Merge master into x-updates

Conflicts (trivial):
	pkgs/games/spring/default.nix

lib/types.nix

@@ -132,7 +132,7 @@ rec {
             { inherit (def) file;
               value = listToAttrs (
                 imap (elemIdx: elem:
-                  { name = "unnamed-${toString defIdx}.${toString elemIdx}";
+                  { name = "${elem.name or "unnamed"}-${toString defIdx}.${toString elemIdx}";
                     value = elem;
                   }) def.value);
             }

nixos/doc/manual/configuration.xml

@@ -1025,7 +1025,6 @@ users.extraUsers.alice =
     home = "/home/alice";
     description = "Alice Foobar";
     extraGroups = [ "wheel" ];
-    isSystemUser = false;
     useDefaultShell = true;
     openssh.authorizedKeys.keys = [ "ssh-dss AAAAB3Nza... alice@foobar" ];
   };

nixos/modules/config/users-groups.nix

@@ -403,24 +403,21 @@ in
       let
         mkhomeUsers = filterAttrs (n: u: u.createHome) cfg.extraUsers;
         setpwUsers = filterAttrs (n: u: u.createUser) cfg.extraUsers;
+        pwFile = u: if !(isNull u.hashedPassword)
+          then pkgs.writeTextFile { name = "password-file"; text = u.hashedPassword; }
+          else if !(isNull u.password)
+          then pkgs.runCommand "password-file" { pw = u.password; } ''
+            echo -n "$pw" | ${pkgs.mkpasswd}/bin/mkpasswd -s > $out
+          '' else u.passwordFile;
         setpw = n: u: ''
           setpw=yes
           ${optionalString cfg.mutableUsers ''
             test "$(getent shadow '${u.name}' | cut -d: -f2)" != "x" && setpw=no
           ''}
           if [ "$setpw" == "yes" ]; then
-            ${if !(isNull u.hashedPassword)
+            ${if !(isNull (pwFile u))
               then ''
-                echo "${u.name}:${u.hashedPassword}" | \
+                echo -n "${u.name}:" | cat - "${pwFile u}" | \
-                  ${pkgs.shadow}/sbin/chpasswd -e''
-              else if u.password == ""
-              then "passwd -d '${u.name}' &>/dev/null"
-              else if !(isNull u.password)
-              then ''
-                echo "${u.name}:${u.password}" | ${pkgs.shadow}/sbin/chpasswd''
-              else if !(isNull u.passwordFile)
-              then ''
-                echo -n "${u.name}:" | cat - "${u.passwordFile}" | \
                   ${pkgs.shadow}/sbin/chpasswd -e
               ''
               else "passwd -l '${u.name}' &>/dev/null"

nixos/modules/hardware/opengl.nix

@@ -2,19 +2,19 @@
 let
   inherit (pkgs.lib) mkOption types mkIf optional optionals elem optionalString optionalAttrs;
 
-  cfg = config.services.mesa;
+  cfg = config.hardware.opengl;
 
   kernelPackages = config.boot.kernelPackages;
 in {
   options = {
-    services.mesa.enable = mkOption {
+    hardware.opengl.enable = mkOption {
-      description = "Whether this configuration requires mesa.";
+      description = "Whether this configuration requires opengl.";
       type = types.bool;
       default = false;
       internal = true;
     };
 
-    services.mesa.driSupport = mkOption {
+    hardware.opengl.driSupport = mkOption {
       type = types.bool;
       default = true;
       description = ''
@@ -23,18 +23,18 @@ in {
       '';
     };
 
-    services.mesa.driSupport32Bit = mkOption {
+    hardware.opengl.driSupport32Bit = mkOption {
       type = types.bool;
       default = false;
       description = ''
         On 64-bit systems, whether to support Direct Rendering for
         32-bit applications (such as Wine).  This is currently only
         supported for the <literal>nvidia</literal> driver and for
-        <literal>mesa</literal>.
+        <literal>Mesa</literal>.
       '';
     };
 
-    services.mesa.s3tcSupport = mkOption {
+    hardware.opengl.s3tcSupport = mkOption {
       type = types.bool;
       default = false;
       description = ''
@@ -47,15 +47,15 @@ in {
     };
 
 
-    services.mesa.videoDrivers = mkOption {
+    hardware.opengl.videoDrivers = mkOption {
       type = types.listOf types.str;
       # !!! We'd like "nv" here, but it segfaults the X server.
       default = [ "ati" "cirrus" "intel" "vesa" "vmware" ];
       example = [ "vesa" ];
       description = ''
-        The names of the video drivers that the mesa should
+        The names of the opengl video drivers the configuration
-        support.  Mesa will try all of the drivers listed
+        supports. They will be tried in order until one that
-        here until it finds one that supports your video card.
+        supports your card is found.
       '';
     };
   };

nixos/modules/hardware/video/bumblebee.nix

@@ -0,0 +1,41 @@
+{ config, pkgs, ... }:
+
+let kernel = config.boot.kernelPackages; in
+with pkgs.lib;
+
+{
+
+  options = {
+    hardware.bumblebee.enable = mkOption {
+      default = false;
+      type = types.bool;
+      description = ''
+        Enable the bumblebee daemon to manage Optimus hybrid video cards.
+        This should power off secondary GPU until its use is requested
+        by running an application with optirun.
+
+        Only nvidia driver is supported so far.
+      '';
+    };
+  };
+
+  config = mkIf config.hardware.bumblebee.enable {
+    boot.blacklistedKernelModules = [ "nouveau" "nvidia" ];
+    boot.kernelModules = [ "bbswitch" ];
+    boot.extraModulePackages = [ kernel.bbswitch kernel.nvidia_x11 ];
+
+    environment.systemPackages = [ pkgs.bumblebee ];
+
+    systemd.services.bumblebeed = {
+      description = "Bumblebee Hybrid Graphics Switcher";
+      wantedBy = [ "display-manager.service" ];
+      script = "bumblebeed --use-syslog";
+      path = [ kernel.bbswitch pkgs.bumblebee ];
+      serviceConfig = {
+        Restart = "always";
+        RestartSec = 60;
+        CPUSchedulingPolicy = "idle";
+      };
+    };
+  };
+}

nixos/modules/installer/cd-dvd/installation-cd-base.nix

@@ -36,7 +36,7 @@ with pkgs.lib;
   isoImage.makeEfiBootable = true;
 
   # Add Memtest86+ to the CD.
-  boot.loader.grub.memtest86 = true;
+  boot.loader.grub.memtest86.enable = true;
 
   # Get a console as soon as the initrd loads fbcon on EFI boot
   boot.initrd.kernelModules = [ "fbcon" ];

nixos/modules/module-list.nix

@@ -29,7 +29,9 @@
   ./hardware/network/intel-3945abg.nix
   ./hardware/network/ralink.nix
   ./hardware/network/rtl8192c.nix
+  ./hardware/opengl.nix
   ./hardware/pcmcia.nix
+  ./hardware/video/bumblebee.nix
   ./installer/tools/nixos-checkout.nix
   ./installer/tools/tools.nix
   ./misc/assertions.nix
@@ -235,7 +237,6 @@
   ./services/x11/hardware/multitouch.nix
   ./services/x11/hardware/synaptics.nix
   ./services/x11/hardware/wacom.nix
-  ./services/x11/mesa.nix
   ./services/x11/window-managers/awesome.nix
   #./services/x11/window-managers/compiz.nix
   ./services/x11/window-managers/default.nix

nixos/modules/profiles/demo.nix

@@ -11,6 +11,6 @@
       createHome = true;
       useDefaultShell = true;
       password = "demo";
-      isSystemUser = false;
+      uid = 1000;
     };
 }

nixos/modules/rename.nix

@@ -119,6 +119,10 @@ in zipModules ([]
 ++ obsolete [ "services" "xserver" "driSupport32Bit" ] [ "services" "mesa" "driSupport32Bit" ]
 ++ obsolete [ "services" "xserver" "s3tcSupport" ] [ "services" "mesa" "s3tcSupport" ]
 ++ obsolete [ "services" "xserver" "videoDrivers" ] [ "services" "mesa" "videoDrivers" ]
+++ obsolete [ "services" "mesa" "driSupport" ] [ "hardware" "opengl" "driSupport" ]
+++ obsolete [ "services" "mesa" "driSupport32Bit" ] [ "hardware" "opengl" "driSupport32Bit" ]
+++ obsolete [ "services" "mesa" "s3tcSupport" ] [ "hardware" "opengl" "s3tcSupport" ]
+++ obsolete [ "services" "mesa" "videoDrivers" ] [ "hardware" "opengl" "videoDrivers" ]
 
 # Options that are obsolete and have no replacement.
 ++ obsolete' [ "boot" "loader" "grub" "bootDevice" ]

nixos/modules/services/networking/networkmanager.nix

@@ -31,7 +31,7 @@ let
 
     [modem-manager]
     Identity=unix-group:networkmanager
-    Action=org.freedesktop.ModemManager.*
+    Action=org.freedesktop.ModemManager*
     ResultAny=yes
     ResultInactive=no
     ResultActive=yes
@@ -42,7 +42,7 @@ let
         subject.isInGroup("networkmanager")
         && subject.active
         && (action.id.indexOf("org.freedesktop.NetworkManager.") == 0
-            || action.id.indexOf("org.freedesktop.ModemManager.")  == 0
+            || action.id.indexOf("org.freedesktop.ModemManager")  == 0
         ))
           { return polkit.Result.YES; }
     });
@@ -161,6 +161,7 @@ in {
         networkmanager_vpnc
         networkmanager_openconnect
         networkmanager_pptp
+        modemmanager
         ];
 
     users.extraGroups = singleton {
@@ -177,7 +178,7 @@ in {
       description = "NetworkManager initialisation";
       wantedBy = [ "network.target" ];
       partOf = [ "NetworkManager.service" ];
-      wants = [ "NetworkManager.service" ];
+      wants = [ "ModemManager.service" ];
       before = [ "NetworkManager.service" ];
       script = ''
         mkdir -m 700 -p /etc/NetworkManager/system-connections
@@ -206,6 +207,7 @@ in {
         networkmanager_vpnc
         networkmanager_openconnect
         networkmanager_pptp
+        modemmanager
         ];
 
     services.udev.packages = cfg.packages;

nixos/modules/services/ttys/kmscon.nix

@@ -73,6 +73,6 @@ in {
       hwaccel
     '';
 
-    services.mesa.enable = mkIf cfg.hwRender true;
+    hardware.opengl.enable = mkIf cfg.hwRender true;
   };
 }

nixos/modules/services/web-servers/apache-httpd/mediawiki.nix

@@ -93,6 +93,10 @@ let
         ensureDir $out
         cp -r * $out
         cp ${mediawikiConfig} $out/LocalSettings.php
+        sed -i 's|/bin/bash|${pkgs.stdenv.shell}|' \
+          $out/maintenance/fuzz-tester.php \
+          $out/bin/ulimit.sh \
+          $out/includes/GlobalFunctions.php
       '';
   };
 
@@ -290,6 +294,7 @@ in
             echo COMMIT
           ) | ${pkgs.postgresql}/bin/psql -U "${config.dbUser}" "${config.dbName}"
       fi
+      ${php}/bin/php ${mediawikiRoot}/maintenance/update.php
     '');
 
   robotsEntries = optionalString (config.articleUrlPrefix != "")

nixos/modules/services/x11/desktop-managers/gnome3.nix

@@ -52,6 +52,7 @@ in {
         gnome3.gnome_terminal
         gnome3.gnome_icon_theme
         gnome3.gnome_themes_standard
+        gnome3.gnome_control_center
       ];
   };
 

nixos/modules/services/x11/xserver.nix

@@ -22,7 +22,7 @@ let
     virtualbox   = { modules = [ kernelPackages.virtualboxGuestAdditions ]; driverName = "vboxvideo"; };
   };
 
-  driverNames = config.services.mesa.videoDrivers;
+  driverNames = config.hardware.opengl.videoDrivers;
 
   drivers = flip map driverNames
     (name: { inherit name; driverName = name; } //
@@ -181,7 +181,7 @@ in
         description = ''
           The name of the video driver for your graphics card.  This
           option is obsolete; please set the
-          <option>services.mesa.videoDrivers</option> instead.
+          <option>hardware.opengl.videoDrivers</option> instead.
         '';
       };
 
@@ -381,8 +381,8 @@ in
   ###### implementation
 
   config = mkIf cfg.enable {
-    services.mesa.enable = true;
+    hardware.opengl.enable = true;
-    services.mesa.videoDrivers = mkIf (cfg.videoDriver != null) [ cfg.videoDriver ];
+    hardware.opengl.videoDrivers = mkIf (cfg.videoDriver != null) [ cfg.videoDriver ];
 
     assertions =
       [ { assertion = !(cfg.startOpenSSHAgent && cfg.startGnuPGAgent);

nixos/modules/system/boot/loader/grub/memtest.nix

@@ -6,28 +6,83 @@ with pkgs.lib;
 
 let
   memtest86 = pkgs.memtest86plus;
+  cfg = config.boot.loader.grub.memtest86;
+  params = concatStringsSep " " cfg.params;
 in
 
 {
   options = {
 
-    boot.loader.grub.memtest86 = mkOption {
+    boot.loader.grub.memtest86 = {
-      default = false;
+
-      type = types.bool;
+      enable = mkOption {
-      description = ''
+        default = false;
-        Make Memtest86+, a memory testing program, available from the
+        type = types.bool;
-        GRUB boot menu.
+        description = ''
-      '';
+          Make Memtest86+, a memory testing program, available from the
+          GRUB boot menu.
+        '';
+      };
+
+      params = mkOption {
+        default = [];
+        example = [ "console=ttyS0,115200" ];
+        type = types.listOf types.str;
+        description = ''
+          Parameters added to the Memtest86+ command line. As of memtest86+ 5.01
+          the following list of (apparently undocumented) parameters are
+          accepted:
+
+          <itemizedlist>
+
+          <listitem>
+            <para><literal>console=...</literal>, set up a serial console.
+            Examples:
+            <literal>console=ttyS0</literal>,
+            <literal>console=ttyS0,9600</literal> or
+            <literal>console=ttyS0,115200n8</literal>.</para>
+          </listitem>
+
+          <listitem>
+            <para><literal>btrace</literal>, enable boot trace.</para>
+          </listitem>
+
+          <listitem>
+            <para><literal>maxcpus=N</literal>, limit number of CPUs.</para>
+          </listitem>
+
+          <listitem>
+            <para><literal>onepass</literal>, run one pass and exit if there
+            are no errors.</para>
+          </listitem>
+
+          <listitem>
+            <para><literal>tstlist=...</literal>, list of tests to run.
+            Example: <literal>0,1,2</literal>.</para>
+          </listitem>
+
+          <listitem>
+            <para><literal>cpumask=...</literal>, set a CPU mask, to select CPUs
+            to use for testing.</para>
+          </listitem>
+
+          </itemizedlist>
+
+          This list of command line options was obtained by reading the
+          Memtest86+ source code.
+        '';
+      };
+
     };
   };
 
-  config = mkIf config.boot.loader.grub.memtest86 {
+  config = mkIf cfg.enable {
 
     boot.loader.grub.extraEntries =
       if config.boot.loader.grub.version == 2 then
         ''
           menuentry "Memtest86+" {
-            linux16 @bootRoot@/memtest.bin
+            linux16 @bootRoot@/memtest.bin ${params}
           }
         ''
       else

nixos/modules/system/boot/luksroot.nix

@@ -39,153 +39,123 @@ let
     ${optionalString (luks.yubikeySupport && (yubikey != null)) ''
 
     rbtohex() {
-        od -An -vtx1 | tr -d ' \n'
+        ( od -An -vtx1 | tr -d ' \n' )
     }
 
     hextorb() {
-        tr '[:lower:]' '[:upper:]' | sed -e 's|\([0-9A-F]\{2\}\)|\\\\\\x\1|gI' | xargs printf
+        ( tr '[:lower:]' '[:upper:]' | sed -e 's/\([0-9A-F]\{2\}\)/\\\\\\x\1/gI' | xargs printf )
-    }
-
-    take() {
-        local c="$1"
-        shift
-        head -c $c "$@"
-    }
-
-    drop() {
-        local c="$1"
-        shift
-        if [ -e "$1" ]; then
-            cat "$1" | ( dd of=/dev/null bs="$c" count=1 2>/dev/null ; dd 2>/dev/null )
-        else
-            ( dd of=/dev/null bs="$c" count=1 2>/dev/null ; dd 2>/dev/null )
-        fi
     }
 
     open_yubikey() {
 
+        # Make all of these local to this function
+        # to prevent their values being leaked
+        local salt
+        local iterations
+        local k_user
+        local challenge
+        local response
+        local k_luks
+        local opened
+        local new_salt
+        local new_iterations
+        local new_challenge
+        local new_response
+        local new_k_luks
+
         mkdir -p ${yubikey.storage.mountPoint}
         mount -t ${yubikey.storage.fsType} ${toString yubikey.storage.device} ${yubikey.storage.mountPoint}
 
-        local uuid_r
+        salt="$(cat ${yubikey.storage.mountPoint}${yubikey.storage.path} | sed -n 1p | tr -d '\n')"
-        local k_user
+        iterations="$(cat ${yubikey.storage.mountPoint}${yubikey.storage.path} | sed -n 2p | tr -d '\n')"
-        local challenge
+        challenge="$(echo -n $salt | openssl-wrap dgst -binary -sha512 | rbtohex)"
-        local k_blob
+        response="$(ykchalresp -${toString yubikey.slot} -x $challenge 2>/dev/null)"
-        local aes_blob_decrypted
-        local checksum_correct
-        local checksum
-        local uuid_luks
-        local user_record
-
-        uuid_luks="$(cryptsetup luksUUID ${device} | take 36 | tr -d '-')"
-
-        ${optionalString (!yubikey.multiUser) ''
-        user_record="$(cat ${yubikey.storage.mountPoint}${yubikey.storage.path})"
-        uuid_r="$(echo -n $user_record | take 32)"
-        ''}
 
         for try in $(seq 3); do
 
-            ${optionalString yubikey.multiUser ''
-            local user_id
-            echo -n "Enter user id: "
-            read -s user_id
-            echo
-            ''}
-
             ${optionalString yubikey.twoFactor ''
             echo -n "Enter two-factor passphrase: "
             read -s k_user
             echo
             ''}
 
-            ${optionalString yubikey.multiUser ''
+            if [ ! -z "$k_user" ]; then
-            local user_id_hash
+                k_luks="$(echo -n $k_user | pbkdf2-sha512 ${toString yubikey.keyLength} $iterations $response | rbtohex)"
-            user_id_hash="$(echo -n $user_id | openssl-wrap dgst -binary -sha512 | rbtohex)"
-
-            user_record="$(sed -n -e /^$user_id_hash[^$]*$/p ${yubikey.storage.mountPoint}${yubikey.storage.path} | tr -d '\n')"
-
-            if [ ! -z "$user_record" ]; then
-                user_record="$(echo -n $user_record | drop 128)"
-                uuid_r="$(echo -n $user_record | take 32)"
-            ''}
-
-                challenge="$(echo -n $k_user$uuid_r$uuid_luks | openssl-wrap dgst -binary -sha1 | rbtohex)"
-
-                k_blob="$(ykchalresp -${toString yubikey.slot} -x $challenge 2>/dev/null)"
-
-                aes_blob_decrypted="$(echo -n $user_record | drop 32 | hextorb | openssl-wrap enc -d -aes-256-ctr -K $k_blob -iv $uuid_r | rbtohex)"
-
-                checksum="$(echo -n $aes_blob_decrypted | drop 168)"
-                if [ "$(echo -n $aes_blob_decrypted | hextorb | take 84 | openssl-wrap dgst -binary -sha512 | rbtohex)" == "$checksum" ]; then
-                    checksum_correct=1
-                    break
-                else
-                    checksum_correct=0
-                    echo "Authentication failed!"
-                fi
-
-            ${optionalString yubikey.multiUser ''
             else
-                checksum_correct=0
+                k_luks="$(echo | pbkdf2-sha512 ${toString yubikey.keyLength} $iterations $response | rbtohex)"
+            fi
+
+            echo -n "$k_luks" | hextorb | cryptsetup luksOpen ${device} ${name} ${optionalString allowDiscards "--allow-discards"} --key-file=-
+
+            if [ $? == "0" ]; then
+                opened=true
+                break
+            else
+                opened=false
                 echo "Authentication failed!"
             fi
-            ''}
         done
 
-        if [ "$checksum_correct" != "1" ]; then
+        if [ "$opened" == false ]; then
             umount ${yubikey.storage.mountPoint}
             echo "Maximum authentication errors reached"
             exit 1
         fi
 
-        local k_yubi
+        echo -n "Gathering entropy for new salt (please enter random keys to generate entropy if this blocks for long)..."
-        k_yubi="$(echo -n $aes_blob_decrypted | take 40)"
+        for i in $(seq ${toString yubikey.saltLength}); do
+            byte="$(dd if=/dev/random bs=1 count=1 2>/dev/null | rbtohex)";
+            new_salt="$new_salt$byte";
+            echo -n .
+        done;
+        echo "ok"
 
-        local k_luks
+        new_iterations="$iterations"
-        k_luks="$(echo -n $aes_blob_decrypted | drop 40 | take 128)"
+        ${optionalString (yubikey.iterationStep > 0) ''
+        new_iterations="$(($new_iterations + ${toString yubikey.iterationStep}))"
+        ''}
 
-        echo -n "$k_luks" | hextorb | cryptsetup luksOpen ${device} ${name} ${optionalString allowDiscards "--allow-discards"} --key-file=-
+        new_challenge="$(echo -n $new_salt | openssl-wrap dgst -binary -sha512 | rbtohex)"
 
-        update_failed=false
+        new_response="$(ykchalresp -${toString yubikey.slot} -x $new_challenge 2>/dev/null)"
 
-        local new_uuid_r
+        if [ ! -z "$k_user" ]; then
-        new_uuid_r="$(uuidgen)"
+            new_k_luks="$(echo -n $k_user | pbkdf2-sha512 ${toString yubikey.keyLength} $new_iterations $new_response | rbtohex)"
-        if [ $? != "0" ]; then
-            for try in $(seq 10); do
-                sleep 1
-                new_uuid_r="$(uuidgen)"
-                if [ $? == "0" ]; then break; fi
-                if [ $try -eq 10 ]; then update_failed=true; fi
-            done
-        fi
-
-        if [ "$update_failed" == false ]; then
-            new_uuid_r="$(echo -n $new_uuid_r | take 36 | tr -d '-')"
-
-            local new_challenge
-            new_challenge="$(echo -n $k_user$new_uuid_r$uuid_luks | openssl-wrap dgst -binary -sha1 | rbtohex)"
-
-            local new_k_blob
-            new_k_blob="$(echo -n $new_challenge | hextorb | openssl-wrap dgst -binary -sha1 -mac HMAC -macopt hexkey:$k_yubi | rbtohex)"
-
-            local new_aes_blob
-            new_aes_blob=$(echo -n "$k_yubi$k_luks$checksum" | hextorb | openssl-wrap enc -e -aes-256-ctr -K "$new_k_blob" -iv "$new_uuid_r" | rbtohex)
-
-            ${optionalString yubikey.multiUser ''
-            sed -i -e "s|^$user_id_hash$user_record|$user_id_hash$new_uuid_r$new_aes_blob|1"
-            ''}
-
-            ${optionalString (!yubikey.multiUser) ''
-            echo -n "$new_uuid_r$new_aes_blob" > ${yubikey.storage.mountPoint}${yubikey.storage.path}
-            ''}
         else
-            echo "Warning: Could not obtain new UUID, current challenge persists!"
+            new_k_luks="$(echo | pbkdf2-sha512 ${toString yubikey.keyLength} $new_iterations $new_response | rbtohex)"
         fi
 
+        mkdir -p ${yubikey.ramfsMountPoint}
+        # A ramfs is used here to ensure that the file used to update
+        # the key slot with cryptsetup will never get swapped out.
+        # Warning: Do NOT replace with tmpfs!
+        mount -t ramfs none ${yubikey.ramfsMountPoint}
+
+        echo -n "$new_k_luks" | hextorb > ${yubikey.ramfsMountPoint}/new_key
+        echo -n "$k_luks" | hextorb | cryptsetup luksChangeKey ${device} --key-file=- ${yubikey.ramfsMountPoint}/new_key
+
+        if [ $? == "0" ]; then
+            echo -ne "$new_salt\n$new_iterations" > ${yubikey.storage.mountPoint}${yubikey.storage.path}
+        else
+            echo "Warning: Could not update LUKS key, current challenge persists!"
+        fi
+
+        rm -f ${yubikey.ramfsMountPoint}/new_key
+        umount ${yubikey.ramfsMountPoint}
+        rm -rf ${yubikey.ramfsMountPoint}
+
         umount ${yubikey.storage.mountPoint}
     }
 
+    ${optionalString (yubikey.gracePeriod > 0) ''
+    echo -n "Waiting ${toString yubikey.gracePeriod} seconds as grace..."
+    for i in $(seq ${toString yubikey.gracePeriod}); do
+        sleep 1
+        echo -n .
+    done
+    echo "ok"
+    ''}
+
     yubikey_missing=true
     ykinfo -v 1>/dev/null 2>&1
     if [ $? != "0" ]; then
@@ -336,21 +306,45 @@ in
               description = "Whether to use a passphrase and a Yubikey (true), or only a Yubikey (false)";
             };
 
-            multiUser = mkOption {
-              default = false;
-              type = types.bool;
-              description = "Whether to allow multiple users to authenticate with a Yubikey";
-            };
-
             slot = mkOption {
               default = 2;
               type = types.int;
               description = "Which slot on the Yubikey to challenge";
             };
 
+            saltLength = mkOption {
+              default = 16;
+              type = types.int;
+              description = "Length of the new salt in byte (64 is the effective maximum)";
+            };
+
+            keyLength = mkOption {
+              default = 64;
+              type = types.int;
+              description = "Length of the LUKS slot key derived with PBKDF2 in byte";
+            };
+
+            iterationStep = mkOption {
+              default = 0;
+              type = types.int;
+              description = "How much the iteration count for PBKDF2 is increased at each successful authentication";
+            };
+
+            gracePeriod = mkOption {
+              default = 2;
+              type = types.int;
+              description = "Time in seconds to wait before attempting to find the Yubikey";
+            };
+
+            ramfsMountPoint = mkOption {
+              default = "/crypt-ramfs";
+              type = types.string;
+              description = "Path where the ramfs used to update the LUKS key will be mounted in stage-1";
+            };
+
             storage = mkOption {
               type = types.optionSet;
-              description = "Options related to the authentication record";
+              description = "Options related to the storing the salt";
 
               options = {
                 device = mkOption {
@@ -358,7 +352,7 @@ in
                   type = types.path;
                   description = ''
                     An unencrypted device that will temporarily be mounted in stage-1.
-                    Must contain the authentication record for this LUKS device.
+                    Must contain the current salt to create the challenge for this LUKS device.
                   '';
                 };
 
@@ -378,7 +372,7 @@ in
                   default = "/crypt-storage/default";
                   type = types.string;
                   description = ''
-                    Absolute path of the authentication record on the unencrypted device with
+                    Absolute path of the salt on the unencrypted device with
                     that device's root directory as "/".
                   '';
                 };
@@ -420,11 +414,13 @@ in
       cp -pdv ${pkgs.popt}/lib/libpopt*.so.* $out/lib
 
       ${optionalString luks.yubikeySupport ''
-      cp -pdv ${pkgs.utillinux}/bin/uuidgen $out/bin
       cp -pdv ${pkgs.ykpers}/bin/ykchalresp $out/bin
       cp -pdv ${pkgs.ykpers}/bin/ykinfo $out/bin
       cp -pdv ${pkgs.openssl}/bin/openssl $out/bin
 
+      cc -O3 -I${pkgs.openssl}/include -L${pkgs.openssl}/lib ${./pbkdf2-sha512.c} -o $out/bin/pbkdf2-sha512 -lcrypto
+      strip -s $out/bin/pbkdf2-sha512
+
       cp -pdv ${pkgs.libusb1}/lib/libusb*.so.* $out/lib
       cp -pdv ${pkgs.ykpers}/lib/libykpers*.so.* $out/lib
       cp -pdv ${pkgs.libyubikey}/lib/libyubikey*.so.* $out/lib
@@ -444,7 +440,6 @@ EOF
     boot.initrd.extraUtilsCommandsTest = ''
       $out/bin/cryptsetup --version
       ${optionalString luks.yubikeySupport ''
-        $out/bin/uuidgen --version
         $out/bin/ykchalresp -V
         $out/bin/ykinfo -V
         cat > $out/bin/openssl-wrap <<EOF

nixos/modules/system/boot/pbkdf2-sha512.c

@@ -0,0 +1,38 @@
+#include <stdint.h>
+#include <string.h>
+#include <stdio.h>
+#include <openssl/evp.h>
+
+void hextorb(uint8_t* hex, uint8_t* rb)
+{
+	while(sscanf(hex, "%2x", rb) == 1)
+	{
+		hex += 2;
+		rb += 1;
+	}
+	*rb = '\0';
+}
+
+int main(int argc, char** argv)
+{
+	uint8_t k_user[2048];
+	uint8_t salt[2048];
+	uint8_t key[4096];
+
+	uint32_t key_length = atoi(argv[1]);
+	uint32_t iteration_count = atoi(argv[2]);
+
+	hextorb(argv[3], salt);
+	uint32_t salt_length = strlen(argv[3]) / 2;
+
+	fgets(k_user, 2048, stdin);
+	uint32_t k_user_length = strlen(k_user);
+	if(k_user[k_user_length - 1] == '\n') {
+			k_user[k_user_length - 1] = '\0';
+	}
+
+	PKCS5_PBKDF2_HMAC(k_user, k_user_length, salt, salt_length, iteration_count, EVP_sha512(), key_length, key);
+	fwrite(key, 1, key_length, stdout);
+
+	return 0;
+}

nixos/modules/virtualisation/qemu-vm.nix

@@ -387,7 +387,7 @@ in
     # When building a regular system configuration, override whatever
     # video driver the host uses.
     services.xserver.videoDriver = mkVMOverride null;
-    services.mesa.videoDrivers = mkVMOverride [ "vesa" ];
+    hardware.opengl.videoDrivers = mkVMOverride [ "vesa" ];
     services.xserver.defaultDepth = mkVMOverride 0;
     services.xserver.resolutions = mkVMOverride [ { x = 1024; y = 768; } ];
     services.xserver.monitorSection =

nixos/modules/virtualisation/virtualbox-guest.nix

@@ -52,7 +52,7 @@ optionalAttrs (pkgs.stdenv.isi686 || pkgs.stdenv.isx86_64) # ugly...
         serviceConfig.ExecStart = "@${kernel.virtualboxGuestAdditions}/sbin/VBoxService VBoxService --foreground";
       };
 
-    services.mesa.videoDrivers = mkOverride 50 [ "virtualbox" ];
+    hardware.opengl.videoDrivers = mkOverride 50 [ "virtualbox" ];
 
     services.xserver.config =
       ''

nixos/release-combined.nix

@@ -61,6 +61,7 @@ in rec {
         (all nixos.tests.printing)
         (all nixos.tests.proxy)
         (all nixos.tests.xfce)
+        (all nixos.tests.gnome3)
 
         nixpkgs.tarball
         (all nixpkgs.emacs)

nixos/tests/common/user-account.nix

@@ -7,5 +7,6 @@
       createHome = true;
       useDefaultShell = true;
       password = "foobar";
+      uid = 1000;
     };
 }

nixos/tests/default.nix

@@ -12,6 +12,7 @@ with import ../lib/testing.nix { inherit system minimal; };
   firewall = makeTest (import ./firewall.nix);
   installer = makeTests (import ./installer.nix);
   efi-installer = makeTests (import ./efi-installer.nix);
+  gnome3 = makeTest (import ./gnome3.nix);
   ipv6 = makeTest (import ./ipv6.nix);
   kde4 = makeTest (import ./kde4.nix);
   #kexec = makeTest (import ./kexec.nix);

nixos/tests/gnome3.nix

@@ -0,0 +1,31 @@
+{ pkgs, ... }:
+
+{
+
+  machine =
+    { config, pkgs, ... }:
+
+    { imports = [ ./common/user-account.nix ];
+
+      services.xserver.enable = true;
+
+      services.xserver.displayManager.auto.enable = true;
+      services.xserver.displayManager.auto.user = "alice";
+      services.xserver.desktopManager.gnome3.enable = true;
+    };
+
+  testScript =
+    ''
+      $machine->waitForX;
+      $machine->sleep(15);
+
+      # Check that logging in has given the user ownership of devices.
+      $machine->succeed("getfacl /dev/snd/timer | grep -q alice");
+
+      $machine->succeed("su - alice -c 'DISPLAY=:0.0 gnome-terminal &'");
+      $machine->waitForWindow(qr/Terminal/);
+      $machine->sleep(10);
+      $machine->screenshot("screen");
+    '';
+
+}

nixos/tests/installer.nix

@@ -252,9 +252,9 @@ in {
         ''
           $machine->succeed(
               "parted /dev/vda mklabel msdos",
-              "parted /dev/vda -- mkpart primary 1M 2048M", # first PV
+              "parted /dev/vda -- mkpart primary 1M 2048M", # PV1
               "parted /dev/vda -- set 1 lvm on",
-              "parted /dev/vda -- mkpart primary 2048M -1s", # second PV
+              "parted /dev/vda -- mkpart primary 2048M -1s", # PV2
               "parted /dev/vda -- set 2 lvm on",
               "udevadm settle",
               "pvcreate /dev/vda1 /dev/vda2",

pkgs/applications/misc/taffybar/default.nix

@@ -0,0 +1,25 @@
+{ cabal, cairo, dbus, dyre, filepath, gtk, gtkTraymanager
+, HStringTemplate, HTTP, mtl, network, parsec, split, stm, text
+, time, transformers, utf8String, X11, xdgBasedir, xmonad
+, xmonadContrib
+}:
+
+cabal.mkDerivation (self: {
+  pname = "taffybar";
+  version = "0.3.0";
+  sha256 = "02vpfbwfprca997ykk746ih7id0ls3i5pnb33gj3nrfgc59fkz7v";
+  isLibrary = true;
+  isExecutable = true;
+  buildDepends = [
+    cairo dbus dyre filepath gtk gtkTraymanager HStringTemplate HTTP
+    mtl network parsec split stm text time transformers utf8String X11
+    xdgBasedir xmonad xmonadContrib
+  ];
+  pkgconfigDepends = [ gtk ];
+  meta = {
+    homepage = "http://github.com/travitch/taffybar";
+    description = "A desktop bar similar to xmobar, but with more GUI";
+    license = self.stdenv.lib.licenses.bsd3;
+    platforms = self.ghc.meta.platforms;
+  };
+})

pkgs/applications/networking/browsers/chromium/sources.nix

@@ -11,8 +11,8 @@
     sha256 = "04n43c4vn8i7qhlybqb19c2c8kri8nc1wpa2l83vin4sqxkq519h";
   };
   stable = {
-    version = "32.0.1700.102";
+    version = "32.0.1700.107";
-    url = "http://commondatastorage.googleapis.com/chromium-browser-official/chromium-32.0.1700.102.tar.xz";
+    url = "http://commondatastorage.googleapis.com/chromium-browser-official/chromium-32.0.1700.107.tar.xz";
-    sha256 = "0jxwhd7cd60ivisrnzcglqqnmy99np1vvjqa27y42d852xjx84ys";
+    sha256 = "1bf1gbjf4r9nf3xdn7zgq0ny1ihak21ka4rkkiadxsg8aq9vdsqz";
   };
 }

pkgs/applications/networking/browsers/firefox/default.nix

@@ -17,9 +17,9 @@ assert stdenv.gcc ? libc && stdenv.gcc.libc != null;
 
 rec {
 
-  firefoxVersion = "26.0";
+  firefoxVersion = "27.0";
 
-  xulVersion = "26.0"; # this attribute is used by other packages
+  xulVersion = "27.0"; # this attribute is used by other packages
 
 
   src = fetchurl {
@@ -29,7 +29,7 @@ rec {
         # Fall back to this url for versions not available at releases.mozilla.org.
         "http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/${firefoxVersion}/source/firefox-${firefoxVersion}.source.tar.bz2"
     ];
-    sha1 = "f7c6642d6f62aea8d4eced48dd27aba0634edcd5";
+    sha1 = "ec2031385237e30be829817ac79caa8e80cc2a14";
   };
 
   commonConfigureFlags =
@@ -116,6 +116,7 @@ rec {
       for i in $out/lib/$libDir/{plugin-container,xulrunner,xulrunner-stub}; do
           wrapProgram $i --prefix LD_LIBRARY_PATH ':' "$out/lib/$libDir"
       done
+
       rm -f $out/bin/run-mozilla.sh
     ''; # */
 
@@ -162,13 +163,20 @@ rec {
       "SYSTEM_LIBXUL=1"
     ];
 
-    # Hack to work around make's idea of -lbz2 dependency
+    # Because preConfigure runs configure from a subdirectory.
+    configureScript = "../configure";
+
     preConfigure =
       ''
+        # Hack to work around make's idea of -lbz2 dependency
         find . -name Makefile.in -execdir sed -i '{}' -e '1ivpath %.so ${
           stdenv.lib.concatStringsSep ":"
             (map (s : s + "/lib") (buildInputs ++ [stdenv.gcc.libc]))
         }' ';'
+
+        # Building directly in the main source directory is not allowed.
+        mkdir obj_dir
+        cd obj_dir
       '';
 
     postInstall =

pkgs/applications/networking/instant-messengers/hipchat/default.nix

@@ -1,12 +1,21 @@
-{ stdenv, fetchurl, libtool, libXext, libSM, libICE, libX11, libXft, libXau, libXdmcp, libXrender
+{ stdenv
-, libxcb, libXfixes, libXcomposite, libXi, dbus, freetype, fontconfig, openssl, zlib, mesa
+, fetchurl
-, libxslt, libxml2
+, libtool
+, libXext
+, libSM
+, libICE
+, libX11
+, libXft
+, libXau
+, libXdmcp
+, libXrender
+, freetype
+, fontconfig
+, openssl
 }:
 
-assert stdenv.system == "i686-linux" || stdenv.system == "x86_64-linux"; 
-
 let
-  version = "2.1.982";
+  version = "1.94.407";
 
   rpath = stdenv.lib.makeSearchPath "lib" [
     stdenv.glibc
@@ -20,29 +29,15 @@ let
     libXau
     libXdmcp
     libXrender
-    libxcb
-    libXfixes
-    libXcomposite
-    libXi
-    dbus
     freetype
     fontconfig
     openssl
-    zlib
-    mesa
-    libxslt
-    libxml2
   ];
 
-  src = 
+  src = fetchurl {
-    if stdenv.system == "i686-linux" then fetchurl {
+    url = "http://downloads.hipchat.com/linux/arch/hipchat-${version}-i686.pkg.tar.xz";
-      url = "http://downloads.hipchat.com/linux/arch/i686/hipchat-${version}-i686.pkg.tar.xz";
+    sha256 = "0kyjpa2ir066zqkvs1zmnx6kvl8v4jfl8h7bw110cgigwmiplk7k";
-      sha256 = "1i60fkl5hdx2p2yfsx9w8qkzn6hl8fajvfls0r0gc2bqc9whg6vn";
+  };
-    } else fetchurl {
-      url = "http://downloads.hipchat.com/linux/arch/x86_64/hipchat-${version}-x86_64.pkg.tar.xz";
-      sha256 = "12bn4la9z1grkbcnixjwhadgxa2g6qkd5x7r3l3vn1sdalgal4ks";
-    };
-
 in stdenv.mkDerivation {
   name = "hipchat-${version}";
 
@@ -54,8 +49,8 @@ in stdenv.mkDerivation {
     mv usr/share $out
     patchShebangs $out/bin
     for file in $(find $out/lib -type f); do
-        patchelf --set-interpreter $(cat $NIX_GCC/nix-support/dynamic-linker) $file || true
+        patchelf --set-interpreter ${stdenv.glibc}/lib/ld-linux.so.2 $file || true
-        patchelf --set-rpath ${rpath}:${stdenv.lib.optionalString stdenv.is64bit "${stdenv.gcc.gcc}/lib64:"}$out/lib $file || true
+        patchelf --set-rpath ${rpath}:$out/lib $file || true
     done
     substituteInPlace $out/share/applications/hipchat.desktop \
       --replace /opt/HipChat/bin $out/bin

pkgs/applications/networking/irc/weechat/default.nix

@@ -3,12 +3,12 @@
 , pythonPackages, cacert, cmake, makeWrapper }:
 
 stdenv.mkDerivation rec {
-  version = "0.4.2";
+  version = "0.4.3";
   name = "weechat-${version}";
 
   src = fetchurl {
     url = "http://weechat.org/files/src/${name}.tar.gz";
-    sha256 = "03ypji34kb5yrxqyn8dbrjm3j00pc8v7wfsip7d3l63nyx79df9v";
+    sha256 = "1sfx2j8xy6das0zis2nmzi9z41q96gzq61xaw4i0xbgag17s7ddz";
   };
 
   buildInputs = 

pkgs/applications/networking/mailreaders/thunderbird/default.nix

@@ -12,14 +12,14 @@
   enableOfficialBranding ? false
 }:
 
-let version = "17.0.8"; in
+let version = "17.0.11esr"; in
 
 stdenv.mkDerivation {
   name = "thunderbird-${version}";
 
   src = fetchurl {
     url = "ftp://ftp.mozilla.org/pub/thunderbird/releases/${version}/source/thunderbird-${version}.source.tar.bz2";
-    sha1 = "4bcbb33f0b3ea050e805723680b5669d80438812";
+    sha256 = "1m2lph8x82kgxqzlyaxr1l1x7s4qnqfzfnqck4b777914mrv1mdp";
   };
 
   #enableParallelBuilding = true;

pkgs/applications/networking/mumble/default.nix

@@ -15,11 +15,11 @@ let
 in
 stdenv.mkDerivation rec {
   name = "mumble-" + version;
-  version = "1.2.4";
+  version = "1.2.5";
 
   src = fetchurl {
     url = "mirror://sourceforge/mumble/${name}.tar.gz";
-    sha256 = "16wwj6gwcnyjlnzh7wk0l255ldxmbwx0wi652sdp20lsv61q7kx1";
+    sha256 = "1bsgains6xgpgpd1b5bq682z0kswp5fcjh2cir4c4qkndya5clci";
   };
 
   patches = optional jackSupport ./mumble-jack-support.patch;

pkgs/applications/networking/mumble/murmur.nix

@@ -12,11 +12,11 @@ let
 in
 stdenv.mkDerivation rec {
   name = "murmur-" + version;
-  version = "1.2.4";
+  version = "1.2.5";
 
   src = fetchurl {
     url = "mirror://sourceforge/mumble/mumble-${version}.tar.gz";
-    sha256 = "16wwj6gwcnyjlnzh7wk0l255ldxmbwx0wi652sdp20lsv61q7kx1";
+    sha256 = "1bsgains6xgpgpd1b5bq682z0kswp5fcjh2cir4c4qkndya5clci";
   };
 
   patchPhase = optional iceSupport ''

pkgs/applications/version-management/git-and-tools/git/default.nix

@@ -10,7 +10,7 @@
 
 let
 
-  version = "1.8.5.2";
+  version = "1.8.5.4";
 
   svn = subversionClient.override { perlBindings = true; };
 
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "http://git-core.googlecode.com/files/git-${version}.tar.gz";
-    sha256 = "12iyj6f89dmb1cn2pvym5lrf23g4m71mp9pwkbi1zscb9d998ih2";
+    sha256 = "062z4j4hfhfdlvkxs2mzarsyvbqvfy4kv8j5h4c75ymb5yp8iklk";
   };
 
   patches = [ ./docbook2texi.patch ./symlinks-in-bin.patch ];

pkgs/applications/video/gnash/default.nix

@@ -81,6 +81,8 @@ stdenv.mkDerivation rec {
        echo "\$GST_PLUGIN_PATH set to \`$GST_PLUGIN_PATH'"
     '';
 
+  postConfigure = "echo '#define nullptr NULL' >> gnashconfig.h";
+
   # Make sure `gtk-gnash' gets `libXext' in its `RPATH'.
   NIX_LDFLAGS="-lX11 -lXext";
 

pkgs/data/fonts/andagii/default.nix

@@ -19,6 +19,7 @@ in
 rec {
   src = a.fetchurl {
     url = sourceInfo.url;
+    curlOpts = "--user-agent 'Mozilla/5.0'";
     sha256 = sourceInfo.hash;
   };
 

pkgs/desktops/gnome-3/core/gnome-control-center/default.nix

@@ -1,11 +1,24 @@
-{ fetchurl, stdenv, pkgconfig, gnome3, ibus, intltool, upower, libcanberra
+{ fetchurl, stdenv, pkgconfig, gnome3, ibus, intltool, upower, libcanberra, accountservice
-, libxml2, polkit, libxslt, libgtop, libsoup, colord, pulseaudio, fontconfig }:
+, libxml2, polkit, libxslt, libgtop, libsoup, colord, colord-gtk, pulseaudio, fontconfig
+, cracklib, python, krb5, networkmanagerapplet, libwacom, samba, libnotify, libxkbfile
+, shared_mime_info, tzdata, icu, libtool, docbook_xsl, docbook_xsl_ns, makeWrapper }:
 
 # http://ftp.gnome.org/pub/GNOME/teams/releng/3.10.2/gnome-suites-core-3.10.2.modules
-# TODO: colord_gtk
+# TODO: bluetooth, networkmanager, wacom, smbclient, printers
 
+let
+  libpwquality = stdenv.mkDerivation rec {
+    name = "libpwquality-1.2.3";
 
-stdenv.mkDerivation rec {
+    src = fetchurl {
+      url = "https://fedorahosted.org/releases/l/i/libpwquality/${name}.tar.bz2";
+      sha256 = "0sjiabvl5277nfxyy96jdz65a0a3pmkkwrfbziwgik83gg77j75i";
+    };
+
+    buildInputs = [ cracklib python ];
+  };
+
+in stdenv.mkDerivation rec {
   name = "gnome-control-center-3.10.2";
 
   src = fetchurl {
@@ -16,7 +29,26 @@ stdenv.mkDerivation rec {
   buildInputs = with gnome3;
     [ pkgconfig intltool ibus gtk glib upower libcanberra gsettings_desktop_schemas
       libxml2 gnome_desktop gnome_settings_daemon polkit libxslt libgtop gnome-menus
-      gnome_online_accounts libsoup colord pulseaudio fontconfig ];
+      gnome_online_accounts libsoup colord pulseaudio fontconfig colord-gtk libpwquality
+      accountservice krb5 networkmanagerapplet libwacom samba libnotify libxkbfile
+      shared_mime_info icu libtool docbook_xsl docbook_xsl_ns makeWrapper ];
+
+  preBuild = ''
+    substituteInPlace tz.h --replace "/usr/share/zoneinfo/zone.tab" "${tzdata}/share/zoneinfo/zone.tab"
+    substituteInPlace panels/datetime/tz.h --replace "/usr/share/zoneinfo/zone.tab" "${tzdata}/share/zoneinfo/zone.tab"
+
+    # hack to make test-endianess happy
+    mkdir -p $out/share/locale
+    substituteInPlace panels/datetime/test-endianess.c --replace "/usr/share/locale/" "$out/share/locale/"
+  '';
+
+  postInstall = with gnome3; ''
+    wrapProgram $out/bin/gnome-control-center \
+      --prefix XDG_DATA_DIRS : "${gsettings_desktop_schemas}/share:${gnome_settings_daemon}/share:${glib}/share:${gtk}/share:${colord}/share:$out/share"
+    for i in $out/share/applications/*; do
+      substituteInPlace $i --replace "gnome-control-center" "$out/bin/gnome-control-center"
+    done
+  '';
 
   meta = with stdenv.lib; {
     platforms = platforms.linux;

pkgs/desktops/gnome-3/core/gnome-shell/default.nix

@@ -19,13 +19,14 @@ stdenv.mkDerivation rec {
       libcroco intltool libsecret pkgconfig python libsoup polkit libcanberra gdk_pixbuf librsvg
       clutter networkmanager libstartup_notification telepathy_glib docbook_xsl docbook_xsl_ns
       libXtst p11_kit networkmanagerapplet gjs mutter pulseaudio caribou evolution_data_server
-      libical libtool nss gobjectIntrospection gtk gstreamer makeWrapper gdm
+      libical libtool nss gobjectIntrospection gtk gstreamer makeWrapper gdm gnome_control_center
       at_spi2_core upower ibus gnome_session gnome_desktop telepathy_logger ];
 
   configureFlags = "--disable-static";
 
   preBuild = ''
     patchShebangs src/data-to-c.pl
+    substituteInPlace data/Makefile --replace " install-keysDATA" ""
   '';
 
   postInstall = with gnome3; ''
@@ -33,7 +34,7 @@ stdenv.mkDerivation rec {
       --prefix GI_TYPELIB_PATH : "$GI_TYPELIB_PATH" \
       --prefix LD_LIBRARY_PATH : "${accountservice}/lib:${ibus}/lib:${gdm}/lib" \
       --set GDK_PIXBUF_MODULE_FILE ${gnome_themes_standard}/lib/gdk-pixbuf/loaders.cache \
-      --prefix XDG_DATA_DIRS : "${gnome-menus}:/share:${ibus}/share:${gnome_settings_daemon}/share:${gdm}/share:${glib}/share:${gnome_themes_standard}/share:${mutter}/share:${gnome_icon_theme}/share:${gsettings_desktop_schemas}/share:${gtk}/share:$out/share"
+      --prefix XDG_DATA_DIRS : "${gnome-menus}:/share:${ibus}/share:${gnome_settings_daemon}/share:${gnome_control_center}/share:${gdm}/share:${glib}/share:${gnome_themes_standard}/share:${mutter}/share:${gnome_icon_theme}/share:${gsettings_desktop_schemas}/share:${gtk}/share:$out/share"
     wrapProgram "$out/libexec/gnome-shell-calendar-server" \
       --prefix XDG_DATA_DIRS : "${evolution_data_server}/share:$out/share"
   '';

pkgs/desktops/gnome-3/core/libqmi/default.nix

@@ -1,16 +0,0 @@
-{ stdenv, fetchurl, pkgconfig, glib, python }:
-
-stdenv.mkDerivation rec {
-  name = "libqmi-1.0";
-
-  src = fetchurl {
-    url = "http://ftp.acc.umu.se/pub/GNOME/core/3.10/3.10.2/sources/${name}.tar.xz";
-    sha256 = "0w4cd7nihp73frh3sfi13fx0rkwmd581xpil54bsjc7pw7z01bd1";
-  };
-
-  buildInputs = [ pkgconfig glib python ];
-
-  meta = with stdenv.lib; {
-    platforms = platforms.linux;
-  };
-}

pkgs/desktops/gnome-3/default.nix

@@ -70,8 +70,6 @@ rec {
 
   libpeas = callPackage ./core/libpeas {};
 
-  libqmi = callPackage ./core/libqmi {};
-
   libgweather = callPackage ./core/libgweather { };
 
   libzapojit = callPackage ./core/libzapojit { };

pkgs/desktops/kde-4.10/kde-workspace.nix

@@ -1,7 +1,8 @@
 { kde, kdelibs, qimageblitz, libdbusmenu_qt, xorg, shared_desktop_ontologies,
   lm_sensors, pciutils, libraw1394, libusb, libxklavier, python, libqalculate,
   xkeyboard_config, kdepimlibs, pam, boost, gpsd, prison, akonadi,
-  libjpeg, pkgconfig, libXft, libXxf86misc, kactivities, qjson, networkmanager
+  libjpeg, pkgconfig, libXft, libXxf86misc, kactivities, qjson, networkmanager,
+  fetchurl
 }:
 
 kde {
@@ -17,6 +18,12 @@ kde {
       kactivities
     ];
 
+  patches = [(fetchurl {
+    url = "https://git.reviewboard.kde.org/r/111261/diff/raw/";
+    sha256 = "0g8qjna1s0imz7801k4iy2ap5z81izi4bncvks7z3n9agji4zf40";
+    name = "CVE-2013-4132.patch";
+  })];
+
   nativeBuildInputs = [ pkgconfig ];
 
   preConfigure =

pkgs/development/compilers/ats2/default.nix

@@ -1,11 +1,11 @@
 { stdenv, fetchurl, gmp }:
 
-let version = "0.0.3"; in stdenv.mkDerivation {
+let version = "0.0.5"; in stdenv.mkDerivation {
   name = "ats2-postiats-${version}";
 
   src = fetchurl {
     url = "mirror://sourceforge/ats2-lang/ATS2-Postiats-${version}.tgz";
-    sha256 = "0hq63zrmm92j5ffnsmylhhllm8kgjpjkaj4xvzz1zlshz39lijxp";
+    sha256 = "1rzcqc7fwqf0y4cc14lr282r25s66jygf6cxrnf5l8p5p550l0dl";
   };
 
   buildInputs = [ gmp ];

pkgs/development/interpreters/elixir/default.nix

@@ -1,29 +1,30 @@
 { stdenv, fetchurl, erlang, rebar, makeWrapper, coreutils }:
 
 let
-  version = "0.12.0";
+  version = "0.12.3";
 in
 stdenv.mkDerivation {
   name = "elixir-${version}";
 
   src = fetchurl {
     url = "https://github.com/elixir-lang/elixir/archive/v${version}.tar.gz";
-    sha256 = "0cir2y36zljwphiqyz8xmq7qq0f094jmfy3qwk3wdm05c05nqnc8";
+    sha256 = "1im00cki38ldsig93djlsap8zbgwv74kpgw7xg9l6ik2cbpk0131";
   };
 
   buildInputs = [ erlang rebar makeWrapper ];
 
   preBuild = ''
-    substituteInPlace rebar \
+    # The build process uses ./rebar. Link it to the nixpkgs rebar
-      --replace "/usr/bin/env escript" ${erlang}/bin/escript
+    rm -v rebar
+    ln -s ${rebar}/bin/rebar rebar
+
     substituteInPlace Makefile \
-      --replace '$(shell echo `pwd`/rebar)' ${rebar}/bin/rebar \
       --replace "/usr/local" $out
   '';
 
   postFixup = ''
-    # Elixirs binaries are shell scripts which run erl. This adds some
+    # Elixir binaries are shell scripts which run erl. Add some stuff
-    # stuff to PATH so the scripts run without problems.
+    # to PATH so the scripts can run without problems.
 
     for f in $out/bin/*
     do

pkgs/development/interpreters/pypy/2.2/default.nix

@@ -58,7 +58,8 @@ let
        # disable shutils because it assumes gid 0 exists
        # disable socket because it has two actual network tests that fail
        # disable test_mhlib because it fails for unknown reason
-      ./pypy-c ./pypy/test_all.py --pypy=./pypy-c -k '-test_socket -test_shutil -test_mhlib' lib-python
+       # disable test_multiprocessing due to transient errors
+      ./pypy-c ./pypy/test_all.py --pypy=./pypy-c -k '-test_socket -test_shutil -test_mhlib -test_multiprocessing' lib-python
     '';
 
     installPhase = ''
@@ -86,7 +87,7 @@ let
       homepage = "http://pypy.org/";
       description = "PyPy is a fast, compliant alternative implementation of the Python language (2.7.3)";
       license = licenses.mit;
-      platforms = platforms.all;
+      platforms = platforms.linux;
       maintainers = with maintainers; [ iElectric ];
     };
   };

pkgs/development/libraries/haskell/diff3/default.nix

@@ -0,0 +1,19 @@
+{ cabal, Diff, QuickCheck, testFramework, testFrameworkQuickcheck2
+}:
+
+cabal.mkDerivation (self: {
+  pname = "diff3";
+  version = "0.2.0.3";
+  sha256 = "0zdfn1jhsq8pd23qpkhzr8wgiwbazfbq688bjnpc406i7gq88k78";
+  buildDepends = [ Diff ];
+  testDepends = [
+    QuickCheck testFramework testFrameworkQuickcheck2
+  ];
+  meta = {
+    homepage = "http://github.com/ocharles/diff3.git";
+    description = "Perform a 3-way difference of documents";
+    license = self.stdenv.lib.licenses.bsd3;
+    platforms = self.ghc.meta.platforms;
+    maintainers = [ self.stdenv.lib.maintainers.ocharles ];
+  };
+})

pkgs/development/libraries/haskell/gtk-traymanager/default.nix

@@ -0,0 +1,15 @@
+{ cabal, glib, gtk, X11 }:
+
+cabal.mkDerivation (self: {
+  pname = "gtk-traymanager";
+  version = "0.1.3";
+  sha256 = "07671f3j3r07djgvrlpbdaqqnm2yc7sc5f5isjn5nczrwh8n0sj4";
+  buildDepends = [ glib gtk ];
+  pkgconfigDepends = [ gtk X11 ];
+  meta = {
+    homepage = "http://github.com/travitch/gtk-traymanager";
+    description = "A wrapper around the eggtraymanager library for Linux system trays";
+    license = self.stdenv.lib.licenses.lgpl21;
+    platforms = self.ghc.meta.platforms;
+  };
+})

pkgs/development/libraries/haskell/json-assertions/default.nix

@@ -0,0 +1,15 @@
+{ cabal, aeson, indexed, indexedFree, lens, text }:
+
+cabal.mkDerivation (self: {
+  pname = "json-assertions";
+  version = "1.0.1";
+  sha256 = "0rpj300knyk602wqkqipmy54xv3pn20cd06sa8irkf2wz0xribzm";
+  buildDepends = [ aeson indexed indexedFree lens text ];
+  meta = {
+    homepage = "http://github.com/ocharles/json-assertions.git";
+    description = "Test that your (Aeson) JSON encoding matches your expectations";
+    license = self.stdenv.lib.licenses.bsd3;
+    platforms = self.ghc.meta.platforms;
+    maintainers = [ self.stdenv.lib.maintainers.ocharles ];
+  };
+})

pkgs/development/libraries/libmbim/default.nix

@@ -0,0 +1,23 @@
+{ stdenv, fetchurl, pkgconfig, glib, python, udev }:
+
+stdenv.mkDerivation rec {
+  name = "libmbim-1.6.0";
+
+  src = fetchurl {
+    url = "http://www.freedesktop.org/software/libmbim/${name}.tar.xz";
+    sha256 = "10mh1b8jfxg6y6nhr7swbi9wx4acjgvx1if7nhrw1ppd5apvvvz0";
+  };
+
+  preConfigure = ''
+    for f in build-aux/mbim-codegen/*; do
+       substituteInPlace $f --replace "/usr/bin/env python" "${python}/bin/python"
+    done
+  '';
+
+  buildInputs = [ pkgconfig glib udev ];
+
+  meta = with stdenv.lib; {
+    description = "talking to WWAN modems and devices which speak the Mobile Interface Broadband Model (MBIM) protocol";
+    platforms = platforms.linux;
+  };
+}

pkgs/development/libraries/libqmi/default.nix

@@ -0,0 +1,21 @@
+{ stdenv, fetchurl, pkgconfig, glib, python }:
+
+stdenv.mkDerivation rec {
+  name = "libqmi-1.8.0";
+
+  src = fetchurl {
+    url = "http://www.freedesktop.org/software/libqmi/${name}.tar.xz";
+    sha256 = "03gf221yjcdzvnl4v2adwpc6cyg5mlbccn20s00fp5bgvmq81pgs";
+  };
+
+  preBuild = ''
+    patchShebangs .
+  '';
+
+  buildInputs = [ pkgconfig glib python ];
+
+  meta = with stdenv.lib; {
+    description = "Modem protocol helper library";
+    platforms = platforms.linux;
+  };
+}

pkgs/development/libraries/nss/default.nix

@@ -5,17 +5,17 @@
 let
 
   nssPEM = fetchurl {
-    url = http://dev.gentoo.org/~anarchy/patches/nss-3.15-pem-support-20130617.patch.xz;
+    url = http://dev.gentoo.org/~polynomial-c/mozilla/nss-3.15.4-pem-support-20140109.patch.xz;
-    sha256 = "1k1m8lsgqwxx251943hks1dd13hz1adpqqb0hxwn011by5vmi201";
+    sha256 = "10ibz6y0hknac15zr6dw4gv9nb5r5z9ym6gq18j3xqx7v7n3vpdw";
   };
 
 in stdenv.mkDerivation rec {
   name = "nss-${version}";
-  version = "3.15.3.1";
+  version = "3.15.4";
 
   src = fetchurl {
-    url = "http://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_15_3_1_RTM/src/${name}.tar.gz";
+    url = "http://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_15_4_RTM/src/${name}.tar.gz";
-    sha1 = "4e0f81a1f770447dc5440201a579151b601463e2";
+    sha1 = "c164fac83fcbaff010786767e2a858ca23a89a5b";
   };
 
   buildInputs = [ nspr perl zlib sqlite ];

pkgs/development/python-modules/fedpkg-buildfix.diff

@@ -0,0 +1,14 @@
+--- a/setup.py	2014-02-04 16:12:37.021993713 +0100
++++ b/setup.py	2014-02-04 16:11:42.653995607 +0100
+@@ -13,8 +13,8 @@
+     package_dir = {'': 'src'},
+     packages = ['fedpkg'],
+     scripts = ['src/bin/fedpkg'],
+-    data_files = [('/etc/bash_completion.d', ['src/fedpkg.bash']),
+-                  ('/etc/rpkg', ['src/fedpkg.conf']),
+-                  ('/usr/libexec/', ['src/fedpkg-fixbranches.py']),
++    data_files = [('etc/bash_completion.d', ['src/fedpkg.bash']),
++                  ('etc/rpkg', ['src/fedpkg.conf']),
++                  ('libexec/', ['src/fedpkg-fixbranches.py']),
+                  ]
+ )

pkgs/development/python-modules/rpkg-buildfix.diff

@@ -0,0 +1,11 @@
+--- a/setup.py	2012-03-12 23:26:16.000000000 +0100
++++ b/setup.py	2014-02-04 14:52:02.335856975 +0100
+@@ -14,6 +14,6 @@
+     package_dir = {'': 'src'},
+     packages = ['pyrpkg'],
+     scripts = ['src/rpkg'],
+-    data_files = [('/etc/bash_completion.d', ['src/rpkg.bash']),
+-                  ('/etc/rpkg', ['src/rpkg.conf'])],
++    data_files = [('etc/bash_completion.d', ['src/rpkg.bash']),
++                  ('etc/rpkg', ['src/rpkg.conf'])],
+ )

pkgs/development/tools/build-managers/leiningen/builder.sh

@@ -19,5 +19,5 @@ chmod -v 755 $out_bin
 patchShebangs $out
 
 wrapProgram $out_bin \
-    --prefix PATH ":" ${rlwrap}/bin \
+    --prefix PATH ":" "${rlwrap}/bin:${coreutils}/bin:${findutils}/bin" \
     --set LEIN_GPG ${gnupg}/bin/gpg

pkgs/development/tools/build-managers/leiningen/default.nix

@@ -1,23 +1,24 @@
-{ stdenv, fetchurl, makeWrapper, jdk, rlwrap, clojure, gnupg }:
+{ stdenv, fetchurl, makeWrapper
+, coreutils, findutils, jdk, rlwrap, clojure, gnupg }:
 
 stdenv.mkDerivation rec {
   pname = "leiningen";
-  version = "2.3.3";
+  version = "2.3.4";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "https://raw.github.com/technomancy/leiningen/${version}/bin/lein-pkg";
-    sha256 = "0lc5ivgknkflk6k4a4q1r8bm3kq63p4cazfs1rdb02cfhdip52hc";
+    sha256 = "1v83hpvp349pgqqiy4babc5m5b9lcwk0fif80fpv4jqvp0a8v6r7";
   };
 
   jarsrc = fetchurl {
     url = "https://leiningen.s3.amazonaws.com/downloads/${pname}-${version}-standalone.jar";
-    sha256 = "1a8i0940ww7xqhwlaaavsgw8s9rjqdnv46hfsla41ns789bappxf";
+    sha256 = "1pqc99p4vz4q3qcs90cqql6m7kc27ihx4hbqs5alxkzk7jv8s2bk";
   };
 
   patches = ./lein_2.3.0.patch;
 
-  inherit rlwrap clojure gnupg;
+  inherit rlwrap clojure gnupg findutils coreutils;
 
   builder = ./builder.sh;
 

pkgs/development/tools/build-managers/rebar/default.nix

@@ -1,11 +1,15 @@
 { stdenv, fetchurl, erlang }:
 
+
+let
+  version = "2.2.0";
+in
 stdenv.mkDerivation {
-  name = "rebar-2.1.0-pre";
+  name = "rebar-${version}";
 
   src = fetchurl {
-    url = "https://github.com/basho/rebar/archive/2.1.0-pre.tar.gz";
+    url = "https://github.com/rebar/rebar/archive/${version}.tar.gz";
-    sha256 = "0dsbk9ssvk1hx9275900dg4bz79kpwcid4gsz09ziiwzv0jjbrjn";
+    sha256 = "0wprgzin09286v583jmlc385jqpi2lcpdql9srm4c7g39122dg43";
   };
 
   buildInputs = [ erlang ];

pkgs/games/anki/default.nix

@@ -6,13 +6,13 @@
 
 let
     py = pythonPackages;
+    version = "2.0.22";
 in
-
 stdenv.mkDerivation rec {
-    name = "anki-2.0.20";
+    name = "anki-${version}";
     src = fetchurl {
       url = "http://ankisrs.net/download/mirror/${name}.tgz";
-      sha256 = "1w274g7as458bfkh86635p04fimvmkn70j8qy9m6nl2xwjaq8nhm";
+      sha256 = "1bnjzf8050hrs3iiaak0m07sxj07vqic677llg2g6iarg9ws8x26";
     };
 
     pythonPath = [ pyqt4 py.pysqlite py.sqlalchemy py.pyaudio ]
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
         decrease your time spent studying, or greatly increase the amount you learn.
 
         Anyone who needs to remember things in their daily life can benefit from
-        Anki. Since it is content-agnostic and supports images, audio, videos and 
+        Anki. Since it is content-agnostic and supports images, audio, videos and
         scientific markup (via LaTeX), the possibilities are endless. For example:
 
         * learning a language

pkgs/games/spring/default.nix

@@ -1,9 +1,10 @@
 { stdenv, fetchurl, cmake, lzma, boost, libdevil, zlib, p7zip
 , openal, libvorbis, glew, freetype, xlibs, SDL, mesa, binutils
-, asciidoc, libxslt, docbook_xsl, curl
+, asciidoc, libxslt, docbook_xsl, docbook_xsl_ns, curl, makeWrapper
 , jdk ? null, python ? null
 , withAI ? true # support for AI Interfaces and Skirmish AIs
 }:
+
 stdenv.mkDerivation rec {
 
   name = "spring-${version}";
@@ -14,23 +15,29 @@ stdenv.mkDerivation rec {
     sha256 = "1axyqkxgv3a0zg0afzlc7j3lyi412zd551j317ci41yqz2qzf0px";
   };
 
-  buildInputs = [ cmake lzma boost libdevil zlib p7zip openal libvorbis freetype SDL
+  cmakeFlags = ["-DCMAKE_BUILD_WITH_INSTALL_RPATH:BOOL=ON"
-    xlibs.libX11 xlibs.libXcursor mesa glew asciidoc libxslt docbook_xsl curl ]
+                "-DCMAKE_INSTALL_RPATH_USE_LINK_PATH:BOOL=ON"
+                "-DPREFER_STATIC_LIBS:BOOL=OFF"];
+
+  buildInputs = [ cmake lzma boost libdevil zlib p7zip openal libvorbis freetype SDL 
+    xlibs.libX11 xlibs.libXcursor mesa glew asciidoc libxslt docbook_xsl curl makeWrapper
+    docbook_xsl_ns ]
     ++ stdenv.lib.optional withAI jdk
     ++ stdenv.lib.optional withAI python;
 
-  prePatch = ''
+  # reported upstream http://springrts.com/mantis/view.php?id=4305
-    substituteInPlace cont/base/make_gamedata_arch.sh --replace "#!/bin/sh" "#!${stdenv.shell}/bin/sh" \
-      --replace "which" "type -p"
-  '';
-
   #enableParallelBuilding = true; # occasionally missing generated files on Hydra
 
+  postInstall = ''
+    wrapProgram "$out/bin/spring" \
+      --prefix LD_LIBRARY_PATH : "${stdenv.gcc.gcc}/lib64:${stdenv.gcc.gcc}/lib"
+  '';
+
   meta = with stdenv.lib; {
     homepage = http://springrts.com/;
     description = "A powerful real-time strategy (RTS) game engine";
     license = licenses.gpl2;
-    maintainers = [ maintainers.phreedom maintainers.qknight ];
+    maintainers = [ maintainers.phreedom maintainers.qknight maintainers.iElectric ];
     platforms = platforms.mesaPlatforms;
   };
 }

pkgs/games/spring/springlobby.nix

@@ -1,5 +1,5 @@
 { stdenv, fetchurl, cmake, wxGTK, openal, pkgconfig, curl, libtorrentRasterbar, libpng, libX11
-, gettext, bash, gawk, boost, libnotify, gtk, doxygen }:
+, gettext, bash, gawk, boost, libnotify, gtk, doxygen, spring, makeWrapper }:
 stdenv.mkDerivation rec {
 
   name = "springlobby-${version}";
@@ -12,9 +12,11 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     cmake wxGTK openal pkgconfig curl gettext libtorrentRasterbar boost libpng libX11
-    libnotify gtk doxygen
+    libnotify gtk doxygen makeWrapper
   ];
 
+  patches = [ ./unitsync_path_find.patch ];
+
   prePatch = ''
     substituteInPlace tools/regen_config_header.sh --replace "#!/usr/bin/env bash" "#!${bash}/bin/bash"
     substituteInPlace tools/test-susynclib.awk --replace "#!/usr/bin/awk" "#!${gawk}/bin/awk"
@@ -26,13 +28,17 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  #buildPhase = "make VERBOSE=1";
+  postInstall = ''
+    wrapProgram $out/bin/springlobby \
+      --prefix PATH : "${spring}/bin" \
+      --set SPRING_LIB_DIRS "${spring}/lib"
+  '';
 
   meta = with stdenv.lib; {
     homepage = http://springlobby.info/;
     description = "Cross-platform lobby client for the Spring RTS project";
     license = licenses.gpl2;
-    maintainers = [ maintainers.phreedom maintainers.qknight];
+    maintainers = [ maintainers.phreedom maintainers.qknight maintainers.iElectric ];
     platforms = platforms.linux;
   };
 }

pkgs/games/spring/unitsync_path_find.patch

@@ -0,0 +1,10 @@
+--- a/src/settings.cpp	2013-12-02 10:09:19.000000000 +0000
++++ b/src/settings.cpp-new	2014-02-10 11:39:48.265628767 +0000
+@@ -498,6 +498,7 @@
+ 
+ wxString Settings::AutoFindUnitSync(wxPathList pl) const
+ {
++	pl.AddEnvList( _T( "SPRING_LIB_DIRS" ) );
+ 	wxString retpath = pl.FindValidPath( _T( "unitsync" ) + GetLibExtension() );
+ 	if ( retpath.IsEmpty() )
+ 		retpath = pl.FindValidPath( _T( "libunitsync" ) + GetLibExtension() );

pkgs/os-specific/linux/ati-drivers/default.nix

@@ -35,7 +35,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = http://www2.ati.com/drivers/linux/amd-catalyst-13.12-linux-x86.x86_64.zip;
-    sha256 = "1jm0c4rqyjjhyj8a7axf4hz16bcvy8yhnkn45wc2l73xhks36h02";
+    sha256 = "1c3fn328340by4qn99dgfj8c2q34fxdb2alcak0vnyc6bw7l5sms";
     curlOpts = "--referer http://support.amd.com/en-us/download/desktop?os=Linux%20x86_64";
   };
 

pkgs/os-specific/linux/kernel/linux-3.10.nix

@@ -1,11 +1,11 @@
 { stdenv, fetchurl, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.10.28";
+  version = "3.10.29";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "1blzvr3qywi8wxgl28zsn5djwgvw70yh3i6qjh2sz3zk9gnpd6mq";
+    sha256 = "14g8z5g2xwf0s6r7m9586xdpd56nc810dny70cz6zq8c03kfq594";
   };
 
   features.iwlwifi = true;

pkgs/os-specific/linux/kernel/linux-3.12.nix

@@ -1,11 +1,11 @@
 { stdenv, fetchurl, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.12.9";
+  version = "3.12.10";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "1jzmcqshfgnkk4dibkxc7w06axw7c2fxdpghvm6d7amfpcd9ygka";
+    sha256 = "0p30mfrf3jfp353k0fbfpbmz3sfkhlyzcispqg22dc0lzcj76aj7";
   };
 
   features.iwlwifi = true;

pkgs/os-specific/linux/kernel/linux-3.13.nix

@@ -13,4 +13,4 @@ import ./generic.nix (args // rec {
   features.needsCifsUtils = true;
   features.canDisableNetfilterConntrackHelpers = true;
   features.netfilterRPFilter = true;
-})
+} // (args.argsOverride or {}))

pkgs/os-specific/linux/kernel/linux-3.2.nix

@@ -9,4 +9,4 @@ import ./generic.nix (args // rec {
   };
 
   features.iwlwifi = true;
-})
+} // (args.argsOverride or {}))

pkgs/os-specific/linux/kernel/linux-3.4.nix

@@ -1,11 +1,11 @@
 { stdenv, fetchurl, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.4.78";
+  version = "3.4.79";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "1n9avgjy3qpr28n1rq80kc1gn33w9nz6bvwds6i4d5z793fp7qpk";
+    sha256 = "07xd01b5vl6gl4p2cs75fsn295jvwmlq2j9jw582b2ii8vsaavvv";
   };
 
   features.iwlwifi = true;

pkgs/os-specific/linux/kernel/patches.nix

@@ -81,22 +81,22 @@ rec {
   grsecurity_3_0_3_2_54 =
     { name = "grsecurity-3.0-3.2.54";
       patch = fetchurl {
-        url = https://grsecurity.net/stable/grsecurity-3.0-3.2.54-201401191012.patch;
+        url = https://grsecurity.net/stable/grsecurity-3.0-3.2.54-201402062221.patch;
-        sha256 = "10kfdk46fgd1awys8f8520w7kanc4m0ckn28xg36473fi76i6snx";
+        sha256 = "14x887xibl7d50a1pxmi0snnwcnh27z8bnidhxg2xfasxxp248m5";
       };
       features.grsecurity = true;
       # The grsec kernel patch seems to include the apparmor patches as of 3.0-3.2.54
       features.apparmor = true;
     };
 
-  grsecurity_3_0_3_12_8 =
+  grsecurity_3_0_3_13_2 =
-    { name = "grsecurity-3.0-3.12.8";
+    { name = "grsecurity-3.0-3.13.2";
       patch = fetchurl {
-        url = https://grsecurity.net/test/grsecurity-3.0-3.12.8-201401191015.patch;
+        url = https://grsecurity.net/test/grsecurity-3.0-3.13.2-201402062224.patch;
-        sha256 = "0dy7daar873jp0afkf48l8ij1ii8cgcc9z5pn50h1fvhc9ap1j4f";
+        sha256 = "0w42d76bv7yzpr23bicsadf64csbmq988kmpzxg4yv5qwzhhbyh7";
       };
       features.grsecurity = true;
-      # The grsec kernel patch seems to include the apparmor patches as of 3.0-3.12.8
+      # The grsec kernel patch seems to include the apparmor patches as of 3.0-3.13.2
       features.apparmor = true;
     };
 

pkgs/os-specific/linux/kernel/perf.nix

@@ -4,6 +4,9 @@
 
 assert withGtk -> gtk != null;
 
+let optionalString = stdenv.lib.optionalString;
+    versionOlder = stdenv.lib.versionOlder;
+in
 stdenv.mkDerivation {
   name = "perf-linux-${kernel.version}";
 
@@ -12,7 +15,7 @@ stdenv.mkDerivation {
   preConfigure = ''
     cd tools/perf
     sed -i s,/usr/include/elfutils,$elfutils/include/elfutils, Makefile
-    patch -p1 < ${./perf.diff}
+    ${optionalString (versionOlder kernel.version "3.13") "patch -p1 < ${./perf.diff}"}
     [ -f bash_completion ] && sed -i 's,^have perf,_have perf,' bash_completion
     export makeFlags="DESTDIR=$out $makeFlags"
   '';

pkgs/tools/X11/bumblebee/config.patch

@@ -1,30 +0,0 @@
---- bumblebee-3.0/src/driver.c.orig	2012-02-03 14:51:10.282464426 +0100
-+++ bumblebee-3.0/src/driver.c	2012-02-04 22:26:02.715498536 +0100
-@@ -23,6 +23,7 @@
- #include "module.h"
- #include "bblogger.h"
- #include "driver.h"
-+#include <stdlib.h>
- 
- /**
-  * Check what drivers are available and autodetect if possible. Driver, module
-@@ -30,6 +31,7 @@
-  */
- void driver_detect(void) {
-   /* determine driver to be used */
-+  set_string_value(&bb_config.driver, getenv("BUMBLEBEE_DRIVER"));
-   if (*bb_config.driver) {
-     bb_log(LOG_DEBUG, "Skipping auto-detection, using configured driver"
-             " '%s'\n", bb_config.driver);
-@@ -65,8 +67,8 @@
-     }
-   }
- 
--  if (strcmp(bb_config.driver, "nvidia")) {
--    set_string_value(&bb_config.ld_path, CONF_LDPATH_NVIDIA);
--    set_string_value(&bb_config.mod_path, CONF_MODPATH_NVIDIA);
-+  if (!strcmp(bb_config.driver, "nvidia")) {
-+    set_string_value(&bb_config.ld_path, getenv("BUMBLEBEE_LDPATH_NVIDIA"));
-+    set_string_value(&bb_config.mod_path, getenv("BUMBLEBEE_MODPATH_NVIDIA"));
-   }
- }

pkgs/tools/X11/bumblebee/default.nix

@@ -8,19 +8,7 @@
 
 # To test: make sure that the 'bbswitch' kernel module is installed,
 # then run 'bumblebeed' as root and 'optirun glxgears' as user.
-# To use at startup, add e.g. to configuration.nix:
+# To use at startup, see hardware.bumblebee options.
-# jobs = {
-#   bumblebeed = {
-#     name = "bumblebeed";
-#     description = "Manages the Optimus video card";
-#     startOn = "started udev and started syslogd";
-#     stopOn = "starting shutdown";
-#     exec = "bumblebeed --use-syslog";
-#     path = [ pkgs.bumblebee ];
-#     environment = { MODULE_DIR = "${config.system.modulesTree}/lib/modules"; };
-#     respawn = true;
-#   };
-# };
 
 # This nix expression supports for now only the native nvidia driver.
 # It should not be hard to generalize this approach to support the
@@ -34,7 +22,7 @@
 }:
 
 let
-  version = "3.0";
+  version = "3.2.1";
   name = "bumblebee-${version}";
 
   # isolated X11 environment with the nvidia module
@@ -61,22 +49,15 @@ let
     ignoreCollisions = true;
   };
 
-  # Custom X11 configuration for the additional xserver instance.
-  xorgConf = ./xorg.conf.nvidia;
-
 in stdenv.mkDerivation {
   inherit name;
 
   src = fetchurl {
-    url = "http://github.com/downloads/Bumblebee-Project/Bumblebee/${name}.tar.gz";
+    url = "http://bumblebee-project.org/${name}.tar.gz";
-    sha256 = "a27ddb77b282ac8b972857fdb0dc5061cf0a0982b7ac3e1cfa698b4f786e49a1";
+    sha256 = "03p3gvx99lwlavznrpg9l7jnl1yfg2adcj8jcjj0gxp20wxp060h";
   };
 
-  # 'config.patch' makes bumblebee read the active module and the nvidia configuration
+  patches = [ ./xopts.patch ];
-  # from the environment variables instead of the config file:
-  #   BUMBLEBEE_DRIVER, BUMBLEBEE_LDPATH_NVIDIA, BUMBLEBEE_MODPATH_NVIDIA
-  # These variables must be set when bumblebeed and optirun are executed.
-  patches = [ ./config.patch ./xopts.patch ];
 
   preConfigure = ''
     # Substitute the path to the actual modinfo program in module.c.
@@ -88,32 +69,25 @@ in stdenv.mkDerivation {
     # Don't use a special group, just reuse wheel.
     substituteInPlace configure \
       --replace 'CONF_GID="bumblebee"' 'CONF_GID="wheel"'
-
-    # Ensures that the config file ends up with a nonempty
-    # name of the nvidia module. This is needed, because the
-    # configuration handling code otherwise resets the
-    # data that we obtained from the environment (see config.patch)
-    export CONF_DRIVER_MODULE_NVIDIA=nvidia
   '';
 
   # Build-time dependencies of bumblebeed and optirun.
   # Note that it has several runtime dependencies.
   buildInputs = [ stdenv makeWrapper pkgconfig help2man libX11 glib libbsd ];
 
+  configureFlags = [
+    "--with-udev-rules=$out/lib/udev/rules.d"
+    "CONF_DRIVER=nvidia"
+    "CONF_DRIVER_MODULE_NVIDIA=nvidia"
+    "CONF_LDPATH_NVIDIA=${commonEnv}/lib"
+    "CONF_MODPATH_NVIDIA=${commonEnv}/lib/xorg/modules"
+  ];
+
   # create a wrapper environment for bumblebeed and optirun
   postInstall = ''
-    # remove some entries from the configuration file that would otherwise
-    # cause our environment variables to be ignored.
-    substituteInPlace "$out/etc/bumblebee/bumblebee.conf" \
-      --replace "LibraryPath=" "" \
-      --replace "XorgModulePath=" ""
-
     wrapProgram "$out/sbin/bumblebeed" \
       --prefix PATH : "${commonEnv}/sbin:${commonEnv}/bin:\$PATH" \
       --prefix LD_LIBRARY_PATH : "${commonEnv}/lib:\$LD_LIBRARY_PATH" \
-      --set BUMBLEBEE_DRIVER "nvidia" \
-      --set BUMBLEBEE_LDPATH_NVIDIA "${commonEnv}/lib" \
-      --set BUMBLEBEE_MODPATH_NVIDIA "${commonEnv}/lib/xorg/modules" \
       --set FONTCONFIG_FILE "/etc/fonts/fonts.conf" \
       --set XKB_BINDIR "${xorg.xkbcomp}/bin" \
       --set XKB_DIR "${xkeyboard_config}/etc/X11/xkb"
@@ -121,16 +95,11 @@ in stdenv.mkDerivation {
     wrapProgram "$out/bin/optirun" \
       --prefix PATH : "${commonEnv}/sbin:${commonEnv}/bin" \
       --prefix LD_LIBRARY_PATH : "${commonEnv}/lib" \
-      --set BUMBLEBEE_DRIVER "nvidia" \
-      --set BUMBLEBEE_LDPATH_NVIDIA "${commonEnv}/lib" \
-      --set BUMBLEBEE_MODPATH_NVIDIA "${commonEnv}/lib/xorg/modules"
-
-    cp ${xorgConf} "$out/etc/bumblebee/xorg.conf.nvidia"
   '';
 
   meta = {
     homepage = http://github.com/Bumblebee-Project/Bumblebee;
     description = "Daemon for managing Optimus videocards (power-on/off, spawns xservers)";
-    license = "free";
+    license = stdenv.lib.licenses.gpl3;
   };
 }

pkgs/tools/X11/bumblebee/xopts.patch

@@ -5,7 +5,7 @@
        "-nolisten", "tcp",
        "-noreset",
 +      "-xkbdir", getenv("XKB_DIR"),
-+      "-logfile", "/dev/null",
++      "-logfile", "/var/log/X.bumblebee.log",
        "-verbose", "3",
        "-isolateDevice", pci_id,
        "-modulepath",

pkgs/tools/X11/bumblebee/xorg.conf.nvidia

@@ -1,49 +0,0 @@
-Section "DRI"
-    Mode 0666
-EndSection
-
-Section "ServerLayout"
-    Identifier "Layout0"
-    Screen "Screen1"
-    Option "AutoAddDevices" "false"
-EndSection
-
-Section "Module"
-    Load "dbe"
-    Load "extmod"
-    Load "glx"
-    Load "record"
-    Load "freetype"
-    Load "type1"
-EndSection
-
-Section "Files"
-EndSection
-
-Section "Device"
-    Identifier "Device1"
-    Driver "nvidia"
-    VendorName "NVIDIA Corporation"
-    Option "NoLogo" "true"
-    Option "UseEDID" "false"
-    Option "ConnectedMonitor" "CRT-0"
-EndSection
-
-Section "Screen"
-    Identifier "Screen1"
-    Device "Device1"
-    Monitor "Monitor0"
-    DefaultDepth 24
-    SubSection "Display"
-        Depth 24
-    EndSubSection
-EndSection
-
-Section "Extensions"
-    Option "Composite" "Enable"
-EndSection
-
-Section "Monitor"
-    Identifier "Monitor0"
-    Option "DPMS"
-EndSection

pkgs/tools/misc/colord-gtk/default.nix

@@ -0,0 +1,18 @@
+{ stdenv, fetchurl, colord, intltool, glib, gtk3, pkgconfig, lcms2 }:
+
+stdenv.mkDerivation rec {
+  name = "colord-gtk-0.1.25";
+
+  src = fetchurl {
+    url = "http://www.freedesktop.org/software/colord/releases/${name}.tar.xz";
+    sha256 = "02hblw9rw24dhj0wqfw86pfq4y4icb6iaa92308a9jwa6k2923xx";
+  };
+
+  buildInputs = [ intltool colord glib gtk3 pkgconfig lcms2 ];
+
+  meta = {
+    homepage = http://www.freedesktop.org/software/colord/intro.html;
+    license = stdenv.lib.licenses.lgpl2Plus;
+    platforms = stdenv.lib.platforms.linux;
+  };
+}

pkgs/tools/networking/modemmanager/default.nix

@@ -1,19 +1,22 @@
-{ stdenv, fetchurl_gnome, udev, polkit, dbus_glib, ppp, intltool, pkgconfig }:
+{ stdenv, fetchurl, udev, polkit, dbus_glib, ppp, intltool, pkgconfig, libmbim, libqmi }:
 
 stdenv.mkDerivation rec {
-  name = src.pkgname;
+  name = "ModemManager-0.7.991";
 
-  src = fetchurl_gnome {
+  src = fetchurl {
-    project = "ModemManager";
+    url = "mirror://gnome/sources/ModemManager/0.7/${name}.tar.xz";
-    major = "0"; minor = "5"; patchlevel = "4.0"; extension = "xz";
+    sha256 = "0p8shqsbgnsazim7s52ylxjk064cbx2n1vm1jgywr7i58hsd6n4y";
-    sha256 = "1fdf5d5cc494825afe9f551248e00a2d91e220e88435b47f109ca2a707a40f1f";
   };
 
   nativeBuildInputs = [ intltool pkgconfig ];
 
-  buildInputs = [ udev polkit dbus_glib ppp ];
+  buildInputs = [ udev polkit dbus_glib ppp libmbim libqmi ];
 
-  configureFlags = "--with-polkit --with-udev-base-dir=$(out)/lib/udev";
+  configureFlags = [
+    "--with-polkit"
+    "--with-udev-base-dir=$(out)/lib/udev"
+    "--with-systemdsystemunitdir=$(out)/etc/systemd/system"
+  ];
 
   meta = {
     description = "WWAN modem manager, part of NetworkManager";

pkgs/tools/package-management/rpm/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, cpio, zlib, bzip2, file, elfutils, nspr, nss, popt, db4, xz }:
+{ stdenv, fetchurl, cpio, zlib, bzip2, file, elfutils, nspr, nss, popt, db4, xz, python }:
 
 stdenv.mkDerivation rec {
   name = "rpm-4.7.2";
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha1 = "07b90f653775329ea726ce0005c4c82f56167ca0";
   };
 
-  buildInputs = [ cpio zlib bzip2 file nspr nss popt db4 xz ];
+  buildInputs = [ cpio zlib bzip2 file nspr nss popt db4 xz python ];
 
   # Note: we don't add elfutils to buildInputs, since it provides a
   # bad `ld' and other stuff.
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   NIX_CFLAGS_LINK = "-L${elfutils}/lib";
   
-  configureFlags = "--with-external-db --without-lua";
+  configureFlags = "--with-external-db --without-lua --enable-python";
 
   meta = {
     homepage = http://www.rpm.org/;

pkgs/top-level/all-packages.nix

@@ -684,6 +684,8 @@ let
 
   colord = callPackage ../tools/misc/colord { };
 
+  colord-gtk = callPackage ../tools/misc/colord-gtk { };
+
   colordiff = callPackage ../tools/text/colordiff { };
 
   connect = callPackage ../tools/networking/connect { };
@@ -1280,6 +1282,10 @@ let
 
   libshout = callPackage ../development/libraries/libshout { };
 
+  libqmi = callPackage ../development/libraries/libqmi { };
+
+  libmbim = callPackage ../development/libraries/libmbim { };
+
   libtorrent = callPackage ../tools/networking/p2p/libtorrent { };
 
   logcheck = callPackage ../tools/system/logcheck {
@@ -2792,7 +2798,8 @@ let
 
   lessc = callPackage ../development/compilers/lessc { };
 
-  llvm = llvmPackages.llvm;
+  llvm = if stdenv.isDarwin then llvm_33 # until someone solves build problems with _34
+    else llvmPackages.llvm;
 
   llvm_34 = llvmPackages.llvm;
   llvm_33 = llvm_v ../development/compilers/llvm/3.3/llvm.nix;
@@ -2809,7 +2816,7 @@ let
     inherit newScope fetchurl;
     isl = isl_0_12;
     stdenv = if stdenv.isDarwin
-      then stdenvAdapters.overrideGCC stdenv gccApple
+      then stdenvAdapters.overrideGCC stdenv gcc48
       else stdenv;
   });
   llvmPackagesSelf = import ../development/compilers/llvm/3.4 { inherit newScope fetchurl; isl = isl_0_12; stdenv = libcxxStdenv; };
@@ -6655,13 +6662,17 @@ let
   # config options you need (e.g. by overriding extraConfig). See list of options here:
   # https://en.wikibooks.org/wiki/Grsecurity/Appendix/Grsecurity_and_PaX_Configuration_Options
   linux_3_2_grsecurity = lowPrio (lib.overrideDerivation (linux_3_2.override (args: {
-    modDirVersion = "${linux_3_2.version}-grsec";
     kernelPatches = args.kernelPatches ++ [ kernelPatches.grsecurity_3_0_3_2_54 kernelPatches.grsec_path ];
+    argsOverride = {
+      modDirVersion = "${linux_3_2.modDirVersion}-grsec";
+    };
   })) (args: grsecurityOverrider args));
 
-  linux_3_12_grsecurity = lowPrio (lib.overrideDerivation (linux_3_12.override (args: {
+  linux_3_13_grsecurity = lowPrio (lib.overrideDerivation (linux_3_13.override (args: {
-    modDirVersion = "${linux_3_12.version}-grsec";
+    kernelPatches = args.kernelPatches ++ [ kernelPatches.grsecurity_3_0_3_13_2 kernelPatches.grsec_path ];
-    kernelPatches = args.kernelPatches ++ [ kernelPatches.grsecurity_3_0_3_12_8 kernelPatches.grsec_path ];
+    argsOverride = {
+      modDirVersion = "${linux_3_13.modDirVersion}-grsec";
+    };
   })) (args: grsecurityOverrider args));
 
   linux_3_2_apparmor = lowPrio (linux_3_2.override {
@@ -6845,7 +6856,7 @@ let
   linuxPackages_3_10_tuxonice = linuxPackagesFor pkgs.linux_3_10_tuxonice linuxPackages_3_10_tuxonice;
   linuxPackages_3_11 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_3_11 linuxPackages_3_11);
   linuxPackages_3_12 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_3_12 linuxPackages_3_12);
-  linuxPackages_3_12_grsecurity = linuxPackagesFor pkgs.linux_3_12_grsecurity linuxPackages_3_12_grsecurity;
+  linuxPackages_3_13_grsecurity = linuxPackagesFor pkgs.linux_3_13_grsecurity linuxPackages_3_13_grsecurity;
   linuxPackages_3_13 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_3_13 linuxPackages_3_13);
   # Update this when adding a new version!
   linuxPackages_latest = pkgs.linuxPackages_3_13;
@@ -8103,7 +8114,7 @@ let
 
   hexedit = callPackage ../applications/editors/hexedit { };
 
-  hipchat = callPackage ../applications/networking/instant-messengers/hipchat { };
+  hipchat = callPackage_i686 ../applications/networking/instant-messengers/hipchat { };
 
   homebank = callPackage ../applications/office/homebank { };
 
@@ -9027,8 +9038,8 @@ let
   };
 
   weechat = callPackage ../applications/networking/irc/weechat {
-    # weechat crashes on /exit when using gnutls 3.1.x. gnutls 3.2.x works.
+    # weechat doesn't exit with gnutls32. Use 3.1 for now.
-    gnutls = gnutls32;
+    gnutls = gnutls31;
   };
 
   weston = callPackage ../applications/window-managers/weston { };

pkgs/top-level/haskell-packages.nix

@@ -944,6 +944,8 @@ let result = let callPackage = x : y : modifyPrio (newScope result.finalReturn x
 
   Diff = callPackage ../development/libraries/haskell/Diff {};
 
+  diff3 = callPackage ../development/libraries/haskell/diff3 {};
+
   digest = callPackage ../development/libraries/haskell/digest {
     inherit (pkgs) zlib;
   };
@@ -1216,6 +1218,8 @@ let result = let callPackage = x : y : modifyPrio (newScope result.finalReturn x
     libc = pkgs.stdenv.gcc.libc;
   };
 
+  gtkTraymanager = callPackage ../development/libraries/haskell/gtk-traymanager {};
+
   graphviz = callPackage ../development/libraries/haskell/graphviz {};
 
   groups = callPackage ../development/libraries/haskell/groups {};
@@ -1508,6 +1512,11 @@ let result = let callPackage = x : y : modifyPrio (newScope result.finalReturn x
 
   json = callPackage ../development/libraries/haskell/json {};
 
+  jsonAssertions = callPackage ../development/libraries/haskell/json-assertions {
+    aeson = self.aeson_0_7_0_0;
+    lens = self.lens_4_0_1;
+  };
+
   jsonTypes = callPackage ../development/libraries/haskell/jsonTypes {};
 
   kansasLava = callPackage ../development/libraries/haskell/kansas-lava {};
@@ -2769,6 +2778,8 @@ let result = let callPackage = x : y : modifyPrio (newScope result.finalReturn x
     QuickCheck = self.QuickCheck2;
   };
 
+  taffybar = callPackage ../applications/misc/taffybar {};
+
   yi = callPackage ../applications/editors/yi/yi.nix {};
 
   yiContrib = callPackage ../applications/editors/yi/yi-contrib.nix {};

pkgs/top-level/python-packages.nix

@@ -417,6 +417,19 @@ pythonPackages = modules // import ./python-packages-generated.nix {
   });
 
 
+  async = buildPythonPackage rec {
+    name = "async-0.6.1";
+    meta.maintainers = [ stdenv.lib.maintainers.mornfall ];
+
+    buildInputs = [ pkgs.zlib ];
+    doCheck = false;
+
+    src = fetchurl {
+      url = "https://pypi.python.org/packages/source/a/async/${name}.tar.gz";
+      sha256 = "1lfmjm8apy9qpnpbq8g641fd01qxh9jlya5g2d6z60vf8p04rla1";
+    };
+  };
+
   argparse = buildPythonPackage (rec {
     name = "argparse-1.2.1";
 
@@ -795,6 +808,17 @@ pythonPackages = modules // import ./python-packages-generated.nix {
     };
   };
 
+  bunch = buildPythonPackage (rec {
+    name = "bunch-1.0.1";
+    meta.maintainers = [ stdenv.lib.maintainers.mornfall ];
+
+    src = fetchurl {
+      url = "https://pypi.python.org/packages/source/b/bunch/${name}.tar.gz";
+      sha256 = "1akalx2pd1fjlvrq69plvcx783ppslvikqdm93z2sdybq07pmish";
+    };
+    doCheck = false;
+  });
+
 
   carrot = buildPythonPackage rec {
     name = "carrot-0.10.7";
@@ -1555,6 +1579,33 @@ pythonPackages = modules // import ./python-packages-generated.nix {
     buildInputs = [ fudge nose ];
   };
 
+  fedora_cert = buildPythonPackage (rec {
+    name = "fedora-cert-0.5.9.2";
+    meta.maintainers = [ stdenv.lib.maintainers.mornfall ];
+
+    src = fetchurl {
+      url = "https://fedorahosted.org/releases/f/e/fedora-packager/fedora-packager-0.5.9.2.tar.bz2";
+      sha256 = "105swvzshgn3g6bjwk67xd8pslnhpxwa63mdsw6cl4c7cjp2blx9";
+    };
+    installCommand = "make install";
+    propagatedBuildInputs = [ python_fedora ];
+    postInstall = "mv $out/bin/fedpkg $out/bin/fedora-cert-fedpkg";
+    doCheck = false;
+  });
+
+  fedpkg = buildPythonPackage (rec {
+    name = "fedpkg-1.14";
+    meta.maintainers = [ stdenv.lib.maintainers.mornfall ];
+
+    src = fetchurl {
+      url = "https://fedorahosted.org/releases/f/e/fedpkg/fedpkg-1.14.tar.bz2";
+      sha256 = "0rj60525f2sv34g5llafnkmpvbwrfbmfajxjc14ldwzymp8clc02";
+    };
+
+    patches = [ ../development/python-modules/fedpkg-buildfix.diff ];
+    propagatedBuildInputs = [ rpkg offtrac urlgrabber fedora_cert ];
+  });
+
   fudge = buildPythonPackage rec {
     name = "fudge-0.9.4";
     src = fetchurl {
@@ -1582,6 +1633,31 @@ pythonPackages = modules // import ./python-packages-generated.nix {
     };
   };
 
+  gitdb = buildPythonPackage rec {
+    name = "gitdb-0.5.4";
+    meta.maintainers = [ stdenv.lib.maintainers.mornfall ];
+    doCheck = false;
+
+    src = fetchurl {
+      url = "https://pypi.python.org/packages/source/g/gitdb/${name}.tar.gz";
+      sha256 = "10rpmmlln59aq44cd5vkb77hslak5pa1rbmigg6ski5f1nn2spfy";
+    };
+
+    propagatedBuildInputs = [ smmap async ];
+  };
+
+  GitPython = buildPythonPackage rec {
+    name = "GitPython-0.3.2";
+    meta.maintainers = [ stdenv.lib.maintainers.mornfall ];
+
+    src = fetchurl {
+      url = "https://pypi.python.org/packages/source/G/GitPython/GitPython-0.3.2.RC1.tar.gz";
+      sha256 = "1q4lc2ps12l517mmrxc8iq6gxyhj6d77bnk1p7mxf38d99l8crzx";
+    };
+
+    buildInputs = [ nose ];
+    propagatedBuildInputs = [ gitdb ];
+  };
 
   googlecl = buildPythonPackage rec {
     version = "0.9.14";
@@ -1619,6 +1695,22 @@ pythonPackages = modules // import ./python-packages-generated.nix {
     };
   };
 
+  koji = buildPythonPackage (rec {
+    name = "koji-1.8";
+    meta.maintainers = [ stdenv.lib.maintainers.mornfall ];
+
+    src = fetchurl {
+      url = "https://fedorahosted.org/released/koji/koji-1.8.0.tar.bz2";
+      sha256 = "10dph209h4jgajb5jmbjhqy4z4hd22i7s2d93vm3ikdf01i8iwf1";
+    };
+
+    buildPhase = ":";
+    installCommand = "make install DESTDIR=$out/ && cp -R $out/nix/store/*/* $out/ && rm -rf $out/nix";
+    doCheck = false;
+    propagatedBuildInputs = [ pythonPackages.pycurl ];
+
+  });
+
   logilab_astng = buildPythonPackage rec {
     name = "logilab-astng-0.24.1";
 
@@ -3227,6 +3319,16 @@ pythonPackages = modules // import ./python-packages-generated.nix {
       [ pkgs.unzip fs gdata python_keyczar mock pyasn1 pycrypto pytest ];
   };
 
+  kitchen = buildPythonPackage (rec {
+    name = "kitchen-1.1.1";
+    meta.maintainers = [ stdenv.lib.maintainers.mornfall ];
+
+    src = fetchurl {
+      url = "https://pypi.python.org/packages/source/k/kitchen/kitchen-1.1.1.tar.gz";
+      sha256 = "0ki840hjk1q19w6icv0dj2jxb00966nwy9b1jib0dgdspj00yrr5";
+    };
+  });
+
   pylast = buildPythonPackage rec {
     name = "pylast-${version}";
     version = "0.5.11";
@@ -4229,6 +4331,17 @@ pythonPackages = modules // import ./python-packages-generated.nix {
     };
   });
 
+  offtrac = buildPythonPackage rec {
+    name = "offtrac-0.1.0";
+    meta.maintainers = [ stdenv.lib.maintainers.mornfall ];
+
+    src = fetchurl {
+      url = "https://pypi.python.org/packages/source/o/offtrac/${name}.tar.gz";
+      sha256 = "06vd010pa1z7lyfj1na30iqzffr4kzj2k2sba09spik7drlvvl56";
+    };
+    doCheck = false;
+  };
+
   # optfunc = buildPythonPackage ( rec {
   #   name = "optfunc-git";
   #
@@ -4293,6 +4406,23 @@ pythonPackages = modules // import ./python-packages-generated.nix {
     };
   });
 
+  osc = buildPythonPackage (rec {
+    name = "osc-0.133+git";
+
+    src = fetchgit {
+      url = git://gitorious.org/opensuse/osc.git;
+      rev = "6cd541967ee2fca0b89e81470f18b97a3ffc23ce";
+      sha256 = "a39ce0e321e40e9758bf7b9128d316c71b35b80eabc84f13df492083bb6f1cc6";
+    };
+
+    buildPhase = "python setup.py build";
+    doCheck = false;
+    postInstall = "ln -s $out/bin/osc-wrapper.py $out/bin/osc";
+
+    propagatedBuildInputs = [ pythonPackages.m2crypto ];
+
+  });
+
   pandas = buildPythonPackage rec {
     name = "pandas-0.12.0";
 
@@ -5171,6 +5301,18 @@ pythonPackages = modules // import ./python-packages-generated.nix {
     };
   });
 
+  python_fedora = buildPythonPackage (rec {
+    name = "python-fedora-0.3.32.3";
+    meta.maintainers = [ stdenv.lib.maintainers.mornfall ];
+
+    src = fetchurl {
+      url = "https://fedorahosted.org/releases/p/y/python-fedora/python-fedora-0.3.32.3.tar.gz";
+      sha256 = "0qwmbid4pkdj6z9gwa43fzs97fr6ci2h2vj1hyk0gp0vqim4kv4l";
+    };
+    propagatedBuildInputs = [ kitchen requests bunch ];
+    doCheck = false;
+  });
+
   python_keyczar = buildPythonPackage rec {
     name = "python-keyczar-0.71c";
 
@@ -5941,6 +6083,24 @@ pythonPackages = modules // import ./python-packages-generated.nix {
     };
   };
 
+  rpkg = buildPythonPackage (rec {
+    name = "rpkg-1.14";
+    meta.maintainers = [ stdenv.lib.maintainers.mornfall ];
+
+    src = fetchurl {
+      url = "https://fedorahosted.org/releases/r/p/rpkg/rpkg-1.14.tar.gz";
+      sha256 = "0d053hdjz87aym1sfm6c4cxmzmy5g0gkrmrczly86skj957r77a7";
+    };
+
+    patches = [ ../development/python-modules/rpkg-buildfix.diff ];
+
+    # buildPhase = "python setup.py build";
+    # doCheck = false;
+    propagatedBuildInputs = [ pycurl koji GitPython pkgs.git
+                              pkgs.rpm pkgs.pyopenssl ];
+
+  });
+
   rtslib_fb = buildPythonPackage rec {
     version = "2.1.fb43";
     name = "rtslib-fb-${version}";
@@ -6806,6 +6966,15 @@ pythonPackages = modules // import ./python-packages-generated.nix {
   #   };
   # };
 
+  smmap = buildPythonPackage rec {
+    name = "smmap-0.8.2";
+    meta.maintainers = [ stdenv.lib.maintainers.mornfall ];
+
+    src = fetchurl {
+      url = "https://pypi.python.org/packages/source/s/smmap/${name}.tar.gz";
+      sha256 = "0vrdgr6npmajrv658fv8bij7zgm5jmz2yxkbv8kmbv25q1f9b8ny";
+    };
+  };
 
   trac = buildPythonPackage {
     name = "trac-1.0.1";