3.out
     libX11.out
     libXScrnSaver.out

pkgs/applications/networking/browsers/vivaldi/default.nix

@@ -4,7 +4,7 @@
 , freetype, fontconfig, libXft, libXrender, libxcb, expat, libXau, libXdmcp
 , libuuid, xz
 , gstreamer, gst-plugins-base, libxml2
-, glib, gtk3, pango, gdk_pixbuf, cairo, atk, at-spi2-atk, gnome3
+, glib, gtk3, pango, gdk_pixbuf, cairo, atk, at-spi2-atk, gnome2
 , nss, nspr
 , patchelf, makeWrapper
 , proprietaryCodecs ? false, vivaldi-ffmpeg-codecs ? null
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     libXi libXft libXcursor libXfixes libXScrnSaver libXcomposite libXdamage libXtst libXrandr
     atk at-spi2-atk alsaLib dbus_libs cups gtk3 gdk_pixbuf libexif ffmpeg systemd
     freetype fontconfig libXrender libuuid expat glib nss nspr
-    gstreamer libxml2 gst-plugins-base pango cairo gnome3.gconf
+    gstreamer libxml2 gst-plugins-base pango cairo gnome2.GConf
   ] ++ stdenv.lib.optional proprietaryCodecs vivaldi-ffmpeg-codecs;
 
   libPath = stdenv.lib.makeLibraryPath buildInputs

pkgs/applications/networking/instant-messengers/discord/default.nix

@@ -1,6 +1,6 @@
 { stdenv, fetchurl, makeDesktopItem, makeWrapper
 , alsaLib, atk, cairo, cups, dbus, expat, fontconfig, freetype, gdk_pixbuf
-, glib, gnome3, gtk2, libnotify, libX11, libXcomposite, libXcursor, libXdamage
+, glib, gnome2, gtk2, libnotify, libX11, libXcomposite, libXcursor, libXdamage
 , libXext, libXfixes, libXi, libXrandr, libXrender, libXtst, nspr, nss, libxcb
 , pango, systemd, libXScrnSaver, libcxx, libpulseaudio }:
 
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     libPath = stdenv.lib.makeLibraryPath [
         libcxx systemd libpulseaudio
         stdenv.cc.cc alsaLib atk cairo cups dbus expat fontconfig freetype
-        gdk_pixbuf glib gnome3.gconf gtk2 libnotify libX11 libXcomposite
+        gdk_pixbuf glib gnome2.GConf gtk2 libnotify libX11 libXcomposite
         libXcursor libXdamage libXext libXfixes libXi libXrandr libXrender
         libXtst nspr nss libxcb pango systemd libXScrnSaver
      ];

pkgs/applications/networking/instant-messengers/franz/default.nix

@@ -1,6 +1,6 @@
 { stdenv, fetchurl, makeDesktopItem, makeWrapper, autoPatchelfHook
 , xorg, atk, glib, pango, gdk_pixbuf, cairo, freetype, fontconfig, gtk2
-, gnome3, dbus, nss, nspr, alsaLib, cups, expat, udev, libnotify, xdg_utils }:
+, gnome2, dbus, nss, nspr, alsaLib, cups, expat, udev, libnotify, xdg_utils }:
 
 let
   bits = if stdenv.system == "x86_64-linux" then "x64"
@@ -34,7 +34,7 @@ in stdenv.mkDerivation rec {
     libXrender libX11 libXtst libXScrnSaver
   ]) ++ [
     gtk2 atk glib pango gdk_pixbuf cairo freetype fontconfig dbus
-    gnome3.gconf nss nspr alsaLib cups expat stdenv.cc.cc
+    gnome2.GConf nss nspr alsaLib cups expat stdenv.cc.cc
   ];
   runtimeDependencies = [ udev.lib libnotify ];
 

pkgs/applications/networking/instant-messengers/mattermost-desktop/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, gnome3, gtk2, pango, atk, cairo, gdk_pixbuf, glib,
+{ stdenv, lib, fetchurl, gnome2, gtk2, pango, atk, cairo, gdk_pixbuf, glib,
 freetype, fontconfig, dbus, libX11, xorg, libXi, libXcursor, libXdamage,
 libXrandr, libXcomposite, libXext, libXfixes, libXrender, libXtst,
 libXScrnSaver, nss, nspr, alsaLib, cups, expat, udev }:
@@ -14,7 +14,7 @@ let
     freetype
     gdk_pixbuf
     glib
-    gnome3.gconf
+    gnome2.GConf
     gtk2
     pango
     libX11

pkgs/applications/networking/instant-messengers/signal-desktop/default.nix

@@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, dpkg, wrapGAppsHook
-, gnome3, gtk3, atk, cairo, pango, gdk_pixbuf, glib, freetype, fontconfig
+, gnome2, gtk3, atk, cairo, pango, gdk_pixbuf, glib, freetype, fontconfig
 , dbus, libX11, xorg, libXi, libXcursor, libXdamage, libXrandr, libXcomposite
 , libXext, libXfixes, libXrender, libXtst, libXScrnSaver, nss, nspr, alsaLib
 , cups, expat, udev
@@ -17,7 +17,7 @@ let
     freetype
     gdk_pixbuf
     glib
-    gnome3.gconf
+    gnome2.GConf
     gtk3
     pango
     libX11

pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix

@@ -1,5 +1,5 @@
 { stdenv, fetchurl, dpkg, makeWrapper
-, alsaLib, atk, cairo, cups, curl, dbus, expat, fontconfig, freetype, gdk_pixbuf, glib, glibc, gnome3
+, alsaLib, atk, cairo, cups, curl, dbus, expat, fontconfig, freetype, gdk_pixbuf, glib, glibc, gnome2, gnome3
 , gtk3, libnotify, libpulseaudio, libsecret, libv4l, nspr, nss, pango, systemd, xorg }:
 
 let
@@ -22,7 +22,7 @@ let
     glibc
     libsecret
 
-    gnome3.gconf
+    gnome2.GConf
     gdk_pixbuf
     gtk3
 

pkgs/applications/networking/instant-messengers/slack/default.nix

@@ -1,6 +1,6 @@
 { stdenv, fetchurl, dpkg, makeWrapper
 , alsaLib, atk, cairo, cups, curl, dbus, expat, fontconfig, freetype, glib
-, gnome3, gtk3, gdk_pixbuf, libnotify, libxcb, nspr, nss, pango
+, gnome2, gtk3, gdk_pixbuf, libnotify, libxcb, nspr, nss, pango
 , systemd, wget, xorg }:
 
 let
@@ -18,7 +18,7 @@ let
     fontconfig
     freetype
     glib
-    gnome3.gconf
+    gnome2.GConf
     gdk_pixbuf
     gtk3
     pango

pkgs/applications/networking/instant-messengers/wire-desktop/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, dpkg, makeDesktopItem, gnome3, gtk2, atk, cairo, pango, gdk_pixbuf, glib
+{ stdenv, lib, fetchurl, dpkg, makeDesktopItem, gnome2, gtk2, atk, cairo, pango, gdk_pixbuf, glib
 , freetype, fontconfig, dbus, libnotify, libX11, xorg, libXi, libXcursor, libXdamage
 , libXrandr, libXcomposite, libXext, libXfixes, libXrender, libXtst, libXScrnSaver
 , nss, nspr, alsaLib, cups, expat, udev, xdg_utils, hunspell
@@ -15,7 +15,7 @@ let
     freetype
     gdk_pixbuf
     glib
-    gnome3.gconf
+    gnome2.GConf
     gtk2
     pango
     hunspell
@@ -93,7 +93,7 @@ in
       mkdir -p $out/share/applications
       cp ${desktopItem}/share/applications/* $out/share/applications
     '';
-    
+
     meta = {
       description = "A modern, secure messenger";
       homepage    = https://wire.com/;

pkgs/applications/networking/super-productivity/default.nix

@@ -1,6 +1,6 @@
 { stdenv, fetchurl, dpkg, makeWrapper
 , alsaLib, atk, cairo, cups, curl, dbus, expat, fontconfig, freetype, glib
-, gnome3, gtk3, gdk_pixbuf, libnotify, libxcb, nspr, nss, pango
+, gnome2, gtk3, gdk_pixbuf, libnotify, libxcb, nspr, nss, pango
 , systemd, wget, xorg, xprintidle-ng }:
 
 let
@@ -18,7 +18,7 @@ let
     fontconfig
     freetype
     glib
-    gnome3.gconf
+    gnome2.GConf
     gdk_pixbuf
     gtk3
     pango

pkgs/applications/science/math/clp/default.nix

@@ -1,24 +1,22 @@
 { stdenv, fetchurl, zlib }:
 
 stdenv.mkDerivation rec {
-	version = "1.16.11";
+  version = "1.16.11";
-	name = "clp-${version}";
+  name = "clp-${version}";
-	src = fetchurl {
+  src = fetchurl {
-		url = "https://www.coin-or.org/download/source/Clp/Clp-${version}.tgz";
+    url = "https://www.coin-or.org/download/source/Clp/Clp-${version}.tgz";
-		sha256 = "0fazlqpp845186nmixa9f1xfxqqkdr1xj4va7q29m8594ca4a9dm";
+    sha256 = "0fazlqpp845186nmixa9f1xfxqqkdr1xj4va7q29m8594ca4a9dm";
-	};
+  };
 
-	propagatedBuildInputs = [ zlib ];
+  propagatedBuildInputs = [ zlib ];
 
-	doCheck = true;
+  doCheck = true;
 
-	checkTarget = "test";
+  meta = {
-
+    license = stdenv.lib.licenses.epl10;
-	meta = {
+    homepage = https://projects.coin-or.org/Clp;
-		license = stdenv.lib.licenses.epl10;
+    description = "An open-source linear programming solver written in C++";
-		homepage = https://projects.coin-or.org/Clp;
+    platforms = stdenv.lib.platforms.all;
-		description = "An open-source linear programming solver written in C++";
+    maintainers = [ stdenv.lib.maintainers.vbgl ];
-		platforms = stdenv.lib.platforms.all;
+  };
-		maintainers = [ stdenv.lib.maintainers.vbgl ];
-	};
 }

pkgs/data/misc/shared-mime-info/default.nix

@@ -1,13 +1,13 @@
 {stdenv, fetchurl, pkgconfig, gettext, perl, perlXMLParser, intltool
 , libxml2, glib}:
 
-let version = "1.9"; in
+let version = "1.10"; in
 stdenv.mkDerivation rec {
   name = "shared-mime-info-${version}";
 
   src = fetchurl {
     url = "http://freedesktop.org/~hadess/${name}.tar.xz";
-    sha256 = "10ywzhzg8v1xmb9sz5xbqaci90id38knswigynyl33i29vn360aw";
+    sha256 = "1gxyvwym3xgpmp262gfn8jg5sla6k5hy6m6dmy6grgiq90xsh9f6";
   };
 
   nativeBuildInputs = [

pkgs/desktops/gnome-2/platform/GConf/default.nix

@@ -1,29 +1,33 @@
 { stdenv, fetchurl, pkgconfig, dbus-glib, glib, ORBit2, libxml2
-, polkit, intltool, dbus_libs, gtk2 ? null, withGtk ? false }:
+, polkit, intltool }:
 
-assert withGtk -> (gtk2 != null);
+stdenv.mkDerivation rec {
-
+  name = "gconf-${version}";
-stdenv.mkDerivation {
+  version = "3.2.6";
-  name = "gconf-2.32.4";
 
   src = fetchurl {
-    url = mirror://gnome/sources/GConf/2.32/GConf-2.32.4.tar.xz;
+    url = "mirror://gnome/sources/GConf/${stdenv.lib.versions.majorMinor version}/GConf-${version}.tar.xz";
-    sha256 = "09ch709cb9fniwc4221xgkq0jf0x0lxs814sqig8p2dcll0llvzk";
+    sha256 = "0k3q9nh53yhc9qxf1zaicz4sk8p3kzq4ndjdsgpaa2db0ccbj4hr";
   };
 
   outputs = [ "out" "dev" "man" ];
 
-  buildInputs = [ ORBit2 dbus_libs dbus-glib libxml2 ]
+  buildInputs = [ ORBit2 libxml2 ]
     # polkit requires pam, which requires shadow.h, which is not available on
     # darwin
-    ++ stdenv.lib.optional (!stdenv.isDarwin) polkit
+    ++ stdenv.lib.optional (!stdenv.isDarwin) polkit;
-    ++ stdenv.lib.optional withGtk gtk2;
 
-  propagatedBuildInputs = [ glib ];
+  propagatedBuildInputs = [ glib dbus-glib ];
 
   nativeBuildInputs = [ pkgconfig intltool ];
 
-  configureFlags = stdenv.lib.optional withGtk "--with-gtk=2.0"
+  configureFlags =
     # fixes the "libgconfbackend-oldxml.so is not portable" error on darwin
-    ++ stdenv.lib.optional stdenv.isDarwin [ "--enable-static" ];
+    stdenv.lib.optional stdenv.isDarwin [ "--enable-static" ];
+
+  meta = with stdenv.lib; {
+    homepage = https://projects.gnome.org/gconf/;
+    description = "Deprecated system for storing application preferences";
+    platforms = platforms.linux;
+  };
 }

pkgs/desktops/gnome-3/apps/gnome-sound-recorder/default.nix

@@ -0,0 +1,35 @@
+{ stdenv, fetchurl, pkgconfig, intltool, gobjectIntrospection, wrapGAppsHook, gjs, glib, gtk3, gdk_pixbuf, gst_all_1, gnome3 }:
+
+let
+  pname = "gnome-sound-recorder";
+  version = "3.28.1";
+in stdenv.mkDerivation rec {
+  name = "${pname}-${version}";
+
+  src = fetchurl {
+    url = "mirror://gnome/sources/${pname}/${gnome3.versionBranch version}/${name}.tar.xz";
+    sha256 = "0y0srj1hvr1waa35p6dj1r1mlgcsscc0i99jni50ijp4zb36fjqy";
+  };
+
+  nativeBuildInputs = [ pkgconfig intltool gobjectIntrospection wrapGAppsHook ];
+  buildInputs = [ gjs glib gtk3 gdk_pixbuf ] ++ (with gst_all_1; [ gstreamer.dev gstreamer gst-plugins-base gst-plugins-good gst-plugins-bad ]);
+
+  # TODO: fix this in gstreamer
+  # TODO: make stdenv.lib.getBin respect outputBin
+  PKG_CONFIG_GSTREAMER_1_0_TOOLSDIR = "${gst_all_1.gstreamer.dev}/bin";
+
+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+      attrPath = "gnome3.${pname}";
+    };
+  };
+
+  meta = with stdenv.lib; {
+    description = "A simple and modern sound recorder";
+    homepage = https://wiki.gnome.org/Apps/SoundRecorder;
+    license = licenses.gpl2Plus;
+    maintainers = gnome3.maintainers;
+    platforms = platforms.linux;
+  };
+}

pkgs/desktops/gnome-3/core/gconf/default.nix

@@ -1,34 +0,0 @@
-{ stdenv, fetchurl, pkgconfig, dbus-glib, gnome3 ? null, glib, libxml2
-, intltool, polkit, orbit, python, withGtk ? false }:
-
-assert withGtk -> (gnome3 != null);
-
-stdenv.mkDerivation rec {
-
-  versionMajor = "3.2";
-  versionMinor = "6";
-  moduleName   = "GConf";
-
-  origName = "${moduleName}-${versionMajor}.${versionMinor}";
-
-  name = "gconf-${versionMajor}.${versionMinor}";
-
-  src = fetchurl {
-    url = "mirror://gnome/sources/${moduleName}/${versionMajor}/${origName}.tar.xz";
-    sha256 = "0k3q9nh53yhc9qxf1zaicz4sk8p3kzq4ndjdsgpaa2db0ccbj4hr";
-  };
-
-  buildInputs = [ libxml2 polkit orbit python ] ++ stdenv.lib.optional withGtk gnome3.gtk;
-  propagatedBuildInputs = [ glib dbus-glib  ];
-  nativeBuildInputs = [ pkgconfig intltool ];
-
-  # ToDo: ldap reported as not found but afterwards reported as supported
-
-  outputs = [ "out" "dev" ];
-
-  meta = with stdenv.lib; {
-    homepage = https://projects.gnome.org/gconf/;
-    description = "A system for storing application preferences";
-    platforms = platforms.linux;
-  };
-}

pkgs/desktops/gnome-3/default.nix

@@ -45,10 +45,8 @@ lib.makeScope pkgs.newScope (self: with self; {
     easytag meld orca rhythmbox shotwell gnome-usage
     clutter clutter-gst clutter-gtk cogl gtkvnc libdazzle;
 
-  inherit (pkgs.gnome2) ORBit2;
   libsoup = pkgs.libsoup.override { gnomeSupport = true; };
   libchamplain = pkgs.libchamplain.override { libsoup = libsoup; };
-  orbit = ORBit2;
   gnome3 = self // { recurseForDerivations = false; };
   gtk = gtk3;
   gtkmm = gtkmm3;
@@ -80,8 +78,6 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   evolution-data-server = callPackage ./core/evolution-data-server { };
 
-  gconf = callPackage ./core/gconf { };
-
   geocode-glib = callPackage ./core/geocode-glib { };
 
   gcr = callPackage ./core/gcr { }; # ToDo: tests fail
@@ -293,6 +289,8 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   gnome-power-manager = callPackage ./apps/gnome-power-manager { };
 
+  gnome-sound-recorder = callPackage ./apps/gnome-sound-recorder { };
+
   gnome-weather = callPackage ./apps/gnome-weather { };
 
   nautilus-sendto = callPackage ./apps/nautilus-sendto { };

pkgs/desktops/gnome-3/devtools/nemiver/default.nix

@@ -1,5 +1,5 @@
 { stdenv, fetchurl, fetchpatch, pkgconfig, gnome3, gtk3, libxml2, intltool, itstool, gdb,
-  boost, sqlite, gconf, libgtop, glibmm, gtkmm, vte, gtksourceview,
+  boost, sqlite, libgtop, glibmm, gtkmm, vte, gtksourceview, gsettings-desktop-schemas,
   gtksourceviewmm, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
@@ -11,23 +11,34 @@ stdenv.mkDerivation rec {
     sha256 = "85ab8cf6c4f83262f441cb0952a6147d075c3c53d0687389a3555e946b694ef2";
   };
 
-  passthru = {
+  nativeBuildInputs = [ libxml2 intltool itstool pkgconfig wrapGAppsHook ];
-    updateScript = gnome3.updateScript { packageName = "nemiver"; attrPath = "gnome3.nemiver"; };
-  };
 
-  nativeBuildInputs = [ pkgconfig wrapGAppsHook ];
+  buildInputs = [
-
+    gtk3 gdb boost sqlite libgtop
-  buildInputs = [ gtk3 libxml2 intltool itstool gdb boost sqlite gconf libgtop
+    glibmm gtkmm vte gtksourceview gtksourceviewmm
-    glibmm gtkmm vte gtksourceview gtksourceviewmm ];
+    gsettings-desktop-schemas
+  ];
 
   patches = [
-    ./bool_slot.patch ./safe_ptr.patch
+    ./bool_slot.patch
+    ./safe_ptr.patch
     (fetchpatch {
       url = https://gitlab.gnome.org/GNOME/nemiver/commit/262cf9657f9c2727a816972b348692adcc666008.patch;
       sha256 = "03jv6z54b8nzvplplapk4aj206zl1gvnv6iz0mad19g6yvfbw7a7";
     })
   ];
 
+  configureFlags = [
+    "--enable-gsettings"
+  ];
+
+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = "nemiver";
+      attrPath = "gnome3.nemiver";
+    };
+  };
+
   meta = with stdenv.lib; {
     homepage = https://wiki.gnome.org/Apps/Nemiver;
     description = "Easy to use standalone C/C++ debugger";
@@ -36,4 +47,3 @@ stdenv.mkDerivation rec {
     maintainers = [ maintainers.juliendehos ];
   };
 }
-

pkgs/desktops/gnome-3/games/aisleriot/default.nix

@@ -1,5 +1,5 @@
 { stdenv, fetchurl, pkgconfig, gnome3, intltool, itstool, gtk3
-, wrapGAppsHook, gconf, librsvg, libxml2, desktop-file-utils
+, wrapGAppsHook, librsvg, libxml2, desktop-file-utils
 , guile_2_0, libcanberra-gtk3 }:
 
 stdenv.mkDerivation rec {
@@ -11,16 +11,21 @@ stdenv.mkDerivation rec {
     sha256 = "0rl39psr5xi584310pyrgw36ini4wn7yr2m1q5118w3a3v1dkhzh";
   };
 
+  configureFlags = [
+    "--with-card-theme-formats=svg"
+    "--with-platform=gtk-only" # until they remove GConf
+  ];
+
+  nativeBuildInputs = [ pkgconfig intltool itstool wrapGAppsHook libxml2 desktop-file-utils ];
+  buildInputs = [ gtk3 librsvg guile_2_0 libcanberra-gtk3 ];
+
   passthru = {
-    updateScript = gnome3.updateScript { packageName = "aisleriot"; attrPath = "gnome3.aisleriot"; };
+    updateScript = gnome3.updateScript {
+      packageName = "aisleriot";
+      attrPath = "gnome3.aisleriot";
+    };
   };
 
-  configureFlags = [ "--with-card-theme-formats=svg" ];
-
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ intltool itstool gtk3 wrapGAppsHook gconf
-                  librsvg libxml2 desktop-file-utils guile_2_0 libcanberra-gtk3 ];
-
   meta = with stdenv.lib; {
     homepage = https://wiki.gnome.org/Apps/Aisleriot;
     description = "A collection of patience games written in guile scheme";

pkgs/desktops/xfce/applications/orage.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchpatch, pkgconfig, bison, flex, intltool, gtk, libical, dbus-glib
+{ stdenv, fetchurl, fetchpatch, pkgconfig, bison, flex, intltool, gtk, libical, dbus-glib, tzdata
 , libnotify, popt, xfce
 }:
 
@@ -22,6 +22,14 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  postPatch = ''
+    substituteInPlace src/parameters.c        --replace "/usr/share/zoneinfo" "${tzdata}/share/zoneinfo"
+    substituteInPlace src/tz_zoneinfo_read.c  --replace "/usr/share/zoneinfo" "${tzdata}/share/zoneinfo"
+    substituteInPlace tz_convert/tz_convert.c --replace "/usr/share/zoneinfo" "${tzdata}/share/zoneinfo"
+  '';
+
+  postConfigure = "rm -rf libical"; # ensure pkgs.libical is used instead of one included in the orage sources
+
   nativeBuildInputs = [ pkgconfig intltool bison flex ];
 
   buildInputs = [ gtk libical dbus-glib libnotify popt xfce.libxfce4util

pkgs/desktops/xfce/core/xfce4-panel.nix

@@ -1,6 +1,6 @@
 { stdenv, fetchurl, pkgconfig, intltool, gtk, libxfce4util, libxfce4ui
 , libxfce4ui_gtk3, libwnck, exo, garcon, xfconf, libstartup_notification
-, makeWrapper, xfce4-mixer, hicolor-icon-theme
+, makeWrapper, xfce4-mixer, hicolor-icon-theme, tzdata
 , withGtk3 ? false, gtk3, gettext, glib-networking
 }:
 let
@@ -24,6 +24,9 @@ stdenv.mkDerivation rec {
     for f in $(find . -name \*.sh); do
       substituteInPlace $f --replace gettext ${gettext}/bin/gettext
     done
+    substituteInPlace plugins/clock/clock.c \
+       --replace "/usr/share/zoneinfo" "${tzdata}/share/zoneinfo" \
+       --replace "if (!g_file_test (filename, G_FILE_TEST_IS_SYMLINK))" ""
   '';
 
   outputs = [ "out" "dev" "devdoc" ];

pkgs/desktops/xfce4-13/orage/default.nix

@@ -1,5 +1,5 @@
-{ lib, fetchpatch, mkXfceDerivation, dbus_glib ? null, gtk2, libical, libnotify ? null
+{ lib, fetchpatch, mkXfceDerivation, dbus-glib, gtk2, libical, libnotify, tzdata
-, popt ? null, libxfce4ui ? null, xfce4-panel ? null, withPanelPlugin ? true }:
+, popt, libxfce4ui ? null, xfce4-panel ? null, withPanelPlugin ? true }:
 
 assert withPanelPlugin -> libxfce4ui != null && xfce4-panel != null;
 
@@ -13,9 +13,17 @@ mkXfceDerivation rec {
   version = "4.12.1";
 
   sha256 = "04z6y1vfaz1im1zq1zr7cf8pjibjhj9zkyanbp7vn30q520yxa0m";
-  buildInputs = [ dbus_glib gtk2 libical libnotify popt ]
+  buildInputs = [ dbus-glib gtk2 libical libnotify popt ]
     ++ optionals withPanelPlugin [ libxfce4ui xfce4-panel ];
 
+  postPatch = ''
+    substituteInPlace src/parameters.c        --replace "/usr/share/zoneinfo" "${tzdata}/share/zoneinfo"
+    substituteInPlace src/tz_zoneinfo_read.c  --replace "/usr/share/zoneinfo" "${tzdata}/share/zoneinfo"
+    substituteInPlace tz_convert/tz_convert.c --replace "/usr/share/zoneinfo" "${tzdata}/share/zoneinfo"
+  '';
+
+  postConfigure = "rm -rf libical"; # ensure pkgs.libical is used instead of one included in the orage sources
+
   patches = [
     # Fix build with libical 3.0
     (fetchpatch {

pkgs/desktops/xfce4-13/xfce4-panel/default.nix

@@ -1,4 +1,4 @@
-{ mkXfceDerivation, exo, garcon, gtk2, gtk3, libxfce4ui, libxfce4util, libwnck3, xfconf }:
+{ mkXfceDerivation, tzdata, exo, garcon, gtk2, gtk3, libxfce4ui, libxfce4util, libwnck3, xfconf }:
 
 mkXfceDerivation rec {
   category = "xfce";
@@ -9,6 +9,12 @@ mkXfceDerivation rec {
 
   buildInputs = [ exo garcon gtk2 gtk3 libxfce4ui libxfce4util libwnck3 xfconf ];
 
+  postPatch = ''
+    substituteInPlace plugins/clock/clock.c \
+       --replace "/usr/share/zoneinfo" "${tzdata}/share/zoneinfo" \
+       --replace "if (!g_file_test (filename, G_FILE_TEST_IS_SYMLINK))" ""
+  '';
+
   meta =  {
     description = "Xfce's panel";
   };

pkgs/development/haskell-modules/configuration-nix.nix

@@ -421,16 +421,6 @@ self: super: builtins.intersectAttrs super {
   # so disable this on Darwin only
   ${if pkgs.stdenv.isDarwin then null else "GLUT"} = addPkgconfigDepend (appendPatch super.GLUT ./patches/GLUT.patch) pkgs.freeglut;
 
-  idris = overrideCabal super.idris (drv: {
-    # https://github.com/idris-lang/Idris-dev/issues/2499
-    librarySystemDepends = (drv.librarySystemDepends or []) ++ [pkgs.gmp];
-
-    # tests and build run executable, so need to set LD_LIBRARY_PATH
-    preBuild = ''
-      export LD_LIBRARY_PATH="$PWD/dist/build:$LD_LIBRARY_PATH"
-    '';
-  });
-
   libsystemd-journal = overrideCabal super.libsystemd-journal (old: {
     librarySystemDepends = old.librarySystemDepends or [] ++ [ pkgs.systemd ];
   });

pkgs/development/haskell-modules/generic-builder.nix

@@ -160,6 +160,9 @@ let
     "--enable-library-for-ghci" # TODO: Should this be configurable?
   ] ++ optionals (enableDeadCodeElimination && (stdenv.lib.versionOlder "8.0.1" ghc.version)) [
      "--ghc-option=-split-sections"
+  ] ++ optionals dontStrip [
+    "--disable-library-stripping"
+    "--disable-executable-stripping"
   ] ++ optionals isGhcjs [
     "--ghcjs"
   ] ++ optionals isCross ([

pkgs/development/idris-modules/build-idris-package.nix

@@ -20,7 +20,7 @@ let
   };
 in
 stdenv.mkDerivation ({
-  name = "${name}-${version}";
+  name = "idris-${name}-${version}";
 
   buildInputs = [ idris-with-packages gmp ] ++ extraBuildInputs;
   propagatedBuildInputs = allIdrisDeps;

pkgs/development/interpreters/clojure/default.nix

@@ -13,7 +13,9 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "prefix" ];
 
-  installPhase = ''
+  installPhase = let
+    binPath = stdenv.lib.makeBinPath [ rlwrap jdk ];
+  in ''
     mkdir -p $prefix/libexec
     cp clojure-tools-${version}.jar $prefix/libexec
     cp {,example-}deps.edn $prefix
@@ -21,8 +23,8 @@ stdenv.mkDerivation rec {
     substituteInPlace clojure --replace PREFIX $prefix
 
     install -Dt $out/bin clj clojure
-    wrapProgram $out/bin/clj --suffix PATH ${rlwrap}/bin
+    wrapProgram $out/bin/clj --prefix PATH : ${binPath}
-    wrapProgram $out/bin/clojure --suffix PATH ${jdk}/bin
+    wrapProgram $out/bin/clojure --prefix PATH : ${binPath}
   '';
 
   meta = with stdenv.lib; {

pkgs/development/libraries/accountsservice/default.nix

@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   name = "accountsservice-${version}";
-  version = "0.6.49";
+  version = "0.6.50";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/accountsservice/accountsservice-${version}.tar.xz";
-    sha256 = "032ndvs18gla49dvc9vg35cwczg0wpv2wscp1m3yjfdqdpams7i5";
+    sha256 = "0jn7vg1z4vxnna0hl33hbcb4bb3zpilxc2vyclh24vx4vvsjhn83";
   };
 
   nativeBuildInputs = [ pkgconfig makeWrapper ];

pkgs/development/libraries/ffmpeg/generic.nix

@@ -26,7 +26,7 @@
  * see `ffmpeg-full' for an ffmpeg build with all features included.
  *
  * Need fixes to support Darwin:
- *   libvpx pulseaudio
+ *   pulseaudio
  *
  * Known issues:
  * 0.6     - fails to compile (unresolved) (so far, only disabling a number of
@@ -58,6 +58,8 @@ let
   disDarwinOrArmFix = origArg: minVer: fixArg: if ((isDarwin || isAarch32) && reqMin minVer) then fixArg else origArg;
 
   vaapiSupport = reqMin "0.6" && ((isLinux || isFreeBSD) && !isAarch32);
+
+  vpxSupport = reqMin "0.6" && !isAarch32;
 in
 
 assert openglSupport -> libGLU_combined != null;
@@ -130,7 +132,7 @@ stdenv.mkDerivation rec {
       (ifMinVer "0.6" (enableFeature vaapiSupport "vaapi"))
       "--enable-vdpau"
       "--enable-libvorbis"
-      (disDarwinOrArmFix (ifMinVer "0.6" "--enable-libvpx") "0.6" "--disable-libvpx")
+      (ifMinVer "0.6" (enableFeature vpxSupport "libvpx"))
       (ifMinVer "2.4" "--enable-lzma")
       (ifMinVer "2.2" (enableFeature openglSupport "opengl"))
       (disDarwinOrArmFix (ifMinVer "0.9" "--enable-libpulse") "0.9" "--disable-libpulse")
@@ -159,7 +161,8 @@ stdenv.mkDerivation rec {
     bzip2 fontconfig freetype gnutls libiconv lame libass libogg libtheora
     libvdpau libvorbis lzma soxr x264 x265 xvidcore zlib libopus
   ] ++ optional openglSupport libGLU_combined
-    ++ optionals (!isDarwin && !isAarch32) [ libvpx libpulseaudio ] # Need to be fixed on Darwin and ARM
+    ++ optional vpxSupport libvpx
+    ++ optionals (!isDarwin && !isAarch32) [ libpulseaudio ] # Need to be fixed on Darwin and ARM
     ++ optional ((isLinux || isFreeBSD) && !isAarch32) libva
     ++ optional isLinux alsaLib
     ++ optionals isDarwin darwinFrameworks

pkgs/development/libraries/gdk-pixbuf/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchgit, fetchpatch, fixDarwinDylibNames, meson, ninja, pkgconfig, gettext, python3, libxml2, libxslt, docbook_xsl
+{ stdenv, fetchurl, fetchFromGitLab, fetchpatch, fixDarwinDylibNames, meson, ninja, pkgconfig, gettext, python3, libxml2, libxslt, docbook_xsl
 , docbook_xml_dtd_43, gtk-doc, glib, libtiff, libjpeg, libpng, libX11, gnome3
 , jasper, gobjectIntrospection, doCheck ? false, makeWrapper }:
 
@@ -14,8 +14,10 @@ stdenv.mkDerivation rec {
   #   url = "mirror://gnome/sources/${pname}/${gnome3.versionBranch version}/${name}.tar.xz";
   #   sha256 = "0d534ysa6n9prd17wwzisq7mj6qkhwh8wcf8qgin1ar3hbs5ry7z";
   # };
-  src = fetchgit {
+  src = fetchFromGitLab {
-    url = https://gitlab.gnome.org/GNOME/gdk-pixbuf.git;
+    domain = "gitlab.gnome.org";
+    owner = "GNOME";
+    repo = "gdk-pixbuf";
     rev = version;
     sha256 = "18lwqg63vyap2m1mw049rnb8fm869429xbf7636a2n21gs3d3jwv";
   };

pkgs/development/libraries/harfbuzz/default.nix

@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "1.8.1";
+  version = "1.8.2";
   inherit (stdenv.lib) optional optionals optionalString;
 in
 
@@ -14,7 +14,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/harfbuzz/release/harfbuzz-${version}.tar.bz2";
-    sha256 = "0ifzhqbg4p6ka7ps5c7lapix09i9yy4z7achc1gf91dhvn967vgv";
+    sha256 = "0my6m9aqv4a8fc2pjwqx9pfdfh3a9mqvas4si4psi1b1867zi8y8";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/libraries/libcouchbase/default.nix

@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake pkgconfig ];
   buildInputs = [ libevent openssl ];
 
-  doCheck = (!stdenv.isDarwin);
+  doCheck = !stdenv.isDarwin;
   checkPhase = "ctest";
 
   meta = with stdenv.lib; {

pkgs/development/libraries/ncurses/default.nix

@@ -32,7 +32,6 @@ stdenv.mkDerivation rec {
     "--enable-pc-files"
     "--enable-symlinks"
   ] ++ lib.optional unicode "--enable-widec"
-    ++ lib.optional enableStatic "--enable-static"
     ++ lib.optional (!withCxx) "--without-cxx"
     ++ lib.optional (abiVersion == "5") "--with-abi-version=5";
 
@@ -109,6 +108,11 @@ stdenv.mkDerivation rec {
         for statictype in a dll.a la; do
           if [ -e "$out/lib/lib''${library}$suffix.$statictype" ]; then
             ln -svf lib''${library}$suffix.$statictype $out/lib/lib$library$newsuffix.$statictype
+            if [ "ncurses" = "$library" ]
+            then
+              # make libtinfo symlinks
+              ln -svf lib''${library}$suffix.$statictype $out/lib/libtinfo$newsuffix.$statictype
+            fi
           fi
         done
         ln -svf ''${library}$suffix.pc $dev/lib/pkgconfig/$library$newsuffix.pc
@@ -127,7 +131,7 @@ stdenv.mkDerivation rec {
     moveToOutput "bin/infotocap" "$out"
   '';
 
-  preFixup = lib.optionalString (!hostPlatform.isCygwin) ''
+  preFixup = lib.optionalString (!hostPlatform.isCygwin && !enableStatic) ''
     rm "$out"/lib/*.a
   '';
 

pkgs/development/libraries/pango/default.nix

@@ -1,19 +1,19 @@
-{ stdenv, fetchurl, fetchpatch, pkgconfig, libXft, cairo, harfbuzz
+{ stdenv, fetchurl, fetchpatch, pkgconfig, libXft, cairo, harfbuzz, fribidi
 , libintl, gobjectIntrospection, darwin
 }:
 
 with stdenv.lib;
 
 let
-  ver_maj = "1.40";
+  ver_maj = "1.42";
-  ver_min = "14";
+  ver_min = "1";
 in
 stdenv.mkDerivation rec {
   name = "pango-${ver_maj}.${ver_min}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/pango/${ver_maj}/${name}.tar.xz";
-    sha256 = "90af1beaa7bf9e4c52db29ec251ec4fd0a8f2cc185d521ad1f88d01b3a6a17e3";
+    sha256 = "0cnfgcya3wbs9m8g44cl5ww6wbp6qbw96qvsgkr8ymwqn9b6fnli";
   };
 
   outputs = [ "bin" "dev" "out" "devdoc" ];
@@ -25,17 +25,10 @@ stdenv.mkDerivation rec {
        CoreGraphics
        CoreText
     ]);
-  propagatedBuildInputs = [ cairo harfbuzz libXft libintl ];
+  propagatedBuildInputs = [ cairo harfbuzz libXft libintl fribidi ];
 
   enableParallelBuilding = true;
 
-  doCheck = false; # test-layout fails on 1.40.3 (fails to find font config)
-  # jww (2014-05-05): The tests currently fail on Darwin:
-  #
-  # ERROR:testiter.c:139:iter_char_test: assertion failed: (extents.width == x1 - x0)
-  # .../bin/sh: line 5: 14823 Abort trap: 6 srcdir=. PANGO_RC_FILE=./pangorc ${dir}$tst
-  # FAIL: testiter
-
   configureFlags = optional stdenv.isDarwin "--without-x";
 
   meta = with stdenv.lib; {

pkgs/development/libraries/pcre/default.nix

@@ -9,7 +9,7 @@ with stdenv.lib;
 assert elem variant [ null "cpp" "pcre16" "pcre32" ];
 
 let
-  version = "8.41";
+  version = "8.42";
   pname = if (variant == null) then "pcre"
     else  if (variant == "cpp") then "pcre-cpp"
     else  variant;
@@ -19,7 +19,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/pcre-${version}.tar.bz2";
-    sha256 = "0c5m469p5pd7jip621ipq6hbgh7128lzh7xndllfgh77ban7wb76";
+    sha256 = "00ckpzlgyr16bnqx8fawa3afjgqxw5yxgs2l081vw23qi1y4pl1c";
   };
 
   outputs = [ "bin" "dev" "out" "doc" "man" ];

pkgs/development/libraries/science/math/openblas/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchpatch, gfortran, perl, which, config, coreutils
+{ stdenv, fetchFromGitHub, fetchpatch, gfortran, perl, which, config, coreutils
 # Most packages depending on openblas expect integer width to match
 # pointer width, but some expect to use 32-bit integers always
 # (for compatibility with reference BLAS).
@@ -80,10 +80,11 @@ in
 stdenv.mkDerivation rec {
   name = "openblas-${version}";
   version = "0.3.1";
-  src = fetchurl {
+  src = fetchFromGitHub {
-    url = "https://github.com/xianyi/OpenBLAS/archive/v${version}.tar.gz";
+    owner = "xianyi";
-    sha256 = "0czbs2afmcxxij1ivqrm04p0qcksg5fravjifhydvb7k6mpraphz";
+    repo = "OpenBLAS";
-    name = "openblas-${version}.tar.gz";
+    rev = "v${version}";
+    sha256 = "1dkwp4gz1hzpmhzks9y9ipb4c5h0r6c7yff62x3s8x9z6f8knaqc";
   };
 
   inherit blas64;
@@ -117,7 +118,20 @@ stdenv.mkDerivation rec {
     ] ++ stdenv.lib.optional (stdenv.hostPlatform.libc == "musl") "NO_AFFINITY=1"
     ++ mapAttrsToList (var: val: var + "=" + val) config;
 
-  patches = []; # TODO: Remove on next mass-rebuild
+    patches = [
+      # Backport of https://github.com/xianyi/OpenBLAS/pull/1667, which
+      # is causing problems and was already accepted upstream.
+      (fetchpatch {
+        url = "https://github.com/xianyi/OpenBLAS/commit/5f2a3c05cd0e3872be3c5686b9da6b627658eeb7.patch";
+        sha256 = "1qvxhk92likrshw6z6hjqxvkblwzgsbzis2b2f71bsvx9174qfk1";
+      })
+      # Double "MAX_ALLOCATING_THREADS", fix with Go and Octave
+      # https://github.com/xianyi/OpenBLAS/pull/1663 (see also linked issue)
+      (fetchpatch {
+        url = "https://github.com/xianyi/OpenBLAS/commit/a49203b48c4a3d6f86413fc8c4b1fbfaa1946463.patch";
+        sha256 = "0v6kjkbgbw7hli6xkism48wqpkypxmcqvxpx564snll049l2xzq2";
+      })
+    ];
 
   doCheck = true;
   checkTarget = "tests";

pkgs/development/libraries/wayland/protocols.nix

@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   name = "wayland-protocols-${version}";
-  version = "1.14";
+  version = "1.15";
 
   src = fetchurl {
     url = "https://wayland.freedesktop.org/releases/${name}.tar.xz";
-    sha256 = "1xknjcfhqvdi1s4iq4kk1q61fg2rar3g8q4vlqarpd324imqjj4n";
+    sha256 = "1qlyf9cllr2p339xxplznh023qcwj5iisp02ikx7ps349dx75fys";
   };
 
   nativeBuildInputs = [ pkgconfig ];

pkgs/development/perl-modules/DBD-Pg/default.nix

@@ -17,7 +17,6 @@ buildPerlPackage rec {
   doCheck = false;
 
   meta = {
-    homepage = http://search.cpan.org/dist/DBD-Pg/;
     description = "DBI PostgreSQL interface";
     license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
     platforms = stdenv.lib.platforms.unix;

pkgs/development/perl-modules/generic/default.nix

@@ -3,6 +3,8 @@ perl:
 { nativeBuildInputs ? [], name, ... } @ attrs:
 
 perl.stdenv.mkDerivation (
+  (
+  perl.stdenv.lib.recursiveUpdate
   {
     outputs = [ "out" "devdoc" ];
 
@@ -20,9 +22,11 @@ perl.stdenv.mkDerivation (
     # authors to skip certain tests (or include certain tests) when
     # the results are not being monitored by a human being."
     AUTOMATED_TESTING = true;
+
+    meta.homepage = "https://metacpan.org/release/${(builtins.parseDrvName name).name}";
   }
-  //
   attrs
+  )
   //
   {
     name = "perl-" + name;

pkgs/development/python-modules/backports_ssl_match_hostname/default.nix

@@ -0,0 +1,17 @@
+{ lib, buildPythonPackage, fetchPypi }:
+
+buildPythonPackage rec {
+  pname = "backports.ssl_match_hostname";
+  version = "3.5.0.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1wndipik52cyqy0677zdgp90i435pmvwd89cz98lm7ri0y3xjajh";
+  };
+
+  meta = with lib; {
+    description = "The Secure Sockets layer is only actually *secure*";
+    homepage = https://bitbucket.org/brandon/backports.ssl_match_hostname;
+    license = licenses.psfl;
+  };
+}

pkgs/development/python-modules/cvxopt/default.nix

@@ -46,11 +46,6 @@ buildPythonPackage rec {
     export CVXOPT_FFTW_INC_DIR=${fftw.dev}/include
   '';
 
-  # https://github.com/cvxopt/cvxopt/issues/122
-  # This is fixed on staging (by #43234, status 2018-07-15), but until that
-  # lands we should disable the tests. Otherwise the 99% of use cases that
-  # should be unaffected by that failure are affected.
-  doCheck = false;
   checkPhase = ''
     ${python.interpreter} -m unittest discover -s tests
   '';

pkgs/development/python-modules/parsy/default.nix

@@ -0,0 +1,26 @@
+{ lib, buildPythonPackage, fetchPypi, pythonOlder, pytest }:
+
+buildPythonPackage rec {
+  pname = "parsy";
+  version = "1.2.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0mdqg07x5ybmbmj55x75gyhfcjrn7ml0cf3z0jwbskx845j31m6x";
+  };
+
+  checkInputs = [ pytest ];
+
+  checkPhase = ''
+    py.test test/
+  '';
+
+  disabled = pythonOlder "3.4";
+
+  meta = with lib; {
+    homepage = https://github.com/python-parsy/parsy;
+    description = "Easy-to-use parser combinators, for parsing in pure Python";
+    license = [ licenses.mit ];
+    maintainers = with maintainers; [ aepsil0n ];
+  };
+}

pkgs/development/tools/build-managers/doit/default.nix

@@ -22,10 +22,10 @@ in python3Packages.buildPythonApplication {
   doCheck = false;
   checkPhase = "py.test";
 
-  meta = {
+  meta = with stdenv.lib; {
     homepage = http://pydoit.org/;
     description = "A task management & automation tool";
-    license = stdenv.lib.licenses.mit;
+    license = licenses.mit;
     longDescription = ''
       doit is a modern open-source build-tool written in python
       designed to be simple to use and flexible to deal with complex
@@ -33,6 +33,7 @@ in python3Packages.buildPythonApplication {
       custom work-flows where there is no out-of-the-box solution
       available.
     '';
-    platforms = stdenv.lib.platforms.all;
+    maintainers = with maintainers; [ pSub ];
+    platforms = platforms.all;
   };
 }

pkgs/development/tools/build-managers/meson/default.nix

@@ -2,12 +2,12 @@
   targetPrefix = lib.optionalString stdenv.isCross
                    (targetPlatform.config + "-");
 in python3Packages.buildPythonApplication rec {
-  version = "0.46.1";
+  version = "0.47.0";
   pname = "meson";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "1jdxs2mkniy1hpdjc4b4jb95axsjp6j5fzphmm6d4gqmqyykjvqc";
+    sha256 = "1mxsvsw7mg3q4yj8qrkrwv79qwws14qnbihryn2i7504b3r204h6";
   };
 
   postFixup = ''

pkgs/development/tools/build-managers/meson/setup-hook.sh

@@ -17,6 +17,7 @@ mesonConfigurePhase() {
         --includedir=${!outputInclude}/include \
         --mandir=${!outputMan}/share/man --infodir=${!outputInfo}/share/info \
         --localedir=${!outputLib}/share/locale \
+        -Dauto_features=disabled \
         $mesonFlags"
 
     mesonFlags="${crossMesonFlags+$crossMesonFlags }--buildtype=${mesonBuildType:-release} $mesonFlags"

pkgs/development/tools/vagrant/Gemfile.lock

@@ -11,7 +11,7 @@ GIT
 PATH
   remote: .
   specs:
-    vagrant (2.1.1)
+    vagrant (2.1.2)
       childprocess (~> 0.6.0)
       erubis (~> 2.7.0)
       hashicorp-checkpoint (~> 0.1.5)
@@ -25,8 +25,6 @@ PATH
       rest-client (>= 1.6.0, < 3.0)
       ruby_dep (<= 1.3.1)
       wdm (~> 0.1.0)
-      win32-file (~> 0.8.1)
-      win32-file-security (~> 1.0.10)
       winrm (~> 2.1)
       winrm-elevated (~> 1.1)
       winrm-fs (~> 1.0)
@@ -47,8 +45,6 @@ GEM
     erubis (2.7.0)
     fake_ftp (0.1.1)
     ffi (1.9.23)
-    ffi-win32-extensions (1.0.3)
-      ffi
     gssapi (1.2.0)
       ffi (>= 1.0.1)
     gyoku (1.3.1)
@@ -119,16 +115,6 @@ GEM
       addressable (>= 2.3.6)
       crack (>= 0.3.2)
       hashdiff
-    win32-file (0.8.1)
-      ffi
-      ffi-win32-extensions
-      win32-file-stat (>= 1.4.0)
-    win32-file-security (1.0.10)
-      ffi
-      ffi-win32-extensions
-    win32-file-stat (1.5.5)
-      ffi
-      ffi-win32-extensions
     winrm (2.2.3)
       builder (>= 2.1.2)
       erubis (~> 2.7)
@@ -160,4 +146,4 @@ DEPENDENCIES
   webmock (~> 2.3.1)
 
 BUNDLED WITH
-   1.14.6
+   1.16.2

pkgs/development/tools/vagrant/default.nix

@@ -1,6 +1,10 @@
 { lib, fetchurl, buildRubyGem, bundlerEnv, ruby, libarchive }:
 
 let
+  # NOTE: bumping the version and updating the hash is insufficient;
+  # you must copy a fresh Gemfile.lock from the vagrant source,
+  # and use bundix to generate a new gemset.nix.
+  # Do not change the existing Gemfile.
   version = "2.1.2";
   url = "https://github.com/hashicorp/vagrant/archive/v${version}.tar.gz";
   sha256 = "0fb90v43d30whhyjlgb9mmy93ccbpr01pz97kp5hrg3wfd7703b1";

pkgs/development/tools/vagrant/gemset.nix

@@ -75,15 +75,6 @@
     };
     version = "1.9.23";
   };
-  ffi-win32-extensions = {
-    dependencies = ["ffi"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1ywkkbr3bpi2ais2jr8yrsqwwrm48jg262anmdkcb9if95vajx7l";
-      type = "gem";
-    };
-    version = "1.0.3";
-  };
   gssapi = {
     dependencies = ["ffi"];
     source = {
@@ -406,7 +397,7 @@
     version = "0.0.7.5";
   };
   vagrant = {
-    dependencies = ["childprocess" "erubis" "hashicorp-checkpoint" "i18n" "listen" "log4r" "net-scp" "net-sftp" "net-ssh" "rb-kqueue" "rest-client" "ruby_dep" "wdm" "win32-file" "win32-file-security" "winrm" "winrm-elevated" "winrm-fs"];
+    dependencies = ["childprocess" "erubis" "hashicorp-checkpoint" "i18n" "listen" "log4r" "net-scp" "net-sftp" "net-ssh" "rb-kqueue" "rest-client" "ruby_dep" "wdm" "winrm" "winrm-elevated" "winrm-fs"];
   };
   vagrant-spec = {
     dependencies = ["childprocess" "log4r" "rspec" "thor"];
@@ -436,33 +427,6 @@
     };
     version = "2.3.2";
   };
-  win32-file = {
-    dependencies = ["ffi" "ffi-win32-extensions" "win32-file-stat"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0mjylzv4bbnxyjqf7hnd9ghcs5xr2sv8chnmkqdi2cc6pya2xax0";
-      type = "gem";
-    };
-    version = "0.8.1";
-  };
-  win32-file-security = {
-    dependencies = ["ffi" "ffi-win32-extensions"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0lpq821a1hrxmm0ki5c34wijzhn77g4ny76v698ixwg853y2ir9r";
-      type = "gem";
-    };
-    version = "1.0.10";
-  };
-  win32-file-stat = {
-    dependencies = ["ffi" "ffi-win32-extensions"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0lc3yajcb8xxabvj9qian938k60ixydvs3ixl5fldi0nlvnvk468";
-      type = "gem";
-    };
-    version = "1.5.5";
-  };
   winrm = {
     dependencies = ["builder" "erubis" "gssapi" "gyoku" "httpclient" "logging" "nori" "rubyntlm"];
     source = {

pkgs/games/planetaryannihilation/default.nix

@@ -1,5 +1,5 @@
 { stdenv, config, fetchurl, patchelf, makeWrapper, gtk2, glib, udev, alsaLib, atk
-, nspr, fontconfig, cairo, pango, nss, freetype, gnome3, gdk_pixbuf, curl, systemd, xorg }:
+, nspr, fontconfig, cairo, pango, nss, freetype, gnome2, gdk_pixbuf, curl, systemd, xorg }:
 
 # TODO: use dynamic attributes once Nix 1.7 is out
 assert ((config.planetary_annihilation or null).url or null) != null;
@@ -34,7 +34,7 @@ stdenv.mkDerivation {
     ln -s ${systemd}/lib/libudev.so.1 $out/lib/libudev.so.0
 
     patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$out/PA"
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" --set-rpath "${stdenv.lib.makeLibraryPath [ stdenv.cc.cc.lib xorg.libXdamage xorg.libXfixes gtk2 glib stdenv.glibc.out "$out" xorg.libXext pango udev xorg.libX11 xorg.libXcomposite alsaLib atk nspr fontconfig cairo pango nss freetype gnome3.gconf gdk_pixbuf xorg.libXrender ]}:{stdenv.cc.cc.lib}/lib64:${stdenv.glibc.out}/lib64" "$out/host/CoherentUI_Host"
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" --set-rpath "${stdenv.lib.makeLibraryPath [ stdenv.cc.cc.lib xorg.libXdamage xorg.libXfixes gtk2 glib stdenv.glibc.out "$out" xorg.libXext pango udev xorg.libX11 xorg.libXcomposite alsaLib atk nspr fontconfig cairo pango nss freetype gnome2.GConf gdk_pixbuf xorg.libXrender ]}:{stdenv.cc.cc.lib}/lib64:${stdenv.glibc.out}/lib64" "$out/host/CoherentUI_Host"
 
     wrapProgram $out/PA --prefix LD_LIBRARY_PATH : "${stdenv.lib.makeLibraryPath [ stdenv.cc.cc.lib stdenv.glibc.out xorg.libX11 xorg.libXcursor gtk2 glib curl "$out" ]}:${stdenv.cc.cc.lib}/lib64:${stdenv.glibc.out}/lib64"
 

pkgs/misc/gnash/default.nix

@@ -9,7 +9,7 @@
 , enableOpenGL ? false, libGLU_combined  ? null
 
 # GUI toolkits
-, enableGTK ? true,  gtk2 ? null, gnome2 ? null, gnome3 ? null
+, enableGTK ? true,  gtk2 ? null, gnome2 ? null
 , enableSDL ? false
 , enableQt  ? false, qt4  ? null
 
@@ -27,7 +27,7 @@
 
 with stdenv.lib;
 
-let 
+let
   available = x: x != null;
 
   sound =
@@ -52,7 +52,7 @@ assert enableCairo  -> available cairo;
 assert enableOpenGL -> available libGLU_combined;
 
 # GUI toolkits
-assert enableGTK -> all available [ gtk2 gnome2.gtkglext gnome3.gconf ];
+assert enableGTK -> all available [ gtk2 gnome2.gtkglext gnome2.GConf ];
 assert enableSDL -> available SDL;
 assert enableQt  -> available qt4;
 
@@ -96,7 +96,7 @@ stdenv.mkDerivation rec {
     ++ optional  enableJemalloc  jemalloc
     ++ optional  enableHwAccel   libGLU_combined
     ++ optionals enablePlugins   [ xulrunner npapi_sdk ]
-    ++ optionals enableGTK       [ gtk2 gnome2.gtkglext gnome3.gconf ]
+    ++ optionals enableGTK       [ gtk2 gnome2.gtkglext gnome2.GConf ]
     ++ optionals enableGstreamer [ gst-plugins-base gst-plugins-ugly gst-ffmpeg ];
 
   configureFlags = with stdenv.lib; [

pkgs/os-specific/linux/procps-ng/default.nix

@@ -1,4 +1,10 @@
-{ lib, stdenv, fetchurl, ncurses, pkgconfig }:
+{ lib, stdenv, fetchurl, ncurses, pkgconfig
+
+# procps is mostly Linux-only. Most commands require a running Linux
+# system (or very similar like that found in Cygwin). The one
+# exception is ‘watch’ which is portable enough to run on pretty much
+# any UNIX-compatible system.
+, watchOnly ? !(stdenv.isLinux || stdenv.isCygwin) }:
 
 stdenv.mkDerivation rec {
   name = "procps-${version}";
@@ -13,7 +19,8 @@ stdenv.mkDerivation rec {
   buildInputs = [ ncurses ];
   nativeBuildInputs = [ pkgconfig ];
 
-  makeFlags = "usrbin_execdir=$(out)/bin";
+  makeFlags = [ "usrbin_execdir=$(out)/bin" ]
+    ++ lib.optionals watchOnly [ "watch" "PKG_LDFLAGS="];
 
   enableParallelBuilding = true;
 
@@ -23,12 +30,17 @@ stdenv.mkDerivation rec {
     [ "ac_cv_func_malloc_0_nonnull=yes"
       "ac_cv_func_realloc_0_nonnull=yes" ];
 
+  installPhase = if watchOnly then ''
+    install -m 0755 -D watch $out/bin/watch
+    install -m 0644 -D watch.1 $out/share/man/man1/watch.1
+  '' else null;
+
   meta = {
     homepage = https://gitlab.com/procps-ng/procps;
     description = "Utilities that give information about processes using the /proc filesystem";
     priority = 10; # less than coreutils, which also provides "kill" and "uptime"
     license = lib.licenses.gpl2;
-    platforms = lib.platforms.linux ++ lib.platforms.cygwin;
+    platforms = lib.platforms.unix;
     maintainers = [ lib.maintainers.typetetris ];
   };
 }

pkgs/os-specific/linux/procps/watch.nix

@@ -1,25 +0,0 @@
-{ stdenv, fetchurl, ncurses }:
-
-stdenv.mkDerivation {
-  name = "watch-0.2.0";
-
-  src = fetchurl {
-    url = http://procps.sourceforge.net/procps-3.2.8.tar.gz;
-    sha256 = "0d8mki0q4yamnkk4533kx8mc0jd879573srxhg6r2fs3lkc6iv8i";
-  };
-
-  buildInputs = [ ncurses ];
-
-  makeFlags = "watch usrbin_execdir=$(out)/bin" +
-              (if stdenv.isDarwin then " PKG_LDFLAGS=" else "");
-
-  enableParallelBuilding = true;
-
-  installPhase = "mkdir $out; mkdir -p $out/bin; cp -p watch $out/bin";
-
-  meta = {
-    homepage = https://sourceforge.net/projects/procps/;
-    description = "Utility for watch the output of a given command at intervals";
-    platforms = stdenv.lib.platforms.unix;
-  };
-}

pkgs/servers/openxpki/default.nix

@@ -34,7 +34,7 @@ buildPerlPackage {
       ConfigGitLike DevelStackTrace TreeDAGNode ClassObservable ClassFactory TimeDate ConfigAny
       CGIFast ClassISA YAML YAMLLibYAML AuthenSASL TextCSV FileFindRulePerl IODigest ]
     ++ stdenv.lib.optionals extraDependencies3
-    [ # dependencies taken from http://search.cpan.org/~alech/Bundle-OpenXPKI-0.06/lib/Bundle/OpenXPKI.pm
+    [ # dependencies taken from https://metacpan.org/pod/release/ALECH/Bundle-OpenXPKI-0.06/lib/Bundle/OpenXPKI.pm
       AttributeHandlers AttributeParamsValidate AutoLoader BC CGI CPAN CacheCache ClassClassgenclassgen
       ClassContainer ClassDataInheritable ClassSingleton ConvertASN1 DBDSQLite DBIxHTMLViewLATEST
       DBFile DataPage DataSpreadPagination DateTimeLocale DateTimeTimeZone DevelPPPort DevelSelfStubber

pkgs/stdenv/generic/setup.sh

@@ -220,7 +220,6 @@ isScript() {
     local fn="$1"
     local fd
     local magic
-    if ! [ -x /bin/sh ]; then return 0; fi
     exec {fd}< "$fn"
     read -r -n 2 -u "$fd" magic
     exec {fd}<&-

pkgs/tools/admin/aws-rotate-key/default.nix

@@ -0,0 +1,25 @@
+{ stdenv, buildGoPackage, fetchFromGitHub }:
+
+buildGoPackage rec {
+  name = "aws-rotate-key-${version}";
+  version = "1.0.0";
+
+  goPackagePath = "github.com/Fullscreen/aws-rotate-key";
+
+  src = fetchFromGitHub {
+    rev = "v${version}";
+    owner = "Fullscreen";
+    repo = "aws-rotate-key";
+    sha256 = "13q7rns65cj8b4i0s75dbswijpra9z74b462zribwfjdm29by5k1";
+  };
+
+  goDeps = ./deps.nix;
+
+  meta = with stdenv.lib; {
+    description = "Easily rotate your AWS key";
+    homepage = https://github.com/Fullscreen/aws-rotate-key;
+    license = licenses.mit;
+    maintainers = [maintainers.mbode];
+    platforms = platforms.unix;
+  };
+}

pkgs/tools/admin/aws-rotate-key/deps.nix

@@ -0,0 +1,29 @@
+[
+  {
+    goPackagePath = "github.com/go-ini/ini";
+    fetch = {
+      type = "git";
+      url = "https://github.com/go-ini/ini";
+      rev = "af26abd521cd7697481572fdbc4a53cbea3dde1b";
+      sha256 = "1yribbqy9i4i70dfg3yrjhkn3n0fywpr3kismn2mvi882mm01pxz";
+    };
+  }
+  {
+    goPackagePath = "github.com/jmespath/go-jmespath";
+    fetch = {
+      type = "git";
+      url = "https://github.com/jmespath/go-jmespath";
+      rev = "c2b33e8439af944379acbdd9c3a5fe0bc44bd8a5";
+      sha256 = "1r6w7ydx8ydryxk3sfhzsk8m6f1nsik9jg3i1zhi69v4kfl4d5cz";
+    };
+  }
+  {
+    goPackagePath = "github.com/aws/aws-sdk-go";
+    fetch = {
+      type = "git";
+      url = "https://github.com/aws/aws-sdk-go";
+      rev = "f844700ba2a387dfee7ab3679e7544b5dbd6d394";
+      sha256 = "0s9100bzqj58nnax3dxfgi5qr4rbaa53cb0cj3s58k9jc9z6270m";
+    };
+  }
+]

pkgs/tools/admin/bluemix-cli/default.nix

@@ -2,16 +2,30 @@
 
 stdenv.mkDerivation rec {
   name = "bluemix-cli-${version}";
-  version = "0.6.6";
+  version = "0.8.0";
 
-  src = fetchurl {
+  src =
-    name = "linux64.tar.gz";
+    if stdenv.system == "i686-linux" then
-    url = "https://clis.ng.bluemix.net/download/bluemix-cli/${version}/linux64";
+      fetchurl {
-    sha256 = "1swjawc4szqrl0wgjcb4na1hbxylaqp2mp53lxsbfbk1db0c3y85";
+        name = "linux32-${version}.tar.gz";
-  };
+        url = "https://clis.ng.bluemix.net/download/bluemix-cli/${version}/linux32";
+        sha256 = "1ryngbjlw59x33rfd32bcz49r93a1q1g92jh7xmi9vydgqnzsifh";
+      }
+    else
+      fetchurl {
+        name = "linux64-${version}.tar.gz";
+        url = "https://clis.ng.bluemix.net/download/bluemix-cli/${version}/linux64";
+        sha256 = "056zbaca430ldcn0s86vy40m5abvwpfrmvqybbr6fjwfv9zngywx";
+      }
+    ;
 
   installPhase = ''
-    install -m755 -D --target $out/bin bin/bluemix bin/bluemix-analytics bin/cfcli/cf
+    install -m755 -D -t $out/bin bin/ibmcloud bin/ibmcloud-analytics
+    install -m755 -D -t $out/bin/cfcli bin/cfcli/cf
+    ln -sv $out/bin/ibmcloud $out/bin/bx
+    ln -sv $out/bin/ibmcloud $out/bin/bluemix
+    install -D -t "$out/etc/bash_completion.d" bx/bash_autocomplete
+    install -D -t "$out/share/zsh/site-functions" bx/zsh_autocomplete
   '';
 
   meta = with lib; {
@@ -19,7 +33,7 @@ stdenv.mkDerivation rec {
     homepage     = "https://console.bluemix.net/docs/cli/index.html";
     downloadPage = "https://console.bluemix.net/docs/cli/reference/bluemix_cli/download_cli.html#download_install";
     license      = licenses.unfree;
-    maintainers  = [ maintainers.tazjin ];
+    maintainers  = [ maintainers.tazjin maintainers.jensbin ];
-    platforms    = [ "x86_64-linux" ];
+    platforms    = [ "x86_64-linux" "i686-linux" ];
   };
 }

pkgs/tools/filesystems/e2fsprogs/default.nix

@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, pkgconfig, libuuid, gettext, texinfo }:
 
 stdenv.mkDerivation rec {
-  name = "e2fsprogs-1.44.2";
+  name = "e2fsprogs-1.44.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/e2fsprogs/${name}.tar.gz";
-    sha256 = "0s3znfy26as63gdbskm6pxh3i1106bpxf2jh9dppd8d9lidmmh75";
+    sha256 = "1gl34i2dy1n7aky9g0jgdybl3ar2zh8i8xnghrcbb5pvws66vbn2";
   };
 
   outputs = [ "bin" "dev" "out" "man" "info" ];

pkgs/tools/filesystems/file-rename/default.nix

@@ -17,7 +17,6 @@ perlPackages.buildPerlPackage rec {
 
   meta = with stdenv.lib; {
     description = "Perl extension for renaming multiple files";
-    homepage = http://search.cpan.org/~rmbarker;
     license = licenses.artistic1;
     maintainers = with maintainers; [ peterhoeg ];
   };

pkgs/tools/graphics/graph-easy/default.nix

@@ -7,9 +7,8 @@ buildPerlPackage rec {
     url = "mirror://cpan/authors/id/S/SH/SHLOMIF/${name}.tar.gz";
     sha256 = "d4a2c10aebef663b598ea37f3aa3e3b752acf1fbbb961232c3dbe1155008d1fa";
   };
-  
+
   meta = with stdenv.lib; {
-    homepage = http://search.cpan.org/~tels/Graph-Easy/bin/graph-easy;
     description = "Render/convert graphs in/from various formats";
     license = licenses.gpl1;
     platforms = platforms.linux;

pkgs/tools/graphics/ibniz/default.nix

@@ -0,0 +1,26 @@
+{ stdenv, fetchurl, SDL }:
+
+stdenv.mkDerivation rec {
+  name = "ibniz-${version}";
+  version = "1.18";
+
+  src = fetchurl {
+    url = "http://www.pelulamu.net/ibniz/${name}.tar.gz";
+    sha256 = "10b4dka8zx7y84m1a58z9j2vly8mz9aw9wn8z9vx9av739j95wp2";
+  };
+
+  buildInputs = [ SDL ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp ibniz $out/bin
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Virtual machine designed for extremely compact low-level audiovisual programs";
+    homepage = "http://www.pelulamu.net/ibniz/";
+    license = licenses.zlib;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.dezgeg ];
+  };
+}

pkgs/tools/misc/mmake/default.nix

@@ -17,7 +17,13 @@ buildGoPackage rec {
 
   meta = with stdenv.lib; {
     homepage = https://github.com/tj/mmake;
-    description = "Mmake is a small program which wraps make to provide additional functionality, such as user-friendly help output, remote includes, and eventually more. It otherwise acts as a pass-through to standard make.";
+    description = "A small program  which wraps make to provide additional functionality";
+    longDescription = ''
+      Mmake is a small program  which wraps make to provide additional
+      functionality,  such   as  user-friendly  help   output,  remote
+      includes,  and   eventually  more.   It  otherwise  acts   as  a
+      pass-through to standard make.
+      '';
     license = licenses.mit;
     platforms = platforms.all;
     maintainers = [ maintainers.gabesoft ];

pkgs/tools/misc/rename/default.nix

@@ -12,7 +12,6 @@ buildPerlPackage rec {
   };
   meta = with stdenv.lib; {
     description = "Rename files according to a Perl rewrite expression";
-    homepage = http://search.cpan.org/~pederst/rename-1.9/bin/rename.PL;
     maintainers = with maintainers; [ mkg ];
     license = with licenses; [ gpl1Plus ];
   };

pkgs/tools/misc/toilet/default.nix

@@ -12,10 +12,11 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libcaca ];
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Display large colourful characters in text mode";
     homepage = http://caca.zoy.org/wiki/toilet;
-    license = stdenv.lib.licenses.wtfpl;
+    license = licenses.wtfpl;
-    platforms = stdenv.lib.platforms.all;
+    maintainers = with maintainers; [ pSub ];
+    platforms = platforms.all;
   };
 }

pkgs/tools/networking/network-manager/fortisslvpn.nix

@@ -13,7 +13,7 @@ in stdenv.mkDerivation rec {
   };
 
   buildInputs = [ openfortivpn networkmanager ppp libtool libsecret ]
-    ++ stdenv.lib.optionals withGnome [ gnome3.gtk gnome3.libgnome-keyring gnome3.gconf gnome3.networkmanagerapplet ];
+    ++ stdenv.lib.optionals withGnome [ gnome3.gtk gnome3.libgnome-keyring gnome3.networkmanagerapplet ];
 
   nativeBuildInputs = [ automake autoconf intltool pkgconfig ];
 

pkgs/tools/networking/network-manager/openconnect.nix

@@ -13,7 +13,7 @@ in stdenv.mkDerivation rec {
   };
 
   buildInputs = [ openconnect networkmanager libsecret ]
-    ++ stdenv.lib.optionals withGnome [ gnome3.gtk gnome3.libgnome-keyring gnome3.gconf ];
+    ++ stdenv.lib.optionals withGnome [ gnome3.gtk gnome3.libgnome-keyring ];
 
   nativeBuildInputs = [ intltool pkgconfig ];
 

pkgs/tools/system/pciutils/default.nix

@@ -22,6 +22,16 @@ stdenv.mkDerivation rec {
 
   installTargets = "install install-lib";
 
+  # Use standardized and equivalent realpath(path, NULL) instead of canonicalize_file_name(path).
+  # This is documented to be equivalent, see `man 3 canonicalize_file_name`.
+  # Fixes w/musl.
+  # Upstream PR: https://github.com/pciutils/pciutils/pull/6
+  postPatch = ''
+    substituteInPlace lib/sysfs.c \
+      --replace "canonicalize_file_name(path)" \
+                "realpath(path, NULL)"
+  '';
+
   # Get rid of update-pciids as it won't work.
   postInstall = "rm $out/sbin/update-pciids $out/man/man8/update-pciids.8";
 

pkgs/tools/text/aha/default.nix

@@ -22,6 +22,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = https://github.com/theZiz/aha;
     license = with licenses; [ lgpl2Plus mpl11 ];
+    maintainers = with maintainers; [ pSub ];
     platforms = platforms.linux;
   };
 }

pkgs/top-level/aliases.nix

@@ -219,7 +219,7 @@ mapAliases ({
   pltScheme = racket; # just to be sure
   polarssl = mbedtls; # added 2018-04-25
   poppler_qt5 = libsForQt5.poppler;  # added 2015-12-19
-  procps = procps-ng; # added 2018-04-25
+  procps-ng = procps; # added 2018-06-08
   prometheus-statsd-bridge = prometheus-statsd-exporter;  # added 2017-08-27
   pulseaudioLight = pulseaudio; # added 2018-04-25
   qca-qt5 = libsForQt5.qca-qt5;  # added 2015-12-19

pkgs/top-level/all-packages.nix

@@ -555,6 +555,8 @@ with pkgs;
 
   awslogs = callPackage ../tools/admin/awslogs { };
 
+  aws-rotate-key = callPackage ../tools/admin/aws-rotate-key { };
+
   aws_shell = pythonPackages.callPackage ../tools/admin/aws_shell { };
 
   aws-sam-cli = callPackage ../development/tools/aws-sam-cli { };
@@ -1773,7 +1775,8 @@ with pkgs;
   };
 
   ibus = callPackage ../tools/inputmethods/ibus {
-    inherit (gnome3) dconf gconf glib;
+    gconf = gnome2.GConf;
+    inherit (gnome3) dconf glib;
   };
 
   ibus-qt = callPackage ../tools/inputmethods/ibus/ibus-qt.nix { };
@@ -3086,6 +3089,8 @@ with pkgs;
 
   iannix = libsForQt5.callPackage ../applications/audio/iannix { };
 
+  ibniz = callPackage ../tools/graphics/ibniz { };
+
   icecast = callPackage ../servers/icecast { };
 
   darkice = callPackage ../tools/audio/darkice { };
@@ -6645,20 +6650,7 @@ with pkgs;
   icedtea_web = icedtea8_web;
 
   idrisPackages = callPackage ../development/idris-modules {
-
+    idris-no-deps = haskellPackages.idris;
-    idris-no-deps =
-      let
-        inherit (self.haskell) lib;
-        haskellPackages = self.haskellPackages.override {
-          overrides = self: super: {
-            binary = lib.dontCheck self.binary_0_8_5_1;
-            parsers = lib.dontCheck super.parsers;
-            semigroupoids = lib.dontCheck super.semigroupoids;
-            trifecta = lib.dontCheck super.trifecta;
-          };
-        };
-      in
-        haskellPackages.idris;
   };
 
   idris = idrisPackages.with-packages [ idrisPackages.base ] ;
@@ -9138,7 +9130,6 @@ with pkgs;
     game-music-emu = if stdenv.isDarwin then null else game-music-emu;
     libjack2 = if stdenv.isDarwin then null else libjack2;
     libmodplug = if stdenv.isDarwin then null else libmodplug;
-    libvpx = if stdenv.isDarwin then null else libvpx;
     openal = if stdenv.isDarwin then null else openal;
     libpulseaudio = if stdenv.isDarwin then null else libpulseaudio;
     samba = if stdenv.isDarwin then null else samba;
@@ -12930,7 +12921,7 @@ with pkgs;
   };
 
   pulseaudioFull = pulseaudio.override {
-    gconf = gnome3.gconf;
+    gconf = gnome2.GConf;
     x11Support = true;
     jackaudioSupport = true;
     airtunesSupport = true;
@@ -14288,10 +14279,8 @@ with pkgs;
 
   prayer = callPackage ../servers/prayer { };
 
-  procps-ng = if stdenv.isLinux then callPackage ../os-specific/linux/procps-ng { }
+  procps = if stdenv.isLinux then callPackage ../os-specific/linux/procps-ng { }
-              else unixtools.procps;
+           else unixtools.procps;
-
-  watch = callPackage ../os-specific/linux/procps/watch.nix { };
 
   qemu_kvm = lowPrio (qemu.override { hostCpuOnly = true; });
 
@@ -15361,7 +15350,7 @@ with pkgs;
 
   bonzomatic = callPackage ../applications/editors/bonzomatic { };
 
-  brackets = callPackage ../applications/editors/brackets { gconf = gnome3.gconf; };
+  brackets = callPackage ../applications/editors/brackets { gconf = gnome2.GConf; };
 
   notmuch-bower = callPackage ../applications/networking/mailreaders/notmuch-bower { };
 
@@ -20221,7 +20210,8 @@ with pkgs;
       mkPlasma5 = import ../desktops/plasma-5;
       attrs = {
         inherit libsForQt5 lib fetchurl;
-        inherit (gnome3) gconf gsettings-desktop-schemas;
+        inherit (gnome3) gsettings-desktop-schemas;
+        gconf = gnome2.GConf;
       };
     in
       recurseIntoAttrs (makeOverridable mkPlasma5 attrs);
@@ -21028,7 +21018,7 @@ with pkgs;
   cups-zj-58 =  callPackage ../misc/cups/drivers/zj-58 { };
 
   crashplan = callPackage ../applications/backup/crashplan { };
-  crashplansb = callPackage ../applications/backup/crashplan/crashplan-small-business.nix { inherit (gnome3) gconf; };
+  crashplansb = callPackage ../applications/backup/crashplan/crashplan-small-business.nix { gconf = gnome2.GConf; };
 
   colort = callPackage ../applications/misc/colort { };
 
@@ -21951,7 +21941,7 @@ with pkgs;
   unixtools = recurseIntoAttrs (callPackages ./unix-tools.nix { });
   inherit (unixtools) hexdump ps logger eject umount
                       mount wall hostname more sysctl getconf
-                      getent locale killall xxd;
+                      getent locale killall xxd watch;
 
   fts = if hostPlatform.isMusl then netbsd.fts else null;
 

pkgs/top-level/python-packages.nix

@@ -943,34 +943,8 @@ in {
 
   backports_shutil_get_terminal_size = callPackage ../development/python-modules/backports_shutil_get_terminal_size { };
 
-  backports_ssl_match_hostname_3_4_0_2 = if !(pythonOlder "3.5") then null else self.buildPythonPackage rec {
+  backports_ssl_match_hostname = if !(pythonOlder "3.5") then null else
-    name = "backports.ssl_match_hostname-3.4.0.2";
+    callPackage ../development/python-modules/backports_ssl_match_hostname { };
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/b/backports.ssl_match_hostname/backports.ssl_match_hostname-3.4.0.2.tar.gz";
-      sha256 = "07410e7fb09aab7bdaf5e618de66c3dac84e2e3d628352814dc4c37de321d6ae";
-    };
-
-    meta = {
-      description = "The Secure Sockets layer is only actually *secure*";
-      homepage = https://bitbucket.org/brandon/backports.ssl_match_hostname;
-    };
-  };
-
-  backports_ssl_match_hostname = if !(pythonOlder "3.5") then null else self.buildPythonPackage rec {
-    name = "backports.ssl_match_hostname-${version}";
-    version = "3.5.0.1";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/b/backports.ssl_match_hostname/${name}.tar.gz";
-      sha256 = "1wndipik52cyqy0677zdgp90i435pmvwd89cz98lm7ri0y3xjajh";
-    };
-
-    meta = {
-      description = "The Secure Sockets layer is only actually *secure*";
-      homepage = https://bitbucket.org/brandon/backports.ssl_match_hostname;
-    };
-  };
 
   backports_lzma = callPackage ../development/python-modules/backports_lzma { };
 
@@ -1881,6 +1855,8 @@ in {
     '';
   };
 
+  parsy = callPackage ../development/python-modules/parsy { };
+
   portpicker = callPackage ../development/python-modules/portpicker { };
 
   pkginfo = callPackage ../development/python-modules/pkginfo { };

pkgs/top-level/release.nix

@@ -166,6 +166,7 @@ let
     } // (mapTestOn ((packagePlatforms pkgs) // rec {
       haskell.compiler = packagePlatforms pkgs.haskell.compiler;
       haskellPackages = packagePlatforms pkgs.haskellPackages;
+      idrisPackages = packagePlatforms pkgs.idrisPackages;
 
       # Language packages disabled in https://github.com/NixOS/nixpkgs/commit/ccd1029f58a3bb9eca32d81bf3f33cb4be25cc66
 

pkgs/top-level/unix-tools.nix

@@ -1,5 +1,4 @@
-{ pkgs, buildEnv, runCommand, hostPlatform, lib
+{ pkgs, buildEnv, runCommand, hostPlatform, lib, stdenv }:
-, stdenv }:
 
 # These are some unix tools that are commonly included in the /usr/bin
 # and /usr/sbin directory under more normal distributions. Along with
@@ -11,35 +10,42 @@
 # instance, if your program needs to use "ps", just list it as a build
 # input, not "procps" which requires Linux.
 
+with lib;
+
 let
   version = "1003.1-2008";
 
   singleBinary = cmd: providers: let
-      provider = "${lib.getBin providers.${hostPlatform.parsed.kernel.name}}/bin/${cmd}";
+      provider = providers.${hostPlatform.parsed.kernel.name};
-      manpage = "${lib.getOutput "man" providers.${hostPlatform.parsed.kernel.name}}/share/man/man1/${cmd}.1.gz";
+      bin = "${getBin provider}/bin/${cmd}";
+      manpage = "${getOutput "man" provider}/share/man/man1/${cmd}.1.gz";
     in runCommand "${cmd}-${version}" {
-      meta.platforms = map (n: { kernel.name = n; }) (pkgs.lib.attrNames providers);
+      meta.platforms = map (n: { kernel.name = n; }) (attrNames providers);
+      passthru = { inherit provider; };
+      preferLocalBuild = true;
     } ''
-      if ! [ -x "${provider}" ]; then
+      if ! [ -x ${bin} ]; then
-        echo "Cannot find command ${cmd}"
+        echo Cannot find command ${cmd}
         exit 1
       fi
 
-      install -D "${provider}" "$out/bin/${cmd}"
+      mkdir -p $out/bin
+      ln -s ${bin} $out/bin/${cmd}
 
-      if [ -f "${manpage}" ]; then
+      if [ -f ${manpage} ]; then
-        install -D "${manpage}" $out/share/man/man1/${cmd}.1.gz
+        mkdir -p $out/share/man/man1
+        ln -s ${manpage} $out/share/man/man1/${cmd}.1.gz
       fi
     '';
 
   # more is unavailable in darwin
-  # just use less
+  # so we just use less
   more_compat = runCommand "more-${version}" {} ''
     mkdir -p $out/bin
     ln -s ${pkgs.less}/bin/less $out/bin/more
   '';
 
-  bins = lib.mapAttrs singleBinary {
+  bins = mapAttrs singleBinary {
     # singular binaries
     arp = {
       linux = pkgs.nettools;
@@ -53,12 +59,12 @@ let
       linux = pkgs.utillinux;
     };
     getconf = {
-      linux = if hostPlatform.libc == "glibc" then lib.getBin pkgs.glibc
+      linux = if hostPlatform.libc == "glibc" then pkgs.glibc
               else pkgs.netbsd.getconf;
       darwin = pkgs.darwin.system_cmds;
     };
     getent = {
-      linux = if hostPlatform.libc == "glibc" then lib.getBin pkgs.glibc
+      linux = if hostPlatform.libc == "glibc" then pkgs.glibc
               else pkgs.netbsd.getent;
       darwin = pkgs.netbsd.getent;
     };
@@ -148,6 +154,13 @@ let
     wall = {
       linux = pkgs.utillinux;
     };
+    watch = {
+      linux = pkgs.procps;
+
+      # watch is the only command from procps that builds currently on
+      # Darwin. Unfortunately no other implementations exist currently!
+      darwin = pkgs.callPackage ../os-specific/linux/procps-ng {};
+    };
     write = {
       linux = pkgs.utillinux;
       darwin = pkgs.darwin.basic_cmds;
@@ -158,15 +171,16 @@ let
     };
   };
 
-  makeCompat = name': value: buildEnv {
+  makeCompat = pname: paths:
-    name = name' + "-compat-${version}";
+    buildEnv {
-    paths = value;
+      name = "${pname}-${version}";
-  };
+      inherit paths;
+    };
 
   # Compatibility derivations
   # Provided for old usage of these commands.
   compat = with bins; lib.mapAttrs makeCompat {
-    procps = [ ps sysctl top ];
+    procps = [ ps sysctl top watch ];
     utillinux = [ fsck fdisk getopt hexdump mount
                   script umount whereis write col ];
     nettools = [ arp hostname ifconfig netstat route ];