Merge remote-tracking branch 'upstream/master' into sage-8.4

doc/cross-compilation.xml

@@ -47,9 +47,13 @@
 
    <para>
     In Nixpkgs, these three platforms are defined as attribute sets under the
-    names <literal>buildPlatform</literal>, <literal>hostPlatform</literal>, and
+    names <literal>buildPlatform</literal>, <literal>hostPlatform</literal>,
-    <literal>targetPlatform</literal>. They are always defined as attributes in
+    and <literal>targetPlatform</literal>. All three are always defined as
-    the standard environment. That means one can access them like:
+    attributes in the standard environment, and at the top level. That means
+    one can get at them just like a dependency in a function that is imported
+    with <literal>callPackage</literal>:
+<programlisting>{ stdenv, buildPlatform, hostPlatform, fooDep, barDep, .. }: ...buildPlatform...</programlisting>
+    , or just off <varname>stdenv</varname>:
 <programlisting>{ stdenv, fooDep, barDep, .. }: ...stdenv.buildPlatform...</programlisting>
     .
    </para>

doc/languages-frameworks/vim.section.md

@@ -5,11 +5,16 @@ date: 2016-06-25
 ---
 # User's Guide to Vim Plugins/Addons/Bundles/Scripts in Nixpkgs
 
-You'll get a vim(-your-suffix) in PATH also loading the plugins you want.
+Both Neovim and Vim can be configured to include your favorite plugins
+and additional libraries.
+
 Loading can be deferred; see examples.
 
-Vim packages, VAM (=vim-addon-manager) and Pathogen are supported to load
+At the moment we support three different methods for managing plugins:
-packages.
+
+- Vim packages (*recommend*)
+- VAM (=vim-addon-manager)
+- Pathogen
 
 ## Custom configuration
 
@@ -25,7 +30,19 @@ vim_configurable.customize {
 }
 ```
 
-## Vim packages
+For Neovim the `configure` argument can be overridden to achieve the same:
+
+```
+neovim.override {
+  configure = {
+    customRC = ''
+      # here your custom configuration goes!
+    '';
+  };
+}
+```
+
+## Managing plugins with Vim packages
 
 To store you plugins in Vim packages the following example can be used:
 
@@ -38,13 +55,50 @@ vim_configurable.customize {
     opt = [ phpCompletion elm-vim ];
     # To automatically load a plugin when opening a filetype, add vimrc lines like:
     # autocmd FileType php :packadd phpCompletion
-  }
+  };
-};
+}
 ```
 
-## VAM
+For Neovim the syntax is
 
-### dependencies by Vim plugins
+```
+neovim.override {
+  configure = {
+    customRC = ''
+      # here your custom configuration goes!
+    '';
+    packages.myVimPackage = with pkgs.vimPlugins; {
+      # see examples below how to use custom packages
+      start = [ ];
+      opt = [ ];
+    };
+  };
+}
+```
+
+The resulting package can be added to `packageOverrides` in `~/.nixpkgs/config.nix` to make it installable:
+
+```
+{
+  packageOverrides = pkgs: with pkgs; {
+    myVim = vim_configurable.customize {
+      name = "vim-with-plugins";
+      # add here code from the example section
+    };
+    myNeovim = neovim.override {
+      configure = {
+      # add here code from the example section
+      };
+    };
+  };
+}
+```
+
+After that you can install your special grafted `myVim` or `myNeovim` packages.
+
+## Managing plugins with VAM
+
+### Handling dependencies of Vim plugins
 
 VAM introduced .json files supporting dependencies without versioning
 assuming that "using latest version" is ok most of the time.
@@ -125,6 +179,18 @@ Sample output2:
     ]
 
 
+## Adding new plugins to nixpkgs
+
+In `pkgs/misc/vim-plugins/vim-plugin-names` we store the plugin names
+for all vim plugins we automatically generate plugins for.
+The format of this file `github username/github repository`:
+For example https://github.com/scrooloose/nerdtree becomes `scrooloose/nerdtree`.
+After adding your plugin to this file run the `./update.py` in the same folder.
+This will updated a file called `generated.nix` and make your plugin accessible in the
+`vimPlugins` attribute set (`vimPlugins.nerdtree` in our example).
+If additional steps to the build process of the plugin are required, add an
+override to the `pkgs/misc/vim-plugins/default.nix` in the same directory.
+
 ## Important repositories
 
 - [vim-pi](https://bitbucket.org/vimcommunity/vim-pi) is a plugin repository

lib/licenses.nix

@@ -355,6 +355,11 @@ lib.mapAttrs (n: v: v // { shortName = n; }) rec {
     fullName = "Independent JPEG Group License";
   };
 
+  imagemagick = spdx {
+    fullName = "ImageMagick License";
+    spdxId = "imagemagick";
+  };
+
   inria-compcert = {
     fullName  = "INRIA Non-Commercial License Agreement for the CompCert verified compiler";
     url       = "http://compcert.inria.fr/doc/LICENSE";

maintainers/maintainer-list.nix

@@ -1847,6 +1847,11 @@
     github = "jerith666";
     name = "Matt McHenry";
   };
+  jethro = {
+    email = "jethrokuan95@gmail.com";
+    github = "jethrokuan";
+    name = "Jethro Kuan";
+  };
   jfb = {
     email = "james@yamtime.com";
     github = "tftio";
@@ -4163,6 +4168,11 @@
     github = "tomsmeets";
     name = "Tom Smeets";
   };
+  toonn = {
+    email = "nnoot@toonn.io";
+    github = "toonn";
+    name = "Toon Nolten";
+  };
   travisbhartwell = {
     email = "nafai@travishartwell.net";
     github = "travisbhartwell";
@@ -4518,6 +4528,11 @@
     github = "y0no";
     name = "Yoann Ono";
   };
+  yarny = {
+    email = "41838844+Yarny0@users.noreply.github.com";
+    github = "Yarny0";
+    name = "Yarny";
+  };
   yarr = {
     email = "savraz@gmail.com";
     github = "Eternity-Yarr";

nixos/doc/manual/installation/upgrading.xml

@@ -52,10 +52,13 @@
    </listitem>
   </itemizedlist>
   To see what channels are available, go to
-  <link
+  <link xlink:href="https://nixos.org/channels"/>. (Note that the URIs of the
-xlink:href="https://nixos.org/channels"/>. (Note that the URIs of the
   various channels redirect to a directory that contains the channel’s latest
-  version and includes ISO images and VirtualBox appliances.)
+  version and includes ISO images and VirtualBox appliances.) Please note that
+  during the release process, channels that are not yet released will be
+  present here as well. See the Getting NixOS page
+  <link xlink:href="https://nixos.org/nixos/download.html"/> to find the newest
+  supported stable release.
  </para>
  <para>
   When you first install NixOS, you’re automatically subscribed to the NixOS

nixos/doc/manual/release-notes/rl-1809.xml

@@ -451,6 +451,14 @@ inherit (pkgs.nixos {
      deprecated. Use <literal>networking.networkmanager.dns</literal> instead.
     </para>
    </listitem>
+   <listitem>
+     <para>
+     The Kubernetes package has been bumped to major version 1.11.
+     Please consult the
+     <link xlink:href="https://github.com/kubernetes/kubernetes/blob/release-1.11/CHANGELOG-1.11.md">release notes</link>
+     for details on new features and api changes.
+    </para>
+   </listitem>
    <listitem>
     <para>
      The option

nixos/lib/eval-config.nix

@@ -36,7 +36,11 @@ let
     _file = ./eval-config.nix;
     key = _file;
     config = {
-      nixpkgs.localSystem = lib.mkDefault { inherit system; };
+      # Explicit `nixpkgs.system` or `nixpkgs.localSystem` should override
+      # this.  Since the latter defaults to the former, the former should
+      # default to the argument. That way this new default could propagate all
+      # they way through, but has the last priority behind everything else.
+      nixpkgs.system = lib.mkDefault system;
       _module.args.pkgs = lib.mkIf (pkgs_ != null) (lib.mkForce pkgs_);
     };
   };

nixos/modules/config/xdg/mime.nix

@@ -23,12 +23,12 @@ with lib;
     ];
 
     environment.extraSetup = ''
-      if [ -w $out/share/mime ]; then
+      if [ -w $out/share/mime ] && [ -d $out/share/mime/packages ]; then
-        XDG_DATA_DIRS=$out/share ${pkgs.shared-mime-info}/bin/update-mime-database -V $out/share/mime > /dev/null
+          XDG_DATA_DIRS=$out/share ${pkgs.shared-mime-info}/bin/update-mime-database -V $out/share/mime > /dev/null
       fi
 
       if [ -w $out/share/applications ]; then
-        ${pkgs.desktop-file-utils}/bin/update-desktop-database $out/share/applications
+          ${pkgs.desktop-file-utils}/bin/update-desktop-database $out/share/applications
       fi
     '';
   };

nixos/modules/misc/ids.nix

@@ -53,7 +53,7 @@
       tomcat = 16;
       #audio = 17; # unused
       #floppy = 18; # unused
-      #uucp = 19; # unused
+      uucp = 19;
       #lp = 20; # unused
       #proc = 21; # unused
       pulseaudio = 22; # must match `pulseaudio' GID

nixos/modules/misc/nixpkgs.nix

@@ -62,12 +62,11 @@ in
     pkgs = mkOption {
       defaultText = literalExample
         ''import "''${nixos}/.." {
-            inherit (config.nixpkgs) config overlays localSystem crossSystem;
+            inherit (cfg) config overlays localSystem crossSystem;
           }
         '';
       default = import ../../.. {
-        localSystem = { inherit (cfg) system; } // cfg.localSystem;
+        inherit (cfg) config overlays localSystem crossSystem;
-        inherit (cfg) config overlays crossSystem;
       };
       type = pkgsType;
       example = literalExample ''import <nixpkgs> {}'';
@@ -140,8 +139,11 @@ in
 
     localSystem = mkOption {
       type = types.attrs; # TODO utilize lib.systems.parsedPlatform
-      default = { system = builtins.currentSystem; };
+      default = { inherit (cfg) system; };
       example = { system = "aarch64-linux"; config = "aarch64-unknown-linux-gnu"; };
+      # Make sure that the final value has all fields for sake of other modules
+      # referring to this. TODO make `lib.systems` itself use the module system.
+      apply = lib.systems.elaborate;
       defaultText = literalExample
         ''(import "''${nixos}/../lib").lib.systems.examples.aarch64-multiplatform'';
       description = ''
@@ -180,6 +182,7 @@ in
     system = mkOption {
       type = types.str;
       example = "i686-linux";
+      default = { system = builtins.currentSystem; };
       description = ''
         Specifies the Nix platform type on which NixOS should be built.
         It is better to specify <code>nixpkgs.localSystem</code> instead.
@@ -196,6 +199,7 @@ in
         </programlisting>
         See <code>nixpkgs.localSystem</code> for more information.
 
+        Ignored when <code>nixpkgs.localSystem</code> is set.
         Ignored when <code>nixpkgs.pkgs</code> is set.
       '';
     };

nixos/modules/module-list.nix

@@ -245,6 +245,7 @@
   ./services/desktops/gnome3/gnome-user-share.nix
   ./services/desktops/gnome3/gpaste.nix
   ./services/desktops/gnome3/gvfs.nix
+  ./services/desktops/gnome3/rygel.nix
   ./services/desktops/gnome3/seahorse.nix
   ./services/desktops/gnome3/sushi.nix
   ./services/desktops/gnome3/tracker.nix
@@ -516,6 +517,7 @@
   ./services/networking/heyefi.nix
   ./services/networking/hostapd.nix
   ./services/networking/htpdate.nix
+  ./services/networking/hylafax/default.nix
   ./services/networking/i2pd.nix
   ./services/networking/i2p.nix
   ./services/networking/iodine.nix

nixos/modules/security/acme.nix

@@ -302,15 +302,15 @@ in
                       workdir="$(mktemp -d)"
 
                       # Create CA
-                      openssl genrsa -des3 -passout pass:x -out $workdir/ca.pass.key 2048
+                      openssl genrsa -des3 -passout pass:xxxx -out $workdir/ca.pass.key 2048
-                      openssl rsa -passin pass:x -in $workdir/ca.pass.key -out $workdir/ca.key
+                      openssl rsa -passin pass:xxxx -in $workdir/ca.pass.key -out $workdir/ca.key
                       openssl req -new -key $workdir/ca.key -out $workdir/ca.csr \
                         -subj "/C=UK/ST=Warwickshire/L=Leamington/O=OrgName/OU=Security Department/CN=example.com"
                       openssl x509 -req -days 1 -in $workdir/ca.csr -signkey $workdir/ca.key -out $workdir/ca.crt
 
                       # Create key
-                      openssl genrsa -des3 -passout pass:x -out $workdir/server.pass.key 2048
+                      openssl genrsa -des3 -passout pass:xxxx -out $workdir/server.pass.key 2048
-                      openssl rsa -passin pass:x -in $workdir/server.pass.key -out $workdir/server.key
+                      openssl rsa -passin pass:xxxx -in $workdir/server.pass.key -out $workdir/server.key
                       openssl req -new -key $workdir/server.key -out $workdir/server.csr \
                         -subj "/C=UK/ST=Warwickshire/L=Leamington/O=OrgName/OU=IT Department/CN=example.com"
                       openssl x509 -req -days 1 -in $workdir/server.csr -CA $workdir/ca.crt \

nixos/modules/services/computing/slurm/slurm.nix

@@ -8,6 +8,7 @@ let
   # configuration file can be generated by http://slurm.schedmd.com/configurator.html
   configFile = pkgs.writeTextDir "slurm.conf"
     ''
+      ClusterName=${cfg.clusterName}
       ${optionalString (cfg.controlMachine != null) ''controlMachine=${cfg.controlMachine}''}
       ${optionalString (cfg.controlAddr != null) ''controlAddr=${cfg.controlAddr}''}
       ${optionalString (cfg.nodeName != null) ''nodeName=${cfg.nodeName}''}
@@ -105,6 +106,15 @@ in
         '';
       };
 
+      clusterName = mkOption {
+        type = types.str;
+        default = "default";
+        example = "myCluster";
+        description = ''
+          Necessary to distinguish accounting records in a multi-cluster environment.
+        '';
+      };
+
       nodeName = mkOption {
         type = types.nullOr types.str;
         default = null;

nixos/modules/services/desktops/gnome3/rygel.nix

@@ -0,0 +1,30 @@
+# rygel service.
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+{
+  ###### interface
+  options = {
+    services.gnome3.rygel = {
+      enable = mkOption {
+        default = false;
+        description = ''
+          Whether to enable Rygel UPnP Mediaserver.
+
+          You will need to also allow UPnP connections in firewall, see the following <link xlink:href="https://github.com/NixOS/nixpkgs/pull/45045#issuecomment-416030795">comment</link>.
+        '';
+        type = types.bool;
+      };
+    };
+  };
+
+  ###### implementation
+  config = mkIf config.services.gnome3.rygel.enable {
+    environment.systemPackages = [ pkgs.gnome3.rygel ];
+
+    services.dbus.packages = [ pkgs.gnome3.rygel ];
+
+    systemd.packages = [ pkgs.gnome3.rygel ];
+  };
+}

nixos/modules/services/monitoring/datadog-agent.nix

@@ -8,7 +8,6 @@ let
   ddConf = {
     dd_url              = "https://app.datadoghq.com";
     skip_ssl_validation = "no";
-    api_key             = "";
     confd_path          = "/etc/datadog-agent/conf.d";
     additional_checksd  = "/etc/datadog-agent/checks.d";
     use_dogstatsd       = true;
@@ -16,6 +15,7 @@ let
   // optionalAttrs (cfg.logLevel != null) { log_level = cfg.logLevel; }
   // optionalAttrs (cfg.hostname != null) { inherit (cfg) hostname; }
   // optionalAttrs (cfg.tags != null ) { tags = concatStringsSep ", " cfg.tags; }
+  // optionalAttrs (cfg.enableLiveProcessCollection) { process_config = { enabled = "true"; }; }
   // cfg.extraConfig;
 
   # Generate Datadog configuration files for each configured checks.
@@ -125,6 +125,13 @@ in {
       '';
      };
 
+    enableLiveProcessCollection = mkOption {
+      description = ''
+        Whether to enable the live process collection agent.
+      '';
+      default = false;
+      type = types.bool;
+    };
     checks = mkOption {
       description = ''
         Configuration for all Datadog checks. Keys of this attribute
@@ -229,6 +236,15 @@ in {
         path = [ datadogPkg pkgs.python pkgs.sysstat pkgs.procps pkgs.jdk ];
         serviceConfig.ExecStart = "${datadogPkg}/bin/dd-jmxfetch";
       });
+
+      datadog-process-agent = lib.mkIf cfg.enableLiveProcessCollection (makeService {
+        description = "Datadog Live Process Agent";
+        path = [ ];
+        script = ''
+          export DD_API_KEY=$(head -n 1 ${cfg.apiKeyFile})
+          ${pkgs.datadog-process-agent}/bin/agent --config /etc/datadog-agent/datadog.yaml
+        '';
+      });
     };
 
     environment.etc = etcfiles;

nixos/modules/services/monitoring/grafana.nix

@@ -235,7 +235,7 @@ in {
         but without GF_ prefix
       '';
       default = {};
-      type = types.attrsOf types.str;
+      type = with types; attrsOf (either str path);
     };
   };
 

nixos/modules/services/networking/hylafax/default.nix

@@ -0,0 +1,29 @@
+{ config, lib, pkgs, ... }:
+
+{
+
+  imports = [
+    ./options.nix
+    ./systemd.nix
+  ];
+
+  config = lib.modules.mkIf config.services.hylafax.enable {
+    environment.systemPackages = [ pkgs.hylafaxplus ];
+    users.users.uucp = {
+      uid = config.ids.uids.uucp;
+      group = "uucp";
+      description = "Unix-to-Unix CoPy system";
+      isSystemUser = true;
+      inherit (config.users.users.nobody) home;
+    };
+    assertions = [{
+      assertion = config.services.hylafax.modems != {};
+      message = ''
+        HylaFAX cannot be used without modems.
+        Please define at least one modem with
+        <option>config.services.hylafax.modems</option>.
+      '';
+    }];
+  };
+
+}

nixos/modules/services/networking/hylafax/faxq-default.nix

@@ -0,0 +1,12 @@
+{ ... }:
+
+# see man:hylafax-config(5)
+
+{
+
+  ModemGroup = [ ''"any:.*"'' ];
+  ServerTracing = "0x78701";
+  SessionTracing = "0x78701";
+  UUCPLockDir = "/var/lock";
+
+}

nixos/modules/services/networking/hylafax/faxq-wait.sh

@@ -0,0 +1,29 @@
+#! @shell@ -e
+
+# skip this if there are no modems at all
+if ! stat -t "@spoolAreaPath@"/etc/config.* >/dev/null 2>&1
+then
+  exit 0
+fi
+
+echo "faxq started, waiting for modem(s) to initialize..."
+
+for i in `seq @timeoutSec@0 -1 0`  # gracefully timeout
+do
+  sleep 0.1
+  # done if status files exist, but don't mention initialization
+  if \
+    stat -t "@spoolAreaPath@"/status/* >/dev/null 2>&1 \
+    && \
+    ! grep --silent --ignore-case 'initializing server' \
+    "@spoolAreaPath@"/status/*
+  then
+    echo "modem(s) apparently ready"
+    exit 0
+  fi
+  # if i reached 0, modems probably failed to initialize
+  if test $i -eq 0
+  then
+    echo "warning: modem initialization timed out"
+  fi
+done

nixos/modules/services/networking/hylafax/hfaxd-default.nix

@@ -0,0 +1,10 @@
+{ ... }:
+
+# see man:hfaxd(8)
+
+{
+
+  ServerTracing = "0x91";
+  XferLogFile = "/clientlog";
+
+}

nixos/modules/services/networking/hylafax/modem-default.nix

@@ -0,0 +1,22 @@
+{ pkgs, ... }:
+
+# see man:hylafax-config(5)
+
+{
+
+  TagLineFont = "etc/LiberationSans-25.pcf";
+  TagLineLocale = ''en_US.UTF-8'';
+
+  AdminGroup = "root";  # groups that can change server config
+  AnswerRotary = "fax";  # don't accept anything else but faxes
+  LogFileMode = "0640";
+  PriorityScheduling = true;
+  RecvFileMode = "0640";
+  ServerTracing = "0x78701";
+  SessionTracing = "0x78701";
+  UUCPLockDir = "/var/lock";
+
+  SendPageCmd = ''${pkgs.coreutils}/bin/false'';  # prevent pager transmit
+  SendUUCPCmd = ''${pkgs.coreutils}/bin/false'';  # prevent UUCP transmit
+
+}

nixos/modules/services/networking/hylafax/options.nix

@@ -0,0 +1,375 @@
+{ config, lib, pkgs, ... }:
+
+let
+
+  inherit (lib.options) literalExample mkEnableOption mkOption;
+  inherit (lib.types) bool enum int lines loaOf nullOr path str submodule;
+  inherit (lib.modules) mkDefault mkIf mkMerge;
+
+  commonDescr = ''
+    Values can be either strings or integers
+    (which will be added to the config file verbatimly)
+    or lists thereof
+    (which will be translated to multiple
+    lines with the same configuration key).
+    Boolean values are translated to "Yes" or "No".
+    The default contains some reasonable
+    configuration to yield an operational system.
+  '';
+
+  str1 = lib.types.addCheck str (s: s!="");  # non-empty string
+  int1 = lib.types.addCheck int (i: i>0);  # positive integer
+
+  configAttrType =
+    # Options in HylaFAX configuration files can be
+    # booleans, strings, integers, or list thereof
+    # representing multiple config directives with the same key.
+    # This type definition resolves all
+    # those types into a list of strings.
+    let
+      inherit (lib.types) attrsOf coercedTo listOf;
+      innerType = coercedTo bool (x: if x then "Yes" else "No")
+        (coercedTo int (toString) str);
+    in
+      attrsOf (coercedTo innerType lib.singleton (listOf innerType));
+
+  cfg = config.services.hylafax;
+
+  modemConfigOptions = { name, config, ... }: {
+    options = {
+      name = mkOption {
+        type = str1;
+        example = "ttyS1";
+        description = ''
+          Name of modem device,
+          will be searched for in <filename>/dev</filename>.
+        '';
+      };
+      type = mkOption {
+        type = str1;
+        example = "cirrus";
+        description = ''
+          Name of modem configuration file,
+          will be searched for in <filename>config</filename>
+          in the spooling area directory.
+        '';
+      };
+      config = mkOption {
+        type = configAttrType;
+        example = {
+          AreaCode = "49";
+          LocalCode = "30";
+          FAXNumber = "123456";
+          LocalIdentifier = "LostInBerlin";
+        };
+        description = ''
+          Attribute set of values for the given modem.
+          ${commonDescr}
+          Options defined here override options in
+          <option>commonModemConfig</option> for this modem.
+        '';
+      };
+    };
+    config.name = mkDefault name;
+    config.config.Include = [ "config/${config.type}" ];
+  };
+
+  defaultConfig =
+    let
+      inherit (config.security) wrapperDir;
+      inherit (config.services.mail.sendmailSetuidWrapper) program;
+      mkIfDefault = cond: value: mkIf cond (mkDefault value);
+      noWrapper = config.services.mail.sendmailSetuidWrapper==null;
+      # If a sendmail setuid wrapper exists,
+      # we add the path to the default configuration file.
+      # Otherwise, we use `false` to provoke
+      # an error if hylafax tries to use it.
+      c.sendmailPath = mkMerge [
+        (mkIfDefault noWrapper ''${pkgs.coreutils}/bin/false'')
+        (mkIfDefault (!noWrapper) ''${wrapperDir}/${program}'')
+      ];
+      importDefaultConfig = file:
+        lib.attrsets.mapAttrs
+        (lib.trivial.const mkDefault)
+        (import file { inherit pkgs; });
+      c.commonModemConfig = importDefaultConfig ./modem-default.nix;
+      c.faxqConfig = importDefaultConfig ./faxq-default.nix;
+      c.hfaxdConfig = importDefaultConfig ./hfaxd-default.nix;
+    in
+      c;
+
+  localConfig =
+    let
+      c.hfaxdConfig.UserAccessFile = cfg.userAccessFile;
+      c.faxqConfig = lib.attrsets.mapAttrs
+        (lib.trivial.const (v: mkIf (v!=null) v))
+        {
+          AreaCode = cfg.areaCode;
+          CountryCode = cfg.countryCode;
+          LongDistancePrefix = cfg.longDistancePrefix;
+          InternationalPrefix = cfg.internationalPrefix;
+        };
+      c.commonModemConfig = c.faxqConfig;
+    in
+      c;
+
+in
+
+
+{
+
+
+  options.services.hylafax = {
+
+    enable = mkEnableOption ''HylaFAX server'';
+
+    autostart = mkOption {
+      type = bool;
+      default = true;
+      example = false;
+      description = ''
+        Autostart the HylaFAX queue manager at system start.
+        If this is <literal>false</literal>, the queue manager
+        will still be started if there are pending
+        jobs or if a user tries to connect to it.
+      '';
+    };
+
+    countryCode = mkOption {
+      type = nullOr str1;
+      default = null;
+      example = "49";
+      description = ''Country code for server and all modems.'';
+    };
+
+    areaCode = mkOption {
+      type = nullOr str1;
+      default = null;
+      example = "30";
+      description = ''Area code for server and all modems.'';
+    };
+
+    longDistancePrefix = mkOption {
+      type = nullOr str;
+      default = null;
+      example = "0";
+      description = ''Long distance prefix for server and all modems.'';
+    };
+
+    internationalPrefix = mkOption {
+      type = nullOr str;
+      default = null;
+      example = "00";
+      description = ''International prefix for server and all modems.'';
+    };
+
+    spoolAreaPath = mkOption {
+      type = path;
+      default = "/var/spool/fax";
+      description = ''
+        The spooling area will be created/maintained
+        at the location given here.
+      '';
+    };
+
+    userAccessFile = mkOption {
+      type = path;
+      default = "/etc/hosts.hfaxd";
+      description = ''
+        The <filename>hosts.hfaxd</filename>
+        file entry in the spooling area
+        will be symlinked to the location given here.
+        This file must exist and be
+        readable only by the <literal>uucp</literal> user.
+        See hosts.hfaxd(5) for details.
+        This configuration permits access for all users:
+        <literal>
+          environment.etc."hosts.hfaxd" = {
+            mode = "0600";
+            user = "uucp";
+            text = ".*";
+          };
+        </literal>
+        Note that host-based access can be controlled with
+        <option>config.systemd.sockets.hylafax-hfaxd.listenStreams</option>;
+        by default, only 127.0.0.1 is permitted to connect.
+      '';
+    };
+
+    sendmailPath = mkOption {
+      type = path;
+      example = literalExample "''${pkgs.postfix}/bin/sendmail";
+      # '' ;  # fix vim
+      description = ''
+        Path to <filename>sendmail</filename> program.
+        The default uses the local sendmail wrapper
+        (see <option>config.services.mail.sendmailSetuidWrapper</option>),
+        otherwise the <filename>false</filename>
+        binary to cause an error if used.
+      '';
+    };
+
+    hfaxdConfig = mkOption {
+      type = configAttrType;
+      example.RecvqProtection = "0400";
+      description = ''
+        Attribute set of lines for the global
+        hfaxd config file <filename>etc/hfaxd.conf</filename>.
+        ${commonDescr}
+      '';
+    };
+
+    faxqConfig = mkOption {
+      type = configAttrType;
+      example = {
+        InternationalPrefix = "00";
+        LongDistancePrefix = "0";
+      };
+      description = ''
+        Attribute set of lines for the global
+        faxq config file <filename>etc/config</filename>.
+        ${commonDescr}
+      '';
+    };
+
+    commonModemConfig = mkOption {
+      type = configAttrType;
+      example = {
+        InternationalPrefix = "00";
+        LongDistancePrefix = "0";
+      };
+      description = ''
+        Attribute set of default values for
+        modem config files <filename>etc/config.*</filename>.
+        ${commonDescr}
+        Think twice before changing
+        paths of fax-processing scripts.
+      '';
+    };
+
+    modems = mkOption {
+      type = loaOf (submodule [ modemConfigOptions ]);
+      default = {};
+      example.ttyS1 = {
+        type = "cirrus";
+        config = {
+          FAXNumber = "123456";
+          LocalIdentifier = "Smith";
+        };
+      };
+      description = ''
+        Description of installed modems.
+        At least on modem must be defined
+        to enable the HylaFAX server.
+      '';
+    };
+
+    spoolExtraInit = mkOption {
+      type = lines;
+      default = "";
+      example = ''chmod 0755 .  # everyone may read my faxes'';
+      description = ''
+        Additional shell code that is executed within the
+        spooling area directory right after its setup.
+      '';
+    };
+
+    faxcron.enable.spoolInit = mkEnableOption ''
+      Purge old files from the spooling area with
+      <filename>faxcron</filename>
+      each time the spooling area is initialized.
+    '';
+    faxcron.enable.frequency = mkOption {
+      type = nullOr str1;
+      default = null;
+      example = "daily";
+      description = ''
+        Purge old files from the spooling area with
+        <filename>faxcron</filename> with the given frequency
+        (see systemd.time(7)).
+      '';
+    };
+    faxcron.infoDays = mkOption {
+      type = int1;
+      default = 30;
+      description = ''
+        Set the expiration time for data in the
+        remote machine information directory in days.
+      '';
+    };
+    faxcron.logDays = mkOption {
+      type = int1;
+      default = 30;
+      description = ''
+        Set the expiration time for
+        session trace log files in days.
+      '';
+    };
+    faxcron.rcvDays = mkOption {
+      type = int1;
+      default = 7;
+      description = ''
+        Set the expiration time for files in
+        the received facsimile queue in days.
+      '';
+    };
+
+    faxqclean.enable.spoolInit = mkEnableOption ''
+      Purge old files from the spooling area with
+      <filename>faxqclean</filename>
+      each time the spooling area is initialized.
+    '';
+    faxqclean.enable.frequency = mkOption {
+      type = nullOr str1;
+      default = null;
+      example = "daily";
+      description = ''
+        Purge old files from the spooling area with
+        <filename>faxcron</filename> with the given frequency
+        (see systemd.time(7)).
+      '';
+    };
+    faxqclean.archiving = mkOption {
+      type = enum [ "never" "as-flagged" "always" ];
+      default = "as-flagged";
+      example = "always";
+      description = ''
+        Enable or suppress job archiving:
+        <literal>never</literal> disables job archiving,
+        <literal>as-flagged</literal> archives jobs that
+        have been flagged for archiving by sendfax,
+        <literal>always</literal> forces archiving of all jobs.
+        See also sendfax(1) and faxqclean(8).
+      '';
+    };
+    faxqclean.doneqMinutes = mkOption {
+      type = int1;
+      default = 15;
+      example = literalExample ''24*60'';
+      description = ''
+        Set the job
+        age threshold (in minutes) that controls how long
+        jobs may reside in the doneq directory.
+      '';
+    };
+    faxqclean.docqMinutes = mkOption {
+      type = int1;
+      default = 60;
+      example = literalExample ''24*60'';
+      description = ''
+        Set the document
+        age threshold (in minutes) that controls how long
+        unreferenced files may reside in the docq directory.
+      '';
+    };
+
+  };
+
+
+  config.services.hylafax =
+    mkIf
+    (config.services.hylafax.enable)
+    (mkMerge [ defaultConfig localConfig ])
+  ;
+
+}

nixos/modules/services/networking/hylafax/spool.sh

@@ -0,0 +1,111 @@
+#! @shell@ -e
+
+# The following lines create/update the HylaFAX spool directory:
+# Subdirectories/files with persistent data are kept,
+# other directories/files are removed/recreated,
+# mostly from the template spool
+# directory in the HylaFAX package.
+
+# This block explains how the spool area is
+# derived from the spool template in the HylaFAX package:
+#
+#                  + capital letter: directory; file otherwise
+#                  + P/p: persistent directory
+#                  + F/f: directory with symlinks per entry
+#                  + T/t: temporary data
+#                  + S/s: single symlink into package
+#                  |
+#                  | + u: change ownership to uucp:uucp
+#                  | + U: ..also change access mode to user-only
+#                  | |
+# archive          P U
+# bin              S
+# client           T u  (client connection info)
+# config           S
+# COPYRIGHT        s
+# dev              T u  (maybe some FIFOs)
+# docq             P U
+# doneq            P U
+# etc              F    contains customized config files!
+# etc/hosts.hfaxd  f
+# etc/xferfaxlog   f
+# info             P u  (database of called devices)
+# log              P u  (communication logs)
+# pollq            P U
+# recvq            P u
+# sendq            P U
+# status           T u  (modem status info files)
+# tmp              T U
+
+
+shopt -s dotglob  # if bash sees "*", it also includes dot files
+lnsym () { ln --symbol "$@" ; }
+lnsymfrc () { ln --symbolic --force "$@" ; }
+cprd () { cp --remove-destination "$@" ; }
+update () { install --owner=@faxuser@ --group=@faxgroup@ "$@" ; }
+
+
+## create/update spooling area
+
+update --mode=0750 -d "@spoolAreaPath@"
+cd "@spoolAreaPath@"
+
+persist=(archive docq doneq info log pollq recvq sendq)
+
+# remove entries that don't belong here
+touch dummy  # ensure "*" resolves to something
+for k in *
+do
+  keep=0
+  for j in "${persist[@]}" xferfaxlog clientlog faxcron.lastrun
+  do
+    if test "$k" == "$j"
+    then
+      keep=1
+      break
+    fi
+  done
+  if test "$keep" == "0"
+  then
+    rm --recursive "$k"
+  fi
+done
+
+# create persistent data directories (unless they exist already)
+update --mode=0700 -d "${persist[@]}"
+chmod 0755 info log recvq
+
+# create ``xferfaxlog``, ``faxcron.lastrun``, ``clientlog``
+touch clientlog faxcron.lastrun xferfaxlog
+chown @faxuser@:@faxgroup@ clientlog faxcron.lastrun xferfaxlog
+
+# create symlinks for frozen directories/files
+lnsym --target-directory=. "@hylafax@"/spool/{COPYRIGHT,bin,config}
+
+# create empty temporary directories
+update --mode=0700 -d client dev status
+update -d tmp
+
+
+## create and fill etc
+
+install -d "@spoolAreaPath@/etc"
+cd "@spoolAreaPath@/etc"
+
+# create symlinks to all files in template's etc
+lnsym --target-directory=. "@hylafax@/spool/etc"/*
+
+# set LOCKDIR in setup.cache
+sed --regexp-extended 's|^(UUCP_LOCKDIR=).*$|\1'"'@lockPath@'|g" --in-place setup.cache
+
+# etc/{xferfaxlog,lastrun} are stored in the spool root
+lnsymfrc --target-directory=. ../xferfaxlog
+lnsymfrc --no-target-directory ../faxcron.lastrun lastrun
+
+# etc/hosts.hfaxd is provided by the NixOS configuration
+lnsymfrc --no-target-directory "@userAccessFile@" hosts.hfaxd
+
+# etc/config and etc/config.${DEVID} must be copied:
+# hfaxd reads these file after locking itself up in a chroot
+cprd --no-target-directory "@globalConfigPath@" config
+cprd --target-directory=. "@modemConfigPath@"/*

nixos/modules/services/networking/hylafax/systemd.nix

@@ -0,0 +1,249 @@
+{ config, lib, pkgs, ... }:
+
+
+let
+
+  inherit (lib) mkIf mkMerge;
+  inherit (lib) concatStringsSep optionalString;
+
+  cfg = config.services.hylafax;
+  mapModems = lib.flip map (lib.attrValues cfg.modems);
+
+  mkConfigFile = name: conf:
+    # creates hylafax config file,
+    # makes sure "Include" is listed *first*
+    let
+      mkLines = conf:
+        (lib.concatLists
+        (lib.flip lib.mapAttrsToList conf
+        (k: map (v: ''${k}: ${v}'')
+      )));
+      include = mkLines { Include = conf.Include or []; };
+      other = mkLines ( conf // { Include = []; } );
+    in
+      pkgs.writeText ''hylafax-config${name}''
+      (concatStringsSep "\n" (include ++ other));
+
+  globalConfigPath = mkConfigFile "" cfg.faxqConfig;
+
+  modemConfigPath =
+    let
+      mkModemConfigFile = { config, name, ... }:
+        mkConfigFile ''.${name}''
+        (cfg.commonModemConfig // config);
+      mkLine = { name, type, ... }@modem: ''
+        # check if modem config file exists:
+        test -f "${pkgs.hylafaxplus}/spool/config/${type}"
+        ln \
+          --symbolic \
+          --no-target-directory \
+          "${mkModemConfigFile modem}" \
+          "$out/config.${name}"
+      '';
+    in
+      pkgs.runCommand "hylafax-config-modems" {}
+      ''mkdir --parents "$out/" ${concatStringsSep "\n" (mapModems mkLine)}'';
+
+  setupSpoolScript = pkgs.substituteAll {
+    name = "hylafax-setup-spool.sh";
+    src = ./spool.sh;
+    isExecutable = true;
+    inherit (pkgs.stdenv) shell;
+    hylafax = pkgs.hylafaxplus;
+    faxuser = "uucp";
+    faxgroup = "uucp";
+    lockPath = "/var/lock";
+    inherit globalConfigPath modemConfigPath;
+    inherit (cfg) sendmailPath spoolAreaPath userAccessFile;
+  };
+
+  waitFaxqScript = pkgs.substituteAll {
+    # This script checks the modems status files
+    # and waits until all modems report readiness.
+    name = "hylafax-faxq-wait-start.sh";
+    src = ./faxq-wait.sh;
+    isExecutable = true;
+    timeoutSec = toString 10;
+    inherit (pkgs.stdenv) shell;
+    inherit (cfg) spoolAreaPath;
+  };
+
+  sockets."hylafax-hfaxd" = {
+    description = "HylaFAX server socket";
+    documentation = [ "man:hfaxd(8)" ];
+    wantedBy = [ "multi-user.target" ];
+    listenStreams = [ "127.0.0.1:4559" ];
+    socketConfig.FreeBind = true;
+    socketConfig.Accept = true;
+  };
+
+  paths."hylafax-faxq" = {
+    description = "HylaFAX queue manager sendq watch";
+    documentation = [ "man:faxq(8)" "man:sendq(5)" ];
+    wantedBy = [ "multi-user.target" ];
+    pathConfig.PathExistsGlob = [ ''${cfg.spoolAreaPath}/sendq/q*'' ];
+  };
+
+  timers = mkMerge [
+    (
+      mkIf (cfg.faxcron.enable.frequency!=null)
+      { "hylafax-faxcron".timerConfig.Persistent = true; }
+    )
+    (
+      mkIf (cfg.faxqclean.enable.frequency!=null)
+      { "hylafax-faxqclean".timerConfig.Persistent = true; }
+    )
+  ];
+
+  hardenService =
+    # Add some common systemd service hardening settings,
+    # but allow each service (here) to override
+    # settings by explicitely setting those to `null`.
+    # More hardening would be nice but makes
+    # customizing hylafax setups very difficult.
+    # If at all, it should only be added along
+    # with some options to customize it.
+    let
+      hardening = {
+        PrivateDevices = true;  # breaks /dev/tty...
+        PrivateNetwork = true;
+        PrivateTmp = true;
+        ProtectControlGroups = true;
+        #ProtectHome = true;  # breaks custom spool dirs
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        #ProtectSystem = "strict";  # breaks custom spool dirs
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+      };
+      filter = key: value: (value != null) || ! (lib.hasAttr key hardening);
+      apply = service: lib.filterAttrs filter (hardening // (service.serviceConfig or {}));
+    in
+      service: service // { serviceConfig = apply service; };
+
+  services."hylafax-spool" = {
+    description = "HylaFAX spool area preparation";
+    documentation = [ "man:hylafax-server(4)" ];
+    script = ''
+      ${setupSpoolScript}
+      cd "${cfg.spoolAreaPath}"
+      ${cfg.spoolExtraInit}
+      if ! test -f "${cfg.spoolAreaPath}/etc/hosts.hfaxd"
+      then
+        echo hosts.hfaxd is missing
+        exit 1
+      fi
+    '';
+    serviceConfig.ExecStop = ''${setupSpoolScript}'';
+    serviceConfig.RemainAfterExit = true;
+    serviceConfig.Type = "oneshot";
+    unitConfig.RequiresMountsFor = [ cfg.spoolAreaPath ];
+  };
+
+  services."hylafax-faxq" = {
+    description = "HylaFAX queue manager";
+    documentation = [ "man:faxq(8)" ];
+    requires = [ "hylafax-spool.service" ];
+    after = [ "hylafax-spool.service" ];
+    wants = mapModems ( { name, ... }: ''hylafax-faxgetty@${name}.service'' );
+    wantedBy = mkIf cfg.autostart [ "multi-user.target" ];
+    serviceConfig.Type = "forking";
+    serviceConfig.ExecStart = ''${pkgs.hylafaxplus}/spool/bin/faxq -q "${cfg.spoolAreaPath}"'';
+    # This delays the "readiness" of this service until
+    # all modems are initialized (or a timeout is reached).
+    # Otherwise, sending a fax with the fax service
+    # stopped will always yield a failed send attempt:
+    # The fax service is started when the job is created with
+    # `sendfax`, but modems need some time to initialize.
+    serviceConfig.ExecStartPost = [ ''${waitFaxqScript}'' ];
+    # faxquit fails if the pipe is already gone
+    # (e.g. the service is already stopping)
+    serviceConfig.ExecStop = ''-${pkgs.hylafaxplus}/spool/bin/faxquit -q "${cfg.spoolAreaPath}"'';
+    # disable some systemd hardening settings
+    serviceConfig.PrivateDevices = null;
+    serviceConfig.RestrictRealtime = null;
+  };
+
+  services."hylafax-hfaxd@" = {
+    description = "HylaFAX server";
+    documentation = [ "man:hfaxd(8)" ];
+    after = [ "hylafax-faxq.service" ];
+    requires = [ "hylafax-faxq.service" ];
+    serviceConfig.StandardInput = "socket";
+    serviceConfig.StandardOutput = "socket";
+    serviceConfig.ExecStart = ''${pkgs.hylafaxplus}/spool/bin/hfaxd -q "${cfg.spoolAreaPath}" -d -I'';
+    unitConfig.RequiresMountsFor = [ cfg.userAccessFile ];
+    # disable some systemd hardening settings
+    serviceConfig.PrivateDevices = null;
+    serviceConfig.PrivateNetwork = null;
+  };
+
+  services."hylafax-faxcron" = rec {
+    description = "HylaFAX spool area maintenance";
+    documentation = [ "man:faxcron(8)" ];
+    after = [ "hylafax-spool.service" ];
+    requires = [ "hylafax-spool.service" ];
+    wantedBy = mkIf cfg.faxcron.enable.spoolInit requires;
+    startAt = mkIf (cfg.faxcron.enable.frequency!=null) cfg.faxcron.enable.frequency;
+    serviceConfig.ExecStart = concatStringsSep " " [
+      ''${pkgs.hylafaxplus}/spool/bin/faxcron''
+      ''-q "${cfg.spoolAreaPath}"''
+      ''-info ${toString cfg.faxcron.infoDays}''
+      ''-log  ${toString cfg.faxcron.logDays}''
+      ''-rcv  ${toString cfg.faxcron.rcvDays}''
+    ];
+  };
+
+  services."hylafax-faxqclean" = rec {
+    description = "HylaFAX spool area queue cleaner";
+    documentation = [ "man:faxqclean(8)" ];
+    after = [ "hylafax-spool.service" ];
+    requires = [ "hylafax-spool.service" ];
+    wantedBy = mkIf cfg.faxqclean.enable.spoolInit requires;
+    startAt = mkIf (cfg.faxqclean.enable.frequency!=null) cfg.faxqclean.enable.frequency;
+    serviceConfig.ExecStart = concatStringsSep " " [
+      ''${pkgs.hylafaxplus}/spool/bin/faxqclean''
+      ''-q "${cfg.spoolAreaPath}"''
+      ''-v''
+      (optionalString (cfg.faxqclean.archiving!="never") ''-a'')
+      (optionalString (cfg.faxqclean.archiving=="always")  ''-A'')
+      ''-j ${toString (cfg.faxqclean.doneqMinutes*60)}''
+      ''-d ${toString (cfg.faxqclean.docqMinutes*60)}''
+    ];
+  };
+
+  mkFaxgettyService = { name, ... }:
+    lib.nameValuePair ''hylafax-faxgetty@${name}'' rec {
+      description = "HylaFAX faxgetty for %I";
+      documentation = [ "man:faxgetty(8)" ];
+      bindsTo = [ "dev-%i.device" ];
+      requires = [ "hylafax-spool.service" ];
+      after = bindsTo ++ requires;
+      before = [ "hylafax-faxq.service" "getty.target" ];
+      unitConfig.StopWhenUnneeded = true;
+      unitConfig.AssertFileNotEmpty = ''${cfg.spoolAreaPath}/etc/config.%I'';
+      serviceConfig.UtmpIdentifier = "%I";
+      serviceConfig.TTYPath = "/dev/%I";
+      serviceConfig.Restart = "always";
+      serviceConfig.KillMode = "process";
+      serviceConfig.IgnoreSIGPIPE = false;
+      serviceConfig.ExecStart = ''-${pkgs.hylafaxplus}/spool/bin/faxgetty -q "${cfg.spoolAreaPath}" /dev/%I'';
+      # faxquit fails if the pipe is already gone
+      # (e.g. the service is already stopping)
+      serviceConfig.ExecStop = ''-${pkgs.hylafaxplus}/spool/bin/faxquit -q "${cfg.spoolAreaPath}" %I'';
+      # disable some systemd hardening settings
+      serviceConfig.PrivateDevices = null;
+      serviceConfig.RestrictRealtime = null;
+    };
+
+  modemServices =
+    lib.listToAttrs (mapModems mkFaxgettyService);
+
+in
+
+{
+  config.systemd = mkIf cfg.enable {
+    inherit sockets timers paths;
+    services = lib.mapAttrs (lib.const hardenService) (services // modemServices);
+  };
+}

nixos/modules/services/networking/i2pd.nix

@@ -8,6 +8,17 @@ let
 
   homeDir = "/var/lib/i2pd";
 
+  strOpt = k: v: k + " = " + v;
+  boolOpt = k: v: k + " = " + boolToString v;
+  intOpt = k: v: k + " = " + toString v;
+  lstOpt = k: xs: k + " = " + concatStringsSep "," xs;
+  optionalNullString = o: s: optional (! isNull s) (strOpt o s);
+  optionalNullBool = o: b: optional (! isNull b) (boolOpt o b);
+  optionalNullInt = o: i: optional (! isNull i) (intOpt o i);
+  optionalEmptyList = o: l: optional ([] != l) (lstOpt o l);
+
+  mkEnableTrueOption = name: mkEnableOption name // { default = true; };
+
   mkEndpointOpt = name: addr: port: {
     enable = mkEnableOption name;
     name = mkOption {
@@ -18,42 +29,54 @@ let
     address = mkOption {
       type = types.str;
       default = addr;
-      description = "Bind address for ${name} endpoint. Default: " + addr;
+      description = "Bind address for ${name} endpoint.";
     };
     port = mkOption {
       type = types.int;
       default = port;
-      description = "Bind port for ${name} endoint. Default: " + toString port;
+      description = "Bind port for ${name} endoint.";
     };
   };
 
-  mkKeyedEndpointOpt = name: addr: port: keyFile:
+  i2cpOpts = name: {
+    length = mkOption {
+      type = types.int;
+      description = "Guaranteed minimum hops for ${name} tunnels.";
+      default = 3;
+    };
+    quantity = mkOption {
+      type = types.int;
+      description = "Number of simultaneous ${name} tunnels.";
+      default = 5;
+    };
+  };
+
+  mkKeyedEndpointOpt = name: addr: port: keyloc:
     (mkEndpointOpt name addr port) // {
       keys = mkOption {
-        type = types.str;
+        type = with types; nullOr str;
-        default = "";
+        default = keyloc;
         description = ''
           File to persist ${lib.toUpper name} keys.
         '';
       };
+      inbound = i2cpOpts name;
+      outbound = i2cpOpts name;
+      latency.min = mkOption {
+        type = with types; nullOr int;
+        description = "Min latency for tunnels.";
+        default = null;
+      };
+      latency.max = mkOption {
+        type = with types; nullOr int;
+        description = "Max latency for tunnels.";
+        default = null;
+      };
     };
 
-  commonTunOpts = let
+  commonTunOpts = name: {
-    i2cpOpts = {
+    outbound = i2cpOpts name;
-      length = mkOption {
+    inbound = i2cpOpts name;
-        type = types.int;
-        description = "Guaranteed minimum hops.";
-        default = 3;
-      };
-      quantity = mkOption {
-        type = types.int;
-        description = "Number of simultaneous tunnels.";
-        default = 5;
-      };
-    };
-  in name: {
-    outbound = i2cpOpts;
-    inbound = i2cpOpts;
     crypto.tagsToSend = mkOption {
       type = types.int;
       description = "Number of ElGamal/AES tags to send.";
@@ -70,94 +93,142 @@ let
     };
   } // mkEndpointOpt name "127.0.0.1" 0;
 
-  i2pdConf = pkgs.writeText "i2pd.conf" ''
+  sec = name: "\n[" + name + "]";
-    # DO NOT EDIT -- this file has been generated automatically.
+  notice = "# DO NOT EDIT -- this file has been generated automatically.";
-    loglevel = ${cfg.logLevel}
+  i2pdConf = let
-
+    opts = [
-    ipv4 = ${boolToString cfg.enableIPv4}
+      notice
-    ipv6 = ${boolToString cfg.enableIPv6}
+      (strOpt "loglevel" cfg.logLevel)
-    notransit = ${boolToString cfg.notransit}
+      (boolOpt "logclftime" cfg.logCLFTime)
-    floodfill = ${boolToString cfg.floodfill}
+      (boolOpt "ipv4" cfg.enableIPv4)
-    netid = ${toString cfg.netid}
+      (boolOpt "ipv6" cfg.enableIPv6)
-    ${if isNull cfg.bandwidth then "" else "bandwidth = ${toString cfg.bandwidth}" }
+      (boolOpt "notransit" cfg.notransit)
-    ${if isNull cfg.port then "" else "port = ${toString cfg.port}"}
+      (boolOpt "floodfill" cfg.floodfill)
-
+      (intOpt "netid" cfg.netid)
-    [limits]
+    ] ++ (optionalNullInt "bandwidth" cfg.bandwidth)
-    transittunnels = ${toString cfg.limits.transittunnels}
+      ++ (optionalNullInt "port" cfg.port)
-
+      ++ (optionalNullString "family" cfg.family)
-    [upnp]
+      ++ (optionalNullString "datadir" cfg.dataDir)
-    enabled = ${boolToString cfg.upnp.enable}
+      ++ (optionalNullInt "share" cfg.share)
-    name = ${cfg.upnp.name}
+      ++ (optionalNullBool "ssu" cfg.ssu)
-
+      ++ (optionalNullBool "ntcp" cfg.ntcp)
-    [precomputation]
+      ++ (optionalNullString "ntcpproxy" cfg.ntcpProxy)
-    elgamal = ${boolToString cfg.precomputation.elgamal}
+      ++ (optionalNullString "ifname" cfg.ifname)
-
+      ++ (optionalNullString "ifname4" cfg.ifname4)
-    [reseed]
+      ++ (optionalNullString "ifname6" cfg.ifname6)
-    verify = ${boolToString cfg.reseed.verify}
+      ++ [
-    file = ${cfg.reseed.file}
+      (sec "limits")
-    urls = ${builtins.concatStringsSep "," cfg.reseed.urls}
+      (intOpt "transittunnels" cfg.limits.transittunnels)
-
+      (intOpt "coresize" cfg.limits.coreSize)
-    [addressbook]
+      (intOpt "openfiles" cfg.limits.openFiles)
-    defaulturl = ${cfg.addressbook.defaulturl}
+      (intOpt "ntcphard" cfg.limits.ntcpHard)
-    subscriptions = ${builtins.concatStringsSep "," cfg.addressbook.subscriptions}
+      (intOpt "ntcpsoft" cfg.limits.ntcpSoft)
-
+      (intOpt "ntcpthreads" cfg.limits.ntcpThreads)
-    ${flip concatMapStrings
+      (sec "upnp")
+      (boolOpt "enabled" cfg.upnp.enable)
+      (sec "precomputation")
+      (boolOpt "elgamal" cfg.precomputation.elgamal)
+      (sec "reseed")
+      (boolOpt "verify" cfg.reseed.verify)
+    ] ++ (optionalNullString "file" cfg.reseed.file)
+      ++ (optionalEmptyList "urls" cfg.reseed.urls)
+      ++ (optionalNullString "floodfill" cfg.reseed.floodfill)
+      ++ (optionalNullString "zipfile" cfg.reseed.zipfile)
+      ++ (optionalNullString "proxy" cfg.reseed.proxy)
+      ++ [
+      (sec "trust")
+      (boolOpt "enabled" cfg.trust.enable)
+      (boolOpt "hidden" cfg.trust.hidden)
+    ] ++ (optionalEmptyList "routers" cfg.trust.routers)
+      ++ (optionalNullString "family" cfg.trust.family)
+      ++ [
+      (sec "websockets")
+      (boolOpt "enabled" cfg.websocket.enable)
+      (strOpt "address" cfg.websocket.address)
+      (intOpt "port" cfg.websocket.port)
+      (sec "exploratory")
+      (intOpt "inbound.length" cfg.exploratory.inbound.length)
+      (intOpt "inbound.quantity" cfg.exploratory.inbound.quantity)
+      (intOpt "outbound.length" cfg.exploratory.outbound.length)
+      (intOpt "outbound.quantity" cfg.exploratory.outbound.quantity)
+      (sec "ntcp2")
+      (boolOpt "enabled" cfg.ntcp2.enable)
+      (boolOpt "published" cfg.ntcp2.published)
+      (intOpt "port" cfg.ntcp2.port)
+      (sec "addressbook")
+      (strOpt "defaulturl" cfg.addressbook.defaulturl)
+    ] ++ (optionalEmptyList "subscriptions" cfg.addressbook.subscriptions)
+      ++ (flip map
       (collect (proto: proto ? port && proto ? address && proto ? name) cfg.proto)
-      (proto: ''
+      (proto: let protoOpts = [
-        [${proto.name}]
+        (sec proto.name)
-        enabled = ${boolToString proto.enable}
+        (boolOpt "enabled" proto.enable)
-        address = ${proto.address}
+        (strOpt "address" proto.address)
-        port = ${toString proto.port}
+        (intOpt "port" proto.port)
-        ${if proto ? keys then "keys = ${proto.keys}" else ""}
+        ] ++ (if proto ? keys then optionalNullString "keys" proto.keys else [])
-        ${if proto ? auth then "auth = ${boolToString proto.auth}" else ""}
+        ++ (if proto ? auth then optionalNullBool "auth" proto.auth else [])
-        ${if proto ? user then "user = ${proto.user}" else ""}
+        ++ (if proto ? user then optionalNullString "user" proto.user else [])
-        ${if proto ? pass then "pass = ${proto.pass}" else ""}
+        ++ (if proto ? pass then optionalNullString "pass" proto.pass else [])
-        ${if proto ? outproxy then "outproxy = ${proto.outproxy}" else ""}
+        ++ (if proto ? strictHeaders then optionalNullBool "strictheaders" proto.strictHeaders else [])
-        ${if proto ? outproxyPort then "outproxyport = ${toString proto.outproxyPort}" else ""}
+        ++ (if proto ? hostname then optionalNullString "hostname" proto.hostname else [])
-      '')
+        ++ (if proto ? outproxy then optionalNullString "outproxy" proto.outproxy else [])
-    }
+        ++ (if proto ? outproxyPort then optionalNullInt "outproxyport" proto.outproxyPort else [])
-  '';
+        ++ (if proto ? outproxyEnable then optionalNullBool "outproxy.enabled" proto.outproxyEnable else []);
+        in (concatStringsSep "\n" protoOpts)
+      ));
+  in
+    pkgs.writeText "i2pd.conf" (concatStringsSep "\n" opts);
 
-  i2pdTunnelConf = pkgs.writeText "i2pd-tunnels.conf" ''
+  tunnelConf = let opts = [
-    # DO NOT EDIT -- this file has been generated automatically.
+    notice
-    ${flip concatMapStrings
+    (flip map
       (collect (tun: tun ? port && tun ? destination) cfg.outTunnels)
-      (tun: ''
+      (tun: let outTunOpts = [
-        [${tun.name}]
+        (sec tun.name)
-        type = client
+        "type = client"
-        destination = ${tun.destination}
+        (intOpt "port" tun.port)
-        destinationport = ${toString tun.destinationPort}
+        (strOpt "destination" tun.destination)
-        keys = ${tun.keys}
+        ] ++ (if tun ? destinationPort then optionalNullInt "destinationport" tun.destinationPort else [])
-        address = ${tun.address}
+        ++ (if tun ? keys then
-        port = ${toString tun.port}
+            optionalNullString "keys" tun.keys else [])
-        inbound.length = ${toString tun.inbound.length}
+        ++ (if tun ? address then
-        outbound.length = ${toString tun.outbound.length}
+            optionalNullString "address" tun.address else [])
-        inbound.quantity = ${toString tun.inbound.quantity}
+        ++ (if tun ? inbound.length then
-        outbound.quantity = ${toString tun.outbound.quantity}
+            optionalNullInt "inbound.length" tun.inbound.length else [])
-        crypto.tagsToSend = ${toString tun.crypto.tagsToSend}
+        ++ (if tun ? inbound.quantity then
-      '')
+            optionalNullInt "inbound.quantity" tun.inbound.quantity else [])
-    }
+        ++ (if tun ? outbound.length then
-    ${flip concatMapStrings
+            optionalNullInt "outbound.length" tun.outbound.length else [])
+        ++ (if tun ? outbound.quantity then
+            optionalNullInt "outbound.quantity" tun.outbound.quantity else [])
+        ++ (if tun ? crypto.tagsToSend then
+            optionalNullInt "crypto.tagstosend" tun.crypto.tagsToSend else []);
+        in concatStringsSep "\n" outTunOpts))
+    (flip map
       (collect (tun: tun ? port && tun ? address) cfg.inTunnels)
-      (tun: ''
+      (tun: let inTunOpts = [
-        [${tun.name}]
+        (sec tun.name)
-        type = server
+        "type = server"
-        destination = ${tun.destination}
+        (intOpt "port" tun.port)
-        keys = ${tun.keys}
+        (strOpt "host" tun.address)
-        host = ${tun.address}
+      ] ++ (if tun ? destination then
-        port = ${toString tun.port}
+            optionalNullString "destination" tun.destination else [])
-        inport = ${toString tun.inPort}
+        ++ (if tun ? keys then
-        accesslist = ${builtins.concatStringsSep "," tun.accessList}
+            optionalNullString "keys" tun.keys else [])
-      '')
+        ++ (if tun ? inPort then
-    }
+            optionalNullInt "inport" tun.inPort else [])
-  '';
+        ++ (if tun ? accessList then
+            optionalEmptyList "accesslist" tun.accessList else []);
+        in concatStringsSep "\n" inTunOpts))];
+    in pkgs.writeText "i2pd-tunnels.conf" opts;
 
   i2pdSh = pkgs.writeScriptBin "i2pd" ''
     #!/bin/sh
     exec ${pkgs.i2pd}/bin/i2pd \
       ${if isNull cfg.address then "" else "--host="+cfg.address} \
+      --service \
       --conf=${i2pdConf} \
-      --tunconf=${i2pdTunnelConf}
+      --tunconf=${tunnelConf}
   '';
 
 in
@@ -170,9 +241,7 @@ in
 
     services.i2pd = {
 
-      enable = mkOption {
+      enable = mkEnableOption "I2Pd daemon" // {
-        type = types.bool;
-        default = false;
         description = ''
           Enables I2Pd as a running service upon activation.
           Please read http://i2pd.readthedocs.io/en/latest/ for further
@@ -192,6 +261,8 @@ in
         '';
       };
 
+      logCLFTime = mkEnableOption "Full CLF-formatted date and time to log";
+
       address = mkOption {
         type = with types; nullOr str;
         default = null;
@@ -200,17 +271,72 @@ in
         '';
       };
 
-      notransit = mkOption {
+      family = mkOption {
-        type = types.bool;
+        type = with types; nullOr str;
-        default = false;
+        default = null;
+        description = ''
+          Specify a family the router belongs to.
+        '';
+      };
+
+      dataDir = mkOption {
+        type = with types; nullOr str;
+        default = null;
+        description = ''
+          Alternative path to storage of i2pd data (RI, keys, peer profiles, ...)
+        '';
+      };
+
+      share = mkOption {
+        type = types.int;
+        default = 100;
+        description = ''
+          Limit of transit traffic from max bandwidth in percents.
+        '';
+      };
+
+      ifname = mkOption {
+        type = with types; nullOr str;
+        default = null;
+        description = ''
+          Network interface to bind to.
+        '';
+      };
+
+      ifname4 = mkOption {
+        type = with types; nullOr str;
+        default = null;
+        description = ''
+          IPv4 interface to bind to.
+        '';
+      };
+
+      ifname6 = mkOption {
+        type = with types; nullOr str;
+        default = null;
+        description = ''
+          IPv6 interface to bind to.
+        '';
+      };
+
+      ntcpProxy = mkOption {
+        type = with types; nullOr str;
+        default = null;
+        description = ''
+          Proxy URL for NTCP transport.
+        '';
+      };
+
+      ntcp = mkEnableTrueOption "ntcp";
+      ssu = mkEnableTrueOption "ssu";
+
+      notransit = mkEnableOption "notransit" // {
         description = ''
           Tells the router to not accept transit tunnels during startup.
         '';
       };
 
-      floodfill = mkOption {
+      floodfill = mkEnableOption "floodfill" // {
-        type = types.bool;
-        default = false;
         description = ''
           If the router is declared to be unreachable and needs introduction nodes.
         '';
@@ -241,51 +367,20 @@ in
         '';
       };
 
-      enableIPv4 = mkOption {
+      enableIPv4 = mkEnableTrueOption "IPv4 connectivity";
-        type = types.bool;
+      enableIPv6 = mkEnableOption "IPv6 connectivity";
-        default = true;
+      nat = mkEnableTrueOption "NAT bypass";
+
+      upnp.enable = mkEnableOption "UPnP service discovery";
+      upnp.name = mkOption {
+        type = types.str;
+        default = "I2Pd";
         description = ''
-          Enables IPv4 connectivity. Enabled by default.
+          Name i2pd appears in UPnP forwardings list.
         '';
       };
 
-      enableIPv6 = mkOption {
+      precomputation.elgamal = mkEnableTrueOption "Precomputed ElGamal tables" // {
-        type = types.bool;
-        default = false;
-        description = ''
-          Enables IPv6 connectivity. Disabled by default.
-        '';
-      };
-
-      nat = mkOption {
-        type = types.bool;
-        default = true;
-        description = ''
-          Assume router is NATed. Enabled by default.
-        '';
-      };
-
-      upnp = {
-        enable = mkOption {
-          type = types.bool;
-          default = false;
-          description = ''
-            Enables UPnP.
-          '';
-        };
-
-        name = mkOption {
-          type = types.str;
-          default = "I2Pd";
-          description = ''
-            Name i2pd appears in UPnP forwardings list.
-          '';
-        };
-      };
-
-      precomputation.elgamal = mkOption {
-        type = types.bool;
-        default = true;
         description = ''
           Whenever to use precomputated tables for ElGamal.
           <command>i2pd</command> defaults to <literal>false</literal>
@@ -296,76 +391,154 @@ in
         '';
       };
 
-      reseed = {
+      reseed.verify = mkEnableOption "SU3 signature verification";
-        verify = mkOption {
-          type = types.bool;
-          default = false;
-          description = ''
-            Request SU3 signature verification
-          '';
-        };
 
-        file = mkOption {
+      reseed.file = mkOption {
-          type = types.str;
+        type = with types; nullOr str;
-          default = "";
+        default = null;
-          description = ''
+        description = ''
-            Full path to SU3 file to reseed from
+          Full path to SU3 file to reseed from.
-          '';
+        '';
-        };
-
-        urls = mkOption {
-          type = with types; listOf str;
-          default = [
-            "https://reseed.i2p-project.de/"
-            "https://i2p.mooo.com/netDb/"
-            "https://netdb.i2p2.no/"
-            "https://us.reseed.i2p2.no:444/"
-            "https://uk.reseed.i2p2.no:444/"
-            "https://i2p.manas.ca:8443/"
-          ];
-          description = ''
-            Reseed URLs
-          '';
-        };
       };
 
-      addressbook = {
+      reseed.urls = mkOption {
-       defaulturl = mkOption {
+        type = with types; listOf str;
-          type = types.str;
+        default = [];
-          default = "http://joajgazyztfssty4w2on5oaqksz6tqoxbduy553y34mf4byv6gpq.b32.i2p/export/alive-hosts.txt";
+        description = ''
-          description = ''
+          Reseed URLs.
-            AddressBook subscription URL for initial setup
+        '';
-          '';
+      };
-        };
+
-       subscriptions = mkOption {
+      reseed.floodfill = mkOption {
-          type = with types; listOf str;
+        type = with types; nullOr str;
-          default = [
+        default = null;
-            "http://inr.i2p/export/alive-hosts.txt"
+        description = ''
-            "http://i2p-projekt.i2p/hosts.txt"
+          Path to router info of floodfill to reseed from.
-            "http://stats.i2p/cgi-bin/newhosts.txt"
+        '';
-          ];
+      };
-          description = ''
+
-            AddressBook subscription URLs
+      reseed.zipfile = mkOption {
-          '';
+        type = with types; nullOr str;
-        };
+        default = null;
+        description = ''
+          Path to local .zip file to reseed from.
+        '';
+      };
+
+      reseed.proxy = mkOption {
+        type = with types; nullOr str;
+        default = null;
+        description = ''
+          URL for reseed proxy, supports http/socks.
+        '';
+      };
+
+     addressbook.defaulturl = mkOption {
+        type = types.str;
+        default = "http://joajgazyztfssty4w2on5oaqksz6tqoxbduy553y34mf4byv6gpq.b32.i2p/export/alive-hosts.txt";
+        description = ''
+          AddressBook subscription URL for initial setup
+        '';
+      };
+     addressbook.subscriptions = mkOption {
+        type = with types; listOf str;
+        default = [
+          "http://inr.i2p/export/alive-hosts.txt"
+          "http://i2p-projekt.i2p/hosts.txt"
+          "http://stats.i2p/cgi-bin/newhosts.txt"
+        ];
+        description = ''
+          AddressBook subscription URLs
+        '';
+      };
+
+      trust.enable = mkEnableOption "Explicit trust options";
+
+      trust.family = mkOption {
+        type = with types; nullOr str;
+        default = null;
+        description = ''
+          Router Familiy to trust for first hops.
+        '';
+      };
+
+      trust.routers = mkOption {
+        type = with types; listOf str;
+        default = [];
+        description = ''
+          Only connect to the listed routers.
+        '';
+      };
+
+      trust.hidden = mkEnableOption "Router concealment.";
+
+      websocket = mkEndpointOpt "websockets" "127.0.0.1" 7666;
+
+      exploratory.inbound = i2cpOpts "exploratory";
+      exploratory.outbound = i2cpOpts "exploratory";
+
+      ntcp2.enable = mkEnableTrueOption "NTCP2.";
+      ntcp2.published = mkEnableOption "NTCP2 publication.";
+      ntcp2.port = mkOption {
+        type = types.int;
+        default = 0;
+        description = ''
+          Port to listen for incoming NTCP2 connections (0=auto).
+        '';
       };
 
       limits.transittunnels = mkOption {
         type = types.int;
         default = 2500;
         description = ''
-          Maximum number of active transit sessions
+          Maximum number of active transit sessions.
+        '';
+      };
+
+      limits.coreSize = mkOption {
+        type = types.int;
+        default = 0;
+        description = ''
+          Maximum size of corefile in Kb (0 - use system limit).
+        '';
+      };
+
+      limits.openFiles = mkOption {
+        type = types.int;
+        default = 0;
+        description = ''
+          Maximum number of open files (0 - use system default).
+        '';
+      };
+
+      limits.ntcpHard = mkOption {
+        type = types.int;
+        default = 0;
+        description = ''
+          Maximum number of active transit sessions.
+        '';
+      };
+
+      limits.ntcpSoft = mkOption {
+        type = types.int;
+        default = 0;
+        description = ''
+          Threshold to start probabalistic backoff with ntcp sessions (default: use system limit).
+        '';
+      };
+
+      limits.ntcpThreads = mkOption {
+        type = types.int;
+        default = 1;
+        description = ''
+          Maximum number of threads used by NTCP DH worker.
         '';
       };
 
       proto.http = (mkEndpointOpt "http" "127.0.0.1" 7070) // {
-        auth = mkOption {
+
-          type = types.bool;
+        auth = mkEnableOption "Webconsole authentication";
-          default = false;
+
-          description = ''
-            Enable authentication for webconsole.
-          '';
-        };
         user = mkOption {
           type = types.str;
           default = "i2pd";
@@ -373,6 +546,7 @@ in
             Username for webconsole access
           '';
         };
+
         pass = mkOption {
           type = types.str;
           default = "i2pd";
@@ -380,11 +554,35 @@ in
             Password for webconsole access.
           '';
         };
+
+        strictHeaders = mkOption {
+          type = with types; nullOr bool;
+          default = null;
+          description = ''
+            Enable strict host checking on WebUI.
+          '';
+        };
+
+        hostname = mkOption {
+          type = with types; nullOr str;
+          default = null;
+          description = ''
+            Expected hostname for WebUI.
+          '';
+        };
       };
 
-      proto.httpProxy = mkKeyedEndpointOpt "httpproxy" "127.0.0.1" 4444 "";
+      proto.httpProxy = (mkKeyedEndpointOpt "httpproxy" "127.0.0.1" 4444 "httpproxy-keys.dat")
-      proto.socksProxy = (mkKeyedEndpointOpt "socksproxy" "127.0.0.1" 4447 "")
       // {
+        outproxy = mkOption {
+          type = with types; nullOr str;
+          default = null;
+          description = "Upstream outproxy bind address.";
+        };
+      };
+      proto.socksProxy = (mkKeyedEndpointOpt "socksproxy" "127.0.0.1" 4447 "socksproxy-keys.dat")
+      // {
+        outproxyEnable = mkEnableOption "SOCKS outproxy";
         outproxy = mkOption {
           type = types.str;
           default = "127.0.0.1";
@@ -408,8 +606,8 @@ in
           { name, ... }: {
             options = {
               destinationPort = mkOption {
-                type = types.int;
+                type = with types; nullOr int;
-                default = 0;
+                default = null;
                 description = "Connect to particular port at destination.";
               };
             } // commonTunOpts name;

nixos/modules/services/networking/networkmanager.nix

@@ -406,25 +406,25 @@ in {
       { source = configFile;
         target = "NetworkManager/NetworkManager.conf";
       }
-      { source = "${networkmanager-openvpn}/etc/NetworkManager/VPN/nm-openvpn-service.name";
+      { source = "${networkmanager-openvpn}/lib/NetworkManager/VPN/nm-openvpn-service.name";
         target = "NetworkManager/VPN/nm-openvpn-service.name";
       }
-      { source = "${networkmanager-vpnc}/etc/NetworkManager/VPN/nm-vpnc-service.name";
+      { source = "${networkmanager-vpnc}/lib/NetworkManager/VPN/nm-vpnc-service.name";
         target = "NetworkManager/VPN/nm-vpnc-service.name";
       }
-      { source = "${networkmanager-openconnect}/etc/NetworkManager/VPN/nm-openconnect-service.name";
+      { source = "${networkmanager-openconnect}/lib/NetworkManager/VPN/nm-openconnect-service.name";
         target = "NetworkManager/VPN/nm-openconnect-service.name";
       }
-      { source = "${networkmanager-fortisslvpn}/etc/NetworkManager/VPN/nm-fortisslvpn-service.name";
+      { source = "${networkmanager-fortisslvpn}/lib/NetworkManager/VPN/nm-fortisslvpn-service.name";
         target = "NetworkManager/VPN/nm-fortisslvpn-service.name";
       }
-      { source = "${networkmanager-l2tp}/etc/NetworkManager/VPN/nm-l2tp-service.name";
+      { source = "${networkmanager-l2tp}/lib/NetworkManager/VPN/nm-l2tp-service.name";
         target = "NetworkManager/VPN/nm-l2tp-service.name";
       }
-      { source = "${networkmanager_strongswan}/etc/NetworkManager/VPN/nm-strongswan-service.name";
+      { source = "${networkmanager_strongswan}/lib/NetworkManager/VPN/nm-strongswan-service.name";
         target = "NetworkManager/VPN/nm-strongswan-service.name";
       }
-      { source = "${networkmanager-iodine}/etc/NetworkManager/VPN/nm-iodine-service.name";
+      { source = "${networkmanager-iodine}/lib/NetworkManager/VPN/nm-iodine-service.name";
         target = "NetworkManager/VPN/nm-iodine-service.name";
       }
     ] ++ optional (cfg.appendNameservers == [] || cfg.insertNameservers == [])

nixos/modules/services/networking/zeronet.nix

@@ -12,6 +12,8 @@ let
       log_dir = ${cfg.logDir}
     '' + lib.optionalString (cfg.port != null) ''
       ui_port = ${toString cfg.port}
+    '' + lib.optionalString (cfg.torAlways) ''
+      tor = always
     '' + cfg.extraConfig;
   };
 in with lib; {
@@ -35,11 +37,17 @@ in with lib; {
     port = mkOption {
       type = types.nullOr types.int;
       default = null;
-      example = 15441;
+      example = 43110;
-      description = "Optional zeronet port.";
+      description = "Optional zeronet web UI port.";
     };
 
     tor = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Use TOR for zeronet traffic where possible.";
+    };
+
+    torAlways = mkOption {
       type = types.bool;
       default = false;
       description = "Use TOR for all zeronet traffic.";
@@ -60,7 +68,11 @@ in with lib; {
     services.tor = mkIf cfg.tor {
       enable = true;
       controlPort = 9051;
-      extraConfig = "CookieAuthentication 1";
+      extraConfig = ''
+        CacheDirectoryGroupReadable 1
+        CookieAuthentication 1
+        CookieAuthFileGroupReadable 1
+      '';
     };
 
     systemd.services.zeronet = {

nixos/modules/services/security/sks.nix

@@ -3,78 +3,112 @@
 with lib;
 
 let
-
   cfg = config.services.sks;
-
   sksPkg = cfg.package;
 
-in
+in {
-
+  meta.maintainers = with maintainers; [ primeos calbrecht jcumming ];
-{
 
   options = {
 
     services.sks = {
 
-      enable = mkEnableOption "sks";
+      enable = mkEnableOption ''
+        SKS (synchronizing key server for OpenPGP) and start the database
+        server. You need to create "''${dataDir}/dump/*.gpg" for the initial
+        import'';
 
       package = mkOption {
         default = pkgs.sks;
         defaultText = "pkgs.sks";
         type = types.package;
-        description = "
+        description = "Which SKS derivation to use.";
-          Which sks derivation to use.
+      };
-        ";
+
+      dataDir = mkOption {
+        type = types.path;
+        default = "/var/db/sks";
+        example = "/var/lib/sks";
+        # TODO: The default might change to "/var/lib/sks" as this is more
+        # common. There's also https://github.com/NixOS/nixpkgs/issues/26256
+        # and "/var/db" is not FHS compliant (seems to come from BSD).
+        description = ''
+          Data directory (-basedir) for SKS, where the database and all
+          configuration files are located (e.g. KDB, PTree, membership and
+          sksconf).
+        '';
       };
 
       hkpAddress = mkOption {
         default = [ "127.0.0.1" "::1" ];
         type = types.listOf types.str;
-        description = "
+        description = ''
-          Wich ip addresses the sks-keyserver is listening on.
+          Domain names, IPv4 and/or IPv6 addresses to listen on for HKP
-        ";
+          requests.
+        '';
       };
 
       hkpPort = mkOption {
         default = 11371;
-        type = types.int;
+        type = types.ints.u16;
-        description = "
+        description = "HKP port to listen on.";
-          Which port the sks-keyserver is listening on.
+      };
-        ";
+
+      webroot = mkOption {
+        type = types.nullOr types.path;
+        default = "${sksPkg.webSamples}/OpenPKG";
+        defaultText = "\${pkgs.sks.webSamples}/OpenPKG";
+        description = ''
+          Source directory (will be symlinked, if not null) for the files the
+          built-in webserver should serve. SKS (''${pkgs.sks.webSamples})
+          provides the following examples: "HTML5", "OpenPKG", and "XHTML+ES".
+          The index file can be named index.html, index.htm, index.xhtm, or
+          index.xhtml. Files with the extensions .css, .es, .js, .jpg, .jpeg,
+          .png, or .gif are supported. Subdirectories and filenames with
+          anything other than alphanumeric characters and the '.' character
+          will be ignored.
+        '';
       };
     };
   };
 
   config = mkIf cfg.enable {
 
-    environment.systemPackages = [ sksPkg ];
+    users = {
-    
+      users.sks = {
-    users.users.sks = {
+        isSystemUser = true;
-      createHome = true;
+        description = "SKS user";
-      home = "/var/db/sks";
+        home = cfg.dataDir;
-      isSystemUser = true;
+        createHome = true;
-      shell = "${pkgs.coreutils}/bin/true";
+        group = "sks";
+        useDefaultShell = true;
+        packages = [ sksPkg pkgs.db ];
+      };
+      groups.sks = { };
     };
 
     systemd.services = let
       hkpAddress = "'" + (builtins.concatStringsSep " " cfg.hkpAddress) + "'" ;
       hkpPort = builtins.toString cfg.hkpPort;
-      home = config.users.users.sks.home;
-      user = config.users.users.sks.name;
     in {
-      sks-keyserver = {
+      "sks-db" = {
+        description = "SKS database server";
+        after = [ "network.target" ];
         wantedBy = [ "multi-user.target" ];
         preStart = ''
-          mkdir -p ${home}/dump
+          ${lib.optionalString (cfg.webroot != null)
-          ${pkgs.sks}/bin/sks build ${home}/dump/*.gpg -n 10 -cache 100 || true #*/
+            "ln -sfT \"${cfg.webroot}\" web"}
-          ${pkgs.sks}/bin/sks cleandb || true
+          mkdir -p dump
-          ${pkgs.sks}/bin/sks pbuild -cache 20 -ptree_cache 70 || true
+          ${sksPkg}/bin/sks build dump/*.gpg -n 10 -cache 100 || true #*/
+          ${sksPkg}/bin/sks cleandb || true
+          ${sksPkg}/bin/sks pbuild -cache 20 -ptree_cache 70 || true
         '';
         serviceConfig = {
-          WorkingDirectory = home;
+          WorkingDirectory = "~";
-          User = user;
+          User = "sks";
+          Group = "sks";
           Restart = "always";
-          ExecStart = "${pkgs.sks}/bin/sks db -hkp_address ${hkpAddress} -hkp_port ${hkpPort}";
+          ExecStart = "${sksPkg}/bin/sks db -hkp_address ${hkpAddress} -hkp_port ${hkpPort}";
         };
       };
     };

nixos/modules/services/x11/desktop-managers/gnome3.nix

@@ -110,6 +110,7 @@ in {
     services.gnome3.gnome-terminal-server.enable = mkDefault true;
     services.gnome3.gnome-user-share.enable = mkDefault true;
     services.gnome3.gvfs.enable = true;
+    services.gnome3.rygel.enable = mkDefault true;
     services.gnome3.seahorse.enable = mkDefault true;
     services.gnome3.sushi.enable = mkDefault true;
     services.gnome3.tracker.enable = mkDefault true;

nixos/modules/tasks/network-interfaces.nix

@@ -341,7 +341,7 @@ in
         You should try to make this ID unique among your machines. You can
         generate a random 32-bit ID using the following commands:
 
-        <literal>cksum /etc/machine-id | while read c rest; do printf "%x" $c; done</literal>
+        <literal>head -c 8 /etc/machine-id</literal>
 
         (this derives it from the machine-id that systemd generates) or
 

pkgs/applications/altcoins/bitcoin-abc.nix

@@ -38,6 +38,7 @@ stdenv.mkDerivation rec {
     homepage = https://bitcoinabc.org/;
     maintainers = with maintainers; [ lassulus ];
     license = licenses.mit;
+    broken = stdenv.isDarwin;
     platforms = platforms.unix;
   };
 }

pkgs/applications/altcoins/bitcoin-classic.nix

@@ -46,6 +46,7 @@ stdenv.mkDerivation rec {
     homepage = https://bitcoinclassic.com/;
     maintainers = with maintainers; [ jefdaj ];
     license = licenses.mit;
+    broken = stdenv.isDarwin;
     platforms = platforms.unix;
   };
 }

pkgs/applications/altcoins/bitcoin-unlimited.nix

@@ -62,6 +62,7 @@ stdenv.mkDerivation rec {
     homepage = https://www.bitcoinunlimited.info/;
     maintainers = with maintainers; [ DmitryTsygankov ];
     license = licenses.mit;
+    broken = stdenv.isDarwin;
     platforms = platforms.unix;
   };
 }

pkgs/applications/altcoins/bitcoin-xt.nix

@@ -43,6 +43,7 @@ stdenv.mkDerivation rec{
     homepage = https://bitcoinxt.software/;
     maintainers = with maintainers; [ jefdaj ];
     license = licenses.mit;
+    broken = stdenv.isDarwin;
     platforms = platforms.unix;
   };
 }

pkgs/applications/altcoins/btc1.nix

@@ -1,6 +1,8 @@
-{ stdenv, fetchurl, pkgconfig, autoreconfHook, openssl, db48, boost
+{ stdenv, fetchurl, pkgconfig, autoreconfHook, hexdump, openssl, db48
-, zlib, miniupnpc, qt4, utillinux, protobuf, qrencode, libevent
+, boost, zlib, miniupnpc, qt4, utillinux, protobuf, qrencode, libevent
-, withGui }:
+, AppKit
+, withGui ? !stdenv.isDarwin
+}:
 
 with stdenv.lib;
 stdenv.mkDerivation rec{
@@ -12,11 +14,10 @@ stdenv.mkDerivation rec{
     sha256 = "0v0g2wb4nsnhddxzb63vj2bc1mgyj05vqm5imicjfz8prvgc0si8";
   };
 
-  nativeBuildInputs = [ pkgconfig autoreconfHook ];
+  nativeBuildInputs = [ pkgconfig autoreconfHook hexdump ];
-  buildInputs = [ openssl db48 boost zlib
+  buildInputs = [ openssl db48 boost zlib miniupnpc protobuf libevent ]
-                  miniupnpc protobuf libevent]
+    ++ optionals withGui [ qt4 qrencode ]
-                  ++ optionals stdenv.isLinux [ utillinux ]
+    ++ optional stdenv.isDarwin AppKit;
-                  ++ optionals withGui [ qt4 qrencode ];
 
   configureFlags = [ "--with-boost-libdir=${boost.out}/lib" ]
                      ++ optionals withGui [ "--with-gui=qt4" ];

pkgs/applications/altcoins/default.nix

@@ -1,4 +1,4 @@
-{ callPackage, boost155, boost165, openssl_1_1_0, haskellPackages, darwin, libsForQt5, miniupnpc_2, python3, buildGo110Package }:
+{ callPackage, boost155, boost165, openssl_1_1, haskellPackages, darwin, libsForQt5, miniupnpc_2, python3, buildGo110Package }:
 
 rec {
 
@@ -32,8 +32,11 @@ rec {
     boost = boost165; withGui = false;
   };
 
-  btc1 = callPackage ./btc1.nix { boost = boost165; withGui = true; };
+  btc1 = callPackage ./btc1.nix {
-  btc1d = callPackage ./btc1.nix { boost = boost165; withGui = false; };
+    inherit (darwin.apple_sdk.frameworks) AppKit;
+    boost = boost165;
+  };
+  btc1d = btc1.override { withGui = false; };
 
   cryptop = python3.pkgs.callPackage ./cryptop { };
 
@@ -59,8 +62,10 @@ rec {
     buildGoPackage = buildGo110Package;
   };
 
-  litecoin  = callPackage ./litecoin.nix { withGui = true; };
+  litecoin  = callPackage ./litecoin.nix {
-  litecoind = callPackage ./litecoin.nix { withGui = false; };
+    inherit (darwin.apple_sdk.frameworks) AppKit;
+  };
+  litecoind = litecoin.override { withGui = false; };
 
   masari = callPackage ./masari.nix { };
 
@@ -85,7 +90,7 @@ rec {
 
   zcash = callPackage ./zcash {
     withGui = false;
-    openssl = openssl_1_1_0;
+    openssl = openssl_1_1;
   };
 
   parity = callPackage ./parity { };

pkgs/applications/altcoins/ethsign/default.nix

@@ -54,6 +54,7 @@ buildGoPackage rec {
   meta = with stdenv.lib; {
     homepage = https://github.com/dapphub/ethsign;
     description = "Make raw signed Ethereum transactions";
+    broken = stdenv.isDarwin;  # test with CoreFoundation 10.11
     license = [licenses.gpl3];
   };
 }

pkgs/applications/altcoins/litecoin.nix

@@ -2,9 +2,12 @@
 , pkgconfig, autoreconfHook
 , openssl, db48, boost, zlib, miniupnpc
 , glib, protobuf, utillinux, qt4, qrencode
-, withGui, libevent }:
+, AppKit
+, withGui ? true, libevent
+}:
 
 with stdenv.lib;
+
 stdenv.mkDerivation rec {
 
   name = "litecoin" + (toString (optional (!withGui) "d")) + "-" + version;
@@ -20,6 +23,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig autoreconfHook ];
   buildInputs = [ openssl db48 boost zlib
                   miniupnpc glib protobuf utillinux libevent ]
+                  ++ optionals stdenv.isDarwin [ AppKit ]
                   ++ optionals withGui [ qt4 qrencode ];
 
   configureFlags = [ "--with-boost-libdir=${boost.out}/lib" ]
@@ -39,6 +43,7 @@ stdenv.mkDerivation rec {
     homepage = https://litecoin.org/;
     platforms = platforms.unix;
     license = licenses.mit;
+    broken = stdenv.isDarwin;
     maintainers = with maintainers; [ offline AndersonTorres ];
   };
 }

pkgs/applications/altcoins/nano-wallet/default.nix

@@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
 
   name = "nano-wallet-${version}";
-  version = "15.2";
+  version = "16.0";
 
   src = fetchFromGitHub {
     owner = "nanocurrency";
     repo = "raiblocks";
     rev = "V${version}";
-    sha256 = "0ngsnaczw5y709zk52flp6m2c83q3kxfgz0bzi8rzfjxp10ncnz3";
+    sha256 = "0fk8jlas3khdh3nlv40krsjdifxp9agblvzap6k93wmm9y34h41c";
     fetchSubmodules = true;
   };
 

pkgs/applications/audio/banshee/default.nix

@@ -1,57 +0,0 @@
-{ stdenv, lib, fetchurl, intltool, pkgconfig, gstreamer, gst-plugins-base
-, gst-plugins-good, gst-plugins-bad, gst-plugins-ugly, gst-ffmpeg, glib
-, mono, mono-addins, dbus-sharp-1_0, dbus-sharp-glib-1_0, notify-sharp, gtk-sharp-2_0
-, boo, gdata-sharp, taglib-sharp, sqlite, gnome-sharp, gconf, gtk-sharp-beans, gio-sharp
-, libmtp, libgpod, mono-zeroconf }:
-
-stdenv.mkDerivation rec {
-  name = "banshee-${version}";
-  version = "2.6.2";
-
-  src = fetchurl {
-    url = "https://ftp.gnome.org/pub/GNOME/sources/banshee/2.6/banshee-${version}.tar.xz";
-    sha256 = "1y30p8wxx5li39i5gpq2wib0ympy8llz0gyi6ri9bp730ndhhz7p";
-  };
-
-  dontStrip = true;
-
-  nativeBuildInputs = [ pkgconfig intltool ];
-  buildInputs = [
-    gtk-sharp-2_0.gtk gstreamer gst-plugins-base gst-plugins-good
-    gst-plugins-bad gst-plugins-ugly gst-ffmpeg
-    mono dbus-sharp-1_0 dbus-sharp-glib-1_0 mono-addins notify-sharp
-    gtk-sharp-2_0 boo gdata-sharp taglib-sharp sqlite gnome-sharp gconf gtk-sharp-beans
-    gio-sharp libmtp libgpod mono-zeroconf
-  ];
-
-  makeFlags = [ "PREFIX=$(out)" ];
-
-  postPatch = ''
-    patchShebangs data/desktop-files/update-desktop-file.sh
-    patchShebangs build/private-icon-theme-installer
-    sed -i "s,DOCDIR=.*,DOCDIR=$out/lib/monodoc," configure
-  '';
-
-  postInstall = let
-    ldLibraryPath = lib.makeLibraryPath [ gtk-sharp-2_0.gtk gtk-sharp-2_0 sqlite gconf glib gstreamer ];
-
-    monoGACPrefix = lib.concatStringsSep ":" [
-      mono dbus-sharp-1_0 dbus-sharp-glib-1_0 mono-addins notify-sharp gtk-sharp-2_0
-      boo gdata-sharp taglib-sharp sqlite gnome-sharp gconf gtk-sharp-beans
-      gio-sharp libmtp libgpod mono-zeroconf
-    ];
-  in ''
-    sed -e '2a export MONO_GAC_PREFIX=${monoGACPrefix}' \
-        -e 's|LD_LIBRARY_PATH=|LD_LIBRARY_PATH=${ldLibraryPath}:|' \
-        -e "s|GST_PLUGIN_PATH=|GST_PLUGIN_PATH=$GST_PLUGIN_SYSTEM_PATH:|" \
-        -e 's| mono | ${mono}/bin/mono |' \
-        -i $out/bin/banshee
-  '';
-  meta = with lib; {
-    homepage = "http://banshee.fm/";
-    description = "A music player written in C# using GNOME technologies";
-    platforms = platforms.linux;
-    maintainers = [ maintainers.zohl ];
-    license = licenses.mit;
-  };
-}

pkgs/applications/audio/lollypop/default.nix

@@ -1,11 +1,15 @@
-{ stdenv, fetchgit, meson, ninja, pkgconfig, wrapGAppsHook
+{ stdenv, fetchgit, meson, ninja, pkgconfig
-, appstream-glib, desktop-file-utils, gobjectIntrospection
+, python3, gtk3, gst_all_1, libsecret, libsoup
-, python36Packages, gnome3, glib, gst_all_1 }:
+, appstream-glib, desktop-file-utils, gnome3
+, gobjectIntrospection, wrapGAppsHook }:
 
-stdenv.mkDerivation rec  {
+python3.pkgs.buildPythonApplication rec  {
   version = "0.9.522";
   name = "lollypop-${version}";
 
+  format = "other";
+  doCheck = false;
+
   src = fetchgit {
     url = "https://gitlab.gnome.org/World/lollypop";
     rev = "refs/tags/${version}";
@@ -13,26 +17,30 @@ stdenv.mkDerivation rec  {
     sha256 = "0f2brwv884cvmxj644jcj9sg5hix3wvnjy2ndg0fh5cxyqz0kwn5";
   };
 
-  nativeBuildInputs = with python36Packages; [
+  nativeBuildInputs = with python3.pkgs; [
     appstream-glib
     desktop-file-utils
     gobjectIntrospection
     meson
     ninja
-    python36Packages.python
     pkgconfig
     wrapGAppsHook
-    wrapPython
   ];
 
-  buildInputs = [ glib ] ++ (with gnome3; [
+  buildInputs = with gst_all_1; [
-    gsettings-desktop-schemas gtk3 libsecret libsoup totem-pl-parser
+    gnome3.totem-pl-parser
-  ]) ++ (with gst_all_1; [
+    gst-libav
-    gst-libav gst-plugins-bad gst-plugins-base gst-plugins-good gst-plugins-ugly
+    gst-plugins-bad
+    gst-plugins-base
+    gst-plugins-good
+    gst-plugins-ugly
     gstreamer
-  ]);
+    gtk3
+    libsecret
+    libsoup
+  ];
 
-  pythonPath = with python36Packages; [
+  pythonPath = with python3.pkgs; [
     beautifulsoup4
     gst-python
     pillow
@@ -42,11 +50,14 @@ stdenv.mkDerivation rec  {
     pylast
   ];
 
-  postFixup = "wrapPythonPrograms";
-
   postPatch = ''
-    chmod +x ./meson_post_install.py
+    chmod +x meson_post_install.py
-    patchShebangs ./meson_post_install.py
+    patchShebangs meson_post_install.py
+  '';
+
+  preFixup = ''
+    buildPythonPath "$out/libexec/lollypop-sp $pythonPath"
+    patchPythonScript "$out/libexec/lollypop-sp"
   '';
 
   meta = with stdenv.lib; {

pkgs/applications/audio/milkytracker/decompressor_gzip.patch

@@ -1,20 +0,0 @@
-https://bugs.archlinux.org/task/31324
-https://410333.bugs.gentoo.org/attachment.cgi?id=322456
-
-diff -ur src.old/compression/DecompressorGZIP.cpp src/compression/DecompressorGZIP.cpp
---- src.old/compression/DecompressorGZIP.cpp	2012-08-28 17:54:46.000000000 +0200
-+++ src/compression/DecompressorGZIP.cpp	2012-08-28 17:55:21.000000000 +0200
-@@ -57,11 +57,11 @@
- 	
- bool DecompressorGZIP::decompress(const PPSystemString& outFileName, Hints hint)
- {
--    gzFile *gz_input_file = NULL;
-+    gzFile gz_input_file = NULL;
- 	int len = 0;
- 	pp_uint8 *buf;
- 	
--	if ((gz_input_file = (void **)gzopen (fileName.getStrBuffer(), "r")) == NULL)
-+	if ((gz_input_file = gzopen (fileName.getStrBuffer(), "r")) == NULL)
- 		return false;
- 	
- 	if ((buf = new pp_uint8[0x10000]) == NULL)

pkgs/applications/audio/milkytracker/default.nix

@@ -1,29 +1,26 @@
-{ stdenv, fetchurl, SDL2, alsaLib, cmake, libjack2, perl
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, makeWrapper
-, zlib, zziplib, pkgconfig, makeWrapper
+, SDL2, alsaLib, libjack2, lhasa, perl, rtmidi, zlib, zziplib }:
-}:
 
 stdenv.mkDerivation rec {
-  version = "1.01";
+  version = "1.02.00";
   name = "milkytracker-${version}";
 
-  src = fetchurl {
+  src = fetchFromGitHub {
-    url = "https://github.com/milkytracker/MilkyTracker/archive/v${version}.00.tar.gz";
+    owner  = "milkytracker";
-    sha256 = "1dvnddsnn9c83lz4dlm0cfjpc0m524amfkbalxbswdy0qc8cj1wv";
+    repo   = "MilkyTracker";
+    rev    = "v${version}";
+    sha256 = "05a6d7l98k9i82dwrgi855dnccm3f2lkb144gi244vhk1156n0ca";
   };
 
-  preBuild=''
-    export CPATH=${zlib.out}/lib
-  '';
-
   nativeBuildInputs = [ cmake pkgconfig makeWrapper ];
 
-  buildInputs = [ SDL2 alsaLib libjack2 perl zlib zziplib ];
+  buildInputs = [ SDL2 alsaLib libjack2 lhasa perl rtmidi zlib zziplib ];
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Music tracker application, similar to Fasttracker II";
     homepage = http://milkytracker.org;
-    license = stdenv.lib.licenses.gpl3Plus;
+    license = licenses.gpl3Plus;
     platforms = [ "x86_64-linux" "i686-linux" ];
-    maintainers = [ stdenv.lib.maintainers.zoomulator ];
+    maintainers = with maintainers; [ zoomulator ];
   };
 }

pkgs/applications/audio/morituri/default.nix

@@ -1,55 +0,0 @@
-{ stdenv, fetchgit, pythonPackages, cdparanoia, cdrdao
-, gst-python, gst-plugins-base, gst-plugins-good
-, utillinux, makeWrapper, substituteAll, autoreconfHook }:
-
-let
-  inherit (pythonPackages) python;
-in stdenv.mkDerivation rec {
-  name = "morituri-${version}";
-  version = "0.2.3.20151109";
-  namePrefix = "";
-
-  src = fetchgit {
-    url = "https://github.com/thomasvs/morituri.git";
-    fetchSubmodules = true;
-    rev = "135b2f7bf27721177e3aeb1d26403f1b29116599";
-    sha256 = "1sl5y5j3gdbynf2v0gf9dwd2hzawj8lm8ywadid7qm34yn8lx12k";
-  };
-
-  pythonPath = with pythonPackages; [
-    pygobject2 gst-python musicbrainzngs
-    pycdio pyxdg setuptools
-    CDDB
-  ];
-
-  nativeBuildInputs = [ autoreconfHook ];
-  buildInputs = [
-    python cdparanoia cdrdao utillinux makeWrapper
-    gst-plugins-base gst-plugins-good
-  ] ++ pythonPath;
-
-  patches = [
-    (substituteAll {
-      src = ./paths.patch;
-      inherit cdrdao cdparanoia python utillinux;
-    })
-  ];
-
-  # This package contains no binaries to patch or strip.
-  dontPatchELF = true;
-  dontStrip = true;
-
-  postInstall = ''
-    wrapProgram "$out/bin/rip" \
-      --prefix PYTHONPATH : "$PYTHONPATH" \
-      --prefix GST_PLUGIN_SYSTEM_PATH : "$GST_PLUGIN_SYSTEM_PATH"
-  '';
-
-  meta = with stdenv.lib; {
-    homepage = http://thomas.apestaart.org/morituri/trac/;
-    description = "A CD ripper aiming for accuracy over speed";
-    maintainers = with maintainers; [ rycee jgeerds ];
-    license = licenses.gpl3Plus;
-    platforms = platforms.linux;
-  };
-}

pkgs/applications/audio/morituri/paths.patch

@@ -1,87 +0,0 @@
-diff --git a/doc/Makefile.am b/doc/Makefile.am
-index c115c2c..78c883e 100644
---- a/doc/Makefile.am
-+++ b/doc/Makefile.am
-@@ -24,7 +24,7 @@ morituri.ics: $(top_srcdir)/morituri.doap
- man_MANS = rip.1
- 
- rip.1: $(top_srcdir)/morituri/extern/python-command/scripts/help2man $(top_srcdir)/morituri
--	PYTHONPATH=$(top_srcdir) $(PYTHON) $(top_srcdir)/morituri/extern/python-command/scripts/help2man morituri.rip.main.Rip rip > rip.1
-+	PYTHONPATH=$(top_srcdir):$(PYTHONPATH) $(PYTHON) $(top_srcdir)/morituri/extern/python-command/scripts/help2man morituri.rip.main.Rip rip > rip.1
- 
- clean-local:
- 	@rm -rf reference
-diff --git a/morituri/common/program.py b/morituri/common/program.py
-index d340fdd..15cb751 100644
---- a/morituri/common/program.py
-+++ b/morituri/common/program.py
-@@ -92,13 +92,13 @@ class Program(log.Loggable):
-         """
-         Load the given device.
-         """
--        os.system('eject -t %s' % device)
-+        os.system('@utillinux@/bin/eject -t %s' % device)
- 
-     def ejectDevice(self, device):
-         """
-         Eject the given device.
-         """
--        os.system('eject %s' % device)
-+        os.system('@utillinux@/bin/eject %s' % device)
- 
-     def unmountDevice(self, device):
-         """
-@@ -112,7 +112,7 @@ class Program(log.Loggable):
-         proc = open('/proc/mounts').read()
-         if device in proc:
-             print 'Device %s is mounted, unmounting' % device
--            os.system('umount %s' % device)
-+            os.system('@utillinux@/bin/umount %s' % device)
- 
-     def getFastToc(self, runner, toc_pickle, device):
-         """
-Submodule morituri/extern/python-command contains modified content
-diff --git a/morituri/program/cdparanoia.py b/morituri/program/cdparanoia.py
-index 46176d5..fce14a5 100644
---- a/morituri/program/cdparanoia.py
-+++ b/morituri/program/cdparanoia.py
-@@ -278,7 +278,7 @@ class ReadTrackTask(log.Loggable, task.Task):
-             stopTrack, stopOffset)
- 
-         bufsize = 1024
--        argv = ["cdparanoia", "--stderr-progress",
-+        argv = ["@cdparanoia@/bin/cdparanoia", "--stderr-progress",
-             "--sample-offset=%d" % self._offset, ]
-         if self._device:
-             argv.extend(["--force-cdrom-device", self._device, ])
-@@ -551,7 +551,7 @@ _VERSION_RE = re.compile(
- 
- def getCdParanoiaVersion():
-     getter = common.VersionGetter('cdparanoia',
--        ["cdparanoia", "-V"],
-+        ["@cdparanoia@/bin/cdparanoia", "-V"],
-         _VERSION_RE,
-         "%(version)s %(release)s")
- 
-diff --git a/morituri/program/cdrdao.py b/morituri/program/cdrdao.py
-index c6fba64..c4d0306 100644
---- a/morituri/program/cdrdao.py
-+++ b/morituri/program/cdrdao.py
-@@ -257,7 +257,7 @@ class CDRDAOTask(ctask.PopenTask):
- 
-     def start(self, runner):
-         self.debug('Starting cdrdao with options %r', self.options)
--        self.command = ['cdrdao', ] + self.options
-+        self.command = ['@cdrdao@/bin/cdrdao', ] + self.options
- 
-         ctask.PopenTask.start(self, runner)
- 
-@@ -515,7 +515,7 @@ _VERSION_RE = re.compile(
- 
- def getCDRDAOVersion():
-     getter = common.VersionGetter('cdrdao',
--        ["cdrdao"],
-+        ["@cdrdao@/bin/cdrdao"],
-         _VERSION_RE,
-         "%(version)s")
- 

pkgs/applications/audio/pulseaudio-modules-bt/default.nix

@@ -0,0 +1,63 @@
+{ stdenv
+, runCommand
+, fetchFromGitHub
+, libpulseaudio
+, pulseaudio
+, pkgconfig
+, libtool
+, cmake
+, bluez
+, dbus
+, sbc
+}:
+
+let
+  pulseSources = runCommand "pulseaudio-sources" {} ''
+    mkdir $out
+    tar -xf ${pulseaudio.src}
+    mv pulseaudio*/* $out/
+  '';
+
+in stdenv.mkDerivation rec {
+  name = "pulseaudio-modules-bt-${version}";
+  version = "unstable-2018-09-11";
+
+  src = fetchFromGitHub {
+    owner = "EHfive";
+    repo = "pulseaudio-modules-bt";
+    rev = "9c6ad75382f3855916ad2feaa6b40e37356d80cc";
+    sha256 = "1iz4m3y6arsvwcyvqc429w252dl3apnhvl1zhyvfxlbg00d2ii0h";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    pkgconfig
+    cmake
+  ];
+
+  buildInputs = [
+    libpulseaudio
+    pulseaudio
+    libtool
+    bluez
+    dbus
+    sbc
+  ];
+
+  NIX_CFLAGS_COMPILE = [
+    "-L${pulseaudio}/lib/pulseaudio"
+  ];
+
+  prePatch = ''
+    rm -r pa
+    ln -s ${pulseSources} pa
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/EHfive/pulseaudio-modules-bt;
+    description = "SBC, Sony LDAC codec (A2DP Audio) support for Pulseaudio";
+    platforms = platforms.linux;
+    license = licenses.mit;
+    maintainers = with maintainers; [ adisbladis ];
+  };
+}

pkgs/applications/audio/qmmp/default.nix

@@ -29,11 +29,11 @@
 # handle that.
 
 stdenv.mkDerivation rec {
-  name = "qmmp-1.2.2";
+  name = "qmmp-1.2.3";
 
   src = fetchurl {
     url = "http://qmmp.ylsoftware.com/files/${name}.tar.bz2";
-    sha256 = "01nnyg8m3p3px1fj3lfsqqv9zh1388dwx1bm2qv4v87jywimgp79";
+    sha256 = "05lqmj22vr5ch1i0928d64ybdnn3qc66s9lgarx5s6x6ffr6589j";
   };
 
   buildInputs =

pkgs/applications/audio/rosegarden/default.nix

@@ -3,12 +3,12 @@
 , liblo, liblrdf, libsamplerate, libsndfile, lirc ? null, qtbase }:
 
 stdenv.mkDerivation (rec {
-  version = "17.12.1";
+  version = "18.06";
   name = "rosegarden-${version}";
 
   src = fetchurl {
     url = "mirror://sourceforge/rosegarden/${name}.tar.bz2";
-    sha256 = "155kqbxg85wqv0w97cmmx8wq0r4xb3qpnk20lfma04vj8k6hc1mg";
+    sha256 = "04qc80sqb2ji42pq3mayhvqqn39hlxzymsywpbpzfpchr19chxx7";
   };
 
   patchPhase = ''

pkgs/applications/audio/snd/default.nix

@@ -4,11 +4,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "snd-18.6";
+  name = "snd-18.7";
 
   src = fetchurl {
     url = "mirror://sourceforge/snd/${name}.tar.gz";
-    sha256 = "1jyqkkz2a6zw0jn9y15xd3027r8glkpw794fjk6hd3al1byjhz2z";
+    sha256 = "1d7g043r534shwsq5s4xsywgn5qv96v9wnhdx04j21s9w7fy9ypl";
   };
 
   nativeBuildInputs = [ pkgconfig ];

pkgs/applications/audio/vocal/default.nix

@@ -0,0 +1,52 @@
+{ stdenv, fetchFromGitHub, cmake, ninja, pkgconfig, vala, gtk3, libxml2, granite, webkitgtk, clutter-gtk
+, clutter-gst, libunity, libnotify, sqlite, gst_all_1, libsoup, json-glib, gnome3, gobjectIntrospection, wrapGAppsHook }:
+
+stdenv.mkDerivation rec {
+  pname = "vocal";
+  version = "2.2.0";
+
+  name = "${pname}-${version}";
+
+  src = fetchFromGitHub {
+    owner = "needle-and-thread";
+    repo = pname;
+    rev = version;
+    sha256 = "09cm4azyaa9fmfymygf25gf0klpm5p04k6bc1i90jhw0f1im8sgl";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    gobjectIntrospection
+    libxml2
+    ninja
+    pkgconfig
+    vala
+    wrapGAppsHook
+  ];
+
+  buildInputs = with gst_all_1; [
+    clutter-gst
+    clutter-gtk
+    gnome3.libgee
+    granite
+    gst-plugins-base
+    gst-plugins-good
+    gstreamer
+    json-glib
+    libnotify
+    libunity
+    sqlite
+    webkitgtk
+  ];
+
+  meta = with stdenv.lib; {
+    description = "The podcast client for the modern free desktop";
+    longDescription = ''
+      Vocal is a powerful, fast, and intuitive application that helps users find new podcasts, manage their libraries, and enjoy the best that indepedent audio and video publishing has to offer. Vocal features full support for both episode downloading and streaming, native system integration, iTunes store search and top 100 charts (with international results support), iTunes link parsing, OPML importing and exporting, and so much more. Plus, it has great smart features like automatically keeping your library clean from old files, and the ability to set custom skip intervals.
+    '';
+    homepage = https://github.com/needle-and-thread/vocal;
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ worldofpeace ];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/audio/whipper/default.nix

@@ -0,0 +1,48 @@
+{ stdenv, fetchFromGitHub, python2, cdparanoia, cdrdao, flac
+, sox, accuraterip-checksum, utillinux, substituteAll }:
+
+python2.pkgs.buildPythonApplication rec {
+  name = "whipper-${version}";
+  version = "0.7.0";
+
+  src = fetchFromGitHub {
+    owner = "JoeLametta";
+    repo = "whipper";
+    rev = "v${version}";
+    sha256 = "04m8s0s9dcnly9l6id8vv99n9kbjrjid79bss52ay9yvwng0frmj";
+  };
+
+  pythonPath = with python2.pkgs; [
+    pygobject2 musicbrainzngs urllib3 chardet
+    pycdio setuptools mutagen
+    requests
+  ];
+
+  checkInputs = with python2.pkgs; [
+    twisted
+  ];
+
+  patches = [
+    (substituteAll {
+      src = ./paths.patch;
+      inherit cdrdao cdparanoia utillinux flac sox;
+      accurateripChecksum = accuraterip-checksum;
+    })
+  ];
+
+  # some tests require internet access
+  # https://github.com/JoeLametta/whipper/issues/291
+  doCheck = false;
+
+  preCheck = ''
+    HOME=$TMPDIR
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/JoeLametta/whipper;
+    description = "A CD ripper aiming for accuracy over speed";
+    maintainers = with maintainers; [ rycee jgeerds ];
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/audio/whipper/paths.patch

@@ -0,0 +1,105 @@
+--- a/whipper/program/arc.py
++++ b/whipper/program/arc.py
+@@ -3,8 +3,8 @@
+ import logging
+ logger = logging.getLogger(__name__)
+ 
+-ARB = 'accuraterip-checksum'
+-FLAC = 'flac'
++ARB = '@accurateripChecksum@/bin/accuraterip-checksum'
++FLAC = '@flac@/bin/flac'
+ 
+ 
+ def _execute(cmd, **redirects):
+--- a/whipper/program/cdparanoia.py
++++ b/whipper/program/cdparanoia.py
+@@ -280,10 +280,10 @@
+ 
+         bufsize = 1024
+         if self._overread:
+-            argv = ["cd-paranoia", "--stderr-progress",
++            argv = ["@cdparanoia@/bin/cdparanoia", "--stderr-progress",
+                     "--sample-offset=%d" % self._offset, "--force-overread", ]
+         else:
+-            argv = ["cd-paranoia", "--stderr-progress",
++            argv = ["@cdparanoia@/bin/cdparanoia", "--stderr-progress",
+                     "--sample-offset=%d" % self._offset, ]
+         if self._device:
+             argv.extend(["--force-cdrom-device", self._device, ])
+@@ -560,7 +560,7 @@
+ 
+ def getCdParanoiaVersion():
+     getter = common.VersionGetter('cd-paranoia',
+-                                  ["cd-paranoia", "-V"],
++                                  ["@cdparanoia@/bin/cdparanoia", "-V"],
+                                   _VERSION_RE,
+                                   "%(version)s %(release)s")
+ 
+@@ -585,7 +585,7 @@
+     def __init__(self, device=None):
+         # cdparanoia -A *always* writes cdparanoia.log
+         self.cwd = tempfile.mkdtemp(suffix='.whipper.cache')
+-        self.command = ['cd-paranoia', '-A']
++        self.command = ['@cdparanoia@/bin/cdparanoia', '-A']
+         if device:
+             self.command += ['-d', device]
+ 
+--- a/whipper/program/cdrdao.py
++++ b/whipper/program/cdrdao.py
+@@ -9,7 +9,7 @@
+ import logging
+ logger = logging.getLogger(__name__)
+ 
+-CDRDAO = 'cdrdao'
++CDRDAO = '@cdrdao@/bin/cdrdao'
+ 
+ 
+ def read_toc(device, fast_toc=False):
+--- a/whipper/program/sox.py
++++ b/whipper/program/sox.py
+@@ -4,7 +4,7 @@
+ import logging
+ logger = logging.getLogger(__name__)
+ 
+-SOX = 'sox'
++SOX = '@sox@/bin/sox'
+ 
+ 
+ def peak_level(track_path):
+--- a/whipper/program/soxi.py
++++ b/whipper/program/soxi.py
+@@ -6,7 +6,7 @@
+ import logging
+ logger = logging.getLogger(__name__)
+ 
+-SOXI = 'soxi'
++SOXI = '@sox@/bin/soxi'
+ 
+ 
+ class AudioLengthTask(ctask.PopenTask):
+--- a/whipper/program/utils.py
++++ b/whipper/program/utils.py
+@@ -9,7 +9,7 @@
+     Eject the given device.
+     """
+     logger.debug("ejecting device %s", device)
+-    os.system('eject %s' % device)
++    os.system('@utillinux@/bin/eject %s' % device)
+ 
+ 
+ def load_device(device):
+@@ -17,7 +17,7 @@
+     Load the given device.
+     """
+     logger.debug("loading (eject -t) device %s", device)
+-    os.system('eject -t %s' % device)
++    os.system('@utillinux@/bin/eject -t %s' % device)
+ 
+ 
+ def unmount_device(device):
+@@ -32,4 +32,4 @@
+     proc = open('/proc/mounts').read()
+     if device in proc:
+         print 'Device %s is mounted, unmounting' % device
+-        os.system('umount %s' % device)
++        os.system('@utillinux@/bin/umount %s' % device)

pkgs/applications/editors/android-studio/default.nix

@@ -13,14 +13,14 @@ let
     sha256Hash = "0xx6yprylmcb32ipmwdcfkgddlm1nrxi1w68miclvgrbk015brf2";
   };
   betaVersion = {
-    version = "3.2.0.24"; # "Android Studio 3.2 RC 2"
+    version = "3.2.0.25"; # "Android Studio 3.2 RC 3"
-    build = "181.4974118";
+    build = "181.4987877";
-    sha256Hash = "0sj848pzpsbmnfi2692gg73v6m72hr1pwlk5x8q912w60iypi3pz";
+    sha256Hash = "0mriakxxchc0wbqkl236pp4fsqbq3gb2qrkdg5hx9zz763dc59gp";
   };
   latestVersion = { # canary & dev
-    version = "3.3.0.7"; # "Android Studio 3.3 Canary 8"
+    version = "3.3.0.9"; # "Android Studio 3.3 Canary 10"
-    build = "182.4978721";
+    build = "182.4996246";
-    sha256Hash = "0xa19wrw1a6y7f2jdv8699yqv7g34h3zdw3wc0ql0447afzwg9a9";
+    sha256Hash = "0g6hhfhlfj9szw48z22n869n6d0rw5fhljazj63dmw6i4v6rd92g";
   };
 in rec {
   # Old alias

pkgs/applications/editors/aseprite/default.nix

@@ -1,5 +1,5 @@
-{ stdenv, lib, fetchFromGitHub, cmake, pkgconfig
+{ stdenv, lib, fetchFromGitHub, fetchpatch, cmake, pkgconfig
-, curl, freetype, giflib, libjpeg, libpng, libwebp, pixman, tinyxml, zlib
+, curl, freetype, giflib, harfbuzz, libjpeg, libpng, libwebp, pixman, tinyxml, zlib
 , libX11, libXext, libXcursor, libXxf86vm
 , unfree ? false
 , cmark
@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation rec {
   name = "aseprite-${version}";
-  version = if unfree then "1.2.4" else "1.1.7";
+  version = if unfree then "1.2.9" else "1.1.7";
 
   src = fetchFromGitHub {
     owner = "aseprite";
@@ -19,16 +19,27 @@ stdenv.mkDerivation rec {
     rev = "v${version}";
     fetchSubmodules = true;
     sha256 = if unfree
-      then "1rnf4a8vgddz8x55rpqaihlxmqip1kgpdhqb4d3l71h1zmidg5k3"
+      then "0a9xk163j0984n8nn6pqf27n83gr6w7g25wkiv591zx88pa6cpbd"
       else "0gd49lns2bpzbkwax5jf9x1xmg1j8ij997kcxr2596cwiswnw4di";
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
 
   buildInputs = [
-    curl freetype giflib libjpeg libpng libwebp pixman tinyxml zlib
+    curl freetype giflib harfbuzz libjpeg libpng libwebp pixman tinyxml zlib
     libX11 libXext libXcursor libXxf86vm
-  ] ++ lib.optionals unfree [ cmark ];
+  ] ++ lib.optionals unfree [ cmark harfbuzz ];
+
+  patches = lib.optionals unfree [
+    (fetchpatch {
+      url = "https://github.com/aseprite/aseprite/commit/cfb4dac6feef1f39e161c23c886055a8f9acfd0d.patch";
+      sha256 = "1qhjfpngg8b1vvb9w26lhjjfamfx57ih0p31km3r5l96nm85l7f9";
+    })
+    (fetchpatch {
+      url = "https://github.com/orivej/aseprite/commit/ea87e65b357ad0bd65467af5529183b5a48a8c17.patch";
+      sha256 = "1vwn8ivap1pzdh444sdvvkndp55iz146nhmd80xbm8cyzn3qmg91";
+    })
+  ];
 
   postPatch = ''
     sed -i src/config.h -e "s-\\(#define VERSION\\) .*-\\1 \"$version\"-"
@@ -49,6 +60,7 @@ stdenv.mkDerivation rec {
     "-DWITH_WEBP_SUPPORT=ON"
   ] ++ lib.optionals unfree [
     "-DUSE_SHARED_CMARK=ON"
+    "-DUSE_SHARED_HARFBUZZ=ON"
     # Aseprite needs internal freetype headers.
     "-DUSE_SHARED_FREETYPE=OFF"
     # Disable libarchive programs.

pkgs/applications/editors/emacs/default.nix

@@ -4,8 +4,9 @@
 , alsaLib, cairo, acl, gpm, AppKit, GSS, ImageIO, m17n_lib, libotf
 , systemd ? null
 , withX ? !stdenv.isDarwin
-, withGTK2 ? false, gtk2 ? null
+, withNS ? stdenv.isDarwin
-, withGTK3 ? true, gtk3 ? null, gsettings-desktop-schemas ? null
+, withGTK2 ? false, gtk2-x11 ? null
+, withGTK3 ? true, gtk3-x11 ? null, gsettings-desktop-schemas ? null
 , withXwidgets ? false, webkitgtk ? null, wrapGAppsHook ? null, glib-networking ? null
 , withCsrc ? true
 , srcRepo ? false, autoconf ? null, automake ? null, texinfo ? null
@@ -13,10 +14,12 @@
 
 assert (libXft != null) -> libpng != null;      # probably a bug
 assert stdenv.isDarwin -> libXaw != null;       # fails to link otherwise
-assert withGTK2 -> withX || stdenv.isDarwin;
+assert withNS -> !withX;
-assert withGTK3 -> withX || stdenv.isDarwin;
+assert withNS -> stdenv.isDarwin;
-assert withGTK2 -> !withGTK3 && gtk2 != null;
+assert (withGTK2 && !withNS) -> withX;
-assert withGTK3 -> !withGTK2 && gtk3 != null;
+assert (withGTK3 && !withNS) -> withX;
+assert withGTK2 -> !withGTK3 && gtk2-x11 != null;
+assert withGTK3 -> !withGTK2 && gtk3-x11 != null;
 assert withXwidgets -> withGTK3 && webkitgtk != null;
 
 let
@@ -56,19 +59,22 @@ stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.isLinux [ dbus libselinux systemd ]
     ++ lib.optionals withX
       [ xlibsWrapper libXaw Xaw3d libXpm libpng libjpeg libungif libtiff librsvg libXft
-        imagemagick gconf m17n_lib libotf ]
+        imagemagick gconf ]
-    ++ lib.optional (withX && withGTK2) gtk2
+    ++ lib.optionals (stdenv.isLinux && withX) [ m17n_lib libotf ]
-    ++ lib.optionals (withX && withGTK3) [ gtk3 gsettings-desktop-schemas ]
+    ++ lib.optional (withX && withGTK2) gtk2-x11
+    ++ lib.optionals (withX && withGTK3) [ gtk3-x11 gsettings-desktop-schemas ]
     ++ lib.optional (stdenv.isDarwin && withX) cairo
     ++ lib.optionals (withX && withXwidgets) [ webkitgtk ];
 
-  propagatedBuildInputs = lib.optionals stdenv.isDarwin [ AppKit GSS ImageIO ];
+  propagatedBuildInputs = lib.optionals withNS [ AppKit GSS ImageIO ];
 
   hardeningDisable = [ "format" ];
 
   configureFlags = [ "--with-modules" ] ++
-   (if stdenv.isDarwin
+    (lib.optional stdenv.isDarwin
-      then [ "--with-ns" "--disable-ns-self-contained" ]
+      (lib.withFeature withNS "ns")) ++
+    (if withNS
+      then [ "--disable-ns-self-contained" ]
     else if withX
       then [ "--with-x-toolkit=${toolkit}" "--with-xft" ]
       else [ "--with-x=no" "--with-xpm=no" "--with-jpeg=no" "--with-png=no"
@@ -103,7 +109,7 @@ stdenv.mkDerivation rec {
       cp $srcdir/TAGS $dstdir
       echo '((nil . ((tags-file-name . "TAGS"))))' > $dstdir/.dir-locals.el
     done
-  '' + lib.optionalString stdenv.isDarwin ''
+  '' + lib.optionalString withNS ''
     mkdir -p $out/Applications
     mv nextstep/Emacs.app $out/Applications
   '';

pkgs/applications/editors/focuswriter/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "focuswriter-${version}";
-  version = "1.6.15";
+  version = "1.6.16";
 
   src = fetchurl {
     url = "https://gottcode.org/focuswriter/focuswriter-${version}-src.tar.bz2";
-    sha256 = "0afs9cm5q7zxag28m427ycwwxkbn47zw7v111x7963ydqyn9gr9q";
+    sha256 = "1warfv9d485a7ysmjazxw4zvi9l0ih1021s6c5adkc86m88k296m";
   };
 
   nativeBuildInputs = [ pkgconfig qmake qttools ];

pkgs/applications/editors/leo-editor/default.nix

@@ -1,29 +1,20 @@
-{ stdenv, python3, libsForQt56, fetchFromGitHub, makeWrapper, makeDesktopItem }:
+{ stdenv, python3, fetchFromGitHub, makeWrapper, makeDesktopItem }:
 
-let
-  packageOverrides = self: super: {
-    pyqt56 = libsForQt56.callPackage ../../../development/python-modules/pyqt/5.x.nix {
-      pythonPackages = self;
-    };
-  };
-
-  pythonPackages = (python3.override { inherit packageOverrides; }).pkgs;
-in
 stdenv.mkDerivation rec {
   name = "leo-editor-${version}";
-  version = "5.6";
+  version = "5.7.3";
 
   src = fetchFromGitHub {
     owner = "leo-editor";
     repo = "leo-editor";
     rev = version;
-    sha256 = "1k6q3gvaf05bi0mzkmmb1p6wrgxwri7ivn38p6f0m0wfd3f70x2j";
+    sha256 = "0ri6l6cxwva450l05af5vs1lsgrz6ciwd02njdgphs9pm1vwxbl9";
   };
 
   dontBuild = true;
 
   nativeBuildInputs = [ makeWrapper python3 ];
-  propagatedBuildInputs = with pythonPackages; [ pyqt56 docutils ];
+  propagatedBuildInputs = with python3.pkgs; [ pyqt5 docutils ];
 
   desktopItem = makeDesktopItem rec {
     name = "leo-editor";

pkgs/applications/editors/nano/default.nix

@@ -14,17 +14,17 @@ let
   nixSyntaxHighlight = fetchFromGitHub {
     owner = "seitz";
     repo = "nanonix";
-    rev = "7483fd8b79f1f3f2179dbbd46aa400df4320ba10";
+    rev = "bf8d898efaa10dce3f7972ff765b58c353b4b4ab";
-    sha256 = "10pv75kfrgnziz8sr83hdbb0c3klm2fmsdw3i5cpqqf5va1fzb8h";
+    sha256 = "0773s5iz8aw9npgyasb0r2ybp6gvy2s9sq51az8w7h52bzn5blnn";
   };
 
 in stdenv.mkDerivation rec {
   name = "nano-${version}";
-  version = "2.9.8";
+  version = "3.0";
 
   src = fetchurl {
     url = "mirror://gnu/nano/${name}.tar.xz";
-    sha256 = "122lm0z97wk3mgnbn8m4d769d4j9rxyc9z7s89xd4gsdp8qsrpn2";
+    sha256 = "1868hg9s584fwjrh0fzdrixmxc2qhw520z4q5iv68kjiajivr9g0";
   };
 
   nativeBuildInputs = [ texinfo ] ++ optional enableNls gettext;

pkgs/applications/editors/nano/nanorc/default.nix

@@ -0,0 +1,29 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  name = "nanorc-${version}";
+  version = "2018-09-05";
+
+  src = fetchFromGitHub {
+    owner = "scopatz";
+    repo = "nanorc";
+    rev = "1e589cb729d24fba470228d429e6dde07973d597";
+    sha256 = "136yxr38lzrfv8bar0c6c56rh54q9s94zpwa19f425crh44drppl";
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p $out/share
+
+    install *.nanorc $out/share/
+  '';
+
+  meta = {
+    description = "Improved Nano Syntax Highlighting Files";
+    homepage = https://github.com/scopatz/nanorc;
+    license = stdenv.lib.licenses.gpl3;
+    maintainers = with stdenv.lib.maintainers; [ nequissimus ];
+    platforms = stdenv.lib.platforms.all;
+  };
+}

pkgs/applications/editors/neovim/qt.nix

@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   name = "neovim-qt-${version}";
-  version = "0.2.9";
+  version = "0.2.10";
 
   src = fetchFromGitHub {
     owner  = "equalsraf";
     repo   = "neovim-qt";
     rev    = "v${version}";
-    sha256 = "014zqfbbv7q85z64h1iw88l37vhrvhjv7xxd0a76j7d1m2769kqs";
+    sha256 = "0hq3w9d6qbzf0j7zm3ls0wpvnab64kypb4i0bhmsnk605mvx63r4";
   };
 
   cmakeFlags = [

pkgs/applications/editors/quilter/default.nix

@@ -0,0 +1,73 @@
+{ stdenv, fetchFromGitHub, fetchpatch, vala, pkgconfig, meson, ninja, python3
+, granite, gtk3, desktop-file-utils, gnome3, gtksourceview, webkitgtk, gtkspell3
+, discount, gobjectIntrospection, wrapGAppsHook }:
+
+stdenv.mkDerivation rec {
+  pname = "quilter";
+  version = "1.6.3";
+
+  name = "${pname}-${version}";
+
+  src = fetchFromGitHub {
+    owner = "lainsce";
+    repo = pname;
+    rev = version;
+    sha256 = "1wa0i6dgg6fgb7q9z33v9qmn1a1dn3ik58v1f3a49dvd5xyf8q6q";
+  };
+
+  nativeBuildInputs = [
+    desktop-file-utils
+    gobjectIntrospection
+    meson
+    ninja
+    pkgconfig
+    python3
+    vala
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    discount
+    granite
+    gtk3
+    gtksourceview
+    gtkspell3
+    webkitgtk
+    gnome3.libgee
+  ];
+
+  patches = [
+    # Fix build with vala 0.42 - Drop these in next release
+    (fetchpatch {
+      url = "https://github.com/lainsce/quilter/commit/a58838213cd7f2d33048c7b34b96dc8875612624.patch";
+      sha256 = "1a4w1zql4zfk8scgrrssrm9n3sh5fsc1af5zvrqk8skbv7f2c80n";
+    })
+    (fetchpatch {
+      url = "https://github.com/lainsce/quilter/commit/d1800ce830343a1715bc83da3339816554896be5.patch";
+      sha256 = "0xl5iz8bgx5661vbbq8qa1wkfvw9d3da67x564ckjfi05zq1vddz";
+    })
+    # Correct libMarkdown dependency discovery: See https://github.com/lainsce/quilter/pull/170
+    (fetchpatch {
+      url = "https://github.com/lainsce/quilter/commit/8b1f3a60bd14cb86c1c62f9917c5f0c12bc4e459.patch";
+      sha256 = "1kjc6ygf9yjvqfa4xhzxiava3338swp9wbjhpfaa3pyz3ayh188n";
+    })
+    # post_install script cleanups: See https://github.com/lainsce/quilter/pull/171
+    (fetchpatch {
+      url = "https://github.com/lainsce/quilter/commit/55bf3b10cd94fcc40b0867bbdb1931a09f577922.patch";
+      sha256 = "1330amichaif2qfrh4qkxwqbcpr87ipik7vzjbjdm2bv3jz9353r";
+    })
+  ];
+
+  postPatch = ''
+    chmod +x meson/post_install.py
+    patchShebangs meson/post_install.py
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Focus on your writing - designed for elementary OS";
+    homepage    = https://github.com/lainsce/quilter;
+    license     = licenses.gpl2Plus;
+    maintainers = with maintainers; [ worldofpeace ];
+    platforms   = platforms.linux;
+  };
+}

pkgs/applications/editors/thonny/default.nix

@@ -0,0 +1,43 @@
+{ stdenv, fetchFromBitbucket, python3 }:
+
+with python3.pkgs;
+
+buildPythonApplication rec {
+  pname = "thonny";
+  version = "3.0.0b3";
+
+  src = fetchFromBitbucket {
+    owner = "plas";
+    repo = pname;
+    rev = "a511d4539c532b6dddf6d7f1586d30e1ac35bd86";
+    sha256 = "1s3pp97r6p3j81idglnml4faxryk7saszxmv3gys1agdfj75qczr";
+  };
+
+  propagatedBuildInputs = with python3.pkgs; [ jedi pyserial tkinter docutils pylint ];
+
+  preInstall = ''
+    export HOME=$(mktemp -d)
+  '';
+
+  preFixup = ''
+    wrapProgram "$out/bin/thonny" \
+       --prefix PYTHONPATH : $PYTHONPATH:$(toPythonPath ${python3.pkgs.jedi})
+  '';
+
+  # Tests need a DISPLAY
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "Python IDE for beginners";
+    longDescription = ''
+      Thonny is a Python IDE for beginners. It supports different ways
+      of stepping through the code, step-by-step expression
+      evaluation, detailed visualization of the call stack and a mode
+      for explaining the concepts of references and heap.
+    '';
+    homepage = https://www.thonny.org/;
+    license = licenses.mit;
+    maintainers = with maintainers; [ leenaars ];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/editors/vim/common.nix

@@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "8.1.0146";
+  version = "8.1.0348";
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    sha256 = "1v33h08j15zii0ipw5py18ghsaxlbar0nyx365z1acjhk4vhn9nb";
+    sha256 = "0f18kpywnph708mvj1fpi06qb53nbhc26ngjh2kvfxwawn63k8ab";
   };
 
   enableParallelBuilding = true;

pkgs/applications/graphics/PythonMagick/default.nix

@@ -1,6 +1,6 @@
 # This expression provides Python bindings to ImageMagick. Python libraries are supposed to be called via `python-packages.nix`.
 
-{stdenv, fetchurl, python, boost, pkgconfig, imagemagick}:
+{ stdenv, fetchurl, python, pkgconfig, imagemagick, autoreconfHook }:
 
 stdenv.mkDerivation rec {
   name = "pythonmagick-${version}";
@@ -11,10 +11,18 @@ stdenv.mkDerivation rec {
     sha256 = "137278mfb5079lns2mmw73x8dhpzgwha53dyl00mmhj2z25varpn";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
+  postPatch = ''
-  buildInputs = [python boost imagemagick];
+    rm configure
+  '';
 
-  meta = {
+  configureFlags = [ "--with-boost=${python.pkgs.boost}" ];
+
+  nativeBuildInputs = [ pkgconfig autoreconfHook ];
+  buildInputs = [ python python.pkgs.boost imagemagick ];
+
+  meta = with stdenv.lib; {
     homepage = http://www.imagemagick.org/script/api.php;
+    license = licenses.imagemagick;
+    description = "PythonMagick provides object oriented bindings for the ImageMagick Library.";
   };
 }

pkgs/applications/graphics/antimony/default.nix

@@ -1,29 +1,34 @@
-{ stdenv, fetchFromGitHub, libpng, python3, boost, libGLU_combined, qtbase, ncurses, cmake, flex, lemon }:
+{ stdenv, fetchFromGitHub, libpng, python3
+, libGLU_combined, qtbase, ncurses
+, cmake, flex, lemon
+}:
 
 let
-  gitRev    = "020910c25614a3752383511ede5a1f5551a8bd39";
+  gitRev    = "60a58688e552f12501980c4bdab034ab0f2ba059";
-  gitBranch = "master";
+  gitBranch = "develop";
   gitTag    = "0.9.3";
 in
   stdenv.mkDerivation rec {
     name    = "antimony-${version}";
-    version = gitTag;
+    version = "2018-07-17";
 
     src = fetchFromGitHub {
-      owner = "mkeeter";
+      owner  = "mkeeter";
-      repo = "antimony";
+      repo   = "antimony";
-      rev = gitTag;
+      rev    = gitRev;
-      sha256 = "1vm5h5py8l3b8h4pbmm8s3wlxvlw492xfwnlwx0nvl0cjs8ba6r4";
+      sha256 = "0pgf6kr23xw012xsil56j5gq78mlirmrlqdm09m5wlgcf4vr6xnl";
     };
 
     patches = [ ./paths-fix.patch ];
 
     postPatch = ''
-       sed -i "s,/usr/local,$out,g" app/CMakeLists.txt app/app/app.cpp app/app/main.cpp
+       sed -i "s,/usr/local,$out,g" \
+       app/CMakeLists.txt app/app/app.cpp app/app/main.cpp
+       sed -i "s,python-py35,python36," CMakeLists.txt
     '';
 
     buildInputs = [
-      libpng python3 (boost.override { python = python3; })
+      libpng python3 python3.pkgs.boost
       libGLU_combined qtbase ncurses
     ];
 
@@ -41,6 +46,7 @@ in
       description = "A computer-aided design (CAD) tool from a parallel universe";
       homepage    = "https://github.com/mkeeter/antimony";
       license     = licenses.mit;
+      maintainers = with maintainers; [ rnhmjoj ];
       platforms   = platforms.linux;
     };
   }

pkgs/applications/graphics/imv/default.nix

@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     homepage    = https://github.com/eXeC64/imv; 
     license     = licenses.gpl2;
     maintainers = with maintainers; [ rnhmjoj ];
-    platforms   = [ "x86_64-linux" ];
+    platforms   = [ "i686-linux" "x86_64-linux" ];
   };
 }
 

pkgs/applications/graphics/kipi-plugins/default.nix

@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   name    = "kipi-plugins-${version}";
-  version = "5.2.0";
+  version = "5.9.0";
 
   src = fetchurl {
     url = "http://download.kde.org/stable/digikam/digikam-${version}.tar.xz";
-    sha256 = "0q4j7iv20cxgfsr14qwzx05wbp2zkgc7cg2pi7ibcnwba70ky96g";
+    sha256 = "06qdalf2mwx2f43p3bljy3vn5bk8n3x539kha6ky2vzxvkp343b6";
   };
 
   prePatch = ''

pkgs/applications/graphics/krita/default.nix

@@ -3,7 +3,7 @@
 , kguiaddons, ki18n, kitemmodels, kitemviews, kwindowsystem
 , kio, kcrash
 , boost, libraw, fftw, eigen, exiv2, libheif, lcms2, gsl, openexr, giflib
-, openjpeg, opencolorio, vc, poppler_qt5, curl, ilmbase
+, openjpeg, opencolorio, vc, poppler, curl, ilmbase
 , qtmultimedia, qtx11extras
 , python3
 }:
@@ -23,7 +23,7 @@ mkDerivation rec {
     karchive kconfig kwidgetsaddons kcompletion kcoreaddons kguiaddons
     ki18n kitemmodels kitemviews kwindowsystem kio kcrash
     boost libraw fftw eigen exiv2 lcms2 gsl openexr libheif giflib
-    openjpeg opencolorio poppler_qt5 curl ilmbase
+    openjpeg opencolorio poppler curl ilmbase
     qtmultimedia qtx11extras
     python3
   ] ++ lib.optional (stdenv.hostPlatform.isi686 || stdenv.hostPlatform.isx86_64) vc;

pkgs/applications/graphics/qcomicbook/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, pkgconfig, cmake, qtbase, qttools, qtx11extras, poppler_qt5 }:
+{ stdenv, fetchFromGitHub, pkgconfig, cmake, qtbase, qttools, qtx11extras, poppler }:
 
 stdenv.mkDerivation rec {
   name = "qcomicbook-${version}";
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    qtbase qttools qtx11extras poppler_qt5
+    qtbase qttools qtx11extras poppler
   ];
 
   postInstall = ''

pkgs/applications/kde/fetch.sh

@@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/applications/18.08.0/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/applications/18.08.1/ -A '*.tar.xz' )

pkgs/applications/misc/dbeaver/default.nix

@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation rec {
   name = "dbeaver-ce-${version}";
-  version = "5.1.6";
+  version = "5.2.0";
 
   desktopItem = makeDesktopItem {
     name = "dbeaver";
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://dbeaver.io/files/${version}/dbeaver-ce-${version}-linux.gtk.x86_64.tar.gz";
-    sha256 = "1zypadnyhinm6mfv91s7zs2s55bhzgkqhl6ai6x3yqwhvayc02nn";
+    sha256 = "13j2qc4g24d2gmkxj9zpqrcbai9aq8rassrq3c9mp9ir6sf4q0jf";
   };
 
   installPhase = ''

pkgs/applications/misc/electrum/default.nix

@@ -1,12 +1,24 @@
 { stdenv, fetchurl, python3, python3Packages, zbar }:
 
+let
+  qdarkstyle = python3Packages.buildPythonPackage rec {
+    pname = "QDarkStyle";
+    version = "2.5.4";
+    src = python3Packages.fetchPypi {
+      inherit pname version;
+      sha256 = "1w715m1i5pycfqcpkrggpn0rs9cakx6cm5v8rggcxnf4p0i0kdiy";
+    };
+    doCheck = false; # no tests
+  };
+in
+
 python3Packages.buildPythonApplication rec {
   name = "electrum-${version}";
-  version = "3.1.3";
+  version = "3.2.3";
 
   src = fetchurl {
     url = "https://download.electrum.org/${version}/Electrum-${version}.tar.gz";
-    sha256 = "05m28yd3zr9awjhaqikf4rg08j5i4ygm750ip1z27wl446sysniy";
+    sha256 = "022iw4cq0c009wvqn7wd815jc0nv8198lq3cawn8h6c28hw2mhs1";
   };
 
   propagatedBuildInputs = with python3Packages; [
@@ -17,12 +29,14 @@ python3Packages.buildPythonApplication rec {
     pbkdf2
     protobuf
     pyaes
-    pycrypto
+    pycryptodomex
     pyqt5
     pysocks
+    qdarkstyle
     qrcode
     requests
     tlslite
+    typing
 
     # plugins
     keepkey
@@ -35,10 +49,10 @@ python3Packages.buildPythonApplication rec {
 
   preBuild = ''
     sed -i 's,usr_share = .*,usr_share = "'$out'/share",g' setup.py
-    pyrcc5 icons.qrc -o gui/qt/icons_rc.py
+    pyrcc5 icons.qrc -o electrum/gui/qt/icons_rc.py
     # Recording the creation timestamps introduces indeterminism to the build
-    sed -i '/Created: .*/d' gui/qt/icons_rc.py
+    sed -i '/Created: .*/d' electrum/gui/qt/icons_rc.py
-    sed -i "s|name = 'libzbar.*'|name='${zbar}/lib/libzbar.so'|" lib/qrscanner.py
+    sed -i "s|name = 'libzbar.*'|name='${zbar}/lib/libzbar.so'|" electrum/qrscanner.py
   '';
 
   postInstall = ''

pkgs/applications/misc/glava/default.nix

@@ -1,24 +1,14 @@
-{ stdenv, fetchurl, writeScript, fetchFromGitHub
+{ stdenv, fetchgit, fetchurl, writeScript
 , libGL, libX11, libXext, python3, libXrandr, libXrender, libpulseaudio, libXcomposite
 , enableGlfw ? false, glfw }:
 
 let
   inherit (stdenv.lib) optional makeLibraryPath;
 
-  version = "1.4.5";
-  gladVersion = "0.1.24";
-  # glad
-  # https://github.com/wacossusca34/glava/issues/46#issuecomment-397816520
-  glad = fetchFromGitHub {
-    owner = "Dav1dde";
-    repo = "glad";
-    rev = "v${gladVersion}";
-    sha256 = "0s2c9w064kqa5i07w8zmvgpg1pa3wj86l1nhgw7w56cjhq7cf8h8";
-  };
   # gl.xml
   gl = fetchurl {
-    url = https://raw.githubusercontent.com/KhronosGroup/OpenGL-Registry/a24f3f7a4c924fdbc666024f99c70e5b8e34c819/xml/gl.xml;
+    url = https://raw.githubusercontent.com/KhronosGroup/OpenGL-Registry/56312cfe680e4be5ae61bbf1c628e420f8731718/xml/gl.xml;
-    sha256 = "1mskxjmhb35m8qv255pibf633d8sn1w9rdsf0lj75bhlgy0zi5c7";
+    sha256 = "1c45bcgaxiic5gmb3gkrd9qcvascvij97vz5y6fc3a2y7x3gjc5l";
   };
   # EGL 1.5
   egl = fetchurl {
@@ -43,12 +33,12 @@ let
 in
   stdenv.mkDerivation rec {
     name = "glava-${version}";
+    version = "1.5.1";
 
-    src = fetchFromGitHub {
+    src = fetchgit {
-      owner = "wacossusca34";
+      url = "https://github.com/wacossusca34/glava.git";
-      repo = "glava";
       rev = "v${version}";
-      sha256 = "1zfw8samrzxxbny709rcdz1z77cw1cd46wlfnf7my02kipmqn0nr";
+      sha256 = "1k8x0a0g2pm7ficsk4az9s7mjbm85a987apjg5c4y6iyldxgd6sb";
     };
 
     buildInputs = [
@@ -65,7 +55,6 @@ in
     ];
 
     patchPhase = ''
-      cp -r --no-preserve=all ${glad}/* glad
       mkdir -p glad/include/KHR
 
       cp ${gl} glad/gl.xml

pkgs/applications/misc/josm/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "josm-${version}";
-  version = "14066";
+  version = "14178";
 
   src = fetchurl {
     url = "https://josm.openstreetmap.de/download/josm-snapshot-${version}.jar";
-    sha256 = "06mhaz5vr19ydqc5irhgcbl0s8fifwvaq60iz2nsnlxb1pw89xia";
+    sha256 = "08an4s8vbcd8vyinnvd7cxmgnrsy47j78a94nk6vq244gp7v5n0r";
   };
 
   buildInputs = [ jre10 makeWrapper ];

pkgs/applications/misc/mediainfo-gui/default.nix

@@ -2,11 +2,11 @@
 , desktop-file-utils, libSM, imagemagick }:
 
 stdenv.mkDerivation rec {
-  version = "18.05";
+  version = "18.08";
   name = "mediainfo-gui-${version}";
   src = fetchurl {
     url = "https://mediaarea.net/download/source/mediainfo/${version}/mediainfo_${version}.tar.xz";
-    sha256 = "0rgsfplisf729n1j3fyg82wpw88aahisrddn5wq9yx8hz6m96h6r";
+    sha256 = "0l4bhrgwfn3da6cr0jz5vs17sk7k0bc26nk7hymv04xifns5999n";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];

pkgs/applications/misc/mediainfo/default.nix

@@ -1,11 +1,11 @@
 { stdenv, fetchurl, autoreconfHook, pkgconfig, libzen, libmediainfo, zlib }:
 
 stdenv.mkDerivation rec {
-  version = "18.05";
+  version = "18.08";
   name = "mediainfo-${version}";
   src = fetchurl {
     url = "https://mediaarea.net/download/source/mediainfo/${version}/mediainfo_${version}.tar.xz";
-    sha256 = "0rgsfplisf729n1j3fyg82wpw88aahisrddn5wq9yx8hz6m96h6r";
+    sha256 = "0l4bhrgwfn3da6cr0jz5vs17sk7k0bc26nk7hymv04xifns5999n";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];

pkgs/applications/misc/notejot/default.nix

@@ -0,0 +1,47 @@
+{ stdenv, fetchFromGitHub, vala, pkgconfig, meson, ninja, python3, granite
+, gtk3, gnome3, gtksourceview, json-glib, gobjectIntrospection, wrapGAppsHook }:
+
+stdenv.mkDerivation rec {
+  pname = "notejot";
+  version = "1.4.5";
+
+  name = "${pname}-${version}";
+
+  src = fetchFromGitHub {
+    owner = "lainsce";
+    repo = pname;
+    rev = version;
+    sha256 = "0mjig4y2rb6v2dyzya44mfz0dxgp5wnjs3kdavf9ha2jzjjr5xyb";
+  };
+
+  nativeBuildInputs = [
+    gobjectIntrospection
+    meson
+    ninja
+    pkgconfig
+    python3
+    vala
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    gnome3.libgee
+    granite
+    gtk3
+    gtksourceview
+    json-glib
+  ];
+
+  postPatch = ''
+    chmod +x meson/post_install.py
+    patchShebangs meson/post_install.py
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Stupidly-simple sticky notes applet";
+    homepage    = https://github.com/lainsce/notejot;
+    license     = licenses.gpl2Plus;
+    maintainers = with maintainers; [ worldofpeace ];
+    platforms   = platforms.linux;
+  };
+}

pkgs/applications/misc/ranger/default.nix

@@ -7,13 +7,13 @@ assert imagePreviewSupport -> w3m != null;
 
 python3Packages.buildPythonApplication rec {
   name = "ranger-${version}";
-  version = "1.9.1";
+  version = "1.9.2";
 
   src = fetchFromGitHub {
     owner = "ranger";
     repo = "ranger";
     rev = "v${version}";
-    sha256= "1zhds37j1scxa9b183qbrjwxqldrdk581c5xiy81vg17sndb1kqj";
+    sha256= "1ws6g8z1m1hfp8bv4msvbaa9f7948p687jmc8h69yib4jkv3qyax";
   };
 
   checkInputs = with python3Packages; [ pytest ];
@@ -51,6 +51,6 @@ python3Packages.buildPythonApplication rec {
     homepage = http://ranger.github.io/;
     license = licenses.gpl3;
     platforms = platforms.unix;
-    maintainers = [ maintainers.magnetophon ];
+    maintainers = [ maintainers.toonn maintainers.magnetophon ];
   };
 }

pkgs/applications/misc/sequeler/default.nix

@@ -4,7 +4,7 @@
 
 
 let
-  version = "0.6.0";
+  version = "0.6.2";
   sqlGda = libgda.override {
     mysqlSupport = true;
     postgresSupport = true;
@@ -17,7 +17,7 @@ in stdenv.mkDerivation rec {
     owner = "Alecaddd";
     repo = "sequeler";
     rev = "v${version}";
-    sha256 = "04x3fg665201g3zy66sicfna4vac4n1pmrahbra90gvfzaia1cai";
+    sha256 = "0j5z3z34jc1acclmlkjpv7fcs4f2gf0bcfnvcpn3zdzw9fzj0sw7";
   };
 
   nativeBuildInputs = [ meson ninja pkgconfig vala gobjectIntrospection gettext wrapGAppsHook python3 desktop-file-utils ];

pkgs/applications/misc/solaar/default.nix

@@ -1,5 +1,5 @@
-{fetchFromGitHub, stdenv, gtk3, python34Packages, gobjectIntrospection}:
+{fetchFromGitHub, stdenv, gtk3, pythonPackages, gobjectIntrospection}:
-python34Packages.buildPythonApplication rec {
+pythonPackages.buildPythonApplication rec {
   name = "solaar-unstable-${version}";
   version = "2018-02-02";
   namePrefix = "";
@@ -10,7 +10,7 @@ python34Packages.buildPythonApplication rec {
     sha256 = "0zy5vmjzdybnjf0mpp8rny11sc43gmm8172svsm9s51h7x0v83y3";
   };
 
-  propagatedBuildInputs = [python34Packages.pygobject3 python34Packages.pyudev gobjectIntrospection gtk3];
+  propagatedBuildInputs = [pythonPackages.pygobject3 pythonPackages.pyudev gobjectIntrospection gtk3];
   postInstall = ''
     wrapProgram "$out/bin/solaar" \
       --prefix PYTHONPATH : "$PYTHONPATH" \

pkgs/applications/misc/taskjuggler/Gemfile.lock

@@ -1,15 +1,15 @@
 GEM
   remote: http://rubygems.org/
   specs:
-    mail (2.6.3)
+    mail (2.7.0)
-      mime-types (>= 1.16, < 3)
+      mini_mime (>= 0.1.1)
-    mime-types (2.6.1)
+    mini_mime (1.0.1)
-    taskjuggler (3.5.0)
+    taskjuggler (3.6.0)
       mail (>= 2.4.3)
       term-ansicolor (>= 1.0.7)
-    term-ansicolor (1.3.2)
+    term-ansicolor (1.6.0)
       tins (~> 1.0)
-    tins (1.6.0)
+    tins (1.16.3)
 
 PLATFORMS
   ruby
@@ -18,4 +18,4 @@ DEPENDENCIES
   taskjuggler
 
 BUNDLED WITH
-   1.10.5
+   1.14.6

pkgs/applications/misc/taskjuggler/default.nix

@@ -1,16 +1,21 @@
-{ lib, bundlerEnv, ruby }:
+{ lib, bundlerApp, ruby }:
 
-bundlerEnv {
+bundlerApp {
-  name = "taskjuggler-3.5.0";
+  pname = "taskjuggler";
 
   inherit ruby;
   gemdir = ./.;
 
+  exes = [
+    "tj3" "tj3client" "tj3d" "tj3man" "tj3ss_receiver" "tj3ss_sender"
+    "tj3ts_receiver" "tj3ts_sender" "tj3ts_summary" "tj3webd"
+  ];
+
   meta = {
-    broken = true; # needs ruby 2.0
     description = "A modern and powerful project management tool";
     homepage    = http://taskjuggler.org/;
     license     = lib.licenses.gpl2;
     platforms   = lib.platforms.unix;
+    maintainers = [ lib.maintainers.manveru ];
   };
 }

pkgs/applications/misc/taskjuggler/gemset.nix

@@ -1,47 +1,55 @@
 {
-  "mail" = {
+  mail = {
-    version = "2.6.3";
+    dependencies = ["mini_mime"];
+    groups = ["default"];
+    platforms = [];
     source = {
+      remotes = ["http://rubygems.org"];
+      sha256 = "10dyifazss9mgdzdv08p47p344wmphp5pkh5i73s7c04ra8y6ahz";
       type = "gem";
-      sha256 = "1nbg60h3cpnys45h7zydxwrl200p7ksvmrbxnwwbpaaf9vnf3znp";
     };
-    dependencies = [
+    version = "2.7.0";
-      "mime-types"
-    ];
   };
-  "mime-types" = {
+  mini_mime = {
-    version = "2.6.1";
+    groups = ["default"];
+    platforms = [];
     source = {
+      remotes = ["http://rubygems.org"];
+      sha256 = "1q4pshq387lzv9m39jv32vwb8wrq3wc4jwgl4jk209r4l33v09d3";
       type = "gem";
-      sha256 = "1vnrvf245ijfyxzjbj9dr6i1hkjbyrh4yj88865wv9bs75axc5jv";
     };
+    version = "1.0.1";
   };
-  "taskjuggler" = {
+  taskjuggler = {
-    version = "3.5.0";
+    dependencies = ["mail" "term-ansicolor"];
+    groups = ["default"];
+    platforms = [];
     source = {
+      remotes = ["http://rubygems.org"];
+      sha256 = "0ky3cydl3szhdyxsy4k6zxzjlbll7mlq025aj6xd5jmh49k3pfbp";
       type = "gem";
-      sha256 = "0r84rlc7a6w7p9nc9mgycbs5h0hq0kzscjq7zj3296xyf0afiwj2";
     };
-    dependencies = [
+    version = "3.6.0";
-      "mail"
-      "term-ansicolor"
-    ];
   };
-  "term-ansicolor" = {
+  term-ansicolor = {
-    version = "1.3.2";
+    dependencies = ["tins"];
+    groups = ["default"];
+    platforms = [];
     source = {
+      remotes = ["http://rubygems.org"];
+      sha256 = "1b1wq9ljh7v3qyxkk8vik2fqx2qzwh5lval5f92llmldkw7r7k7b";
       type = "gem";
-      sha256 = "0ydbbyjmk5p7fsi55ffnkq79jnfqx65c3nj8d9rpgl6sw85ahyys";
     };
-    dependencies = [
-      "tins"
-    ];
-  };
-  "tins" = {
     version = "1.6.0";
+  };
+  tins = {
+    groups = ["default"];
+    platforms = [];
     source = {
+      remotes = ["http://rubygems.org"];
+      sha256 = "0g95xs4nvx5n62hb4fkbkd870l9q3y9adfc4h8j21phj9mxybkb8";
       type = "gem";
-      sha256 = "02qarvy17nbwvslfgqam8y6y7479cwmb1a6di9z18hzka4cf90hz";
     };
+    version = "1.16.3";
   };
 }

pkgs/applications/misc/tilix/default.nix

@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   name = "tilix-${version}";
-  version = "1.8.3";
+  version = "1.8.5";
 
   src = fetchFromGitHub {
     owner = "gnunn1";
     repo = "tilix";
     rev = "${version}";
-    sha256 = "05x2nyyb5w3122j90g0f7lh9jl7xi1nk176sl01vl2ks7zar00dq";
+    sha256 = "1ixhkssz0xn3x75n2iw6gd3hka6bgmgwfgbvblbjhhx8gcpbw3s7";
   };
 
   nativeBuildInputs = [

pkgs/applications/misc/worker/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "worker-${version}";
-  version = "3.15.1";
+  version = "3.15.2";
 
   src = fetchurl {
     url = "http://www.boomerangsworld.de/cms/worker/downloads/${name}.tar.gz";
-    sha256 = "05h25dxqff4xhmrk7j9j11yxpqa4qm7m3xprv7yldryc1mbvnpwi";
+    sha256 = "0km17ls51vp4nxlppf58vvxxymyx6w3xlzjc8wghxpjj098v4pp8";
   };
 
   buildInputs = [ libX11 ];

pkgs/applications/misc/xca/default.nix

@@ -1,15 +1,15 @@
-{ mkDerivation, lib, fetchFromGitHub, autoreconfHook, perl, pkgconfig, which
+{ mkDerivation, lib, fetchFromGitHub, autoreconfHook, perl, pkgconfig
 , libtool, openssl, qtbase, qttools }:
 
 mkDerivation rec {
   name = "xca-${version}";
-  version = "2.1.0";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner  = "chris2511";
     repo   = "xca";
     rev    = "RELEASE.${version}";
-    sha256 = "039qz6hh43hx8dcw2bq71mgy95zk09jyd3xxpldmxxd5d69zcr8m";
+    sha256 = "1d09329a80axwqhxixwasd8scsmh23vsq1076amy5c8173s4ambi";
   };
 
   postPatch = ''
@@ -17,15 +17,15 @@ mkDerivation rec {
       --replace /usr/bin/perl ${perl}/bin/perl
   '';
 
-  buildInputs = [ libtool openssl qtbase qttools ];
+  buildInputs = [ libtool openssl qtbase ];
 
-  nativeBuildInputs = [ autoreconfHook pkgconfig which ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig qttools ];
 
   enableParallelBuilding = true;
 
   meta = with lib; {
-    description = "Interface for managing asymetric keys like RSA or DSA";
+    description = "An x509 certificate generation tool, handling RSA, DSA and EC keys, certificate signing requests (PKCS#10) and CRLs";
-    homepage    = http://xca.sourceforge.net/;
+    homepage    = https://hohnstaedt.de/xca/;
     license     = licenses.bsd3;
     maintainers = with maintainers; [ offline peterhoeg ];
     platforms   = platforms.all;

pkgs/applications/networking/browsers/chromium/common.nix

@@ -1,4 +1,4 @@
-{ stdenv, ninja, which, nodejs, fetchurl, fetchpatch, gnutar
+{ stdenv, gn, ninja, which, nodejs, fetchurl, fetchpatch, gnutar
 
 # default dependencies
 , bzip2, flac, speex, libopus
@@ -139,11 +139,6 @@ let
     # (gentooPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000")
       ./patches/fix-freetype.patch
       ./patches/nix_plugin_paths_68.patch
-    ]  ++ optionals (versionRange "68" "69") [
-      ./patches/remove-webp-include-68.patch
-      (githubPatch "4d10424f9e2a06978cdd6cdf5403fcaef18e49fc" "11la1jycmr5b5rw89mzcdwznmd2qh28sghvz9klr1qhmsmw1vzjc")
-      (githubPatch "56cb5f7da1025f6db869e840ed34d3b98b9ab899" "04mp5r1yvdvdx6m12g3lw3z51bzh7m3gr73mhblkn4wxdbvi3dcs")
-    ]  ++ optionals (versionAtLeast version "69") [
       ./patches/remove-webp-include-69.patch
     ] ++ optional enableWideVine ./patches/widevine.patch;
 
@@ -243,15 +238,11 @@ let
     configurePhase = ''
       runHook preConfigure
 
-      # Build gn
-      python tools/gn/bootstrap/bootstrap.py -v -s --no-clean
-      PATH="$PWD/out/Release:$PATH"
-
       # This is to ensure expansion of $out.
       libExecPath="${libExecPath}"
       python build/linux/unbundle/replace_gn_files.py \
         --system-libraries ${toString gnSystemLibraries}
-      gn gen --args=${escapeShellArg gnFlags} out/Release | tee gn-gen-outputs.txt
+      ${gn}/bin/gn gen --args=${escapeShellArg gnFlags} out/Release | tee gn-gen-outputs.txt
 
       # Fail if `gn gen` contains a WARNING.
       grep -o WARNING gn-gen-outputs.txt && echo "Found gn WARNING, exiting nix build" && exit 1

pkgs/applications/networking/browsers/chromium/patches/remove-webp-include-68.patch

@@ -1,12 +0,0 @@
---- a/third_party/blink/renderer/platform/image-encoders/image_encoder.h
-+++ b/third_party/blink/renderer/platform/image-encoders/image_encoder.h
-@@ -8,7 +8,7 @@
- #include "third_party/blink/renderer/platform/platform_export.h"
- #include "third_party/blink/renderer/platform/wtf/vector.h"
- #include "third_party/libjpeg/jpeglib.h"          // for JPEG_MAX_DIMENSION
--#include "third_party/libwebp/src/webp/encode.h"  // for WEBP_MAX_DIMENSION
-+#define WEBP_MAX_DIMENSION 16383
- #include "third_party/skia/include/core/SkStream.h"
- #include "third_party/skia/include/encode/SkJpegEncoder.h"
- #include "third_party/skia/include/encode/SkPngEncoder.h"
-

pkgs/applications/networking/browsers/chromium/plugins.nix

@@ -98,11 +98,11 @@ let
 
   flash = stdenv.mkDerivation rec {
     name = "flashplayer-ppapi-${version}";
-    version = "30.0.0.154";
+    version = "31.0.0.108";
 
     src = fetchzip {
       url = "https://fpdownload.adobe.com/pub/flashplayer/pdc/${version}/flash_player_ppapi_linux.x86_64.tar.gz";
-      sha256 = "0bi9b6syx7x2avixgjwanrvynzanf89xm2g3nxazw9qgxxc1cp48";
+      sha256 = "0dcwyx0fp7wbsx0cyi7xpwq0nnvcvkzfgi6zyy75487820ssc4h1";
       stripRoot = false;
     };
 

pkgs/applications/networking/browsers/chromium/upstream-info.nix

@@ -1,18 +1,18 @@
 # This file is autogenerated from update.sh in the same directory.
 {
   beta = {
-    sha256 = "0w5k1446j45796vj8p6kv5cdrkrxyr7rh8d8vavplfldbvg36bdw";
+    sha256 = "0i3iz6c05ykqxbq58sx954nky0gd0schl7ik2r56p3jqsk8cfnhn";
-    sha256bin64 = "0a7gmbcps3b85rhwgrvg41m9db2n3igwr4hncm7kcqnq5hr60v8s";
+    sha256bin64 = "03k5y1nyzx26mxwxmdijkl2kj49vm5vhbxhakfxxjg3r1v0rsqrs";
-    version = "69.0.3497.32";
+    version = "69.0.3497.81";
   };
   dev = {
-    sha256 = "15gk2jbjv3iy4hg4xm1f66x5jqfqh9f98wfzrcsd5ix3ki3f9g3c";
+    sha256 = "1lx6dfd6w675b4kyrci8ikc8rfmjc1aqmm7bimxp3h4p97j5wml1";
-    sha256bin64 = "1lir6q31dnjsbrz99bfx74r5j6f0c1a443ky1k0idbx6ysvr8nnm";
+    sha256bin64 = "0fsxj9h25glp3akw0x2rc488w5zr5v5yvl6ry7fy8w70fqgynffj";
-    version = "70.0.3521.2";
+    version = "70.0.3538.9";
   };
   stable = {
-    sha256 = "1676y2axl5ihvv8jid2i9wp4i4awxzij5nwvd5zx98506l3088bh";
+    sha256 = "0i3iz6c05ykqxbq58sx954nky0gd0schl7ik2r56p3jqsk8cfnhn";
-    sha256bin64 = "0d352maw1630g0hns3c0g0n95bp5iqh7nzs8bnv48kxz87snmpdj";
+    sha256bin64 = "1f3shb85jynxq37vjxxkkxrjayqgvpss1zws5i28x6i9nygfzay7";
-    version = "68.0.3440.106";
+    version = "69.0.3497.81";
   };
 }

pkgs/applications/networking/browsers/eolie/default.nix

@@ -1,45 +1,53 @@
-{ stdenv, fetchgit, meson, ninja, pkgconfig, wrapGAppsHook
+{ stdenv, fetchgit, meson, ninja, pkgconfig
-, desktop-file-utils, gobjectIntrospection, python36Packages
+, python3, gtk3, libsecret, gst_all_1, webkitgtk
-, gnome3, gst_all_1, gtkspell3, hunspell }:
+, glib-networking, gtkspell3, hunspell, desktop-file-utils
+, gobjectIntrospection, wrapGAppsHook }:
 
-stdenv.mkDerivation rec {
+python3.pkgs.buildPythonApplication rec {
   name = "eolie-${version}";
-  version = "0.9.35";
+  version = "0.9.36";
+
+  format = "other";
+  doCheck = false;
 
   src = fetchgit {
     url = "https://gitlab.gnome.org/World/eolie";
     rev = "refs/tags/${version}";
     fetchSubmodules = true;
-    sha256 = "0x3p1fgx1fhrnr7vkkpnl34401r6k6xg2mrjff7ncb1k57q522k7";
+    sha256 = "1pqs6lddkj7nvxdwf0yncwdcr7683mpvx3912vn7b1f2q2zkp1fv";
   };
 
-  nativeBuildInputs = with python36Packages; [
+  nativeBuildInputs = [
     desktop-file-utils
     gobjectIntrospection
     meson
     ninja
     pkgconfig
     wrapGAppsHook
-    wrapPython
   ];
 
-  buildInputs = [ gtkspell3 hunspell python36Packages.pygobject3 ] ++ (with gnome3; [
+  buildInputs = with gst_all_1; [
-    glib glib-networking gsettings-desktop-schemas gtk3 webkitgtk libsecret
+    glib-networking
-  ]) ++ (with gst_all_1; [
+    gst-libav
-    gst-libav gst-plugins-base gst-plugins-ugly gstreamer
+    gst-plugins-base
-  ]);
+    gst-plugins-ugly
+    gstreamer
+    gtk3
+    gtkspell3
+    hunspell
+    libsecret
+    webkitgtk
+  ];
 
-  pythonPath = with python36Packages; [
+  pythonPath = with python3.pkgs; [
     beautifulsoup4
     pycairo
     pygobject3
     python-dateutil
   ];
 
-  postFixup = "wrapPythonPrograms";
-
   postPatch = ''
-    chmod +x meson_post_install.py # patchShebangs requires executable file
+    chmod +x meson_post_install.py
     patchShebangs meson_post_install.py
   '';
 

pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix

@@ -73,25 +73,25 @@ let
 in
 stdenv.mkDerivation rec {
   name = "flashplayer-${version}";
-  version = "30.0.0.154";
+  version = "31.0.0.108";
 
   src = fetchurl {
     url =
       if debug then
-        "https://fpdownload.macromedia.com/pub/flashplayer/updaters/30/flash_player_npapi_linux_debug.${arch}.tar.gz"
+        "https://fpdownload.macromedia.com/pub/flashplayer/updaters/31/flash_player_npapi_linux_debug.${arch}.tar.gz"
       else
         "https://fpdownload.adobe.com/get/flashplayer/pdc/${version}/flash_player_npapi_linux.${arch}.tar.gz";
     sha256 =
       if debug then
         if arch == "x86_64" then
-          "04hfh0vn1n70gdpfydq0sj94d6rkbk80h4pmy3rsfvhg0x540wx8"
+          "1mn29ahxjf6pdy2zp2na14cz46jrl88f54kp3bs3cz75syyizyb6"
         else
-          "073327sszbvkglh5b18axmwv40sy2vyacdhcd1fx82qskv44sfda"
+          "0inpj6bcsn5lh8gdv1wxpgipzrmpc553nhr68a55b2wff9fkv1ci"
       else
         if arch == "x86_64" then
-          "03ypgzy88ck5rn1q971v0km9yw3p10ly1zkxh239v6nx0hs35w84"
+          "1dfgsl5jf8ja9f7wwkzj5bfz1v5rdsyf4qhg1shqqldadmyyha7p"
         else
-          "0rld7i659ccp4gvcvdkqkc1lajvlss5d4qndzf9aqiksvdknv62x";
+          "0yiqwwqs3z9zzkfgqzjwqqdr2vaj1ia5xychs9fgxix3y4j934da";
   };
 
   nativeBuildInputs = [ unzip ];

pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix

@@ -49,19 +49,19 @@
 
 stdenv.mkDerivation rec {
   name = "flashplayer-standalone-${version}";
-  version = "30.0.0.154";
+  version = "31.0.0.108";
 
   src = fetchurl {
     url =
       if debug then
-        "https://fpdownload.macromedia.com/pub/flashplayer/updaters/30/flash_player_sa_linux_debug.x86_64.tar.gz"
+        "https://fpdownload.macromedia.com/pub/flashplayer/updaters/31/flash_player_sa_linux_debug.x86_64.tar.gz"
       else
-        "https://fpdownload.macromedia.com/pub/flashplayer/updaters/30/flash_player_sa_linux.x86_64.tar.gz";
+        "https://fpdownload.macromedia.com/pub/flashplayer/updaters/31/flash_player_sa_linux.x86_64.tar.gz";
     sha256 =
       if debug then
-        "133zhgc5fh6s0xr93lv70xcrgvaj7lhjxk5w7xz79h3mp185p3g4"
+        "0i047fvj3x9lx7x8bf7jl1ybf9xpmr6g77q0h7n2s8qvscsw0pmm"
       else
-        "1xz1l5q0zahalh0l4mkrwhmfrmcli3sckg3rcfnllizq9rbfzcmr";
+        "19wfs452ix57yfi4cy2din6mi5jky9hjzbdjny1bl8w32fy8xmm3";
   };
 
   nativeBuildInputs = [ unzip ];

pkgs/applications/networking/browsers/qutebrowser/default.nix

@@ -55,10 +55,13 @@ in python3Packages.buildPythonApplication rec {
   propagatedBuildInputs = with python3Packages; [
     pyyaml pyqt5 jinja2 pygments
     pypeg2 cssutils pyopengl attrs
+    # scripts and userscripts libs
+    tldextract beautifulsoup4
+    pyreadability pykeepass stem
   ];
 
   postPatch = ''
-    sed -i "s,/usr/share/qutebrowser,$out/share/qutebrowser,g" qutebrowser/utils/standarddir.py
+    sed -i "s,/usr/share/,$out/share/,g" qutebrowser/utils/standarddir.py
   '' + lib.optionalString withPdfReader ''
     sed -i "s,/usr/share/pdf.js,${pdfjs},g" qutebrowser/browser/pdfjs.py
   '';
@@ -81,15 +84,15 @@ in python3Packages.buildPythonApplication rec {
         "$out/share/icons/hicolor/scalable/apps/qutebrowser.svg"
 
     # Install scripts
-    sed -i "s,/usr/bin/qutebrowser,$out/bin/qutebrowser,g" scripts/open_url_in_instance.sh
+    sed -i "s,/usr/bin/,$out/bin/,g" scripts/open_url_in_instance.sh
-    install -Dm755 -t "$out/share/qutebrowser/scripts/" scripts/open_url_in_instance.sh
+    install -Dm755 -t "$out/share/qutebrowser/scripts/" $(find scripts -type f)
     install -Dm755 -t "$out/share/qutebrowser/userscripts/" misc/userscripts/*
 
-    # Install and patch python scripts
+    # Patch python scripts
     buildPythonPath "$out $propagatedBuildInputs"
-    for i in importer dictcli keytester utils; do
+    scripts=$(grep -rl python "$out"/share/qutebrowser/{user,}scripts/)
-      install -Dm755 -t "$out/share/qutebrowser/scripts/" scripts/$i.py
+    for i in $scripts; do
-      patchPythonScript "$out/share/qutebrowser/scripts/$i.py"
+      patchPythonScript "$i"
     done
   '';
 
@@ -97,10 +100,10 @@ in python3Packages.buildPythonApplication rec {
     wrapProgram $out/bin/qutebrowser --add-flags "--backend webkit"
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
-    homepage = https://github.com/The-Compiler/qutebrowser;
+    homepage    = https://github.com/The-Compiler/qutebrowser;
     description = "Keyboard-focused browser with a minimal GUI";
-    license = stdenv.lib.licenses.gpl3Plus;
+    license     = licenses.gpl3Plus;
-    maintainers = [ stdenv.lib.maintainers.jagajaga ];
+    maintainers = with maintainers; [ jagajaga rnhmjoj ];
   };
 }

pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix

@@ -14,7 +14,7 @@
 , freetype
 , gdk_pixbuf
 , glib
-, gtk2
+, gtk3
 , libxcb
 , libX11
 , libXext
@@ -42,8 +42,10 @@
 # Wrapper runtime
 , coreutils
 , glibcLocales
-, hicolor-icon-theme
+, defaultIconTheme
+, runtimeShell
 , shared-mime-info
+, gsettings-desktop-schemas
 
 # Whether to disable multiprocess support to work around crashing tabs
 # TODO: fix the underlying problem instead of this terrible work-around
@@ -70,7 +72,7 @@ let
     freetype
     gdk_pixbuf
     glib
-    gtk2
+    gtk3
     libxcb
     libX11
     libXext
@@ -101,7 +103,7 @@ let
   fteLibPath = makeLibraryPath [ stdenv.cc.cc gmp ];
 
   # Upstream source
-  version = "7.5.6";
+  version = "8.0";
 
   lang = "en-US";
 
@@ -111,7 +113,7 @@ let
         "https://github.com/TheTorProject/gettorbrowser/releases/download/v${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
         "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
       ];
-      sha256 = "07z7lg5firyah0897pr04wqnbgf4mvsnk3gq2zgsg1rrwladxz5s";
+      sha256 = "139cizh33x3nzr0f4b2q3cchrv9l01n3c2v0v0mghq30hap55p79";
     };
 
     "i686-linux" = fetchurl {
@@ -119,7 +121,7 @@ let
         "https://github.com/TheTorProject/gettorbrowser/releases/download/v${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
         "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
       ];
-      sha256 = "1s0k82ch7ypjyc5k5rb4skb9ylnp7b9ipvf8gb7pdhb8m4zjk461";
+      sha256 = "1vw5wh193vs5x3wizz34m2nyzlxpn24727hdxqpiqwlhwhj7y3nx";
     };
   };
 in
@@ -154,10 +156,14 @@ stdenv.mkDerivation rec {
     pushd "$TBB_IN_STORE"
 
     # Set ELF interpreter
-    for exe in firefox TorBrowser/Tor/tor ; do
+    for exe in firefox.real TorBrowser/Tor/tor ; do
+      echo "Setting ELF interpreter on $exe ..." >&2
       patchelf --set-interpreter "$interp" "$exe"
     done
 
+    # firefox is a wrapper that checks for a more recent libstdc++ & appends it to the ld path
+    mv firefox.real firefox
+
     # The final libPath.  Note, we could split this into firefoxLibPath
     # and torLibPath for accuracy, but this is more convenient ...
     libPath=${libPath}:$TBB_IN_STORE:$TBB_IN_STORE/TorBrowser/Tor
@@ -219,7 +225,7 @@ stdenv.mkDerivation rec {
 
     // Insist on using IPC for communicating with Tor
     //
-    // Defaults to creating $TBB_HOME/TorBrowser/Data/Tor/{socks,control}.socket
+    // Defaults to creating \$TBB_HOME/TorBrowser/Data/Tor/{socks,control}.socket
     lockPref("extensions.torlauncher.control_port_use_ipc", true);
     lockPref("extensions.torlauncher.socks_port_use_ipc", true);
 
@@ -245,10 +251,6 @@ stdenv.mkDerivation rec {
     sed -i "$FONTCONFIG_FILE" \
         -e "s,<dir>fonts</dir>,<dir>$TBB_IN_STORE/fonts</dir>,"
 
-    # Move default extension overrides into distribution dir, to avoid
-    # having to synchronize between local state and store.
-    mv TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js defaults/pref/torbrowser.js
-
     # Preload extensions by moving into the runtime instead of storing under the
     # user's profile directory.
     mv "$TBB_IN_STORE/TorBrowser/Data/Browser/profile.default/extensions/"* \
@@ -264,14 +266,19 @@ stdenv.mkDerivation rec {
     EOF
 
     WRAPPER_XDG_DATA_DIRS=${concatMapStringsSep ":" (x: "${x}/share") [
-      hicolor-icon-theme
+      defaultIconTheme
       shared-mime-info
     ]}
+    WRAPPER_XDG_DATA_DIRS+=":"${concatMapStringsSep ":" (x: "${x}/share/gsettings-schemas/${x.name}") [
+      glib
+      gsettings-desktop-schemas
+      gtk3
+    ]};
 
     # Generate wrapper
     mkdir -p $out/bin
     cat > "$out/bin/tor-browser" << EOF
-    #! ${stdenv.shell}
+    #! ${runtimeShell}
     set -o errexit -o nounset
 
     PATH=${makeBinPath [ coreutils ]}
@@ -384,11 +391,7 @@ stdenv.mkDerivation rec {
     cp $desktopItem/share/applications"/"* $out/share/applications
     sed -i $out/share/applications/torbrowser.desktop \
         -e "s,Exec=.*,Exec=$out/bin/tor-browser," \
-        -e "s,Icon=.*,Icon=$out/share/pixmaps/torbrowser.png,"
+        -e "s,Icon=.*,Icon=web-browser,"
-
-    # Install icons
-    mkdir -p $out/share/pixmaps
-    cp browser/icons/mozicon128.png $out/share/pixmaps/torbrowser.png
 
     # Check installed apps
     echo "Checking bundled Tor ..."

pkgs/applications/networking/charles/default.nix

@@ -14,11 +14,11 @@ let
 
 in stdenv.mkDerivation rec {
   name = "charles-${version}";
-  version = "4.2.6";
+  version = "4.2.7";
 
   src = fetchurl {
     url = "https://www.charlesproxy.com/assets/release/${version}/charles-proxy-${version}.tar.gz";
-    sha256 = "1hjfimyr9nnbbxadwni02d2xl64ybarh42l1g6hlslq5qwl8ywzb";
+    sha256 = "1nycw3wpbfwj4ijjaq5k0f4xipj8j605fs0yjzgl66gmv7r583rd";
   };
 
   buildInputs = [ makeWrapper ];

pkgs/applications/networking/cluster/click/default.nix

@@ -4,17 +4,18 @@ with rustPlatform;
 
 buildRustPackage rec {
   name = "click-${version}";
-  version = "0.3.1";
+  version = "0.3.2";
-  rev = "b5dfb4a8f8344330a098cb61523695dfe0fd296a";
 
   src = fetchFromGitHub {
+    rev = "v${version}";
     owner = "databricks";
     repo = "click";
-    sha256 = "0a2hq4hcxkkx7gs5dv7sr3j5jy2dby4r6y090z7zl2xy5wydr7bi";
+    sha256 = "0sbj41kypn637z1w115w2h5v6bxz3y6w5ikgpx3ihsh89lkc19d2";
-    inherit rev;
   };
 
-  cargoSha256 = "03vgbkv9xsnx44vivbbhjgxv9drp0yjnimgy6hwm32x74r00k3hj";
+  cargoSha256 = "05asqp5312a1g26pvf5hgqhc4kj3iw2hdvml2ycvga33sxb7zm7r";
+
+  patches = [ ./fix_cargo_lock_version.patch ];
 
   buildInputs = stdenv.lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
 

pkgs/applications/networking/cluster/click/fix_cargo_lock_version.patch

@@ -0,0 +1,13 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index ff80350..c86c6fe 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -111,7 +111,7 @@ dependencies = [
+
+ [[package]]
+ name = "click"
+-version = "0.3.1"
++version = "0.3.2"
+ dependencies = [
+  "ansi_term 0.9.0 (registry+https://github.com/rust-lang/crates.io-index)",
+  "base64 0.5.2 (registry+https://github.com/rust-lang/crates.io-index)",

pkgs/applications/networking/cluster/cni/plugins.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "cni-plugins-${version}";
-  version = "0.7.1";
+  version = "0.7.3";
 
   src = fetchFromGitHub {
     owner = "containernetworking";
     repo = "plugins";
     rev = "v${version}";
-    sha256 = "1sywllwnr6lc812sgkqjdd3y10r82shl88dlnwgnbgzs738q2vp2";
+    sha256 = "1saaszzxy4x3jkqd9ac6cphmzfim7x84h28c9i7az46px40blzm1";
   };
 
   buildInputs = [ go ];