Merge remote-tracking branch 'upstream/master' into staging

Conflicts:
	pkgs/applications/networking/browsers/vivaldi/default.nix
	pkgs/misc/emulators/wine/base.nix

lib/maintainers.nix

@@ -143,6 +143,7 @@
   garrison = "Jim Garrison <jim@garrison.cc>";
   gavin = "Gavin Rogers <gavin@praxeology.co.uk>";
   gebner = "Gabriel Ebner <gebner@gebner.org>";
+  gilligan = "Tobias Pflug <tobias.pflug@gmail.com>";
   giogadi = "Luis G. Torres <lgtorres42@gmail.com>";
   gleber = "Gleb Peregud <gleber.p@gmail.com>";
   globin = "Robin Gloster <mail@glob.in>";
@@ -236,6 +237,7 @@
   mirdhyn = "Merlin Gaillard <mirdhyn@gmail.com>";
   modulistic = "Pablo Costa <modulistic@gmail.com>";
   mog = "Matthew O'Gorman <mog-lists@rldn.net>";
+  moosingin3space = "Nathan Moos <moosingin3space@gmail.com>";
   moretea = "Maarten Hoogendoorn <maarten@moretea.nl>";
   mornfall = "Petr Ročkai <me@mornfall.net>";
   MostAwesomeDude = "Corbin Simpson <cds@corbinsimpson.com>";
@@ -292,6 +294,7 @@
   pxc = "Patrick Callahan <patrick.callahan@latitudeengineering.com>";
   qknight = "Joachim Schiele <js@lastlog.de>";
   ragge = "Ragnar Dahlen <r.dahlen@gmail.com>";
+  rardiol = "Ricardo Ardissone <ricardo.ardissone@gmail.com>";
   rasendubi = "Alexey Shmalko <rasen.dubi@gmail.com>";
   raskin = "Michael Raskin <7c6f434c@mail.ru>";
   redbaron = "Maxim Ivanov <ivanov.maxim@gmail.com>";
@@ -315,6 +318,7 @@
   ryanartecona = "Ryan Artecona <ryanartecona@gmail.com>";
   ryantm = "Ryan Mulligan <ryan@ryantm.com>";
   rycee = "Robert Helgesson <robert@rycee.net>";
+  ryneeverett = "Ryne Everett <ryneeverett@gmail.com>";
   samuelrivas = "Samuel Rivas <samuelrivas@gmail.com>";
   sander = "Sander van der Burg <s.vanderburg@tudelft.nl>";
   schmitthenner = "Fabian Schmitthenner <development@schmitthenner.eu>";

nixos/doc/manual/configuration/config-file.xml

@@ -106,11 +106,15 @@ networking.extraHosts =
   '';
 </programlisting>
 
-      The main difference is that preceding whitespace is
+      The main difference is that it strips from each line
-      automatically stripped from each line, and that characters like
+      a number of spaces equal to the minimal indentation of
+      the string as a whole (disregarding the indentation of
+      empty lines), and that characters like
       <literal>"</literal> and <literal>\</literal> are not special
       (making it more convenient for including things like shell
-      code).</para>
+      code).
+      See more info about this in the Nix manual <link
+      xlink:href="https://nixos.org/nix/manual/#ssec-values">here</link>.</para>
     </listitem>
   </varlistentry>
 

nixos/doc/manual/default.nix

@@ -74,6 +74,63 @@ let
       </toc>
     '';
 
+  manualXsltprocOptions = toString [
+    "--param section.autolabel 1"
+    "--param section.label.includes.component.label 1"
+    "--stringparam html.stylesheet style.css"
+    "--param xref.with.number.and.title 1"
+    "--param toc.section.depth 3"
+    "--stringparam admon.style ''"
+    "--stringparam callout.graphics.extension .gif"
+    "--stringparam current.docid manual"
+    "--param chunk.section.depth 0"
+    "--param chunk.first.sections 1"
+    "--param use.id.as.filename 1"
+    "--stringparam generate.toc 'book toc appendix toc'"
+    "--stringparam chunk.toc ${toc}"
+  ];
+
+  olinkDB = stdenv.mkDerivation {
+    name = "manual-olinkdb";
+
+    inherit sources;
+
+    buildInputs = [ libxml2 libxslt ];
+
+    buildCommand = ''
+      ${copySources}
+
+      xsltproc \
+        ${manualXsltprocOptions} \
+        --stringparam collect.xref.targets only \
+        --stringparam targets.filename "$out/manual.db" \
+        --nonet --xinclude \
+        ${docbook5_xsl}/xml/xsl/docbook/xhtml/chunktoc.xsl \
+        ./manual.xml
+
+      # Check the validity of the man pages sources.
+      xmllint --noout --nonet --xinclude --noxincludenode \
+        --relaxng ${docbook5}/xml/rng/docbook/docbook.rng \
+        ./man-pages.xml
+
+      cat > "$out/olinkdb.xml" <<EOF
+      <?xml version="1.0" encoding="utf-8"?>
+      <!DOCTYPE targetset SYSTEM
+        "file://${docbook5_xsl}/xml/xsl/docbook/common/targetdatabase.dtd" [
+        <!ENTITY manualtargets SYSTEM "file://$out/manual.db">
+      ]>
+      <targetset>
+        <targetsetinfo>
+            Allows for cross-referencing olinks between the manpages
+            and the HTML/PDF manuals.
+        </targetsetinfo>
+
+        <document targetdoc="manual">&manualtargets;</document>
+      </targetset>
+      EOF
+    '';
+  };
+
 in rec {
 
   # The NixOS options in JSON format.
@@ -116,18 +173,8 @@ in rec {
       dst=$out/share/doc/nixos
       mkdir -p $dst
       xsltproc \
-        --param section.autolabel 1 \
+        ${manualXsltprocOptions} \
-        --param section.label.includes.component.label 1 \
+        --stringparam target.database.document "${olinkDB}/olinkdb.xml" \
-        --stringparam html.stylesheet style.css \
-        --param xref.with.number.and.title 1 \
-        --param toc.section.depth 3 \
-        --stringparam admon.style "" \
-        --stringparam callout.graphics.extension .gif \
-        --param chunk.section.depth 0 \
-        --param chunk.first.sections 1 \
-        --param use.id.as.filename 1 \
-        --stringparam generate.toc "book toc appendix toc" \
-        --stringparam chunk.toc ${toc} \
         --nonet --xinclude --output $dst/ \
         ${docbook5_xsl}/xml/xsl/docbook/xhtml/chunktoc.xsl ./manual.xml
 
@@ -159,6 +206,7 @@ in rec {
       dst=$out/share/doc/nixos
       mkdir -p $dst
       xmllint --xinclude manual.xml | dblatex -o $dst/manual.pdf - \
+        -P target.database.document="${olinkDB}/olinkdb.xml" \
         -P doc.collab.show=0 \
         -P latex.output.revhistory=0
 
@@ -178,7 +226,7 @@ in rec {
     buildCommand = ''
       ${copySources}
 
-      # Check the validity of the manual sources.
+      # Check the validity of the man pages sources.
       xmllint --noout --nonet --xinclude --noxincludenode \
         --relaxng ${docbook5}/xml/rng/docbook/docbook.rng \
         ./man-pages.xml
@@ -190,6 +238,7 @@ in rec {
         --param man.output.base.dir "'$out/share/man/'" \
         --param man.endnotes.are.numbered 0 \
         --param man.break.after.slash 1 \
+        --stringparam target.database.document "${olinkDB}/olinkdb.xml" \
         ${docbook5_xsl}/xml/xsl/docbook/manpages/docbook.xsl \
         ./man-pages.xml
     '';

nixos/doc/manual/installation/installing-pxe.xml

@@ -0,0 +1,48 @@
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-booting-from-pxe">
+
+<title>Booting from the <quote>netboot</quote> media (PXE)</title>
+<para>
+  Advanced users may wish to install NixOS using an existing PXE or
+  iPXE setup.
+</para>
+<para>
+  These instructions assume that you have an existing PXE or iPXE
+  infrastructure and simply want to add the NixOS installer as another
+  option. To build the necessary files from a recent version of
+  nixpkgs, you can run:
+</para>
+<programlisting>
+nix-build -A netboot nixos/release.nix
+</programlisting>
+<para>
+  This will create a <literal>result</literal> directory containing: *
+  <literal>bzImage</literal> – the Linux kernel *
+  <literal>initrd</literal> – the initrd file *
+  <literal>netboot.ipxe</literal> – an example ipxe script
+  demonstrating the appropriate kernel command line arguments for this
+  image
+</para>
+<para>
+  If you’re using plain PXE, configure your boot loader to use the
+  <literal>bzImage</literal> and <literal>initrd</literal> files and
+  have it provide the same kernel command line arguments found in
+  <literal>netboot.ipxe</literal>.
+</para>
+<para>
+  If you’re using iPXE, depending on how your HTTP/FTP/etc. server is
+  configured you may be able to use <literal>netboot.ipxe</literal>
+  unmodified, or you may need to update the paths to the files to
+  match your server’s directory layout
+</para>
+<para>
+  In the future we may begin making these files available as build
+  products from hydra at which point we will update this documentation
+  with instructions on how to obtain them either for placing on a
+  dedicated TFTP server or to boot them directly over the internet.
+</para>
+
+</section>

nixos/doc/manual/installation/installing.xml

@@ -270,5 +270,6 @@ $ reboot</screen>
 
 <xi:include href="installing-uefi.xml" />
 <xi:include href="installing-usb.xml" />
+<xi:include href="installing-pxe.xml" />
 
 </chapter>

nixos/doc/manual/release-notes/release-notes.xml

@@ -9,6 +9,7 @@
 <para>This section lists the release notes for each stable version of NixOS
 and current unstable revision.</para>
 
+<xi:include href="rl-1609.xml" />
 <xi:include href="rl-1603.xml" />
 <xi:include href="rl-1509.xml" />
 <xi:include href="rl-1412.xml" />

nixos/doc/manual/release-notes/rl-1609.xml

@@ -0,0 +1,48 @@
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-release-16.09">
+
+<title>Release 16.09 (“Flounder”, 2016/09/??)</title>
+
+<para>In addition to numerous new and upgraded packages, this release
+has the following highlights: </para>
+
+<itemizedlist>
+
+  <listitem>
+    <para>PXE "netboot" media has landed in <link xlink:href="https://github.com/NixOS/nixpkgs/pull/14740" />.
+    See <xref linkend="sec-booting-from-pxe" /> for documentation.</para>
+  </listitem>
+
+</itemizedlist>
+
+<para>The following new services were added since the last release:</para>
+
+  <itemizedlist>
+    <listitem><para><literal>(this will get automatically generated at release time)</literal></para></listitem>
+  </itemizedlist>
+
+
+<para>When upgrading from a previous release, please be aware of the
+following incompatible changes:</para>
+
+<itemizedlist>
+  <listitem>
+    <para>todo</para>
+  </listitem>
+</itemizedlist>
+
+
+<para>Other notable improvements:</para>
+
+<itemizedlist>
+  <listitem>
+    <para>todo</para>
+  </listitem>
+
+</itemizedlist>
+
+
+</section>

nixos/modules/installer/netboot/netboot-base.nix

@@ -0,0 +1,20 @@
+# This module contains the basic configuration for building netboot
+# images
+
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+{
+  imports =
+    [ ./netboot.nix
+
+      # Profiles of this basic netboot media
+      ../../profiles/all-hardware.nix
+      ../../profiles/base.nix
+      ../../profiles/installation-device.nix
+    ];
+
+  # Allow the user to log in as root without a password.
+  users.extraUsers.root.initialHashedPassword = "";
+}

nixos/modules/installer/netboot/netboot-minimal.nix

@@ -0,0 +1,10 @@
+# This module defines a small netboot environment.
+
+{ config, lib, ... }:
+
+{
+  imports =
+    [ ./netboot-base.nix
+      ../../profiles/minimal.nix
+    ];
+}

nixos/modules/installer/netboot/netboot.nix

@@ -0,0 +1,91 @@
+# This module creates netboot media containing the given NixOS
+# configuration.
+
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+{
+  options = {
+
+    netboot.storeContents = mkOption {
+      example = literalExample "[ pkgs.stdenv ]";
+      description = ''
+        This option lists additional derivations to be included in the
+        Nix store in the generated netboot image.
+      '';
+    };
+
+  };
+
+  config = {
+
+    boot.loader.grub.version = 2;
+
+    # Don't build the GRUB menu builder script, since we don't need it
+    # here and it causes a cyclic dependency.
+    boot.loader.grub.enable = false;
+
+    boot.initrd.postMountCommands = ''
+      mkdir -p /mnt-root/nix/store
+      mount -t squashfs /nix-store.squashfs /mnt-root/nix/store
+    '';
+
+    # !!! Hack - attributes expected by other modules.
+    system.boot.loader.kernelFile = "bzImage";
+    environment.systemPackages = [ pkgs.grub2 pkgs.grub2_efi pkgs.syslinux ];
+
+    boot.consoleLogLevel = mkDefault 7;
+
+    fileSystems."/" =
+      { fsType = "tmpfs";
+        options = [ "mode=0755" ];
+      };
+
+    boot.initrd.availableKernelModules = [ "squashfs" ];
+
+    boot.initrd.kernelModules = [ "loop" ];
+
+    # Closures to be copied to the Nix store, namely the init
+    # script and the top-level system configuration directory.
+   netboot.storeContents =
+      [ config.system.build.toplevel ];
+
+    # Create the squashfs image that contains the Nix store.
+    system.build.squashfsStore = import ../../../lib/make-squashfs.nix {
+      inherit (pkgs) stdenv squashfsTools perl pathsFromGraph;
+      storeContents = config.netboot.storeContents;
+    };
+
+
+    # Create the initrd
+    system.build.netbootRamdisk = pkgs.makeInitrd {
+      inherit (config.boot.initrd) compressor;
+      prepend = [ "${config.system.build.initialRamdisk}/initrd" ];
+
+      contents =
+        [ { object = config.system.build.squashfsStore;
+            symlink = "/nix-store.squashfs";
+          }
+        ];
+    };
+
+    system.build.netbootIpxeScript = pkgs.writeTextDir "netboot.ipxe" "#!ipxe\nkernel bzImage init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams}\ninitrd initrd\nboot";
+
+    boot.loader.timeout = 10;
+
+    boot.postBootCommands =
+      ''
+        # After booting, register the contents of the Nix store
+        # in the Nix database in the tmpfs.
+        ${config.nix.package}/bin/nix-store --load-db < /nix/store/nix-path-registration
+
+        # nixos-rebuild also requires a "system" profile and an
+        # /etc/NIXOS tag.
+        touch /etc/NIXOS
+        ${config.nix.package}/bin/nix-env -p /nix/var/nix/profiles/system --set /run/current-system
+      '';
+
+  };
+
+}

nixos/modules/misc/ids.nix

@@ -264,6 +264,7 @@
       taskd = 240;
       factorio = 241;
       emby = 242;
+      graylog = 243;
 
       # When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!
 

nixos/modules/module-list.nix

@@ -183,6 +183,7 @@
   ./services/hardware/thermald.nix
   ./services/logging/awstats.nix
   ./services/logging/fluentd.nix
+  ./services/logging/graylog.nix
   ./services/logging/klogd.nix
   ./services/logging/logcheck.nix
   ./services/logging/logrotate.nix

nixos/modules/security/grsecurity.nix

@@ -234,7 +234,8 @@ in
 
     systemd.services.grsec-lock = mkIf cfg.config.sysctl {
       description     = "grsecurity sysctl-lock Service";
-      requires        = [ "systemd-sysctl.service" ];
+      wants           = [ "systemd-sysctl.service" ];
+      after           = [ "systemd-sysctl.service" ];
       wantedBy        = [ "multi-user.target" ];
       serviceConfig.Type = "oneshot";
       serviceConfig.RemainAfterExit = "yes";

nixos/modules/services/hardware/sane_extra_backends/brscan4.nix

@@ -0,0 +1,116 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.hardware.sane.brscan4;
+
+  netDeviceList = attrValues cfg.netDevices;
+
+  etcFiles = pkgs.callPackage ./brscan4_etc_files.nix { netDevices = netDeviceList; };
+
+  netDeviceOpts = { name, config, ... }: {
+
+    options = {
+
+      name = mkOption {
+        type = types.str;
+        description = ''
+          The friendly name you give to the network device. If undefined,
+          the name of attribute will be used.
+        '';
+
+        example = literalExample "office1";
+      };
+
+      model = mkOption {
+        type = types.str;
+        description = ''
+          The model of the network device.
+        '';
+
+        example = literalExample "MFC-7860DW";
+      };
+
+      ip = mkOption {
+        type = with types; nullOr str;
+        default = null;
+        description = ''
+          The ip address of the device. If undefined, you will have to
+          provide a nodename.
+        '';
+
+        example = literalExample "192.168.1.2";
+      };
+
+      nodename = mkOption {
+        type = with types; nullOr str;
+        default = null;
+        description = ''
+          The node name of the device. If undefined, you will have to
+          provide an ip.
+        '';
+
+        example = literalExample "BRW0080927AFBCE";
+      };
+
+    };
+
+
+    config =
+      { name = mkDefault name;
+      };
+  };
+
+in
+
+{
+  options = {
+
+    hardware.sane.brscan4.enable = 
+      mkEnableOption "Brother's brscan4 scan backend" // {
+      description = ''
+        When enabled, will automatically register the "brscan4" sane
+        backend and bring configuration files to their expected location. 
+      '';
+    };
+
+    hardware.sane.brscan4.netDevices = mkOption {
+      default = {};
+      example =
+        { office1 = { model = "MFC-7860DW"; ip = "192.168.1.2"; };
+          office2 = { model = "MFC-7860DW"; nodename = "BRW0080927AFBCE"; };
+        };
+      type = types.loaOf types.optionSet;
+      description = ''
+        The list of network devices that will be registered against the brscan4
+        sane backend.
+      '';
+      options = [ netDeviceOpts ];
+    };
+  };
+
+  config = mkIf (config.hardware.sane.enable && cfg.enable) {
+
+    hardware.sane.extraBackends = [
+      pkgs.brscan4
+    ];
+
+    environment.etc = singleton {
+      target = "opt/brother/scanner/brscan4";
+      source = "${etcFiles}/etc/opt/brother/scanner/brscan4";
+    };
+
+    assertions = [
+      { assertion = all (x: !(null != x.ip && null != x.nodename)) netDeviceList;
+          
+        message = ''
+          When describing a network device as part of the attribute list
+          `hardware.sane.brscan4.netDevices`, only one of its `ip` or `nodename`
+          attribute should be specified, not both!
+        '';
+      }
+    ];
+
+  };
+}

nixos/modules/services/hardware/sane_extra_backends/brscan4_etc_files.nix

@@ -0,0 +1,71 @@
+{ stdenv, lib, brscan4, netDevices ? [] }:
+
+/*
+
+Testing
+-------
+
+No net devices:
+
+~~~
+nix-shell -E 'with import <nixpkgs> { }; brscan4-etc-files'
+~~~
+
+Two net devices:
+
+~~~
+nix-shell -E 'with import <nixpkgs> { }; brscan4-etc-files.override{netDevices=[{name="a"; model="MFC-7860DW"; nodename="BRW0080927AFBCE";} {name="b"; model="MFC-7860DW"; ip="192.168.1.2";}];}'
+~~~
+
+*/
+
+with lib; 
+
+let
+
+  addNetDev = nd: ''
+    brsaneconfig4 -a \
+    name="${nd.name}" \
+    model="${nd.model}" \
+    ${if (hasAttr "nodename" nd && nd.nodename != null) then
+      ''nodename="${nd.nodename}"'' else
+      ''ip="${nd.ip}"''}'';
+  addAllNetDev = xs: concatStringsSep "\n" (map addNetDev xs);
+in
+
+stdenv.mkDerivation rec {
+
+  name = "brscan4-etc-files-0.4.3-3";
+  src = "${brscan4}/opt/brother/scanner/brscan4";
+
+  nativeBuildInputs = [ brscan4 ];
+
+  configurePhase = ":";
+
+  buildPhase = ''
+    TARGET_DIR="$out/etc/opt/brother/scanner/brscan4"
+    mkdir -p "$TARGET_DIR"
+    cp -rp "./models4" "$TARGET_DIR"
+    cp -rp "./Brsane4.ini" "$TARGET_DIR"
+    cp -rp "./brsanenetdevice4.cfg" "$TARGET_DIR"
+
+    export BRSANENETDEVICE4_CFG_FILENAME="$TARGET_DIR/brsanenetdevice4.cfg"
+
+    printf '${addAllNetDev netDevices}\n'
+
+    ${addAllNetDev netDevices}
+  '';
+
+  installPhase = ":";
+
+  dontStrip = true;
+  dontPatchELF = true;
+
+  meta = {
+    description = "Brother brscan4 sane backend driver etc files";
+    homepage = http://www.brother.com;
+    platforms = stdenv.lib.platforms.linux;
+    license = stdenv.lib.licenses.unfree;
+    maintainers = with stdenv.lib.maintainers; [ jraygauthier ];
+  };
+}

nixos/modules/services/logging/graylog.nix

@@ -0,0 +1,161 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.graylog;
+  configBool = b: if b then "true" else "false";
+
+  confFile = pkgs.writeText "graylog.conf" ''
+    is_master = ${configBool cfg.isMaster}
+    node_id_file = ${cfg.nodeIdFile}
+    password_secret = ${cfg.passwordSecret}
+    root_username = ${cfg.rootUsername}
+    root_password_sha2 = ${cfg.rootPasswordSha2}
+    elasticsearch_cluster_name = ${cfg.elasticsearchClusterName}
+    elasticsearch_discovery_zen_ping_multicast_enabled = ${configBool cfg.elasticsearchDiscoveryZenPingMulticastEnabled}
+    elasticsearch_discovery_zen_ping_unicast_hosts = ${cfg.elasticsearchDiscoveryZenPingUnicastHosts}
+    message_journal_dir = ${cfg.messageJournalDir}
+    mongodb_uri = ${cfg.mongodbUri}
+
+    ${cfg.extraConfig}
+  '';
+in
+
+{
+  ###### interface
+
+  options = {
+
+    services.graylog = {
+
+      enable = mkEnableOption "Graylog";
+
+      package = mkOption {
+        type = types.package;
+        default = pkgs.graylog;
+        defaultText = "pkgs.graylog";
+        example = literalExample "pkgs.graylog";
+        description = "Graylog package to use.";
+      };
+
+      user = mkOption {
+        type = types.str;
+        default = "graylog";
+        example = literalExample "graylog";
+        description = "User account under which graylog runs";
+      };
+
+      isMaster = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Whether this is the master instance of your Graylog cluster";
+      };
+
+      nodeIdFile = mkOption {
+        type = types.str;
+        default = "/var/lib/graylog/server/node-id";
+        description = "Path of the file containing the graylog node-id";
+      };
+
+      passwordSecret = mkOption {
+        type = types.str;
+        description = ''
+          You MUST set a secret to secure/pepper the stored user passwords here. Use at least 64 characters.
+          Generate one by using for example: pwgen -N 1 -s 96
+        '';
+      };
+
+      rootUsername = mkOption {
+        type = types.str;
+        default = "admin";
+        description = "Name of the default administrator user";
+      };
+
+      rootPasswordSha2 = mkOption {
+        type = types.str;
+        example = "e3c652f0ba0b4801205814f8b6bc49672c4c74e25b497770bb89b22cdeb4e952";
+        description = ''
+          You MUST specify a hash password for the root user (which you only need to initially set up the
+          system and in case you lose connectivity to your authentication backend)
+          This password cannot be changed using the API or via the web interface. If you need to change it,
+          modify it here.
+          Create one by using for example: echo -n yourpassword | shasum -a 256
+          and use the resulting hash value as string for the option
+        '';
+      };
+
+      elasticsearchClusterName = mkOption {
+        type = types.str;
+        example = "graylog";
+        description = "This must be the same as for your Elasticsearch cluster";
+      };
+
+      elasticsearchDiscoveryZenPingMulticastEnabled = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Whether to use elasticsearch multicast discovery";
+      };
+
+      elasticsearchDiscoveryZenPingUnicastHosts = mkOption {
+        type = types.str;
+        default = "127.0.0.1:9300";
+        description = "Tells Graylogs Elasticsearch client how to find other cluster members. See Elasticsearch documentation for details";
+      };
+
+      messageJournalDir = mkOption {
+        type = types.str;
+        default = "/var/lib/graylog/data/journal";
+        description = "The directory which will be used to store the message journal. The directory must be exclusively used by Graylog and must not contain any other files than the ones created by Graylog itself";
+      };
+
+      mongodbUri = mkOption {
+        type = types.str;
+        default = "mongodb://localhost/graylog";
+        description = "MongoDB connection string. See http://docs.mongodb.org/manual/reference/connection-string/ for details";
+      };
+
+      extraConfig = mkOption {
+        type = types.str;
+        default = "";
+        description = "Any other configuration options you might want to add";
+      };
+
+    };
+  };
+
+
+  ###### implementation
+
+  config = mkIf cfg.enable {
+
+    users.extraUsers = mkIf (cfg.user == "graylog") {
+      graylog = {
+        uid = config.ids.uids.graylog;
+        description = "Graylog server daemon user";
+      };
+    };
+
+    systemd.services.graylog = with pkgs; {
+      description = "Graylog Server";
+      wantedBy = [ "multi-user.target" ];
+      environment = {
+        JAVA_HOME = jre;
+        GRAYLOG_CONF = "${confFile}";
+      };
+      path = [ pkgs.openjdk8 pkgs.which pkgs.procps ];
+      preStart = ''
+        mkdir -p /var/lib/graylog -m 755
+        chown -R ${cfg.user} /var/lib/graylog
+
+        mkdir -p ${cfg.messageJournalDir} -m 755
+        chown -R ${cfg.user} ${cfg.messageJournalDir}
+      '';
+      serviceConfig = {
+        User="${cfg.user}";
+        PermissionsStartOnly=true;
+        ExecStart = "${cfg.package}/bin/graylogctl run";
+      };
+    };
+  };
+}

nixos/modules/services/mail/rmilter.nix

@@ -7,9 +7,14 @@ let
   rspamdCfg = config.services.rspamd;
   cfg = config.services.rmilter;
 
+  inetSockets = map (sock: let s = stringSplit ":" sock; in "inet:${last s}:${head s}") cfg.bindInetSockets;
+  unixSockets = map (sock: "unix:${sock}") cfg.bindUnixSockets;
+
+  allSockets = unixSockets ++ inetSockets;
+
   rmilterConf = ''
 pidfile = /run/rmilter/rmilter.pid;
-bind_socket = ${cfg.bindSocket};
+bind_socket = ${if cfg.socketActivation then "fd:3" else concatStringsSep ", " allSockets};
 tempdir = /tmp;
 
   '' + (with cfg.rspamd; if enable then ''
@@ -68,14 +73,37 @@ in
         '';
        };
 
-      bindSocket =  mkOption {
+      bindUnixSockets =  mkOption {
-        type = types.string;
+        type = types.listOf types.str;
-        default = "unix:/run/rmilter/rmilter.sock";
+        default = ["/run/rmilter.sock"];
-        description = "Socket to listed for MTA requests";
+        description = ''
+          Unix domain sockets to listen for MTA requests.
+        '';
         example = ''
-            "unix:/run/rmilter/rmilter.sock" or
+            [ "/run/rmilter.sock"]
-            "inet:11990@127.0.0.1"
+        '';
-          '';
+      };
+
+      bindInetSockets = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        description = ''
+          Inet addresses to listen (in format accepted by systemd.socket)
+        '';
+        example = ''
+            ["127.0.0.1:11990"]
+        '';
+      };
+
+      socketActivation = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Enable systemd socket activation for rmilter.
+          (disabling socket activation not recommended
+          when unix socket used, and follow to wrong
+          permissions on unix domain socket.)
+        '';
       };
 
       rspamd = {
@@ -86,7 +114,7 @@ in
 
         servers = mkOption {
           type = types.listOf types.str;
-          default = ["r:0.0.0.0:11333"];
+          default = ["r:/run/rspamd.sock"];
           description = ''
             Spamd socket definitions.
             Is server name is prefixed with r: it is rspamd server.
@@ -129,7 +157,7 @@ in
           type = types.str;
           description = "Addon to postfix configuration";
           default = ''
-smtpd_milters = ${cfg.bindSocket}
+smtpd_milters = ${head allSockets}
 # or for TCP socket
 # # smtpd_milters = inet:localhost:9900
 milter_protocol = 6
@@ -169,21 +197,30 @@ milter_default_action = accept
 
       serviceConfig = {
         ExecStart = "${pkgs.rmilter}/bin/rmilter ${optionalString cfg.debug "-d"} -n -c ${rmilterConfigFile}";
+        ExecReload = "/bin/kill -USR1 $MAINPID";
         User = cfg.user;
         Group = cfg.group;
         PermissionsStartOnly = true;
         Restart = "always";
+        RuntimeDirectory = "rmilter";
+        RuntimeDirectoryPermissions="0755";
       };
 
-      preStart = ''
-        ${pkgs.coreutils}/bin/mkdir -p /run/rmilter
-        ${pkgs.coreutils}/bin/chown ${cfg.user}:${cfg.group} /run/rmilter
-      '';
-
     };
 
-    services.postfix.extraConfig = optionalString cfg.postfix.enable cfg.postfix.configFragment;
+    systemd.sockets.rmilter = mkIf cfg.socketActivation {
+      description = "Rmilter service socket";
+      wantedBy = [ "sockets.target" ];
+      socketConfig = {
+          ListenStream = cfg.bindUnixSockets ++ cfg.bindInetSockets;
+          SocketUser = cfg.user;
+          SocketGroup = cfg.group;
+          SocketMode = "0660";
+      };
+    };
 
+    services.postfix.extraConfig = optionalString cfg.postfix.enable cfg.postfix.configFragment;
+    users.users.postfix.extraGroups = [ cfg.group ];
   };
 
 }

nixos/modules/services/mail/rspamd.nix

@@ -6,6 +6,35 @@ let
 
   cfg = config.services.rspamd;
 
+  mkBindSockets = socks: concatStringsSep "\n" (map (each: "  bind_socket = \"${each}\"") socks);
+
+  rspamdConf =
+    ''
+      .include "$CONFDIR/common.conf"
+
+      options {
+        pidfile = "$RUNDIR/rspamd.pid";
+        .include "$CONFDIR/options.inc"
+      }
+
+      logging {
+        type = "file";
+        filename = "$LOGDIR/rspamd.log";
+        .include "$CONFDIR/logging.inc"
+      }
+
+      worker {
+      ${mkBindSockets cfg.bindSocket}
+        .include "$CONFDIR/worker-normal.inc"
+      }
+
+      worker {
+      ${mkBindSockets cfg.bindUISocket}
+        .include "$CONFDIR/worker-controller.inc"
+      }
+   '';
+   rspamdConfFile = pkgs.writeText "rspamd.conf" rspamdConf;
+
 in
 
 {
@@ -26,6 +55,32 @@ in
         description = "Whether to run the rspamd daemon in debug mode.";
       };
 
+      bindSocket = mkOption {
+        type = types.listOf types.str;
+        default = [
+          "/run/rspamd.sock mode=0666 owner=${cfg.user}"
+        ];
+        description = ''
+          List of sockets to listen, in format acceptable by rspamd
+        '';
+        example = ''
+          bindSocket = [
+            "/run/rspamd.sock mode=0666 owner=rspamd"
+            "*:11333"
+          ];
+        '';
+      };
+
+      bindUISocket = mkOption {
+        type = types.listOf types.str;
+        default = [
+          "localhost:11334"
+        ];
+        description = ''
+          List of sockets for web interface, in format acceptable by rspamd
+        '';
+      };
+
       user = mkOption {
         type = types.string;
         default = "rspamd";
@@ -62,7 +117,7 @@ in
 
     users.extraGroups = singleton {
       name = cfg.group;
-      gid = config.ids.gids.spamd;
+      gid = config.ids.gids.rspamd;
     };
 
     systemd.services.rspamd = {
@@ -72,7 +127,7 @@ in
       after = [ "network.target" ];
 
       serviceConfig = {
-        ExecStart = "${pkgs.rspamd}/bin/rspamd ${optionalString cfg.debug "-d"} --user=${cfg.user} --group=${cfg.group} --pid=/run/rspamd.pid -f";
+        ExecStart = "${pkgs.rspamd}/bin/rspamd ${optionalString cfg.debug "-d"} --user=${cfg.user} --group=${cfg.group} --pid=/run/rspamd.pid -c ${rspamdConfFile} -f";
         RuntimeDirectory = "/var/lib/rspamd";
         PermissionsStartOnly = true;
         Restart = "always";

nixos/modules/services/misc/taskserver/default.nix

@@ -449,7 +449,7 @@ in {
         };
       };
     })
-    (mkIf needToCreateCA {
+    (mkIf (cfg.enable && needToCreateCA) {
       systemd.services.taskserver-ca = {
         wantedBy = [ "taskserver.service" ];
         after = [ "taskserver-init.service" ];
@@ -533,7 +533,7 @@ in {
         '';
       };
     })
-    (mkIf (cfg.listenHost != "localhost") {
+    (mkIf (cfg.enable && cfg.listenHost != "localhost") {
       networking.firewall.allowedTCPPorts = [ cfg.listenPort ];
     })
     { meta.doc = ./taskserver.xml; }

nixos/modules/services/networking/copy-com.nix

@@ -1,54 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-
-  cfg = config.services.copy-com;
-
-in
-
-{
-  options = {
-
-    services.copy-com = {
-
-	  enable = mkOption {
-          default = false;
-          description = "
-            Enable the Copy.com client.
-            NOTE: before enabling the client for the first time, it must be
-            configured by first running CopyConsole (command line) or CopyAgent
-            (graphical) as the appropriate user.
-          ";
-      };
-
-      user = mkOption {
-        description = "The user for which the Copy.com client should be run.";
-      };
-
-      debug = mkOption {
-        default = false;
-        description = "Output more (debugging) messages to the console.";
-      };
-	  };
-  };
-
-  config = mkIf cfg.enable {
-    environment.systemPackages = [ pkgs.postfix ];
-
-    systemd.services."copy-com-${cfg.user}" = {
-      description = "Copy.com client";
-      wants = [ "network-online.target" ];
-      after = [ "network-online.target" "local-fs.target" ];
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        ExecStart = "${pkgs.copy-com}/bin/CopyConsole ${if cfg.debug then "-consoleOutput -debugToConsole=dirwatch,path-watch,csm_path,csm -debug -console" else ""}";
-        User = "${cfg.user}";
-      };
-
-    };
-  };
-
-}
-

nixos/modules/services/search/elasticsearch.nix

@@ -145,6 +145,7 @@ in {
         # Install plugins
         ln -sfT ${esPlugins}/plugins ${cfg.dataDir}/plugins
         ln -sfT ${cfg.package}/lib ${cfg.dataDir}/lib
+        ln -sfT ${cfg.package}/modules ${cfg.dataDir}/modules
         if [ "$(id -u)" = 0 ]; then chown -R elasticsearch ${cfg.dataDir}; fi
       '';
       postStart = mkBefore ''

nixos/modules/services/security/fail2ban.nix

@@ -99,34 +99,32 @@ in
 
         wantedBy = [ "multi-user.target" ];
         after = [ "network.target" ];
+        partOf = optional config.networking.firewall.enable "firewall.service";
 
         restartTriggers = [ fail2banConf jailConf ];
         path = [ pkgs.fail2ban pkgs.iptables ];
 
         preStart =
           ''
-            mkdir -p /run/fail2ban -m 0755
             mkdir -p /var/lib/fail2ban
           '';
 
+        unitConfig.Documentation = "man:fail2ban(1)";
+
         serviceConfig =
-          { ExecStart = "${pkgs.fail2ban}/bin/fail2ban-server -f";
+          { Type = "forking";
+            ExecStart = "${pkgs.fail2ban}/bin/fail2ban-client -x start";
+            ExecStop = "${pkgs.fail2ban}/bin/fail2ban-client stop";
+            ExecReload = "${pkgs.fail2ban}/bin/fail2ban-client reload";
+            PIDFile = "/run/fail2ban/fail2ban.pid";
+            Restart = "always";
+
             ReadOnlyDirectories = "/";
-            ReadWriteDirectories = "/run /var/tmp /var/lib";
+            ReadWriteDirectories = "/run/fail2ban /var/tmp /var/lib";
+            PrivateTmp = "true";
+            RuntimeDirectory = "fail2ban";
             CapabilityBoundingSet = "CAP_DAC_READ_SEARCH CAP_NET_ADMIN CAP_NET_RAW";
           };
-
-        postStart =
-          ''
-            # Wait for the server to start listening.
-            for ((n = 0; n < 20; n++)); do
-              if fail2ban-client ping; then break; fi
-              sleep 0.5
-            done
-
-            # Reload its configuration.
-            fail2ban-client reload
-          '';
       };
 
     # Add some reasonable default jails.  The special "DEFAULT" jail

nixos/modules/services/x11/desktop-managers/gnome3.nix

@@ -165,6 +165,8 @@ in {
         '';
       };
 
+    services.xserver.updateDbusEnvironment = true;
+
     environment.variables.GIO_EXTRA_MODULES = [ "${gnome3.dconf}/lib/gio/modules"
                                                 "${gnome3.glib_networking.out}/lib/gio/modules"
                                                 "${gnome3.gvfs}/lib/gio/modules" ];

nixos/modules/services/x11/desktop-managers/xfce.nix

@@ -42,10 +42,13 @@ in
             # Set GTK_DATA_PREFIX so that GTK+ can find the Xfce themes.
             export GTK_DATA_PREFIX=${config.system.path}
 
-            exec ${pkgs.stdenv.shell} ${pkgs.xfce.xinitrc}
+            ${pkgs.stdenv.shell} ${pkgs.xfce.xinitrc} &
+            waitPID=$!
           '';
       };
 
+    services.xserver.updateDbusEnvironment = true;
+
     environment.systemPackages =
       [ pkgs.gtk # To get GTK+'s themes.
         pkgs.hicolor_icon_theme

nixos/modules/services/x11/display-managers/default.nix

@@ -126,6 +126,14 @@ let
         (*) echo "$0: Desktop manager '$desktopManager' not found.";;
       esac
 
+      ${optionalString (cfg.startDbusSession && cfg.updateDbusEnvironment) ''
+        ${pkgs.glib}/bin/gdbus call --session \
+          --dest org.freedesktop.DBus --object-path /org/freedesktop/DBus \
+          --method org.freedesktop.DBus.UpdateActivationEnvironment \
+          "{$(env | ${pkgs.gnused}/bin/sed "s/'/\\\\'/g; s/\([^=]*\)=\(.*\)/'\1':'\2'/" \
+                  | ${pkgs.coreutils}/bin/paste -sd,)}"
+      ''}
+
       test -n "$waitPID" && wait "$waitPID"
       exit 0
     '';

nixos/modules/services/x11/xserver.nix

@@ -233,6 +233,15 @@ in
         '';
       };
 
+      updateDbusEnvironment = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to update the DBus activation environment after launching the
+          desktop manager.
+        '';
+      };
+
       layout = mkOption {
         type = types.str;
         default = "us";

nixos/modules/virtualisation/ec2-amis.nix

@@ -90,40 +90,40 @@
   "15.09".us-west-2.pv-ebs = "ami-005fb160";
   "15.09".us-west-2.pv-s3 = "ami-cd55bbad";
 
-  "16.03".ap-northeast-1.hvm-ebs = "ami-885040e6";
+  "16.03".ap-northeast-1.hvm-ebs = "ami-b6edf5d8";
-  "16.03".ap-northeast-1.hvm-s3 = "ami-d15a4abf";
+  "16.03".ap-northeast-1.hvm-s3 = "ami-b1e3fbdf";
-  "16.03".ap-northeast-1.pv-ebs = "ami-7f455511";
+  "16.03".ap-northeast-1.pv-ebs = "ami-6190880f";
-  "16.03".ap-northeast-1.pv-s3 = "ami-6d7d6d03";
+  "16.03".ap-northeast-1.pv-s3 = "ami-908d95fe";
-  "16.03".ap-southeast-1.hvm-ebs = "ami-478a5f24";
+  "16.03".ap-southeast-1.hvm-ebs = "ami-35b16656";
-  "16.03".ap-southeast-1.hvm-s3 = "ami-b2885dd1";
+  "16.03".ap-southeast-1.hvm-s3 = "ami-41be6922";
-  "16.03".ap-southeast-1.pv-ebs = "ami-55b46136";
+  "16.03".ap-southeast-1.pv-ebs = "ami-4cb96e2f";
-  "16.03".ap-southeast-1.pv-s3 = "ami-92b762f1";
+  "16.03".ap-southeast-1.pv-s3 = "ami-3bb96e58";
-  "16.03".ap-southeast-2.hvm-ebs = "ami-26b09345";
+  "16.03".ap-southeast-2.hvm-ebs = "ami-debc91bd";
-  "16.03".ap-southeast-2.hvm-s3 = "ami-52ac8f31";
+  "16.03".ap-southeast-2.hvm-s3 = "ami-55bc9136";
-  "16.03".ap-southeast-2.pv-ebs = "ami-1fb3907c";
+  "16.03".ap-southeast-2.pv-ebs = "ami-b38ba6d0";
-  "16.03".ap-southeast-2.pv-s3 = "ami-49b1922a";
+  "16.03".ap-southeast-2.pv-s3 = "ami-9e8ba6fd";
-  "16.03".eu-central-1.hvm-ebs = "ami-2bd63744";
+  "16.03".eu-central-1.hvm-ebs = "ami-7c967413";
-  "16.03".eu-central-1.hvm-s3 = "ami-82d435ed";
+  "16.03".eu-central-1.hvm-s3 = "ami-b29072dd";
-  "16.03".eu-central-1.pv-ebs = "ami-b729c8d8";
+  "16.03".eu-central-1.pv-ebs = "ami-7a947615";
-  "16.03".eu-central-1.pv-s3 = "ami-a12dccce";
+  "16.03".eu-central-1.pv-s3 = "ami-729b791d";
-  "16.03".eu-west-1.hvm-ebs = "ami-87c242f4";
+  "16.03".eu-west-1.hvm-ebs = "ami-ff27a98c";
-  "16.03".eu-west-1.hvm-s3 = "ami-b6c343c5";
+  "16.03".eu-west-1.hvm-s3 = "ami-6c21af1f";
-  "16.03".eu-west-1.pv-ebs = "ami-6bc94918";
+  "16.03".eu-west-1.pv-ebs = "ami-a33cb2d0";
-  "16.03".eu-west-1.pv-s3 = "ami-00cb4b73";
+  "16.03".eu-west-1.pv-s3 = "ami-ec38b69f";
-  "16.03".sa-east-1.hvm-ebs = "ami-845cd3e8";
+  "16.03".sa-east-1.hvm-ebs = "ami-5bef6637";
-  "16.03".sa-east-1.hvm-s3 = "ami-8142cded";
+  "16.03".sa-east-1.hvm-s3 = "ami-55f87139";
-  "16.03".sa-east-1.pv-ebs = "ami-1643cc7a";
+  "16.03".sa-east-1.pv-ebs = "ami-76e56c1a";
-  "16.03".sa-east-1.pv-s3 = "ami-1646c97a";
+  "16.03".sa-east-1.pv-s3 = "ami-e1f8718d";
-  "16.03".us-east-1.hvm-ebs = "ami-2cc4d046";
+  "16.03".us-east-1.hvm-ebs = "ami-4bfd1926";
-  "16.03".us-east-1.hvm-s3 = "ami-9bc9ddf1";
+  "16.03".us-east-1.hvm-s3 = "ami-60c5210d";
-  "16.03".us-east-1.pv-ebs = "ami-7df4e017";
+  "16.03".us-east-1.pv-ebs = "ami-c0c92dad";
-  "16.03".us-east-1.pv-s3 = "ami-90f2e6fa";
+  "16.03".us-east-1.pv-s3 = "ami-f9d63294";
-  "16.03".us-west-1.hvm-ebs = "ami-d8116db8";
+  "16.03".us-west-1.hvm-ebs = "ami-13aad473";
-  "16.03".us-west-1.hvm-s3 = "ami-a7166ac7";
+  "16.03".us-west-1.hvm-s3 = "ami-e1a8d681";
-  "16.03".us-west-1.pv-ebs = "ami-e90c7089";
+  "16.03".us-west-1.pv-ebs = "ami-c0a6d8a0";
-  "16.03".us-west-1.pv-s3 = "ami-5b0c703b";
+  "16.03".us-west-1.pv-s3 = "ami-6aa9d70a";
-  "16.03".us-west-2.hvm-ebs = "ami-b339ccd3";
+  "16.03".us-west-2.hvm-ebs = "ami-265dad46";
-  "16.03".us-west-2.hvm-s3 = "ami-2c3bce4c";
+  "16.03".us-west-2.hvm-s3 = "ami-cd40b0ad";
-  "16.03".us-west-2.pv-ebs = "ami-0625d066";
+  "16.03".us-west-2.pv-ebs = "ami-7b4aba1b";
-  "16.03".us-west-2.pv-s3 = "ami-7414e114";
+  "16.03".us-west-2.pv-s3 = "ami-0849b968";
 }

nixos/release.nix

@@ -103,6 +103,19 @@ in rec {
   # Build the initial ramdisk so Hydra can keep track of its size over time.
   initialRamdisk = buildFromConfig ({ pkgs, ... }: { }) (config: config.system.build.initialRamdisk);
 
+  netboot.x86_64-linux = let build = (import lib/eval-config.nix {
+      system = "x86_64-linux";
+      modules = [
+        ./modules/installer/netboot/netboot-minimal.nix
+        versionModule
+      ];
+    }).config.system.build;
+  in
+    pkgs.symlinkJoin {name="netboot"; paths=[
+      build.netbootRamdisk
+      build.kernel
+      build.netbootIpxeScript
+    ];};
 
   iso_minimal = forAllSystems (system: makeIso {
     module = ./modules/installer/cd-dvd/installation-cd-minimal.nix;

nixos/tests/boot.nix

@@ -44,5 +44,44 @@ in {
         usb => glob("${iso}/iso/*.iso"),
         bios => '${pkgs.OVMF}/FV/OVMF.fd'
       '';
-  }
+    netboot = let
-
+      config = (import ../lib/eval-config.nix {
+          inherit system;
+          modules =
+            [ ../modules/installer/netboot/netboot.nix
+              ../modules/testing/test-instrumentation.nix
+              { key = "serial"; }
+            ];
+        }).config;
+      ipxeScriptDir = pkgs.writeTextFile {
+        name = "ipxeScriptDir";
+        text = ''
+          #!ipxe
+          dhcp
+          kernel bzImage init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams} console=ttyS0
+          initrd initrd
+          boot
+        '';
+        destination = "/boot.ipxe";
+      };
+      ipxeBootDir = pkgs.symlinkJoin {
+        name = "ipxeBootDir";
+        paths = [
+          config.system.build.netbootRamdisk
+          config.system.build.kernel
+          ipxeScriptDir
+        ];
+      };
+    in
+      makeTest {
+        name = "boot-netboot";
+        nodes = { };
+        testScript =
+          ''
+            my $machine = createMachine({ qemuFlags => '-boot order=n -net nic,model=e1000 -net user,tftp=${ipxeBootDir}/,bootfile=boot.ipxe -m 2000M' });
+            $machine->start;
+            $machine->waitForUnit("multi-user.target");
+            $machine->shutdown;
+          '';
+      };
+}

pkgs/applications/audio/MMA/default.nix

@@ -0,0 +1,68 @@
+{ stdenv, fetchurl, makeWrapper, python, alsaUtils, timidity }:
+
+  stdenv.mkDerivation rec {
+  version = "15.12";
+  name = "mma-${version}";
+
+  src = fetchurl {
+    url = "http://www.mellowood.ca/mma/mma-bin-${version}.tar.gz";
+    sha256 = "0k37kcrfaxmwjb8xb1cbqinrkx3g50dbvwqbvwl3l762j4vr8jgx";
+  };
+
+  buildInputs = [ makeWrapper python alsaUtils timidity ];
+
+  patchPhase = ''
+    sed -i 's@/usr/bin/aplaymidi@/${alsaUtils}/bin/aplaymidi@g' mma-splitrec
+    sed -i 's@/usr/bin/aplaymidi@/${alsaUtils}/bin/aplaymidi@g' util/mma-splitrec.py
+    sed -i 's@/usr/bin/arecord@/${alsaUtils}/bin/arecord@g' mma-splitrec
+    sed -i 's@/usr/bin/arecord@/${alsaUtils}/bin/arecord@g' util/mma-splitrec.py
+    sed -i 's@/usr/bin/timidity@/${timidity}/bin/timidity@g' mma-splitrec
+    sed -i 's@/usr/bin/timidity@/${timidity}/bin/timidity@g' util/mma-splitrec.py
+    find . -type f | xargs sed -i 's@/usr/bin/env python@${python}/bin/python@g'
+  '';
+
+  installPhase = ''
+    mkdir -p $out/{bin,share/mma,share/man/man1,share/man/man8}
+    mkdir -p $out/etc
+
+    cp mma.py $out/bin/mma
+    cp mma-gb $out/bin/mma-gb
+    cp mma-libdoc $out/bin/mma-libdoc
+    cp mma-renum $out/bin/mma-renum
+    cp mma-splitrec $out/bin/mma-splitrec
+    cp util/mma-mnx.py $out/bin/mma-mnx
+    cp util/mma-rm2std.py $out/bin/mma-rm2std
+    cp util/mmatabs.py $out/bin/mmatabs
+    cp util/mup2mma.py $out/bin/mup2mma
+    cp util/pg2mma.py $out/bin/pg2mma
+    cp util/synthsplit.py $out/bin/mma-synthsplit
+    cp -r {docs,egs,includes,lib,MMA,text} $out/share/mma
+    rmdir $out/share/mma/includes/aria
+
+    cp util/README.* $out/share/mma/docs
+    mv $out/share/mma/docs/man/mma-libdoc.8 $out/share/man/man8
+    mv $out/share/mma/docs/man/mma-renum.1 $out/share/man/man1
+    mv $out/share/mma/docs/man/mma.1 $out/share/man/man1
+    mv $out/share/mma/docs/man/mma-gb.1 $out/share/man/man1
+    rm -rf $out/share/mma/docs/man
+    find $out -type f | xargs sed -i "s@/usr/share/mma@$out/share/mma@g"
+  '';
+
+  preFixup = ''
+    PYTHONPATH=$out/share/mma/:$PYTHONPATH
+    for f in $out/bin/*; do
+          wrapProgram $f \
+           --prefix PYTHONPATH : $PYTHONPATH
+    done
+    cd $out/share/mma/
+    $out/bin/mma -G
+  '';
+
+  meta = {
+    description = "Creates MIDI tracks for a soloist to perform over from a user supplied file containing chords";
+    homepage =  http://www.mellowood.ca/mma/index.html;
+    license = stdenv.lib.licenses.gpl2;
+    maintainers = [ stdenv.lib.maintainers.magnetophon ];
+    platforms = stdenv.lib.platforms.linux;
+  };
+}

pkgs/applications/audio/abcde/default.nix

@@ -3,13 +3,13 @@
 , perl, DigestSHA, MusicBrainz, MusicBrainzDiscID
 , makeWrapper }:
 
-let version = "2.7";
+let version = "2.7.2";
 in
   stdenv.mkDerivation {
     name = "abcde-${version}";
     src = fetchurl {
       url = "http://abcde.einval.com/download/abcde-${version}.tar.gz";
-      sha256 = "0ikpffzvacadh6vj9qlary8126j1zrd2knp9gvivmp7y1656jj01";
+      sha256 = "1pakpi41k8yd780mfp0snhia6mmwjwxk9lcrq6gynimch8b8hfda";
     };
 
     # FIXME: This package does not support `distmp3', `eject', etc.
@@ -39,6 +39,8 @@ in
 
     buildInputs = [ makeWrapper ];
 
+    installFlags = [ "sysconfdir=$(out)/etc" ];
+
     postInstall = ''
     #   substituteInPlace "$out/bin/cddb-tool" \
     #      --replace '#!/bin/sh' '#!${bash}/bin/sh'

pkgs/applications/audio/deadbeef/default.nix

@@ -53,11 +53,11 @@ assert remoteSupport -> curl != null;
 
 stdenv.mkDerivation rec {
   name = "deadbeef-${version}";
-  version = "0.7.0";
+  version = "0.7.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/project/deadbeef/${name}.tar.bz2";
-    sha256 = "0s6qip1zs83pig75pnd30ayiv1dbbj7s72px9mr31f4m0v86kaqx";
+    sha256 = "0rwdxxn7h94vlgblbkswyvj6pm82488v8x5nrmlrcsbzjjf2pccw";
   };
 
   buildInputs = with stdenv.lib; [ jansson ]
@@ -96,10 +96,10 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Ultimate Music Player for GNU/Linux";
-    homepage = http://deadbeef.sourceforge.net/;
+    homepage = "http://deadbeef.sourceforge.net/";
     license = licenses.gpl2;
     platforms = platforms.linux;
     maintainers = [ maintainers.abbradar ];
-    repositories.git = https://github.com/Alexey-Yakovenko/deadbeef;
+    repositories.git = "https://github.com/Alexey-Yakovenko/deadbeef";
   };
 }

pkgs/applications/audio/linuxband/default.nix

@@ -0,0 +1,34 @@
+{ stdenv, fetchurl, makeWrapper, pkgconfig, MMA, libjack2, libsmf, python, pyGtkGlade, pygtksourceview }:
+
+stdenv.mkDerivation rec {
+  version = "12.02.1";
+  name = "linuxband-${version}";
+
+  src = fetchurl {
+    url = "http://linuxband.org/assets/sources/${name}.tar.gz";
+    sha256 = "1r71h4yg775m4gax4irrvygmrsclgn503ykmc2qwjsxa42ri4n2n";
+  };
+
+  buildInputs = [ makeWrapper pkgconfig MMA libjack2 libsmf python pyGtkGlade pygtksourceview ];
+
+  patchPhase = ''
+    sed -i 's@/usr/@${MMA}/@g' src/main/config/linuxband.rc.in
+    cat src/main/config/linuxband.rc.in
+  '';
+
+  postFixup = ''
+    PYTHONPATH=$pyGtkGlade/share/:pygtksourceview/share/:$PYTHONPATH
+    for f in $out/bin/*; do
+      wrapProgram $f \
+      --prefix PYTHONPATH : $PYTHONPATH
+    done
+  '';
+
+  meta = {
+    description = "A GUI front-end for MMA: Type in the chords, choose the groove and it will play an accompaniment";
+    homepage = http://linuxband.org/;
+    license = stdenv.lib.licenses.gpl2;
+    maintainers = [ stdenv.lib.maintainers.magnetophon ];
+    platforms = stdenv.lib.platforms.linux;
+  };
+}

pkgs/applications/audio/paprefs/default.nix

@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
       dialog for the PulseAudio sound server.
     '';
 
-    homepage = http://freedesktop.org/software/pulseaudio/paprefs/;
+    homepage = "http://freedesktop.org/software/pulseaudio/paprefs/";
 
     license = licenses.gpl2Plus;
 

pkgs/applications/audio/pavucontrol/default.nix

@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
       easily control the volume of all clients, sinks, etc.
     '';
 
-    homepage = http://freedesktop.org/software/pulseaudio/pavucontrol/ ;
+    homepage = "http://freedesktop.org/software/pulseaudio/pavucontrol/";
 
     license = stdenv.lib.licenses.gpl2Plus;
 

pkgs/applications/audio/renoise/default.nix

@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
       ln -s $path/lib/*.so* $out/lib/
     done
 
-    ln -s ${stdenv.cc.cc}/lib/libstdc++.so.6 $out/lib/
+    ln -s ${stdenv.cc.cc.lib}/lib/libstdc++.so.6 $out/lib/
 
     mkdir $out/bin
     ln -s $out/renoise $out/bin/renoise

pkgs/applications/audio/spotify/default.nix

@@ -5,7 +5,7 @@
 assert stdenv.system == "x86_64-linux";
 
 let
-  version = "1.0.27.71.g0a26e3b2-9";
+  version = "1.0.28.89.gf959d4ce-37";
 
   deps = [
     alsaLib
@@ -50,7 +50,7 @@ stdenv.mkDerivation {
   src =
     fetchurl {
       url = "http://repository-origin.spotify.com/pool/non-free/s/spotify-client/spotify-client_${version}_amd64.deb";
-      sha256 = "1rs08cvn0y1lzazlmzj4sn2iyacadwi6j70n5c7rvfvvs4p61p42";
+      sha256 = "06v6fmjn0zi1riqhbmwkrq4m1q1vs95p348i8c12hqvsrp0g2qy5";
     };
 
   buildInputs = [ dpkg makeWrapper ];

pkgs/applications/audio/svox/default.nix

@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Text-to-speech engine";
-    homepage = https://android.googlesource.com/platform/external/svox;
+    homepage = "https://android.googlesource.com/platform/external/svox";
     platforms = platforms.linux;
     license = licenses.asl20;
     maintainers = with maintainers; [ abbradar ];

pkgs/applications/editors/eclipse/build-eclipse.nix

@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     tar xfvz $src -C $out
 
     # Patch binaries.
-    interpreter=$(echo ${stdenv.glibc}/lib/ld-linux*.so.2)
+    interpreter=$(echo ${stdenv.glibc.out}/lib/ld-linux*.so.2)
     libCairo=$out/eclipse/libcairo-swt.so
     patchelf --set-interpreter $interpreter $out/eclipse/eclipse
     [ -f $libCairo ] && patchelf --set-rpath ${freetype}/lib:${fontconfig}/lib:${libX11}/lib:${libXrender}/lib:${zlib}/lib $libCairo
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
 
     makeWrapper $out/eclipse/eclipse $out/bin/eclipse \
       --prefix PATH : ${jdk}/bin \
-      --prefix LD_LIBRARY_PATH : ${glib}/lib:${gtk}/lib:${libXtst}/lib${stdenv.lib.optionalString (webkitgtk2 != null) ":${webkitgtk2}/lib"} \
+      --prefix LD_LIBRARY_PATH : ${glib}/lib:${gtk.out}/lib:${libXtst}/lib${stdenv.lib.optionalString (webkitgtk2 != null) ":${webkitgtk2}/lib"} \
       --add-flags "-configuration \$HOME/.eclipse/''${productId}_$productVersion/configuration"
 
     # Create desktop item.

pkgs/applications/editors/eclipse/plugins.nix

@@ -214,21 +214,22 @@ rec {
 
   cup = buildEclipsePluginBase rec {
     name = "cup-${version}";
-    version = "1.0.0.201412081321";
+    version = "1.1.0.201604221613";
+    version_ = "1.0.0.201604221613";
 
     srcFeature = fetchurl {
       url = "http://www2.in.tum.de/projects/cup/eclipse/features/CupEclipsePluginFeature_${version}.jar";
-      sha256 = "353513445f77ed144687bafc20ab85dc31f2f95ffdc47f102ab773ab0b7afb8b";
+      sha256 = "13nnsf0cqg02z3af6xg45rhcgiffsibxbx6h1zahjv7igvqgkyna";
     };
 
     srcPlugin1 = fetchurl {
-      url = "http://www2.in.tum.de/projects/cup/eclipse/plugins/CupReferencedLibraries_${version}.jar";
+      url = "http://www2.in.tum.de/projects/cup/eclipse/plugins/CupReferencedLibraries_${version_}.jar";
-      sha256 = "082b5ed8730ad065efaac6ea2812dae15669ae74a49778911125b171bea41187";
+      sha256 = "0kif8kivrysprva1pxzajm88gi967qf7idhb6ga2xpvsdcris91j";
     };
 
     srcPlugin2 = fetchurl {
       url = "http://www2.in.tum.de/projects/cup/eclipse/plugins/de.tum.in.www2.CupPlugin_${version}.jar";
-      sha256 = "6b67937fa11944b0330173a9d8564a19eccd705e76b96291d80077a1d7344939";
+      sha256 = "022phbrsny3gb8npb6sxyqqxacx138q5bd7dq3gqxh3kprx5chbl";
     };
 
     srcs = [ srcFeature srcPlugin1 srcPlugin2 ];
@@ -377,16 +378,16 @@ rec {
 
   testng = buildEclipsePlugin rec {
     name = "testng-${version}";
-    version = "6.9.11.201603260617";
+    version = "6.9.11.201604020423";
 
     srcFeature = fetchurl {
       url = "http://beust.com/eclipse-old/eclipse_${version}/features/org.testng.eclipse_${version}.jar";
-      sha256 = "0cd7d3bdp6f081vrampsv53z55g1mjn04w9ngz3h8dr0h6jnxz3y";
+      sha256 = "1cp7f6f0525wqwjj4pyrp0q0ii7zcd5gwd5acaq9jjb13xgw8vav";
     };
 
     srcPlugin = fetchurl {
       url = "http://beust.com/eclipse-old/eclipse_${version}/plugins/org.testng.eclipse_${version}.jar";
-      sha256 = "10kdwnydmsvngn8ahijxrv50aps6wa4ckbf7p24mxbwlnmpqfj03";
+      sha256 = "04m07cdfw0isp27ykx6dbrlcdw33rxww7vnavanygxxnlpyvyas3";
     };
 
     meta = with stdenv.lib; {

pkgs/applications/editors/idea/default.nix

@@ -185,13 +185,13 @@ in
 
   idea-community = buildIdea rec {
     name = "idea-community-${version}";
-    version = "2016.1";
+    version = "2016.1.1";
-    build = "IC-145.258.11";
+    build = "IC-145.597";
     description = "Integrated Development Environment (IDE) by Jetbrains, community edition";
     license = stdenv.lib.licenses.asl20;
     src = fetchurl {
       url = "https://download.jetbrains.com/idea/ideaIC-${version}.tar.gz";
-      sha256 = "1grgyaapsbf7xn0m18x6fgghjh9n1n2zblz9608g9qgx5p28kn6q";
+      sha256 = "1r0kvq8vk8ln4cabqjvfqp0lfy9vf8c8vddh76sd41d635pamba6";
     };
   };
 
@@ -209,13 +209,13 @@ in
 
   idea-ultimate = buildIdea rec {
     name = "idea-ultimate-${version}";
-    version = "2016.1";
+    version = "2016.1.1";
-    build = "IU-145.258.11";
+    build = "IU-145.597";
     description = "Integrated Development Environment (IDE) by Jetbrains, requires paid license";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/idea/ideaIU-${version}.tar.gz";
-      sha256 = "15ybqdy311wi3iqi7bzk798cd91jpl73ngl86kzwr68d24nyy3zb";
+      sha256 = "d5a7d2d657fe2ad170716054c6ccd164e509cf50ee6eee8b61fe3490071940df";
     };
   };
 
@@ -233,25 +233,25 @@ in
 
   pycharm-community = buildPycharm rec {
     name = "pycharm-community-${version}";
-    version = "5.0.3";
+    version = "2016.1.2";
-    build = "143.1559.1";
+    build = "145.844";
     description = "PyCharm Community Edition";
     license = stdenv.lib.licenses.asl20;
     src = fetchurl {
       url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "1xb3qxhl8ln488v0hmjqkzpyypm7wh941c7syi4cs7plbdp6w4c2";
+      sha256 = "1kxwjg5l2fzpn6hr0iir0dv1n5l02jl02aff9wrj95186wxivg3a";
     };
   };
 
   pycharm-professional = buildPycharm rec {
     name = "pycharm-professional-${version}";
-    version = "5.0.3";
+    version = "2016.1.2";
-    build = "143.1559.1";
+    build = "145.844";
     description = "PyCharm Professional Edition";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "1v2g9867nn3id1zfbg4zwj0c0z9d72rl9c1dz6vs2c4j0y4gy9xl";
+      sha256 = "1kwi9d80r2yp5ivbvslrj70iam966rv4a8diajbwpcc26m7rj3kk";
     };
   };
 

pkgs/applications/editors/sublime/default.nix

@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     echo ${libPath}
     patchelf \
       --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-      --set-rpath ${libPath}:${stdenv.cc.cc}/lib${stdenv.lib.optionalString stdenv.is64bit "64"} \
+      --set-rpath ${libPath}:${stdenv.cc.cc.lib}/lib${stdenv.lib.optionalString stdenv.is64bit "64"} \
       $out/sublime/sublime_text
   '';
 

pkgs/applications/editors/sublime3/default.nix

@@ -37,7 +37,7 @@ in let
       for i in sublime_text plugin_host crash_reporter; do
         patchelf \
           --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-          --set-rpath ${libPath}:${stdenv.cc.cc}/lib${stdenv.lib.optionalString stdenv.is64bit "64"} \
+          --set-rpath ${libPath}:${stdenv.cc.cc.lib}/lib${stdenv.lib.optionalString stdenv.is64bit "64"} \
           $i
       done
 
@@ -57,7 +57,7 @@ in let
         --set NIX_REDIRECTS ${builtins.concatStringsSep ":" redirects}
 
       # Without this, plugin_host crashes, even though it has the rpath
-      wrapProgram $out/plugin_host --prefix LD_PRELOAD : ${stdenv.cc.cc}/lib${stdenv.lib.optionalString stdenv.is64bit "64"}/libgcc_s.so.1:${openssl.out}/lib/libssl.so:${bzip2.out}/lib/libbz2.so
+      wrapProgram $out/plugin_host --prefix LD_PRELOAD : ${stdenv.cc.cc.lib}/lib${stdenv.lib.optionalString stdenv.is64bit "64"}/libgcc_s.so.1:${openssl.out}/lib/libssl.so:${bzip2.out}/lib/libbz2.so
     '';
   };
 in stdenv.mkDerivation {

pkgs/applications/graphics/ImageMagick/default.nix

@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, pkgconfig, libtool
 , bzip2, zlib, libX11, libXext, libXt, fontconfig, freetype, ghostscript, libjpeg
-, lcms2, openexr, libpng, librsvg, libtiff, libxml2, openjpeg
+, lcms2, openexr, libpng, librsvg, libtiff, libxml2, openjpeg, libwebp
 }:
 
 let
@@ -39,13 +39,14 @@ stdenv.mkDerivation rec {
 
   buildInputs =
     [ pkgconfig libtool zlib fontconfig freetype ghostscript libjpeg
-      openexr libpng librsvg libtiff libxml2 openjpeg
+      openexr libpng librsvg libtiff libxml2 openjpeg libwebp
     ];
 
   propagatedBuildInputs =
     [ bzip2 freetype libjpeg libX11 libXext libXt lcms2 ];
 
   postInstall = ''
+
     (cd "$out/include" && ln -s ImageMagick* ImageMagick)
   '' + lib.optionalString (ghostscript != null) ''
     for la in $out/lib/*.la; do

pkgs/applications/graphics/sane/backends/brscan4/default.nix

@@ -0,0 +1,97 @@
+{ stdenv, fetchurl, callPackage, patchelf, makeWrapper, coreutils, libusb }:
+
+/*
+
+
+*/
+
+let
+
+  myPatchElf = file: with stdenv.lib; ''
+    patchelf --set-interpreter \
+      ${stdenv.glibc}/lib/ld-linux${optionalString stdenv.is64bit "-x86-64"}.so.2 \
+      ${file}
+  '';
+
+  udevRules = callPackage ./udev_rules_type1.nix {};
+
+in
+
+stdenv.mkDerivation rec {
+
+  name = "brscan4-0.4.3-3";
+  src = fetchurl {
+    url = "http://download.brother.com/welcome/dlf006645/${name}.amd64.deb";
+    sha256 = "1nccyjl0b195pn6ya4q0zijb075q8r31v9z9a0hfzipfyvcj57n2";
+  };
+
+  unpackPhase = ''
+    ar x $src
+    tar xfvz data.tar.gz
+  '';
+
+  nativeBuildInputs = [ makeWrapper patchelf coreutils udevRules ];
+  buildInputs = [ libusb ];
+  buildPhase = ":";
+
+
+  patchPhase = ''
+    ${myPatchElf "opt/brother/scanner/brscan4/brsaneconfig4"}
+
+    RPATH=${libusb}/lib
+    for a in usr/lib64/sane/*.so*; do
+      if ! test -L $a; then
+        patchelf --set-rpath $RPATH $a
+      fi
+    done
+  '';
+
+  installPhase = ''
+
+    PATH_TO_BRSCAN4="opt/brother/scanner/brscan4"
+    mkdir -p $out/$PATH_TO_BRSCAN4
+    cp -rp $PATH_TO_BRSCAN4/* $out/$PATH_TO_BRSCAN4
+    mkdir -p $out/lib/sane
+    cp -rp usr/lib64/sane/* $out/lib/sane
+
+    # Symbolic links were absolute. Fix them so that they point to $out.
+    pushd "$out/lib/sane" > /dev/null
+    for a in *.so*; do
+      if test -L $a; then
+        fixedTargetFileName="$(basename $(readlink $a))"
+        unlink "$a"
+        ln -s -T "$fixedTargetFileName" "$a"
+      fi
+    done
+    popd > /dev/null
+
+    # Generate an LD_PRELOAD wrapper to redirect execvp(), open() and open64()
+    # calls to `/opt/brother/scanner/brscan4`.
+    preload=$out/libexec/brother/scanner/brscan4/libpreload.so
+    mkdir -p $(dirname $preload)
+    gcc -shared ${./preload.c} -o $preload -ldl -DOUT=\"$out\" -fPIC
+
+    makeWrapper \
+      "$out/$PATH_TO_BRSCAN4/brsaneconfig4" \
+      "$out/bin/brsaneconfig4" \
+      --set LD_PRELOAD $preload
+
+    mkdir -p $out/etc/sane.d
+    echo "brother4" > $out/etc/sane.d/dll.conf
+
+    mkdir -p $out/etc/udev/rules.d
+    cp -p ${udevRules}/etc/udev/rules.d/*.rules \
+      $out/etc/udev/rules.d
+  '';
+
+  dontStrip = true;
+  dontPatchELF = true;
+
+  meta = {
+    description = "Brother brscan4 sane backend driver";
+    homepage = http://www.brother.com;
+    platforms = stdenv.lib.platforms.linux;
+    license = stdenv.lib.licenses.unfree;
+    maintainers = with stdenv.lib.maintainers; [ jraygauthier ];
+  };
+}

pkgs/applications/graphics/sane/backends/brscan4/preload.c

@@ -0,0 +1,170 @@
+/* Brgen4 search for configuration under `/etc/opt/brother/scanner/brscan4`. This
+   LD_PRELOAD library intercepts execvp(), open and open64 calls to redirect them to
+   the corresponding location in $out. Also support specifying an alternate
+   file name for `brsanenetdevice4.cfg` which otherwise is invariable
+   created at `/etc/opt/brother/scanner/brscan4`*/
+
+#define _GNU_SOURCE
+#include <stdio.h>
+#include <stdarg.h>
+#include <stdlib.h>
+#include <dlfcn.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <limits.h>
+#include <string.h>
+#include <dirent.h>
+
+char origDir [] = "/etc/opt/brother/scanner/brscan4";
+char realDir [] = OUT "/opt/brother/scanner/brscan4";
+
+char devCfgFileNameEnvVar [] = "BRSANENETDEVICE4_CFG_FILENAME";
+char devCfgFileName [] = "/etc/opt/brother/scanner/brscan4//brsanenetdevice4.cfg";
+
+const char * rewrite(const char * path, char * buf)
+{
+    if (strncmp(path, devCfgFileName, sizeof(devCfgFileName)) == 0) {
+
+      const char* newCfgFileName = getenv(devCfgFileNameEnvVar);
+      if (!newCfgFileName) return path;
+
+      if (snprintf(buf, PATH_MAX, "%s", newCfgFileName) >= PATH_MAX)
+          abort();
+      return buf;
+    }
+
+    if (strncmp(path, origDir, sizeof(origDir) - 1) != 0) return path;
+    if (snprintf(buf, PATH_MAX, "%s%s", realDir, path + sizeof(origDir) - 1) >= PATH_MAX)
+        abort();
+    return buf;
+}
+
+const char* findAndReplaceFirstOccurence(const char* inStr, const char* subStr, 
+                                         const char* replaceStr, 
+                                         char* buf, unsigned maxBuf)
+{
+    const char* foundStr = strstr(inStr, subStr);
+    if (!foundStr)
+      return inStr;
+
+    const unsigned inStrLen = strlen(inStr);
+    const unsigned subStrLen = strlen(subStr);
+    const unsigned replaceStrLen = strlen(replaceStr);
+
+    const unsigned precedingStrLen = foundStr - inStr;
+    if (precedingStrLen + 1 > maxBuf)
+      return NULL;
+
+    const unsigned followingStrPos = precedingStrLen + subStrLen;
+    const unsigned followingStrLen = inStrLen - followingStrPos;
+
+    strncpy(buf, inStr, precedingStrLen);
+    unsigned outLength = precedingStrLen;
+
+    if (outLength + replaceStrLen + 1 > maxBuf)
+      return NULL;
+
+    strncpy(buf + outLength, replaceStr, replaceStrLen);
+    outLength += replaceStrLen;
+    
+    if (outLength + followingStrLen + 1 > maxBuf)
+      return NULL;
+
+    strncpy(buf + outLength, inStr + followingStrPos, followingStrLen);
+    outLength += followingStrLen;
+    
+    buf[outLength] = '\0';
+
+    return buf;
+}
+
+const char* rewriteSystemCall(const char* command, char* buf, unsigned maxBuf)
+{
+
+    const char* foundStr = strstr(command, devCfgFileName);
+    if (!foundStr)
+      return command;
+
+    const char* replaceStr = getenv(devCfgFileNameEnvVar);
+    if (!replaceStr) return command;
+
+    const char* result = 
+      findAndReplaceFirstOccurence(command, devCfgFileName, replaceStr, buf, maxBuf);
+
+    if (!result)
+      abort();
+
+    return result;
+}
+
+int execvp(const char * path, char * const argv[])
+{
+    int (*_execvp) (const char *, char * const argv[]) = dlsym(RTLD_NEXT, "execvp");
+    char buf[PATH_MAX];
+    return _execvp(rewrite(path, buf), argv);
+}
+
+
+int open(const char *path, int flags, ...)
+{
+    char buf[PATH_MAX];
+    int (*_open) (const char *, int, mode_t) = dlsym(RTLD_NEXT, "open");
+    mode_t mode = 0;
+    if (flags & O_CREAT) {
+        va_list ap;
+        va_start(ap, flags);
+        mode = va_arg(ap, mode_t);
+        va_end(ap);
+    }
+    return _open(rewrite(path, buf), flags, mode);
+}
+
+int open64(const char *path, int flags, ...)
+{
+    char buf[PATH_MAX];
+    int (*_open64) (const char *, int, mode_t) = dlsym(RTLD_NEXT, "open64");
+    mode_t mode = 0;
+    if (flags & O_CREAT) {
+        va_list ap;
+        va_start(ap, flags);
+        mode = va_arg(ap, mode_t);
+        va_end(ap);
+    }
+    return _open64(rewrite(path, buf), flags, mode);
+}
+
+FILE* fopen(const char* path, const char* mode)
+{
+  char buf[PATH_MAX];
+	FILE* (*_fopen) (const char*, const char*) = dlsym(RTLD_NEXT, "fopen");
+
+	return _fopen(rewrite(path, buf), mode);
+}
+
+FILE *fopen64(const char *path, const char *mode)
+{
+  char buf[PATH_MAX];
+	FILE* (*_fopen64) (const char*, const char*) = dlsym(RTLD_NEXT, "fopen64");
+
+	return _fopen64(rewrite(path, buf), mode);
+}
+
+DIR* opendir(const char* path)
+{
+  char buf[PATH_MAX];
+	DIR* (*_opendir) (const char*) = dlsym(RTLD_NEXT, "opendir");
+
+	return _opendir(rewrite(path, buf));
+}
+
+#define SYSTEM_CMD_MAX 512
+
+int system(const char *command)
+{
+    char buf[SYSTEM_CMD_MAX];
+    int (*_system) (const char*) = dlsym(RTLD_NEXT, "system");
+
+    const char* newCommand = rewriteSystemCall(command, buf, SYSTEM_CMD_MAX);
+    return _system(newCommand);
+}

pkgs/applications/graphics/sane/backends/brscan4/udev_rules_type1.nix

@@ -0,0 +1,60 @@
+{ stdenv, fetchurl, libsaneUDevRuleNumber ? "49"}:
+
+
+stdenv.mkDerivation rec {
+
+  name = "brother-udev-rule-type1-1.0.0-1";
+
+  src = fetchurl {
+    url = "http://download.brother.com/welcome/dlf006654/${name}.all.deb";
+    sha256 = "0i0x5jw135pli4jl9mgnr5n2rrdvml57nw84yq2999r4frza53xi";
+  };
+
+  buildInputs = [ ];
+
+  unpackPhase = ''
+    ar x $src
+    tar xfvz data.tar.gz
+  '';
+
+  /*
+    Fix the following error:
+
+    ~~~
+    invalid rule 49-brother-libsane-type1.rules
+    unknown key 'SYSFS{idVendor}'
+    ~~~
+
+    Apparently the udev rules syntax has change and the SYSFS key has to
+    be changed to ATTR.
+
+    See:
+
+     -  <http://ubuntuforums.org/showthread.php?t=1496878>
+     -  <http://www.planet-libre.org/index.php?post_id=10937>
+  */
+  patchPhase = ''
+    sed -i -e s/SYSFS/ATTR/g opt/brother/scanner/udev-rules/type1/*.rules
+  '';
+
+
+  buildPhase = ":";
+
+  installPhase = ''
+    mkdir -p $out/etc/udev/rules.d
+    cp opt/brother/scanner/udev-rules/type1/NN-brother-mfp-type1.rules \
+      $out/etc/udev/rules.d/${libsaneUDevRuleNumber}-brother-libsane-type1.rules
+    chmod 644 $out/etc/udev/rules.d/${libsaneUDevRuleNumber}-brother-libsane-type1.rules
+  '';
+
+  dontStrip = true;
+  dontPatchELF = true;
+
+  meta = {
+    description = "Brother type1 scanners udev rules";
+    homepage = http://www.brother.com;
+    platforms = stdenv.lib.platforms.linux;
+    license = stdenv.lib.licenses.unfree;
+    maintainers = with stdenv.lib.maintainers; [ jraygauthier ];
+  };
+}

pkgs/applications/misc/albert/default.nix

@@ -2,16 +2,20 @@
 
 stdenv.mkDerivation rec {
   name    = "albert-${version}";
-  version = "0.8.7.2";
+  version = "0.8.8";
 
   src = fetchFromGitHub {
     owner  = "manuelschneid3r";
     repo   = "albert";
     rev    = "v${version}";
-    sha256 = "04k6cawil6kqkmsilq5mpjy8lwgk0g08s0v23d5a83calpq3ljpc";
+    sha256 = "1mqxy5xbvgzykg2vvr2d1p9kr2viga1pqxslkg9y1x05kdhr2zal";
   };
 
-  buildInputs = [ cmake qtbase qtsvg qtx11extras muparser makeQtWrapper ];
+  nativeBuildInputs = [ cmake makeQtWrapper ];
+
+  buildInputs = [ qtbase qtsvg qtx11extras muparser ];
+
+  enableParallelBuilding = true;
 
   fixupPhase = ''
     wrapQtProgram $out/bin/albert

pkgs/applications/misc/buku/default.nix

@@ -3,14 +3,14 @@
 }:
 
 pythonPackages.buildPythonApplication rec {
-  version = "1.8";
+  version = "1.9";
   name = "buku-${version}";
 
   src = fetchFromGitHub {
     owner = "jarun";
     repo = "buku";
-    rev = "53d48ee56a3abfb53b94ed25fb620ee759141c96";
+    rev = "e99844876d0d871df80770b1bd76c161276116eb";
-    sha256 = "185d3gndw20c3l6f3mf0iq4qapm8g30bl0hn0wsqpp36vl0bpq28";
+    sha256 = "1qwkff61gdjd6w337a5ipfiybzqdwkxdyfa1l4zzm9dj7lsklgq2";
   };
 
   buildInputs = stdenv.lib.optional encryptionSupport pythonPackages.pycrypto;

pkgs/applications/misc/cdrtools/default.nix

@@ -1,11 +1,12 @@
 { stdenv, fetchurl, acl, libcap }:
 
 stdenv.mkDerivation rec {
-  name = "cdrtools-3.02a03";
+  name = "cdrtools-${version}";
+  version = "3.02a06";
 
   src = fetchurl {
     url = "mirror://sourceforge/cdrtools/${name}.tar.bz2";
-    sha256 = "02gjxib0sgzsdicnb7496x0a175w1sb34v8zc9mdi8cfw7skw996";
+    sha256 = "1cayhfbhj5g2vgmkmq5scr23k0ka5fsn0dhn0n9yllj386csnygd";
   };
 
   patches = [ ./fix-paths.patch ];

pkgs/applications/misc/ltwheelconf/default.nix

@@ -0,0 +1,29 @@
+{ stdenv, libusb1, pkgconfig, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "ltwheelconf";
+  version = "0.2.7";
+  name = "${pname}-${version}";
+
+  src = fetchFromGitHub {
+    owner = "thk";
+    repo = "ltwheelconf";
+    rev = "df55451f059d593b0259431662612ab5c2bef859";
+    sha256 = "1fsz7k73yln987gcx1jvb5irxfbp1x2c457a60a8yap27nkp5y2w";
+  };
+
+  buildInputs = [ libusb1 pkgconfig ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp ltwheelconf $out/bin
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/thk/LTWheelConf;
+    description = "Logitech wheels configuration tool";
+    license = licenses.gpl3;
+    maintainers = [ maintainers.ebzzry ];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/misc/octoprint/default.nix

@@ -34,7 +34,7 @@ pythonPackages.buildPythonApplication rec {
   '';
 
   meta = with stdenv.lib; {
-    homepage = http://octoprint.org/;
+    homepage = "http://octoprint.org/";
     description = "The snappy web interface for your 3D printer";
     platforms = platforms.all;
     license = licenses.agpl3;

pkgs/applications/misc/octoprint/plugins.nix

@@ -8,13 +8,13 @@ in {
 
   m3d-fio = buildPlugin rec {
     name = "M3D-Fio-${version}";
-    version = "0.30.2";
+    version = "0.32";
 
     src = fetchFromGitHub {
       owner = "donovan6000";
       repo = "M3D-Fio";
       rev = "V${version}";
-      sha256 = "1knm41hwjf6v4yjx8khr2zd9ryndmw8bkp3y80hgjc5p4nqxrmg3";
+      sha256 = "1s15nx6v56yjwd88b19fx0gk1l0abp76nz10yicspdn91fpr1sf4";
     };
 
     patches = [
@@ -31,8 +31,8 @@ in {
     '';
 
     meta = with stdenv.lib; {
-      homepage = https://github.com/donovan6000/M3D-Fio;
+      homepage = "https://github.com/donovan6000/M3D-Fio";
-      description = " OctoPrint plugin for the Micro 3D printer";
+      description = "OctoPrint plugin for the Micro 3D printer";
       platforms = platforms.all;
       license = licenses.gpl3;
       maintainers = with maintainers; [ abbradar ];

pkgs/applications/misc/openbrf/default.nix

@@ -26,7 +26,7 @@ stdenv.mkDerivation {
 
   meta = with stdenv.lib; {
     description = "A tool to edit resource files (BRF)";
-    homepage = https://github.com/cfcohen/openbrf;
+    homepage = "https://github.com/cfcohen/openbrf";
     maintainers = with stdenv.lib.maintainers; [ abbradar ];
     license = licenses.free;
     platforms = platforms.linux;

pkgs/applications/misc/redis-desktop-manager/default.nix

@@ -0,0 +1,81 @@
+{ stdenv, lib, fetchgit, pkgconfig , libssh2
+, qtbase, qtdeclarative, qtgraphicaleffects, qtimageformats, qtquickcontrols
+, qtsvg, qttools, qtquick1
+, makeQtWrapper, qmakeHook
+}:
+
+let
+  breakpad_lss = fetchgit {
+    url = "https://chromium.googlesource.com/linux-syscall-support";
+    rev = "08056836f2b4a5747daff75435d10d649bed22f6";
+    sha256 = "1ryshs2nyxwa0kn3rlbnd5b3fhna9vqm560yviddcfgdm2jyg0hz";
+  };
+
+in
+
+stdenv.mkDerivation rec {
+  name = "redis-desktop-manager-${version}";
+  version = "0.8.3";
+
+  src = fetchgit {
+    url = "https://github.com/uglide/RedisDesktopManager.git";
+    fetchSubmodules = true;
+    rev = "refs/tags/${version}";
+    sha256 = "08969xwqpjgvfa195dxskpr54p4mnapgfykcffpqpczp990ak1l6";
+  };
+
+  nativeBuildInputs = [ makeQtWrapper qmakeHook ];
+
+  buildInputs = [
+    pkgconfig libssh2 qtbase qtdeclarative qtgraphicaleffects qtimageformats
+    qtquick1 qtquickcontrols qtsvg qttools
+  ];
+
+  configurePhase = "true";
+
+  buildPhase = ''
+    srcdir=$PWD
+
+    substituteInPlace src/resources/qml/ValueTabs.qml \
+      --replace "import QtQuick.Controls 1.4" \
+                "import QtQuick.Controls 1.2"
+
+    cat <<EOF > src/version.h
+#ifndef RDM_VERSION
+    #define RDM_VERSION "${version}-120"
+#endif // !RDM_VERSION
+EOF
+
+    cd $srcdir/3rdparty/gbreakpad
+    cp -r ${breakpad_lss} src/third_party/lss
+    chmod +w -R src/third_party/lss
+    touch README
+
+    cd $srcdir/3rdparty/crashreporter
+    qmake CONFIG+=release DESTDIR="$srcdir/rdm/bin/linux/release" QMAKE_LFLAGS_RPATH=""
+    make
+
+    cd $srcdir/3rdparty/gbreakpad
+    ./configure
+    make
+
+    cd $srcdir/src
+    qmake
+    make
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    instdir="$srcdir/bin/linux/release"
+    cp $instdir/rdm $out/bin
+    wrapQtProgram $out/bin/rdm
+  '';
+
+  meta = with lib; {
+    description = "Cross-platform open source Redis DB management tool";
+    homepage = "http://redisdesktop.com/";
+    license = licenses.lgpl21;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ cstrahan ];
+  };
+}

pkgs/applications/misc/rescuetime/default.nix

@@ -5,18 +5,18 @@ let
     if stdenv.system == "i686-linux" then fetchurl {
       name = "rescuetime-installer.deb";
       url = "https://www.rescuetime.com/installers/rescuetime_current_i386.deb";
-      sha256 = "15x3nvhxk4f0rga0i99c6lhaa1rwdi446kxnx1l4jprhbl788sx6";
+      sha256 = "1wi9ikwmc9jfilj8adad3rcb7rmmxkpkfcp2gkfxvdyw6n0mzcnf";
     } else fetchurl {
       name = "rescuetime-installer.deb";
       url = "https://www.rescuetime.com/installers/rescuetime_current_amd64.deb";
-      sha256 = "0ibdlx8fdlmh81908d1syb7c5lf88pqp49fl7r43cj6bybpdx411";
+      sha256 = "074yivz7rz1ac1962dix0aahpyqvsrkizh32kk5hyw5az0vqpcjs";
     };
 
 in
 
 stdenv.mkDerivation {
   # https://www.rescuetime.com/updates/linux_release_notes.html
-  name = "rescuetime-2.8.9.1170";
+  name = "rescuetime-2.9.10.1255";
   inherit src;
   buildInputs = [ dpkg makeWrapper ];
   unpackPhase = ''
@@ -24,7 +24,11 @@ stdenv.mkDerivation {
     dpkg-deb -x $src pkg
     sourceRoot=pkg
   '';
-  installPhase = ''
+  installPhase = let
+
+    lib = p: stdenv.lib.makeLibraryPath [ p ];
+
+  in ''
     mkdir -p $out/bin
     cp usr/bin/rescuetime $out/bin
 
@@ -33,7 +37,7 @@ stdenv.mkDerivation {
       $out/bin/rescuetime
 
     wrapProgram $out/bin/rescuetime \
-      --prefix LD_PRELOAD : ${qt4}/lib/libQtGui.so.4:${qt4}/lib/libQtCore.so.4:${libXtst}/lib/libXtst.so.6:${libXext}/lib/libXext.so.6:${libX11}/lib/libX11.so.6:${libXScrnSaver}/lib/libXss.so.1
+      --prefix LD_PRELOAD : ${lib qt4}/libQtGui.so.4:${lib qt4}/libQtCore.so.4:${lib libXtst}/libXtst.so.6:${lib libXext}/libXext.so.6:${lib libX11}/libX11.so.6:${lib libXScrnSaver}/libXss.so.1
   '';
   meta = with lib; {
     description = "Helps you understand your daily habits so you can focus and be more productive";

pkgs/applications/misc/workrave/default.nix

@@ -1,37 +1,45 @@
-{ stdenv, fetchurl, autoconf, automake, gettext, intltool, libtool, pkgconfig,
+{ stdenv, fetchFromGitHub, fetchpatch
-  libXtst, cheetah, libXScrnSaver, xorg,
+, autoconf, automake, gettext, intltool, libtool, pkgconfig
-  glib, glibmm,
+, libICE, libSM, libXScrnSaver, libXtst, cheetah
-  gtk, gtkmm,
+, glib, glibmm, gtk, gtkmm, atk, pango, pangomm, cairo, cairomm
-  atk,
+, dbus, dbus_glib, GConf, gconfmm, gdome2, gstreamer, libsigcxx }:
-  pango, pangomm,
-  cairo, cairomm,
-  dbus, dbus_glib,
-  GConf, gconfmm,
-  gdome2, gstreamer, libsigcxx }:
 
 stdenv.mkDerivation rec {
-  version = "1.10.6";
   name = "workrave-${version}";
+  version = "1.10.7";
 
   src = let
-    version_ = with stdenv.lib;
+  in fetchFromGitHub {
-      concatStringsSep "_" (splitString "." version);
+    sha256 = "1mxg882rfih7xzadrpj51m9r33f6s3rzwv61nfwi94vzd68qjnxb";
-  in fetchurl {
+    rev = with stdenv.lib;
-    name = "${name}.tar.gz";
+      "v" + concatStringsSep "_" (splitString "." version);
-    url = "http://github.com/rcaelers/workrave/archive/v${version_}.tar.gz";
+    repo = "workrave";
-    sha256 = "0q2p83n33chbqzdcdm7ykfsy73frfi6drxzm4qidxwzpzsxrysgq";
+    owner = "rcaelers";
   };
 
-  buildInputs = [
+  patches = [
-    autoconf automake gettext intltool libtool pkgconfig libXtst cheetah
+    # Building with gtk{,mm}3 works just fine, but let's be conservative for once:
-    libXScrnSaver
+    (fetchpatch {
+      name = "workrave-fix-compilation-with-gtk2.patch";
+      url = "https://github.com/rcaelers/workrave/commit/"
+        + "271efdcd795b3592bfede8b1af2162af4b1f0f26.patch";
+      sha256 = "1a3d4jj8516m3m24bl6y8alanl1qnyzv5dv1hz5v3hjgk89fj6rk";
+    })
+  ];
 
+  nativeBuildInputs = [
+    autoconf automake gettext intltool libtool pkgconfig
+  ];
+  buildInputs = [
+    libICE libSM libXScrnSaver libXtst cheetah
     glib glibmm gtk gtkmm atk pango pangomm cairo cairomm
-    dbus dbus_glib GConf gconfmm gdome2 gstreamer libsigcxx xorg.libICE xorg.libSM
+    dbus dbus_glib GConf gconfmm gdome2 gstreamer libsigcxx
   ];
 
   preConfigure = "./autogen.sh";
 
+  enableParallelBuilding = true;
+
   meta = with stdenv.lib; {
     description = "A program to help prevent Repetitive Strain Injury";
     longDescription = ''
@@ -42,7 +50,7 @@ stdenv.mkDerivation rec {
     homepage = http://www.workrave.org/;
     downloadPage = https://github.com/rcaelers/workrave/releases;
     license = licenses.gpl3;
-    maintainers = with maintainers; [ prikhi ];
+    maintainers = with maintainers; [ nckx prikhi ];
     platforms = platforms.linux;
   };
 }

pkgs/applications/networking/bittorrentsync/2.0.x.nix

@@ -1,28 +1,27 @@
-{ stdenv, fetchurl, patchelf }:
+{ stdenv, fetchurl }:
 
 let
   arch = if stdenv.system == "x86_64-linux" then "x64"
     else if stdenv.system == "i686-linux" then "i386"
     else throw "Bittorrent Sync for: ${stdenv.system} not supported!";
 
-  sha256 = if stdenv.system == "x86_64-linux" then "0l6z2fyd7i3i3cr95gkihbf6fwa7mk1b2m1jpf2nq5ispg0qf74n"
+  sha256 = if stdenv.system == "x86_64-linux" then "01yrligi61gxcixh7z6gi427ga0sx97wnmkv08p9ykd4b90hvj7s"
-    else if stdenv.system == "i686-linux" then "06x8f75dh58saqrz2k2xgcilh27v0jmql4k4rs7g361aad9v3pnr"
+    else if stdenv.system == "i686-linux" then     "119dll7f4w7h8nrrafmrj1d0lddjzwg5l8hnf74xdjg6g7rhrmd7"
     else throw "Bittorrent Sync for: ${stdenv.system} not supported!";
 
   libPath = stdenv.lib.makeLibraryPath [ stdenv.cc.libc ];
 in
 stdenv.mkDerivation rec {
   name = "btsync-${version}";
-  version = "2.3.3";
+  version = "2.3.6";
 
   src  = fetchurl {
-    url  = "https://download-cdn.getsyncapp.com/${version}/linux-${arch}/BitTorrent-Sync_${arch}.tar.gz";
+    url  = "https://download-cdn.getsync.com/${version}/linux-${arch}/BitTorrent-Sync_${arch}.tar.gz";
     inherit sha256;
   };
 
   dontStrip   = true; # Don't strip, otherwise patching the rpaths breaks
   sourceRoot  = ".";
-  buildInputs = [ patchelf ];
 
   installPhase = ''
     mkdir -p "$out/bin/"
@@ -34,7 +33,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Automatically sync files via secure, distributed technology";
-    homepage    = "http://www.bittorrent.com/sync";
+    homepage    = https://www.getsync.com/;
     license     = stdenv.lib.licenses.unfreeRedistributable;
     platforms   = stdenv.lib.platforms.linux;
     maintainers = with stdenv.lib.maintainers; [ iElectric thoughtpolice cwoac ];

pkgs/applications/networking/browsers/firefox/default.nix

@@ -35,7 +35,7 @@ common = { pname, version, sha512 }: stdenv.mkDerivation rec {
       alsaLib nspr nss libnotify xorg.pixman yasm mesa
       xorg.libXScrnSaver xorg.scrnsaverproto pysqlite
       xorg.libXext xorg.xextproto sqlite unzip makeWrapper
-      hunspell libevent libstartup_notification libvpx /* cairo */
+      hunspell libevent libstartup_notification /* libvpx */ /* cairo */
       gstreamer gst_plugins_base icu libpng jemalloc
       libpulseaudio # only headers are needed
     ]
@@ -50,7 +50,7 @@ common = { pname, version, sha512 }: stdenv.mkDerivation rec {
       "--with-system-nspr"
       "--with-system-nss"
       "--with-system-libevent"
-      "--with-system-libvpx"
+      #"--with-system-libvpx" # needs 1.5.0
       "--with-system-png" # needs APNG support
       "--with-system-icu"
       "--enable-system-ffi"
@@ -69,6 +69,7 @@ common = { pname, version, sha512 }: stdenv.mkDerivation rec {
       "--disable-updater"
       "--enable-jemalloc"
       "--disable-gconf"
+      "--enable-default-toolkit=cairo-gtk2"
     ]
     ++ lib.optional enableGTK3 "--enable-default-toolkit=cairo-gtk3"
     ++ (if debugBuild then [ "--enable-debug" "--enable-profiling" ]
@@ -130,8 +131,8 @@ in {
 
   firefox-unwrapped = common {
     pname = "firefox";
-    version = "45.0.2";
+    version = "46.0";
-    sha512 = "8c0b7afb41a1a405fe499299d1a8b1138dac52b9ad67bfc8761b70a26f330581c2aa1d76d67075896ec3a0c3f5367b8b58365ebc8b3a01f801fa37071b3de526";
+    sha512 = "f5a652e25fa74e3cb271af04d50cc7b63ca73fde9d2ff350e84b3dda55352bac2b28b567aed12164285d992414ad475da9d2555ab972e5c5d7b8f5226591036b";
   };
 
   firefox-esr-unwrapped = common {

pkgs/applications/networking/browsers/firefox/wrapper.nix

@@ -6,6 +6,7 @@
 , supportsJDK, jrePlugin, icedtea_web
 , trezor-bridge, bluejeans, djview4, adobe-reader
 , google_talk_plugin, fribid, gnome3/*.gnome_shell*/
+, esteidfirefoxplugin
 }:
 
 ## configurability of the wrapper itself
@@ -42,6 +43,7 @@ let
       ++ lib.optional (cfg.enableTrezor or false) trezor-bridge
       ++ lib.optional (cfg.enableBluejeans or false) bluejeans
       ++ lib.optional (cfg.enableAdobeReader or false) adobe-reader
+      ++ lib.optional (cfg.enableEsteid or false) esteidfirefoxplugin
      );
   libs = [ gst_all.gstreamer gst_all.gst-plugins-base ]
          ++ lib.optionals (cfg.enableQuakeLive or false)
@@ -86,7 +88,7 @@ stdenv.mkDerivation {
     makeWrapper "${browser}/bin/${browserName}" \
         "$out/bin/${browserName}${nameSuffix}" \
         --suffix-each MOZ_PLUGIN_PATH ':' "$plugins" \
-        --suffix-each LD_LIBRARY_PATH ':' "$libs" \
+        --suffix LD_LIBRARY_PATH ':' "$libs" \
         --suffix-each GTK_PATH ':' "$gtk_modules" \
         --suffix-each LD_PRELOAD ':' "$(cat $(filterExisting $(addSuffix /extra-ld-preload $plugins)))" \
         --prefix GST_PLUGIN_SYSTEM_PATH : "$GST_PLUGIN_SYSTEM_PATH" \
@@ -127,7 +129,7 @@ stdenv.mkDerivation {
   # Let each plugin tell us (through its `mozillaPlugin') attribute
   # where to find the plugin in its tree.
   plugins = map (x: x + x.mozillaPlugin) plugins;
-  libs = map (x: x + "/lib") libs ++ map (x: x + "/lib64") libs;
+  libs = lib.makeLibraryPath libs + ":" + lib.makeSearchPathOutputs "lib64" ["lib"] libs;
   gtk_modules = map (x: x + x.gtkModule) gtk_modules;
 
   passthru = { unwrapped = browser; };

pkgs/applications/networking/browsers/mozilla-plugins/esteidfirefoxplugin/default.nix

@@ -0,0 +1,45 @@
+{ stdenv, fetchurl, gtk2, openssl, pcsclite, pkgconfig, opensc }:
+
+stdenv.mkDerivation rec {
+  version = "3.12.1.1142";
+  name = "esteidfirefoxplugin-${version}";
+
+  src = fetchurl {
+    url = "https://installer.id.ee/media/ubuntu/pool/main/e/esteidfirefoxplugin/esteidfirefoxplugin_3.12.1.1142.orig.tar.xz";
+    sha256 = "0y7759x1xr00p5r3c5wpllcqqnnxh2zi74cmy4m9m690z3ywn0fx";
+  };
+
+  unpackPhase = ''
+    mkdir src
+    tar xf $src -C src
+    cd src
+  '';
+
+  buildInputs = [ gtk2 openssl pcsclite pkgconfig opensc ];
+
+  buildPhase = ''
+    sed -i "s|opensc-pkcs11.so|${opensc}/lib/pkcs11/opensc-pkcs11.so|" Makefile 
+    make plugin
+  '';
+
+  installPhase = ''
+    plugins=$out/lib/mozilla/plugins
+    mkdir -p $plugins
+    cp -a npesteid-firefox-plugin.so $plugins/
+    rp=$(patchelf --print-rpath $plugins/npesteid-firefox-plugin.so)
+    patchelf --set-rpath "$rp:${opensc}/lib:${opensc}/lib/pkcs11" $plugins/npesteid-firefox-plugin.so
+  '';
+
+  passthru.mozillaPlugin = "/lib/mozilla/plugins";
+
+  dontStrip = true;
+  dontPatchELF = true;
+
+  meta = with stdenv.lib; {
+    description = "Firefox ID card signing plugin";
+    homepage = "http://www.id.ee/";
+    license = licenses.lgpl2;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.jagajaga ];
+  };
+}

pkgs/applications/networking/browsers/mozilla-plugins/google-talk-plugin/default.nix

@@ -76,11 +76,11 @@ stdenv.mkDerivation rec {
       cp opt/google/talkplugin/*.so $plugins
 
       for i in libnpgoogletalk.so libppgoogletalk.so libppo1d.so; do
-        patchelf --set-rpath "${makeLibraryPath [ stdenv.cc.cc xorg.libX11 ]}:${stdenv.cc.cc}/lib64" $plugins/$i
+        patchelf --set-rpath "${makeLibraryPath [ stdenv.cc.cc xorg.libX11 ]}:${stdenv.cc.cc.lib}/lib64" $plugins/$i
       done
 
       for i in libgoogletalkremoting.so libnpo1d.so; do
-        patchelf --set-rpath "$out/libexec/google/talkplugin/lib:${rpathPlugin}:${stdenv.cc.cc}/lib64" $plugins/$i
+        patchelf --set-rpath "$out/libexec/google/talkplugin/lib:${rpathPlugin}:${stdenv.cc.cc.lib}/lib64" $plugins/$i
       done
 
       mkdir -p $out/libexec/google/talkplugin
@@ -88,7 +88,7 @@ stdenv.mkDerivation rec {
 
       patchelf \
         --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-        --set-rpath "${rpathProgram}:${stdenv.cc.cc}/lib64" \
+        --set-rpath "${rpathProgram}:${stdenv.cc.cc.lib}/lib64" \
         $out/libexec/google/talkplugin/GoogleTalkPlugin
 
       # Generate an LD_PRELOAD wrapper to redirect execvp() calls to

pkgs/applications/networking/browsers/vivaldi/default.nix

@@ -10,25 +10,25 @@
 }:
 
 let
-  archUrl = name: arch: "https://vivaldi.com/download/stable/${name}_${arch}.deb";
+  version = "1.1";
-in
+  build = "453.47-1";
-stdenv.mkDerivation rec {
+  fullVersion = "stable_${version}.${build}";
-  version    = "1.0";
+
-  debversion = "stable_1.0.435.40-1";
+  info = if stdenv.is64bit then {
+      arch = "amd64";
+      sha256 = "09kadsi4ydjciq092i6linapqzjdzx915zqmz7vfq6w1yp9mqbwq";
+    } else {
+      arch = "i386";
+      sha256 = "0b5410phnkpg6sz0j345vdn0r6n89rm865bchqw8p4kx7pmy78z3";
+    };
+in stdenv.mkDerivation rec {
   product    = "vivaldi";
   name       = "${product}-${version}";
 
-  src = if stdenv.system == "x86_64-linux"
+  src = fetchurl {
-    then fetchurl {
+    inherit (info) sha256;
-      url    = archUrl "vivaldi-${debversion}" "amd64";
+    url = "https://downloads.vivaldi.com/stable/${product}-${fullVersion}_${info.arch}.deb";
-      sha256 = "12c051a40258a95f9594eed2f73fa5f591482ac2a41d5cf643811b1ea2a1efbf";
+  };
-    }
-    else if stdenv.system == "i686-linux"
-    then fetchurl {
-      url    = archUrl "vivaldi-${debversion}" "i386";
-      sha256 = "6e0b84fba38211bab9a71bc10e97398fca77c0acd82791923c1d432b20846f0f";
-    }
-    else throw "Vivaldi is not supported on ${stdenv.system} (only i686-linux and x86_64 linux are supported)";
 
   unpackPhase = ''
     ar vx ${src}
@@ -40,12 +40,12 @@ stdenv.mkDerivation rec {
       libXi libXft libXcursor libXfixes libXScrnSaver libXcomposite libXdamage libXtst libXrandr
       atk alsaLib dbus_libs cups gtk gdk_pixbuf libexif ffmpeg libudev
       freetype fontconfig libXrender libuuid expat glib nss nspr
-      gstreamer libxml2 gst_plugins_base pango cairo gnome3.gconf 
+      gstreamer libxml2 gst_plugins_base pango cairo gnome3.gconf
       patchelf
     ];
 
   libPath = stdenv.lib.makeLibraryPath buildInputs
-    + stdenv.lib.optionalString (stdenv.system == "x86_64-linux")
+    + stdenv.lib.optionalString (stdenv.is64bit)
       (":" + stdenv.lib.makeSearchPathOutput "lib" "lib64" buildInputs);
 
   buildPhase = ''
@@ -71,7 +71,7 @@ stdenv.mkDerivation rec {
     description = "A Browser for our Friends, powerful and personal";
     homepage    = "https://vivaldi.com";
     license     = licenses.unfree;
-    maintainers = with maintainers; [ otwieracz ];
+    maintainers = with maintainers; [ otwieracz nequissimus ];
     platforms   = platforms.linux;
   };
 }

pkgs/applications/networking/copy-com/default.nix

@@ -1,62 +0,0 @@
-{ stdenv, fetchurl, patchelf, fontconfig, freetype
-, gcc, glib, libICE, libSM, libX11, libXext, libXrender }:
-
-let
-  arch = if stdenv.system == "x86_64-linux" then "x86_64"
-    else if stdenv.system == "i686-linux" then "x86"
-    else if stdenv.system == "armv6-linux" then "armv6h"
-    else throw "Copy.com client for: ${stdenv.system} not supported!";
-
-  interpreter = if stdenv.system == "x86_64-linux" then "ld-linux-x86-64.so.2"
-    else if stdenv.system == "i686-linux" then "ld-linux.so.2"
-    else if stdenv.system == "armv6-linux" then "ld-linux.so.2"
-    else throw "Copy.com client for: ${stdenv.system} not supported!";
-
-  appdir = "opt/copy";
-  
-  libPackages = [ fontconfig freetype gcc.cc glib libICE libSM libX11 libXext
-    libXrender ];
-  libPaths = stdenv.lib.concatStringsSep ":"
-    (map (path: "${path}/lib") libPackages);
-
-in stdenv.mkDerivation {
-  
-  name = "copy-com-3.2.01.0481";
-
-  src = fetchurl {
-    # Note: copy.com doesn't version this file. Annoying.
-    url = "https://copy.com/install/linux/Copy.tgz";
-    sha256 = "0bpphm71mqpaiygs57kwa23nli0qm64fvgl1qh7fkxyqqabh4g7k";
-  };
-
-  nativeBuildInputs = [ patchelf ];
-
-  phases = "unpackPhase installPhase";
-
-  installPhase = ''
-    mkdir -p $out/opt
-    cp -r ${arch} "$out/${appdir}"
-
-    mkdir -p "$out/bin"
-    for binary in Copy{Agent,Console,Cmd}; do
-      binary="$out/${appdir}/$binary"
-      ln -sv "$binary" "$out/bin"
-      patchelf --set-interpreter ${stdenv.glibc.out}/lib/${interpreter} "$binary"
-    done
-
-    RPATH=${libPaths}:$out/${appdir}
-    echo "Updating rpaths to $RPATH in:"
-    find "$out/${appdir}" -type f -a -perm -0100 \
-      -print -exec patchelf --force-rpath --set-rpath "$RPATH" {} \;
-  '';
-
-  meta = with stdenv.lib; {
-    homepage = http://copy.com;
-    description = "Copy.com graphical & command-line clients";
-    # Closed Source unfortunately.
-    license = licenses.unfree;
-    maintainers = with maintainers; [ nathan-gs nckx ];
-    # NOTE: Copy.com itself only works on linux, so this is ok.
-    platforms = platforms.linux;
-  };
-}

pkgs/applications/networking/ftp/filezilla/default.nix

@@ -1,13 +1,13 @@
 { stdenv, fetchurl, dbus, gnutls, wxGTK30, libidn, tinyxml, gettext
-, pkgconfig, xdg_utils, gtk2, sqlite, pugixml, libfilezilla }:
+, pkgconfig, xdg_utils, gtk2, sqlite, pugixml, libfilezilla, nettle }:
 
-let version = "3.16.1"; in
+let version = "3.17.0"; in
 stdenv.mkDerivation {
   name = "filezilla-${version}";
 
   src = fetchurl {
     url = "mirror://sourceforge/project/filezilla/FileZilla_Client/${version}/FileZilla_${version}_src.tar.bz2";
-    sha256 = "1a6xvpnsjpgdrxla0i2zag30hy825rfsl4ka9p0zj5za9j2ny11v";
+    sha256 = "0vb5zqpvh0fi0a7nkz79cdmbzjk1cpmbyqx77nfkvd1kz1fcsqrp";
   };
 
   configureFlags = [
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
 
   buildInputs = [
     dbus gnutls wxGTK30 libidn tinyxml gettext pkgconfig xdg_utils gtk2 sqlite
-    pugixml libfilezilla ];
+    pugixml libfilezilla nettle ];
 
   meta = with stdenv.lib; {
     homepage = http://filezilla-project.org/;

pkgs/applications/networking/instant-messengers/hipchat/default.nix

@@ -36,7 +36,7 @@ let
     xcbutilkeysyms
     systemd
     mesa_noglu
-  ] + ":${stdenv.cc.cc}/lib64";
+  ] + ":${stdenv.cc.cc.lib}/lib64";
 
   src =
     if stdenv.system == "x86_64-linux" then

pkgs/applications/networking/instant-messengers/pidgin-plugins/otr/default.nix

@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ libotr pidgin intltool ];
 
   meta = with stdenv.lib; {
-    homepage = https://otr.cypherpunks.ca/;
+    homepage = "https://otr.cypherpunks.ca/";
     description = "Plugin for Pidgin 2.x which implements OTR Messaging";
     license = licenses.gpl2;
     platforms = platforms.linux;

pkgs/applications/networking/instant-messengers/slack/default.nix

@@ -36,7 +36,7 @@ let
     xorg.libXrandr
     xorg.libXrender
     xorg.libXtst
-  ] + ":${stdenv.cc.cc}/lib64";
+  ] + ":${stdenv.cc.cc.lib}/lib64";
 
   src =
     if stdenv.system == "x86_64-linux" then

pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix

@@ -12,20 +12,20 @@ let
   system-x86_64 = lib.elem stdenv.system lib.platforms.x86_64;
 in stdenv.mkDerivation rec {
   name = "telegram-desktop-${version}";
-  version = "0.9.33";
+  version = "0.9.44";
   qtVersion = lib.replaceStrings ["."] ["_"] qtbase.version;
 
   src = fetchFromGitHub {
     owner = "telegramdesktop";
     repo = "tdesktop";
     rev = "v${version}";
-    sha256 = "020vwm7h22951v9zh457d82qy5ifp746vwishkvb16h1vwr1qx4s";
+    sha256 = "0ydd5yhy2nq4n6x59ajb6c4d0blyj6gm7hkx4hfrx2a88iksc5rm";
   };
 
   tgaur = fetchgit {
     url = "https://aur.archlinux.org/telegram-desktop.git";
-    rev = "df47a864282959b103a08b65844e9088e012fdb3";
+    rev = "f8907d1ccaf8345c06232238342921213270e3d8";
-    sha256 = "1v1dbi8yiaf2hgghniykm5qbnda456xj3zfjnbqysn41f5cn40h4";
+    sha256 = "1fsp098ykpf5gynn3lq3qcj3a47bkjfr0l96pymmmfd4a2s1690v";
   };
 
   buildInputs = [
@@ -88,6 +88,17 @@ in stdenv.mkDerivation rec {
       -e 's,-flto ,,g'
     echo "Q_IMPORT_PLUGIN(QXcbIntegrationPlugin)" >> Telegram/SourceFiles/stdafx.cpp
 
+    ( mkdir -p Linux/DebugIntermediateStyle
+      cd Linux/DebugIntermediateStyle
+      qmake CONFIG+=debug ../../Telegram/MetaStyle.pro
+      buildPhase
+    )
+    ( mkdir -p Linux/DebugIntermediateLang
+      cd Linux/DebugIntermediateLang
+      qmake CONFIG+=debug ../../Telegram/MetaLang.pro
+      buildPhase
+    )
+
     ( mkdir -p ../Libraries
       cd ../Libraries
       for i in $qtSrcs; do
@@ -121,17 +132,6 @@ in stdenv.mkDerivation rec {
       installPhase
     )
 
-    ( mkdir -p Linux/DebugIntermediateStyle
-      cd Linux/DebugIntermediateStyle
-      qmake CONFIG+=debug ../../Telegram/MetaStyle.pro
-      buildPhase
-    )
-    ( mkdir -p Linux/DebugIntermediateLang
-      cd Linux/DebugIntermediateLang
-      qmake CONFIG+=debug ../../Telegram/MetaLang.pro
-      buildPhase
-    )
-
     ( mkdir -p Linux/ReleaseIntermediate
       cd Linux/ReleaseIntermediate
       qmake $qmakeFlags ../../Telegram/Telegram.pro
@@ -147,7 +147,7 @@ in stdenv.mkDerivation rec {
     sed "s,/usr/bin,$out/bin,g" $tgaur/telegramdesktop.desktop > $out/share/applications/telegramdesktop.desktop
     sed "s,/usr/bin,$out/bin,g" $tgaur/tg.protocol > $out/share/kde4/services/tg.protocol
     for icon_size in 16 32 48 64 128 256 512; do
-      install -Dm644 "Telegram/SourceFiles/art/icon''${icon_size}.png" "$out/share/icons/hicolor/''${icon_size}x''${icon_size}/apps/telegram-desktop.png"
+      install -Dm644 "Telegram/Resources/art/icon''${icon_size}.png" "$out/share/icons/hicolor/''${icon_size}x''${icon_size}/apps/telegram-desktop.png"
     done
 
     fixupPhase

pkgs/applications/networking/mailreaders/sylpheed/default.nix

@@ -11,14 +11,13 @@ with stdenv.lib;
 assert sslSupport -> openssl != null;
 assert gpgSupport -> gpgme != null;
 
-let version = "3.4.1"; in
+stdenv.mkDerivation rec {
-
-stdenv.mkDerivation {
   name = "sylpheed-${version}";
+  version = "3.5.0";
 
   src = fetchurl {
-    url = "http://sylpheed.sraoss.jp/sylpheed/v3.4/sylpheed-${version}.tar.bz2";
+    url = "http://sylpheed.sraoss.jp/sylpheed/v3.5/${name}.tar.bz2";
-    sha256 = "11wpifvn8a0p4dqmvi7r61imqkgm6rjjp3h057c344vny37livbx";
+    sha256 = "0p50cr9h8b7cv1ayxhqxpj3kv0b7k9dga7lmmfb1lvyagg8n42sa";
   };
 
   buildInputs =

pkgs/applications/networking/msmtp/default.nix

@@ -1,12 +1,12 @@
 { stdenv, fetchurl, openssl, pkgconfig, gnutls, gsasl, libidn, Security }:
 
 stdenv.mkDerivation rec {
-  version = "1.6.2";
+  version = "1.6.4";
   name = "msmtp-${version}";
 
   src = fetchurl {
     url = "mirror://sourceforge/msmtp/${name}.tar.xz";
-    sha256 = "12c7ljahb06pgn8yvvw526xvr11vnr6d4nr0apylixddpxycsvig";
+    sha256 = "1kfihblm769s4hv8iah5mqynqd6hfwlyz5rcg2v423a4llic0jcv";
   };
 
   buildInputs = [ openssl pkgconfig gnutls gsasl libidn ]

pkgs/applications/networking/netperf/default.nix

@@ -1,11 +1,11 @@
 {stdenv, fetchurl}:
 
 stdenv.mkDerivation rec {
-  name = "netperf-2.6.0";
+  name = "netperf-2.7.0";
 
   src = fetchurl {
     url = "ftp://ftp.netperf.org/netperf/${name}.tar.bz2";
-    sha256 = "cd8dac710d4273d29f70e8dbd09353a6362ac58a11926e0822233c0cb230323a";
+    sha256 = "0nip8178pdry0pqx2gkz0sl2gcvc7qww621q43kqnp43amvg2al4";
   };
 
   meta = {

pkgs/applications/networking/p2p/qbittorrent/default.nix

@@ -1,5 +1,5 @@
 { stdenv, fetchurl, pkgconfig, which
-, boost, libtorrentRasterbar, qt5
+, boost, libtorrentRasterbar, qmakeHook, qt5
 , debugSupport ? false # Debugging
 , guiSupport ? true, dbus_libs ? null # GUI (disable to run headless)
 , webuiSupport ? true # WebUI
@@ -10,18 +10,24 @@ assert guiSupport -> (dbus_libs != null);
 with stdenv.lib;
 stdenv.mkDerivation rec {
   name = "qbittorrent-${version}";
-  version = "3.3.3";
+  version = "3.3.4";
 
   src = fetchurl {
     url = "mirror://sourceforge/qbittorrent/${name}.tar.xz";
-    sha256 = "0lyv230vqwb77isjqm6fwwgv8hdap88zir9yrccj0qxj7zf8p3cw";
+    sha256 = "1f4impsjck8anl39pwypsck7j6xw0dl18qd0b4xi23r45jvx9l60";
   };
 
-  nativeBuildInputs = [ pkgconfig which ];
+  nativeBuildInputs = [ pkgconfig which qmakeHook ];
 
   buildInputs = [ boost libtorrentRasterbar qt5.qtbase qt5.qttools ]
     ++ optional guiSupport dbus_libs;
 
+  dontUseQmakeConfigure = true;
+
+  preConfigure = ''
+    export QT_QMAKE="$qtOut/bin"
+  '';
+
   configureFlags = [
     "--with-boost-libdir=${boost.out}/lib"
     "--with-boost=${boost.dev}"

pkgs/applications/science/electronics/eagle/default.nix

@@ -73,7 +73,7 @@ stdenv.mkDerivation rec {
     mkdir -p "$out"/bin
     cat > "$out"/bin/eagle << EOF
     #!${stdenv.shell}
-    export LD_LIBRARY_PATH="${stdenv.cc.cc}/lib:${libPath}"
+    export LD_LIBRARY_PATH="${stdenv.cc.cc.lib}/lib:${libPath}"
     export LD_PRELOAD="$out/lib/eagle_fixer.so"
     export QT_XKB_CONFIG_ROOT="${xkeyboardconfig}/share/X11/xkb"
     exec "$dynlinker" "$out/eagle-${version}/bin/eagle" "\$@"

pkgs/applications/science/logic/hol_light/Makefile.patch

@@ -7,7 +7,7 @@ Index: Makefile
               else if test ${CAMLP5_VERSION} = "6.02.2" -o ${CAMLP5_VERSION} = "6.02.3" -o ${CAMLP5_VERSION} = "6.03" -o ${CAMLP5_VERSION} = "6.04" -o ${CAMLP5_VERSION} = "6.05" -o ${CAMLP5_VERSION} = "6.06" ; \
                    then cp pa_j_3.1x_6.02.2.ml pa_j.ml; \
 -                  else if test ${CAMLP5_VERSION} = "6.06" -o ${CAMLP5_VERSION} = "6.07" -o ${CAMLP5_VERSION} = "6.08" -o ${CAMLP5_VERSION} = "6.09" -o ${CAMLP5_VERSION} = "6.10" -o ${CAMLP5_VERSION} = "6.11" -o ${CAMLP5_VERSION} = "6.12" ; \
-+                  else if test ${CAMLP5_VERSION} = "6.06" -o ${CAMLP5_VERSION} = "6.07" -o ${CAMLP5_VERSION} = "6.08" -o ${CAMLP5_VERSION} = "6.09" -o ${CAMLP5_VERSION} = "6.10" -o ${CAMLP5_VERSION} = "6.11" -o ${CAMLP5_VERSION} = "6.12" -o ${CAMLP5_VERSION} = "6.13" -o ${CAMLP5_VERSION} = "6.14" ; \
++                  else if test ${CAMLP5_VERSION} = "6.06" -o ${CAMLP5_VERSION} = "6.07" -o ${CAMLP5_VERSION} = "6.08" -o ${CAMLP5_VERSION} = "6.09" -o ${CAMLP5_VERSION} = "6.10" -o ${CAMLP5_VERSION} = "6.11" -o ${CAMLP5_VERSION} = "6.12" -o ${CAMLP5_VERSION} = "6.13" -o ${CAMLP5_VERSION} = "6.14" -o ${CAMLP5_VERSION} = "6.16" ; \
                         then cp pa_j_3.1x_6.11.ml pa_j.ml; \
                         else cp pa_j_3.1x_${CAMLP5_BINARY_VERSION}.xx.ml pa_j.ml; \
                         fi \

pkgs/applications/science/logic/saw-tools/default.nix

@@ -7,7 +7,7 @@ let
       gmp4
       ncurses
       zlib
-    ] + ":${stdenv.cc.cc}/lib64";
+    ] + ":${stdenv.cc.cc.lib}/lib64";
 
   url = "https://github.com/GaloisInc/saw-script/releases/download";
 

pkgs/applications/science/logic/verifast/default.nix

@@ -7,7 +7,7 @@ let
   libPath = stdenv.lib.makeLibraryPath
     [ stdenv.cc.libc stdenv.cc.cc gtk gdk_pixbuf atk pango glib cairo
       freetype fontconfig libxml2 gnome2.gtksourceview
-    ] + ":${stdenv.cc.cc}/lib64";
+    ] + ":${stdenv.cc.cc.lib}/lib64";
 
   patchExe = x: ''
     patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \

pkgs/applications/version-management/git-and-tools/default.nix

@@ -51,6 +51,8 @@ rec {
 
   git-extras = callPackage ./git-extras { };
 
+  git-hub = callPackage ./git-hub { };
+
   git-imerge = callPackage ./git-imerge { };
 
   git-radar = callPackage ./git-radar { };

pkgs/applications/version-management/git-and-tools/git-hub/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "git-hub-${version}";
-  version = "0.9.0";
+  version = "0.10";
 
   src = fetchFromGitHub {
-    sha256 = "0c4kq4a906lr8nzway7qh0560n2ydvidh9rlffh44902rd48kp0h";
+    sha256 = "0zy1g6zzv6cw8ffj8ffm28qa922fys2826n5813p8icqypi04y0k";
     rev = "v${version}";
     repo = "git-hub";
-    owner = "sociomantic";
+    owner = "sociomantic-tsunami";
   };
 
   buildInputs = [ python ];

pkgs/applications/version-management/git-and-tools/git/default.nix

@@ -27,6 +27,7 @@ stdenv.mkDerivation {
     ./symlinks-in-bin.patch
     ./git-sh-i18n.patch
     ./ssh-path.patch
+    ./ssl-cert-file.patch
   ];
 
   postPatch = ''
@@ -111,12 +112,12 @@ stdenv.mkDerivation {
 
       ''# wrap git-svn
         gitperllib=$out/lib/perl5/site_perl
-        for i in ${builtins.toString perlLibs} ${svn}; do
+        for i in ${builtins.toString perlLibs} ${svn.out}; do
           gitperllib=$gitperllib:$i/lib/perl5/site_perl
         done
         wrapProgram $out/libexec/git-core/git-svn     \
                      --set GITPERLLIB "$gitperllib"   \
-                     --prefix PATH : "${svn}/bin" ''
+                     --prefix PATH : "${svn.out}/bin" ''
        else '' # replace git-svn by notification script
         notSupported $out/libexec/git-core/git-svn
        '')

pkgs/applications/version-management/git-and-tools/git/ssl-cert-file.patch

@@ -0,0 +1,11 @@
+diff -ru git-2.7.4-orig/http.c git-2.7.4/http.c
+--- git-2.7.4-orig/http.c	2016-03-17 21:47:59.000000000 +0100
++++ git-2.7.4/http.c	2016-04-12 11:38:33.187070848 +0200
+@@ -544,6 +544,7 @@
+ #if LIBCURL_VERSION_NUM >= 0x070908
+ 	set_from_env(&ssl_capath, "GIT_SSL_CAPATH");
+ #endif
++	set_from_env(&ssl_cainfo, "SSL_CERT_FILE");
+ 	set_from_env(&ssl_cainfo, "GIT_SSL_CAINFO");
+ 
+ 	set_from_env(&user_agent, "GIT_HTTP_USER_AGENT");

pkgs/applications/version-management/subversion/apr-1.patch

@@ -0,0 +1,11 @@
+--- a/subversion/bindings/swig/perl/native/Makefile.PL.in
++++ b/subversion/bindings/swig/perl/native/Makefile.PL.in
+@@ -72,7 +72,7 @@
+ # According to the log of r7937, the flags guarded by the conditional break
+ # the build on FreeBSD if not conditionalized.
+ my $apr_ldflags = '@SVN_APR_LIBS@'
+-   if $^O eq 'darwin' or $^O eq 'cygwin';
++   if $^O eq 'darwin' or $^O eq 'cygwin' or $^O eq 'linux';
+ 
+ chomp $apr_shlib_path_var;
+ 

pkgs/applications/version-management/subversion/default.nix

@@ -35,6 +35,8 @@ let
       ++ stdenv.lib.optional perlBindings perl
       ++ stdenv.lib.optional saslSupport sasl;
 
+    patches = [ ./apr-1.patch ];
+
     configureFlags = ''
       ${if bdbSupport then "--with-berkeley-db" else "--without-berkeley-db"}
       ${if httpServer then "--with-apxs=${apacheHttpd}/bin/apxs" else "--without-apxs"}

pkgs/applications/video/popcorntime/default.nix

@@ -1,24 +1,25 @@
 { lib, stdenv, fetchurl, makeWrapper, nwjs, zip }:
 
 let
-  arch = if stdenv.system == "x86_64-linux" then "64"
+  arch = if stdenv.system == "x86_64-linux" then "l64"
-    else if stdenv.system == "i686-linux"   then "32" 
+    else if stdenv.system == "i686-linux"   then "l32" 
     else throw "Unsupported system ${stdenv.system}";
 
 in stdenv.mkDerivation rec {
   name = "popcorntime-${version}";
-  version = "0.3.9";
+  version = "0.4.0";
+  build = "2";
 
   src = fetchurl {
-    url = "http://get.popcorntime.sh/build/Popcorn-Time-${version}-Linux-${arch}.tar.xz";
+    url = "http://popcorntime.ag/download.php?file=popcorn-time-community-v${version}-${build}-${arch}.tar.xz";
     sha256 =
-      if arch == "64"
+      if arch == "l64"
-      then "0qaqdz45frgiy440jyz6hikhklx2yp08qp94z82r03dkbf4a2hvx"
+      then "0a68d0a81d8e97c94afa0c75209056ee4b8486f400854c952bd3ad7251bd80c9"
-      else "0y08a42pm681s97lkczdq5dblxl2jbr850hnl85hknl3ynag9kq4";
+      else "b311c312a29d408a7c661a271d1f3a8fc83865d8a204cf026ee87e9ac173874d";
   };
 
   dontPatchELF = true;
-  sourceRoot   = "linux${arch}";
+  sourceRoot = ".";
   buildInputs  = [ zip makeWrapper ];
 
   buildPhase = ''
@@ -39,5 +40,6 @@ in stdenv.mkDerivation rec {
     license = stdenv.lib.licenses.gpl3;
     platforms = platforms.linux;
     maintainers = with maintainers; [ bobvanderlinden rnhmjoj ];
+    broken = true;
   };
 }

pkgs/applications/video/smplayer/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, qtscript }:
+{ stdenv, fetchurl, qmakeHook, qtscript }:
 
 stdenv.mkDerivation rec {
   name = "smplayer-16.1.0";
@@ -10,7 +10,9 @@ stdenv.mkDerivation rec {
 
   patches = [ ./basegui.cpp.patch ];
 
-  buildInputs = [ qtscript ];
+  buildInputs = [ qmakeHook qtscript ];
+
+  dontUseQmakeConfigure = true;
 
   preConfigure = ''
     makeFlags="PREFIX=$out"

pkgs/applications/video/smtube/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, qtscript, qtwebkit }:
+{ stdenv, fetchurl, qmakeHook, qtscript, qtwebkit }:
 
 stdenv.mkDerivation rec {
   version = "16.1.0";
@@ -13,7 +13,9 @@ stdenv.mkDerivation rec {
     "PREFIX=$(out)"
   ];
 
-  buildInputs = [ qtscript qtwebkit ];
+  dontUseQmakeConfigure = true;
+
+  buildInputs = [ qmakeHook qtscript qtwebkit ];
 
   meta = with stdenv.lib; {
     description = "Play and download Youtube videos";

pkgs/applications/window-managers/compton/git.nix

@@ -4,20 +4,24 @@
   libXrandr, libXrender }:
 
 stdenv.mkDerivation {
-  name = "compton-git-2015-04-20";
+  name = "compton-git-2015-09-21";
 
   src = fetchFromGitHub {
     owner  = "chjj";
     repo   = "compton";
-    rev    = "b1889c1245e6f47eedfae6063100d5a16f584e2b";
+    rev    = "2343e4bbd298b35ea5c190c52abd2b0cb9f79a18";
-    sha256 = "0brnbidxi7wg08yiwgnijzcyqv5lnkd74xzfymvb0i7pgy465vaf";
+    sha256 = "1pb0ic47sfd796crwk47cya2ahbxsm6ygi6sh4fwd734kwz37h4z";
   };
 
-  buildInputs = [
+  nativeBuildInputs = [
     asciidoc
-    dbus
     docbook_xml_dtd_45
     docbook_xml_xslt
+    pkgconfig
+  ];
+
+  buildInputs = [
+    dbus
     libXcomposite
     libXdamage
     libXext
@@ -31,7 +35,6 @@ stdenv.mkDerivation {
     libxslt
     mesa
     pcre
-    pkgconfig
   ];
 
   installFlags = "PREFIX=$(out)";

pkgs/applications/window-managers/herbstluftwm/default.nix

@@ -1,11 +1,11 @@
 { stdenv, fetchurl, pkgconfig, glib, libX11, libXext, libXinerama }:
 
 stdenv.mkDerivation rec {
-  name = "herbstluftwm-0.6.2";
+  name = "herbstluftwm-0.7.0";
 
   src = fetchurl {
     url = "http://herbstluftwm.org/tarballs/${name}.tar.gz";
-    sha256 = "1b7h2zi0i9j17k1z62qw5zq7j9i8gv33pmcxnfiilzzfg8wmr7x8";
+    sha256 = "09xfs213vg1dpird61wik5bqb9yf8kh63ssy18ihf54inwqgqbvy";
   };
 
   patchPhase = ''
@@ -22,5 +22,6 @@ stdenv.mkDerivation rec {
     homepage = "http://herbstluftwm.org/";
     license = stdenv.lib.licenses.bsd2;
     platforms = stdenv.lib.platforms.linux;
+    maintainers = with stdenv.lib.maintainers; [ the-kenny ];
   };
 }

pkgs/applications/window-managers/matchbox/default.nix

@@ -1,12 +1,13 @@
 { stdenv, fetchurl, libmatchbox, pkgconfig}:
 
 stdenv.mkDerivation rec {
-  name = "matchbox-1.2";
+  name = "matchbox-${version}";
+  version = "1.2";
 
   buildInputs = [ libmatchbox pkgconfig ];
 
   src = fetchurl {
-    url = http://matchbox-project.org/sources/matchbox-window-manager/1.2/matchbox-window-manager-1.2.tar.bz2;
+    url = "http://downloads.yoctoproject.org/releases/matchbox/matchbox-window-manager/${version}/matchbox-window-manager-${version}.tar.bz2";
     sha256 = "1zyfq438b466ygcz78nvsmnsc5bhg4wcfnpxb43kbkwpyx53m8l1";
   };
 

pkgs/build-support/grsecurity/default.nix

@@ -90,6 +90,10 @@ let
         GRKERNSEC y
         ${grsecMainConfig}
 
+        # The paxmarks mechanism relies on ELF header markings, but the default
+        # grsecurity configuration only enables xattr markings
+        PAX_PT_PAX_FLAGS y
+
         ${if cfg.config.restrictProc then
             "GRKERNSEC_PROC_USER y"
           else
@@ -117,8 +121,7 @@ let
       # additional build inputs for gcc plugins, required by some PaX/grsec features
       nativeBuildInputs = args.nativeBuildInputs ++ (with pkgs; [ gmp libmpc mpfr ]);
 
-      preConfigure = args.preConfigure or "" + ''
+      preConfigure = (args.preConfigure or "") + ''
-        rm localversion-grsec
         echo ${localver grkern} > localversion-grsec
       '';
     };

pkgs/build-support/setup-hooks/scatter_output.sh

@@ -1,56 +0,0 @@
-preFixupPhases+=" scatter_files"
-preDistPhases+=" propagate_bin_input"
-
-SCATTER_BIN_DEFAULT=${SCATTER_BIN_DEFAULT:-"/lib/*.so* /bin/*"}
-SCATTER_DOC_DEFAULT=${SCATTER_DOC_DEFAULT:-"/share/man/* /share/doc/*"}
-
-
-scatter_files() {
-    save_nullglob=$(shopt -p nullglob)
-    for o in $outputs; do
-	[[ "$o" == "out" ]] && continue
-	v=files_${o}
-	
-	#if files_'output' isn't set in derivative, use defualts for some
-	[[ ${!v} ]] || {
-            case $o in
-		bin)
-		    v=SCATTER_BIN_DEFAULT
-		    ;;
-		doc)
-		    v=SCATTER_DOC_DEFAULT
-		    ;;
-		*)
-		    continue
-		    ;;
-	    esac
-        }
-
-	# prepend each path with $out
-	paths=$out${!v// \// $out/}
-        shopt -s nullglob
-	for f in $paths; do
-	    shopt -u nullglob
-	    dist=${!o}${f#$out}
-	    mkdir -p $(dirname $dist)
-	    cp -pr $f $dist
-	    # remove source, not forgetting to clean empty dirs
-	    rm -r $f
-	    rmdir --ignore-fail-on-non-empty $(dirname $f)
-	done
-	find ${!o} -type f -exec $SHELL -c 'patchelf --set-rpath $(patchelf --print-rpath {} 2>/dev/null):'${!o}'/lib {} 2>/dev/null && patchelf --shrink-rpath {}' \;
-    done
-    eval $save_nullglob
-}
-
-propagate_bin_input() {
-    if [[ -n ${bin:-} ]]; then
-	mkdir -p $out/nix-support
-	echo $bin >> $out/nix-support/propagated-native-build-inputs 
-    fi
-
-    if [[ -n ${bin:-} && -n ${doc:-} ]]; then
-	mkdir -p $bin/nix-support
-	echo $doc >> $bin/nix-support/propagated-user-env-packages
-    fi
-}

pkgs/build-support/vm/default.nix

@@ -1688,6 +1688,40 @@ rec {
       packages = commonDebPackages ++ [ "diffutils" "libc-bin" ];
     };
 
+    ubuntu1604i386 = {
+      name = "ubuntu-16.04-xenial-i386";
+      fullName = "Ubuntu 16.04 Xenial (i386)";
+      packagesLists =
+        [ (fetchurl {
+            url = mirror://ubuntu/dists/xenial/main/binary-i386/Packages.xz;
+            sha256 = "13r75sp4slqy8w32y5dnr7pp7p3cfvavyr1g7gwnlkyrq4zx4ahy";
+          })
+          (fetchurl {
+            url = mirror://ubuntu/dists/xenial/universe/binary-i386/Packages.xz;
+            sha256 = "14fid1rqm3sc0wlygcvn0yx5aljf51c2jpd4x0zxij4019316hsh";
+          })
+        ];
+      urlPrefix = mirror://ubuntu;
+      packages = commonDebPackages ++ [ "diffutils" "libc-bin" ];
+    };
+
+    ubuntu1604x86_64 = {
+      name = "ubuntu-16.04-xenial-amd64";
+      fullName = "Ubuntu 16.04 Xenial (amd64)";
+      packagesList =
+        [ (fetchurl {
+            url = mirror://ubuntu/dists/xenial/main/binary-amd64/Packages.xz;
+            sha256 = "110qnkhjkkwm316fbig3aivm2595ydz6zskc4ld5cr8ngcrqm1bn";
+          })
+          (fetchurl {
+            url = mirror://ubuntu/dists/xenial/universe/binary-amd64/Packages.xz;
+            sha256 = "0mm7gj491yi6q4v0n4qkbsm94s59bvqir6fk60j73w7y4la8rg68";
+          })
+        ];
+      urlPrefix = mirror://ubuntu;
+      packages = commonDebPackages ++ [ "diffutils" "libc-bin" ];
+    };
+
     debian40i386 = {
       name = "debian-4.0r9-etch-i386";
       fullName = "Debian 4.0r9 Etch (i386)";

pkgs/data/icons/hicolor-icon-theme/default.nix

@@ -1,11 +1,11 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "hicolor-icon-theme-0.14";
+  name = "hicolor-icon-theme-0.15";
 
   src = fetchurl {
     url = "http://icon-theme.freedesktop.org/releases/${name}.tar.xz";
-    sha256 = "1k9fj0lb9b44inb5q5m04910x5nfkzrxl3ys9ckihqrixzk0dvbv";
+    sha256 = "1k1kf2c5zbqh31nglc3nxs9j6wr083k9kjyql8p22ccc671mmi4w";
   };
 
   setupHook = ./setup-hook.sh;

pkgs/data/misc/geolite-legacy/default.nix

@@ -8,7 +8,7 @@ let
 in
 stdenv.mkDerivation rec {
   name = "geolite-legacy-${version}";
-  version = "2016-04-25";
+  version = "2016-05-02";
 
   srcGeoIP = fetchDB
     "GeoLiteCountry/GeoIP.dat.gz" "GeoIP.dat.gz"
@@ -18,16 +18,16 @@ stdenv.mkDerivation rec {
     "12k4nmfblm9c7kj4v7cyl6sgfgdfv2jdx4fl7nxfzpk1km7yc5na";
   srcGeoLiteCity = fetchDB
     "GeoLiteCity.dat.xz" "GeoIPCity.dat.xz"
-    "1l6pnlapc9ky3k6wznlhi013i7r3i68x3b5bmkgbvnxadjjdwszw";
+    "04bi7zmmm7v9gl9vhxh0fvqfhmg9ja1lan4ff0njx7qs7lz3ak88";
   srcGeoLiteCityv6 = fetchDB
     "GeoLiteCityv6-beta/GeoLiteCityv6.dat.gz" "GeoIPCityv6.dat.gz"
-    "11igx6r0fypih5i3f0mrcv044pivnl45mq6pkq81i81cv28hfcn8";
+    "1sr2yapsfmdpl4zpf8i5rl3k65dgbq7bb1615g6wf60yw9ngh76x";
   srcGeoIPASNum = fetchDB
     "asnum/GeoIPASNum.dat.gz" "GeoIPASNum.dat.gz"
-    "1b7w8sdazxq5sv3nz1s28420374vf4wn6h2zasbg68kc2cxwdh2w";
+    "04gyrb5qyy3i1p9lgnls90irq3s64y5qfcqj91nx4x68r7dixnai";
   srcGeoIPASNumv6 = fetchDB
     "asnum/GeoIPASNumv6.dat.gz" "GeoIPASNumv6.dat.gz"
-    "1iy6myanmx8h4ha493bz80q6wjwgjlbk7cmliyw1806dd7fhqvwi";
+    "1l9j97bk3mbv5b6lxva6ig590gl7097xr0vayz5mpsfx5d37r4zw";
 
   meta = with stdenv.lib; {
     description = "GeoLite Legacy IP geolocation databases";

pkgs/data/misc/wireless-regdb/default.nix

@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   name = "wireless-regdb-${version}";
-  version = "2016-02-08";
+  version = "2016-05-02";
 
   src = fetchgit {
-    sha256 = "0cqnkkcni27ya6apy2ba4im7xj4nrhbcgrahlarvrzbbjkp740m9";
+    sha256 = "04vqhhqm307bx63ihmli751r15b5vrp3011rj1addlkya56wflby";
     url = https://git.kernel.org/pub/scm/linux/kernel/git/sforshee/wireless-regdb.git;
     rev = "refs/tags/master-${version}";
   };

pkgs/desktops/xfce/core/gtk-xfce-engine.nix

@@ -1,17 +1,19 @@
-{ stdenv, fetchurl, pkgconfig, intltool, gtk }:
+{ stdenv, fetchurl, pkgconfig, intltool, gtk, withGtk3 ? false, gtk3 }:
 
 stdenv.mkDerivation rec {
   p_name  = "gtk-xfce-engine";
-  ver_maj = "2.10";
+  ver_maj = "3.2";
-  ver_min = "1";
+  ver_min = "0";
 
   src = fetchurl {
     url = "mirror://xfce/src/xfce/${p_name}/${ver_maj}/${name}.tar.bz2";
-    sha256 = "4a92910205881f707f2cc8d3c9b00a95feb58eb9084d932c841f3ed027f7063d";
+    sha256 = "1va71f3gpl8gikfkmqsd5ikgp7qj8b64jii2l98g1ylnv8xrqp47";
   };
   name = "${p_name}-${ver_maj}.${ver_min}";
 
-  buildInputs = [ pkgconfig intltool gtk ];
+  buildInputs = [ pkgconfig intltool gtk ] ++ stdenv.lib.optional withGtk3 gtk3;
+  
+  configureFlags = stdenv.lib.optional withGtk3 "--enable-gtk3";
 
   meta = {
     homepage = http://www.xfce.org/;

pkgs/desktops/xfce/default.nix

@@ -21,7 +21,7 @@ xfce_self = rec { # the lines are very long but it seems better than the even-od
 
   exo             = callPackage ./core/exo.nix { };
   garcon          = callPackage ./core/garcon.nix { };
-  gtk_xfce_engine = callPackage ./core/gtk-xfce-engine.nix { }; # ToDo: when should be used?
+  gtk_xfce_engine = callPackage ./core/gtk-xfce-engine.nix { withGtk3 = true; }; # ToDo: when should be used?
   libxfce4ui      = callPackage ./core/libxfce4ui.nix { };
   libxfce4ui_gtk3 = libxfce4ui.override { withGtk3 = true; };
   libxfce4util    = callPackage ./core/libxfce4util.nix { };

pkgs/development/compilers/chez/default.nix

@@ -0,0 +1,59 @@
+{ stdenv, fetchgit, coreutils, ncurses, libX11 }:
+
+stdenv.mkDerivation rec {
+  name    = "chez-scheme-${version}";
+  version = "9.4-${dver}";
+  dver    = "20160501";
+
+  src = fetchgit {
+    url    = "https://github.com/cisco/chezscheme.git";
+    rev    = "8343b7172532a00d2d19914206fcf83c93798c80";
+    sha256 = "1jq55sdk468lckccfnqh0iv868bhw6yb9ba9bakqg2pfydb8r4qf";
+    fetchSubmodules = true;
+  };
+
+  enableParallelBuilding = true;
+  buildInputs = [ ncurses libX11 ];
+
+  /* Chez uses a strange default search path, which completely
+  ** ignores the installation prefix for some reason, and instead
+  ** defaults to {/usr,/usr/local,$HOME}/lib for finding the .boot
+  ** file.
+  **
+  ** Also, we patch out a very annoying 'feature' in ./configure, too,
+  ** which tries to use 'git' to update submodules.
+  **
+  ** Finally, we have to also fix a few occurrences to tools with
+  ** absolute paths in some helper scripts, otherwise the build will
+  ** fail on NixOS or in any chroot build.
+  */
+  patchPhase = ''
+    substituteInPlace ./c/scheme.c \
+      --replace "/usr/lib/csv" "$out/lib/csv"
+
+    substituteInPlace ./configure \
+      --replace "git submodule init && git submodule update || exit 1" ""
+
+    substituteInPlace ./workarea \
+      --replace "/bin/ln" "${coreutils}/bin/ln"
+
+    substituteInPlace ./makefiles/installsh \
+      --replace "/usr/bin/true" "${coreutils}/bin/true"
+  '';
+
+  /* Don't use configureFlags, since that just implicitly appends
+  ** everything onto a --prefix flag, which ./configure gets very angry
+  ** about.
+  */
+  configurePhase = ''
+    ./configure --threads --installprefix=$out --installman=$out/share/man
+  '';
+
+  meta = {
+    description = "A powerful and incredibly fast R6RS Scheme compiler";
+    homepage    = "http://www.scheme.com";
+    license     = stdenv.lib.licenses.asl20;
+    platforms   = stdenv.lib.platforms.linux;
+    maintainers = with stdenv.lib.maintainers; [ thoughtpolice ];
+  };
+}

pkgs/development/compilers/cudatoolkit/default.nix

@@ -32,7 +32,7 @@ let
         gtk2 glib fontconfig freetype unixODBC alsaLib
       ];
 
-      rpath = "${stdenv.lib.makeLibraryPath runtimeDependencies}:${stdenv.cc.cc}/lib64";
+      rpath = "${stdenv.lib.makeLibraryPath runtimeDependencies}:${stdenv.cc.cc.lib}/lib64";
 
       unpackPhase = ''
         sh $src --keep --noexec

pkgs/development/compilers/fpc/lazarus.nix

@@ -34,7 +34,7 @@ stdenv.mkDerivation {
   ];
   preBuild = ''
     export makeFlags="$makeFlags LAZARUS_INSTALL_DIR=$out/share/lazarus/ INSTALL_PREFIX=$out/"
-    export NIX_LDFLAGS="$NIX_LDFLAGS -L${stdenv.cc.cc}/lib -lXi -lX11 -lglib-2.0 -lgtk-x11-2.0 -lgdk-x11-2.0 -lc -lXext -lpango-1.0 -latk-1.0 -lgdk_pixbuf-2.0 -lcairo -lgcc_s"
+    export NIX_LDFLAGS="$NIX_LDFLAGS -L${stdenv.cc.cc.lib}/lib -lXi -lX11 -lglib-2.0 -lgtk-x11-2.0 -lgdk-x11-2.0 -lc -lXext -lpango-1.0 -latk-1.0 -lgdk_pixbuf-2.0 -lcairo -lgcc_s"
     export LCL_PLATFORM=gtk2
     mkdir -p $out/share "$out/lazarus"
     tar xf ${fpc.src} --strip-components=1 -C $out/share -m