Merge branch 'master' into staging

doc/overlays.xml

@@ -34,7 +34,7 @@ first one present is considered, and all the rest are ignored:
 
   <listitem>
 
-    <para>In the directory <filename>~/.nixpkgs/overlays/</filename>.</para>
+    <para>In the directory <filename>~/.config/nixpkgs/overlays/</filename>.</para>
   </listitem>
 
 </orderedlist>
@@ -50,7 +50,7 @@ the same recipe. In the case where overlays are loaded from a directory, they ar
 alphabetical order.</para>
 
 <para>To install an overlay using the last option, you can clone the overlay's repository and add
-a symbolic link to it in <filename>~/.nixpkgs/overlays/</filename> directory.</para>
+a symbolic link to it in <filename>~/.config/nixpkgs/overlays/</filename> directory.</para>
 
 </section>
 

lib/maintainers.nix

@@ -25,6 +25,7 @@
   aforemny = "Alexander Foremny <alexanderforemny@googlemail.com>";
   afranchuk = "Alex Franchuk <alex.franchuk@gmail.com>";
   aherrmann = "Andreas Herrmann <andreash87@gmx.ch>";
+  ahmedtd = "Taahir Ahmed <ahmed.taahir@gmail.com>";
   ak = "Alexander Kjeldaas <ak@formalprivacy.com>";
   akaWolf = "Artjom Vejsel <akawolf0@gmail.com>";
   akc = "Anders Claesson <akc@akc.is>";
@@ -135,6 +136,7 @@
   dgonyeo = "Derek Gonyeo <derek@gonyeo.com>";
   dipinhora = "Dipin Hora <dipinhora+github@gmail.com>";
   dmalikov = "Dmitry Malikov <malikov.d.y@gmail.com>";
+  DmitryTsygankov = "Dmitry Tsygankov <dmitry.tsygankov@gmail.com>";
   dmjio = "David Johnson <djohnson.m@gmail.com>";
   dochang = "Desmond O. Chang <dochang@gmail.com>";
   domenkozar = "Domen Kozar <domen@dev.si>";
@@ -142,6 +144,7 @@
   dpaetzel = "David Pätzel <david.a.paetzel@gmail.com>";
   drets = "Dmytro Rets <dmitryrets@gmail.com>";
   drewkett = "Andrew Burkett <burkett.andrew@gmail.com>";
+  dsferruzza = "David Sferruzza <david.sferruzza@gmail.com>";
   dtzWill = "Will Dietz <nix@wdtz.org>";
   e-user = "Alexander Kahl <nixos@sodosopa.io>";
   ebzzry = "Rommel Martinez <ebzzry@gmail.com>";
@@ -519,6 +522,7 @@
   tvorog = "Marsel Zaripov <marszaripov@gmail.com>";
   twey = "James ‘Twey’ Kay <twey@twey.co.uk>";
   uralbash = "Svintsov Dmitry <root@uralbash.ru>";
+  utdemir = "Utku Demir <me@utdemir.com>";
   #urkud = "Yury G. Kudryashov <urkud+nix@ya.ru>"; inactive since 2012
   uwap = "uwap <me@uwap.name>";
   vandenoever = "Jos van den Oever <jos@vandenoever.info>";

nixos/doc/manual/development/sources.xml

@@ -8,7 +8,7 @@
 
 <para>By default, NixOS’s <command>nixos-rebuild</command> command
 uses the NixOS and Nixpkgs sources provided by the
-<literal>nixos-unstable</literal> channel (kept in
+<literal>nixos</literal> channel (kept in
 <filename>/nix/var/nix/profiles/per-user/root/channels/nixos</filename>).
 To modify NixOS, however, you should check out the latest sources from
 Git.  This is as follows:
@@ -41,7 +41,7 @@ branch based on your current NixOS version:
 $ nixos-version
 17.09pre104379.6e0b727 (Hummingbird)
 
-$ git checkout -b local e3938c8
+$ git checkout -b local 6e0b727
 </screen>
 
 Or, to base your local branch on the latest version available in a
@@ -87,7 +87,11 @@ $ ln -s <replaceable>/my/sources</replaceable>/nixpkgs ~/.nix-defexpr/nixpkgs
 
 You may want to delete the symlink
 <filename>~/.nix-defexpr/channels_root</filename> to prevent root’s
-NixOS channel from clashing with your own tree.</para>
+NixOS channel from clashing with your own tree (this may break the
+command-not-found utility though). If you want to go back to the default
+state, you may just remove the <filename>~/.nix-defexpr</filename>
+directory completely, log out and log in again and it should have been
+recreated with a link to the root channels.</para>
 
 <!-- FIXME: not sure what this means.
 <para>You should not pass the base directory

nixos/doc/manual/release-notes/rl-1703.xml

@@ -501,6 +501,14 @@ following incompatible changes:</para>
       necessary to pull in all of <literal>bind</literal> to use them.
     </para>
   </listitem>
+
+  <listitem>
+    <para>
+      Per-user configuration was moved from <filename>~/.nixpkgs</filename> to
+      <filename>~/.config/nixpkgs</filename>. The former is still valid for
+      <filename>config.nix</filename> for backwards compatibility.
+    </para>
+  </listitem>
 </itemizedlist>
 </section>
 </section>

nixos/maintainers/scripts/ec2/create-amis.sh

@@ -3,21 +3,20 @@
 
 # To start with do: nix-shell -p awscli --run "aws configure"
 
-
+set -e
 set -o pipefail
-#set -x
-
-stateDir=${TMPDIR:-/tmp}/ec2-image
-echo "keeping state in $stateDir"
-mkdir -p $stateDir
 
 version=$(nix-instantiate --eval --strict '<nixpkgs>' -A lib.nixpkgsVersion | sed s/'"'//g)
 major=${version:0:5}
 echo "NixOS version is $version ($major)"
 
+stateDir=/var/tmp/ec2-image-$version
+echo "keeping state in $stateDir"
+mkdir -p $stateDir
+
 rm -f ec2-amis.nix
 
-types="hvm pv"
+types="hvm"
 stores="ebs s3"
 regions="eu-west-1 eu-west-2 eu-central-1 us-east-1 us-east-2 us-west-1 us-west-2 ca-central-1 ap-southeast-1 ap-southeast-2 ap-northeast-1 ap-northeast-2 sa-east-1 ap-south-1"
 
@@ -206,7 +205,7 @@ for type in $types; do
 
                     # Register the AMI.
                     if [ $type = pv ]; then
-                        kernel=$(aws ec2 describe-images --owner amazon --filters "Name=name,Values=pv-grub-hd0_1.04-$arch.gz" | jq -r .Images[0].ImageId)
+                        kernel=$(aws ec2 describe-images --owner amazon --filters "Name=name,Values=pv-grub-hd0_1.05-$arch.gz" | jq -r .Images[0].ImageId)
                         if [ "$kernel" = null ]; then break; fi
                         echo "using PV-GRUB kernel $kernel"
                         extraFlags+=" --virtualization-type paravirtual --kernel $kernel"

nixos/modules/config/fonts/fontconfig-penultimate.nix

@@ -3,23 +3,236 @@
 with lib;
 
 let
-  cfg = config.fonts.fontconfig.penultimate;
+  cfg = config.fonts.fontconfig;
 
+  fcBool = x: "<bool>" + (if x then "true" else "false") + "</bool>";
+
+  # back-supported fontconfig version and package
+  # version is used for font cache generation
+  supportVersion = "210";
+  supportPkg     = pkgs."fontconfig_${supportVersion}";
+
+  # latest fontconfig version and package
+  # version is used for configuration folder name, /etc/fonts/VERSION/
+  # note: format differs from supportVersion and can not be used with makeCacheConf
   latestVersion  = pkgs.fontconfig.configVersion;
+  latestPkg      = pkgs.fontconfig;
+
+  # supported version fonts.conf
+  supportFontsConf = pkgs.makeFontsConf { fontconfig = supportPkg; fontDirectories = config.fonts.fonts; };
+
+  # configuration file to read fontconfig cache
+  # version dependent
+  # priority 0
+  cacheConfSupport = makeCacheConf { version = supportVersion; };
+  cacheConfLatest  = makeCacheConf {};
+
+  # generate the font cache setting file for a fontconfig version
+  # use latest when no version is passed
+  makeCacheConf = { version ? null }:
+    let
+      fcPackage = if builtins.isNull version
+                  then "fontconfig"
+                  else "fontconfig_${version}";
+      makeCache = fontconfig: pkgs.makeFontsCache { inherit fontconfig; fontDirectories = config.fonts.fonts; };
+      cache     = makeCache pkgs."${fcPackage}";
+      cache32   = makeCache pkgs.pkgsi686Linux."${fcPackage}";
+    in
+    pkgs.writeText "fc-00-nixos-cache.conf" ''
+      <?xml version='1.0'?>
+      <!DOCTYPE fontconfig SYSTEM 'fonts.dtd'>
+      <fontconfig>
+        <!-- Font directories -->
+        ${concatStringsSep "\n" (map (font: "<dir>${font}</dir>") config.fonts.fonts)}
+        <!-- Pre-generated font caches -->
+        <cachedir>${cache}</cachedir>
+        ${optionalString (pkgs.stdenv.isx86_64 && cfg.cache32Bit) ''
+          <cachedir>${cache32}</cachedir>
+        ''}
+      </fontconfig>
+    '';
 
   # The configuration to be included in /etc/font/
-  confPkg = pkgs.runCommand "font-penultimate-conf" {} ''
+  penultimateConf = pkgs.runCommand "font-penultimate-conf" {} ''
     support_folder=$out/etc/fonts/conf.d
     latest_folder=$out/etc/fonts/${latestVersion}/conf.d
 
     mkdir -p $support_folder
     mkdir -p $latest_folder
 
-    # fontconfig ultimate various configuration files
+    ln -s ${supportFontsConf} $support_folder/../fonts.conf
+    ln -s ${latestPkg.out}/etc/fonts/fonts.conf \
+          $latest_folder/../fonts.conf
+
+    # fontconfig-penultimate various configuration files
     ln -s ${pkgs.fontconfig-penultimate}/etc/fonts/conf.d/*.conf \
           $support_folder
     ln -s ${pkgs.fontconfig-penultimate}/etc/fonts/conf.d/*.conf \
           $latest_folder
+
+    ln -s ${cacheConfSupport} $support_folder/00-nixos-cache.conf
+    ln -s ${cacheConfLatest}  $latest_folder/00-nixos-cache.conf
+
+    rm $support_folder/10-antialias.conf $latest_folder/10-antialias.conf
+    ln -s ${antialiasConf} $support_folder/10-antialias.conf
+    ln -s ${antialiasConf} $latest_folder/10-antialias.conf
+
+    rm $support_folder/10-hinting.conf $latest_folder/10-hinting.conf
+    ln -s ${hintingConf} $support_folder/10-hinting.conf
+    ln -s ${hintingConf} $latest_folder/10-hinting.conf
+
+    ${optionalString cfg.useEmbeddedBitmaps ''
+    rm $support_folder/10-no-embedded-bitmaps.conf
+    rm $latest_folder/10-no-embedded-bitmaps.conf
+    ''}
+
+    rm $support_folder/10-subpixel.conf $latest_folder/10-subpixel.conf
+    ln -s ${subpixelConf} $support_folder/10-subpixel.conf
+    ln -s ${subpixelConf} $latest_folder/10-subpixel.conf
+
+    ${optionalString (cfg.dpi != 0) ''
+    ln -s ${dpiConf} $support_folder/11-dpi.conf
+    ln -s ${dpiConf} $latest_folder/11-dpi.conf
+    ''}
+
+    ${optionalString (!cfg.includeUserConf) ''
+    rm $support_folder/50-user.conf
+    rm $latest_folder/50-user.conf
+    ''}
+
+    # 51-local.conf
+    rm $latest_folder/51-local.conf
+    substitute \
+      ${pkgs.fontconfig-penultimate}/etc/fonts/conf.d/51-local.conf \
+      $latest_folder/51-local.conf \
+      --replace local.conf /etc/fonts/${latestVersion}/local.conf
+
+    ln -s ${defaultFontsConf} $support_folder/52-default-fonts.conf
+    ln -s ${defaultFontsConf} $latest_folder/52-default-fonts.conf
+
+    ${optionalString cfg.allowBitmaps ''
+    rm $support_folder/53-no-bitmaps.conf
+    rm $latest_folder/53-no-bitmaps.conf
+    ''}
+
+    ${optionalString (!cfg.allowType1) ''
+    ln -s ${rejectType1} $support_folder/53-no-type1.conf
+    ln -s ${rejectType1} $latest_folder/53-no-type1.conf
+    ''}
+  '';
+
+  hintingConf = pkgs.writeText "fc-10-hinting.conf" ''
+    <?xml version='1.0'?>
+    <!DOCTYPE fontconfig SYSTEM 'fonts.dtd'>
+    <fontconfig>
+
+      <!-- Default rendering settings -->
+      <match target="pattern">
+        <edit mode="append" name="hinting">
+          ${fcBool cfg.hinting.enable}
+        </edit>
+        <edit mode="append" name="autohint">
+          ${fcBool cfg.hinting.autohint}
+        </edit>
+        <edit mode="append" name="hintstyle">
+          <const>hintslight</const>
+        </edit>
+      </match>
+
+    </fontconfig>
+  '';
+
+  antialiasConf = pkgs.writeText "fc-10-antialias.conf" ''
+    <?xml version='1.0'?>
+    <!DOCTYPE fontconfig SYSTEM 'fonts.dtd'>
+    <fontconfig>
+
+      <!-- Default rendering settings -->
+      <match target="pattern">
+        <edit mode="append" name="antialias">
+          ${fcBool cfg.antialias}
+        </edit>
+      </match>
+
+    </fontconfig>
+  '';
+
+  subpixelConf = pkgs.writeText "fc-10-subpixel.conf" ''
+    <?xml version='1.0'?>
+    <!DOCTYPE fontconfig SYSTEM 'fonts.dtd'>
+    <fontconfig>
+
+      <!-- Default rendering settings -->
+      <match target="pattern">
+        <edit mode="append" name="rgba">
+          <const>${cfg.subpixel.rgba}</const>
+        </edit>
+        <edit mode="append" name="lcdfilter">
+          <const>lcd${cfg.subpixel.lcdfilter}</const>
+        </edit>
+      </match>
+
+    </fontconfig>
+  '';
+
+  dpiConf = pkgs.writeText "fc-11-dpi.conf" ''
+    <?xml version='1.0'?>
+    <!DOCTYPE fontconfig SYSTEM 'fonts.dtd'>
+    <fontconfig>
+
+      <match target="pattern">
+        <edit name="dpi" mode="assign">
+          <double>${toString cfg.dpi}</double>
+        </edit>
+      </match>
+
+    </fontconfig>
+  '';
+
+  defaultFontsConf =
+    let genDefault = fonts: name:
+      optionalString (fonts != []) ''
+        <alias>
+          <family>${name}</family>
+          <prefer>
+          ${concatStringsSep ""
+          (map (font: ''
+            <family>${font}</family>
+          '') fonts)}
+          </prefer>
+        </alias>
+      '';
+    in
+    pkgs.writeText "fc-52-nixos-default-fonts.conf" ''
+    <?xml version='1.0'?>
+    <!DOCTYPE fontconfig SYSTEM 'fonts.dtd'>
+    <fontconfig>
+
+      <!-- Default fonts -->
+      ${genDefault cfg.defaultFonts.sansSerif "sans-serif"}
+
+      ${genDefault cfg.defaultFonts.serif     "serif"}
+
+      ${genDefault cfg.defaultFonts.monospace "monospace"}
+
+    </fontconfig>
+  '';
+
+  rejectType1 = pkgs.writeText "fc-53-no-type1.conf" ''
+    <?xml version="1.0"?>
+    <!DOCTYPE fontconfig SYSTEM "fonts.dtd">
+    <fontconfig>
+
+    <!-- Reject Type 1 fonts -->
+    <selectfont>
+      <rejectfont>
+        <pattern>
+          <patelt name="fontformat"><string>Type 1</string></patelt>
+        </pattern>
+      </rejectfont>
+    </selectfont>
+
+    </fontconfig>
   '';
 
 in
@@ -50,7 +263,7 @@ in
 
   config = mkIf (config.fonts.fontconfig.enable && cfg.enable) {
 
-    fonts.fontconfig.confPackages = [ confPkg ];
+    fonts.fontconfig.confPackages = [ penultimateConf ];
 
   };
 

nixos/modules/config/fonts/fontconfig.nix

@@ -104,13 +104,6 @@ let cfg = config.fonts.fontconfig;
         </match>
         ''}
 
-        <!-- Force autohint always -->
-        <match target="font">
-          <edit name="force_autohint" mode="assign">
-            ${fcBool cfg.forceAutohint}
-          </edit>
-        </match>
-
       </fontconfig>
     '';
 
@@ -174,13 +167,6 @@ let cfg = config.fonts.fontconfig;
         </edit>
       </match>
 
-      <!-- Render some monospace TTF fonts as bitmaps -->
-      <match target="pattern">
-        <edit name="bitmap_monospace" mode="assign">
-          ${fcBool cfg.renderMonoTTFAsBitmap}
-        </edit>
-      </match>
-
       </fontconfig>
     '';
 
@@ -372,11 +358,11 @@ in
 
           autohint = mkOption {
             type = types.bool;
-            default = true;
+            default = false;
             description = ''
-              Enable the autohinter, which provides hinting for otherwise
+              Enable the autohinter in place of the default interpreter.
-              un-hinted fonts. The results are usually lower quality than
+              The results are usually lower quality than correctly-hinted
-              correctly-hinted fonts.
+              fonts, but better than unhinted fonts.
             '';
           };
         };
@@ -453,31 +439,19 @@ in
           description = ''Use embedded bitmaps in fonts like Calibri.'';
         };
 
-        forceAutohint = mkOption {
-          type = types.bool;
-          default = false;
-          description = ''
-            Force use of the TrueType Autohinter. Useful for debugging or
-            free-software purists.
-          '';
-        };
-
-        renderMonoTTFAsBitmap = mkOption {
-          type = types.bool;
-          default = false;
-          description = ''Render some monospace TTF fonts as bitmaps.'';
       };
 
     };
 
   };
-
+  config = mkMerge [
-  };
+    (mkIf cfg.enable {
-  config = mkIf cfg.enable {
-    fonts.fontconfig.confPackages = [ confPkg ];
-
       environment.systemPackages    = [ pkgs.fontconfig ];
       environment.etc.fonts.source  = "${fontconfigEtc}/etc/fonts/";
-  };
+    })
+    (mkIf (cfg.enable && !cfg.penultimate.enable) {
+      fonts.fontconfig.confPackages = [ confPkg ];
+    })
+  ];
 
 }

nixos/modules/hardware/all-firmware.nix

@@ -26,6 +26,7 @@ with lib;
       firmwareLinuxNonfree
       intel2200BGFirmware
       rtl8723bs-firmware
+      rtl8192su-firmware
     ];
   };
 

nixos/modules/rename.nix

@@ -202,5 +202,7 @@ with lib;
     (mkRemovedOptionModule [ "fonts" "fontconfig" "hinting" "style" ] "")
     (mkRemovedOptionModule [ "services" "xserver" "displayManager" "sddm" "themes" ]
       "Set the option `services.xserver.displayManager.sddm.package' instead.")
+    (mkRemovedOptionModule [ "fonts" "fontconfig" "forceAutohint" ] "")
+    (mkRemovedOptionModule [ "fonts" "fontconfig" "renderMonoTTFAsBitmap" ] "")
   ];
 }

nixos/modules/security/acme.nix

@@ -178,7 +178,7 @@ in
                   path = [ pkgs.simp_le ];
                   preStart = ''
                     mkdir -p '${cfg.directory}'
-                    chown '${data.user}:${data.group}' '${cfg.directory}'
+                    chown -R '${data.user}:${data.group}' '${cfg.directory}'
                     if [ ! -d '${cpath}' ]; then
                       mkdir '${cpath}'
                     fi

nixos/modules/security/polkit.nix

@@ -64,7 +64,7 @@ in
     systemd.packages = [ pkgs.polkit.out ];
 
     systemd.services.polkit.restartTriggers = [ config.system.path ];
-    systemd.services.polkit.unitConfig.X-StopIfChanged = false;
+    systemd.services.polkit.stopIfChanged = false;
 
     # The polkit daemon reads action/rule files
     environment.pathsToLink = [ "/share/polkit-1" ];

nixos/modules/services/networking/searx.nix

@@ -18,17 +18,12 @@ in
 
     services.searx = {
 
-      enable = mkOption {
+      enable = mkEnableOption
-        type = types.bool;
+        "the searx server. See https://github.com/asciimoo/searx";
-        default = false;
-        description = "
-          Whether to enable the Searx server. See https://github.com/asciimoo/searx
-        ";
-      };
 
       configFile = mkOption {
-        type = types.path;
+        type = types.nullOr types.path;
-        default = "";
+        default = null;
         description = "
           The path of the Searx server configuration file. If no file
           is specified, a default file is used (default config file has
@@ -72,7 +67,7 @@ in
           User = "searx";
           ExecStart = "${cfg.package}/bin/searx-run";
         };
-      } // (optionalAttrs (configFile != "") {
+      } // (optionalAttrs (configFile != null) {
         environment.SEARX_SETTINGS_PATH = configFile;
       });
 

nixos/modules/system/activation/top-level.nix

@@ -53,6 +53,8 @@ let
 
         ln -s ${config.system.build.initialRamdisk}/initrd $out/initrd
 
+        ln -s ${config.system.build.initialRamdiskSecretAppender}/bin/append-initrd-secrets $out
+
         ln -s ${config.hardware.firmware}/lib/firmware $out/firmware
       ''}
 

nixos/modules/system/boot/initrd-ssh.nix

@@ -44,9 +44,10 @@ in
       description = ''
         RSA SSH private key file in the Dropbear format.
 
-        WARNING: This key is contained insecurely in the global Nix store. Do NOT
+        WARNING: Unless your bootloader supports initrd secrets, this key is
-        use your regular SSH host private keys for this purpose or you'll expose
+        contained insecurely in the global Nix store. Do NOT use your regular
-        them to regular users!
+        SSH host private keys for this purpose or you'll expose them to
+        regular users!
       '';
     };
 
@@ -56,9 +57,10 @@ in
       description = ''
         DSS SSH private key file in the Dropbear format.
 
-        WARNING: This key is contained insecurely in the global Nix store. Do NOT
+        WARNING: Unless your bootloader supports initrd secrets, this key is
-        use your regular SSH host private keys for this purpose or you'll expose
+        contained insecurely in the global Nix store. Do NOT use your regular
-        them to regular users!
+        SSH host private keys for this purpose or you'll expose them to
+        regular users!
       '';
     };
 
@@ -68,9 +70,10 @@ in
       description = ''
         ECDSA SSH private key file in the Dropbear format.
 
-        WARNING: This key is contained insecurely in the global Nix store. Do NOT
+        WARNING: Unless your bootloader supports initrd secrets, this key is
-        use your regular SSH host private keys for this purpose or you'll expose
+        contained insecurely in the global Nix store. Do NOT use your regular
-        them to regular users!
+        SSH host private keys for this purpose or you'll expose them to
+        regular users!
       '';
     };
 
@@ -97,10 +100,6 @@ in
     boot.initrd.extraUtilsCommands = ''
       copy_bin_and_libs ${pkgs.dropbear}/bin/dropbear
       cp -pv ${pkgs.glibc.out}/lib/libnss_files.so.* $out/lib
-
-      ${optionalString (cfg.hostRSAKey != null) "install -D ${cfg.hostRSAKey} $out/etc/dropbear/dropbear_rsa_host_key"}
-      ${optionalString (cfg.hostDSSKey != null) "install -D ${cfg.hostDSSKey} $out/etc/dropbear/dropbear_dss_host_key"}
-      ${optionalString (cfg.hostECDSAKey != null) "install -D ${cfg.hostECDSAKey} $out/etc/dropbear/dropbear_ecdsa_host_key"}
     '';
 
     boot.initrd.extraUtilsCommandsTest = ''
@@ -116,9 +115,6 @@ in
       touch /var/log/lastlog
 
       mkdir -p /etc/dropbear
-      ${optionalString (cfg.hostRSAKey != null) "ln -s $extraUtils/etc/dropbear/dropbear_rsa_host_key /etc/dropbear/dropbear_rsa_host_key"}
-      ${optionalString (cfg.hostDSSKey != null) "ln -s $extraUtils/etc/dropbear/dropbear_dss_host_key /etc/dropbear/dropbear_dss_host_key"}
-      ${optionalString (cfg.hostECDSAKey != null) "ln -s $extraUtils/etc/dropbear/dropbear_ecdsa_host_key /etc/dropbear/dropbear_ecdsa_host_key"}
 
       mkdir -p /root/.ssh
       ${concatStrings (map (key: ''
@@ -128,6 +124,11 @@ in
       dropbear -s -j -k -E -m -p ${toString cfg.port}
     '';
 
+    boot.initrd.secrets =
+     (optionalAttrs (cfg.hostRSAKey != null) { "/etc/dropbear/dropbear_rsa_host_key" = cfg.hostRSAKey; }) //
+     (optionalAttrs (cfg.hostDSSKey != null) { "/etc/dropbear/dropbear_dss_host_key" = cfg.hostDSSKey; }) //
+     (optionalAttrs (cfg.hostECDSAKey != null) { "/etc/dropbear/dropbear_ecdsa_host_key" = cfg.hostECDSAKey; });
+
   };
 
 }

nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py

@@ -32,8 +32,11 @@ def write_loader_conf(generation):
             f.write("editor 0");
     os.rename("@efiSysMountPoint@/loader/loader.conf.tmp", "@efiSysMountPoint@/loader/loader.conf")
 
+def profile_path(generation, name):
+    return os.readlink("%s/%s" % (system_dir(generation), name))
+
 def copy_from_profile(generation, name, dry_run=False):
-    store_file_path = os.readlink("%s/%s" % (system_dir(generation), name))
+    store_file_path = profile_path(generation, name)
     suffix = os.path.basename(store_file_path)
     store_dir = os.path.basename(os.path.dirname(store_file_path))
     efi_file_path = "/efi/nixos/%s-%s.efi" % (store_dir, suffix)
@@ -44,6 +47,11 @@ def copy_from_profile(generation, name, dry_run=False):
 def write_entry(generation, machine_id):
     kernel = copy_from_profile(generation, "kernel")
     initrd = copy_from_profile(generation, "initrd")
+    try:
+        append_initrd_secrets = profile_path(generation, "append-initrd-secrets")
+        subprocess.check_call([append_initrd_secrets, "@efiSysMountPoint@%s" % (initrd)])
+    except FileNotFoundError:
+        pass
     entry_file = "@efiSysMountPoint@/loader/entries/nixos-generation-%d.conf" % (generation)
     generation_dir = os.readlink(system_dir(generation))
     tmp_path = "%s.tmp" % (entry_file)

nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix

@@ -65,6 +65,8 @@ in {
 
     boot.loader.grub.enable = mkDefault false;
 
+    boot.loader.supportsInitrdSecrets = true;
+
     system = {
       build.installBootLoader = gummibootBuilder;
 

nixos/modules/system/boot/luksroot.nix

@@ -6,29 +6,38 @@ let
   luks = config.boot.initrd.luks;
 
   openCommand = name': { name, device, header, keyFile, keyFileSize, allowDiscards, yubikey, ... }: assert name' == name; ''
-    # Wait for luksRoot to appear, e.g. if on a usb drive.
+
-    # XXX: copied and adapted from stage-1-init.sh - should be
+    # Wait for a target (e.g. device, keyFile, header, ...) to appear.
-    # available as a function.
+    wait_target() {
-    if ! test -e ${device}; then
+        local name="$1"
-        echo -n "waiting 10 seconds for device ${device} to appear..."
+        local target="$2"
+
+        if [ ! -e $target ]; then
+            echo -n "Waiting 10 seconds for $name $target to appear"
+            local success=false;
             for try in $(seq 10); do
+                echo -n "."
                 sleep 1
-            if test -e ${device}; then break; fi
+                if [ -e $target ]; then success=true break; fi
-            echo -n .
             done
-        echo "ok"
+            if [ $success = true ]; then
+                echo " - success";
+            else
+                echo " - failure";
             fi
+        fi
+    }
+
+    # Wait for luksRoot (and optionally keyFile and/or header) to appear, e.g.
+    # if on a USB drive.
+    wait_target "device" ${device}
 
     ${optionalString (keyFile != null) ''
-    if ! test -e ${keyFile}; then
+      wait_target "key file" ${keyFile}
-        echo -n "waiting 10 seconds for key file ${keyFile} to appear..."
+    ''}
-        for try in $(seq 10); do
+
-            sleep 1
+    ${optionalString (header != null) ''
-            if test -e ${keyFile}; then break; fi
+      wait_target "header" ${header}
-            echo -n .
-        done
-        echo "ok"
-    fi
     ''}
 
     open_normally() {

nixos/modules/system/boot/stage-1-init.sh

@@ -8,6 +8,14 @@ export LD_LIBRARY_PATH=@extraUtils@/lib
 export PATH=@extraUtils@/bin
 ln -s @extraUtils@/bin /bin
 
+# Copy the secrets to their needed location
+if [ -d "@extraUtils@/secrets" ]; then
+    for secret in $(cd "@extraUtils@/secrets"; find . -type f); do
+        mkdir -p $(dirname "/$secret")
+        ln -s "@extraUtils@/secrets/$secret" "$secret"
+    done
+fi
+
 # Stop LVM complaining about fd3
 export LVM_SUPPRESS_FD_WARNINGS=true
 

nixos/modules/system/boot/stage-1.nix

@@ -82,6 +82,17 @@ let
         copy_bin_and_libs ${pkgs.e2fsprogs}/sbin/resize2fs
       ''}
 
+      # Copy secrets if needed.
+      ${optionalString (!config.boot.loader.supportsInitrdSecrets)
+          (concatStringsSep "\n" (mapAttrsToList (dest: source:
+             let source' = if source == null then dest else source; in
+               ''
+                  mkdir -p $(dirname "$out/secrets/${dest}")
+                  cp -a ${source'} "$out/secrets/${dest}"
+                ''
+          ) config.boot.initrd.secrets))
+       }
+
       ${config.boot.initrd.extraUtilsCommands}
 
       # Copy ld manually since it isn't detected correctly
@@ -242,6 +253,52 @@ let
       ];
   };
 
+  # Script to add secret files to the initrd at bootloader update time
+  initialRamdiskSecretAppender =
+    pkgs.writeScriptBin "append-initrd-secrets"
+      ''
+        #!${pkgs.bash}/bin/bash -e
+        function usage {
+          echo "USAGE: $0 INITRD_FILE" >&2
+          echo "Appends this configuration's secrets to INITRD_FILE" >&2
+        }
+
+        if [ $# -ne 1 ]; then
+          usage
+          exit 1
+        fi
+
+        if [ "$1"x = "--helpx" ]; then
+          usage
+          exit 0
+        fi
+
+        ${lib.optionalString (config.boot.initrd.secrets == {})
+            "exit 0"}
+
+        export PATH=${pkgs.coreutils}/bin:${pkgs.cpio}/bin:${pkgs.gzip}/bin:${pkgs.findutils}/bin
+
+        function cleanup {
+          if [ -n "$tmp" -a -d "$tmp" ]; then
+            rm -fR "$tmp"
+          fi
+        }
+        trap cleanup EXIT
+
+        tmp=$(mktemp -d initrd-secrets.XXXXXXXXXX)
+
+        ${lib.concatStringsSep "\n" (mapAttrsToList (dest: source:
+            let source' = if source == null then dest else toString source; in
+              ''
+                mkdir -p $(dirname "$tmp/${dest}")
+                cp -a ${source'} "$tmp/${dest}"
+              ''
+          ) config.boot.initrd.secrets)
+         }
+
+        (cd "$tmp" && find . | cpio -H newc -o) | gzip >>"$1"
+      '';
+
 in
 
 {
@@ -370,6 +427,25 @@ in
       example = "xz";
     };
 
+    boot.initrd.secrets = mkOption
+      { internal = true;
+        default = {};
+        type = types.attrsOf (types.nullOr types.path);
+        description =
+          ''
+            Secrets to append to the initrd. The attribute name is the
+            path the secret should have inside the initrd, the value
+            is the path it should be copied from (or null for the same
+            path inside and out).
+          '';
+        example = literalExample
+          ''
+            { "/etc/dropbear/dropbear_rsa_host_key" =
+                ./secret-dropbear-key;
+            }
+          '';
+      };
+
     boot.initrd.supportedFilesystems = mkOption {
       default = [ ];
       example = [ "btrfs" ];
@@ -377,6 +453,18 @@ in
       description = "Names of supported filesystem types in the initial ramdisk.";
     };
 
+    boot.loader.supportsInitrdSecrets = mkOption
+      { internal = true;
+        default = false;
+        type = types.bool;
+        description =
+          ''
+            Whether the bootloader setup runs append-initrd-secrets.
+            If not, any needed secrets must be copied into the initrd
+            and thus added to the store.
+          '';
+      };
+
     fileSystems = mkOption {
       options.neededForBoot = mkOption {
         default = false;
@@ -404,9 +492,8 @@ in
       }
     ];
 
-    system.build.bootStage1 = bootStage1;
+    system.build =
-    system.build.initialRamdisk = initialRamdisk;
+      { inherit bootStage1 initialRamdisk initialRamdiskSecretAppender extraUtils; };
-    system.build.extraUtils = extraUtils;
 
     system.requiredKernelConfig = with config.lib.kernelConfig; [
       (isYes "TMPFS")

nixos/modules/system/boot/systemd.nix

@@ -829,7 +829,8 @@ in
 
     # Some overrides to upstream units.
     systemd.services."systemd-backlight@".restartIfChanged = false;
-    systemd.services."systemd-rfkill@".restartIfChanged = false;
+    systemd.services."systemd-fsck@".restartIfChanged = false;
+    systemd.services."systemd-fsck@".path = [ config.system.path ];
     systemd.services."user@".restartIfChanged = false;
     systemd.services.systemd-journal-flush.restartIfChanged = false;
     systemd.services.systemd-random-seed.restartIfChanged = false;

nixos/modules/tasks/network-interfaces-scripted.nix

@@ -159,35 +159,42 @@ let
             after = [ "network-pre.target" ] ++ (deviceDependency i.name);
             serviceConfig.Type = "oneshot";
             serviceConfig.RemainAfterExit = true;
+            # Restart rather than stop+start this unit to prevent the
+            # network from dying during switch-to-configuration.
+            stopIfChanged = false;
             path = [ pkgs.iproute ];
             script =
               ''
+                # FIXME: shouldn't this be done in network-link?
                 echo "bringing up interface..."
                 ip link set "${i.name}" up
 
-                restart_network_interfaces=false
+                state="/run/nixos/network/addresses/${i.name}"
+
+                mkdir -p $(dirname "$state")
+
               '' + flip concatMapStrings (ips) (ip:
                 let
                   address = "${ip.address}/${toString ip.prefixLength}";
                 in
                 ''
-                  echo "checking ip ${address}..."
+                  echo "${address}" >> $state
                   if out=$(ip addr add "${address}" dev "${i.name}" 2>&1); then
-                    echo "added ip ${address}..."
+                    echo "added ip ${address}"
                   elif ! echo "$out" | grep "File exists" >/dev/null 2>&1; then
                     echo "failed to add ${address}"
                     exit 1
                   fi
                 '');
-            preStop = flip concatMapStrings (ips) (ip:
+            preStop = ''
-                let
+              state="/run/nixos/network/addresses/${i.name}"
-                  address = "${ip.address}/${toString ip.prefixLength}";
+              while read address; do
-                in
+                echo -n "deleting $address..."
-                ''
+                ip addr del "$address" dev "${i.name}" >/dev/null 2>&1 || echo -n " Failed"
-                  echo -n "deleting ${address}..."
-                  ip addr del "${address}" dev "${i.name}" >/dev/null 2>&1 || echo -n " Failed"
                 echo ""
-                '');
+              done < "$state"
+              rm -f "$state"
+            '';
           };
 
         createTunDevice = i: nameValuePair "${i.name}-netdev"

nixos/modules/virtualisation/amazon-image.nix

@@ -15,6 +15,12 @@ let cfg = config.ec2; in
 
   config = {
 
+    assertions = [
+      { assertion = cfg.hvm;
+        message = "Paravirtualized EC2 instances are no longer supported.";
+      }
+    ];
+
     virtualisation.growPartition = cfg.hvm;
 
     fileSystems."/" = {

nixos/modules/virtualisation/amazon-options.nix

@@ -3,7 +3,7 @@
   options = {
     ec2 = {
       hvm = lib.mkOption {
-        default = false;
+        default = lib.versionAtLeast config.system.stateVersion "17.03";
         internal = true;
         description = ''
           Whether the EC2 instance is a HVM instance.
@@ -11,6 +11,4 @@
       };
     };
   };
-
-  config = {};
 }

nixos/modules/virtualisation/docker.nix

@@ -126,7 +126,17 @@ in
 
         path = [ pkgs.kmod ] ++ (optional (cfg.storageDriver == "zfs") pkgs.zfs);
       };
-      systemd.sockets.docker.socketConfig.ListenStream = cfg.listenOptions;
+
+      systemd.sockets.docker = {
+        description = "Docker Socket for the API";
+        wantedBy = [ "sockets.target" ];
+        socketConfig = {
+          ListenStream = cfg.listenOptions;
+          SocketMode = "0660";
+          SocketUser = "root";
+          SocketGroup = "docker";
+        };
+      };
     }
   ]);
 

nixos/modules/virtualisation/ec2-amis.nix

@@ -193,5 +193,35 @@ let self = {
   "16.09".us-west-2.pv-ebs = "ami-6d4af60d";
   "16.09".us-west-2.pv-s3 = "ami-de48f4be";
 
-  latest = self."16.09";
+  # 17.03.885.6024dd4067
+  "17.03".ap-northeast-1.hvm-ebs = "ami-dbd0f7bc";
+  "17.03".ap-northeast-1.hvm-s3 = "ami-7cdff81b";
+  "17.03".ap-northeast-2.hvm-ebs = "ami-c59a48ab";
+  "17.03".ap-northeast-2.hvm-s3 = "ami-0b944665";
+  "17.03".ap-south-1.hvm-ebs = "ami-4f413220";
+  "17.03".ap-south-1.hvm-s3 = "ami-864033e9";
+  "17.03".ap-southeast-1.hvm-ebs = "ami-e08c3383";
+  "17.03".ap-southeast-1.hvm-s3 = "ami-c28f30a1";
+  "17.03".ap-southeast-2.hvm-ebs = "ami-fca9a69f";
+  "17.03".ap-southeast-2.hvm-s3 = "ami-3daaa55e";
+  "17.03".ca-central-1.hvm-ebs = "ami-9b00bdff";
+  "17.03".ca-central-1.hvm-s3 = "ami-e800bd8c";
+  "17.03".eu-central-1.hvm-ebs = "ami-5450803b";
+  "17.03".eu-central-1.hvm-s3 = "ami-6e2efe01";
+  "17.03".eu-west-1.hvm-ebs = "ami-10754c76";
+  "17.03".eu-west-1.hvm-s3 = "ami-11734a77";
+  "17.03".eu-west-2.hvm-ebs = "ami-ff1d099b";
+  "17.03".eu-west-2.hvm-s3 = "ami-fe1d099a";
+  "17.03".sa-east-1.hvm-ebs = "ami-d95d3eb5";
+  "17.03".sa-east-1.hvm-s3 = "ami-fca2c190";
+  "17.03".us-east-1.hvm-ebs = "ami-0940c61f";
+  "17.03".us-east-1.hvm-s3 = "ami-674fc971";
+  "17.03".us-east-2.hvm-ebs = "ami-afc2e6ca";
+  "17.03".us-east-2.hvm-s3 = "ami-a1cde9c4";
+  "17.03".us-west-1.hvm-ebs = "ami-587b2138";
+  "17.03".us-west-1.hvm-s3 = "ami-70411b10";
+  "17.03".us-west-2.hvm-ebs = "ami-a93daac9";
+  "17.03".us-west-2.hvm-s3 = "ami-5139ae31";
+
+  latest = self."17.03";
 }; in self

nixos/tests/docker.nix

@@ -11,6 +11,21 @@ import ./make-test.nix ({ pkgs, ...} : {
       { config, pkgs, ... }:
         {
           virtualisation.docker.enable = true;
+
+          users.users = {
+            noprivs = {
+              isNormalUser = true;
+              description = "Can't access the docker daemon";
+              password = "foobar";
+            };
+
+            hasprivs = {
+              isNormalUser = true;
+              description = "Can access the docker daemon";
+              password = "foobar";
+              extraGroups = [ "docker" ];
+            };
+          };
         };
     };
 
@@ -21,6 +36,8 @@ import ./make-test.nix ({ pkgs, ...} : {
     $docker->succeed("tar cv --files-from /dev/null | docker import - scratchimg");
     $docker->succeed("docker run -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10");
     $docker->succeed("docker ps | grep sleeping");
+    $docker->succeed("sudo -u hasprivs docker ps");
+    $docker->fail("sudo -u noprivs docker ps");
     $docker->succeed("docker stop sleeping");
   '';
 })

nixos/tests/hibernate.nix

@@ -13,7 +13,7 @@ import ./make-test.nix (pkgs: {
 
       networking.firewall.allowedTCPPorts = [ 4444 ];
 
-      systemd.services.listener.serviceConfig.ExecStart = "${pkgs.netcat}/bin/nc -l 4444";
+      systemd.services.listener.serviceConfig.ExecStart = "${pkgs.netcat}/bin/nc -l 4444 -k";
     };
 
     probe = { config, lib, pkgs, ...}: {
@@ -32,6 +32,7 @@ import ./make-test.nix (pkgs: {
       $machine->succeed("mkswap /dev/vdb");
       $machine->succeed("swapon -a");
       $machine->startJob("listener");
+      $machine->waitForOpenPort(4444);
       $machine->succeed("systemctl hibernate &");
       $machine->waitForShutdown;
       $machine->start;

pkgs/applications/altcoins/bitcoin-unlimited.nix

@@ -0,0 +1,60 @@
+{ stdenv, fetchFromGitHub, pkgconfig, autoreconfHook, openssl, db48, boost
+, zlib, miniupnpc, qt4, utillinux, protobuf, qrencode, libevent
+, withGui }:
+
+with stdenv.lib;
+
+stdenv.mkDerivation rec {
+
+  name = "bitcoin" + (toString (optional (!withGui) "d")) + "-unlimited-" + version;
+  version = "1.0.1.3";
+
+  src = fetchFromGitHub {
+    owner = "bitcoinunlimited";
+    repo = "bitcoinunlimited";
+    rev = "${version}";
+    sha256 = "177l2jf2yqxh3sgf80dhgyk3wgjdnqszy3hb83clk8q1wyjkfz7y";
+  };
+
+  nativeBuildInputs = [ pkgconfig autoreconfHook ];
+  buildInputs = [ openssl db48 boost zlib
+                  miniupnpc utillinux protobuf libevent ]
+                  ++ optionals withGui [ qt4 qrencode ];
+
+  configureFlags = [ "--with-boost-libdir=${boost.out}/lib" ]
+                     ++ optionals withGui [ "--with-gui=qt4" ];
+
+  meta = {
+    description = "Peer-to-peer electronic cash system (Unlimited client)";
+    longDescription= ''
+      Bitcoin is a free open source peer-to-peer electronic cash system that is
+      completely decentralized, without the need for a central server or trusted
+      parties. Users hold the crypto keys to their own money and transact directly
+      with each other, with the help of a P2P network to check for double-spending.
+      
+      The Bitcoin Unlimited (BU) project seeks to provide a voice to all
+      stakeholders in the Bitcoin ecosystem.
+
+      Every node operator or miner can currently choose their own blocksize limit
+      by modifying their client. Bitcoin Unlimited makes the process easier by
+      providing a configurable option for the accepted and generated blocksize via
+      a GUI menu. Bitcoin Unlimited further provides a user-configurable failsafe
+      setting allowing you to accept a block larger than your maximum accepted
+      blocksize if it reaches a certain number of blocks deep in the chain.
+
+      The Bitcoin Unlimited client is not a competitive block scaling proposal
+      like BIP-101, BIP-102, etc. Instead it tracks consensus. This means that it
+      tracks the blockchain that the hash power majority follows, irrespective of
+      blocksize, and signals its ability to accept larger blocks via protocol and
+      block versioning fields.
+
+      If you support an increase in the blocksize limit by any means - or just
+      support Bitcoin conflict resolution as originally envisioned by its founder -
+      consider running a Bitcoin Unlimited client.      
+    '';
+    homepage = https://www.bitcoinunlimited.info/;
+    maintainers = with maintainers; [ DmitryTsygankov ];
+    license = licenses.mit;
+    platforms = platforms.unix;
+  };
+}

pkgs/applications/altcoins/bitcoin.nix

@@ -4,19 +4,18 @@
 
 with stdenv.lib;
 stdenv.mkDerivation rec{
-
   name = "bitcoin" + (toString (optional (!withGui) "d")) + "-" + version;
-  core_version = "0.13.1";
+  version = "0.14.0";
-  version = core_version;
 
   src = fetchurl {
-    urls = [ "https://bitcoin.org/bin/bitcoin-core-${core_version}/bitcoin-${version}.tar.gz"
+    urls = [ "https://bitcoin.org/bin/bitcoin-core-${version}/bitcoin-${version}.tar.gz"
-             "mirror://sourceforge/bitcoin/Bitcoin/bitcoin-${core_version}/bitcoin-${version}.tar.gz"
+             "mirror://sourceforge/bitcoin/Bitcoin/bitcoin-${version}/bitcoin-${version}.tar.gz"
            ];
-    sha256 = "d8edbd797ff1c8266113e54d851a85def46ab82389abe7d7bd0d2827e74cecd7";
+    sha256 = "07k4i9r033dsvkp5ii5g3hykidm8b19c8c0mz1bi8k0dda3d8hyp";
   };
 
-  buildInputs = [ pkgconfig autoreconfHook openssl db48 boost zlib
+  nativeBuildInputs = [ pkgconfig autoreconfHook ];
+  buildInputs = [ openssl db48 boost zlib
                   miniupnpc protobuf libevent]
                   ++ optionals stdenv.isLinux [ utillinux ]
                   ++ optionals withGui [ qt4 qrencode ];

pkgs/applications/altcoins/default.nix

@@ -5,6 +5,9 @@ rec {
   bitcoin  = callPackage ./bitcoin.nix { withGui = true; };
   bitcoind = callPackage ./bitcoin.nix { withGui = false; };
 
+  bitcoin-unlimited  = callPackage ./bitcoin-unlimited.nix { withGui = true; };
+  bitcoind-unlimited = callPackage ./bitcoin-unlimited.nix { withGui = false; };
+
   bitcoin-classic  = callPackage ./bitcoin-classic.nix { withGui = true; };
   bitcoind-classic = callPackage ./bitcoin-classic.nix { withGui = false; };
 

pkgs/applications/display-managers/lightdm/default.nix

@@ -4,38 +4,39 @@
 , withQt5 ? false, qtbase
 }:
 
+with stdenv.lib;
+
 let
-  ver_branch = "1.19";
+  ver_branch = "1.22";
-  version = "1.19.5";
+  version = "1.22.0";
 in
 stdenv.mkDerivation rec {
   name = "lightdm-${version}";
 
   src = fetchurl {
     url = "${meta.homepage}/${ver_branch}/${version}/+download/${name}.tar.xz";
-    sha256 = "0gbz8jk1ljh8rwgvldkiqma1k61sd27yh008228ahdqd5i2v1r1z";
+    sha256 = "0a5bvfl2h7r873al6q7c819h0kg564k9fh51rl6489z6lyvazfg4";
   };
 
-  patches = [ ./fix-paths.patch ];
+  nativeBuildInputs = [ pkgconfig intltool ];
-
   buildInputs = [
-    pkgconfig pam libxcb glib libXdmcp itstool libxml2 intltool libxklavier libgcrypt
+    pam libxcb glib libXdmcp itstool libxml2 libxklavier libgcrypt
     qt4 libaudit gcc6
-  ] ++ stdenv.lib.optional withQt5 qtbase;
+  ] ++ optional withQt5 qtbase;
 
   configureFlags = [
     "--localstatedir=/var"
     "--sysconfdir=/etc"
     "--disable-tests"
-  ] ++ stdenv.lib.optional (qt4 != null) "--enable-liblightdm-qt"
+  ] ++ optional (qt4 != null) "--enable-liblightdm-qt"
-    ++ stdenv.lib.optional withQt5 "--enable-liblightdm-qt5";
+    ++ optional withQt5 "--enable-liblightdm-qt5";
 
   installFlags = [
     "sysconfdir=\${out}/etc"
     "localstatedir=\${TMPDIR}"
   ];
 
-  meta = with stdenv.lib; {
+  meta = {
     homepage = https://launchpad.net/lightdm;
     platforms = platforms.linux;
     license = licenses.gpl3;

pkgs/applications/display-managers/lightdm/fix-paths.patch

@@ -1,61 +0,0 @@
-diff --git a/common/user-list.c b/common/user-list.c
-index 792c6d3..57fbfb7 100644
---- a/common/user-list.c
-+++ b/common/user-list.c
-@@ -331,7 +331,7 @@ load_passwd_file (CommonUserList *user_list, gboolean emit_add_signal)
- 
-     value = g_key_file_get_string (config, "UserList", "hidden-shells", NULL);
-     if (!value)
--        value = g_strdup ("/bin/false /usr/sbin/nologin");
-+        value = g_strdup ("/run/current-system/sw/bin/nologin");
-     hidden_shells = g_strsplit (value, " ", -1);
-     g_free (value);
- 
-diff --git a/src/seat.c b/src/seat.c
-index f9b149d..9029742 100644
---- a/src/seat.c
-+++ b/src/seat.c
-@@ -343,7 +343,7 @@ run_script (Seat *seat, DisplayServer *display_server, const gchar *script_name,
- 
-     /* Set POSIX variables */
-     process_set_clear_environment (script, TRUE);
--    process_set_env (script, "SHELL", "/bin/sh");
-+    process_set_env (script, "SHELL", "/run/current-system/sw/bin/sh");
- 
-     /* Variables required for regression tests */
-     if (g_getenv ("LIGHTDM_TEST_ROOT"))
-@@ -354,7 +354,7 @@ run_script (Seat *seat, DisplayServer *display_server, const gchar *script_name,
-         process_set_env (script, "PATH", g_getenv ("PATH"));
-     }
-     else
--        process_set_env (script, "PATH", "/usr/local/bin:/usr/bin:/bin");
-+        process_set_env (script, "PATH", "/run/current-system/sw/bin");
- 
-     if (user)
-     {
-diff --git a/src/session-child.c b/src/session-child.c
-index e85f57d..93db0bd 100644
---- a/src/session-child.c
-+++ b/src/session-child.c
-@@ -410,7 +410,7 @@ session_child_run (int argc, char **argv)
-         else
-         {
-             /* Set POSIX variables */
--            pam_putenv (pam_handle, "PATH=/usr/local/bin:/usr/bin:/bin");
-+            pam_putenv (pam_handle, "PATH=/run/current-system/sw/bin");
-             pam_putenv (pam_handle, g_strdup_printf ("USER=%s", username));
-             pam_putenv (pam_handle, g_strdup_printf ("LOGNAME=%s", username));
-             pam_putenv (pam_handle, g_strdup_printf ("HOME=%s", user_get_home_directory (user)));
-diff --git a/src/shared-data-manager.c b/src/shared-data-manager.c
-index 47f1c10..cc82652 100644
---- a/src/shared-data-manager.c
-+++ b/src/shared-data-manager.c
-@@ -68,7 +68,7 @@ delete_unused_user (gpointer key, gpointer value, gpointer user_data)
- 
-     gchar *path = g_build_filename (USERS_DIR, user, NULL);
-     gchar *quoted_path = g_shell_quote (path);
--    gchar *cmd = g_strdup_printf ("/bin/rm -rf %s", quoted_path);
-+    gchar *cmd = g_strdup_printf ("/run/current-system/sw/bin/rm -rf %s", quoted_path);
- 
-     g_spawn_command_line_async (cmd, &error);
-     if (error)

pkgs/applications/editors/leo-editor/default.nix

@@ -2,18 +2,18 @@
 
 stdenv.mkDerivation rec {
   name = "leo-editor-${version}";
-  version = "5.3";
+  version = "5.5";
 
   src = fetchFromGitHub {
     owner = "leo-editor";
     repo = "leo-editor";
     rev = version;
-    sha256 = "0whbay8ilabzpxdjaxv447y6bqbsilx161fv7wa15v3qqm2kapsp";
+    sha256 = "0crzljirzfiy9xn02ydd23clmd8bzdjxkyxdqsvdkgfy9j41b8hr";
   };
 
   dontBuild = true;
 
-  buildInputs = [ makeWrapper python3Packages.python ];
+  nativeBuildInputs = [ makeWrapper python3Packages.python ];
   propagatedBuildInputs = with python3Packages; [ pyqt5 ];
 
   desktopItem = makeDesktopItem rec {
@@ -56,10 +56,10 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    homepage = "http://leoeditor.com";
+    homepage = http://leoeditor.com;
     description = "A powerful folding editor";
     longDescription = "Leo is a PIM, IDE and outliner that accelerates the work flow of programmers, authors and web designers.";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ leonardoce ramkromberg ];
   };
 }

pkgs/applications/editors/nano/default.nix

@@ -20,11 +20,11 @@ let
 
 in stdenv.mkDerivation rec {
   name = "nano-${version}";
-  version = "2.7.5";
+  version = "2.8.0";
 
   src = fetchurl {
     url = "mirror://gnu/nano/${name}.tar.xz";
-    sha256 = "1r37gqx7hppqbgsbclchiis8wzzpb9srm3q3dlvlii2gpkk28kd6";
+    sha256 = "1hjxr0kgq3q1fcns9y4lj0dbhjf33j3pa2wayrb3p3c8v3sbrh8m";
   };
 
   nativeBuildInputs = [ texinfo ] ++ optional enableNls gettext;

pkgs/applications/editors/vscode/default.nix

@@ -55,7 +55,7 @@ in
       '' else ''
         mkdir -p $out/lib/vscode $out/bin
         cp -r ./* $out/lib/vscode
-        ln -s $out/lib/vscode/code $out/bin
+        ln -s $out/lib/vscode/bin/code $out/bin
 
         mkdir -p $out/share/applications
         cp $desktopItem/share/applications/* $out/share/applications
@@ -67,11 +67,8 @@ in
     postFixup = lib.optionalString (stdenv.system == "i686-linux" || stdenv.system == "x86_64-linux") ''
       patchelf \
         --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-        --set-rpath "${atomEnv.libPath}:$out/lib/vscode" \
+        --set-rpath "${atomEnv.libPath}:${stdenv.lib.makeLibraryPath [libXScrnSaver]}/libXss.so.1:$out/lib/vscode" \
         $out/lib/vscode/code
-
-      wrapProgram $out/bin/code \
-        --prefix LD_PRELOAD : ${stdenv.lib.makeLibraryPath [ libXScrnSaver ]}/libXss.so.1
     '';
 
     meta = with stdenv.lib; {

pkgs/applications/graphics/nomacs/default.nix

@@ -0,0 +1,65 @@
+{ stdenv
+, fetchFromGitHub
+, cmake
+, makeWrapper
+, pkgconfig
+, wrapGAppsHook
+, gsettings_desktop_schemas
+
+, qtbase
+, qttools
+, qtsvg
+
+, exiv2
+, opencv
+, libraw
+, libtiff
+, quazip
+}:
+
+stdenv.mkDerivation rec {
+  version = "3.6.1";
+  src = fetchFromGitHub {
+    owner = "nomacs";
+    repo = "nomacs";
+    rev = version;
+    sha256 = "0yli05hhmd57v3mynq78nmr15rbpm0vadv273pavmcnayv86yl44";
+  };
+
+  name = "nomacs-${version}";
+
+  enableParallelBuilding = true;
+
+  sourceRoot = "${name}-src/ImageLounge";
+
+  patches = [./fix-appdata-install.patch];
+
+  nativeBuildInputs = [cmake
+                       pkgconfig
+                       wrapGAppsHook];
+
+  buildInputs = [qtbase
+                 qttools
+                 qtsvg
+                 exiv2
+                 opencv
+                 libraw
+                 libtiff
+                 quazip
+                 gsettings_desktop_schemas];
+
+  cmakeFlags = ["-DENABLE_OPENCV=ON"
+                "-DENABLE_RAW=ON"
+                "-DENABLE_TIFF=ON"
+                "-DENABLE_QUAZIP=ON"
+                "-DUSE_SYSTEM_QUAZIP=ON"];
+
+  meta = with stdenv.lib; {
+    homepage = https://nomacs.org;
+    description = "Qt-based image viewer";
+    maintainers = [maintainers.ahmedtd];
+    license = licenses.gpl3Plus;
+    repositories.git = https://github.com/nomacs/nomacs.git;
+    inherit (qtbase.meta) platforms;
+  };
+}

pkgs/applications/graphics/nomacs/fix-appdata-install.patch

@@ -0,0 +1,13 @@
+diff --git a/cmake/UnixBuildTarget.cmake b/cmake/UnixBuildTarget.cmake
+index 3521056a..34f99ed9 100644
+--- a/cmake/UnixBuildTarget.cmake
++++ b/cmake/UnixBuildTarget.cmake
+@@ -80,7 +80,7 @@ install(FILES ${NOMACS_QM} DESTINATION share/nomacs/translations)
+ #  manpage
+ install(FILES Readme/nomacs.1 DESTINATION share/man/man1)
+ #  appdata
+-install(FILES nomacs.appdata.xml DESTINATION /usr/share/appdata/)
++install(FILES nomacs.appdata.xml DESTINATION share/appdata/)
+ 
+ # "make dist" target
+ string(TOLOWER ${PROJECT_NAME} CPACK_PACKAGE_NAME)

pkgs/applications/misc/albert/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name    = "albert-${version}";
-  version = "0.10.0";
+  version = "0.10.2";
 
   src = fetchFromGitHub {
     owner  = "albertlauncher";
     repo   = "albert";
     rev    = "v${version}";
-    sha256 = "1r8m0b6lqljy314ilpi58sdpqyb9rr502nzx3pgmx2g2xz4izsfj";
+    sha256 = "0plb8c7js91bpf7qgq1snhry8x4zixyy34lq42nhsglab2kaq4ns";
   };
 
   nativeBuildInputs = [ cmake makeQtWrapper ];

pkgs/applications/misc/calibre/default.nix

@@ -5,12 +5,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "2.80.0";
+  version = "2.82.0";
   name = "calibre-${version}";
 
   src = fetchurl {
     url = "https://download.calibre-ebook.com/${version}/${name}.tar.xz";
-    sha256 = "1cgj30b0imv4gl12y1lcd07w3bx10sapclvjr78z78n7g32xp9ik";
+    sha256 = "073iarhjsapqf1g8ji1w835biixybqq869flq58vkz37wjmray8k";
   };
 
   patches = [

pkgs/applications/misc/dmenu2/default.nix

@@ -22,8 +22,8 @@ stdenv.mkDerivation rec {
   meta = {
       description = "A patched fork of the original dmenu - an efficient dynamic menu for X";
       homepage = https://bitbucket.org/melek/dmenu2;
-      license = stdenv.lib.licenses.mit;
+      license = licenses.mit;
-      maintainers = with maintainers; [ cstrahan ];
+      maintainers = [ maintainers.cstrahan ];
       platforms = platforms.all;
   };
 }

pkgs/applications/misc/doomseeker/default.nix

@@ -18,11 +18,11 @@ stdenv.mkDerivation rec {
     substituteInPlace src/core/CMakeLists.txt --replace /usr/share/applications "$out"/share/applications
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     homepage = http://doomseeker.drdteam.org/;
     description = "Multiplayer server browser for many Doom source ports";
-    license = stdenv.lib.licenses.gpl2;
+    license = licenses.gpl2;
-    platforms = stdenv.lib.platforms.unix;
+    platforms = platforms.unix;
-    maintainers = with stdenv.lib.maintainers; [ MP2E ];
+    maintainers = [ maintainers.MP2E ];
   };
 }

pkgs/applications/misc/epdfview/default.nix

@@ -1,14 +1,16 @@
 { stdenv, fetchurl, fetchpatch, pkgconfig, gtk2, poppler }:
 
 stdenv.mkDerivation rec {
-  name = "epdfview-0.1.8";
+  name = "epdfview-${version}";
+  version = "0.1.8";
 
   src = fetchurl {
-    url = "http://trac.emma-soft.com/epdfview/chrome/site/releases/${name}.tar.bz2";
+    url = "mirror://debian/pool/main/e/epdfview/epdfview_${version}.orig.tar.gz";
-    sha256 = "1w7qybh8ssl4dffi5qfajq8mndw7ipsd92vkim03nywxgjp4i1ll";
+    sha256 = "0ibyb60a0b4n34bsjgvhdw8yf24463ky0hpmf6a2jjqsbm5g4v64";
   };
 
-  buildInputs = [ pkgconfig gtk2 poppler ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gtk2 poppler ];
 
   hardeningDisable = [ "format" ];
 
@@ -24,16 +26,16 @@ stdenv.mkDerivation rec {
               })
             ];
 
-  meta = {
+  meta = with stdenv.lib; {
-    homepage = http://trac.emma-soft.com/epdfview/;
+    homepage = https://packages.debian.org/wheezy/epdfview;
     description = "A lightweight PDF document viewer using Poppler and GTK+";
     longDescription = ''
         ePDFView is a free lightweight PDF document viewer using Poppler and
         GTK+ libraries. The aim of ePDFView is to make a simple PDF document
         viewer, in the lines of Evince but without using the Gnome libraries.
     '';
-    license = stdenv.lib.licenses.gpl2;
+    license = licenses.gpl2;
-    maintainers = with stdenv.lib.maintainers; [ astsmtl ];
+    maintainers = [ maintainers.astsmtl ];
-    platforms = with stdenv.lib.platforms; linux;
+    platforms = platforms.linux;
   };
 }

pkgs/applications/misc/evopedia/default.nix

@@ -1,23 +1,24 @@
-{ stdenv, fetchgit, bzip2, qt4, qmake4Hook, libX11 }:
+{ stdenv, fetchFromGitHub, bzip2, qt4, qmake4Hook, libX11 }:
 
 stdenv.mkDerivation rec {
   name = "evopedia-${version}";
   version = "0.4.4";
 
-  src = fetchgit {
+  src = fetchFromGitHub {
-    url = https://github.com/evopedia/evopedia_qt;
+    owner = "evopedia";
-    rev = "refs/tags/v${version}";
+    repo = "evopedia_qt";
+    rev = "v${version}";
     sha256 = "0snp5qiywj306kfaywvkl7j34fivgxcb8dids1lzmbqq5xcpqqvc";
   };
 
   buildInputs = [ bzip2 qt4 libX11 ];
   nativeBuildInputs = [ qmake4Hook ];
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Offline Wikipedia Viewer";
     homepage = http://www.evopedia.info;
-    license = stdenv.lib.licenses.gpl3Plus;
+    license = licenses.gpl3Plus;
-    maintainers = with stdenv.lib.maintainers; [ qknight ];
+    maintainers = [ maintainers.qknight ];
-    platforms = with stdenv.lib.platforms; linux;
+    platforms = platforms.linux;
   };
 }

pkgs/applications/misc/finalterm/default.nix

@@ -1,27 +1,29 @@
-{ stdenv, lib, fetchgit, makeWrapper
+{ stdenv, lib, fetchFromGitHub, makeWrapper
 , pkgconfig, cmake, libxml2, vala_0_23, intltool, libmx, gnome3, gtk3, gtk_doc
 , keybinder3, clutter_gtk, libnotify
 , libxkbcommon, xorg, udev
 , bashInteractive
 }:
 
+with stdenv.lib;
+
 stdenv.mkDerivation {
   name = "finalterm-git-2014-11-15";
 
-  src = fetchgit {
+  src = fetchFromGitHub {
-    url = "https://github.com/p-e-w/finalterm.git";
+    owner = "p-e-w";
+    repo = "finalterm";
     rev = "39b078b2a96a5c3c9e74f92b1929f383d220ca8b";
     sha256 = "14viln5nabr39lafg1lzf6ydibz1h5d9346drp435ljxc6wsh21i";
   };
 
+  nativeBuildInputs = [ pkgconfig cmake intltool makeWrapper ];
   buildInputs = [
-    pkgconfig cmake vala_0_23 intltool gtk3 gnome3.gnome_common gnome3.libgee
+    vala_0_23 gtk3 gnome3.gnome_common gnome3.libgee
-    gtk_doc clutter_gtk libmx keybinder3 libxml2 libnotify makeWrapper
+    gtk_doc clutter_gtk libmx keybinder3 libxml2 libnotify
     xorg.libpthreadstubs xorg.libXdmcp xorg.libxshmfence
     libxkbcommon
-  ] ++ lib.optionals stdenv.isLinux [
+  ] ++ optionals stdenv.isLinux [ udev ];
-    udev
-  ];
 
   preConfigure = ''
     substituteInPlace data/org.gnome.finalterm.gschema.xml \
@@ -44,7 +46,7 @@ stdenv.mkDerivation {
       --prefix XDG_DATA_DIRS : "${gnome3.defaultIconTheme}/share:${gnome3.gtk.out}/share:$out/share:$GSETTINGS_SCHEMAS_PATH"
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "http://finalterm.org";
     description = "A new breed of terminal emulator";
     longDescription = ''
@@ -57,7 +59,7 @@ stdenv.mkDerivation {
       - GUI terminal controls
     '';
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ cstrahan ];
+    maintainers = [ maintainers.cstrahan ];
     platforms = platforms.linux;
   };
 }

pkgs/applications/misc/jp2a/default.nix

@@ -1,16 +1,19 @@
-{ stdenv, fetchurl, libjpeg }:
+{ stdenv, fetchFromGitHub, libjpeg, autoreconfHook }:
 
 stdenv.mkDerivation rec {
-  version = "1.0.6";
+  version = "1.0.7";
   name = "jp2a-${version}";
 
-  src = fetchurl {
+  src = fetchFromGitHub {
-    url = "mirror://sourceforge/jp2a/${name}.tar.gz";
+    owner = "cslarsen";
-    sha256 = "076frk3pa16s4r1b10zgy81vdlz0385zh3ykbnkaij25jn5aqc09";
+    repo = "jp2a";
+    rev = "v${version}";
+    sha256 = "12a1z9ba2j16y67f41y8ax5sgv1wdjd71pg7circdxkj263n78ql";
   };
 
   makeFlags = "PREFIX=$(out)";
 
+  nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ libjpeg ];
 
   meta = with stdenv.lib; {

pkgs/applications/misc/pdfshuffler/default.nix

@@ -0,0 +1,40 @@
+{ stdenv, fetchsvn
+, wrapGAppsHook, makeWrapper, gettext
+, python3Packages, gtk3, poppler_gi
+, gnome3, gsettings_desktop_schemas, shared_mime_info,
+}:
+
+python3Packages.buildPythonApplication rec {
+  name = "pdfshuffler-unstable-2017-02-26"; # no official release in 5 years
+
+  src = fetchsvn {
+    url = "http://svn.gna.org/svn/pdfshuffler/trunk";
+    rev = "20";
+    sha256 = "1g20dy45xg5vda9y58d2b1gkczj44xgrfi59jx6hr62ynd3z0dfc";
+  };
+
+  nativeBuildInputs = [ wrapGAppsHook gettext makeWrapper ];
+
+  buildInputs = [
+    gtk3 gsettings_desktop_schemas poppler_gi gnome3.adwaita-icon-theme
+  ];
+
+  propagatedBuildInputs = with python3Packages; [
+    pygobject3
+    pycairo
+    pypdf2
+  ];
+
+  preFixup = ''
+    gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "${shared_mime_info}/share")
+  '';
+
+  doCheck = false; # no tests
+
+  meta = with stdenv.lib; {
+    homepage = https://gna.org/projects/pdfshuffler/;
+    description = "Merge or split pdf documents and rotate, crop and rearrange their pages";
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ mic92 ];
+  };
+}

pkgs/applications/misc/veracrypt/default.nix

@@ -0,0 +1,45 @@
+{ fetchurl, stdenv, pkgconfig, nasm, fuse, wxGTK30, devicemapper, makeself,
+  wxGUI ? true
+}:
+
+with stdenv.lib;
+
+stdenv.mkDerivation rec {
+  name = "veracrypt-${version}";
+  version = "1.19";
+
+  src = fetchurl {
+    url = "https://launchpad.net/veracrypt/trunk/${version}/+download/VeraCrypt_${version}_Source.tar.gz";
+    sha256 = "111xs1zmic82lpn5spn0ca33q0g4za04a2k4cvjwdb7k3vcicq6v";
+  };
+
+  # The source archive appears to be compressed twice ...
+  unpackPhase =
+    ''
+      gzip -dc $src | tar xz
+      cd Vera*/src
+    '';
+
+  nativeBuildInputs = [ makeself nasm pkgconfig ];
+  buildInputs = [ fuse devicemapper ]
+    ++ optional wxGUI wxGTK30;
+  makeFlags = optionalString (!wxGUI) "NOGUI=1";
+
+  installPhase =
+    ''
+      mkdir -p $out/bin
+      cp Main/veracrypt $out/bin
+      mkdir -p $out/share/$name
+      cp License.txt $out/share/$name/LICENSE
+      mkdir -p $out/share/applications
+      sed "s,Exec=.*,Exec=$out/bin/veracrypt," Setup/Linux/veracrypt.desktop > $out/share/applications/veracrypt.desktop
+    '';
+
+  meta = {
+    description = "Free Open-Source filesystem on-the-fly encryption";
+    homepage = https://veracrypt.codeplex.com/;
+    license = "VeraCrypt License";
+    maintainers = with maintainers; [ dsferruzza ];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/networking/browsers/qutebrowser/default.nix

@@ -1,8 +1,10 @@
-{ stdenv, fetchurl, unzip, buildPythonApplication, makeQtWrapper, wrapGAppsHook
+{ stdenv, lib, fetchurl, unzip, buildPythonApplication, makeQtWrapper, wrapGAppsHook
 , qtbase, pyqt5, jinja2, pygments, pyyaml, pypeg2, cssutils, glib_networking
 , asciidoc, docbook_xml_dtd_45, docbook_xsl, libxml2, libxslt
 , gst-plugins-base, gst-plugins-good, gst-plugins-bad, gst-plugins-ugly, gst-libav
-, qtwebkit-plugins }:
+, qtwebkit-plugins
+, withWebEngineDefault ? false
+}:
 
 let
   pdfjs = stdenv.mkDerivation rec {
@@ -73,7 +75,8 @@ in buildPythonApplication rec {
 
   postFixup = ''
     mv $out/bin/qutebrowser $out/bin/.qutebrowser-noqtpath
-    makeQtWrapper $out/bin/.qutebrowser-noqtpath $out/bin/qutebrowser
+    makeQtWrapper $out/bin/.qutebrowser-noqtpath $out/bin/qutebrowser \
+      ${lib.optionalString withWebEngineDefault ''--add-flags "--backend webengine"''}
 
     sed -i 's/\.qutebrowser-wrapped/qutebrowser/g' $out/bin/..qutebrowser-wrapped-wrapped
   '';

pkgs/applications/networking/browsers/surf/default.nix

@@ -1,34 +1,27 @@
-{stdenv, fetchurl, makeWrapper, gtk2, webkit, pkgconfig, glib, glib_networking, libsoup, gsettings_desktop_schemas, patches ? null}:
+{ stdenv, fetchurl
+, pkgconfig, wrapGAppsHook
+, glib, glib_networking, gsettings_desktop_schemas, gtk, libsoup, webkitgtk
+, patches ? null
+}:
 
 stdenv.mkDerivation rec {
   name = "surf-${version}";
-  version="0.7";
+  version = "2.0";
 
   src = fetchurl {
     url = "http://dl.suckless.org/surf/surf-${version}.tar.gz";
-    sha256 = "0jj93izd8fizxfa6ln9w1h9bwki81sz5dhskh5x1rl34zd38aq4m";
+    sha256 = "07cmajyafljigy10d21kkyvv5jf3hxkx06pz3rwwk3y3c9x4rvps";
   };
 
-  buildInputs = [ gtk2 makeWrapper webkit gsettings_desktop_schemas pkgconfig glib libsoup ];
+  nativeBuildInputs = [ pkgconfig wrapGAppsHook ];
+  buildInputs = [ glib glib_networking gsettings_desktop_schemas gtk libsoup webkitgtk ];
 
-  # Allow users set their own list of patches
   inherit patches;
 
-  buildPhase = " make ";
-
-  # `-lX11' to make sure libX11's store path is in the RPATH
-  NIX_LDFLAGS = "-lX11";
-  preConfigure = ''sed -i "s@PREFIX = /usr/local@PREFIX = $out@g" config.mk'';
   installFlags = [ "PREFIX=/" "DESTDIR=$(out)" ];
 
-  preFixup = ''
+  meta = with stdenv.lib; {
-    wrapProgram "$out/bin/surf" \
+    description = "A simple web browser based on WebKit/GTK+";
-      --prefix GIO_EXTRA_MODULES : ${glib_networking.out}/lib/gio/modules \
-      --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH"
-  '';
-
-  meta = {
-    description = "Simple web browser";
     longDescription = ''
       Surf is a simple web browser based on WebKit/GTK+. It is able to display
       websites and follow links. It supports the XEmbed protocol which makes it
@@ -36,7 +29,8 @@ stdenv.mkDerivation rec {
       surf to another URI by setting its XProperties.
     '';
     homepage = http://surf.suckless.org;
-    license = stdenv.lib.licenses.mit;
+    license = licenses.mit;
-    platforms = stdenv.lib.platforms.linux;
+    platforms = webkitgtk.meta.platforms;
+    maintainers = with maintainers; [ joachifm ];
   };
 }

pkgs/applications/networking/browsers/surf/webkit2.nix

@@ -1,42 +0,0 @@
-{ stdenv, fetchzip
-, pkgconfig, wrapGAppsHook
-, glib, glib_networking, gsettings_desktop_schemas, gtk2, libsoup, webkitgtk
-, patches ? null
-}:
-
-let
-  # http://git.suckless.org/surf/log/?h=surf-webkit2
-  rev = "7e02344a615a61246ccce1c7f770e88fbd57756e";
-  sha256 = "11f93fbjhl7nfgwkcc45lcm3x1wk5h87ap8fbw9w855021i57pp6";
-  date = "2017-03-22";
-in
-
-stdenv.mkDerivation rec {
-  name = "surf-webkit2-${date}";
-
-  src = fetchzip {
-    url = "http://git.suckless.org/surf/snapshot/surf-${rev}.tar.gz";
-    inherit sha256;
-  };
-
-  nativeBuildInputs = [ pkgconfig wrapGAppsHook ];
-  buildInputs = [ glib glib_networking gsettings_desktop_schemas gtk2 libsoup webkitgtk ];
-
-  inherit patches;
-
-  installFlags = [ "PREFIX=/" "DESTDIR=$(out)" ];
-
-  meta = with stdenv.lib; {
-    description = "A simple web browser based on WebKit/GTK+";
-    longDescription = ''
-      Surf is a simple web browser based on WebKit/GTK+. It is able to display
-      websites and follow links. It supports the XEmbed protocol which makes it
-      possible to embed it in another application. Furthermore, one can point
-      surf to another URI by setting its XProperties.
-    '';
-    homepage = http://surf.suckless.org;
-    license = licenses.mit;
-    platforms = platforms.all;
-    maintainers = with maintainers; [ joachifm ];
-  };
-}

pkgs/applications/networking/cluster/terraform/0.8.5.nix

@@ -1,34 +0,0 @@
-{ stdenv, lib, buildGoPackage, fetchFromGitHub }:
-
-buildGoPackage rec {
-  name = "terraform-${version}";
-  version = "0.8.5";
-
-  goPackagePath = "github.com/hashicorp/terraform";
-
-  src = fetchFromGitHub {
-    owner  = "hashicorp";
-    repo   = "terraform";
-    rev    = "v${version}";
-    sha256 = "1cxwv3652fpsbm2zk1akw356cd7w7vhny1623ighgbz9ha8gvg09";
-  };
-
-  postInstall = ''
-    # remove all plugins, they are part of the main binary now
-    for i in $bin/bin/*; do
-      if [[ $(basename $i) != terraform ]]; then
-        rm "$i"
-      fi
-    done
-  '';
-
-  meta = with stdenv.lib; {
-    description = "Tool for building, changing, and versioning infrastructure";
-    homepage = "https://www.terraform.io/";
-    license = licenses.mpl20;
-    maintainers = with maintainers; [
-      jgeerds
-      zimbatm
-    ];
-  };
-}

pkgs/applications/networking/cluster/terraform/default.nix

@@ -1,11 +1,14 @@
-{ stdenv, lib, buildGoPackage, fetchFromGitHub }:
+{ stdenv, lib, buildGoPackage, fetchpatch, fetchFromGitHub }:
 
 let
-  generic = { version, sha256 }:
+  goPackagePath = "github.com/hashicorp/terraform";
-  buildGoPackage rec {
+
+  generic = { version, sha256, ... }@attrs:
+    let attrs' = builtins.removeAttrs attrs ["version" "sha256"]; in
+    buildGoPackage ({
       name = "terraform-${version}";
 
-    goPackagePath = "github.com/hashicorp/terraform";
+      inherit goPackagePath;
 
       src = fetchFromGitHub {
         owner  = "hashicorp";
@@ -27,17 +30,15 @@ let
         export HOME=$TMP
       '';
 
-    doCheck = builtins.compareVersions version "0.9.0" >= 0;
-
       meta = with stdenv.lib; {
         description = "Tool for building, changing, and versioning infrastructure";
         homepage = https://www.terraform.io/;
         license = licenses.mpl20;
         maintainers = with maintainers; [ jgeerds zimbatm peterhoeg ];
       };
-  };
+    } // attrs');
 
-in rec {
+in {
   terraform_0_8_5 = generic {
     version = "0.8.5";
     sha256 = "1cxwv3652fpsbm2zk1akw356cd7w7vhny1623ighgbz9ha8gvg09";
@@ -48,8 +49,21 @@ in rec {
     sha256 = "0ibgpcpvz0bmn3cw60nzsabsrxrbmmym1hv7fx6zmjxiwd68w5gb";
   };
 
-  terraform_0_9_1 = generic {
+  terraform_0_9_2 = generic {
-    version = "0.9.1";
+    version = "0.9.2";
-    sha256 = "081p6dlvkg9mgaz49ichxzlk1ks0rxa7nvilaq8jj1gq3jvylqnh";
+    sha256 = "1yj5x1d10028fm3v3gjyjdn128ps0as345hr50y8x3vn86n70lxl";
+
+    patches = [
+      (fetchpatch {
+        url = "https://github.com/hashicorp/terraform/pull/13237.patch";
+        sha256 = "03c2nq12gvqqp12znvl3lmiviwsqksx4nrplv09fns2kz2gyfnbm";
+      })
+      (fetchpatch {
+        url = "https://github.com/hashicorp/terraform/pull/13248.patch";
+        sha256 = "0awj8gaic0j7a69is95f2rll3yip4n6avai1jh20b1x7dybdrp5m";
+      })
+    ];
+
+    doCheck = true;
   };
 }

pkgs/applications/networking/corebird/default.nix

@@ -3,14 +3,14 @@
 , glib_networking }:
 
 stdenv.mkDerivation rec {
-  version = "1.3.3";
+  version = "1.4.2";
   name = "corebird-${version}";
 
   src = fetchFromGitHub {
     owner = "baedert";
     repo = "corebird";
     rev = version;
-    sha256 = "09k0jrhjqrmpvyz5pf1g7wkidflkhpvw5869a95vnhfxjd45kzs3";
+    sha256 = "0s28q9c7p4p4jyhb1g6gdwdphlf6yhi6yg4yn8bkd0gmyf9acakb";
   };
 
   preConfigure = ''
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ automake autoconf libtool pkgconfig wrapGAppsHook ];
 
   buildInputs = [
-    gtk3 json_glib sqlite libsoup gettext vala_0_32 gnome3.rest gnome3.dconf glib_networking
+    gtk3 json_glib sqlite libsoup gettext vala_0_32 gnome3.rest gnome3.dconf gnome3.gspell glib_networking
   ] ++ (with gst_all_1; [ gstreamer gst-plugins-base gst-plugins-good gst-plugins-bad gst-libav ]);
 
   meta = {

pkgs/applications/networking/droopy/default.nix

@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     description = "Mini Web server that let others upload files to your computer";
     homepage = http://stackp.online.fr/droopy;
     license = licenses.bsd3;
-    maintainers = maintainers.profpatsch;
+    maintainers = [ maintainers.profpatsch ];
   };
 
 }

pkgs/applications/networking/feedreaders/rss2email/default.nix

@@ -0,0 +1,29 @@
+{ pythonPackages, fetchurl, lib }:
+
+with pythonPackages;
+
+buildPythonApplication rec {
+  name = "${pname}-${version}";
+  pname = "rss2email";
+  version = "3.9";
+
+  propagatedBuildInputs = [ feedparser beautifulsoup4 html2text ];
+
+  src = fetchurl {
+    url = "mirror://pypi/r/rss2email/${name}.tar.gz";
+    sha256 = "02wj9zhmc2ym8ba1i0z9pm1c622z2fj7fxwagnxbvpr1402ahmr5";
+  };
+
+  postInstall = ''
+    install -Dm 644 r2e.1 $out/share/man/man1/r2e.1
+    # an alias for better finding the manpage
+    ln -s -T r2e.1 $out/share/man/man1/rss2email.1
+  '';
+
+  meta = with lib; {
+    description = "A tool that converts RSS/Atom newsfeeds to email.";
+    homepage = "https://pypi.python.org/pypi/rss2email";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ jb55 profpatsch ];
+  };
+}

pkgs/applications/networking/google-drive-ocamlfuse/default.nix

@@ -1,5 +1,5 @@
 { stdenv, fetchurl, zlib
-, ocaml, ocamlfuse, findlib, gapi_ocaml, ocaml_sqlite3, camlidl }:
+, ocaml, ocamlbuild, ocamlfuse, findlib, gapi_ocaml, ocaml_sqlite3, camlidl }:
 
 stdenv.mkDerivation rec {
   name    = "google-drive-ocamlfuse-${version}";
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "1ldja7080pnjaibrbdvfqwakp4mac8yw1lkb95f7lgldmy96lxas";
   };
 
-  buildInputs = [ zlib ocaml ocamlfuse findlib gapi_ocaml ocaml_sqlite3 camlidl];
+  buildInputs = [ zlib ocaml ocamlbuild ocamlfuse findlib gapi_ocaml ocaml_sqlite3 camlidl];
 
   configurePhase = "ocaml setup.ml -configure --prefix \"$out\"";
   buildPhase = "ocaml setup.ml -build";

pkgs/applications/networking/instant-messengers/jitsi/default.nix

@@ -6,7 +6,6 @@
 assert stdenv.isLinux;
 
 stdenv.mkDerivation rec {
-
   name = "jitsi-${version}";
   version = "2.10.5550";
 
@@ -15,7 +14,6 @@ stdenv.mkDerivation rec {
     sha256 = "11vjchc3dnzj55x7c62wsm6masvwmij1ifkds917r1qvil1nzz6d";
   };
 
-
   patches = [ ./jitsi.patch ];
 
   jitsiItem = makeDesktopItem {
@@ -42,7 +40,8 @@ stdenv.mkDerivation rec {
     xorg.libXv
   ]);
 
-  buildInputs = [unzip ant jdk];
+  nativeBuildInputs = [ unzip ];
+  buildInputs = [ ant jdk ];
 
   buildPhase = ''ant make'';
 
@@ -57,9 +56,9 @@ stdenv.mkDerivation rec {
     substituteInPlace $out/bin/jitsi \
       --subst-var-by JAVA ${jdk}/bin/java \
       --subst-var-by EXTRALIBS ${gtk2.out}/lib
+    sed -e 's,^java\ ,${jdk}/bin/java ,' -i $out/bin/jitsi
     patchShebangs $out
-
+    libPath="$libPath:${jdk.home}/lib/${jdk.architecture}"
-    libPath="$libPath:${jdk.jre.home}/lib/${jdk.architecture}"
     find $out/ -type f -name '*.so' | while read file; do
       patchelf --set-rpath "$libPath" "$file" && \
           patchelf --shrink-rpath "$file"
@@ -71,7 +70,6 @@ stdenv.mkDerivation rec {
     description = "Open Source Video Calls and Chat";
     license = licenses.lgpl21Plus;
     platforms = platforms.linux;
-    maintainers = [ maintainers.khumba ];
+    maintainers = with maintainers; [ khumba ndowens ];
   };
-
 }

pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix

@@ -1,144 +1,92 @@
 { stdenv, lib, fetchFromGitHub, fetchgit, pkgconfig, gyp, cmake
-, qtbase, qtimageformats, qtwayland
+, qtbase, qtimageformats, makeQtWrapper
-, breakpad, ffmpeg, openalSoft, openssl, zlib, libexif, lzma, libopus
+, breakpad, gtk3, libappindicator-gtk3, dee
-, gtk2, glib, cairo, pango, gdk_pixbuf, atk, libappindicator-gtk2
+, ffmpeg, openalSoft, minizip
-, libwebp, libunity, dee, libdbusmenu-glib, libva-full, wayland
-, xcbutilrenderutil, icu, libSM, libICE, libproxy, libvdpau
-
-, libxcb, xcbutilwm, xcbutilimage, xcbutilkeysyms, libxkbcommon
-, libpng, libjpeg, freetype, harfbuzz, pcre16, xproto, libX11
-, inputproto, sqlite, dbus
 }:
 
-let
+stdenv.mkDerivation rec {
-  system-x86_64 = lib.elem stdenv.system lib.platforms.x86_64;
-  packagedQt = "5.6.2";
-  # Hacky: split "1.2.3-4" into "1.2.3" and "4"
-  systemQt = (builtins.parseDrvName qtbase.version).name;
-  qtLibs = [ qtbase qtimageformats qtwayland ];
-
-in stdenv.mkDerivation rec {
   name = "telegram-desktop-${version}";
-  version = "1.0.2";
+  version = "1.0.27";
-  qtVersion = lib.replaceStrings ["."] ["_"] packagedQt;
 
-  src = fetchFromGitHub {
+  # Submodules
-    owner = "telegramdesktop";
+  src = fetchgit {
-    repo = "tdesktop";
+    url = "https://github.com/telegramdesktop/tdesktop";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
-    sha256 = "1pakxzs28v794x9mm7pb2m0phkfrwq19shz8a6lfyidb6ng85hy2";
+    sha256 = "05g88g6h2a7f9biliicg81fqssx0y3akd3y5r2q2b5h8q3igqrfc";
   };
 
   tgaur = fetchgit {
-    url = "https://aur.archlinux.org/telegram-desktop.git";
+    url = "https://aur.archlinux.org/telegram-desktop-systemqt.git";
-    rev = "957a76f9fb691486341bcf4781ad0ef3d16f6b69";
+    rev = "b4d169076ed12ec01941a95499774d5caa6fc00e";
-    sha256 = "01nrvvq0mrdyvamjgqr4z5aahyd1wrf28jyddpfsnixp2w5kxqj8";
+    sha256 = "0pmm6slabg9xazgs0ffnp8v0hx3vnpdfgymvapwqpm3h9mwk22x9";
   };
 
   buildInputs = [
-    breakpad ffmpeg openalSoft openssl zlib libexif lzma libopus
+    gtk3 libappindicator-gtk3 dee qtbase qtimageformats ffmpeg openalSoft minizip
-    gtk2 glib libappindicator-gtk2 libunity cairo pango gdk_pixbuf atk
-    dee libdbusmenu-glib libva-full xcbutilrenderutil icu libproxy
-    libSM libICE
-    # Qt dependencies
-    libxcb xcbutilwm xcbutilimage xcbutilkeysyms libxkbcommon
-    libpng libjpeg freetype harfbuzz pcre16 xproto libX11
-    inputproto sqlite dbus libwebp wayland libvdpau
   ];
 
-  nativeBuildInputs = [ pkgconfig gyp cmake ];
+  nativeBuildInputs = [ pkgconfig gyp cmake makeQtWrapper ];
 
-  patches = [ "${tgaur}/aur-fixes.diff" ];
+  patches = [ "${tgaur}/aur-build-fixes.patch" ];
 
   enableParallelBuilding = true;
 
-  qtSrcs = builtins.map (x: x.src) qtLibs;
+  GYP_DEFINES = lib.concatStringsSep "," [
-  qtNames = builtins.map (x: (builtins.parseDrvName x.name).name) (lib.tail qtLibs);
+    "TDESKTOP_DISABLE_CRASH_REPORTS"
-  qtPatches = qtbase.patches;
+    "TDESKTOP_DISABLE_AUTOUPDATE"
+    "TDESKTOP_DISABLE_REGISTER_CUSTOM_SCHEME"
+  ];
 
-  buildCommand = ''
+  NIX_CFLAGS_COMPILE = [
-    unpackPhase
+    "-DTDESKTOP_DISABLE_AUTOUPDATE"
-    cd "$sourceRoot"
+    "-DTDESKTOP_DISABLE_CRASH_REPORTS"
-
+    "-DTDESKTOP_DISABLE_REGISTER_CUSTOM_SCHEME"
-    patchPhase
+    "-I${minizip}/include/minizip"
-
+    # See Telegram/gyp/qt.gypi
-    sed -i Telegram/gyp/Telegram.gyp \
+    "-I${qtbase.dev}/mkspecs/linux-g++"
-      -e 's,/usr/include/breakpad,${breakpad}/include/breakpad,g'
+  ] ++ lib.concatMap (x: [
+    "-I${qtbase.dev}/include/${x}"
+    "-I${qtbase.dev}/include/${x}/${qtbase.version}"
+    "-I${qtbase.dev}/include/${x}/${qtbase.version}/${x}"
+  ]) [ "QtCore" "QtGui" ];
+  CPPFLAGS = NIX_CFLAGS_COMPILE;
 
+  preConfigure = ''
     sed -i Telegram/gyp/telegram_linux.gypi \
       -e 's,/usr,/does-not-exist,g' \
+      -e 's,appindicator-0.1,appindicator3-0.1,g' \
       -e 's,-flto,,g'
 
     sed -i Telegram/gyp/qt.gypi \
-      -e 's,${packagedQt},${systemQt},g'
+      -e "s,/usr/bin/moc,moc,g"
+    sed -i Telegram/gyp/qt_rcc.gypi \
+      -e "s,/usr/bin/rcc,rcc,g"
 
-    gypFlagsArray=(
+    gyp \
-      "-Dlinux_path_qt=$PWD/../qt"
+      -Gconfig=Release \
-      "-Dlinux_lib_ssl=-lssl"
+      --depth=Telegram/gyp \
-      "-Dlinux_lib_crypto=-lcrypto"
+      --generator-output=../.. \
-      "-Dlinux_lib_icu=-licuuc -licutu -licui18n"
+      -Goutput_dir=out \
-    )
+       --format=cmake \
+      Telegram/gyp/Telegram.gyp
 
-    export QMAKE=$PWD/../qt/bin/qmake
+    cd out/Release
-    ( mkdir -p ../Libraries
-      cd ../Libraries
-      for i in $qtSrcs; do
-        tar -xaf $i
-      done
-      cd qtbase-*
-      # This patch is often outdated but the fixes doesn't feel very important
-      patch -p1 < ../../$sourceRoot/Telegram/Patches/qtbase_${qtVersion}.diff || true
-      for i in $qtPatches; do
-        patch -p1 < $i
-      done
-      ${qtbase.postPatch}
-      cd ..
 
-      export configureFlags="-prefix "$PWD/../qt" -release -opensource -confirm-license -system-zlib \
+    NUM=$((`wc -l < CMakeLists.txt` - 2))
-        -system-libpng -system-libjpeg -system-freetype -system-harfbuzz -system-pcre -system-xcb \
+    sed -i "$NUM r $tgaur/CMakeLists.inj" CMakeLists.txt
-        -system-xkbcommon-x11 -no-eglfs -no-gtkstyle -static -nomake examples -nomake tests \
-        -no-directfb -system-proxies -openssl-linked -dbus-linked -system-sqlite -verbose \
-        ${lib.optionalString (!system-x86_64) "-no-sse2"} -no-sse3 -no-ssse3 \
-        -no-sse4.1 -no-sse4.2 -no-avx -no-avx2 -no-mips_dsp -no-mips_dspr2"
-      export dontAddPrefix=1
-      export MAKEFLAGS=-j$NIX_BUILD_CORES
 
-      ( cd qtbase-*
-        configurePhase
-        buildPhase
-        make install
-      )
-      for i in $qtNames; do
-        ( cd $i-*
-          $QMAKE
-          buildPhase
-          make install
-        )
-      done
-    )
-
-    ( cd Telegram/gyp
-      gyp "''${gypFlagsArray[@]}" --depth=. --generator-output=../.. -Goutput_dir=out Telegram.gyp --format=cmake
-    )
-
-    ( cd out/Release
     export ASM=$(type -p gcc)
-      cmake .
+  '';
-      # For some reason, it can't find stdafx.h -- we need to build dependencies till it fails and then retry.
-      buildPhase || true
-      export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -include stdafx.h"
-      buildPhase
-    )
 
-    install -Dm755 out/Release/Telegram $out/bin/telegram-desktop
+  installPhase = ''
+    install -Dm755 Telegram $out/bin/telegram-desktop
     mkdir -p $out/share/applications $out/share/kde4/services
     sed "s,/usr/bin,$out/bin,g" $tgaur/telegramdesktop.desktop > $out/share/applications/telegramdesktop.desktop
     sed "s,/usr/bin,$out/bin,g" $tgaur/tg.protocol > $out/share/kde4/services/tg.protocol
     for icon_size in 16 32 48 64 128 256 512; do
-      install -Dm644 "Telegram/Resources/art/icon''${icon_size}.png" "$out/share/icons/hicolor/''${icon_size}x''${icon_size}/apps/telegram-desktop.png"
+      install -Dm644 "../../../Telegram/Resources/art/icon''${icon_size}.png" "$out/share/icons/hicolor/''${icon_size}x''${icon_size}/apps/telegram-desktop.png"
     done
-
+    wrapQtProgram $out/bin/telegram-desktop
-    fixupPhase
   '';
 
   meta = with stdenv.lib; {

pkgs/applications/networking/ipfs/default.nix

@@ -2,15 +2,15 @@
 
 buildGoPackage rec {
   name = "ipfs-${version}";
-  version = "0.4.6";
+  version = "0.4.8";
-  rev = "ed729423ce548785834cdcaa21aab11ebc3a1b1a";
+  rev = "8e7484ed794d1aecb3e773e9003ae64c7b78bb87";
 
   goPackagePath = "github.com/ipfs/go-ipfs";
 
   extraSrcPaths = [
     (fetchgx {
       inherit name src;
-      sha256 = "1wwzbps3ry3vlrr0iqhvxd44x0wi99dcp5hlxvh79dc0g9r7myfk";
+      sha256 = "1h4n74n65z4sw3fqz8nfcrwisbvvwwfq69909w3kgrjsxs7505s5";
     })
   ];
 
@@ -18,7 +18,7 @@ buildGoPackage rec {
     owner = "ipfs";
     repo = "go-ipfs";
     inherit rev;
-    sha256 = "1b262k1lhb1g68l8hghly4pdrxx1c6wbv6ij6dg399zdwqzczl13";
+    sha256 = "15jcg0wbm7g82fsmhc1vxrsszbxcghls3rsyv35n1hv5k5r5d5nh";
   };
 
   meta = with stdenv.lib; {

pkgs/applications/networking/newsreaders/liferea/default.nix

@@ -6,13 +6,13 @@
 
 let
   pname = "liferea";
-  version = "1.12-rc2";
+  version = "1.12-rc3";
 in stdenv.mkDerivation rec {
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "https://github.com/lwindolf/${pname}/releases/download/v${version}/${name}.tar.bz2";
-    sha256 = "1q83s900skl0w9pb0afq8z387ynhl0rqn6fmps8wmncj0z1q07wb";
+    sha256 = "0dd6hisqvc4ps6dx9ly34qx49ab1qa5h826b7dvf64mjqxa2v3kr";
   };
 
   nativeBuildInputs = [ wrapGAppsHook python3Packages.wrapPython intltool pkgconfig ];

pkgs/applications/office/treesheets/default.nix

@@ -0,0 +1,56 @@
+{ stdenv, fetchFromGitHub, wxGTK, makeWrapper }:
+
+stdenv.mkDerivation rec {
+  name    = "treesheets-${version}";
+  version = "2017-03-27";
+
+  src = fetchFromGitHub {
+    owner  = "aardappel";
+    repo   = "treesheets";
+    rev    = "1d1d6b214e3ae88445eb1ec0032d5fef14160f32";
+    sha256 = "0np91c4skq3yxq76c4zi33w73qb1w2nrcin490kkvrxk53jspklb";
+  };
+
+  buildInputs = [ wxGTK makeWrapper ];
+
+  preConfigure = "cd src";
+
+  postInstall = ''
+    mkdir "$out/share" -p
+    cp -av ../TS "$out/share/libexec"
+
+    mkdir "$out/bin" -p
+    makeWrapper "$out/share/libexec/treesheets" "$out/bin/treesheets"
+
+    mkdir "$out/share/doc" -p
+
+    for f in readme.html docs examples
+    do
+      mv -v "$out/share/libexec/$f" "$out/share/doc"
+      ln -sv "$out/share/doc/$f" "$out/share/libexec/$f"
+    done
+
+    mkdir "$out/share/applications" -p
+    mv -v "$out/share/libexec/treesheets.desktop" "$out/share/applications"
+    substituteInPlace "$out/share/applications/treesheets.desktop" \
+      --replace "Icon=images/treesheets.svg" "Icon=$out/share/libexec/images/treesheets.svg"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Free Form Data Organizer";
+
+    longDescription = ''
+      The ultimate replacement for spreadsheets, mind mappers, outliners,
+      PIMs, text editors and small databases.
+
+      Suitable for any kind of data organization, such as Todo lists,
+      calendars, project management, brainstorming, organizing ideas,
+      planning, requirements gathering, presentation of information, etc.
+    '';
+
+    homepage    = http://strlen.com/treesheets/;
+    maintainers = with maintainers; [ obadz ];
+    platforms   = platforms.linux;
+    license     = licenses.zlib;
+  };
+}

pkgs/applications/version-management/git-and-tools/diff-so-fancy/default.nix

@@ -2,18 +2,18 @@
 
 stdenv.mkDerivation rec {
   name = "diff-so-fancy-${version}";
-  version = "0.11.1";
+  version = "0.11.4";
-
-  # perl is needed here so patchShebangs can do its job
-  buildInputs = [perl makeWrapper];
 
   src = fetchFromGitHub {
     owner = "so-fancy";
     repo = "diff-so-fancy";
     rev = "v${version}";
-    sha256 = "1dw32c5i9mry6zr2a6h1369fhp1qbqimx04qgdmdnmn1imyck1h3";
+    sha256 = "1za2rm8jzcdc6bkpl198nrqf5bc05nw53vlkk15nmmb9snnb69ig";
   };
 
+  # Perl is needed here for patchShebangs
+  nativeBuildInputs = [ perl makeWrapper ];
+
   buildPhase = null;
 
   installPhase = ''
@@ -34,16 +34,14 @@ stdenv.mkDerivation rec {
       --prefix PATH : "${ncurses.out}/bin"
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     homepage = https://github.com/so-fancy/diff-so-fancy;
     description = "Good-looking diffs filter for git";
-    license = stdenv.lib.licenses.mit;
+    license = licenses.mit;
-
+    platforms = platforms.all;
     longDescription = ''
       diff-so-fancy builds on the good-lookin' output of git contrib's
       diff-highlight to upgrade your diffs' appearances.
     '';
-
-    platforms = stdenv.lib.platforms.all;
   };
 }

pkgs/applications/version-management/git-and-tools/git-cola/default.nix

@@ -1,33 +1,21 @@
-{ stdenv, fetchurl, pythonPackages, makeWrapper, gettext, git }:
+{ stdenv, fetchFromGitHub, pythonPackages, makeWrapper, gettext, git }:
 
 let
   inherit (pythonPackages) buildPythonApplication pyqt4 sip pyinotify python mock;
 in buildPythonApplication rec {
   name = "git-cola-${version}";
-  version = "2.8";
+  version = "2.10";
 
-  src = fetchurl {
+  src = fetchFromGitHub {
-    url = "https://github.com/git-cola/git-cola/archive/v${version}.tar.gz";
+    owner = "git-cola";
-    sha256 = "19ff7i0h5fznrkm17lp3xkxwkq27whhiil6y6bm16b1wny5hjqlr";
+    repo = "git-cola";
+    rev = "v${version}";
+    sha256 = "067g0yya6718kxagf5qm59zizp0lizca4m3ih85y732i6rqpgwv8";
   };
 
-  buildInputs = [ git makeWrapper gettext ];
+  buildInputs = [ git gettext ];
   propagatedBuildInputs = [ pyqt4 sip pyinotify ];
 
-  # HACK: wrapPythonPrograms adds 'import sys; sys.argv[0] = "git-cola"', but
-  # "import __future__" must be placed above that. This removes the argv[0] line.
-  postFixup = ''
-    wrapPythonPrograms
-
-    sed -i "$out/bin/.git-dag-wrapped" -e '{
-      /import sys; sys.argv/d
-    }'
-    
-    sed -i "$out/bin/.git-cola-wrapped" -e '{
-      /import sys; sys.argv/d
-    }'
-  '';
-
   doCheck = false;
 
   meta = with stdenv.lib; {

pkgs/applications/version-management/git-and-tools/git-imerge/default.nix

@@ -1,21 +1,19 @@
-{ stdenv, fetchurl, pythonPackages }:
+{ stdenv, fetchFromGitHub, pythonPackages }:
 
 stdenv.mkDerivation rec {
   name = "git-imerge-${version}";
-  version = "0.7.0";
+  version = "1.0.0";
 
-  src = fetchurl {
+  src = fetchFromGitHub {
-    url = "https://github.com/mhagger/git-imerge/archive/${version}.tar.gz";
+    owner = "mhagger";
-    sha256 = "00nwn3rfhf15wsv01lfji5412d7yz827ric916lnyp662d6gx206";
+    repo = "git-imerge";
+    rev = "v${version}";
+    sha256 = "1ylzxmbjfrzzxmcrbqzy1wv21npqj1r6cgl77a9n2zvsrz8zdb74";
   };
 
   buildInputs = [ pythonPackages.python pythonPackages.wrapPython ];
 
-  installPhase = ''
+  makeFlags = "PREFIX= DESTDIR=$(out)" ; 
-    mkdir -p $out/bin
-    make install PREFIX=$out
-    wrapPythonPrograms
-  '';
  
   meta = with stdenv.lib; {
     homepage = https://github.com/mhagger/git-imerge;

pkgs/applications/version-management/git-and-tools/git-radar/default.nix

@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   name = "git-radar-${version}";
-  version = "0.3.2";
+  version = "0.5";
 
   phases = [ "unpackPhase" "installPhase" ];
 
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     owner = "michaeldfallen";
     repo = "git-radar";
     rev = "v${version}";
-    sha256 = "1028462b4kqxx66vjv7r8nnr6bi3kw11fixpqyg2srqriha6447p";
+    sha256 = "1915aqx8bfc4xmvhx2gfxv72p969a6rn436kii9w4yi38hibmqv9";
   };
 
   installPhase = ''
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = https://github.com/michaeldfallen/git-radar;
     license = licenses.mit;
-    description = "Git-radar is a tool you can add to your prompt to provide at-a-glance information on your git repo";
+    description = "A tool you can add to your prompt to provide at-a-glance information on your git repo";
     platforms = with platforms; linux ++ darwin;
     maintainers = with maintainers; [ kamilchm ];
   };

pkgs/applications/version-management/git-and-tools/subgit/default.nix

@@ -1,7 +1,7 @@
 { stdenv, fetchurl, unzip, makeWrapper, jre }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
-  name = "subgit-3.1.0";
+  name = "subgit-3.2.4";
 
   meta = {
     description = "A tool for a smooth, stress-free SVN to Git migration";
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
     platforms = stdenv.lib.platforms.all;
   };
 
-  buildInputs = [ unzip makeWrapper ];
+  nativeBuildInputs = [ unzip makeWrapper ];
 
   installPhase = ''
     mkdir $out;
@@ -20,7 +20,7 @@ stdenv.mkDerivation {
   '';
 
   src = fetchurl {
-    url = http://old.subgit.com/download/subgit-3.1.0.zip;
+    url = "http://subgit.com/download/${name}.zip";
-    sha256 = "08qhpg6y2ziwplm0z1ghh1wfp607sw4hyb53a7qzfn759j5kcdrg";
+    sha256 = "13r6hi2zk46bs3j17anfc85kszlwliv2yc16qx834b3v4w68hajw";
   };
 }

pkgs/applications/version-management/git-and-tools/transcrypt/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "transcrypt-${version}";
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchFromGitHub {
     owner = "elasticdog";
     repo = "transcrypt";
     rev = "v${version}";
-    sha256 = "12n8714my9i93lysqa3dj1z5xgi10iv5y1mnsqki9zn5av3lgqkq";
+    sha256 = "05q0rgcsphrkavmcsm3qghsl1pkgshvhdf6zpwkn1qcj288h8gkc";
   };
 
   buildInputs = [ git makeWrapper openssl ];

pkgs/applications/version-management/gitkraken/default.nix

@@ -2,17 +2,18 @@
 , libXfixes, atk, gtk2, libXrender, pango, gnome2, cairo, freetype, fontconfig
 , libX11, libXi, libXext, libXcursor, glib, libXScrnSaver, libxkbfile, libXtst
 , nss, nspr, cups, fetchurl, expat, gdk_pixbuf, libXdamage, libXrandr, dbus
+, dpkg, makeDesktopItem
 }:
 
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "gitkraken-${version}";
-  version = "2.2.1";
+  version = "2.3.1";
 
   src = fetchurl {
-    url = "https://release.gitkraken.com/linux/v${version}.tar.gz";
+    url = "https://release.gitkraken.com/linux/v${version}.deb";
-    sha256 = "12nyw2dh9ylrms264dbw0xzyif0znmba32zyfq7kdp0iay0wvgqd";
+    sha256 = "ddb9eec34232e830646633c43bc9adc61afa0eee79500af29918b62780093b2a";
   };
 
   libPath = makeLibraryPath [
@@ -53,9 +54,29 @@ stdenv.mkDerivation rec {
 
   dontBuild = true;
 
+  desktopItem = makeDesktopItem {
+    name = "gitkraken";
+    exec = "gitkraken";
+    icon = "app";
+    desktopName = "GitKraken";
+    genericName = "Git Client";
+    categories = "Application;Development;";
+    comment = "Graphical Git client from Axosoft";
+  };
+
+  buildInputs = [ dpkg ];
+
+  unpackPhase = "dpkg-deb -x $src .";
+
   installPhase = ''
     mkdir -p "$out/opt/gitkraken"
-    cp -r ./* "$out/opt/gitkraken"
+    cp -r usr/share/gitkraken/* "$out/opt/gitkraken"
+
+    mkdir -p "$out/share/applications"
+    cp $desktopItem/share/applications/* "$out/share/applications"
+
+    mkdir -p "$out/share/pixmaps"
+    cp usr/share/pixmaps/app.png "$out/share/pixmaps"
   '';
 
   postFixup = ''

pkgs/applications/version-management/pijul/default.nix

@@ -4,11 +4,11 @@ with rustPlatform;
 
 buildRustPackage rec {
   name = "pijul-${version}";
-  version = "0.3.3";
+  version = "0.4.1";
 
   src = fetchurl {
     url = "https://pijul.org/releases/${name}.tar.gz";
-    sha256 = "933e68703916ee7b50cd09f928bb072bdfc3388b69ff657578c23080f7df22b8";
+    sha256 = "e492fde1bea839f474f5b91bb762a0fab5ff6a9bc2b8f20eb91a253ca6feda5a";
   };
 
   sourceRoot = "${name}/pijul";
@@ -18,7 +18,7 @@ buildRustPackage rec {
 
   doCheck = false;
   
-  depsSha256 = "1aiyjl8jbmr8yys5bsd2mg1i7jryzb8kxqlmxp7kjn2qx7b4q2zd";
+  depsSha256 = "17n66clr31s49gbbcsii0f31s63rncc9mmz4wwdi0yl4r6ykv9h7";
 
   meta = with stdenv.lib; {
     description = "A distributed version control system";

pkgs/applications/version-management/src/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "src-${version}";
-  version = "1.12";
+  version = "1.13";
 
   src = fetchurl {
     url = "http://www.catb.org/~esr/src/${name}.tar.gz";
-    sha256 = "1m6rjbizx9win3jkciyx176sfy98r5arb1g3l6aqnqam9gpr44zm";
+    sha256 = "0l13ld8nxm1c720ns22lyx3q1bq2c2zn78vi5w92b7nl6p2nncy8";
   };
 
   buildInputs = [ python rcs git makeWrapper ];

pkgs/applications/virtualization/docker-distribution/default.nix

@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "distribution-${version}";
-  version = "2.5.1";
+  version = "2.6.0";
   rev = "v${version}";
 
   goPackagePath = "github.com/docker/distribution";
@@ -11,7 +11,7 @@ buildGoPackage rec {
     owner = "docker";
     repo = "distribution";
     inherit rev;
-    sha256 = "08nxcsl9bc3k9gav2mkqccm5byrlfcgy6qaqaywiyza0b0cn4kdc";
+    sha256 = "1yg2zrikn3vkvkx5mn51p6bfjk840qdkn7ahhhvvcsc8mpigrjc6";
   };
 
   meta = with stdenv.lib; {

pkgs/applications/virtualization/docker/default.nix

@@ -6,19 +6,26 @@
 }:
 
 # https://github.com/docker/docker/blob/master/project/PACKAGERS.md
+# https://github.com/docker/docker/blob/TAG/hack/dockerfile/binaries-commits
 
 with lib;
 
-stdenv.mkDerivation rec {
+rec {
+  dockerGen = {
+      version, rev, sha256
+      , runcRev, runcSha256
+      , containerdRev, containerdSha256
+      , tiniRev, tiniSha256
+  } : stdenv.mkDerivation rec {
+    inherit version rev;
+
     name = "docker-${version}";
-  version = "17.03.0-ce";
-  rev = "60ccb22"; # should match the version commit
 
     src = fetchFromGitHub {
       owner = "docker";
       repo = "docker";
       rev = "v${version}";
-    sha256 = "0ml9aan8x4w8kfz7dm9vvl8b1a0vq09si9b7z50xz84040cjhnr9";
+      sha256 = sha256;
     };
 
     docker-runc = runc.overrideAttrs (oldAttrs: rec {
@@ -26,8 +33,8 @@ stdenv.mkDerivation rec {
       src = fetchFromGitHub {
         owner = "docker";
         repo = "runc";
-      rev = "a01dafd48bc1c7cc12bdb01206f9fea7dd6feb70";
+        rev = runcRev;
-      sha256 = "0n7vr47fhpyxx5vdnp453qp4cq50w4hwgq3ldyj5878d91iir7l1";
+        sha256 = runcSha256;
       };
       # docker/runc already include these patches / are not applicable
       patches = [];
@@ -37,8 +44,8 @@ stdenv.mkDerivation rec {
       src = fetchFromGitHub {
         owner = "docker";
         repo = "containerd";
-      rev = "977c511eda0925a723debdc94d09459af49d082a";
+        rev = containerdRev;
-      sha256 = "0hmcj8i70vv3a3bbdawrgi84a442m09x5mpc7fgn8dd3v031lcbc";
+        sha256 = containerdSha256;
       };
     });
     docker-tini = tini.overrideAttrs  (oldAttrs: rec {
@@ -46,8 +53,8 @@ stdenv.mkDerivation rec {
       src = fetchFromGitHub {
         owner = "krallin";
         repo = "tini";
-      rev = "949e6facb77383876aeff8a6944dde66b3089574";
+        rev = tiniRev;
-      sha256 = "0zj4kdis1vvc6dwn4gplqna0bs7v6d1y2zc8v80s3zi018inhznw";
+        sha256 = tiniSha256;
       };
 
       # Do not remove static from make files as we want a static binary
@@ -136,4 +143,17 @@ stdenv.mkDerivation rec {
       maintainers = with maintainers; [ offline tailhook ];
       platforms = platforms.linux;
     };
+  };
+
+  docker_17_03 = dockerGen rec {
+    version = "17.03.1-ce";
+    rev = "c6d412e"; # git commit
+    sha256 = "1h3hkg15c3isfgaqpkp3mr7ys5826cz24hn3f3wz07jmismq98q7";
+    runcRev = "54296cf40ad8143b62dbcaa1d90e520a2136ddfe";
+    runcSha256 = "0ylymx7pi4jmvbqj94j2i8qspy8cpq0m91l6a0xiqlx43yx6qi2m";
+    containerdRev = "4ab9917febca54791c5f071a9d1f404867857fcc";
+    containerdSha256 = "06f2gsx4w9z4wwjhrpafmz6c829wi8p7crj6sya6x9ii50bkn8p6";
+    tiniRev = "949e6facb77383876aeff8a6944dde66b3089574";
+    tiniSha256 = "0zj4kdis1vvc6dwn4gplqna0bs7v6d1y2zc8v80s3zi018inhznw";
+  };
 }

pkgs/applications/window-managers/i3/lock-color.nix

@@ -2,17 +2,19 @@
 , xcbutilimage, pam, libX11, libev, cairo, libxkbcommon, libxkbfile }:
 
 stdenv.mkDerivation rec {
-  rev = "c8e1aece7301c3c6481bf2f695734f8d273f252e";
+  version = "2.7-2017-04-01";
-  version = "2.7-2016-09-17";
   name = "i3lock-color-${version}";
+
   src = fetchFromGitHub {
     owner = "chrjguill";
     repo = "i3lock-color";
-    inherit rev;
+    rev = "61f6428aedbe4829d3e0f51d137283c8aec1e206";
-    sha256 = "07fpvwgdfxsnxnf63idrz3n1kbyayr53lsfns2q775q93cz1mfia";
+    sha256 = "0h4nzx46kcsp6b1i2lm9y4d1w1icrpvjl8g1h3wbpa5x4crh4703";
   };
-  buildInputs = [ which pkgconfig libxcb xcbutilkeysyms xcbutilimage pam libX11
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ which libxcb xcbutilkeysyms xcbutilimage pam libX11
     libev cairo libxkbcommon libxkbfile ];
+
   makeFlags = "all";
   preInstall = ''
     mkdir -p $out/share/man/man1

pkgs/applications/window-managers/sway/default.nix

@@ -1,10 +1,11 @@
 { stdenv, fetchFromGitHub, pango, libinput
 , makeWrapper, cmake, pkgconfig, asciidoc, libxslt, docbook_xsl, cairo
 , wayland, wlc, libxkbcommon, pixman, fontconfig, pcre, json_c, dbus_libs, libcap
+, xwayland
 }:
 
 let
-  version = "0.11";
+  version = "0.12.2";
 in
   stdenv.mkDerivation rec {
     name = "sway-${version}";
@@ -13,12 +14,12 @@ in
       owner = "Sircmpwn";
       repo = "sway";
       rev = "${version}";
-      sha256 = "01k01f72kh90fwgqh2hgg6dv9931x4v18bzz11b47mn7p9z68ddv";
+      sha256 = "1hkr6pmz45xa5w5y21ijz7i2dwb62rifhcy28r8kh5r2hwbil2hs";
     };
 
     nativeBuildInputs = [ makeWrapper cmake pkgconfig asciidoc libxslt docbook_xsl ];
 
-    buildInputs = [ wayland wlc libxkbcommon pixman fontconfig pcre json_c dbus_libs pango cairo libinput libcap ];
+    buildInputs = [ wayland wlc libxkbcommon pixman fontconfig pcre json_c dbus_libs pango cairo libinput libcap xwayland ];
 
     patchPhase = ''
       sed -i s@/etc/sway@$out/etc/sway@g CMakeLists.txt;

pkgs/data/fonts/fontconfig-penultimate/default.nix

@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub }:
 
-let version = "0.2.1"; in
+let version = "0.3.2"; in
 stdenv.mkDerivation {
   name = "fontconfig-penultimate-${version}";
 
@@ -8,7 +8,7 @@ stdenv.mkDerivation {
     owner = "ttuegel";
     repo = "fontconfig-penultimate";
     rev = version;
-    sha256 = "14arpalmpn7ig2myxslk4jdg6lm0cnmwsxy7zl0j7yr417k1kprf";
+    sha256 = "01cgqdmgpqahkg71lnvr3yzsmka9q1kgkbiz6w5ds1fhrpcswj7p";
   };
 
   installPhase = ''

pkgs/data/fonts/iosevka/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "iosevka-${version}";
-  version = "1.11.4";
+  version = "1.12.1";
 
   buildInputs = [ unzip ];
 
   src = fetchurl {
-    url = "https://github.com/be5invis/Iosevka/releases/download/v${version}/01-iosevka-${version}.zip";
+    url = "https://github.com/be5invis/Iosevka/releases/download/v${version}/iosevka-pack-${version}.zip";
-    sha256 = "0mn9pqkambsal5cvz8hzlwx7qvcdfch8g1iy7mqhgghzflfhsy8x";
+    sha256 = "1rwg06fbizf2cmjwysx4ciz96nh80k48drsyr3rshppycajnaahj";
   };
 
   sourceRoot = ".";

pkgs/desktops/gnome-3/3.22/core/baobab/default.nix

@@ -1,6 +1,6 @@
-{ stdenv, intltool, fetchurl, vala_0_32, libgtop
+{ stdenv, intltool, fetchurl, vala, libgtop
 , pkgconfig, gtk3, glib
-, bash, makeWrapper, itstool, libxml2
+, bash, wrapGAppsHook, itstool, libxml2
 , gnome3, librsvg, gdk_pixbuf, file }:
 
 stdenv.mkDerivation rec {
@@ -10,17 +10,8 @@ stdenv.mkDerivation rec {
 
   NIX_CFLAGS_COMPILE = "-I${gnome3.glib.dev}/include/gio-unix-2.0";
 
-  propagatedUserEnvPkgs = [ gnome3.gnome_themes_standard ];
+  buildInputs = [ vala pkgconfig gtk3 glib libgtop intltool itstool libxml2
-
+                  wrapGAppsHook file gdk_pixbuf gnome3.defaultIconTheme librsvg ];
-  buildInputs = [ vala_0_32 pkgconfig gtk3 glib libgtop intltool itstool libxml2
-                  gnome3.gsettings_desktop_schemas makeWrapper file
-                  gdk_pixbuf gnome3.defaultIconTheme librsvg ];
-
-  preFixup = ''
-    wrapProgram "$out/bin/baobab" \
-      --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
-      --prefix XDG_DATA_DIRS : "${gnome3.gnome_themes_standard}/share:$out/share:$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH"
-  '';
 
   meta = with stdenv.lib; {
     homepage = https://wiki.gnome.org/Apps/Baobab;

pkgs/desktops/gnome-3/3.22/core/gnome-keyring/default.nix

@@ -1,5 +1,5 @@
 { stdenv, fetchurl, pkgconfig, dbus, libgcrypt, libtasn1, pam, python, glib, libxslt
-, intltool, pango, gcr, gdk_pixbuf, atk, p11_kit, makeWrapper
+, intltool, pango, gcr, gdk_pixbuf, atk, p11_kit, wrapGAppsHook
 , docbook_xsl_ns, docbook_xsl, gnome3 }:
 
 stdenv.mkDerivation rec {
@@ -7,25 +7,18 @@ stdenv.mkDerivation rec {
 
   buildInputs = with gnome3; [
     dbus libgcrypt pam python gtk3 gconf libgnome_keyring
-    pango gcr gdk_pixbuf atk p11_kit makeWrapper
+    pango gcr gdk_pixbuf atk p11_kit
   ];
 
   propagatedBuildInputs = [ glib libtasn1 libxslt ];
 
-  nativeBuildInputs = [ pkgconfig intltool docbook_xsl_ns docbook_xsl ];
+  nativeBuildInputs = [ pkgconfig intltool docbook_xsl_ns docbook_xsl wrapGAppsHook ];
 
   configureFlags = [
     "--with-pkcs11-config=$$out/etc/pkcs11/" # installation directories
     "--with-pkcs11-modules=$$out/lib/pkcs11/"
   ];
 
-  preFixup = ''
-    wrapProgram "$out/bin/gnome-keyring" \
-      --prefix XDG_DATA_DIRS : "${glib.out}/share:$out/share:$GSETTINGS_SCHEMAS_PATH"
-    wrapProgram "$out/bin/gnome-keyring-daemon" \
-      --prefix XDG_DATA_DIRS : "${glib.out}/share:$out/share:$GSETTINGS_SCHEMAS_PATH"
-  '';
-
   meta = with stdenv.lib; {
     platforms = platforms.linux;
     maintainers = gnome3.maintainers;

pkgs/desktops/gnome-3/3.22/misc/gspell/default.nix

@@ -1,9 +1,9 @@
-{ stdenv, fetchurl, pkgconfig, glib, gtk3, enchant, isocodes }:
+{ stdenv, fetchurl, pkgconfig, glib, gtk3, enchant, isocodes, vala }:
 
 stdenv.mkDerivation rec {
   inherit (import ./src.nix fetchurl) name src;
 
-  buildInputs = [ pkgconfig glib gtk3 enchant isocodes ];
+  buildInputs = [ pkgconfig glib gtk3 enchant isocodes vala ];
 
   meta = with stdenv.lib; {
     platforms = platforms.linux;

pkgs/desktops/gnome-3/3.22/misc/gspell/src.nix

@@ -1,10 +1,10 @@
 fetchurl: rec {
-  major = "1.0";
+  major = "1.2";
-  minor = "3";
+  minor = "1";
   name = "gspell-${major}.${minor}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gspell/${major}/${name}.tar.xz";
-    sha256 = "1m8v4rqaxjsblccc3nnirkbkzgqm90vfpzp3x08lkqriqvk0anfr";
+    sha256 = "18zisdrq14my2iq6iv3lhqfn9jg98bqwbzcdidp7hfk915gkw74z";
   };
 }

pkgs/development/compilers/ghcjs/head_stage2.nix

@@ -382,6 +382,7 @@
         version = "1.24.0.0";
         src = "${ghcjsBoot}/boot/cabal/Cabal";
         doCheck = false;
+        hyperlinkSource = false;
         libraryHaskellDepends = [
           array base binary bytestring containers deepseq directory filepath
           pretty process time unix

pkgs/development/compilers/scala/2.11.nix

@@ -1,11 +1,11 @@
 { stdenv, fetchurl, makeWrapper, jre, gnugrep, coreutils }:
 
 stdenv.mkDerivation rec {
-  name = "scala-2.11.8";
+  name = "scala-2.11.9";
 
   src = fetchurl {
     url = "http://www.scala-lang.org/files/archive/${name}.tgz";
-    sha256 = "1khs7673wca7gnxz2rxphv6v5k94jkpcarlqznsys9cpknhqdz47";
+    sha256 = "02rpx0pzr98vla2mgkgf6s8blccnrji5bxw05z36m1iwqmpryx5r";
   };
 
   propagatedBuildInputs = [ jre ] ;

pkgs/development/go-modules/generic/default.nix

@@ -1,4 +1,4 @@
-{ go, govers, parallel, lib, fetchgit, fetchhg, rsync }:
+{ go, govers, parallel, lib, fetchgit, fetchhg, rsync, removeReferencesTo }:
 
 { name, buildInputs ? [], nativeBuildInputs ? [], passthru ? {}, preFixup ? ""
 
@@ -41,9 +41,7 @@ let
 
   removeReferences = [ ] ++ lib.optional (!allowGoReference) go;
 
-  removeExpr = refs: lib.flip lib.concatMapStrings refs (ref: ''
+  removeExpr = refs: ''remove-references-to ${lib.concatMapStrings (ref: " -t ${ref}") refs}'';
-    | sed "s,${ref},$(echo "${ref}" | sed "s,$NIX_STORE/[^-]*,$NIX_STORE/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee,"),g" \
-  '');
 
   dep2src = goDep:
     {
@@ -70,7 +68,7 @@ go.stdenv.mkDerivation (
   (builtins.removeAttrs args [ "goPackageAliases" "disabled" ]) // {
 
   inherit name;
-  nativeBuildInputs = [ go parallel ]
+  nativeBuildInputs = [ removeReferencesTo go parallel ]
     ++ (lib.optional (!dontRenameImports) govers) ++ nativeBuildInputs;
   buildInputs = [ go ] ++ buildInputs;
 
@@ -186,11 +184,7 @@ go.stdenv.mkDerivation (
   '';
 
   preFixup = preFixup + ''
-    while read file; do
+    find $bin/bin -type f -exec ${removeExpr removeReferences} '{}' +
-      cat $file ${removeExpr removeReferences} > $file.tmp
-      mv $file.tmp $file
-      chmod +x $file
-    done < <(find $bin/bin -type f 2>/dev/null)
   '';
 
   shellHook = ''

pkgs/development/haskell-modules/configuration-ghc-6.12.x.nix

@@ -41,7 +41,7 @@ self: super: {
   unix = null;
 
   # These packages are core libraries in GHC 7.10.x, but not here.
-  binary = self.binary_0_8_4_1;
+  binary = self.binary_0_8_5_1;
   deepseq = self.deepseq_1_3_0_1;
   haskeline = self.haskeline_0_7_3_1;
   hoopl = self.hoopl_3_10_2_0;

pkgs/development/haskell-modules/configuration-ghc-7.2.x.nix

@@ -42,7 +42,7 @@ self: super: {
   xhtml = self.xhtml_3000_2_1;
 
   # https://github.com/haskell/cabal/issues/2322
-  Cabal_1_22_4_0 = super.Cabal_1_22_4_0.override { binary = self.binary_0_8_4_1; process = self.process_1_2_3_0; };
+  Cabal_1_22_4_0 = super.Cabal_1_22_4_0.override { binary = self.binary_0_8_5_1; process = self.process_1_2_3_0; };
 
   # https://github.com/tibbe/hashable/issues/85
   hashable = dontCheck super.hashable;

pkgs/development/haskell-modules/configuration-ghc-7.4.x.nix

@@ -41,10 +41,10 @@ self: super: {
   xhtml = self.xhtml_3000_2_1;
 
   # https://github.com/haskell/cabal/issues/2322
-  Cabal_1_22_4_0 = super.Cabal_1_22_4_0.override { binary = dontCheck self.binary_0_8_4_1; };
+  Cabal_1_22_4_0 = super.Cabal_1_22_4_0.override { binary = dontCheck self.binary_0_8_5_1; };
 
   # Avoid inconsistent 'binary' versions from 'text' and 'Cabal'.
-  cabal-install = super.cabal-install.overrideScope (self: super: { binary = dontCheck self.binary_0_8_4_1; });
+  cabal-install = super.cabal-install.overrideScope (self: super: { binary = dontCheck self.binary_0_8_5_1; });
 
   # https://github.com/tibbe/hashable/issues/85
   hashable = dontCheck super.hashable;

pkgs/development/haskell-modules/configuration-ghc-7.6.x.nix

@@ -39,11 +39,8 @@ self: super: {
   transformers = self.transformers_0_4_3_0;
   xhtml = self.xhtml_3000_2_1;
 
-  # https://github.com/haskell/cabal/issues/2322
-  Cabal_1_22_4_0 = super.Cabal_1_22_4_0.override { binary = dontCheck self.binary_0_8_4_1; };
-
   # Avoid inconsistent 'binary' versions from 'text' and 'Cabal'.
-  cabal-install = super.cabal-install.overrideScope (self: super: { binary = dontCheck self.binary_0_8_4_1; });
+  cabal-install = super.cabal-install.overrideScope (self: super: { binary = dontCheck self.binary_0_8_5_1; });
 
   # https://github.com/tibbe/hashable/issues/85
   hashable = dontCheck super.hashable;
@@ -101,6 +98,12 @@ self: super: {
   lens = addBuildDepends super.lens (with self; [doctest generic-deriving nats simple-reflect]);
   distributive = addBuildDepend super.distributive self.semigroups;
   QuickCheck = addBuildDepend super.QuickCheck self.semigroups;
+  void = addBuildDepends super.void (with self; [hashable semigroups]);
+
+  # Need a newer version of Cabal to interpret their build instructions.
+  cmdargs = addSetupDepend super.cmdargs self.Cabal_1_24_2_0;
+  extra = addSetupDepend super.extra self.Cabal_1_24_2_0;
+  hlint = addSetupDepend super.hlint self.Cabal_1_24_2_0;
 
   # Haddock doesn't cope with the new markup.
   bifunctors = dontHaddock super.bifunctors;

pkgs/development/haskell-modules/configuration-hackage2nix.yaml

@@ -38,7 +38,7 @@ core-packages:
 
 default-package-overrides:
   - store < 0.4.1               # https://github.com/fpco/store/issues/104
-  # LTS Haskell 8.6
+  # LTS Haskell 8.8
   - abstract-deque ==0.3
   - abstract-par ==0.3.3
   - AC-Vector ==2.3.2
@@ -371,7 +371,7 @@ default-package-overrides:
   - cmark ==0.5.5.1
   - cmark-highlight ==0.2.0.0
   - cmark-lucid ==0.1.0.0
-  - cmdargs ==0.10.16
+  - cmdargs ==0.10.17
   - code-builder ==0.1.3
   - code-page ==0.1.3
   - codo-notation ==0.5.2
@@ -666,6 +666,7 @@ default-package-overrides:
   - format-numbers ==0.1.0.0
   - formatting ==6.2.4
   - fortran-src ==0.1.0.4
+  - foundation ==0.0.4
   - Frames ==0.1.9
   - free ==4.12.4
   - free-vl ==0.1.4
@@ -695,7 +696,7 @@ default-package-overrides:
   - getopt-generics ==0.13
   - ghc-events ==0.4.4.0
   - ghc-exactprint ==0.5.3.0
-  - ghc-heap-view ==0.5.7
+  - ghc-heap-view ==0.5.9
   - ghc-mod ==5.7.0.0
   - ghc-paths ==0.1.0.9
   - ghc-prof ==1.3.0.2
@@ -708,7 +709,7 @@ default-package-overrides:
   - ghcjs-base-stub ==0.1.0.2
   - ghcjs-codemirror ==0.0.0.1
   - ghcjs-hplay ==0.3.4.2
-  - ghcjs-perch ==0.3.3.1
+  - ghcjs-perch ==0.3.3.2
   - gi-atk ==2.0.11
   - gi-cairo ==1.0.11
   - gi-gdk ==3.0.11
@@ -897,10 +898,10 @@ default-package-overrides:
   - hashable ==1.2.6.0
   - hashable-time ==0.2
   - hashmap ==1.3.2
-  - hashtables ==1.2.1.0
+  - hashtables ==1.2.1.1
   - haskeline ==0.7.3.1
-  - haskell-gi ==0.20
+  - haskell-gi ==0.20.1
-  - haskell-gi-base ==0.20
+  - haskell-gi-base ==0.20.1
   - haskell-import-graph ==1.0.1
   - haskell-lexer ==1.0.1
   - haskell-names ==0.8.0
@@ -957,6 +958,7 @@ default-package-overrides:
   - hfsevents ==0.1.6
   - hid ==0.2.2
   - hidapi ==0.1.4
+  - hidden-char ==0.1.0.0
   - hierarchical-clustering ==0.4.6
   - highjson ==0.4.0.0
   - highjson-swagger ==0.4.0.0
@@ -1097,7 +1099,8 @@ default-package-overrides:
   - hyphenation ==0.6
   - ical ==0.0.1
   - iconv ==0.4.1.3
-  - identicon ==0.2.0
+  - identicon ==0.2.1
+  - idris ==1.0
   - ieee754 ==0.8.0
   - if ==0.1.0.0
   - IfElse ==0.85
@@ -1224,6 +1227,7 @@ default-package-overrides:
   - leveldb-haskell ==0.6.4
   - lexer-applicative ==2.1.0.1
   - lhs2tex ==1.19
+  - libffi ==0.1
   - libgit ==0.3.1
   - libinfluxdb ==0.0.4
   - libmpd ==0.9.0.6
@@ -1291,7 +1295,7 @@ default-package-overrides:
   - median-stream ==0.7.0.0
   - mega-sdist ==0.3.0.2
   - megaparsec ==5.2.0
-  - memory ==0.14.2
+  - memory ==0.14.3
   - MemoTrie ==0.6.7
   - mersenne-random ==1.0.0.1
   - mersenne-random-pure64 ==0.2.2.0
@@ -1327,7 +1331,7 @@ default-package-overrides:
   - monad-extras ==0.6.0
   - monad-http ==0.1.0.0
   - monad-journal ==0.7.2
-  - monad-logger ==0.3.21
+  - monad-logger ==0.3.22
   - monad-logger-json ==0.1.0.0
   - monad-logger-prefix ==0.1.6
   - monad-logger-syslog ==0.1.3.0
@@ -1371,7 +1375,7 @@ default-package-overrides:
   - multistate ==0.7.1.1
   - murmur-hash ==0.1.0.9
   - MusicBrainz ==0.2.4
-  - mustache ==2.1.2
+  - mustache ==2.1.3
   - mutable-containers ==0.3.3
   - mwc-probability ==1.3.0
   - mwc-random ==0.13.5.0
@@ -1567,6 +1571,7 @@ default-package-overrides:
   - prelude-safeenum ==0.1.1.2
   - preprocessor-tools ==1.0.1
   - presburger ==1.3.1
+  - present ==4.1.0
   - pretty-class ==1.0.1.1
   - pretty-hex ==1.0
   - pretty-show ==1.6.12
@@ -1587,7 +1592,7 @@ default-package-overrides:
   - prometheus-metrics-ghc ==0.1.0.1
   - prompt ==0.1.1.2
   - protobuf ==0.2.1.1
-  - protobuf-simple ==0.1.0.2
+  - protobuf-simple ==0.1.0.3
   - protocol-buffers ==2.4.0
   - protocol-buffers-descriptor ==2.4.0
   - protolude ==0.1.10
@@ -1725,7 +1730,7 @@ default-package-overrides:
   - scalpel ==0.5.0
   - scalpel-core ==0.5.0
   - scanner ==0.2
-  - scientific ==0.3.4.10
+  - scientific ==0.3.4.11
   - scotty ==0.11.0
   - scrape-changes ==0.1.0.5
   - scrypt ==0.5.0
@@ -1867,7 +1872,7 @@ default-package-overrides:
   - storable-record ==0.0.3.1
   - store-core ==0.4
   - Strafunski-StrategyLib ==5.0.0.10
-  - stratosphere ==0.4.1
+  - stratosphere ==0.4.2
   - streaming ==0.1.4.5
   - streaming-bytestring ==0.1.4.6
   - streaming-commons ==0.1.17
@@ -1935,11 +1940,11 @@ default-package-overrides:
   - tasty-program ==1.0.5
   - tasty-quickcheck ==0.8.4
   - tasty-rerun ==1.1.6
-  - tasty-silver ==3.1.9
+  - tasty-silver ==3.1.10
   - tasty-smallcheck ==0.8.1
   - tasty-stats ==0.2.0.2
   - tasty-tap ==0.0.4
-  - tasty-th ==0.1.4
+  - tasty-th ==0.1.5
   - Taxonomy ==1.0.2
   - TCache ==0.12.1
   - tce-conf ==1.3
@@ -2054,7 +2059,7 @@ default-package-overrides:
   - uglymemo ==0.1.0.1
   - unbound ==0.5.1
   - unbound-generics ==0.3.1
-  - unbounded-delays ==0.1.0.9
+  - unbounded-delays ==0.1.0.10
   - uncertain ==0.3.1.0
   - unexceptionalio ==0.3.0
   - unicode-show ==0.1.0.2
@@ -2138,7 +2143,7 @@ default-package-overrides:
   - wai-middleware-consul ==0.1.0.2
   - wai-middleware-content-type ==0.5.0.1
   - wai-middleware-crowd ==0.1.4.2
-  - wai-middleware-metrics ==0.2.3
+  - wai-middleware-metrics ==0.2.4
   - wai-middleware-prometheus ==0.1.0.1
   - wai-middleware-static ==0.8.1
   - wai-middleware-throttle ==0.2.1.0
@@ -2168,7 +2173,7 @@ default-package-overrides:
   - webdriver-angular ==0.1.11
   - webkitgtk3 ==0.14.2.1
   - webkitgtk3-javascriptcore ==0.14.2.1
-  - webpage ==0.0.4
+  - webpage ==0.0.5
   - webrtc-vad ==0.1.0.3
   - websockets ==0.10.0.0
   - websockets-snap ==0.10.2.0
@@ -2203,7 +2208,7 @@ default-package-overrides:
   - writer-cps-full ==0.1.0.0
   - writer-cps-lens ==0.1.0.1
   - writer-cps-morph ==0.1.0.2
-  - writer-cps-mtl ==0.1.1.2
+  - writer-cps-mtl ==0.1.1.3
   - writer-cps-transformers ==0.1.1.2
   - wuss ==1.1.3
   - X11 ==1.8
@@ -2281,7 +2286,7 @@ default-package-overrides:
   - yjtools ==0.9.18
   - zero ==0.1.4
   - zeromq4-haskell ==0.6.5
-  - zip ==0.1.9
+  - zip ==0.1.10
   - zip-archive ==0.3.0.5
   - zippers ==0.2.2
   - zlib ==0.6.1.2
@@ -2409,12 +2414,14 @@ dont-distribute-packages:
   shine-varying:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
 
   # these packages depend on software with an unfree license
+  accelerate-bignum:                            [ i686-linux, x86_64-linux, x86_64-darwin ]
   accelerate-cublas:                            [ i686-linux, x86_64-linux, x86_64-darwin ]
   accelerate-cuda:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
   accelerate-cufft:                             [ i686-linux, x86_64-linux, x86_64-darwin ]
   accelerate-examples:                          [ i686-linux, x86_64-linux, x86_64-darwin ]
   accelerate-fft:                               [ i686-linux, x86_64-linux, x86_64-darwin ]
   accelerate-fourier-benchmark:                 [ i686-linux, x86_64-linux, x86_64-darwin ]
+  accelerate-llvm-ptx:                          [ i686-linux, x86_64-linux, x86_64-darwin ]
   bindings-yices:                               [ i686-linux, x86_64-linux, x86_64-darwin ]
   ccelerate-cuda:                               [ i686-linux, x86_64-linux, x86_64-darwin ]
   cublas:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]

pkgs/development/haskell-modules/configuration-nix.nix

@@ -239,6 +239,8 @@ self: super: builtins.intersectAttrs super {
       }
     );
 
+  llvm-hs = super.llvm-hs.override { llvm-config = pkgs.llvm_4; };
+
   # Needs help finding LLVM.
   spaceprobe = addBuildTool super.spaceprobe self.llvmPackages.llvm;
 

pkgs/development/haskell-modules/default.nix

@@ -80,12 +80,12 @@ let
     in
       import ./hackage-packages.nix { inherit pkgs stdenv callPackage; } self // {
 
-        inherit mkDerivation callPackage;
+        inherit mkDerivation callPackage haskellSrc2nix hackage2nix;
 
-        callHackage = name: version: self.callPackage (hackage2nix name version);
+        callHackage = name: version: self.callPackage (self.hackage2nix name version);
 
         # Creates a Haskell package from a source package by calling cabal2nix on the source.
-        callCabal2nix = name: src: self.callPackage (haskellSrc2nix { inherit src name; });
+        callCabal2nix = name: src: self.callPackage (self.haskellSrc2nix { inherit src name; });
 
         ghcWithPackages = selectFrom: withPackages (selectFrom self);
 

pkgs/development/interpreters/ruby/default.nix

@@ -181,10 +181,10 @@ let
 
 in {
   ruby_2_0_0 = generic {
-    version = rubyVersion "2" "0" "0" "p647";
+    version = rubyVersion "2" "0" "0" "p648";
     sha256 = {
-      src = "1v2vbvydarcx5801gx9lc6gr6dfi0i7qbzwhsavjqbn79rdsz2n8";
+      src = "1y3n4c6xw2wki7pyjpq5zpbgxnw5i3jc8mcpj6rk7hs995mvv446";
-      git = "186pf4q9xymzn4zn1sjppl1skrl5f0159ixz5cz8g72dmmynq3g3";
+      git = "0ncjfq4hfqj9kcr8pbll6kypwnmcgs8w7l4466qqfyv7jj3yjd76";
     };
   };
 
@@ -196,27 +196,27 @@ in {
     };
   };
 
-  ruby_2_2_5 = generic {
+  ruby_2_2_7 = generic {
-    version = rubyVersion "2" "2" "5" "";
+    version = rubyVersion "2" "2" "7" "";
     sha256 = {
-      src = "1qrmlcyc0cy9hgafb1wny2h90rjyyh6d72nvr2h4xjm4jwbb7i1h";
+      src = "199xz5bvmp26c7vyzw47cpxkd8jk826kc8nlpavqzj5vqp388h9p";
-      git = "0k0av6ypyq08c9axm721f0xi2bcp1443l7ydbxv4v8x4vsxdkmq2";
+      git = "0i0nsm9ldjp39m9xq47v8w6wlg821ikczz530493cs150qkqa0a1";
     };
   };
 
-  ruby_2_3_3 = generic {
+  ruby_2_3_4 = generic {
-    version = rubyVersion "2" "3" "3" "";
+    version = rubyVersion "2" "3" "4" "";
     sha256 = {
-      src = "1dqmh42p6siv9aqzdjldsnhljj3f2h30m0v8cf25icjmqp40h514";
+      src = "1hy0zr4vwkqcjbykh2hp0d6ifkrhgskaxlzy6878sc9kr4bqzqcq";
-      git = "0cwjf0nrzaa5g81bw0qp65byyadhxvbnvprkshv3ckjl7yi46zf6";
+      git = "0jjhgdjv3aayxb0flxjiny7xfzh3ggrqcpvgjv2ydm25padfbqmp";
     };
   };
 
-  ruby_2_4_0 = generic {
+  ruby_2_4_1 = generic {
-    version = rubyVersion "2" "4" "0" "";
+    version = rubyVersion "2" "4" "1" "";
     sha256 = {
-      src = "0gcyn9328w2vma882l71c9v9ygmmsj2z8j1l44c4l2x92nyx0bqm";
+      src = "0l0201fqwzwygnrgxay469gbb2w865bnqckq00x3prdmbh6y2c53";
-      git = "1w9zyx8xmka8jdiha57snnbfls2r6dc9g03d8cjx0nxkmwf3r2l3";
+      git = "1gjn31ymypzzcwkrjx62hqw59fywz1x3cyvmi1f2yb9bwb3659ss";
     };
   };
 }

pkgs/development/interpreters/ruby/patchsets.nix

@@ -24,24 +24,19 @@ rec {
     "${patchSet}/patches/ruby/2.1.8/railsexpress/08-funny-falcon-method-cache.patch"
     "${patchSet}/patches/ruby/2.1.8/railsexpress/09-heap-dump-support.patch"
   ];
-  "2.2.5" = ops useRailsExpress [
+  "2.2.7" = ops useRailsExpress [
-    "${patchSet}/patches/ruby/2.2.5/railsexpress/01-zero-broken-tests.patch"
+    "${patchSet}/patches/ruby/2.2/head/railsexpress/01-zero-broken-tests.patch"
-    "${patchSet}/patches/ruby/2.2.5/railsexpress/02-improve-gc-stats.patch"
+    "${patchSet}/patches/ruby/2.2/head/railsexpress/02-improve-gc-stats.patch"
-    "${patchSet}/patches/ruby/2.2.5/railsexpress/03-display-more-detailed-stack-trace.patch"
+    "${patchSet}/patches/ruby/2.2/head/railsexpress/03-display-more-detailed-stack-trace.patch"
   ];
-  "2.3.1" = ops useRailsExpress [
+  "2.3.4" = ops useRailsExpress [
     "${patchSet}/patches/ruby/2.3/head/railsexpress/01-skip-broken-tests.patch"
     "${patchSet}/patches/ruby/2.3/head/railsexpress/02-improve-gc-stats.patch"
     "${patchSet}/patches/ruby/2.3/head/railsexpress/03-display-more-detailed-stack-trace.patch"
   ];
-  "2.3.3" = ops useRailsExpress [
+  "2.4.1" = ops useRailsExpress [
-    "${patchSet}/patches/ruby/2.3/head/railsexpress/01-skip-broken-tests.patch"
+    "${patchSet}/patches/ruby/2.4/head/railsexpress/01-skip-broken-tests.patch"
-    "${patchSet}/patches/ruby/2.3/head/railsexpress/02-improve-gc-stats.patch"
+    "${patchSet}/patches/ruby/2.4/head/railsexpress/02-improve-gc-stats.patch"
-    "${patchSet}/patches/ruby/2.3/head/railsexpress/03-display-more-detailed-stack-trace.patch"
+    "${patchSet}/patches/ruby/2.4/head/railsexpress/03-display-more-detailed-stack-trace.patch"
-  ];
-  "2.4.0" = ops useRailsExpress [
-    "${patchSet}/patches/ruby/2.4.0/railsexpress/01-skip-broken-tests.patch"
-    "${patchSet}/patches/ruby/2.4.0/railsexpress/02-improve-gc-stats.patch"
-    "${patchSet}/patches/ruby/2.4.0/railsexpress/03-display-more-detailed-stack-trace.patch"
   ];
 }

pkgs/development/interpreters/ruby/rvm-patchsets.nix

@@ -1,8 +1,8 @@
 { fetchFromGitHub }:
 
 fetchFromGitHub {
-  owner  = "manveru";
+  owner  = "skaes";
   repo   = "rvm-patchsets";
-  rev    = "46e04f230ce91a786f5e583389443efec0ecd594";
+  rev    = "15f5df0fba0e2fb489856b5bdb67a52fb9745f94";
-  sha256 = "0ayh8zj8knyz3344an942qdf33pi42jmksqk34frb346zi1ag693";
+  sha256 = "0vdgr7xp3gbmsyaz4q78qlbwmp006b1gkgj0kwi6h8d80dclbzny";
 }

pkgs/development/libraries/gpgme/default.nix

@@ -1,19 +1,11 @@
-{ stdenv, fetchurl, libgpgerror, gnupg, pkgconfig, glib, pth, libassuan
+{ stdenv, fetchurl, libgpgerror, gnupg, pkgconfig, glib, pth, libassuan }:
-, useGnupg1 ? false, gnupg1 ? null }:
 
-assert useGnupg1 -> gnupg1 != null;
-assert !useGnupg1 -> gnupg != null;
-
-let
-  gpgStorePath = if useGnupg1 then gnupg1 else gnupg;
-  gpgProgram = if useGnupg1 then "gpg" else "gpg2";
-in
 stdenv.mkDerivation rec {
-  name = "gpgme-1.8.0";
+  name = "gpgme-1.9.0";
 
   src = fetchurl {
     url = "mirror://gnupg/gpgme/${name}.tar.bz2";
-    sha256 = "0csx3qnycwm0n90ql6gs65if5xi4gqyzzy21fxs2xqicghjrfq2r";
+    sha256 = "1ssc0gs02r4fasabk7c6v6r865k2j02mpb5g1vkpbmzsigdzwa8v";
   };
 
   outputs = [ "out" "dev" "info" ];
@@ -24,20 +16,24 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig gnupg ];
 
   configureFlags = [
-    "--enable-fixed-path=${gpgStorePath}/bin"
+    "--enable-fixed-path=${gnupg}/bin"
   ];
 
+  # https://www.gnupg.org/documentation/manuals/gpgme/Largefile-Support-_0028LFS_0029.html
   NIX_CFLAGS_COMPILE =
     with stdenv; lib.optional (system == "i686-linux") "-D_FILE_OFFSET_BITS=64";
 
-  AM_CXXFLAGS =
-    with stdenv; lib.optional (isDarwin) "-D_POSIX_C_SOURCE=200809L";
-
   meta = with stdenv.lib; {
-    homepage = "http://www.gnupg.org/related_software/gpgme";
+    homepage = "https://gnupg.org/software/gpgme/index.html";
     description = "Library for making GnuPG easier to use";
-    license = licenses.gpl2;
+    longDescription = ''
+      GnuPG Made Easy (GPGME) is a library designed to make access to GnuPG
+      easier for applications. It provides a High-Level Crypto API for
+      encryption, decryption, signing, signature verification and key
+      management.
+    '';
+    license = with licenses; [ lgpl21Plus gpl3Plus ];
     platforms = platforms.unix;
-    maintainers = [ maintainers.fuuzetsu ];
+    maintainers = with maintainers; [ fuuzetsu primeos ];
   };
 }

pkgs/development/libraries/kde-frameworks/kwallet.nix

@@ -1,6 +1,6 @@
 { kdeFramework, lib, extra-cmake-modules, kconfig, kconfigwidgets
 , kcoreaddons , kdbusaddons, kdoctools, ki18n, kiconthemes
-, knotifications , kservice, kwidgetsaddons, kwindowsystem, libgcrypt
+, knotifications , kservice, kwidgetsaddons, kwindowsystem, libgcrypt, gpgme
 }:
 
 kdeFramework {
@@ -9,6 +9,6 @@ kdeFramework {
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   propagatedBuildInputs = [
     kconfig kconfigwidgets kcoreaddons kdbusaddons ki18n kiconthemes
-    knotifications kservice kwidgetsaddons kwindowsystem libgcrypt
+    knotifications kservice kwidgetsaddons kwindowsystem libgcrypt gpgme
   ];
 }

pkgs/development/libraries/libappindicator/default.nix

@@ -27,12 +27,17 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig autoconf ];
 
+  propagatedBuildInputs =
+    if gtkVersion == "2"
+    then [ gtk2 libdbusmenu-gtk2 ]
+    else [ gtk3 libdbusmenu-gtk3 ];
+
   buildInputs = [
     glib dbus_glib
     python pygobject2 pygtk gobjectIntrospection vala_0_23
   ] ++ (if gtkVersion == "2"
-    then [ gtk2 libindicator-gtk2 libdbusmenu-gtk2 ] ++ optionals monoSupport [ mono gtk-sharp-2_0 ]
+    then [ libindicator-gtk2 ] ++ optionals monoSupport [ mono gtk-sharp-2_0 ]
-    else [ gtk3 libindicator-gtk3 libdbusmenu-gtk3 ]);
+    else [ libindicator-gtk3 ]);
 
   postPatch = ''
     substituteInPlace configure.ac \

pkgs/development/libraries/libbap/default.nix

@@ -0,0 +1,29 @@
+{ stdenv, fetchFromGitHub, bap, ocaml, findlib, ctypes, autoreconfHook,
+  which }:
+
+stdenv.mkDerivation rec {
+  name = "libbap-${version}";
+  version = "master-2017-02-08";
+
+  src = fetchFromGitHub {
+    owner = "BinaryAnalysisPlatform";
+    repo = "bap-bindings";
+    rev = "b3da5bd5cdb3d646015ccdeb886b5ea8fd85a108";
+    sha256 = "0cwfyfpxbi9bm4kkpamyd7mgsm5b6j1rh217fqb5gi05wg45rkbb";
+  };
+
+  nativeBuildInputs = [ autoreconfHook which ];
+  buildInputs = [ ocaml bap findlib ctypes ];
+
+  preInstall = ''
+    mkdir -p $out/lib
+    mkdir -p $out/include
+  '';
+
+  meta = {
+    homepage = http://github.com/binaryanalysisplatform/bap-bindings;
+    description = "A C library for interacting with BAP";
+    maintainers = [ stdenv.lib.maintainers.maurer ];
+    platforms = stdenv.lib.platforms.unix;
+  };
+}

pkgs/development/libraries/libgsf/default.nix

@@ -19,6 +19,8 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = [ libxml2 glib gdk_pixbuf libiconv ]
     ++ libintlOrEmpty;
 
+  outputs = [ "out" "dev" ];
+
   doCheck = true;
   preCheck = "patchShebangs ./tests/";
 

pkgs/development/libraries/libproxy/default.nix

@@ -1,5 +1,5 @@
 { stdenv, lib, fetchFromGitHub, pkgconfig, cmake
-, dbus, networkmanager, spidermonkey_1_8_5 }:
+, dbus, networkmanager, webkitgtk214x, pcre, python2 }:
 
 stdenv.mkDerivation rec {
   name = "libproxy-${version}";
@@ -16,7 +16,13 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig cmake ];
 
-  buildInputs = [ dbus networkmanager spidermonkey_1_8_5 ];
+  buildInputs = [ dbus networkmanager webkitgtk214x pcre ];
+
+  cmakeFlags = [
+    "-DWITH_WEBKIT3=ON"
+    "-DWITH_MOZJS=OFF"
+    "-DPYTHON_SITEPKG_DIR=$(out)/${python2.sitePackages}"
+  ];
 
   meta = with stdenv.lib; {
     platforms = platforms.linux;