Merge remote-tracking branch 'upstream/master' into HEAD

2017-09-16 12:34:32 +02:00 · 2017-09-16 12:34:32 +02:00 · 03fa6965ad
commit 03fa6965ad
parent a31365d831 6712e0111a
175 changed files with 4611 additions and 2713 deletions
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@ -175,6 +175,12 @@ lib.mapAttrs (n: v: v // { shortName = n; }) rec {
    fullName = "DOC License";
  };

+  eapl = {
+    fullName = "EPSON AVASYS PUBLIC LICENSE";
+    url = http://avasys.jp/hp/menu000000700/hpg000000603.htm;
+    free = false;
+  };
+
  efl10 = spdx {
    spdxId = "EFL-1.0";
    fullName = "Eiffel Forum License v1.0";
@ -211,6 +217,11 @@ lib.mapAttrs (n: v: v // { shortName = n; }) rec {
    fullName = "GNU Free Documentation License v1.3";
  };

+  ffsl = {
+    fullName = "Floodgap Free Software License";
+    url = http://www.floodgap.com/software/ffsl/license.html;
+  };
+
  free = {
    fullName = "Unspecified free software license";
  };
--- a/lib/maintainers.nix
+++ b/lib/maintainers.nix
@ -304,7 +304,7 @@
  kiloreux = "Kiloreux Emperex <kiloreux@gmail.com>";
  kkallio = "Karn Kallio <tierpluspluslists@gmail.com>";
  knedlsepp = "Josef Kemetmüller <josef.kemetmueller@gmail.com>";
-  konimex = "Muhammad Herdiansyah <herdiansyah@openmailbox.org>";
+  konimex = "Muhammad Herdiansyah <herdiansyah@netc.eu>";
  koral = "Koral <koral@mailoo.org>";
  kovirobi = "Kovacsics Robert <kovirobi@gmail.com>";
  kragniz = "Louis Taylor <louis@kragniz.eu>";
@ -583,6 +583,7 @@
  thammers = "Tobias Hammerschmidt <jawr@gmx.de>";
  the-kenny = "Moritz Ulrich <moritz@tarn-vedra.de>";
  theuni = "Christian Theune <ct@flyingcircus.io>";
+  ThomasMader = "Thomas Mader <thomas.mader@gmail.com>";
  thoughtpolice = "Austin Seipp <aseipp@pobox.com>";
  timbertson = "Tim Cuthbertson <tim@gfxmonk.net>";
  titanous = "Jonathan Rudenberg <jonathan@titanous.com>";
@ -636,6 +637,7 @@
  wjlroe = "William Roe <willroe@gmail.com>";
  wkennington = "William A. Kennington III <william@wkennington.com>";
  wmertens = "Wout Mertens <Wout.Mertens@gmail.com>";
+  woffs = "Frank Doepper <github@woffs.de>";
  womfoo = "Kranium Gikos Mendoza <kranium@gikos.net>";
  wscott = "Wayne Scott <wsc9tt@gmail.com>";
  wyvie = "Elijah Rum <elijahrum@gmail.com>";
--- a/nixos/modules/installer/cd-dvd/sd-image-aarch64.nix
+++ b/nixos/modules/installer/cd-dvd/sd-image-aarch64.nix
@ -27,7 +27,8 @@ in
  boot.loader.generic-extlinux-compatible.enable = true;

  boot.kernelPackages = pkgs.linuxPackages_latest;
-  boot.kernelParams = ["console=ttyS0,115200n8" "console=tty0"];
+  # Increase the amount of CMA to ensure the virtual console on the RPi3 works.
+  boot.kernelParams = ["cma=32M" "console=ttyS0,115200n8" "console=tty0"];
  boot.consoleLogLevel = 7;

  # FIXME: this probably should be in installation-device.nix
--- a/nixos/modules/installer/tools/nix-fallback-paths.nix
+++ b/nixos/modules/installer/tools/nix-fallback-paths.nix
@ -1,5 +1,5 @@
 {
-  x86_64-linux = "/nix/store/xrqssm90gsrnqdn79rpfcs6dwx8597d2-nix-1.11.14";
-  i686-linux = "/nix/store/3vjphivqs2iy6m9yb3bd80nd3518510k-nix-1.11.14";
-  x86_64-darwin = "/nix/store/4j9jacx8mjd4jlj53wvymyhxq7dqyj5d-nix-1.11.14";
+  x86_64-linux = "/nix/store/b4s1gxiis1ryvybnjhdjvgc5sr1nq0ys-nix-1.11.15";
+  i686-linux = "/nix/store/kgb5hs7qw13bvb6icramv1ry9dard3h9-nix-1.11.15";
+  x86_64-darwin = "/nix/store/dgwz3dxdzs2wwd7pg7cdhvl8rv0qpnbj-nix-1.11.15";
 }
--- a/nixos/modules/installer/tools/nixos-install.sh
+++ b/nixos/modules/installer/tools/nixos-install.sh
@ -106,8 +106,11 @@ extraBuildFlags+=(--option "build-users-group" "$buildUsersGroup")
 binary_caches="$(@perl@/bin/perl -I @nix@/lib/perl5/site_perl/*/* -e 'use Nix::Config; Nix::Config::readConfig; print $Nix::Config::config{"binary-caches"};')"
 extraBuildFlags+=(--option "binary-caches" "$binary_caches")

+# We only need nixpkgs in the path if we don't already have a system closure to install
+if [[ -z "$closure" ]]; then
    nixpkgs="$(readlink -f "$(nix-instantiate --find-file nixpkgs)")"
    export NIX_PATH="nixpkgs=$nixpkgs:nixos-config=$mountPoint/$NIXOS_CONFIG"
+fi
 unset NIXOS_CONFIG

 # TODO: do I need to set NIX_SUBSTITUTERS here or is the --option binary-caches above enough?
@ -123,6 +126,9 @@ function closure() {
 }

 system_closure="$tmpdir/system.closure"
+# Use a FIFO for piping nix-store --export into nix-store --import, saving disk
+# I/O and space. nix-store --import is run by nixos-prepare-root.
+mkfifo $system_closure

 if [ -z "$closure" ]; then
    expr="(import <nixpkgs/nixos> {}).system"
@ -132,7 +138,9 @@ else
    system_root=$closure
    # Create a temporary file ending in .closure (so nixos-prepare-root knows to --import it) to transport the store closure
    # to the filesytem we're preparing. Also delete it on exit!
-    nix-store --export $(nix-store -qR $closure) > $system_closure
+    # Run in background to avoid blocking while trying to write to the FIFO
+    # $system_closure refers to
+    nix-store --export $(nix-store -qR $closure) > $system_closure &
 fi

 channel_root="$(nix-env -p /nix/var/nix/profiles/per-user/root/channels -q nixos --no-name --out-path 2>/dev/null || echo -n "")"
--- a/nixos/modules/programs/mtr.nix
+++ b/nixos/modules/programs/mtr.nix
@ -19,8 +19,9 @@ in {
  };

  config = mkIf cfg.enable {
-    security.wrappers.mtr = {
-      source = "${pkgs.mtr}/bin/mtr";
+    environment.systemPackages = with pkgs; [ mtr ];
+    security.wrappers.mtr-packet = {
+      source = "${pkgs.mtr}/bin/mtr-packet";
      capabilities = "cap_net_raw+p";
    };
  };
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@ -192,7 +192,6 @@ with lib;
      "Set the option `services.xserver.displayManager.sddm.package' instead.")
    (mkRemovedOptionModule [ "fonts" "fontconfig" "forceAutohint" ] "")
    (mkRemovedOptionModule [ "fonts" "fontconfig" "renderMonoTTFAsBitmap" ] "")
-    (mkRemovedOptionModule [ "boot" "zfs" "enableUnstable" ] "0.7.0 is now the default")

    # ZSH
    (mkRenamedOptionModule [ "programs" "zsh" "enableSyntaxHighlighting" ] [ "programs" "zsh" "syntaxHighlighting" "enable" ])
--- a/nixos/modules/services/mail/dovecot.nix
+++ b/nixos/modules/services/mail/dovecot.nix
@ -60,6 +60,39 @@ let
      }
    '')

+    ''
+      protocol imap {
+        namespace inbox {
+          inbox=yes
+          ${concatStringsSep "\n" (map mailboxConfig cfg.mailboxes)}
+        }
+      }
+    ''
+
+    (optionalString cfg.enableQuota ''
+      mail_plugins = $mail_plugins quota
+      service quota-status {
+        executable = ${dovecotPkg}/libexec/dovecot/quota-status -p postfix
+        inet_listener {
+          port = ${cfg.quotaPort}
+        }
+        client_limit = 1
+      }
+
+      protocol imap {
+        mail_plugins = $mail_plugins imap_quota
+      }
+
+      plugin {
+        quota_rule = *:storage=${cfg.quotaGlobalPerUser} 
+        quota = maildir:User quota # per virtual mail user quota # BUG/FIXME broken, we couldn't get this working
+        quota_status_success = DUNNO
+        quota_status_nouser = DUNNO
+        quota_status_overquota = "552 5.2.2 Mailbox is full"
+        quota_grace = 10%%
+      }
+    '')
+
    cfg.extraConfig
  ];

@ -68,6 +101,34 @@ let
    paths = map (pkg: "${pkg}/lib/dovecot") ([ dovecotPkg ] ++ map (module: module.override { dovecot = dovecotPkg; }) cfg.modules);
  };

+  mailboxConfig = mailbox: ''
+    mailbox ${mailbox.name} {
+      auto = ${toString mailbox.auto}
+  '' + optionalString (mailbox.specialUse != null) ''
+      special_use = \${toString mailbox.specialUse}
+  '' + "}";
+
+  mailboxes = { lib, pkgs, ... }: {
+    options = {
+      name = mkOption {
+        type = types.str;
+        example = "Spam";
+        description = "The name of the mailbox.";
+      };
+      auto = mkOption {
+        type = types.enum [ "no" "create" "subscribe" ];
+        default = "no";
+        example = "subscribe";
+        description = "Whether to automatically create or create and subscribe to the mailbox or not.";
+      };
+      specialUse = mkOption {
+        type = types.nullOr (types.enum [ "All" "Archive" "Drafts" "Flagged" "Junk" "Sent" "Trash" ]);
+        default = null;
+        example = "Junk";
+        description = "Null if no special use flag is set. Other than that every use flag mentioned in the RFC is valid.";
+      };
+    };
+  };
 in
 {

@ -76,7 +137,7 @@ in

    enablePop3 = mkOption {
      type = types.bool;
-      default = true;
+      default = false;
      description = "Start the POP3 listener (when Dovecot is enabled).";
    };

@ -145,6 +206,14 @@ in
      description = "Default group to store mail for virtual users.";
    };

+    createMailUser = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''Whether to automatically create the user
+        given in <option>services.dovecot.user</option> and the group
+        given in <option>services.dovecot.group</option>.'';
+    };
+
    modules = mkOption {
      type = types.listOf types.package;
      default = [];
@ -191,6 +260,36 @@ in
      default = false;
      description = "Show the PAM failure message on authentication error (useful for OTPW).";
    };
+
+    mailboxes = mkOption {
+      type = types.listOf (types.submodule mailboxes);
+      default = [];
+      example = [ { name = "Spam"; specialUse = "Junk"; auto = "create"; } ];
+      description = "Configure mailboxes and auto create or subscribe them.";
+    };
+
+    enableQuota = mkOption {
+      type = types.bool;
+      default = false;
+      example = true;
+      description = "Whether to enable the dovecot quota service.";
+    };
+
+    quotaPort = mkOption {
+      type = types.str;
+      default = "12340";
+      description = ''
+        The Port the dovecot quota service binds to.
+        If using postfix, add check_policy_service inet:localhost:12340 to your smtpd_recipient_restrictions in your postfix config.
+      '';
+    };
+    quotaGlobalPerUser = mkOption {
+      type = types.str;
+      default = "100G";
+      example = "10G";
+      description = "Quota limit for the user in bytes. Supports suffixes b, k, M, G, T and %.";
+    };
+
  };


@ -214,11 +313,19 @@ in
           uid = config.ids.uids.dovecot2;
           description = "Dovecot user";
           group = cfg.group;
+         }
+      ++ optional cfg.createMailUser
+         { name = cfg.mailUser;
+           description = "Virtual Mail User";
+           group = cfg.mailGroup;
         };

    users.extraGroups = optional (cfg.group == "dovecot2")
      { name = "dovecot2";
        gid = config.ids.gids.dovecot2;
+      }
+    ++ optional cfg.createMailUser
+      { name = cfg.mailGroup;
      };

    environment.etc."dovecot/modules".source = modulesDir;
--- a/nixos/modules/services/misc/geoip-updater.nix
+++ b/nixos/modules/services/misc/geoip-updater.nix
@ -238,7 +238,7 @@ in

    assertions = [
      { assertion = (builtins.filter
-          (x: builtins.match ".*\.(gz|xz)$" x == null) cfg.databases) == [];
+          (x: builtins.match ".*\\.(gz|xz)$" x == null) cfg.databases) == [];
        message = ''
          services.geoip-updater.databases supports only .gz and .xz databases.

@ -246,7 +246,7 @@ in
          ${toString cfg.databases}

          Offending element(s):
-          ${toString (builtins.filter (x: builtins.match ".*\.(gz|xz)$" x == null) cfg.databases)};
+          ${toString (builtins.filter (x: builtins.match ".*\\.(gz|xz)$" x == null) cfg.databases)};
        '';
      }
    ];
--- a/nixos/modules/services/networking/namecoind.nix
+++ b/nixos/modules/services/networking/namecoind.nix
@ -173,7 +173,7 @@ in

      serviceConfig = {
        User  = "namecoin";
-        Griup = "namecoin";
+        Group = "namecoin";
        ExecStart  = "${pkgs.altcoins.namecoind}/bin/namecoind -conf=${configFile} -datadir=${dataDir} -printtoconsole";
        ExecStop   = "${pkgs.coreutils}/bin/kill -KILL $MAINPID";
        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
--- a/nixos/modules/services/networking/supplicant.nix
+++ b/nixos/modules/services/networking/supplicant.nix
@ -181,18 +181,19 @@ in

      default = { };

-      example = {
-        "wlan0 wlan1" = {
+      example = literalExample ''
+        { "wlan0 wlan1" = {
            configFile = "/etc/wpa_supplicant";
            userControlled.group = "network";
-          extraConf = ''
+            extraConf = '''
              ap_scan=1
              p2p_disabled=1
-          '';
+            ''';
            extraCmdArgs = "-u -W";
            bridge = "br0";
          };
-      };
+        }
+      '';

      description = ''
        Interfaces for which to start <command>wpa_supplicant</command>.
--- a/nixos/modules/services/security/tor.nix
+++ b/nixos/modules/services/security/tor.nix
@ -17,7 +17,7 @@ let
      GeoIPv6File ${pkgs.tor.geoip}/share/tor/geoip6
    ''}

-    ${optint "ControlPort" (toString cfg.controlPort)}
+    ${optint "ControlPort" cfg.controlPort}
  ''
  # Client connection config
  + optionalString cfg.client.enable  ''
--- a/nixos/modules/tasks/filesystems/zfs.nix
+++ b/nixos/modules/tasks/filesystems/zfs.nix
@ -24,7 +24,11 @@ let

  kernel = config.boot.kernelPackages;

-  packages = {
+  packages = if config.boot.zfs.enableUnstable then {
+    spl = kernel.splUnstable;
+    zfs = kernel.zfsUnstable;
+    zfsUser = pkgs.zfsUnstable;
+  } else {
    spl = kernel.spl;
    zfs = kernel.zfs;
    zfsUser = pkgs.zfs;
@ -58,6 +62,19 @@ in

  options = {
    boot.zfs = {
+      enableUnstable = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Use the unstable zfs package. This might be an option, if the latest
+          kernel is not yet supported by a published release of ZFS. Enabling
+          this option will install a development version of ZFS on Linux. The
+          version will have already passed an extensive test suite, but it is
+          more likely to hit an undiscovered bug compared to running a released
+          version of ZFS on Linux.
+          '';
+      };
+
      extraPools = mkOption {
        type = types.listOf types.str;
        default = [];
--- a/nixos/modules/virtualisation/google-compute-image.nix
+++ b/nixos/modules/virtualisation/google-compute-image.nix
@ -117,7 +117,7 @@ in
    before = ["sshd.service"];
    wants = ["local-fs.target" "network-online.target" "network.target"];
    wantedBy = [ "sshd.service" "multi-user.target" ];
-    path = with pkgs; [ ethtool ];
+    path = with pkgs; [ ethtool openssh ];
    serviceConfig = {
      ExecStart = "${gce}/bin/google_instance_setup --debug";
      Type = "oneshot";
--- a/nixos/release.nix
+++ b/nixos/release.nix
@ -214,6 +214,7 @@ in rec {
  # Run the tests for each platform.  You can run a test by doing
  # e.g. ‘nix-build -A tests.login.x86_64-linux’, or equivalently,
  # ‘nix-build tests/login.nix -A result’.
+  tests.acme = callTest tests/acme.nix {};
  tests.avahi = callTest tests/avahi.nix {};
  tests.bittorrent = callTest tests/bittorrent.nix {};
  tests.blivet = callTest tests/blivet.nix {};
--- a/nixos/tests/acme.nix
+++ b/nixos/tests/acme.nix
@ -0,0 +1,62 @@
+let
+  commonConfig = { config, lib, pkgs, nodes, ... }: {
+    networking.nameservers = [
+      nodes.letsencrypt.config.networking.primaryIPAddress
+    ];
+
+    nixpkgs.overlays = lib.singleton (self: super: {
+      cacert = super.cacert.overrideDerivation (drv: {
+        installPhase = (drv.installPhase or "") + ''
+          cat "${nodes.letsencrypt.config.test-support.letsencrypt.caCert}" \
+            >> "$out/etc/ssl/certs/ca-bundle.crt"
+        '';
+      });
+
+      pythonPackages = (super.python.override {
+        packageOverrides = lib.const (pysuper: {
+          certifi = pysuper.certifi.overridePythonAttrs (attrs: {
+            postPatch = (attrs.postPatch or "") + ''
+              cat "${self.cacert}/etc/ssl/certs/ca-bundle.crt" \
+                > certifi/cacert.pem
+            '';
+          });
+        });
+      }).pkgs;
+    });
+  };
+
+in import ./make-test.nix {
+  name = "acme";
+
+  nodes = {
+    letsencrypt = ./common/letsencrypt.nix;
+
+    webserver = { config, pkgs, ... }: {
+      imports = [ commonConfig ];
+      networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+      networking.extraHosts = ''
+        ${config.networking.primaryIPAddress} example.com
+      '';
+
+      services.nginx.enable = true;
+      services.nginx.virtualHosts."example.com" = {
+        enableACME = true;
+        forceSSL = true;
+        locations."/".root = pkgs.runCommand "docroot" {} ''
+          mkdir -p "$out"
+          echo hello world > "$out/index.html"
+        '';
+      };
+    };
+
+    client = commonConfig;
+  };
+
+  testScript = ''
+    $letsencrypt->waitForUnit("boulder.service");
+    startAll;
+    $webserver->waitForUnit("acme-certificates.target");
+    $client->succeed('curl https://example.com/ | grep -qF "hello world"');
+  '';
+}
--- a/nixos/tests/common/letsencrypt.nix
+++ b/nixos/tests/common/letsencrypt.nix
@ -0,0 +1,446 @@
+# Fully pluggable module to have Letsencrypt's Boulder ACME service running in
+# a test environment.
+#
+# The certificate for the ACME service is exported as:
+#
+#   config.test-support.letsencrypt.caCert
+#
+# This value can be used inside the configuration of other test nodes to inject
+# the snakeoil certificate into security.pki.certificateFiles or into package
+# overlays.
+#
+# Another value that's needed if you don't use a custom resolver (see below for
+# notes on that) is to add the letsencrypt node as a nameserver to every node
+# that needs to acquire certificates using ACME, because otherwise the API host
+# for letsencrypt.org can't be resolved.
+#
+# A configuration example of a full node setup using this would be this:
+#
+# {
+#   letsencrypt = import ./common/letsencrypt.nix;
+#
+#   example = { nodes, ... }: {
+#     networking.nameservers = [
+#       nodes.letsencrypt.config.networking.primaryIPAddress
+#     ];
+#     security.pki.certificateFiles = [
+#       nodes.letsencrypt.config.test-support.letsencrypt.caCert
+#     ];
+#   };
+# }
+#
+# By default, this module runs a local resolver, generated using resolver.nix
+# from the same directory to automatically discover all zones in the network.
+#
+# If you do not want this and want to use your own resolver, you can just
+# override networking.nameservers like this:
+#
+# {
+#   letsencrypt = { nodes, ... }: {
+#     imports = [ ./common/letsencrypt.nix ];
+#     networking.nameservers = [
+#       nodes.myresolver.config.networking.primaryIPAddress
+#     ];
+#   };
+#
+#   myresolver = ...;
+# }
+#
+# Keep in mind, that currently only _one_ resolver is supported, if you have
+# more than one resolver in networking.nameservers only the first one will be
+# used.
+#
+# Also make sure that whenever you use a resolver from a different test node
+# that it has to be started _before_ the ACME service.
+{ config, pkgs, lib, ... }:
+
+let
+  softhsm = pkgs.stdenv.mkDerivation rec {
+    name = "softhsm-${version}";
+    version = "1.3.8";
+
+    src = pkgs.fetchurl {
+      url = "https://dist.opendnssec.org/source/${name}.tar.gz";
+      sha256 = "0flmnpkgp65ym7w3qyg78d3fbmvq3aznmi66rgd420n33shf7aif";
+    };
+
+    configureFlags = [ "--with-botan=${pkgs.botan}" ];
+    buildInputs = [ pkgs.sqlite ];
+  };
+
+  pkcs11-proxy = pkgs.stdenv.mkDerivation {
+    name = "pkcs11-proxy";
+
+    src = pkgs.fetchFromGitHub {
+      owner = "SUNET";
+      repo = "pkcs11-proxy";
+      rev = "944684f78bca0c8da6cabe3fa273fed3db44a890";
+      sha256 = "1nxgd29y9wmifm11pjcdpd2y293p0dgi0x5ycis55miy97n0f5zy";
+    };
+
+    postPatch = "patchShebangs mksyscalls.sh";
+
+    nativeBuildInputs = [ pkgs.cmake ];
+    buildInputs = [ pkgs.openssl pkgs.libseccomp ];
+  };
+
+  mkGoDep = { goPackagePath, url ? "https://${goPackagePath}", rev, sha256 }: {
+    inherit goPackagePath;
+    src = pkgs.fetchgit { inherit url rev sha256; };
+  };
+
+  goose = let
+    owner = "liamstask";
+    repo = "goose";
+    rev = "8488cc47d90c8a502b1c41a462a6d9cc8ee0a895";
+    version = "20150116";
+
+  in pkgs.buildGoPackage rec {
+    name = "${repo}-${version}";
+
+    src = pkgs.fetchFromBitbucket {
+      name = "${name}-src";
+      inherit rev owner repo;
+      sha256 = "1jy0pscxjnxjdg3hj111w21g8079rq9ah2ix5ycxxhbbi3f0wdhs";
+    };
+
+    goPackagePath = "bitbucket.org/${owner}/${repo}";
+    subPackages = [ "cmd/goose" ];
+    extraSrcs = map mkGoDep [
+      { goPackagePath = "github.com/go-sql-driver/mysql";
+        rev = "2e00b5cd70399450106cec6431c2e2ce3cae5034";
+        sha256 = "085g48jq9hzmlcxg122n0c4pi41sc1nn2qpx1vrl2jfa8crsppa5";
+      }
+      { goPackagePath = "github.com/kylelemons/go-gypsy";
+        rev = "08cad365cd28a7fba23bb1e57aa43c5e18ad8bb8";
+        sha256 = "1djv7nii3hy451n5jlslk0dblqzb1hia1cbqpdwhnps1g8hqjy8q";
+      }
+      { goPackagePath = "github.com/lib/pq";
+        rev = "ba5d4f7a35561e22fbdf7a39aa0070f4d460cfc0";
+        sha256 = "1mfbqw9g00bk24bfmf53wri5c2wqmgl0qh4sh1qv2da13a7cwwg3";
+      }
+      { goPackagePath = "github.com/mattn/go-sqlite3";
+        rev = "2acfafad5870400156f6fceb12852c281cbba4d5";
+        sha256 = "1rpgil3w4hh1cibidskv1js898hwz83ps06gh0hm3mym7ki8d5h7";
+      }
+      { goPackagePath = "github.com/ziutek/mymysql";
+        rev = "0582bcf675f52c0c2045c027fd135bd726048f45";
+        sha256 = "0bkc9x8sgqbzgdimsmsnhb0qrzlzfv33fgajmmjxl4hcb21qz3rf";
+      }
+      { goPackagePath = "golang.org/x/net";
+        url = "https://go.googlesource.com/net";
+        rev = "10c134ea0df15f7e34d789338c7a2d76cc7a3ab9";
+        sha256 = "14cbr2shl08gyg85n5gj7nbjhrhhgrd52h073qd14j97qcxsakcz";
+      }
+    ];
+  };
+
+  boulder = let
+    owner = "letsencrypt";
+    repo = "boulder";
+    rev = "9866abab8962a591f06db457a4b84c518cc88243";
+    version = "20170510";
+
+  in pkgs.buildGoPackage rec {
+    name = "${repo}-${version}";
+
+    src = pkgs.fetchFromGitHub {
+      name = "${name}-src";
+      inherit rev owner repo;
+      sha256 = "170m5cjngbrm36wi7wschqw8jzs7kxpcyzmshq3pcrmcpigrhna1";
+    };
+
+    postPatch = ''
+      # compat for go < 1.8
+      sed -i -e 's/time\.Until(\([^)]\+\))/\1.Sub(time.Now())/' \
+        test/ocsp/helper/helper.go
+
+      find test -type f -exec sed -i -e '/libpkcs11-proxy.so/ {
+        s,/usr/local,${pkcs11-proxy},
+      }' {} +
+
+      sed -i -r \
+        -e '/^def +install/a \    return True' \
+        -e 's,exec \./bin/,,' \
+        test/startservers.py
+
+      cat "${snakeOilCa}/ca.key" > test/test-ca.key
+      cat "${snakeOilCa}/ca.pem" > test/test-ca.pem
+    '';
+
+    goPackagePath = "github.com/${owner}/${repo}";
+    buildInputs = [ pkgs.libtool ];
+  };
+
+  boulderSource = "${boulder.out}/share/go/src/${boulder.goPackagePath}";
+
+  softHsmConf = pkgs.writeText "softhsm.conf" ''
+    0:/var/lib/softhsm/slot0.db
+    1:/var/lib/softhsm/slot1.db
+  '';
+
+  snakeOilCa = pkgs.runCommand "snakeoil-ca" {
+    buildInputs = [ pkgs.openssl ];
+  } ''
+    mkdir "$out"
+    openssl req -newkey rsa:4096 -x509 -sha256 -days 36500 \
+      -subj '/CN=Snakeoil CA' -nodes \
+      -out "$out/ca.pem" -keyout "$out/ca.key"
+  '';
+
+  createAndSignCert = fqdn: let
+    snakeoilCertConf = pkgs.writeText "snakeoil.cnf" ''
+      [req]
+      default_bits = 4096
+      prompt = no
+      default_md = sha256
+      req_extensions = req_ext
+      distinguished_name = dn
+      [dn]
+      CN = ${fqdn}
+      [req_ext]
+      subjectAltName = DNS:${fqdn}
+    '';
+  in pkgs.runCommand "snakeoil-certs-${fqdn}" {
+    buildInputs = [ pkgs.openssl ];
+  } ''
+    mkdir "$out"
+    openssl genrsa -out "$out/snakeoil.key" 4096
+    openssl req -new -key "$out/snakeoil.key" \
+      -config ${lib.escapeShellArg snakeoilCertConf} \
+      -out snakeoil.csr
+    openssl x509 -req -in snakeoil.csr -sha256 -set_serial 666 \
+      -CA "${snakeOilCa}/ca.pem" -CAkey "${snakeOilCa}/ca.key" \
+      -extfile ${lib.escapeShellArg snakeoilCertConf} \
+      -out "$out/snakeoil.pem" -days 36500
+  '';
+
+  wfeCerts = createAndSignCert wfeDomain;
+  wfeDomain = "acme-v01.api.letsencrypt.org";
+  wfeCertFile = "${wfeCerts}/snakeoil.pem";
+  wfeKeyFile = "${wfeCerts}/snakeoil.key";
+
+  siteCerts = createAndSignCert siteDomain;
+  siteDomain = "letsencrypt.org";
+  siteCertFile = "${siteCerts}/snakeoil.pem";
+  siteKeyFile = "${siteCerts}/snakeoil.key";
+
+  # Retrieved via:
+  # curl -s -I https://acme-v01.api.letsencrypt.org/terms \
+  #   | sed -ne 's/^[Ll]ocation: *//p'
+  tosUrl = "https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf";
+  tosPath = builtins.head (builtins.match "https?://[^/]+(.*)" tosUrl);
+
+  tosFile = pkgs.fetchurl {
+    url = tosUrl;
+    sha256 = "08b2gacdz23mzji2pjr1pwnk82a84rzvr36isif7mmi9kydl6wv3";
+  };
+
+  resolver = let
+    message = "You need to define a resolver for the letsencrypt test module.";
+    firstNS = lib.head config.networking.nameservers;
+  in if config.networking.nameservers == [] then throw message else firstNS;
+
+  cfgDir = pkgs.stdenv.mkDerivation {
+    name = "boulder-config";
+    src = "${boulderSource}/test/config";
+    nativeBuildInputs = [ pkgs.jq ];
+    phases = [ "unpackPhase" "patchPhase" "installPhase" ];
+    postPatch = ''
+      sed -i -e 's/5002/80/' -e 's/5002/443/' va.json
+      sed -i -e '/listenAddress/s/:4000/:80/' wfe.json
+      sed -i -r \
+        -e ${lib.escapeShellArg "s,http://boulder:4000/terms/v1,${tosUrl},g"} \
+        -e 's,http://(boulder|127\.0\.0\.1):4000,https://${wfeDomain},g' \
+        -e '/dnsResolver/s/127\.0\.0\.1:8053/${resolver}:53/' \
+        *.json
+      if grep 4000 *.json; then exit 1; fi
+
+      # Change all ports from 1909X to 909X, because the 1909X range of ports is
+      # allocated by startservers.py in order to intercept gRPC communication.
+      sed -i -e 's/\<1\(909[0-9]\)\>/\1/' *.json
+
+      # Patch out all additional issuer certs
+      jq '. + {ca: (.ca + {Issuers:
+        [.ca.Issuers[] | select(.CertFile == "test/test-ca.pem")]
+      })}' ca.json > tmp
+      mv tmp ca.json
+    '';
+    installPhase = "cp -r . \"$out\"";
+  };
+
+  components = {
+    gsb-test-srv.args = "-apikey my-voice-is-my-passport";
+    gsb-test-srv.waitForPort = 6000;
+    gsb-test-srv.first = true;
+    boulder-sa.args = "--config ${cfgDir}/sa.json";
+    boulder-wfe.args = "--config ${cfgDir}/wfe.json";
+    boulder-ra.args = "--config ${cfgDir}/ra.json";
+    boulder-ca.args = "--config ${cfgDir}/ca.json";
+    boulder-va.args = "--config ${cfgDir}/va.json";
+    boulder-publisher.args = "--config ${cfgDir}/publisher.json";
+    boulder-publisher.waitForPort = 9091;
+    ocsp-updater.args = "--config ${cfgDir}/ocsp-updater.json";
+    ocsp-updater.after = [ "boulder-publisher" ];
+    ocsp-responder.args = "--config ${cfgDir}/ocsp-responder.json";
+    ct-test-srv = {};
+    mail-test-srv.args = "--closeFirst 5";
+  };
+
+  commonPath = [ softhsm pkgs.mariadb goose boulder ];
+
+  mkServices = a: b: with lib; listToAttrs (concatLists (mapAttrsToList a b));
+
+  componentServices = mkServices (name: attrs: let
+    mkSrvName = n: "boulder-${n}.service";
+    firsts = lib.filterAttrs (lib.const (c: c.first or false)) components;
+    firstServices = map mkSrvName (lib.attrNames firsts);
+    firstServicesNoSelf = lib.remove "boulder-${name}.service" firstServices;
+    additionalAfter = firstServicesNoSelf ++ map mkSrvName (attrs.after or []);
+    needsPort = attrs ? waitForPort;
+    inits = map (n: "boulder-init-${n}.service") [ "mysql" "softhsm" ];
+    portWaiter = {
+      name = "boulder-${name}";
+      value = {
+        description = "Wait For Port ${toString attrs.waitForPort} (${name})";
+        after = [ "boulder-real-${name}.service" "bind.service" ];
+        requires = [ "boulder-real-${name}.service" ];
+        requiredBy = [ "boulder.service" ];
+        serviceConfig.Type = "oneshot";
+        serviceConfig.RemainAfterExit = true;
+        script = let
+          netcat = "${pkgs.netcat-openbsd}/bin/nc";
+          portCheck = "${netcat} -z 127.0.0.1 ${toString attrs.waitForPort}";
+        in "while ! ${portCheck}; do :; done";
+      };
+    };
+  in lib.optional needsPort portWaiter ++ lib.singleton {
+    name = if needsPort then "boulder-real-${name}" else "boulder-${name}";
+    value = {
+      description = "Boulder ACME Component (${name})";
+      after = inits ++ additionalAfter;
+      requires = inits;
+      requiredBy = [ "boulder.service" ];
+      path = commonPath;
+      environment.GORACE = "halt_on_error=1";
+      environment.SOFTHSM_CONF = softHsmConf;
+      environment.PKCS11_PROXY_SOCKET = "tcp://127.0.0.1:5657";
+      serviceConfig.WorkingDirectory = boulderSource;
+      serviceConfig.ExecStart = "${boulder}/bin/${name} ${attrs.args or ""}";
+      serviceConfig.Restart = "on-failure";
+    };
+  }) components;
+
+in {
+  imports = [ ./resolver.nix ];
+
+  options.test-support.letsencrypt.caCert = lib.mkOption {
+    type = lib.types.path;
+    description = ''
+      A certificate file to use with the <literal>nodes</literal> attribute to
+      inject the snakeoil CA certificate used in the ACME server into
+      <option>security.pki.certificateFiles</option>.
+    '';
+  };
+
+  config = {
+    test-support = {
+      resolver.enable = let
+        isLocalResolver = config.networking.nameservers == [ "127.0.0.1" ];
+      in lib.mkOverride 900 isLocalResolver;
+      letsencrypt.caCert = "${snakeOilCa}/ca.pem";
+    };
+
+    # This has priority 140, because modules/testing/test-instrumentation.nix
+    # already overrides this with priority 150.
+    networking.nameservers = lib.mkOverride 140 [ "127.0.0.1" ];
+    networking.firewall.enable = false;
+
+    networking.extraHosts = ''
+      127.0.0.1 ${toString [
+        "sa.boulder" "ra.boulder" "wfe.boulder" "ca.boulder" "va.boulder"
+        "publisher.boulder" "ocsp-updater.boulder" "admin-revoker.boulder"
+        "boulder" "boulder-mysql" wfeDomain
+      ]}
+      ${config.networking.primaryIPAddress} ${wfeDomain} ${siteDomain}
+    '';
+
+    services.mysql.enable = true;
+    services.mysql.package = pkgs.mariadb;
+
+    services.nginx.enable = true;
+    services.nginx.recommendedProxySettings = true;
+    services.nginx.virtualHosts.${wfeDomain} = {
+      onlySSL = true;
+      enableACME = false;
+      sslCertificate = wfeCertFile;
+      sslCertificateKey = wfeKeyFile;
+      locations."/".proxyPass = "http://127.0.0.1:80";
+    };
+    services.nginx.virtualHosts.${siteDomain} = {
+      onlySSL = true;
+      enableACME = false;
+      sslCertificate = siteCertFile;
+      sslCertificateKey = siteKeyFile;
+      locations.${tosPath}.extraConfig = "alias ${tosFile};";
+    };
+
+    systemd.services = {
+      pkcs11-daemon = {
+        description = "PKCS11 Daemon";
+        after = [ "boulder-init-softhsm.service" ];
+        before = map (n: "${n}.service") (lib.attrNames componentServices);
+        wantedBy = [ "multi-user.target" ];
+        environment.SOFTHSM_CONF = softHsmConf;
+        environment.PKCS11_DAEMON_SOCKET = "tcp://127.0.0.1:5657";
+        serviceConfig.ExecStart = let
+          softhsmLib = "${softhsm}/lib/softhsm/libsofthsm.so";
+        in "${pkcs11-proxy}/bin/pkcs11-daemon ${softhsmLib}";
+      };
+
+      boulder-init-mysql = {
+        description = "Boulder ACME Init (MySQL)";
+        after = [ "mysql.service" ];
+        serviceConfig.Type = "oneshot";
+        serviceConfig.RemainAfterExit = true;
+        serviceConfig.WorkingDirectory = boulderSource;
+        path = commonPath;
+        script = "${pkgs.bash}/bin/sh test/create_db.sh";
+      };
+
+      boulder-init-softhsm = {
+        description = "Boulder ACME Init (SoftHSM)";
+        environment.SOFTHSM_CONF = softHsmConf;
+        serviceConfig.Type = "oneshot";
+        serviceConfig.RemainAfterExit = true;
+        serviceConfig.WorkingDirectory = boulderSource;
+        preStart = "mkdir -p /var/lib/softhsm";
+        path = commonPath;
+        script = ''
+          softhsm --slot 0 --init-token \
+            --label intermediate --pin 5678 --so-pin 1234
+          softhsm --slot 0 --import test/test-ca.key \
+            --label intermediate_key --pin 5678 --id FB
+          softhsm --slot 1 --init-token \
+            --label root --pin 5678 --so-pin 1234
+          softhsm --slot 1 --import test/test-root.key \
+            --label root_key --pin 5678 --id FA
+        '';
+      };
+
+      boulder = {
+        description = "Boulder ACME Server";
+        after = map (n: "${n}.service") (lib.attrNames componentServices);
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig.Type = "oneshot";
+        serviceConfig.RemainAfterExit = true;
+        script = let
+          ports = lib.range 8000 8005 ++ lib.singleton 80;
+          netcat = "${pkgs.netcat-openbsd}/bin/nc";
+          mkPortCheck = port: "${netcat} -z 127.0.0.1 ${toString port}";
+          checks = "(${lib.concatMapStringsSep " && " mkPortCheck ports})";
+        in "while ! ${checks}; do :; done";
+      };
+    } // componentServices;
+  };
+}
--- a/nixos/tests/common/resolver.nix
+++ b/nixos/tests/common/resolver.nix
@ -0,0 +1,141 @@
+# This module automatically discovers zones in BIND and NSD NixOS
+# configurations and creates zones for all definitions of networking.extraHosts
+# (except those that point to 127.0.0.1 or ::1) within the current test network
+# and delegates these zones using a fake root zone served by a BIND recursive
+# name server.
+{ config, nodes, pkgs, lib, ... }:
+
+{
+  options.test-support.resolver.enable = lib.mkOption {
+    type = lib.types.bool;
+    default = true;
+    internal = true;
+    description = ''
+      Whether to enable the resolver that automatically discovers zone in the
+      test network.
+
+      This option is <literal>true</literal> by default, because the module
+      defining this option needs to be explicitly imported.
+
+      The reason this option exists is for the
+      <filename>nixos/tests/common/letsencrypt.nix</filename> module, which
+      needs that option to disable the resolver once the user has set its own
+      resolver.
+    '';
+  };
+
+  config = lib.mkIf config.test-support.resolver.enable {
+    networking.firewall.enable = false;
+    services.bind.enable = true;
+    services.bind.cacheNetworks = lib.mkForce [ "any" ];
+    services.bind.forwarders = lib.mkForce [];
+    services.bind.zones = lib.singleton {
+      name = ".";
+      file = let
+        addDot = zone: zone + lib.optionalString (!lib.hasSuffix "." zone) ".";
+        mkNsdZoneNames = zones: map addDot (lib.attrNames zones);
+        mkBindZoneNames = zones: map (zone: addDot zone.name) zones;
+        getZones = cfg: mkNsdZoneNames cfg.services.nsd.zones
+                     ++ mkBindZoneNames cfg.services.bind.zones;
+
+        getZonesForNode = attrs: {
+          ip = attrs.config.networking.primaryIPAddress;
+          zones = lib.filter (zone: zone != ".") (getZones attrs.config);
+        };
+
+        zoneInfo = lib.mapAttrsToList (lib.const getZonesForNode) nodes;
+
+        # A and AAAA resource records for all the definitions of
+        # networking.extraHosts except those for 127.0.0.1 or ::1.
+        #
+        # The result is an attribute set with keys being the host name and the
+        # values are either { ipv4 = ADDR; } or { ipv6 = ADDR; } where ADDR is
+        # the IP address for the corresponding key.
+        recordsFromExtraHosts = let
+          getHostsForNode = lib.const (n: n.config.networking.extraHosts);
+          allHostsList = lib.mapAttrsToList getHostsForNode nodes;
+          allHosts = lib.concatStringsSep "\n" allHostsList;
+
+          reIp = "[a-fA-F0-9.:]+";
+          reHost = "[a-zA-Z0-9.-]+";
+
+          matchAliases = str: let
+            matched = builtins.match "[ \t]+(${reHost})(.*)" str;
+            continue = lib.singleton (lib.head matched)
+                    ++ matchAliases (lib.last matched);
+          in if matched == null then [] else continue;
+
+          matchLine = str: let
+            result = builtins.match "[ \t]*(${reIp})[ \t]+(${reHost})(.*)" str;
+          in if result == null then null else {
+            ipAddr = lib.head result;
+            hosts = lib.singleton (lib.elemAt result 1)
+                 ++ matchAliases (lib.last result);
+          };
+
+          skipLine = str: let
+            rest = builtins.match "[^\n]*\n(.*)" str;
+          in if rest == null then "" else lib.head rest;
+
+          getEntries = str: acc: let
+            result = matchLine str;
+            next = getEntries (skipLine str);
+            newEntry = acc ++ lib.singleton result;
+            continue = if result == null then next acc else next newEntry;
+          in if str == "" then acc else continue;
+
+          isIPv6 = str: builtins.match ".*:.*" str != null;
+          loopbackIps = [ "127.0.0.1" "::1" ];
+          filterLoopback = lib.filter (e: !lib.elem e.ipAddr loopbackIps);
+
+          allEntries = lib.concatMap (entry: map (host: {
+            inherit host;
+            ${if isIPv6 entry.ipAddr then "ipv6" else "ipv4"} = entry.ipAddr;
+          }) entry.hosts) (filterLoopback (getEntries (allHosts + "\n") []));
+
+          mkRecords = entry: let
+            records = lib.optional (entry ? ipv6) "AAAA ${entry.ipv6}"
+                   ++ lib.optional (entry ? ipv4) "A ${entry.ipv4}";
+            mkRecord = typeAndData: "${entry.host}. IN ${typeAndData}";
+          in lib.concatMapStringsSep "\n" mkRecord records;
+
+        in lib.concatMapStringsSep "\n" mkRecords allEntries;
+
+        # All of the zones that are subdomains of existing zones.
+        # For example if there is only "example.com" the following zones would
+        # be 'subZones':
+        #
+        #  * foo.example.com.
+        #  * bar.example.com.
+        #
+        # While the following would *not* be 'subZones':
+        #
+        #  * example.com.
+        #  * com.
+        #
+        subZones = let
+          allZones = lib.concatMap (zi: zi.zones) zoneInfo;
+          isSubZoneOf = z1: z2: lib.hasSuffix z2 z1 && z1 != z2;
+        in lib.filter (z: lib.any (isSubZoneOf z) allZones) allZones;
+
+        # All the zones without 'subZones'.
+        filteredZoneInfo = map (zi: zi // {
+          zones = lib.filter (x: !lib.elem x subZones) zi.zones;
+        }) zoneInfo;
+
+      in pkgs.writeText "fake-root.zone" ''
+        $TTL 3600
+        . IN SOA ns.fakedns. admin.fakedns. ( 1 3h 1h 1w 1d )
+        ns.fakedns. IN A ${config.networking.primaryIPAddress}
+        . IN NS ns.fakedns.
+        ${lib.concatImapStrings (num: { ip, zones }: ''
+          ns${toString num}.fakedns. IN A ${ip}
+          ${lib.concatMapStrings (zone: ''
+          ${zone} IN NS ns${toString num}.fakedns.
+          '') zones}
+        '') (lib.filter (zi: zi.zones != []) filteredZoneInfo)}
+        ${recordsFromExtraHosts}
+      '';
+    };
+  };
+}
--- a/pkgs/applications/altcoins/go-ethereum.nix
+++ b/pkgs/applications/altcoins/go-ethereum.nix
@ -2,7 +2,7 @@

 buildGoPackage rec {
  name = "go-ethereum-${version}";
-  version = "1.6.7";
+  version = "1.7.0";
  goPackagePath = "github.com/ethereum/go-ethereum";

  # Fixes Cgo related build failures (see https://github.com/NixOS/nixpkgs/issues/25959 )
@ -12,7 +12,7 @@ buildGoPackage rec {
    owner = "ethereum";
    repo = "go-ethereum";
    rev = "v${version}";
-    sha256 = "19cq0pmif4y33v34jzvam4mcszl8vf2saf2gzfz01l4x1iv4hf1r";
+    sha256 = "0ybjaiyrfb320rab6a5r9iiqvkrcd8b2qvixzx0kjmc4a7l1q5zh";
  };

  # Fix cyclic referencing on Darwin
@ -23,9 +23,10 @@ buildGoPackage rec {
    done
  '';

-  meta = {
+  meta = with stdenv.lib; {
    homepage = https://ethereum.github.io/go-ethereum/;
    description = "Official golang implementation of the Ethereum protocol";
-    license = with lib.licenses; [ lgpl3 gpl3 ];
+    license = with licenses; [ lgpl3 gpl3 ];
+    maintainers = [ maintainers.adisbladis ];
  };
 }
--- a/pkgs/applications/audio/mopidy-gmusic/default.nix
+++ b/pkgs/applications/audio/mopidy-gmusic/default.nix
@ -13,7 +13,7 @@ pythonPackages.buildPythonApplication rec {
    mopidy
    pythonPackages.requests
    pythonPackages.gmusicapi
-    pythonPackages.cachetools
+    pythonPackages.cachetools_1
  ];

  doCheck = false;
--- a/pkgs/applications/editors/atom/default.nix
+++ b/pkgs/applications/editors/atom/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "atom-${version}";
-  version = "1.19.7";
+  version = "1.20.0";

  src = fetchurl {
    url = "https://github.com/atom/atom/releases/download/v${version}/atom-amd64.deb";
-    sha256 = "0ividd7bmx0fqz1ykcx5cbnd6qyms1h7r662pcclyzzm3vxj9zif";
+    sha256 = "1jzpa44ny78djdxc8d2w4jz1m68xmi8bzq87q3wmdffa4g9z4aa0";
    name = "${name}.deb";
  };

--- a/pkgs/applications/editors/emacs/macport.nix
+++ b/pkgs/applications/editors/emacs/macport.nix
@ -4,21 +4,21 @@
 }:

 stdenv.mkDerivation rec {
-  emacsVersion = "25.2";
+  emacsVersion = "25.3";
  emacsName = "emacs-${emacsVersion}";
-  macportVersion = "6.3";
+  macportVersion = "6.7";
  name = "emacs-mac-${emacsVersion}-${macportVersion}";

  builder = ./builder.sh;

  src = fetchurl {
    url = "mirror:///gnu/emacs/${emacsName}.tar.xz";
-    sha256 = "1ykkq0xl28ljdg61bm6gzy04ww86ajms98gix72qg6cpr6a53dar";
+    sha256 = "02y00y9q42g1iqgz5qhmsja75hwxd88yrn9zp14lanay0zkwafi5";
  };

  macportSrc = fetchurl {
    url = "ftp://ftp.math.s.chiba-u.ac.jp/emacs/${emacsName}-mac-${macportVersion}.tar.gz";
-    sha256 = "1dz11frk3ya3842lb89ixzpns9bz5f9njxdkyvjy75gfymqfhhzv";
+    sha256 = "0fivrasvigszr31w8wg8kb808hmqv2cc8klrm9n0hdxwg5fs5d0y";
  };

  hiresSrc = fetchurl {
--- a/pkgs/applications/editors/sublime3/default.nix
+++ b/pkgs/applications/editors/sublime3/default.nix
@ -6,7 +6,7 @@ assert stdenv.system == "i686-linux" || stdenv.system == "x86_64-linux";
 assert gksuSupport -> gksu != null;

 let
-  build = "3126";
+  build = "3143";
  libPath = stdenv.lib.makeLibraryPath [glib xorg.libX11 gtk2 cairo pango];
  redirects = [ "/usr/bin/pkexec=${pkexecPath}" ]
    ++ stdenv.lib.optional gksuSupport "/usr/bin/gksudo=${gksu}/bin/gksudo";
@ -20,13 +20,13 @@ in let
        fetchurl {
          name = "sublimetext-${build}.tar.bz2";
          url = "https://download.sublimetext.com/sublime_text_3_build_${build}_x32.tar.bz2";
-          sha256 = "0acff4wj1s61x3xszdd93lkhaqa26lb7ryqdxnbphxzhf2jfzzwj";
+          sha256 = "0dgpx4wij2m77f478p746qadavab172166bghxmj7fb61nvw9v5i";
        }
      else
        fetchurl {
          name = "sublimetext-${build}.tar.bz2";
          url = "https://download.sublimetext.com/sublime_text_3_build_${build}_x64.tar.bz2";
-          sha256 = "0ykj33fq86iv7f9zx76h90pl9y86iri0idhlj09a6prhk8p17nqq";
+          sha256 = "06b554d2cvpxc976rvh89ix3kqc7klnngvk070xrs8wbyb221qcw";
        };

    dontStrip = true;
--- a/pkgs/applications/graphics/PythonMagick/default.nix
+++ b/pkgs/applications/graphics/PythonMagick/default.nix
@ -8,7 +8,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "mirror://imagemagick/python/releases/PythonMagick-${version}.tar.xz";
-    sha256 = "0vkgpmrdz530nyvmjahpdrvcj7fd7hvsp15d485hq6103qycisv8";
+    sha256 = "137278mfb5079lns2mmw73x8dhpzgwha53dyl00mmhj2z25varpn";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/applications/graphics/awesomebump/default.nix
+++ b/pkgs/applications/graphics/awesomebump/default.nix
@ -28,6 +28,11 @@ stdenv.mkDerivation {
        --run "cd $d"
    '';

+  # RPATH in /tmp hack
+  preFixup = ''
+    rm -r $NIX_BUILD_TOP/__nix_qt5__
+  '';
+
  meta = {
    homepage = https://github.com/kmkolasinski/AwesomeBump;
    description = "A program to generate normal, height, specular or ambient occlusion textures from a single image";
--- a/pkgs/applications/graphics/gocr/default.nix
+++ b/pkgs/applications/graphics/gocr/default.nix
@ -8,7 +8,18 @@ stdenv.mkDerivation rec {
    sha256 = "1dgmcpapy7h68d53q2c5d0bpgzgfb2nw2blndnx9qhc7z12149mw";
  };

+  buildFlags = [ "all" "libs" ];
+  installFlags = [ "libdir=/lib/" ]; # Specify libdir so Makefile will also install library.
+
+  preInstall = "mkdir -p $out/lib";
+
  postInstall = ''
+    for i in pgm2asc.h gocr.h; do
+      install -D -m644 src/$i $out/include/gocr/$i
+    done
+  '';
+
+  preFixup = ''
    sed -i -e 's|exec wish|exec ${tk}/bin/wish|' $out/bin/gocr.tcl
  '';

--- a/pkgs/applications/misc/doomseeker/default.nix
+++ b/pkgs/applications/misc/doomseeker/default.nix
@ -1,11 +1,11 @@
 { stdenv, cmake, fetchurl, pkgconfig, qt4, zlib, bzip2 }:

 stdenv.mkDerivation rec {
-  name = "doomseeker-1.0";
+  name = "doomseeker-1.1";

  src = fetchurl {
    url = "http://doomseeker.drdteam.org/files/${name}_src.tar.bz2";
-    sha256 = "172ybxg720r64hp6aah0hqvxklqv1cf8v7kwx0ng5ap0h20jydbw";
+    sha256 = "0nmq8s842z30ngzikrmfx0xpnk4klxdv37y26chs002rnj010r7h";
  };

  buildInputs = [ qt4 zlib bzip2 ];
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@ -2,7 +2,7 @@

 buildGoPackage rec {
  name = "hugo-${version}";
-  version = "0.27";
+  version = "0.27.1";

  goPackagePath = "github.com/gohugoio/hugo";

@ -10,7 +10,7 @@ buildGoPackage rec {
    owner = "gohugoio";
    repo = "hugo";
    rev = "v${version}";
-    sha256 = "1r64pwk5g50gwriawmsgza6j8m4jymg8mwgwh1rplpsdfxqdfrbx";
+    sha256 = "0vxzjwm9dsan314cz0gnj4spssg4w8y6ywsak8n9c6w0l45xf07p";
  };

  goDeps = ./deps.nix;
--- a/pkgs/applications/misc/josm/default.nix
+++ b/pkgs/applications/misc/josm/default.nix
@ -1,17 +1,15 @@
-{ fetchurl, stdenv, makeDesktopItem, unzip, bash, jre8 }:
+{ fetchurl, stdenv, makeDesktopItem, makeWrapper, unzip, bash, jre8 }:

 stdenv.mkDerivation rec {
  name = "josm-${version}";
-  version = "12545";
+  version = "12712";

  src = fetchurl {
    url = "https://josm.openstreetmap.de/download/josm-snapshot-${version}.jar";
-    sha256 = "0817mjc4118b5hhfvx67bib1lhcg8mdkzibrpa2mb7hrv38q56y4";
+    sha256 = "0lpz4yzkvjpn5g36nibrkh773jnlkiqj6lghsx69i86h0xfb7gqf";
  };

-  phases = [ "installPhase" ];
-
-  buildInputs = [ jre8 ];
+  buildInputs = [ jre8 makeWrapper ];

  desktopItem = makeDesktopItem {
    name = "josm";
@ -23,14 +21,12 @@ stdenv.mkDerivation rec {
    categories = "Education;Geoscience;Maps;";
  };

-  installPhase = ''
+  buildCommand = ''
    mkdir -p $out/bin $out/share/java
    cp -v $src $out/share/java/josm.jar
-    cat > $out/bin/josm <<EOF
-    #!${bash}/bin/bash
-    exec ${jre8}/bin/java -jar $out/share/java/josm.jar "\$@"
-    EOF
-    chmod 755 $out/bin/josm
+
+    makeWrapper ${jre8}/bin/java $out/bin/josm \
+      --add-flags "-jar $out/share/java/josm.jar"

    mkdir -p $out/share/applications
    cp $desktopItem/share/applications"/"* $out/share/applications
--- a/pkgs/applications/misc/k2pdfopt/default.nix
+++ b/pkgs/applications/misc/k2pdfopt/default.nix
@ -1,105 +1,92 @@
-# Build procedure lifted from https://aur.archlinux.org/packages/k2/k2pdfopt/PKGBUILD
-{ stdenv, fetchzip, fetchurl, writeScript, libX11, libXext, autoconf, automake, libtool
-      , leptonica, libpng, libtiff, zlib, openjpeg, freetype, jbig2dec, djvulibre
-      , openssl }:
+{ stdenv, fetchzip, fetchurl, fetchpatch, cmake, pkgconfig
+, zlib, libpng
+, enableGSL ? true, gsl
+, enableGhostScript ? true, ghostscript
+, enableMuPDF ? true, jbig2dec, openjpeg, freetype, harfbuzz, mupdf
+, enableJPEG2K ? true, jasper
+, enableDJVU ? true, djvulibre
+, enableGOCR ? false, gocr # Disabled by default due to crashes
+, enableTesseract ? true, leptonica, tesseract
+}:

-let
-  mupdf_src = fetchurl {
-    url = http://www.mupdf.com/downloads/archive/mupdf-1.6-source.tar.gz;
-    sha256 = "0qx51rj6alzcagcixm59rvdpm54w6syrwr4184v439jh14ryw4wq";
-  };
+with stdenv.lib;

-  tess_src = fetchurl {
-    url = http://tesseract-ocr.googlecode.com/files/tesseract-ocr-3.02.02.tar.gz;
-    sha256 = "0g81m9y4iydp7kgr56mlkvjdwpp3mb01q385yhdnyvra7z5kkk96";
-  };
-
-  gocr_src = fetchurl {
-    url = http://www-e.uni-magdeburg.de/jschulen/ocr/gocr-0.49.tar.gz;
-    sha256 = "06hpzp7rkkwfr1fvmc8kcfz9v490i9yir7f7imh13gmka0fr6afc";
-  };
-
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
  name = "k2pdfopt-${version}";
-  version = "2.32";
+  version = "2.42";
+
  src = fetchzip {
    url = "http://www.willus.com/k2pdfopt/src/k2pdfopt_v${version}_src.zip";
-    sha256 = "1v3cj5bwpjvy7s66sfqcmkxs91f7nxaykjpdjm2wn87vn6q7n19m";
+    sha256 = "1zag4jmkr0qrcpqqb5davmvdrabhdyz87q4zz0xpfkl6xw2dn9bk";
  };

-  buildInputs = [ libX11 libXext autoconf automake libtool leptonica libpng libtiff zlib
-                    openjpeg freetype jbig2dec djvulibre openssl ];
-  NIX_LDFLAGS = "-lX11 -lXext";
+  patches = [ ./k2pdfopt.patch ];

-  hardeningDisable = [ "format" ];
+  nativeBuildInputs = [ cmake pkgconfig ];

-  k2_pa = ./k2pdfopt.patch;
-  tess_pa = ./tesseract.patch;
+  buildInputs =
+  let
+    mupdf_modded = mupdf.overrideAttrs (attrs: {
+      name = "mupdf-1.10a";
+      src = fetchurl {
+        url = "http://mupdf.com/downloads/archive/mupdf-1.10a-source.tar.gz";
+        sha256 = "0dm8wcs8i29aibzkqkrn8kcnk4q0kd1v66pg48h5c3qqp4v1zk5a";
+      };
+      # Excluded the pdf-*.c files, since they mostly just broke the #includes
+      prePatch = ''
+        cp ${src}/mupdf_mod/{font,stext-device,string}.c source/fitz/
+        cp ${src}/mupdf_mod/font-win32.c source/pdf/
+      '';
+      # Patches from previous 1.10a version in nixpkgs
+      patches = [
+        # Compatibility with new openjpeg
+        (fetchpatch {
+         name = "mupdf-1.9a-openjpeg-2.1.1.patch";
+         url = "https://git.archlinux.org/svntogit/community.git/plain/mupdf/trunk/0001-mupdf-openjpeg.patch?id=5a28ad0a8999a9234aa7848096041992cc988099";
+         sha256 = "1i24qr4xagyapx4bijjfksj4g3bxz8vs5c2mn61nkm29c63knp75";
+        })

-  builder = writeScript "builder.sh" ''
-    . ${stdenv}/setup
-    set -e
+        (fetchurl {
+         name = "CVE-2017-5896.patch";
+         url = "http://git.ghostscript.com/?p=mupdf.git;a=patch;h=2c4e5867ee699b1081527bc6c6ea0e99a35a5c27";
+         sha256 = "14k7x47ifx82sds1c06ibzbmcparfg80719jhgwjk6w1vkh4r693";
+        })
+      ];
+    });
+    leptonica_modded = leptonica.overrideAttrs (attrs: {
+      prePatch = ''
+        cp ${src}/leptonica_mod/* src/
+      '';
+    });
+    tesseract_modded = tesseract.overrideAttrs (attrs: {
+      prePatch = ''
+        cp ${src}/tesseract_mod/{ambigs.cpp,ccutil.h,ccutil.cpp} ccutil/
+        cp ${src}/tesseract_mod/dawg.cpp api/
+        cp ${src}/tesseract_mod/{imagedata.cpp,tessdatamanager.cpp} ccstruct/
+        cp ${src}/tesseract_mod/openclwrapper.h opencl/
+        cp ${src}/tesseract_mod/{tessedit.cpp,thresholder.cpp} ccmain/
+        cp ${src}/tesseract_mod/tess_lang_mod_edge.h cube/
+        cp ${src}/tesseract_mod/tesscapi.cpp api/
+        cp ${src}/include_mod/{tesseract.h,leptonica.h} api/
+      '';
+      patches = [ ./tesseract.patch ];
+    });
+  in
+    [ zlib libpng ] ++
+    optional enableGSL gsl ++
+    optional enableGhostScript ghostscript ++
+    optionals enableMuPDF [ jbig2dec openjpeg freetype harfbuzz mupdf_modded ] ++
+    optionals enableJPEG2K [ jasper ] ++
+    optional enableDJVU djvulibre ++
+    optional enableGOCR gocr ++
+    optionals enableTesseract [ leptonica_modded tesseract_modded ];

-    plibs=`pwd`/patched_libraries
+  dontUseCmakeBuildDir = true;

-    tar zxf ${mupdf_src}
-    cp $src/mupdf_mod/font.c $src/mupdf_mod/string.c mupdf-1.6-source/source/fitz/
-    cp $src/mupdf_mod/pdf-* mupdf-1.6-source/source/pdf
+  cmakeFlags = [ "-DCMAKE_C_FLAGS=-I${src}/include_mod" ];

-    tar zxf ${tess_src}
-    cp $src/tesseract_mod/dawg.cpp tesseract-ocr/dict
-    cp $src/tesseract_mod/tessdatamanager.cpp tesseract-ocr/ccutil
-    cp $src/tesseract_mod/tessedit.cpp tesseract-ocr/ccmain
-    cp $src/tesseract_mod/tesscapi.cpp tesseract-ocr/api
-    cp $src/include_mod/tesseract.h $src/include_mod/leptonica.h tesseract-ocr/api
-
-    cp -a $src k2pdfopt_v2.21
-    chmod -R +w k2pdfopt_v2.21
-
-    patch -p0 -i $tess_pa
-    patch -p0 -i $k2_pa
-
-    cd tesseract-ocr
-    ./autogen.sh
-    substituteInPlace "configure" \
-            --replace 'LIBLEPT_HEADERSDIR="/usr/local/include /usr/include"' \
-            'LIBLEPT_HEADERSDIR=${leptonica}/include'
-    ./configure --prefix=$plibs --disable-shared
-    make install
-
-    cd ..
-    tar zxf ${gocr_src}
-    cd gocr-0.49
-    ./configure
-    cp src/{gocr.h,pnm.h,unicode.h,list.h} $plibs/include
-    cp include/config.h $plibs/include
-    make libs
-    cp src/libPgm2asc.a $plibs/lib
-
-    cd ../mupdf-1.6-source
-    make prefix=$plibs install
-    install -Dm644 build/debug/libmujs.a $plibs/lib
-
-    cd ../k2pdfopt_v2.21/k2pdfoptlib
-    gcc -Ofast -Wall -c *.c -I ../include_mod/ -I $plibs/include \
-        -I . -I ../willuslib
-    ar rcs libk2pdfopt.a *.o
-
-    cd ../willuslib
-    gcc -Ofast -Wall -c *.c -I ../include_mod/ -I $plibs/include
-    ar rcs libwillus.a *.o
-
-    cd ..
-    gcc -Wall -Ofast -o k2pdfopt.o -c k2pdfopt.c -I k2pdfoptlib/ -I willuslib/ \
-            -I include_mod/ -I $plibs/include
-    g++ -Ofast k2pdfopt.o -o k2pdfopt -I willuslib/ -I k2pdfoptlib/ -I include_mod/ \
-            -I $plibs/include -L $plibs/lib/ \
-            -L willuslib/ -L k2pdfoptlib/ -lk2pdfopt -lwillus -ldjvulibre -lz -lmupdf  \
-            -ljbig2dec -ljpeg -lopenjp2 -lpng -lfreetype -lpthread -lmujs \
-            -lPgm2asc -llept -ltesseract -lcrypto
-
-    mkdir -p $out/bin
-    cp k2pdfopt $out/bin
+  installPhase = ''
+    install -D -m 755 k2pdfopt $out/bin/k2pdfopt
  '';

  meta = with stdenv.lib; {
@ -107,7 +94,7 @@ in stdenv.mkDerivation rec {
    homepage = http://www.willus.com/k2pdfopt;
    license = licenses.gpl3;
    platforms = platforms.linux;
-    maintainers = [ maintainers.bosu ];
+    maintainers = with maintainers; [ bosu danielfullmer ];
  };
 }

--- a/pkgs/applications/misc/k2pdfopt/k2pdfopt.patch
+++ b/pkgs/applications/misc/k2pdfopt/k2pdfopt.patch
@ -1,95 +1,99 @@
-diff -aur k2pdfopt_v2.21/willuslib/array.c k2pdfopt_v2.21.new/willuslib/array.c
--- k2pdfopt_v2.21/willuslib/array.c	2014-05-23 16:29:58.000000000 -0300
-+++ k2pdfopt_v2.21.new/willuslib/array.c	2014-07-26 11:35:49.829825567 -0300
-@@ -1055,7 +1055,7 @@
- void arrayf_sort(float *a,int n)
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 4a2378b..502c477 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -52,6 +52,7 @@ endif(JPEG_FOUND)
+ include(FindJasper)
+ if(JASPER_FOUND)
+   set(HAVE_JASPER_LIB 1)
+  set(K2PDFOPT_LIB ${K2PDFOPT_LIB} ${JASPER_LIBRARY})
+ endif(JASPER_FOUND)
 
-     {
-    sort(a,(long)n);
-+    willus_sort(a,(long)n);
-     }
+ # paths from willuslib/wgs.c
+@@ -66,8 +67,12 @@ else()
+   message(STATUS "Could NOT find ghostscript executable")
+ endif(GHOSTSCRIPT_EXECUTABLE)
+ 
+-# willus.h
+-# HAVE_GSL_LIB
+pkg_check_modules(GSL gsl)
+if(MUPDF_FOUND)
+  set(HAVE_GSL_LIB 1)
+  include_directories(SYSTEM ${GSL_INCLUDEDIR})
+  set(K2PDFOPT_LIB ${K2PDFOPT_LIB} ${GSL_LDFLAGS})
+endif(MUPDF_FOUND)
 
 
-diff -aur k2pdfopt_v2.21/willuslib/math.c k2pdfopt_v2.21.new/willuslib/math.c
--- k2pdfopt_v2.21/willuslib/math.c	2013-08-15 21:33:50.000000000 -0300
-+++ k2pdfopt_v2.21.new/willuslib/math.c	2014-07-26 11:36:02.853170659 -0300
-@@ -532,7 +532,7 @@
+ # libfreetype6 (>= 2.3.9), libjbig2dec0, libjpeg8 (>= 8c), libx11-6, libxext6, zlib1g (>= 1:1.2.0)
+@@ -80,7 +85,7 @@ if(MUPDF_FOUND)
+   include_directories(SYSTEM ${MUPDF_INCLUDEDIR})
+   message(STATUS "mupdf libraries: ${MUPDF_LDFLAGS}")
+   set(K2PDFOPT_LIB ${K2PDFOPT_LIB} ${MUPDF_LDFLAGS} 
+-    -lmupdf-js-none -lopenjpeg -ljbig2dec -ljpeg -lfreetype
+    -lopenjp2 -ljbig2dec -ljpeg -lfreetype -lharfbuzz
+   )
+ endif(MUPDF_FOUND)
 
+@@ -91,9 +96,25 @@ if(DJVU_FOUND)
+   set(K2PDFOPT_LIB ${K2PDFOPT_LIB} ${DJVU_LDFLAGS})
+ endif(DJVU_FOUND)
 
+-# HAVE_GOCR_LIB
+-# HAVE_LEPTONICA_LIB
+-# HAVE_TESSERACT_LIB
+find_library(GOCR_LIB NAMES Pgm2asc)
+if(GOCR_LIB)
+  set(HAVE_GOCR_LIB 1)
+  set(K2PDFOPT_LIB ${K2PDFOPT_LIB} ${GOCR_LIB})
+endif(GOCR_LIB)
+
+pkg_check_modules(LEPTONICA lept)
+if(LEPTONICA_FOUND)
+  set(HAVE_LEPTONICA_LIB 1)
+  include_directories(SYSTEM ${LEPTONICA_INCLUDEDIR})
+  set(K2PDFOPT_LIB ${K2PDFOPT_LIB} ${LEPTONICA_LDFLAGS})
+endif(LEPTONICA_FOUND)
+
+pkg_check_modules(TESSERACT tesseract)
+if(TESSERACT_FOUND)
+  set(HAVE_TESSERACT_LIB 1)
+  include_directories(SYSTEM ${TESSERACT_INCLUDEDIR})
+  set(K2PDFOPT_LIB ${K2PDFOPT_LIB} ${TESSERACT_LDFLAGS})
+endif(TESSERACT_FOUND)
 
-void sort(float *x,int n)
-+void willus_sort(float *x,int n)
+ # ---- Describe project
 
-     {
-     int top,n1;
-diff -aur k2pdfopt_v2.21/willuslib/ocrjocr.c k2pdfopt_v2.21.new/willuslib/ocrjocr.c
--- k2pdfopt_v2.21/willuslib/ocrjocr.c	2012-11-12 13:09:42.000000000 -0300
-+++ k2pdfopt_v2.21.new/willuslib/ocrjocr.c	2014-07-26 11:36:46.699837185 -0300
+diff --git a/willuslib/CMakeLists.txt b/willuslib/CMakeLists.txt
+index 463bbc9..8043db5 100644
+--- a/willuslib/CMakeLists.txt
+++ b/willuslib/CMakeLists.txt
+@@ -6,7 +6,7 @@ include_directories(..)
+ set(WILLUSLIB_SRC
+     ansi.c array.c bmp.c bmpdjvu.c bmpmupdf.c dtcompress.c filelist.c
+     fontdata.c fontrender.c gslpolyfit.c linux.c math.c mem.c ocr.c
+-    ocrjocr.c ocrtess.c pdfwrite.c point2d.c render.c strbuf.c string.c
+    ocrgocr.c ocrtess.c pdfwrite.c point2d.c render.c strbuf.c string.c
+     token.c wfile.c wgs.c wgui.c willusversion.c win.c winbmp.c
+     wincomdlg.c winmbox.c winshell.c wmupdf.c wmupdfinfo.c wpdf.c wsys.c
+     wzfile.c wleptonica.c
+diff --git a/willuslib/ocrgocr.c b/willuslib/ocrgocr.c
+index 6027e9a..fbe10f0 100644
+--- a/willuslib/ocrgocr.c
+++ b/willuslib/ocrgocr.c
@@ -29,6 +29,8 @@
 #ifdef HAVE_GOCR_LIB
 #include <gocr.h>
 
-+job_t *JOB;
+job_t *OCR_JOB;
 +
 /*
 ** bmp8 must be grayscale
 ** (x1,y1) and (x2,y2) from top left of bitmap
-@@ -66,6 +68,7 @@
+@@ -63,6 +65,7 @@ void gocr_single_word_from_bmp8(char *text,int maxlen,WILLUSBITMAP *bmp8,
     h=y2-y1+1;
     dh=h+bw*2;
     job=&_job;
-+    JOB=job;
+    OCR_JOB=job;
     job_init(job);
     job_init_image(job);
     // willus_mem_alloc_warn((void **)&job->src.p.p,w*h,funcname,10);
-diff -aur k2pdfopt_v2.21/willuslib/string.c k2pdfopt_v2.21.new/willuslib/string.c
--- k2pdfopt_v2.21/willuslib/string.c	2014-02-03 00:37:44.000000000 -0300
-+++ k2pdfopt_v2.21.new/willuslib/string.c	2014-07-26 11:37:01.766506277 -0300
-@@ -81,7 +81,7 @@
- ** Returns NULL if EOF, otherwise returns pointer to the string.
- **
- */
-char *get_line(char *buf,int max,FILE *f)
-+char *willus_get_line(char *buf,int max,FILE *f)
- 
-     {
-     int     i;
-diff -aur k2pdfopt_v2.21/willuslib/willus.h k2pdfopt_v2.21.new/willuslib/willus.h
--- k2pdfopt_v2.21/willuslib/willus.h	2014-07-25 15:03:51.000000000 -0300
-+++ k2pdfopt_v2.21.new/willuslib/willus.h	2014-07-26 11:37:56.316506038 -0300
-@@ -214,9 +214,6 @@
- ** CMAKE handles the defines, not this source
- ** (Mod from Dirk Thierbach, 31-Dec-2013)
- */
-#ifdef USE_CMAKE
-#include "config.h"
-#else /* USE_CMAKE */
- 
- #ifndef HAVE_Z_LIB
- #define HAVE_Z_LIB
-@@ -268,7 +265,6 @@
- #undef HAVE_GSL_LIB
- #endif
- 
-#endif /* USE_CMAKE */
- /*
- ** Consistency check
- */
-@@ -533,7 +529,7 @@
-                       int *n,FILE *err);
- int    readxyz_ex    (char *filename,double **x,double **y,double **z,
-                       int *n,FILE *err,int ignore_after_semicolon);
-void   sort          (float *x,int n);
-+void   willus_sort          (float *x,int n);
- void   sortd         (double *x,int n);
- void   sorti         (int *x,int n);
- void   sortxy        (float *x,float *y,int n);
-@@ -602,7 +598,7 @@
- /* string.c */
- void   clean_line    (char *buf);
- void   clean_line_end(char *buf);
-char  *get_line      (char *buf,int max,FILE *f);
-+char  *willus_get_line      (char *buf,int max,FILE *f);
- char  *get_line_cf   (char *buf,int max,FILE *f);
- int   mem_get_line_cf(char *buf,int maxlen,char *cptr,long *cindex,long csize);
- int    in_string     (char *buffer,char *pattern);
--- a/pkgs/applications/misc/k2pdfopt/tesseract.patch
+++ b/pkgs/applications/misc/k2pdfopt/tesseract.patch
@ -1,12 +1,13 @@
-diff -aur tesseract-ocr/api/Makefile.am tesseract-ocr.new/api/Makefile.am
--- tesseract-ocr/api/Makefile.am	2012-10-09 14:18:39.000000000 -0300
-+++ tesseract-ocr.new/api/Makefile.am	2014-03-20 18:43:13.926030341 -0300
-@@ -36,7 +36,7 @@
+diff --git a/api/Makefile.am b/api/Makefile.am
+index d8c1e54..46ead13 100644
+--- a/api/Makefile.am
+++ b/api/Makefile.am
+@@ -42,7 +42,7 @@ libtesseract_api_la_CPPFLAGS = $(AM_CPPFLAGS)
 if VISIBILITY
 libtesseract_api_la_CPPFLAGS += -DTESS_EXPORTS
 endif
-libtesseract_api_la_SOURCES = baseapi.cpp capi.cpp
-+libtesseract_api_la_SOURCES = baseapi.cpp capi.cpp tesscapi.cpp
+-libtesseract_api_la_SOURCES = baseapi.cpp capi.cpp renderer.cpp pdfrenderer.cpp
+libtesseract_api_la_SOURCES = baseapi.cpp capi.cpp renderer.cpp pdfrenderer.cpp tesscapi.cpp
 
 lib_LTLIBRARIES += libtesseract.la
 libtesseract_la_LDFLAGS = 
--- a/pkgs/applications/misc/pitz/default.nix
+++ b/pkgs/applications/misc/pitz/default.nix
@ -1,34 +0,0 @@
-{ stdenv, fetchurl, buildPythonApplication, tempita, jinja2, pyyaml, clepy, mock
-, nose, decorator, docutils
-}:
-
-# TODO: pitz has a pitz-shell utility that depends on ipython, but it just
-# errors out and dies (it probably depends on an old ipython version):
-#
-#   from IPython.Shell import IPShellEmbed
-#   ImportError: No module named Shell
-#
-# pitz-shell is not the primary interface, so it is not critical to have it
-# working. Concider fixing pitz upstream.
-
-buildPythonApplication rec {
-  name = "pitz-1.2.4";
-  namePrefix = "";
-
-  src = fetchurl {
-    url = "mirror://pypi/p/pitz/${name}.tar.gz";
-    sha256 = "1k7f3h4acllzqy3mjqnjd4w5jskp03s79b7dx3c85vlmd7824smr";
-  };
-
-  # propagatedBuildInputs is needed for pitz to find its dependencies at
-  # runtime. If we use buildInputs it would just build, not run.
-  propagatedBuildInputs = [ tempita jinja2 pyyaml clepy mock nose decorator docutils ];
-
-  meta = with stdenv.lib; {
-    description = "Distributed bugtracker";
-    license = licenses.bsd3;
-    homepage = http://pitz.tplus1.com/;
-    platforms = platforms.linux;
-    maintainers = [ maintainers.bjornfor ];
-  };
-}
--- a/pkgs/applications/networking/browsers/chromium/browser.nix
+++ b/pkgs/applications/networking/browsers/chromium/browser.nix
@ -12,11 +12,10 @@ mkChromiumDerivation (base: rec {
  sandboxExecutableName = "__chromium-suid-sandbox";

  installPhase = ''
-    mkdir -p "$libExecPath/swiftshader"
+    mkdir -p "$libExecPath"
    cp -v "$buildPath/"*.pak "$buildPath/"*.bin "$libExecPath/"
    cp -v "$buildPath/icudtl.dat" "$libExecPath/"
    cp -vLR "$buildPath/locales" "$buildPath/resources" "$libExecPath/"
-    cp -v "$buildPath/swiftshader/"*.so "$libExecPath/swiftshader/"
    cp -v "$buildPath/chrome" "$libExecPath/$packageName"

    if [ -e "$buildPath/libwidevinecdmadapter.so" ]; then
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@ -117,7 +117,10 @@ let

    patches = [
      ./patches/nix_plugin_paths_52.patch
-      ./patches/chromium-gn-bootstrap-r8.patch
+      ./patches/chromium-gn-bootstrap-r14.patch
+      ./patches/chromium-gcc-r1.patch
+      ./patches/chromium-atk-r1.patch
+      ./patches/chromium-gcc5-r1.patch
      # To enable ChromeCast, go to chrome://flags and set "Load Media Router Component Extension" to Enabled
      # Fixes Chromecast: https://bugs.chromium.org/p/chromium/issues/detail?id=734325
      ./patches/fix_network_api_crash.patch
--- a/pkgs/applications/networking/browsers/chromium/patches/chromium-atk-r1.patch
+++ b/pkgs/applications/networking/browsers/chromium/patches/chromium-atk-r1.patch
@ -0,0 +1,11 @@
+--- a/content/browser/accessibility/browser_accessibility_auralinux.cc.orig	2017-07-27 06:28:01.090257874 +0000
+++ b/content/browser/accessibility/browser_accessibility_auralinux.cc	2017-07-27 06:28:21.174653680 +0000
+@@ -571,7 +571,7 @@
+ // it's best to leave this out rather than break people's builds:
+ #if defined(ATK_CHECK_VERSION)
+ #if ATK_CHECK_VERSION(2, 16, 0)
+-      atk_state_set_add_state(atk_state_set, ATK_STATE_READ_ONLY);
+      atk_state_set_add_state(state_set, ATK_STATE_READ_ONLY);
+ #endif
+ #endif
+       break;
--- a/pkgs/applications/networking/browsers/chromium/patches/chromium-gcc-r1.patch
+++ b/pkgs/applications/networking/browsers/chromium/patches/chromium-gcc-r1.patch
@ -0,0 +1,14 @@
+diff --git a/base/numerics/safe_math_shared_impl.h b/base/numerics/safe_math_shared_impl.h
+index 99f230ce7e9a..de2415d402f5 100644
+--- a/base/numerics/safe_math_shared_impl.h
+++ b/base/numerics/safe_math_shared_impl.h
+@@ -21,8 +21,7 @@
+ #if !defined(__native_client__) &&                         \
+     ((defined(__clang__) &&                                \
+       ((__clang_major__ > 3) ||                            \
+-       (__clang_major__ == 3 && __clang_minor__ >= 4))) || \
+-     (defined(__GNUC__) && __GNUC__ >= 5))
+       (__clang_major__ == 3 && __clang_minor__ >= 4))))
+ #include "base/numerics/safe_math_clang_gcc_impl.h"
+ #define BASE_HAS_OPTIMIZED_SAFE_MATH (1)
+ #else
--- a/pkgs/applications/networking/browsers/chromium/patches/chromium-gcc5-r1.patch
+++ b/pkgs/applications/networking/browsers/chromium/patches/chromium-gcc5-r1.patch
@ -0,0 +1,66 @@
+--- a/chrome/browser/devtools/devtools_file_system_indexer.cc
+++ b/chrome/browser/devtools/devtools_file_system_indexer.cc
+@@ -34,7 +34,6 @@ using base::TimeDelta;
+ using base::TimeTicks;
+ using content::BrowserThread;
+ using std::map;
+-using std::set;
+ using std::string;
+ using std::vector;
+ 
+@@ -191,7 +190,7 @@ vector<FilePath> Index::Search(const string& query) {
+     if (trigram != kUndefinedTrigram)
+       trigrams.push_back(trigram);
+   }
+-  set<FileId> file_ids;
+  std::set<FileId> file_ids;
+   bool first = true;
+   vector<Trigram>::const_iterator it = trigrams.begin();
+   for (; it != trigrams.end(); ++it) {
+@@ -203,7 +202,7 @@ vector<FilePath> Index::Search(const string& query) {
+       first = false;
+       continue;
+     }
+-    set<FileId> intersection = base::STLSetIntersection<set<FileId> >(
+    std::set<FileId> intersection = base::STLSetIntersection<std::set<FileId> >(
+         file_ids, index_[trigram]);
+     file_ids.swap(intersection);
+   }
+diff --git a/third_party/WebKit/Source/platform/wtf/typed_arrays/ArrayBufferContents.h b/third_party/WebKit/Source/platform/wtf/typed_arrays/ArrayBufferContents.h
+index 94bb9161ec85..e40c6387f72e 100644
+--- a/third_party/WebKit/Source/platform/wtf/typed_arrays/ArrayBufferContents.h
+++ b/third_party/WebKit/Source/platform/wtf/typed_arrays/ArrayBufferContents.h
+@@ -63,7 +63,7 @@ class WTF_EXPORT ArrayBufferContents {
+           allocation_length_(0),
+           data_(data),
+           data_length_(0),
+-          kind_(AllocationKind::kNormal),
+          kind_(WTF::ArrayBufferContents::AllocationKind::kNormal),
+           deleter_(deleter) {}
+     DataHandle(void* allocation_base,
+                size_t allocation_length,
+@@ -94,11 +94,11 @@ class WTF_EXPORT ArrayBufferContents {
+              reinterpret_cast<uintptr_t>(allocation_base_) +
+                  allocation_length_);
+       switch (kind_) {
+-        case AllocationKind::kNormal:
+        case WTF::ArrayBufferContents::AllocationKind::kNormal:
+           DCHECK(deleter_);
+           deleter_(data_);
+           return;
+-        case AllocationKind::kReservation:
+        case WTF::ArrayBufferContents::AllocationKind::kReservation:
+           ReleaseReservedMemory(allocation_base_, allocation_length_);
+           return;
+       }
+--- a/third_party/webrtc/modules/audio_processing/aec3/aec_state.cc.orig	2017-08-15 12:45:59.433532111 +0000
+++ b/third_party/webrtc/modules/audio_processing/aec3/aec_state.cc	2017-08-15 17:52:59.691328825 +0000
+@@ -10,7 +10,7 @@
+ 
+ #include "webrtc/modules/audio_processing/aec3/aec_state.h"
+ 
+-#include <math.h>
+#include <cmath>
+ #include <numeric>
+ #include <vector>
+ 
--- a/pkgs/applications/networking/browsers/chromium/patches/chromium-gn-bootstrap-r14.patch
+++ b/pkgs/applications/networking/browsers/chromium/patches/chromium-gn-bootstrap-r14.patch
@ -0,0 +1,27 @@
+commit 96c271f8ab2be7ea4199078ea65ac50c6ada4685
+Author: Pawel Hajdan, Jr <phajdan.jr@chromium.org>
+Date:   Wed Jul 26 21:51:54 2017 +0000
+
+    wip
+
+diff --git a/tools/gn/bootstrap/bootstrap.py b/tools/gn/bootstrap/bootstrap.py
+index 1390560f8e37..ff2ae57c46b0 100755
+--- a/tools/gn/bootstrap/bootstrap.py
+++ b/tools/gn/bootstrap/bootstrap.py
+@@ -449,6 +449,7 @@ def write_gn_ninja(path, root_gen_dir, options):
+       'base/metrics/histogram_base.cc',
+       'base/metrics/histogram_functions.cc',
+       'base/metrics/histogram_samples.cc',
+      'base/metrics/histogram_snapshot_manager.cc',
+       'base/metrics/metrics_hashes.cc',
+       'base/metrics/persistent_histogram_allocator.cc',
+       'base/metrics/persistent_memory_allocator.cc',
+@@ -534,7 +535,7 @@ def write_gn_ninja(path, root_gen_dir, options):
+       'base/trace_event/heap_profiler_allocation_context_tracker.cc',
+       'base/trace_event/heap_profiler_allocation_register.cc',
+       'base/trace_event/heap_profiler_event_filter.cc',
+-      'base/trace_event/heap_profiler_event_writer.cc',
+      'base/trace_event/heap_profiler_heap_dump_writer.cc',
+       'base/trace_event/heap_profiler_serialization_state.cc',
+       'base/trace_event/heap_profiler_stack_frame_deduplicator.cc',
+       'base/trace_event/heap_profiler_type_name_deduplicator.cc',
--- a/pkgs/applications/networking/browsers/chromium/patches/chromium-gn-bootstrap-r8.patch
+++ b/pkgs/applications/networking/browsers/chromium/patches/chromium-gn-bootstrap-r8.patch
@ -1,13 +0,0 @@
-Index: tools/gn/bootstrap/bootstrap.py
-diff --git a/tools/gn/bootstrap/bootstrap.py b/tools/gn/bootstrap/bootstrap.py
-index 6f2f5b1264519ea38cc36fb0b7e2cc24c378ca7a..0b03d2626b358fb90ab39d737679ee47bd60303b 100755
--- a/tools/gn/bootstrap/bootstrap.py
-+++ b/tools/gn/bootstrap/bootstrap.py
-@@ -487,6 +487,7 @@ def write_gn_ninja(path, root_gen_dir, options):
-       'base/sys_info.cc',
-       'base/task_runner.cc',
-       'base/task_scheduler/delayed_task_manager.cc',
-+      'base/task_scheduler/environment_config.cc',
-       'base/task_scheduler/post_task.cc',
-       'base/task_scheduler/priority_queue.cc',
-       'base/task_scheduler/scheduler_lock_impl.cc',
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@ -1,18 +1,18 @@
 # This file is autogenerated from update.sh in the same directory.
 {
  beta = {
-    sha256 = "1sh3rq36sh4g7blajvqfvs06fs5sbrbdp50qq0cvcj4k3fmb4bd8";
-    sha256bin64 = "1w67y4z57qm5fwniayncly7a4mjmwqir7gfd54ny8lwlf247d43m";
-    version = "60.0.3112.78";
+    sha256 = "09q7s5x22vnmvqyz0f1l6qnaryglmsp0rc63qcg5sfvgv2g17g5x";
+    sha256bin64 = "12z6z8gjxl4mx8j6db8nnlzrj03rh4qwyrvcf4hqcsv7b1armg6j";
+    version = "61.0.3163.79";
  };
  dev = {
-    sha256 = "0yan2dzx1854f3xslif5682rkb82a1li6vxj12z5s5fxqijhj1jq";
-    sha256bin64 = "0ddva2rqnid2gcx3qh72p41wc15869w2w9n0rbdpn662rpl041v1";
-    version = "61.0.3163.25";
+    sha256 = "168i6dcdl13an3vlr2m83q8fcprgckmclkmzwj70jdkp84qx80fq";
+    sha256bin64 = "116vddp01m2ls337zj6r4h1nvybphvldlk9bs8czypx5skn29vbz";
+    version = "62.0.3202.9";
  };
  stable = {
-    sha256 = "1rirhwvccidza4q4z1gqdwcd9v1bymh1m9r2cq8jhiabfrjpjbxl";
-    sha256bin64 = "1lw349ips0sgyls3arv864yq5xykfn9jilwkalvllaq6yvdvcvlk";
-    version = "60.0.3112.90";
+    sha256 = "09q7s5x22vnmvqyz0f1l6qnaryglmsp0rc63qcg5sfvgv2g17g5x";
+    sha256bin64 = "0a0wd06c0v061lnmb8x20gqgsg9zqafp2kq1fl3cjm0ldg9rwayw";
+    version = "61.0.3163.79";
  };
 }
--- a/pkgs/applications/networking/cluster/minikube/default.nix
+++ b/pkgs/applications/networking/cluster/minikube/default.nix
@ -15,15 +15,15 @@ let
  # instead, we download localkube ourselves and shove it into the minikube binary. The versions URL that minikube uses is
  # currently https://storage.googleapis.com/minikube/k8s_releases.json

-  localkube-version = "1.7.4";
+  localkube-version = "1.7.5";
  localkube-binary = fetchurl {
    url = "https://storage.googleapis.com/minikube/k8sReleases/v${localkube-version}/localkube-linux-amd64";
-    sha256 = "1v9zq6ivcs2qvdmhidvvp0krd1sxgqvqpp4bcl9is85vpdxhk95b";
+    sha256 = "1kn4lwnn961r19hqnkgr13np80zqk2fhp8xkhrvxzq6v6shk7gfz";
  };
 in buildGoPackage rec {
  pname   = "minikube";
  name    = "${pname}-${version}";
-  version = "0.22.0";
+  version = "0.22.1";

  goPackagePath = "k8s.io/minikube";

@ -31,7 +31,7 @@ in buildGoPackage rec {
    owner  = "kubernetes";
    repo   = "minikube";
    rev    = "v${version}";
-    sha256 = "118l98kxzn6npq67nmylanfy9pvd1vd9hvsr2rkzrsvhzzk13kh4";
+    sha256 = "015ffsb7xx82y0dl38gayv2v9v33v99qmssd5djl21dhb3j79yba";
  };

  # kubernetes is here only to shut up a loud warning when generating the completions below. minikube checks very eagerly
--- a/pkgs/applications/networking/cluster/openshift/default.nix
+++ b/pkgs/applications/networking/cluster/openshift/default.nix
@ -1,7 +1,7 @@
-{ stdenv, fetchFromGitHub, which, buildGoPackage }:
+{ stdenv, fetchFromGitHub, which, buildGoPackage, utillinux, coreutils }:

 let
-  version = "1.5.0";
+  version = "3.6.0";
  ver = stdenv.lib.elemAt (stdenv.lib.splitString "." version);
  versionMajor = ver 0;
  versionMinor = ver 1;
@ -14,7 +14,7 @@ in buildGoPackage rec {
    owner = "openshift";
    repo = "origin";
    rev = "v${version}";
-    sha256 = "0qvyxcyca3888nkgvyvqcmybm95ncwxb3zvrzbg2gz8kx6g6350v";
+    sha256 = "08bdqvsjl6c7dmllyz8n4akb7gyn91znvbph5cgmmk1bhskycy1r";
  };

  buildInputs = [ which ];
@ -22,13 +22,24 @@ in buildGoPackage rec {
  goPackagePath = null;
  patchPhase = ''
    patchShebangs ./hack
+    substituteInPlace pkg/bootstrap/docker/host/host.go  \
+      --replace 'nsenter --mount=/rootfs/proc/1/ns/mnt findmnt' \
+      'nsenter --mount=/rootfs/proc/1/ns/mnt ${utillinux}/bin/findmnt'
+
+    substituteInPlace pkg/bootstrap/docker/host/host.go  \
+      --replace 'nsenter --mount=/rootfs/proc/1/ns/mnt mount' \
+      'nsenter --mount=/rootfs/proc/1/ns/mnt ${utillinux}/bin/mount'
+
+    substituteInPlace pkg/bootstrap/docker/host/host.go  \
+      --replace 'nsenter --mount=/rootfs/proc/1/ns/mnt mkdir' \
+      'nsenter --mount=/rootfs/proc/1/ns/mnt ${utillinux}/bin/mount'
  '';

  buildPhase = ''
    cd go/src/origin-v${version}-src
    # Openshift build require this variables to be set
    # unless there is a .git folder which is not the case with fetchFromGitHub
-    export OS_GIT_VERSION=${version}
+    export OS_GIT_VERSION=v${version}
    export OS_GIT_MAJOR=${versionMajor}
    export OS_GIT_MINOR=${versionMinor}
    make build
@ -43,7 +54,7 @@ in buildGoPackage rec {
    description = "Build, deploy, and manage your applications with Docker and Kubernetes";
    license = licenses.asl20;
    homepage = http://www.openshift.org;
-    maintainers = with maintainers; [offline bachp];
+    maintainers = with maintainers; [offline bachp moretea];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/networking/dropbox/default.nix
+++ b/pkgs/applications/networking/dropbox/default.nix
@ -24,10 +24,10 @@
 let
  # NOTE: When updating, please also update in current stable,
  # as older versions stop working
-  version = "34.4.20";
+  version = "34.4.22";
  sha256 = {
-    "x86_64-linux" = "04yc0sf4w4p86f2rpph4g4qhd4wxlsyhiwcf4201xadnnjj11gzz";
-    "i686-linux"   = "0ch5yxw1n6mwa6050pd10f5z3ys2yca9n8ccjlqi2d2aa4qcxsmr";
+    "x86_64-linux" = "1ryxj8d5ym2dc18vn2m883jvy9n19xvw5kgfbqxziirb0bip58ba";
+    "i686-linux"   = "1pj7c77196ill8jpwk8f66917v2a7c2xvkd9mssh98c9n321k5j8";
  }."${stdenv.system}" or (throw "system ${stdenv.system} not supported");

  arch = {
--- a/pkgs/applications/networking/instant-messengers/bitlbee-facebook/default.nix
+++ b/pkgs/applications/networking/instant-messengers/bitlbee-facebook/default.nix
@ -3,13 +3,13 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
  name = "bitlbee-facebook-${version}";
-  version = "1.1.1";
+  version = "1.1.2";

  src = fetchFromGitHub {
    rev = "v${version}";
-    owner = "jgeboski";
+    owner = "bitlbee";
    repo = "bitlbee-facebook";
-    sha256 = "08ibjqqcrmq1a5nmj8z93rjrdabi0yy2a70p31xalnfrh200m24c";
+    sha256 = "0kz2sc10iq01vn0hvf06bcdc1rsxz1j77z3mw55slf3j08xr07in";
  };

  nativeBuildInputs = [ autoconf automake libtool pkgconfig ];
@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
  meta = {
    description = "The Facebook protocol plugin for bitlbee";

-    homepage = https://github.com/jgeboski/bitlbee-facebook;
+    homepage = https://github.com/bitlbee/bitlbee-facebook;
    license = licenses.gpl2Plus;
    platforms = stdenv.lib.platforms.linux;
  };
--- a/pkgs/applications/networking/instant-messengers/oysttyer/default.nix
+++ b/pkgs/applications/networking/instant-messengers/oysttyer/default.nix
@ -0,0 +1,42 @@
+{ stdenv, lib, perl, perlPackages, coreutils,
+fetchFromGitHub, makeWrapper }:
+
+stdenv.mkDerivation rec {
+  name = "oysttyer-${version}";
+  version = "2.9.1";
+
+  src = fetchFromGitHub {
+    owner  = "oysttyer";
+    repo   = "oysttyer";
+    rev    = "${version}";
+    sha256 = "05bfak4jr8ln4847rkj5qkazqnjym65k1phav3yicbyr3mxywhjw";
+  };
+
+  buildInputs = [
+    perl
+    makeWrapper
+  ];
+
+  propagatedBuildInputs = with perlPackages; [
+    DateTimeFormatDateParse
+    TermReadLineTTYtter
+    TermReadKey
+  ];
+
+  installPhase = ''
+    ${coreutils}/bin/install -Dm755 \
+      oysttyer.pl \
+      $out/bin/oysttyer
+
+    wrapProgram $out/bin/oysttyer \
+      --prefix PERL5LIB : $PERL5LIB
+  '';
+
+  meta = with lib; {
+    inherit version;
+    description = "Perl Console Twitter Client";
+    homepage    = http://oysttyer.github.io/;
+    maintainers = with maintainers; [ woffs ];
+    license = with licenses; [ ffsl ];
+  };
+}
--- a/pkgs/applications/networking/instant-messengers/telepathy/kde/0.8.80.nix
+++ b/pkgs/applications/networking/instant-messengers/telepathy/kde/0.8.80.nix
@ -1,14 +0,0 @@
-[
-{name="ktp-accounts-kcm";key="accounts_kcm";sha256="08b873k455jbs9vd5nsb222pr1kb7gjx3qky769654j696rad5bc";}
-{name="ktp-approver";key="approver";sha256="07qsjxvcjr9i0v7g7cdx3rky1fa8aany5fyfav488kq6nc13fjb1";}
-{name="ktp-auth-handler";key="auth_handler";sha256="00gq5gq7imv7rv8xivl2s1n0k39llpmd5z46rvhai76z7hp8sj4l";}
-{name="ktp-call-ui";key="call_ui";sha256="1dwsq2ixci95byfg1ayy6g2zv0dbc0273r9wb395f220dgqpz7b4";}
-{name="ktp-common-internals";key="common_internals";sha256="049hh045p6nccyrjvagfw183vfa857xdl96q2w1vrj6frimniz9q";}
-{name="ktp-contact-list";key="contact_list";sha256="0xydyyla48y7q8pf84i12l7fx13p0gi8k4jl7nl7jxjsflzidscp";}
-{name="ktp-contact-runner";key="contact_runner";sha256="1bfb772cyzrbwjkglr3bvawp44dcqr59kkgvb6irgha8w7adic3b";}
-{name="ktp-desktop-applets";key="desktop_applets";sha256="150mpk7vq2w47vz2yffhj676k84fn3h8g77xklmyqm1y3f21dx01";}
-{name="ktp-filetransfer-handler";key="filetransfer_handler";sha256="07jgfydhr5hh7z0wkrz6k4gh3li9nmyxhjvxcxsayxrc7gnhazja";}
-{name="ktp-kded-integration-module";key="kded_integration_module";sha256="0axjqsk1h9c71hxpcy8ls7jsb0dsmsm75wdgwx71xrdb9hpqwn9f";}
-{name="ktp-send-file";key="send_file";sha256="0wiqrwhrmccx3ic0aaqlq539jcznkgsrwyn9hdizwsc8f33rxmri";}
-{name="ktp-text-ui";key="text_ui";sha256="0ch6sqvj9hpx3823c1wmziqy6g9v97sj1hihbaf8z8wyb84f0wbl";}
-]
--- a/pkgs/applications/networking/instant-messengers/telepathy/kde/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telepathy/kde/default.nix
@ -1,69 +0,0 @@
-{ stdenv, fetchurl, fetchgit, automoc4, cmake, gettext, perl, pkgconfig
-, telepathy_qt, kdelibs4, kde_workspace, dbus_glib, dbus_libs, farstream
-, qt-gstreamer1, telepathy_glib, telepathy_logger
-, qjson, flex, bison, qca2 }:
-
-let
-  version = "0.8.80";
-  manifest = import (./. + "/${version}.nix");
-
-  overrides = {
-    call_ui = x : x // {
-      NIX_CFLAGS_COMPILE =
-        "-I${telepathy_glib}/include/telepathy-1.0"
-        + " -I${dbus_glib.dev}/include/dbus-1.0"
-        + " -I${dbus_libs.dev}/include/dbus-1.0";
-    };
-    telepathy_logger_qt = x : x // {
-      NIX_CFLAGS_COMPILE = "-I${dbus_libs.dev}/include/dbus-1.0";
-    };
-  };
-
-  extraBuildInputs = {
-    auth_handler = [ qjson qca2 ];
-    call_ui = [ qt-gstreamer1 telepathy_glib farstream ];
-    contact_applet = [ kde_workspace ];
-    telepathy_logger_qt = [ telepathy_logger qt-gstreamer1 ];
-    text_ui = [ qt-gstreamer1 telepathy_logger qjson ];
-    common_internals = [ telepathy_qt ];
-  };
-
-  extraNativeBuildInputs = {
-    telepathy_logger_qt = [ flex bison ];
-  };
-
-  ktpFun = { name, key, sha256 }:
-  {
-    name = key;
-    value = stdenv.mkDerivation (
-      (stdenv.lib.attrByPath [ key ] (x : x) overrides)
-      {
-        name = "${name}-${version}";
-
-        src = fetchurl {
-          url = "mirror://kde/unstable/kde-telepathy/${version}/src/${name}-${version}.tar.bz2";
-          inherit sha256;
-        };
-
-        nativeBuildInputs =
-          [ automoc4 cmake gettext perl pkgconfig ]
-          ++ (stdenv.lib.attrByPath [ key ] [] extraNativeBuildInputs);
-        buildInputs = [ kdelibs4 telepathy_qt ]
-          ++ stdenv.lib.optional (name != "ktp-common-internals") ktp.common_internals
-          ++ (stdenv.lib.attrByPath [ key ] [] extraBuildInputs);
-
-        meta = {
-          inherit (kdelibs4.meta) platforms;
-          maintainers = [ ];
-        };
-      }
-    );
-  };
-
-  ktp = builtins.listToAttrs (map ktpFun manifest);
-in
-ktp // {
-  inherit version;
-  recurseForDerivations = true;
-  full = stdenv.lib.attrValues ktp;
-}
--- a/pkgs/applications/networking/instant-messengers/telepathy/kde/update.sh
+++ b/pkgs/applications/networking/instant-messengers/telepathy/kde/update.sh
@ -1,38 +0,0 @@
-#!/bin/sh
-
-usage() {
-  echo "$0 version|directory"
-}
-
-download() {
-  URL=ftp://ftp.kde.org/pub/kde/unstable/kde-telepathy/$1/src
-  destdir=$2
-  if test -n "$KDE_FULL_SESSION"; then
-    kioclient copy $URL $destdir
-  else
-    mkdir $destdir
-    lftp -c "open $URL; lcd $destdir; mget -c *"
-  fi
-}
-
-if [[ -d $1 ]]; then
-  directory=$1
-  version=$(ls $directory/* | head -n1 |
-    sed -e "s,$directory/[^0-9.]*\\([0-9.]\\+\\)\\.tar.*,\\1,")
-  echo "Version $version"
-else
-  version=$1
-  directory=src-$version
-  download $version $directory
-fi
-
-packages=$(ls $directory/* | sed -e "s,$directory/\\(.*\\)-$version.*,\\1,")
-echo $packages
-exec >$version.nix
-echo "["
-for name in $packages; do
-  hash=$(nix-hash --flat --type sha256 --base32 $directory/$name-$version.*)
-  key=${name#ktp-}
-  echo "{name=\"${name}\";key=\"${key//-/_}\";sha256=\"${hash}\";}"
-done
-echo "]"
--- a/pkgs/applications/networking/mailreaders/mailnag/default.nix
+++ b/pkgs/applications/networking/mailreaders/mailnag/default.nix
@ -5,11 +5,11 @@

 python2Packages.buildPythonApplication rec {
  name = "mailnag-${version}";
-  version = "1.1.0";
+  version = "1.2.1";

  src = fetchurl {
    url = "https://github.com/pulb/mailnag/archive/v${version}.tar.gz";
-    sha256 = "0li4kvxjmbz3nqg6bysgn2wdazqrd7gm9fym3rd7148aiqqwa91r";
+    sha256 = "ec7ac027d93bc7d88fc270858f5a181453a6ff07f43cab20563d185818801fee";
  };

  buildInputs = [
@ -30,6 +30,12 @@ python2Packages.buildPythonApplication rec {
    done
  '';

+  buildPhase = "";
+
+  installPhase = "python2 setup.py install --prefix=$out";
+
+  doCheck = false;
+
  meta = with stdenv.lib; {
    description = "An extensible mail notification daemon";
    homepage = https://github.com/pulb/mailnag;
--- a/pkgs/applications/networking/mailreaders/neomutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/neomutt/default.nix
@ -2,14 +2,14 @@
 , cyrus_sasl, gss, gpgme, kerberos, libidn, notmuch, openssl, lmdb, libxslt, docbook_xsl }:

 stdenv.mkDerivation rec {
-  version = "20170907";
+  version = "20170912";
  name = "neomutt-${version}";

  src = fetchFromGitHub {
    owner  = "neomutt";
    repo   = "neomutt";
    rev    = "neomutt-${version}";
-    sha256 = "0j2k5d77j5dvfh0yqihgvynnxxv2s5lf3pl50dr8b5b4jk04b961";
+    sha256 = "0qndszmaihly3pp2wqiqm31nxbv9ys3j05kzffaqhzngfilmar9g";
  };

  nativeBuildInputs = [ autoreconfHook docbook_xsl libxslt.bin which ];
@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
  meta = with stdenv.lib; {
    description = "A small but very powerful text-based mail client";
    homepage    = http://www.neomutt.org;
-    license     = stdenv.lib.licenses.gpl2Plus;
+    license     = licenses.gpl2Plus;
    maintainers = with maintainers; [ cstrahan erikryb jfrankenau vrthra ];
    platforms   = platforms.unix;
  };
--- a/pkgs/applications/networking/mailreaders/notmuch/default.nix
+++ b/pkgs/applications/networking/mailreaders/notmuch/default.nix
@ -1,4 +1,4 @@
-{ fetchurl, stdenv, fixDarwinDylibNames, gdb
+{ fetchurl, stdenv, fixDarwinDylibNames
 , pkgconfig, gnupg
 , xapian, gmime, talloc, zlib
 , doxygen, perl
@ -6,9 +6,11 @@
 , bash-completion
 , emacs
 , ruby
-, which, dtach, openssl, bash
+, which, dtach, openssl, bash, gdb, man
 }:

+with stdenv.lib;
+
 stdenv.mkDerivation rec {
  version = "0.25";
  name = "notmuch-${version}";
@ -33,18 +35,10 @@ stdenv.mkDerivation rec {
    ruby  # (optional) ruby bindings
    which dtach openssl bash  # test dependencies
  ]
-    ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames
-    ++ stdenv.lib.optional (!stdenv.isDarwin) gdb;
-
-  doCheck = !stdenv.isDarwin;
-  checkTarget = "test";
-
-  patchPhase = ''
-    # XXX: disabling few tests since i have no idea how to make them pass for now
-    rm -f test/T010-help-test.sh \
-          test/T350-crypto.sh \
-          test/T355-smime.sh
+  ++ optional stdenv.isDarwin fixDarwinDylibNames
+  ++ optionals (!stdenv.isDarwin) [ gdb man ]; # test dependencies

+  postPatch = ''
    find test -type f -exec \
      sed -i \
        -e "1s|#!/usr/bin/env bash|#!${bash}/bin/bash|" \
@ -65,7 +59,9 @@ stdenv.mkDerivation rec {
    done
  '';

-  preFixup = stdenv.lib.optionalString stdenv.isDarwin ''
+  makeFlags = "V=1";
+
+  preFixup = optionalString stdenv.isDarwin ''
    set -e

    die() {
@ -92,12 +88,16 @@ stdenv.mkDerivation rec {
    install_name_tool -change "$badname" "$goodname" "$prg"
  '';

+  doCheck = !stdenv.isDarwin && (versionAtLeast gmime.version "3.0");
+  checkTarget = "test V=1";
+
  postInstall = ''
    make install-man
  '';
+
  dontGzipMan = true; # already compressed

-  meta = with stdenv.lib; {
+  meta = {
    description = "Mail indexer";
    homepage    = https://notmuchmail.org/;
    license     = licenses.gpl3;
--- a/pkgs/applications/networking/nextcloud-client/default.nix
+++ b/pkgs/applications/networking/nextcloud-client/default.nix
@ -1,4 +1,5 @@
-{ stdenv, fetchgit, cmake, pkgconfig, qtbase, qtwebkit, qtkeychain, sqlite }:
+{ stdenv, fetchgit, cmake, pkgconfig, qtbase, qtwebkit, qtkeychain, sqlite
+, inotify-tools, withGnomeKeyring ? false, makeWrapper, libgnome_keyring }:

 stdenv.mkDerivation rec {
  name = "nextcloud-client-${version}";
@ -12,10 +13,29 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [ pkgconfig cmake ];
-  buildInputs = [ qtbase qtwebkit qtkeychain sqlite ];

-  preConfigure = ''
-    cmakeFlagsArray+=("-UCMAKE_INSTALL_LIBDIR" "-DOEM_THEME_DIR=$(realpath ./nextcloudtheme)" "../client")
+  buildInputs = [ qtbase qtwebkit qtkeychain sqlite ]
+    ++ stdenv.lib.optional stdenv.isLinux inotify-tools
+    ++ stdenv.lib.optional withGnomeKeyring makeWrapper;
+
+  enableParallelBuilding = true;
+
+  dontUseCmakeBuildDir = true;
+
+  cmakeDir = "client";
+
+  cmakeFlags = [
+    "-UCMAKE_INSTALL_LIBDIR"
+    "-DCMAKE_BUILD_TYPE=Release"
+    "-DOEM_THEME_DIR=${src}/nextcloudtheme"
+  ] ++ stdenv.lib.optionals stdenv.isLinux [
+    "-DINOTIFY_LIBRARY=${inotify-tools}/lib/libinotifytools.so"
+    "-DINOTIFY_INCLUDE_DIR=${inotify-tools}/include"
+  ];
+
+  postInstall = stdenv.lib.optionalString (withGnomeKeyring) ''
+    wrapProgram "$out/bin/nextcloud" \
+      --prefix LD_LIBRARY_PATH : ${stdenv.lib.makeLibraryPath [ libgnome_keyring ]}
  '';

  meta = with stdenv.lib; {
--- a/pkgs/applications/networking/nntp-proxy/default.nix
+++ b/pkgs/applications/networking/nntp-proxy/default.nix
@ -11,14 +11,16 @@ stdenv.mkDerivation rec {
    sha256 = "0jwxh71am83fbnq9mn06jl06rq8qybm506js79xmmc3xbk5pqvy4";
  };

-  buildInputs = [ libconfig pkgconfig libevent openssl ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libconfig libevent openssl ];

-  installFlags = "INSTALL_DIR=\${out}/bin/";
+  installFlags = [ "INSTALL_DIR=$(out)/bin/" ];

-  preInstall = ''
+  prePatch = ''
    mkdir -p $out/bin
    substituteInPlace Makefile \
-      --replace /usr/bin/install $(type -P install)
+      --replace /usr/bin/install $(type -P install) \
+      --replace gcc cc
  '';

  meta = {
--- a/pkgs/applications/science/logic/lean/default.nix
+++ b/pkgs/applications/science/logic/lean/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  name = "lean-${version}";
-  version = "3.2.0";
+  version = "3.3.0";

  src = fetchFromGitHub {
    owner  = "leanprover";
    repo   = "lean";
    rev    = "v${version}";
-    sha256 = "13sb9rwgc9ni2j5zx77imjhkzhix9d7klsdb8cg68c17b20sy1g3";
+    sha256 = "0irh9b4haz0pzzxrb4hwcss91a0xb499kjrcrmr2s59p3zq8bbd9";
  };

  buildInputs = [ gmp cmake ];
--- a/pkgs/applications/science/logic/mcrl2/default.nix
+++ b/pkgs/applications/science/logic/mcrl2/default.nix
@ -1,4 +1,4 @@
-{stdenv, gcc5, fetchurl, xlibs, cmake, subversion, mesa, qt5, boost,
+{stdenv, fetchurl, xlibs, cmake, subversion, mesa, qt5, boost,
 python27, python27Packages}:

 stdenv.mkDerivation rec {
@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
    sha256 = "1c8h94ja7271ph61zrcgnjgblxppld6v22f7f900prjgzbcfy14m";
  };

-  buildInputs = [ gcc5 cmake mesa qt5.qtbase boost ];
+  buildInputs = [ cmake mesa qt5.qtbase boost ];

  enableParallelBuilding = true;

--- a/pkgs/applications/science/math/mxnet/default.nix
+++ b/pkgs/applications/science/math/mxnet/default.nix
@ -0,0 +1,43 @@
+{ stdenv, lib, fetchgit, cmake
+, opencv, gtest, openblas, liblapack
+, cudaSupport ? false, cudatoolkit
+, cudnnSupport ? false, cudnn
+}:
+
+assert cudnnSupport -> cudaSupport;
+
+stdenv.mkDerivation rec {
+  name = "mxnet-${version}";
+  version = "0.11.0";
+
+  # Submodules needed
+  src = fetchgit {
+    url = "https://github.com/apache/incubator-mxnet";
+    rev = "refs/tags/${version}";
+    sha256 = "1qgns0c70a1gfyil96h17ms736nwdkp9kv496gvs9pkzqzvr6cpz";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [ opencv gtest openblas liblapack ]
+              ++ lib.optional cudaSupport cudatoolkit
+              ++ lib.optional cudnnSupport cudnn;
+
+  cmakeFlags = lib.optional (!cudaSupport) "-DUSE_CUDA=OFF"
+            ++ lib.optional (!cudnnSupport) "-DUSE_CUDNN=OFF";
+
+  installPhase = ''
+    install -Dm755 libmxnet.so $out/lib/libmxnet.so
+    cp -r ../include $out
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "Lightweight, Portable, Flexible Distributed/Mobile Deep Learning with Dynamic, Mutation-aware Dataflow Dep Scheduler";
+    homepage = "https://mxnet.incubator.apache.org/";
+    maintainers = with maintainers; [ abbradar ];
+    license = licenses.asl20;
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/video/streamlink/default.nix
+++ b/pkgs/applications/video/streamlink/default.nix
@ -1,19 +1,19 @@
 { stdenv, pythonPackages, fetchFromGitHub, rtmpdump, ffmpeg }:

 pythonPackages.buildPythonApplication rec {
-  version = "0.7.0";
+  version = "0.8.1";
  name = "streamlink-${version}";

  src = fetchFromGitHub {
    owner = "streamlink";
    repo = "streamlink";
    rev = "${version}";
-    sha256 = "0knh7lw6bv1vix3p40hjp5lc0z9pavvx6rncviw5h095rzcw5287";
+    sha256 = "0l09vp108dw6d9d9rri2xwlr49mr5nkrlxbivr4kk5jbaczjp9xm";
  };

  buildInputs = with pythonPackages; [ pytest mock ];

-  propagatedBuildInputs = (with pythonPackages; [ pycryptodome requests iso-639 iso3166 ]) ++ [ rtmpdump ffmpeg ];
+  propagatedBuildInputs = (with pythonPackages; [ pycryptodome requests iso-639 iso3166 websocket_client ]) ++ [ rtmpdump ffmpeg ];

  meta = with stdenv.lib; {
    homepage = https://github.com/streamlink/streamlink;
--- a/pkgs/build-support/buildenv/default.nix
+++ b/pkgs/build-support/buildenv/default.nix
@ -4,7 +4,8 @@

 { buildPackages, runCommand, lib }:

-{ name
+lib.makeOverridable
+({ name

 , # The manifest file (if any).  A symlink $out/manifest will be
  # created to it.
@ -68,4 +69,4 @@ runCommand name
  ''
    ${buildPackages.perl}/bin/perl -w ${./builder.pl}
    eval "$postBuild"
-  ''
+  '')
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@ -1687,10 +1687,6 @@ rec {
            url = mirror://ubuntu/dists/trusty/universe/binary-amd64/Packages.bz2;
            sha256 = "558637eeb8e340b871653e2060effe36e064677eca4eae62d9e4138dd402a610";
          })
-          (fetchurl {
-            url = mirror://ubuntu/dists/trusty-updates/main/binary-amd64/Packages.bz2;
-            sha256 = "03vd582p8b78s8sq6hz3nynn9vr7syccmn77i5mzayvsadb74cfy";
-          })
        ];
      urlPrefix = mirror://ubuntu;
      packages = commonDebPackages ++ [ "diffutils" "libc-bin" ];
--- a/pkgs/desktops/kde-4.14/kde-package/4.14.3.nix
+++ b/pkgs/desktops/kde-4.14/kde-package/4.14.3.nix
@ -3,7 +3,6 @@ hashes=builtins.listToAttrs[
  {name="baloo";value="0p3awsrc20q79kq04x0vjz84acxz6gjm9jc7j2al4kybkyzx5p4y";}
  {name="kde-baseapps";value="1nz6mm257rd916dklnbrix4r25scylvjil99b1djb35blx1aynqj";}
  {name="kdepimlibs";value="1mv8k0wr0wr0hnlb1al50nmz8d77vbm73p2hhipipgliq6zb3vb5";}
-  {name="kde-workspace";value="00bf708i0vzl47dgcr8mp61n7k0xjzqnlb8j1smliy5bydiaa86g";}
  {name="kfilemetadata";value="0wak1nphnphcam8r6pba7m2gld4w04dkk8qn23myjammv3myc59i";}
  {name="libkcddb";value="0xrmg53p5lh4ral2l5zh96angaf9czhih3zzvwr9qr9h9ks5vrn1";}
  {name="libkdcraw";value="0ksarwq8aaxc77cp0ryfnw1n311wkykzdlhj03rln8jjlbdm3j3q";}
@ -18,7 +17,6 @@ versions=builtins.listToAttrs[
  {name="kde-baseapps";value="4.14.3";}
  {name="kdepimlibs";value="4.14.3";}
  {name="kde-runtime";value="4.14.3";}
-  {name="kde-workspace";value="4.11.14";}
  {name="kfilemetadata";value="4.14.3";}
  {name="libkcddb";value="4.14.3";}
  {name="libkdcraw";value="4.14.3";}
@ -69,6 +67,5 @@ sane="kde_baseapps";  split=true;
 }
 { module="kactivities";  split=false;}
 { module="kdepimlibs";  split=false;}
-{ module="kde-workspace"; sane="kde_workspace"; split=false;}
 ];
 }
--- a/pkgs/desktops/kde-4.14/kde-workspace.nix
+++ b/pkgs/desktops/kde-4.14/kde-workspace.nix
@ -1,41 +0,0 @@
-{ stdenv, kde, kdelibs, qimageblitz, libdbusmenu_qt, xorg, lm_sensors
-, pciutils, libraw1394, libusb1, python, libqalculate, akonadi
-, xkeyboard_config, kdepimlibs, pam, boost, gpsd, prison
-, libjpeg, pkgconfig, kactivities, qjson, udev, fetchurl
-}:
-
-kde {
-#todo: wayland, xmms,   libusb isn't found
-#note: xorg.libXft is needed to build kfontview and kfontinst though this isn't reflected in the build log
-  buildInputs =
-    [ kdelibs qimageblitz libdbusmenu_qt xorg.libxcb xorg.xcbutilimage libjpeg
-      xorg.xcbutilrenderutil xorg.xcbutilkeysyms xorg.libpthreadstubs xorg.libXdmcp
-      xorg.libxkbfile xorg.libXcomposite  xorg.libXtst
-      xorg.libXdamage xorg.libXft
-
-      python boost qjson lm_sensors /* gpsd */ libraw1394 pciutils udev
-      akonadi pam libusb1 libqalculate kdepimlibs  prison
-      kactivities
-    ];
-
-  patches = [ ./files/ksysguard-0001-disable-signalplottertest.patch ];
-
-  preConfigure =
-   ''
-     # Fix incorrect path to kde4-config.
-     substituteInPlace startkde.cmake --replace '$bindir/kde4-config' ${kdelibs}/bin/kde4-config
-
-     # Fix the path to the keyboard configuration files.
-     substituteInPlace kcontrol/keyboard/xkb_rules.cpp \
-       --replace /usr/share/X11 ${xkeyboard_config}/etc/X11
-   '';
-
-  NIX_CFLAGS_COMPILE = [ "-fpermissive" ]; # gcc-6
-
-  enableParallelBuilding = false; # frequent problems on Hydra
-
-  meta = {
-    description = "KDE workspace components such as Plasma, Kwin and System Settings";
-    license = stdenv.lib.licenses.gpl2;
-  };
-}
--- a/pkgs/development/compilers/dmd/2.067.1.nix
+++ b/pkgs/development/compilers/dmd/2.067.1.nix
@ -153,7 +153,6 @@ stdenv.mkDerivation rec {
    # https://github.com/dlang/dmd/pull/6680
    license = licenses.boost;
    platforms = platforms.unix;
-    broken = true;
  };
 }

--- a/pkgs/development/compilers/dmd/default.nix
+++ b/pkgs/development/compilers/dmd/default.nix
@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub
 , makeWrapper, unzip, which
-, curl, tzdata
+, curl, tzdata, gdb
 # Versions 2.070.2 and up require a working dmd compiler to build:
 , bootstrapDmd }:

@ -35,6 +35,10 @@ stdenv.mkDerivation rec {
      mv dmd-v${version}-src dmd
      mv druntime-v${version}-src druntime
      mv phobos-v${version}-src phobos
+
+      # Remove cppa test for now because it doesn't work.
+      rm dmd/test/runnable/cppa.d
+      rm dmd/test/runnable/extra-files/cppb.cpp
  '';

  # Compile with PIC to prevent colliding modules with binutils 2.28.
@ -69,22 +73,22 @@ stdenv.mkDerivation rec {
            --replace MACOSX_DEPLOYMENT_TARGET MACOSX_DEPLOYMENT_TARGET_
    '';

-  nativeBuildInputs = [ bootstrapDmd makeWrapper unzip which ];
+  nativeBuildInputs = [ bootstrapDmd makeWrapper unzip which gdb ];
  buildInputs = [ curl tzdata ];

  # Buid and install are based on http://wiki.dlang.org/Building_DMD
  buildPhase = ''
      cd dmd
-      make -f posix.mak INSTALL_DIR=$out
+      make -j$NIX_BUILD_CORES -f posix.mak INSTALL_DIR=$out
      ${
          let bits = builtins.toString stdenv.hostPlatform.parsed.cpu.bits;
          osname = if stdenv.hostPlatform.isDarwin then "osx" else stdenv.hostPlatform.parsed.kernel.name; in
          "export DMD=$PWD/generated/${osname}/release/${bits}/dmd"
      }
      cd ../druntime
-      make -f posix.mak PIC=${usePIC} INSTALL_DIR=$out DMD=$DMD
+      make -j$NIX_BUILD_CORES -f posix.mak PIC=${usePIC} INSTALL_DIR=$out DMD=$DMD
      cd ../phobos
-      make -f posix.mak PIC=${usePIC} INSTALL_DIR=$out DMD=$DMD
+      make -j$NIX_BUILD_CORES -f posix.mak PIC=${usePIC} INSTALL_DIR=$out DMD=$DMD
      cd ..
  '';

@ -97,10 +101,11 @@ stdenv.mkDerivation rec {
          osname = if stdenv.hostPlatform.isDarwin then "osx" else stdenv.hostPlatform.parsed.kernel.name; in
          "export DMD=$PWD/generated/${osname}/release/${bits}/dmd"
      }
+      make -j$NIX_BUILD_CORES -C test -f Makefile PIC=${usePIC} DMD=$DMD BUILD=release SHARED=0
      cd ../druntime
-      make -f posix.mak unittest PIC=${usePIC} DMD=$DMD BUILD=release
+      make -j$NIX_BUILD_CORES -f posix.mak unittest PIC=${usePIC} DMD=$DMD BUILD=release
      cd ../phobos
-      make -f posix.mak unittest PIC=${usePIC} DMD=$DMD BUILD=release
+      make -j$NIX_BUILD_CORES -f posix.mak unittest PIC=${usePIC} DMD=$DMD BUILD=release
      cd ..
  '';

@ -153,7 +158,7 @@ stdenv.mkDerivation rec {
    # Everything is now Boost licensed, even the backend.
    # https://github.com/dlang/dmd/pull/6680
    license = licenses.boost;
+    maintainers = with maintainers; [ ThomasMader ];
    platforms = platforms.unix;
-    broken = true;
  };
 }
--- a/pkgs/development/compilers/emscripten-fastcomp/default.nix
+++ b/pkgs/development/compilers/emscripten-fastcomp/default.nix
@ -1,54 +1,22 @@
-{ stdenv, fetchFromGitHub, cmake, python, ... }:
-
+{ newScope, stdenv, wrapCC, wrapCCWith, symlinkJoin }:
 let
-  rev = "1.37.16";
-  gcc = if stdenv.cc.isGNU then stdenv.cc.cc else stdenv.cc.cc.gcc;
-in
-stdenv.mkDerivation rec {
-  name = "emscripten-fastcomp-${rev}";
+  callPackage = newScope (self // {inherit stdenv;});

-  src = fetchFromGitHub {
-    owner = "kripken";
-    repo = "emscripten-fastcomp";
-    sha256 = "0wj9sc0gciaiidcjv6wb0qn6ks06xds7q34351masc7qpvd217by";
-    inherit rev;
-  };
-
-  srcFL = fetchFromGitHub {
-    owner = "kripken";
-    repo = "emscripten-fastcomp-clang";
-    sha256 = "1akdgxzxhzjbhp4d14ajcrp9jrf39x004a726ly2gynqc185l4j7";
-    inherit rev;
-  };
-
-  nativeBuildInputs = [ cmake python ];
-  preConfigure = ''
-    cp -Lr ${srcFL} tools/clang
-    chmod +w -R tools/clang
+  self = {
+    emscriptenfastcomp-unwrapped = callPackage ./emscripten-fastcomp.nix {};
+    emscriptenfastcomp-wrapped = wrapCCWith stdenv.cc.libc ''
+      # hardening flags break WASM support
+      cat > $out/nix-support/add-hardening.sh
+    '' self.emscriptenfastcomp-unwrapped;
+    emscriptenfastcomp = symlinkJoin {
+      name = "emscriptenfastcomp";
+      paths = [ self.emscriptenfastcomp-wrapped self.emscriptenfastcomp-unwrapped ];
+      preferLocalBuild = false;
+      allowSubstitutes = true;
+      postBuild = ''
+        # replace unwrapped clang-3.9 binary by wrapper
+        ln -sf $out/bin/clang $out/bin/clang-[0-9]*
      '';
-  cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
-    "-DLLVM_TARGETS_TO_BUILD='X86;JSBackend'"
-    "-DLLVM_INCLUDE_EXAMPLES=OFF"
-    "-DLLVM_INCLUDE_TESTS=OFF"
-    # "-DCLANG_INCLUDE_EXAMPLES=OFF"
-    "-DCLANG_INCLUDE_TESTS=OFF"
-  ] ++ (stdenv.lib.optional stdenv.isLinux
-    # necessary for clang to find crtend.o
-    "-DGCC_INSTALL_PREFIX=${gcc}"
-  );
-  enableParallelBuilding = true;
-
-  passthru = {
-    isClang = true;
-    inherit gcc;
    };
-
-  meta = with stdenv.lib; {
-    homepage = https://github.com/kripken/emscripten-fastcomp;
-    description = "Emscripten LLVM";
-    platforms = platforms.all;
-    maintainers = with maintainers; [ qknight matthewbauer ];
-    license = stdenv.lib.licenses.ncsa;
  };
-}
+in self
--- a/pkgs/development/compilers/emscripten-fastcomp/emscripten-fastcomp.nix
+++ b/pkgs/development/compilers/emscripten-fastcomp/emscripten-fastcomp.nix
@ -0,0 +1,54 @@
+{ stdenv, fetchFromGitHub, cmake, python, ... }:
+
+let
+  rev = "1.37.16";
+  gcc = if stdenv.cc.isGNU then stdenv.cc.cc else stdenv.cc.cc.gcc;
+in
+stdenv.mkDerivation rec {
+  name = "emscripten-fastcomp-${rev}";
+
+  src = fetchFromGitHub {
+    owner = "kripken";
+    repo = "emscripten-fastcomp";
+    sha256 = "0wj9sc0gciaiidcjv6wb0qn6ks06xds7q34351masc7qpvd217by";
+    inherit rev;
+  };
+
+  srcFL = fetchFromGitHub {
+    owner = "kripken";
+    repo = "emscripten-fastcomp-clang";
+    sha256 = "1akdgxzxhzjbhp4d14ajcrp9jrf39x004a726ly2gynqc185l4j7";
+    inherit rev;
+  };
+
+  nativeBuildInputs = [ cmake python ];
+  preConfigure = ''
+    cp -Lr ${srcFL} tools/clang
+    chmod +w -R tools/clang
+  '';
+  cmakeFlags = [
+    "-DCMAKE_BUILD_TYPE=Release"
+    "-DLLVM_TARGETS_TO_BUILD='X86;JSBackend'"
+    "-DLLVM_INCLUDE_EXAMPLES=OFF"
+    "-DLLVM_INCLUDE_TESTS=OFF"
+    # "-DCLANG_INCLUDE_EXAMPLES=OFF"
+    "-DCLANG_INCLUDE_TESTS=OFF"
+  ] ++ (stdenv.lib.optional stdenv.isLinux
+    # necessary for clang to find crtend.o
+    "-DGCC_INSTALL_PREFIX=${gcc}"
+  );
+  enableParallelBuilding = true;
+
+  passthru = {
+    isClang = true;
+    inherit gcc;
+  };
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/kripken/emscripten-fastcomp;
+    description = "Emscripten LLVM";
+    platforms = platforms.all;
+    maintainers = with maintainers; [ qknight matthewbauer ];
+    license = stdenv.lib.licenses.ncsa;
+  };
+}
--- a/pkgs/development/compilers/ghc/7.2.2.nix
+++ b/pkgs/development/compilers/ghc/7.2.2.nix
@ -61,6 +61,7 @@ stdenv.mkDerivation rec {
    ];
    platforms = ["x86_64-linux" "i686-linux"];  # Darwin is unsupported.
    inherit (ghc.meta) license;
+    broken = true;   # broken by 51cf42ad0d3ccb55af182f1f0ee5eb5094ea5995: https://hydra.nixos.org/build/60616815
  };

 }
--- a/pkgs/development/compilers/ldc/default.nix
+++ b/pkgs/development/compilers/ldc/default.nix
@ -0,0 +1,98 @@
+{ stdenv, fetchFromGitHub, cmake, llvm, dmd, curl, tzdata, python,
+  lit, gdb, unzip, darwin }:
+
+stdenv.mkDerivation rec {
+  name = "ldc-${version}";
+  version = "1.3.0";
+
+  srcs = [
+  (fetchFromGitHub {
+    owner = "ldc-developers";
+    repo = "ldc";
+    rev = "v${version}";
+    sha256 = "1ac3j4cwwgjpayhijxx4d6478bc3iqksjxkd7xp7byx7k8w1ppdl";
+  })
+  (fetchFromGitHub {
+    owner = "ldc-developers";
+    repo = "druntime";
+    rev = "ldc-v${version}";
+    sha256 = "1m13370wnj3sizqk3sdpzi9am5d24srf27d613qblhqa9n8vwz30";
+  })
+  (fetchFromGitHub {
+    owner = "ldc-developers";
+    repo = "phobos";
+    rev = "ldc-v${version}";
+    sha256 = "0fhcdfi7a00plwj27ysfyv783nhk0kspq7hawf6vbsl3s1nyvn8g";
+  })
+  (fetchFromGitHub {
+    owner = "ldc-developers";
+    repo = "dmd-testsuite";
+    rev = "ldc-v${version}";
+    sha256 = "0dmdkp220gqhxjrmrjfkf0vsvylwfaj70hswavq4q3v4dg17pzmj";
+  })
+  ];
+
+  sourceRoot = ".";
+
+  postUnpack = ''
+      mv ldc-v${version}-src/* .
+
+      mv druntime-ldc-v${version}-src/* runtime/druntime
+
+      mv phobos-ldc-v${version}-src/* runtime/phobos
+
+      mv dmd-testsuite-ldc-v${version}-src/* tests/d2/dmd-testsuite
+
+      # Remove cppa test for now because it doesn't work.
+      rm tests/d2/dmd-testsuite/runnable/cppa.d
+      rm tests/d2/dmd-testsuite/runnable/extra-files/cppb.cpp
+  '';
+
+  postPatch = ''
+      substituteInPlace runtime/phobos/std/net/curl.d \
+          --replace libcurl.so ${curl.out}/lib/libcurl.so
+
+      # Ugly hack to fix the hardcoded path to zoneinfo in the source file.
+      # https://issues.dlang.org/show_bug.cgi?id=15391
+      substituteInPlace runtime/phobos/std/datetime.d \
+          --replace /usr/share/zoneinfo/ ${tzdata}/share/zoneinfo/
+  ''
+
+  + stdenv.lib.optionalString stdenv.hostPlatform.isDarwin ''
+      substituteInPlace driver/tool.cpp \
+          --replace "gcc" "clang"
+  '';
+
+  nativeBuildInputs = [ cmake llvm dmd python lit gdb unzip ]
+
+  ++ stdenv.lib.optional stdenv.hostPlatform.isDarwin (with darwin.apple_sdk.frameworks; [
+    Foundation
+  ]);
+
+  buildInputs = [ curl tzdata stdenv.cc ];
+
+  preConfigure = ''
+    cmakeFlagsArray=("-DINCLUDE_INSTALL_DIR=$out/include/dlang/ldc")
+  '';
+
+  postConfigure = ''
+    export DMD=$PWD/bin/ldc2
+  '';
+
+  makeFlags = [ "DMD=$DMD" ];
+
+  doCheck = true;
+
+  checkPhase = ''
+      ctest -j $NIX_BUILD_CORES -V DMD=$DMD
+  '';
+
+  meta = with stdenv.lib; {
+    description = "The LLVM-based D compiler";
+    homepage = https://github.com/ldc-developers/ldc;
+    # from https://github.com/ldc-developers/ldc/blob/master/LICENSE
+    license = with licenses; [ bsd3 boost mit ncsa gpl2Plus ];
+    maintainers = with maintainers; [ ThomasMader ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/development/compilers/llvm/3.7/default.nix
+++ b/pkgs/development/compilers/llvm/3.7/default.nix
@ -1,4 +1,7 @@
-{ newScope, stdenv, cmake, libxml2, python2, isl, fetchurl, overrideCC, wrapCC, ccWrapperFun }:
+{ newScope, stdenv, libstdcxxHook, cmake, libxml2, python2, isl, fetchurl
+, overrideCC, wrapCC, ccWrapperFun, darwin
+}:
+
 let
  callPackage = newScope (self // { inherit stdenv cmake libxml2 python2 isl version fetch; });

@ -22,20 +25,35 @@ let
      inherit clang-tools-extra_src stdenv;
    };

-    clang = wrapCC self.clang-unwrapped;
+    clang = if stdenv.cc.isGNU then self.libstdcxxClang else self.libcxxClang;
+
+    libstdcxxClang = ccWrapperFun {
+      cc = self.clang-unwrapped;
+      /* FIXME is this right? */
+      inherit (stdenv.cc) libc nativeTools nativeLibc;
+      extraPackages = [ libstdcxxHook ];
+    };

    libcxxClang = ccWrapperFun {
      cc = self.clang-unwrapped;
-      isClang = true;
-      inherit (self) stdenv;
      /* FIXME is this right? */
      inherit (stdenv.cc) libc nativeTools nativeLibc;
      extraPackages = [ self.libcxx self.libcxxabi ];
    };

-    stdenv = overrideCC stdenv self.clang;
+    stdenv = stdenv.override (drv: {
+      allowedRequisites = null;
+      cc = self.clang;
+      # Don't include the libc++ and libc++abi from the original stdenv.
+      extraBuildInputs = stdenv.lib.optional stdenv.isDarwin darwin.CF;
+    });

-    libcxxStdenv = overrideCC stdenv self.libcxxClang;
+    libcxxStdenv = stdenv.override (drv: {
+      allowedRequisites = null;
+      cc = self.libcxxClang;
+      # Don't include the libc++ and libc++abi from the original stdenv.
+      extraBuildInputs = stdenv.lib.optional stdenv.isDarwin darwin.CF;
+    });

    lldb = callPackage ./lldb.nix {};

--- a/pkgs/development/compilers/llvm/3.8/default.nix
+++ b/pkgs/development/compilers/llvm/3.8/default.nix
@ -1,4 +1,4 @@
-{ newScope, stdenv, isl, fetchurl, overrideCC, wrapCC, ccWrapperFun }:
+{ newScope, stdenv, libstdcxxHook, isl, fetchurl, overrideCC, wrapCC, ccWrapperFun, darwin }:
 let
  callPackage = newScope (self // { inherit stdenv isl version fetch; });

@ -22,20 +22,35 @@ let
      inherit clang-tools-extra_src stdenv;
    };

-    clang = wrapCC self.clang-unwrapped;
+    clang = if stdenv.cc.isGNU then self.libstdcxxClang else self.libcxxClang;
+
+    libstdcxxClang = ccWrapperFun {
+      cc = self.clang-unwrapped;
+      /* FIXME is this right? */
+      inherit (stdenv.cc) libc nativeTools nativeLibc;
+      extraPackages = [ libstdcxxHook ];
+    };

    libcxxClang = ccWrapperFun {
      cc = self.clang-unwrapped;
-      isClang = true;
-      inherit (self) stdenv;
      /* FIXME is this right? */
      inherit (stdenv.cc) libc nativeTools nativeLibc;
      extraPackages = [ self.libcxx self.libcxxabi ];
    };

-    stdenv = overrideCC stdenv self.clang;
+    stdenv = stdenv.override (drv: {
+      allowedRequisites = null;
+      cc = self.clang;
+      # Don't include the libc++ and libc++abi from the original stdenv.
+      extraBuildInputs = stdenv.lib.optional stdenv.isDarwin darwin.CF;
+    });

-    libcxxStdenv = overrideCC stdenv self.libcxxClang;
+    libcxxStdenv = stdenv.override (drv: {
+      allowedRequisites = null;
+      cc = self.libcxxClang;
+      # Don't include the libc++ and libc++abi from the original stdenv.
+      extraBuildInputs = stdenv.lib.optional stdenv.isDarwin darwin.CF;
+    });

    lldb = callPackage ./lldb.nix {};

--- a/pkgs/development/compilers/llvm/3.9/default.nix
+++ b/pkgs/development/compilers/llvm/3.9/default.nix
@ -1,4 +1,4 @@
-{ newScope, stdenv, isl, fetchurl, overrideCC, wrapCC, darwin, ccWrapperFun }:
+{ newScope, stdenv, libstdcxxHook, isl, fetchurl, overrideCC, wrapCC, ccWrapperFun, darwin }:
 let
  callPackage = newScope (self // { inherit stdenv isl version fetch; });

@ -22,20 +22,35 @@ let
      inherit clang-tools-extra_src stdenv;
    };

-    clang = wrapCC self.clang-unwrapped;
+    clang = if stdenv.cc.isGNU then self.libstdcxxClang else self.libcxxClang;
+
+    libstdcxxClang = ccWrapperFun {
+      cc = self.clang-unwrapped;
+      /* FIXME is this right? */
+      inherit (stdenv.cc) libc nativeTools nativeLibc;
+      extraPackages = [ libstdcxxHook ];
+    };

    libcxxClang = ccWrapperFun {
      cc = self.clang-unwrapped;
-      isClang = true;
-      inherit (self) stdenv;
      /* FIXME is this right? */
      inherit (stdenv.cc) libc nativeTools nativeLibc;
      extraPackages = [ self.libcxx self.libcxxabi ];
    };

-    stdenv = overrideCC stdenv self.clang;
+    stdenv = stdenv.override (drv: {
+      allowedRequisites = null;
+      cc = self.clang;
+      # Don't include the libc++ and libc++abi from the original stdenv.
+      extraBuildInputs = stdenv.lib.optional stdenv.isDarwin darwin.CF;
+    });

-    libcxxStdenv = overrideCC stdenv self.libcxxClang;
+    libcxxStdenv = stdenv.override (drv: {
+      allowedRequisites = null;
+      cc = self.libcxxClang;
+      # Don't include the libc++ and libc++abi from the original stdenv.
+      extraBuildInputs = stdenv.lib.optional stdenv.isDarwin darwin.CF;
+    });

    lldb = callPackage ./lldb.nix {};

--- a/pkgs/development/compilers/llvm/4/default.nix
+++ b/pkgs/development/compilers/llvm/4/default.nix
@ -37,14 +37,17 @@ let
    llvm-manpages = lowPrio self.llvm.man;
    clang-manpages = lowPrio self.clang-unwrapped.man;

-    clang = wrapCC self.clang-unwrapped;
+    clang = if stdenv.cc.isGNU then self.libstdcxxClang else self.libcxxClang;

-    openmp = callPackage ./openmp.nix {};
+    libstdcxxClang = ccWrapperFun {
+      cc = self.clang-unwrapped;
+      /* FIXME is this right? */
+      inherit (stdenv.cc) libc nativeTools nativeLibc;
+      extraPackages = [ libstdcxxHook ];
+    };

    libcxxClang = ccWrapperFun {
      cc = self.clang-unwrapped;
-      isClang = true;
-      inherit (self) stdenv;
      /* FIXME is this right? */
      inherit (stdenv.cc) libc nativeTools nativeLibc;
      extraPackages = [ self.libcxx self.libcxxabi ];
@ -53,11 +56,16 @@ let
    stdenv = stdenv.override (drv: {
      allowedRequisites = null;
      cc = self.clang;
-      # Use the gcc libstdc++ when targeting linux.
-      extraBuildInputs = if stdenv.cc.isGNU then [ libstdcxxHook ] else drv.extraBuildInputs;
+      # Don't include the libc++ and libc++abi from the original stdenv.
+      extraBuildInputs = stdenv.lib.optional stdenv.isDarwin darwin.CF;
    });

-    libcxxStdenv = overrideCC stdenv self.libcxxClang;
+    libcxxStdenv = stdenv.override (drv: {
+      allowedRequisites = null;
+      cc = self.libcxxClang;
+      # Don't include the libc++ and libc++abi from the original stdenv.
+      extraBuildInputs = stdenv.lib.optional stdenv.isDarwin darwin.CF;
+    });

    lld = callPackage ./lld.nix {};

@ -66,6 +74,8 @@ let
    libcxx = callPackage ./libc++ {};

    libcxxabi = callPackage ./libc++abi.nix {};
+
+    openmp = callPackage ./openmp.nix {};
  };

 in self
--- a/pkgs/development/compilers/ponyc/default.nix
+++ b/pkgs/development/compilers/ponyc/default.nix
@ -3,13 +3,13 @@

 stdenv.mkDerivation ( rec {
  name = "ponyc-${version}";
-  version = "0.19.0";
+  version = "0.19.1";

  src = fetchFromGitHub {
    owner = "ponylang";
    repo = "ponyc";
    rev = version;
-    sha256 = "05xswxbibkrzm6rf8mvd1y9ysf624ngpj0k0xxcrlsls197sian9";
+    sha256 = "1zd051syn0n6ign4nnxb40xj2s5vqp0s349nkjqv7051xzvlzf1p";
  };

  buildInputs = [ llvm makeWrapper which ];
--- a/pkgs/development/compilers/tinycc/default.nix
+++ b/pkgs/development/compilers/tinycc/default.nix
@ -2,10 +2,10 @@
 with stdenv.lib;

 let
-  date = "20170821";
+  date = "20170911";
+  rev = "870271ea071971002fa556e09e1873db316fa1a9";
+  sha256 = "1a9djm0p7cd5nzqdhch9y48c4wai76x6d4nwx0bj5jz46ws39bs9";
  version = "0.9.27pre-${date}";
-  rev = "b8fe8fc2105455eb5004be89fa8575aa928a18f3";
-  sha256 = "0rsv5pikm7ai2n7r93qlbvkyky23dsgc3sdc83crbcxjjk6xh378";
 in

 stdenv.mkDerivation rec {
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@ -104,6 +104,10 @@ self: super: {
  # Fix test trying to access /home directory
  shell-conduit = (overrideCabal super.shell-conduit (drv: {
    postPatch = "sed -i s/home/tmp/ test/Spec.hs";
+
+    # the tests for shell-conduit on Darwin illegitimatey assume non-GNU echo
+    # see: https://github.com/psibi/shell-conduit/issues/12
+    doCheck = !pkgs.stdenv.hostPlatform.isDarwin;
  }));

  # https://github.com/froozen/kademlia/issues/2
@ -400,6 +404,12 @@ self: super: {
  th-printf = dontCheck super.th-printf;
  thumbnail-plus = dontCheck super.thumbnail-plus;
  tickle = dontCheck super.tickle;
+  tldr = super.tldr.override {
+    # shell-conduit determines what commands are available at compile-time, so
+    # that tldr will not compile unless the shell-conduit it uses is compiled
+    # with git in its environment.
+    shell-conduit = addBuildTool self.shell-conduit pkgs.git;
+  };
  tpdb = dontCheck super.tpdb;
  translatable-intset = dontCheck super.translatable-intset;
  ua-parser = dontCheck super.ua-parser;
@ -929,6 +939,9 @@ self: super: {
  # https://hydra.nixos.org/build/60678124
  Agda = markBroken (super.Agda.override { happy = self.happy_1_19_5; });

+  # cryptol-2.5.0 doesn't want happy 1.19.6+.
+  cryptol = super.cryptol.override { happy = self.happy_1_19_5; };
+
  # https://github.com/jtdaugherty/text-zipper/issues/11
  text-zipper = dontCheck super.text-zipper;

--- a/pkgs/development/haskell-modules/configuration-ghc-8.2.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-8.2.x.nix
@ -71,23 +71,11 @@ self: super: {
  # https://github.com/aristidb/aws/issues/238
  aws = doJailbreak super.aws;

-  # https://github.com/jgm/pandoc/issues/3876
-  pandoc = let fixSetup = pkgs.fetchpatch {
-                            url = "https://github.com/jgm/pandoc/pull/3899.patch";
-                            sha256 = "0lk9vs2l1wc1kr0y8fkdcarfi4sjd3dl81r52n39r25xx9kqawv7";
-                          };
-           in overrideCabal super.pandoc (drv: {
-                editedCabalFile = null;
-                patches = drv.patches or [] ++ [fixSetup];
-                setupHaskellDepends = drv.setupHaskellDepends or [self.Cabal_1_24_2_0];
-                preCompileBuildDriver = "setupCompileFlags+=' -package=Cabal-1.24.2.0'";
-              });
-
  # LTS-9 versions do not compile.
  path = dontCheck super.path;
  path-io = super.path-io_1_3_3;
  trifecta = super.trifecta_1_7_1_1;
  aeson-compat = dontCheck super.aeson-compat_0_3_7_1;  # test suite needs QuickCheck 2.10.*
-  binary-orphans = dontCheck super.binary-orphans_0_1_7_0; # test suite needs QuickCheck 2.10.*
+  binary-orphans = dontCheck super.binary-orphans_0_1_8_0; # test suite needs QuickCheck 2.10.*

 }
--- a/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
@ -37,7 +37,7 @@ core-packages:
  - ghcjs-base-0

 default-package-overrides:
-  # LTS Haskell 9.3
+  # LTS Haskell 9.4
  - abstract-deque ==0.3
  - abstract-deque-tests ==0.3
  - abstract-par ==0.3.3
@ -62,11 +62,11 @@ default-package-overrides:
  - aeson-pretty ==0.8.5
  - aeson-qq ==0.8.2
  - aeson-utils ==0.3.0.2
-  - Agda ==2.5.2
+  - Agda ==2.5.3
  - airship ==0.6.0
  - alarmclock ==0.4.0.3
  - alerta ==0.1.0.4
-  - alex ==3.2.2
+  - alex ==3.2.3
  - algebraic-graphs ==0.0.5
  - alsa-core ==0.5.0.1
  - alsa-mixer ==0.2.0.3
@ -420,10 +420,10 @@ default-package-overrides:
  - concurrent-output ==1.9.2
  - concurrent-split ==0.0.1
  - concurrent-supply ==0.1.8
-  - conduit ==1.2.11
+  - conduit ==1.2.12
  - conduit-combinators ==1.1.1
  - conduit-connection ==0.1.0.3
-  - conduit-extra ==1.1.16
+  - conduit-extra ==1.1.17
  - conduit-iconv ==0.1.1.2
  - conduit-parse ==0.1.2.1
  - ConfigFile ==1.1.4
@ -504,7 +504,7 @@ default-package-overrides:
  - data-diverse-lens ==0.1.1.0
  - data-dword ==0.3.1.1
  - data-endian ==0.1.1
-  - data-fix ==0.0.6
+  - data-fix ==0.0.7
  - data-has ==0.2.1.0
  - data-hash ==0.2.0.1
  - data-inttrie ==0.1.2
@ -525,7 +525,7 @@ default-package-overrides:
  - Decimal ==0.4.2
  - declarative ==0.5.1
  - deepseq-generics ==0.2.0.0
-  - dejafu ==0.7.1.2
+  - dejafu ==0.7.1.3
  - dependent-map ==0.2.4.0
  - dependent-sum ==0.4
  - derive ==2.6.3
@ -574,7 +574,7 @@ default-package-overrides:
  - dmenu-pkill ==0.1.0.1
  - dmenu-pmount ==0.1.0.1
  - dmenu-search ==0.1.0.1
-  - dns ==2.0.12
+  - dns ==2.0.13
  - do-list ==1.0.1
  - dockerfile ==0.1.0.1
  - docopt ==0.7.0.5
@ -697,7 +697,7 @@ default-package-overrides:
  - filemanip ==0.3.6.3
  - fileplow ==0.1.0.0
  - filter-logger ==0.6.0.0
-  - find-clumpiness ==0.2.2.0
+  - find-clumpiness ==0.2.3.0
  - fingertree ==0.1.1.0
  - fingertree-psqueue ==0.3
  - finite-typelits ==0.1.2.0
@ -957,18 +957,18 @@ default-package-overrides:
  - hamlet ==1.2.0
  - HandsomeSoup ==0.4.2
  - handwriting ==0.1.0.3
-  - hapistrano ==0.3.2.4
+  - hapistrano ==0.3.3.0
  - happstack-hsp ==7.3.7.3
  - happstack-jmacro ==7.0.12
  - happstack-server ==7.4.6.4
  - happstack-server-tls ==7.1.6.4
-  - happy >1.19.6
-  - harp ==0.4.2
+  - happy ==1.19.7
+  - harp ==0.4.3
  - hasbolt ==0.1.2.1
  - hashable ==1.2.6.1
  - hashable-time ==0.2.0.1
  - hashmap ==1.3.2
-  - hashtables ==1.2.1.1
+  - hashtables ==1.2.2.0
  - haskeline ==0.7.4.0
  - haskell-gi ==0.20.3
  - haskell-gi-base ==0.20.4
@ -1093,7 +1093,7 @@ default-package-overrides:
  - hsemail ==2
  - HSet ==0.0.1
  - hset ==2.2.0
-  - hsexif ==0.6.1.2
+  - hsexif ==0.6.1.3
  - hsignal ==0.2.7.5
  - hsinstall ==1.6
  - hslogger ==1.2.10
@ -1212,7 +1212,7 @@ default-package-overrides:
  - instance-control ==0.1.1.1
  - integer-logarithms ==1.0.2
  - integration ==0.2.1
-  - intero ==0.1.21
+  - intero ==0.1.23
  - interpolate ==0.1.1
  - interpolatedstring-perl6 ==1.0.0
  - interpolation ==0.1.0.1
@ -1228,7 +1228,7 @@ default-package-overrides:
  - io-region ==0.1.1
  - io-storage ==0.3
  - io-streams ==1.4.1.0
-  - io-streams-haproxy ==1.0.0.1
+  - io-streams-haproxy ==1.0.0.2
  - ip6addr ==0.5.3
  - iproute ==1.7.1
  - IPv6Addr ==1.0.1
@ -1262,7 +1262,7 @@ default-package-overrides:
  - json-builder ==0.3
  - json-rpc-generic ==0.2.1.2
  - json-schema ==0.7.4.1
-  - json-stream ==0.4.1.4
+  - json-stream ==0.4.1.5
  - JuicyPixels ==3.2.8.3
  - JuicyPixels-extra ==0.2.1
  - JuicyPixels-scale-dct ==0.1.1.2
@ -1355,7 +1355,7 @@ default-package-overrides:
  - log-postgres ==0.7.0.2
  - logfloat ==0.13.3.3
  - logger-thread ==0.1.0.2
-  - logging-effect ==1.2.0
+  - logging-effect ==1.2.1
  - logging-facade ==0.3.0
  - logging-facade-syslog ==1
  - logict ==0.6.0.2
@ -1398,7 +1398,7 @@ default-package-overrides:
  - median-stream ==0.7.0.0
  - mega-sdist ==0.3.0.2
  - megaparsec ==5.3.1
-  - memory ==0.14.6
+  - memory ==0.14.7
  - MemoTrie ==0.6.8
  - mersenne-random-pure64 ==0.2.2.0
  - messagepack ==0.5.4
@ -1440,7 +1440,7 @@ default-package-overrides:
  - monad-extras ==0.6.0
  - monad-http ==0.1.0.0
  - monad-journal ==0.7.2
-  - monad-logger ==0.3.25
+  - monad-logger ==0.3.25.1
  - monad-logger-json ==0.1.0.0
  - monad-logger-prefix ==0.1.6
  - monad-logger-syslog ==0.1.4.0
@ -1565,7 +1565,7 @@ default-package-overrides:
  - Only ==0.1
  - oo-prototypes ==0.1.0.0
  - opaleye ==0.5.4.0
-  - opaleye-trans ==0.3.5
+  - opaleye-trans ==0.3.6
  - open-browser ==0.2.1.0
  - open-witness ==0.4.0.1
  - OpenAL ==1.7.0.4
@ -1574,7 +1574,7 @@ default-package-overrides:
  - OpenGLRaw ==3.2.5.0
  - openpgp-asciiarmor ==0.1
  - opensource ==0.1.0.0
-  - openssl-streams ==1.2.1.1
+  - openssl-streams ==1.2.1.3
  - operational ==0.2.3.5
  - operational-class ==0.3.0.0
  - opml-conduit ==0.6.0.3
@ -1594,7 +1594,7 @@ default-package-overrides:
  - pagerduty ==0.0.8
  - pagination ==0.2.1
  - palette ==0.1.0.5
-  - pandoc ==1.19.2.1
+  - pandoc ==1.19.2.4
  - pandoc-citeproc ==0.10.5.1
  - pandoc-types ==1.17.0.5
  - pango ==0.13.3.1
@ -1612,7 +1612,7 @@ default-package-overrides:
  - partial-order ==0.1.2.1
  - patat ==0.5.2.2
  - path ==0.5.13
-  - path-extra ==0.0.3
+  - path-extra ==0.0.5
  - path-io ==1.2.2
  - path-pieces ==0.2.1
  - pathtype ==0.8
@ -1654,10 +1654,10 @@ default-package-overrides:
  - pipes-bytestring ==2.1.6
  - pipes-cacophony ==0.5.0
  - pipes-category ==0.2.0.1
-  - pipes-concurrency ==2.0.7
+  - pipes-concurrency ==2.0.8
  - pipes-extras ==1.0.10
  - pipes-fluid ==0.5.0.3
-  - pipes-group ==1.0.7
+  - pipes-group ==1.0.8
  - pipes-misc ==0.3.0.0
  - pipes-mongodb ==0.1.0.0
  - pipes-parse ==3.0.8
@ -1669,7 +1669,7 @@ default-package-overrides:
  - pkcs10 ==0.2.0.0
  - placeholders ==0.1
  - plan-b ==0.2.1
-  - plot ==0.2.3.7
+  - plot ==0.2.3.8
  - plot-gtk ==0.2.0.4
  - plot-gtk-ui ==0.3.0.2
  - plot-gtk3 ==0.1.0.2
@ -1868,7 +1868,7 @@ default-package-overrides:
  - safe-exceptions ==0.1.6.0
  - safe-exceptions-checked ==0.1.0
  - safecopy ==0.9.3.3
-  - safeio ==0.0.3.0
+  - safeio ==0.0.4.0
  - SafeSemaphore ==0.10.1
  - sample-frame ==0.0.3
  - sample-frame-np ==0.0.4.1
@ -1893,8 +1893,8 @@ default-package-overrides:
  - search-algorithms ==0.2.0
  - securemem ==0.1.9
  - SegmentTree ==0.3
-  - selda ==0.1.10.1
-  - selda-postgresql ==0.1.6.0
+  - selda ==0.1.11.0
+  - selda-postgresql ==0.1.7.0
  - selda-sqlite ==0.1.6.0
  - semigroupoid-extras ==5
  - semigroupoids ==5.2.1
@ -1970,8 +1970,8 @@ default-package-overrides:
  - smoothie ==0.4.2.7
  - smtp-mail ==0.1.4.6
  - snap-blaze ==0.2.1.5
-  - snap-core ==1.0.3.0
-  - snap-server ==1.0.3.0
+  - snap-core ==1.0.3.1
+  - snap-server ==1.0.3.1
  - snowflake ==0.1.1.1
  - snowtify ==0.1.0.3
  - soap ==0.2.3.5
@ -2073,7 +2073,7 @@ default-package-overrides:
  - svg-tree ==0.6.2
  - SVGFonts ==1.6.0.2
  - swagger ==0.3.0
-  - swagger2 ==2.1.4.1
+  - swagger2 ==2.1.5
  - syb ==0.7
  - symbol ==0.2.4
  - symengine ==0.1.2.0
@ -2161,11 +2161,11 @@ default-package-overrides:
  - text-region ==0.3.0.0
  - text-show ==3.6
  - text-show-instances ==3.6
-  - text-zipper ==0.10
+  - text-zipper ==0.10.1
  - textlocal ==0.1.0.5
  - tf-random ==0.5
  - tfp ==1.0.0.2
-  - th-abstraction ==0.2.5.0
+  - th-abstraction ==0.2.6.0
  - th-data-compat ==0.0.2.4
  - th-desugar ==1.6
  - th-expand-syns ==0.4.3.0
@ -2246,7 +2246,7 @@ default-package-overrides:
  - type-operators ==0.1.0.4
  - type-spec ==0.3.0.1
  - TypeCompose ==0.9.12
-  - typed-process ==0.1.0.1
+  - typed-process ==0.1.1
  - typelits-witnesses ==0.2.3.0
  - typography-geometry ==1.0.0.1
  - tz ==0.1.3.0
@ -2268,7 +2268,7 @@ default-package-overrides:
  - union-find ==0.2
  - uniplate ==1.6.12
  - uniq-deep ==1.1.0.0
-  - Unique ==0.4.6.1
+  - Unique ==0.4.7.1
  - unique ==0
  - unit-constraint ==0.0.0
  - units ==2.4
@ -2306,7 +2306,7 @@ default-package-overrides:
  - uuid-types ==1.0.3
  - vado ==0.0.9
  - validate-input ==0.4.0.0
-  - validation ==0.5.4
+  - validation ==0.5.5
  - validationt ==0.2.0.0
  - varying ==0.7.0.3
  - vault ==0.3.0.7
@ -2338,7 +2338,7 @@ default-package-overrides:
  - wai-cors ==0.2.5
  - wai-eventsource ==3.0.0
  - wai-extra ==3.0.20.0
-  - wai-handler-launch ==3.0.2.2
+  - wai-handler-launch ==3.0.2.3
  - wai-logger ==2.3.0
  - wai-middleware-auth ==0.1.2.1
  - wai-middleware-caching ==0.1.0.2
@ -2448,7 +2448,7 @@ default-package-overrides:
  - xmlgen ==0.6.2.1
  - xmonad ==0.13
  - xmonad-contrib ==0.13
-  - xmonad-extras ==0.13.0
+  - xmonad-extras ==0.13.1
  - xss-sanitize ==0.3.5.7
  - xturtle ==0.2.0.0
  - yackage ==0.8.1
@ -2458,7 +2458,7 @@ default-package-overrides:
  - YampaSynth ==0.2
  - yes-precure5-command ==5.5.3
  - yesod ==1.4.5
-  - yesod-auth ==1.4.18
+  - yesod-auth ==1.4.19
  - yesod-auth-account ==1.4.3
  - yesod-auth-basic ==0.1.0.2
  - yesod-auth-fb ==1.8.1
@ -2468,7 +2468,7 @@ default-package-overrides:
  - yesod-default ==1.2.0
  - yesod-eventsource ==1.4.1
  - yesod-fb ==0.4.0
-  - yesod-form ==1.4.15
+  - yesod-form ==1.4.16
  - yesod-form-bootstrap4 ==0.1.0.1
  - yesod-form-richtext ==0.1.0.2
  - yesod-gitrepo ==0.2.1.0
--- a/pkgs/development/haskell-modules/hackage-packages.nix
+++ b/pkgs/development/haskell-modules/hackage-packages.nix
--- a/pkgs/development/idris-modules/default.nix
+++ b/pkgs/development/idris-modules/default.nix
@ -26,7 +26,7 @@
    };

    files = builtins.filter (n: n != "default") (pkgs.lib.mapAttrsToList (name: type: let
-      m = builtins.match "(.*)\.nix" name;
+      m = builtins.match "(.*)\\.nix" name;
    in if m == null then "default" else builtins.head m) (builtins.readDir ./.));
  in (builtins.listToAttrs (map (name: {
    inherit name;
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@ -110,8 +110,9 @@ let
    "--enable-shared"
    "--with-threads"
    "--enable-unicode=ucs4"
-  ] ++ optionals hostPlatform.isCygwin [
+  ] ++ optionals (hostPlatform.isCygwin || hostPlatform.isAarch64) [
    "--with-system-ffi"
+  ] ++ optionals hostPlatform.isCygwin [
    "--with-system-expat"
    "ac_cv_func_bind_textdomain_codeset=yes"
  ] ++ optionals stdenv.isDarwin [
@ -125,7 +126,8 @@ let
  buildInputs =
    optional (stdenv ? cc && stdenv.cc.libc != null) stdenv.cc.libc ++
    [ bzip2 openssl zlib ]
-    ++ optionals hostPlatform.isCygwin [ expat libffi ]
+    ++ optional (hostPlatform.isCygwin || hostPlatform.isAarch64) libffi
+    ++ optional hostPlatform.isCygwin expat
    ++ [ db gdbm ncurses sqlite readline ]
    ++ optionals x11Support [ tcl tk xlibsWrapper libX11 ]
    ++ optionals stdenv.isDarwin [ CF configd ];
--- a/pkgs/development/interpreters/python/cpython/3.4/default.nix
+++ b/pkgs/development/interpreters/python/cpython/3.4/default.nix
@ -66,6 +66,7 @@ in stdenv.mkDerivation {

  patches = [
    ./no-ldconfig.patch
+    ./ld_library_path.patch
  ];

  postPatch = ''
--- a/pkgs/development/interpreters/python/cpython/3.4/ld_library_path.patch
+++ b/pkgs/development/interpreters/python/cpython/3.4/ld_library_path.patch
@ -0,0 +1,51 @@
+From 85991e0d7f0e631240f3f6233bd65d1128a66dec Mon Sep 17 00:00:00 2001
+From: Frederik Rietdijk <fridh@fridh.nl>
+Date: Thu, 14 Sep 2017 10:00:31 +0200
+Subject: [PATCH] ctypes.util: support LD_LIBRARY_PATH
+
+Backports support for LD_LIBRARY_PATH from 3.6
+---
+ Lib/ctypes/util.py | 26 +++++++++++++++++++++++++-
+ 1 file changed, 25 insertions(+), 1 deletion(-)
+
+diff --git a/Lib/ctypes/util.py b/Lib/ctypes/util.py
+index 780cd5d21b..d7ac15070f 100644
+--- a/Lib/ctypes/util.py
+++ b/Lib/ctypes/util.py
+@@ -181,8 +181,32 @@ elif os.name == "posix":
+         def _findSoname_ldconfig(name):
+             return None
+ 
+        def _findLib_ld(name):
+            # See issue #9998 for why this is needed
+            expr = r'[^\(\)\s]*lib%s\.[^\(\)\s]*' % re.escape(name)
+            cmd = ['ld', '-t']
+            libpath = os.environ.get('LD_LIBRARY_PATH')
+            if libpath:
+                for d in libpath.split(':'):
+                    cmd.extend(['-L', d])
+            cmd.extend(['-o', os.devnull, '-l%s' % name])
+            result = None
+            try:
+                p = subprocess.Popen(cmd, stdout=subprocess.PIPE,
+                                     stderr=subprocess.PIPE,
+                                     universal_newlines=True)
+                out, _ = p.communicate()
+                res = re.search(expr, os.fsdecode(out))
+                if res:
+                    result = res.group(0)
+            except Exception as e:
+                pass  # result will be None
+            return result
+
+         def find_library(name):
+-            return _findSoname_ldconfig(name) or _get_soname(_findLib_gcc(name))
+            # See issue #9998
+            return _findSoname_ldconfig(name) or \
+                   _get_soname(_findLib_gcc(name) or _findLib_ld(name))
+ 
+ ################################################################
+ # test code
+-- 
+2.14.1
+
--- a/pkgs/development/interpreters/python/cpython/3.5/default.nix
+++ b/pkgs/development/interpreters/python/cpython/3.5/default.nix
@ -66,6 +66,7 @@ in stdenv.mkDerivation {

  patches = [
    ./no-ldconfig.patch
+    ./ld_library_path.patch
  ];

  postPatch = ''
--- a/pkgs/development/interpreters/python/cpython/3.5/ld_library_path.patch
+++ b/pkgs/development/interpreters/python/cpython/3.5/ld_library_path.patch
@ -0,0 +1,51 @@
+From 918201682127ed8a270a4bd1a448b490019e4ada Mon Sep 17 00:00:00 2001
+From: Frederik Rietdijk <fridh@fridh.nl>
+Date: Thu, 14 Sep 2017 10:00:31 +0200
+Subject: [PATCH] ctypes.util: support LD_LIBRARY_PATH
+
+Backports support for LD_LIBRARY_PATH from 3.6
+---
+ Lib/ctypes/util.py | 26 +++++++++++++++++++++++++-
+ 1 file changed, 25 insertions(+), 1 deletion(-)
+
+diff --git a/Lib/ctypes/util.py b/Lib/ctypes/util.py
+index e9957d7951..9926f6c881 100644
+--- a/Lib/ctypes/util.py
+++ b/Lib/ctypes/util.py
+@@ -219,8 +219,32 @@ elif os.name == "posix":
+         def _findSoname_ldconfig(name):
+             return None
+ 
+        def _findLib_ld(name):
+            # See issue #9998 for why this is needed
+            expr = r'[^\(\)\s]*lib%s\.[^\(\)\s]*' % re.escape(name)
+            cmd = ['ld', '-t']
+            libpath = os.environ.get('LD_LIBRARY_PATH')
+            if libpath:
+                for d in libpath.split(':'):
+                    cmd.extend(['-L', d])
+            cmd.extend(['-o', os.devnull, '-l%s' % name])
+            result = None
+            try:
+                p = subprocess.Popen(cmd, stdout=subprocess.PIPE,
+                                     stderr=subprocess.PIPE,
+                                     universal_newlines=True)
+                out, _ = p.communicate()
+                res = re.search(expr, os.fsdecode(out))
+                if res:
+                    result = res.group(0)
+            except Exception as e:
+                pass  # result will be None
+            return result
+
+         def find_library(name):
+-            return _findSoname_ldconfig(name) or _get_soname(_findLib_gcc(name))
+            # See issue #9998
+            return _findSoname_ldconfig(name) or \
+                   _get_soname(_findLib_gcc(name) or _findLib_ld(name))
+ 
+ ################################################################
+ # test code
+-- 
+2.14.1
+
--- a/pkgs/development/interpreters/racket/default.nix
+++ b/pkgs/development/interpreters/racket/default.nix
@ -33,11 +33,11 @@ in

 stdenv.mkDerivation rec {
  name = "racket-${version}";
-  version = "6.10";
+  version = "6.10.1";

  src = fetchurl {
    url = "http://mirror.racket-lang.org/installers/${version}/${name}-src.tgz";
-    sha256 = "1mqnyj3bawad12dygsb11f2dbnkjp7q6d7ra714rqyw8mxix5ws0";
+    sha256 = "0v3z6x277lq1y7wkqdf6mj3826z5vq0yadygspx9h4r0f1dnmafc";
  };

  FONTCONFIG_FILE = fontsConf;
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@ -212,11 +212,11 @@ in {
    };
  };

-  ruby_2_4_1 = generic {
-    version = rubyVersion "2" "4" "1" "";
+  ruby_2_4_2 = generic {
+    version = rubyVersion "2" "4" "2" "";
    sha256 = {
-      src = "0l0201fqwzwygnrgxay469gbb2w865bnqckq00x3prdmbh6y2c53";
-      git = "1gjn31ymypzzcwkrjx62hqw59fywz1x3cyvmi1f2yb9bwb3659ss";
+      src = "174cdiz3am1f76vsnm3iqi9c5vqphypbf9kbxx6vqqmj01gfgfck";
+      git = "1w83kzak3m6vv3k09ynfw9vpgc7vpmij3x3zmgrhwm4ds1sp5irl";
    };
  };
 }
--- a/pkgs/development/interpreters/ruby/patchsets.nix
+++ b/pkgs/development/interpreters/ruby/patchsets.nix
@ -34,7 +34,7 @@ rec {
    "${patchSet}/patches/ruby/2.3/head/railsexpress/02-improve-gc-stats.patch"
    "${patchSet}/patches/ruby/2.3/head/railsexpress/03-display-more-detailed-stack-trace.patch"
  ];
-  "2.4.1" = ops useRailsExpress [
+  "2.4.2" = ops useRailsExpress [
    "${patchSet}/patches/ruby/2.4/head/railsexpress/01-skip-broken-tests.patch"
    "${patchSet}/patches/ruby/2.4/head/railsexpress/02-improve-gc-stats.patch"
    "${patchSet}/patches/ruby/2.4/head/railsexpress/03-display-more-detailed-stack-trace.patch"
--- a/pkgs/development/libraries/appstream-glib/default.nix
+++ b/pkgs/development/libraries/appstream-glib/default.nix
@ -28,7 +28,11 @@ in stdenv.mkDerivation rec {
  propagatedBuildInputs = [ gtk3 ];
  mesonFlags = [ "-Denable-rpm=false" "-Denable-stemmer=false" "-Denable-dep11=false" ];

-  postFixup = "patchelf --set-rpath ${rpath} $out/lib/libappstream-glib.so";
+  postFixup = ''
+    for elf in "$out"/bin/* "$out"/lib/*.so; do
+      patchelf --set-rpath '${rpath}':"$out/lib" "$elf"
+    done
+  '';

  meta = with stdenv.lib; {
    description = "Objects and helper methods to read and write AppStream metadata";
--- a/pkgs/development/libraries/ffmpeg-full/default.nix
+++ b/pkgs/development/libraries/ffmpeg-full/default.nix
@ -231,11 +231,11 @@ assert nvenc -> nvidia-video-sdk != null && nonfreeLicensing;

 stdenv.mkDerivation rec {
  name = "ffmpeg-full-${version}";
-  version = "3.3.3";
+  version = "3.3.4";

  src = fetchurl {
    url = "https://www.ffmpeg.org/releases/ffmpeg-${version}.tar.xz";
-    sha256 = "07is8msrhxr1dk6vgwa192k2pl2a0in1h9w8f9cknlvbvhn01afj";
+    sha256 = "0mx9dvad3lkyhvsrblf280x2bz6dxajya1ylnspbdzldj0dpxfcq";
  };

  patchPhase = ''patchShebangs .
--- a/pkgs/development/libraries/ffmpeg/3.3.nix
+++ b/pkgs/development/libraries/ffmpeg/3.3.nix
@ -6,7 +6,7 @@

 callPackage ./generic.nix (args // rec {
  version = "${branch}";
-  branch = "3.3.3";
-  sha256 = "0wx421d7vp4nz8kgp0kg16sswikj8ff1pd18x9mmcbpmqy7sqs8h";
+  branch = "3.3.4";
+  sha256 = "0zmczggi95fbsq9nz33mpln1y3p1gqniqc4x5smp871idhkykxay";
  darwinFrameworks = [ Cocoa CoreMedia ];
 })
--- a/pkgs/development/libraries/gmime/default.nix
+++ b/pkgs/development/libraries/gmime/default.nix
@ -1,7 +1,8 @@
 { stdenv, fetchurl, pkgconfig, glib, zlib, libgpgerror, gobjectIntrospection }:

 stdenv.mkDerivation rec {
-  name = "gmime-2.6.23";
+  version = "2.6.23";
+  name = "gmime-${version}";

  src = fetchurl {
    url = "mirror://gnome/sources/gmime/2.6/${name}.tar.xz";
@ -16,10 +17,11 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

-  meta = {
+  meta = with stdenv.lib; {
    homepage = https://github.com/jstedfast/gmime/;
    description = "A C/C++ library for creating, editing and parsing MIME messages and structures";
-    maintainers = [ stdenv.lib.maintainers.chaoflow ];
-    platforms = stdenv.lib.platforms.unix;
+    license = licenses.lgpl21Plus;
+    maintainers = with maintainers; [ chaoflow ];
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/development/libraries/gmime/3.nix
+++ b/pkgs/development/libraries/gmime/3.nix
@ -0,0 +1,27 @@
+{ stdenv, fetchurl, pkgconfig, glib, zlib, gpgme, libidn, gobjectIntrospection }:
+
+stdenv.mkDerivation rec {
+  version = "3.0.1";
+  name = "gmime-${version}";
+
+  src = fetchurl {
+    url = "mirror://gnome/sources/gmime/3.0/${name}.tar.xz";
+    sha256 = "001y93b8mq9alzkvli6vfh3pzdcn5c5iy206ml23lzhhhvm5k162";
+  };
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [ pkgconfig gobjectIntrospection ];
+  propagatedBuildInputs = [ glib zlib gpgme libidn ];
+  configureFlags = [ "--enable-introspection=yes" ];
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/jstedfast/gmime/;
+    description = "A C/C++ library for creating, editing and parsing MIME messages and structures";
+    license = licenses.lgpl21Plus;
+    maintainers = with maintainers; [ chaoflow ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/development/libraries/gtk+/3.x.nix
+++ b/pkgs/development/libraries/gtk+/3.x.nix
@ -13,7 +13,7 @@ with stdenv.lib;

 let
  ver_maj = "3.22";
-  ver_min = "19";
+  ver_min = "21";
  version = "${ver_maj}.${ver_min}";
 in
 stdenv.mkDerivation rec {
@ -21,7 +21,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "mirror://gnome/sources/gtk+/${ver_maj}/gtk+-${version}.tar.xz";
-    sha256 = "9883d3ca5244f9b3168ce660e87d52900e141d0f7147dea0640bdd6fe8e5166c";
+    sha256 = "1bd3c1a85cfb4db112cabb5379abb05a1a94fe43052d309d573493fca00e6b87";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/development/libraries/kde-frameworks/fetch.sh
+++ b/pkgs/development/libraries/kde-frameworks/fetch.sh
@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/frameworks/5.37/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/frameworks/5.38/ -A '*.tar.xz' )
--- a/pkgs/development/libraries/kde-frameworks/ktexteditor.nix
+++ b/pkgs/development/libraries/kde-frameworks/ktexteditor.nix
@ -2,7 +2,7 @@
  mkDerivation, lib, copyPathsToStore,
  extra-cmake-modules, perl,
  karchive, kconfig, kguiaddons, ki18n, kiconthemes, kio, kparts, libgit2,
-  qtscript, qtxmlpatterns, sonnet, syntax-highlighting
+  qtscript, qtxmlpatterns, sonnet, syntax-highlighting, qtquickcontrols
 }:

 mkDerivation {
@ -11,7 +11,7 @@ mkDerivation {
  nativeBuildInputs = [ extra-cmake-modules perl ];
  buildInputs = [
    karchive kconfig kguiaddons ki18n kiconthemes kio libgit2 qtscript
-    qtxmlpatterns sonnet syntax-highlighting
+    qtxmlpatterns sonnet syntax-highlighting qtquickcontrols
  ];
  propagatedBuildInputs = [ kparts ];
 }
--- a/pkgs/development/libraries/kde-frameworks/srcs.nix
+++ b/pkgs/development/libraries/kde-frameworks/srcs.nix
@ -3,603 +3,603 @@

 {
  attica = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/attica-5.37.0.tar.xz";
-      sha256 = "13jqk4w9crh8pca6n9334l1gb8bmwf86pa36k0mfh5j19dq72g2p";
-      name = "attica-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/attica-5.38.0.tar.xz";
+      sha256 = "12smdcd7lcyjqiw0bsk3lwivrl6cvmiqv5cqaw0gz8flhvk29w96";
+      name = "attica-5.38.0.tar.xz";
    };
  };
  baloo = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/baloo-5.37.0.tar.xz";
-      sha256 = "19sl07lhjrri40vfi8wl6azgmg08lgfb98xx110j6spjbbbnww79";
-      name = "baloo-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/baloo-5.38.0.tar.xz";
+      sha256 = "14522akyxg36lclfblp65xai95i9hiydqjhkmfkadjbq82wm9s9i";
+      name = "baloo-5.38.0.tar.xz";
    };
  };
  bluez-qt = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/bluez-qt-5.37.0.tar.xz";
-      sha256 = "1x6nj7vsn0sp9rckzkcbl6fwm7qzj5w98w2qys1fndb1spl7av8s";
-      name = "bluez-qt-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/bluez-qt-5.38.0.tar.xz";
+      sha256 = "0hanmygp4smbvczxn4dj997z3bln32p017z0r26z89m2p0b2ylwv";
+      name = "bluez-qt-5.38.0.tar.xz";
    };
  };
  breeze-icons = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/breeze-icons-5.37.0.tar.xz";
-      sha256 = "17nr2phd0nxyx49igvl170ksikapgc4365z26pw0dmmw41llcbxw";
-      name = "breeze-icons-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/breeze-icons-5.38.0.tar.xz";
+      sha256 = "09afi6c4h31ycs6aa85lqbmn392zi532zf8fp7ll43xxjv9isac9";
+      name = "breeze-icons-5.38.0.tar.xz";
    };
  };
  extra-cmake-modules = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/extra-cmake-modules-5.37.0.tar.xz";
-      sha256 = "1jr7nmhh4kyz1g454qkldfhimfjvvylqa19zna5iak08bkq8q696";
-      name = "extra-cmake-modules-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/extra-cmake-modules-5.38.0.tar.xz";
+      sha256 = "0ci3vdzdbcrbnxpqvf4hcwcrzz1ijhifp8b99wh3k53rinnai231";
+      name = "extra-cmake-modules-5.38.0.tar.xz";
    };
  };
  frameworkintegration = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/frameworkintegration-5.37.0.tar.xz";
-      sha256 = "0pcy3hjqbahbx65yxz5bl0h2ah4y3fb7mq3pj1rrp2cpp92s135a";
-      name = "frameworkintegration-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/frameworkintegration-5.38.0.tar.xz";
+      sha256 = "0w1n3czgsnnmaqwypy3mpci8s4ppv9030zxw7ka7rsvwgkpqijq8";
+      name = "frameworkintegration-5.38.0.tar.xz";
    };
  };
  kactivities = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kactivities-5.37.0.tar.xz";
-      sha256 = "005xvzp10kvwcsl2w6ghcqgqnr2rdvv9w61i4y44y25vcb85g26v";
-      name = "kactivities-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kactivities-5.38.0.tar.xz";
+      sha256 = "0grm0cilc80g5ih2hqhwgwm35mlfnrs343j6ixkd9s0mflv2b798";
+      name = "kactivities-5.38.0.tar.xz";
    };
  };
  kactivities-stats = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kactivities-stats-5.37.0.tar.xz";
-      sha256 = "09zsdzf77palmww7x3dzinl0hxrm4z0q0yc2fmf0d7z6cfl695y2";
-      name = "kactivities-stats-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kactivities-stats-5.38.0.tar.xz";
+      sha256 = "0s57iz04n3m4fpqrqflda6vpk4l1mnf0nyz1iyza382fb375afd2";
+      name = "kactivities-stats-5.38.0.tar.xz";
    };
  };
  kapidox = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kapidox-5.37.0.tar.xz";
-      sha256 = "1xwkaamifxjghv158rwslndfd9z70rm9ixnp1mmkgw8radwsqg5v";
-      name = "kapidox-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kapidox-5.38.0.tar.xz";
+      sha256 = "1j4k75lhqdnsxmgyvblla0627qvgabxivw6limfdb3rdpmqdxj76";
+      name = "kapidox-5.38.0.tar.xz";
    };
  };
  karchive = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/karchive-5.37.0.tar.xz";
-      sha256 = "1599lql0kcx705313bfvbazr7rayr6vsiwrpiq6iwljzc7lli1im";
-      name = "karchive-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/karchive-5.38.0.tar.xz";
+      sha256 = "0n5nxd3v9ljjff0r6k4xrvy5hj057b7c7jzcq258harl359d8m4k";
+      name = "karchive-5.38.0.tar.xz";
    };
  };
  kauth = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kauth-5.37.0.tar.xz";
-      sha256 = "0ciz28bvbvxlv0iz0cgs31x2m1czkki21ypzqj8rg2ix8jw2p65w";
-      name = "kauth-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kauth-5.38.0.tar.xz";
+      sha256 = "12nyfbilz4v4b2i5x191iph3jj4lcpw7z1rh0xrv5y1v7dczk6i7";
+      name = "kauth-5.38.0.tar.xz";
    };
  };
  kbookmarks = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kbookmarks-5.37.0.tar.xz";
-      sha256 = "0l6rkj0b7hk2wg6dypj1dkl8pcd1vx89gaiixbhkd3vf7jp46n41";
-      name = "kbookmarks-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kbookmarks-5.38.0.tar.xz";
+      sha256 = "0s230mcwmrg0qpz42sg804m96j2xpnwj4bdp0mfv08x3jasqpbrq";
+      name = "kbookmarks-5.38.0.tar.xz";
    };
  };
  kcmutils = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kcmutils-5.37.0.tar.xz";
-      sha256 = "1ik1505f16swsmvrv62dacis33f1ccnmkw3zbhb84vbrbqyskvzx";
-      name = "kcmutils-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kcmutils-5.38.0.tar.xz";
+      sha256 = "0n6f2xvl5v8fwfxpdl6la1hb01dh4h1pcdrf05nn60v0rqg9f58b";
+      name = "kcmutils-5.38.0.tar.xz";
    };
  };
  kcodecs = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kcodecs-5.37.0.tar.xz";
-      sha256 = "0kmk97b5vbnyb3xjxwmg3l47aka8mkf50g4p7wvr096qwplffbva";
-      name = "kcodecs-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kcodecs-5.38.0.tar.xz";
+      sha256 = "0cnxhaj5jk7f3j9q4hzphc3nm3vdaqwy9xab5d4nvn1kv8vjv8ii";
+      name = "kcodecs-5.38.0.tar.xz";
    };
  };
  kcompletion = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kcompletion-5.37.0.tar.xz";
-      sha256 = "0qhjkqmd1jjy50hlzsdxwgnjwpfdrz3njl5n88h3nzp83yjv1ljz";
-      name = "kcompletion-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kcompletion-5.38.0.tar.xz";
+      sha256 = "0f955w67wrk15rdmglrk7k0xc5i6kah12bpb078xhzlyfackg52w";
+      name = "kcompletion-5.38.0.tar.xz";
    };
  };
  kconfig = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kconfig-5.37.0.tar.xz";
-      sha256 = "1f0y2gmwy05b17clr7vg1zp18l1z0fd757v02ha7cwd64yznyr5d";
-      name = "kconfig-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kconfig-5.38.0.tar.xz";
+      sha256 = "0fi428dsr6qpa9336wcfic6hyix6l2p9s135w00qzdwhdkr4lx3r";
+      name = "kconfig-5.38.0.tar.xz";
    };
  };
  kconfigwidgets = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kconfigwidgets-5.37.0.tar.xz";
-      sha256 = "001d1nj8q6xpl71rwm15rnvy5ajyxpvknvf4ic7p5pbik3021bs6";
-      name = "kconfigwidgets-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kconfigwidgets-5.38.0.tar.xz";
+      sha256 = "0w319d94wxn90dbbdfw5zrn2ddnv9vb7wldkpvvycq7yxrhsfw0x";
+      name = "kconfigwidgets-5.38.0.tar.xz";
    };
  };
  kcoreaddons = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kcoreaddons-5.37.0.tar.xz";
-      sha256 = "0a45sz11d7b2d8sbr9z57mv337nbhd94fiqk3issw470n0y46g3y";
-      name = "kcoreaddons-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kcoreaddons-5.38.0.tar.xz";
+      sha256 = "1m3mn9fhllwcidzji2l26k5yxzrqkbyjdly04nh3s5rf823dvqwv";
+      name = "kcoreaddons-5.38.0.tar.xz";
    };
  };
  kcrash = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kcrash-5.37.0.tar.xz";
-      sha256 = "16k2pwf3s3adgayd9vq7kk8c5gnq9g6wra4psrvs3a3c5k5am5y0";
-      name = "kcrash-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kcrash-5.38.0.tar.xz";
+      sha256 = "1a8hvyhwa112wx4ldadlrxpyda6qpial387j07dr1jq1cnzr0p11";
+      name = "kcrash-5.38.0.tar.xz";
    };
  };
  kdbusaddons = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kdbusaddons-5.37.0.tar.xz";
-      sha256 = "0745arkp4wnpwyhjq02h7lfac049cmlg5qwhf96i7ss0w54vch4i";
-      name = "kdbusaddons-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kdbusaddons-5.38.0.tar.xz";
+      sha256 = "1mw9sl82y2aj7l2xj1skrbxbyv55br60h6f61r4f1mqcaxaqj7qw";
+      name = "kdbusaddons-5.38.0.tar.xz";
    };
  };
  kdeclarative = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kdeclarative-5.37.0.tar.xz";
-      sha256 = "1ish46m2dpnpqjnf8g660clcg7ky65w11cbk2m79pwyhqvhxgggj";
-      name = "kdeclarative-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kdeclarative-5.38.0.tar.xz";
+      sha256 = "1966sxzhdkzi2lwg5ixhrx0yg10plbvn9lsjgnj9crghaajsnf4b";
+      name = "kdeclarative-5.38.0.tar.xz";
    };
  };
  kded = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kded-5.37.0.tar.xz";
-      sha256 = "162s5qx2qb0bi889f8jjvd3ci31azd8iwp25i04vwi0lzglwb8gy";
-      name = "kded-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kded-5.38.0.tar.xz";
+      sha256 = "0xsjzj5jx4wsrq5fnbv6raqlr11shz20p2mvypf5wfvq2c1vb5lb";
+      name = "kded-5.38.0.tar.xz";
    };
  };
  kdelibs4support = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/portingAids/kdelibs4support-5.37.0.tar.xz";
-      sha256 = "1zz100m1sqfmg3ni7023b99qn79jhdd2ryw6534axl5zgn0sglh9";
-      name = "kdelibs4support-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/portingAids/kdelibs4support-5.38.0.tar.xz";
+      sha256 = "06vlgziy212pwm4z9r8rbfa9ziwx3nkihy9b25m13gbh60baqapp";
+      name = "kdelibs4support-5.38.0.tar.xz";
    };
  };
  kdesignerplugin = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kdesignerplugin-5.37.0.tar.xz";
-      sha256 = "1197003bqcdpsyn6faasr2nhaadh7ryg92vjpqim78af3vwinsdw";
-      name = "kdesignerplugin-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kdesignerplugin-5.38.0.tar.xz";
+      sha256 = "0rivjxgsxvsgk24lnzsqpzqr7m1i1faqnbby3rnkw2059z28l0y6";
+      name = "kdesignerplugin-5.38.0.tar.xz";
    };
  };
  kdesu = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kdesu-5.37.0.tar.xz";
-      sha256 = "1qfhkzk6l9rfdyiad8y6k30zlhziz3q2dxvxkmnghxmkg98yhdza";
-      name = "kdesu-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kdesu-5.38.0.tar.xz";
+      sha256 = "1c9j2zih7r0jph41kzxnxpri9snphm1k4w4rs1q6zawwz8a5kcr5";
+      name = "kdesu-5.38.0.tar.xz";
    };
  };
  kdewebkit = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kdewebkit-5.37.0.tar.xz";
-      sha256 = "1ph3a50wix42hmsbc9jbfxla172aihjx9yzp9rza09j1a7va3hg1";
-      name = "kdewebkit-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kdewebkit-5.38.0.tar.xz";
+      sha256 = "1cncbjkgrbrnvwx3izjqh9hqiw9bg6aqaq09f8bdryvr8537b0zf";
+      name = "kdewebkit-5.38.0.tar.xz";
    };
  };
  kdnssd = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kdnssd-5.37.0.tar.xz";
-      sha256 = "03rd6znn2qwndn4m3bb03slwyic06ry535rawgyh06lfps0fcc5z";
-      name = "kdnssd-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kdnssd-5.38.0.tar.xz";
+      sha256 = "101gygxrq2m3yfz6j0ldspib3pm3jjvqz505j3h15zj59qcwqw0x";
+      name = "kdnssd-5.38.0.tar.xz";
    };
  };
  kdoctools = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kdoctools-5.37.0.tar.xz";
-      sha256 = "0gbc5qqim6262hvkl9pf6rynnblxb3hsw3c4ars03ip7n761y0zl";
-      name = "kdoctools-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kdoctools-5.38.0.tar.xz";
+      sha256 = "0fbv7i1930rl496psny7nfiixvsnaq535h1zggwkwv6i9dh7wpy9";
+      name = "kdoctools-5.38.0.tar.xz";
    };
  };
  kemoticons = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kemoticons-5.37.0.tar.xz";
-      sha256 = "1cx978s1dm3v1jh4aymncxs44iizdqp174dqg9m5mf043fcvvinq";
-      name = "kemoticons-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kemoticons-5.38.0.tar.xz";
+      sha256 = "1c0991yd8jx2diy5ynl11h5qqyapn1dsir2gy04y8m90h944vdd5";
+      name = "kemoticons-5.38.0.tar.xz";
    };
  };
  kfilemetadata = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kfilemetadata-5.37.0.tar.xz";
-      sha256 = "17mbm6pdi6ac61kj2qzxf7y3rbxhxg9rwqr7qy766gh3img2vq8p";
-      name = "kfilemetadata-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kfilemetadata-5.38.0.tar.xz";
+      sha256 = "1815r9lx99h9kzbk67bfk41jya3y2hsi112fsgpv3m4mg028pklm";
+      name = "kfilemetadata-5.38.0.tar.xz";
    };
  };
  kglobalaccel = {
-    version = "5.37.0";
+    version = "5.38.1";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kglobalaccel-5.37.0.tar.xz";
-      sha256 = "1d84q3r6q5n2lclym9a9m1brfqnq3p3dykfpzvhcba3bjxh3cdsb";
-      name = "kglobalaccel-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kglobalaccel-5.38.1.tar.xz";
+      sha256 = "0si3bxxa6wj008j6rr6a1ljnsbmim4z0pqyx1z48ih4qamcfpkin";
+      name = "kglobalaccel-5.38.1.tar.xz";
    };
  };
  kguiaddons = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kguiaddons-5.37.0.tar.xz";
-      sha256 = "13g6nlw8fk135i6z3f8ichy8whxd6v4rycg80dlvm25h66rg6vn5";
-      name = "kguiaddons-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kguiaddons-5.38.0.tar.xz";
+      sha256 = "1jks0hwn665hlypl0qfhi5r0prqzrg1gv4skc88zp1kgx05kb9h1";
+      name = "kguiaddons-5.38.0.tar.xz";
    };
  };
  khtml = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/portingAids/khtml-5.37.0.tar.xz";
-      sha256 = "1n0mx2xy9n5ffhvh58z3kn61aa7dhppsrwgxk697pybqy1h45ah2";
-      name = "khtml-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/portingAids/khtml-5.38.0.tar.xz";
+      sha256 = "0fa61va3dbwml40y4scxks223swlb8vf5730wr7rijl91lz1adgy";
+      name = "khtml-5.38.0.tar.xz";
    };
  };
  ki18n = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/ki18n-5.37.0.tar.xz";
-      sha256 = "1c1sy4pbhlwsajs2972brdmma5val72gkil6k0a0f58nfvvg952d";
-      name = "ki18n-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/ki18n-5.38.0.tar.xz";
+      sha256 = "0z9arj2s4fn04vavl6ad3avl1p5yr3mgr2n802lmvy2wlqicy314";
+      name = "ki18n-5.38.0.tar.xz";
    };
  };
  kiconthemes = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kiconthemes-5.37.0.tar.xz";
-      sha256 = "1j7mgfsvxa24nf1d9xyn2jv9y9j523vghsvsm73x8d3ijibchfxq";
-      name = "kiconthemes-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kiconthemes-5.38.0.tar.xz";
+      sha256 = "01xa30r2cx312vbmz2c3x8vvna1cqb6fx91cjp4aivp9q4jwaz9a";
+      name = "kiconthemes-5.38.0.tar.xz";
    };
  };
  kidletime = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kidletime-5.37.0.tar.xz";
-      sha256 = "01m4q3l2yq83f2dpbv6jry7cjkj6bqdgfpy5b8byaf1gf9w2firs";
-      name = "kidletime-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kidletime-5.38.0.tar.xz";
+      sha256 = "1i91w9hcb2k5n9qz8q7k2z44z9ss7r9i2zsg9vnl8am7dqqhmlsv";
+      name = "kidletime-5.38.0.tar.xz";
    };
  };
  kimageformats = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kimageformats-5.37.0.tar.xz";
-      sha256 = "1knha6wjzjs0vnkljwpfinzg3hg2jyh9c07ifqvd47cprl96ickg";
-      name = "kimageformats-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kimageformats-5.38.0.tar.xz";
+      sha256 = "0q78shcwgczdm5ylhbp9fnq70w3hqzkbynp2vpyyg5pjaam8xjlp";
+      name = "kimageformats-5.38.0.tar.xz";
    };
  };
  kinit = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kinit-5.37.0.tar.xz";
-      sha256 = "0b7dyy4hqyf6wk7gg2l23ldnji2zl8vzyj5wd5qh4yi7rdl6js5r";
-      name = "kinit-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kinit-5.38.0.tar.xz";
+      sha256 = "0k4i0zrwkz088vjkk7d7whwhkrjvqqhdigspzf58d1laryiy0jdf";
+      name = "kinit-5.38.0.tar.xz";
    };
  };
  kio = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kio-5.37.0.tar.xz";
-      sha256 = "0nxchbhs8p2d4243dyp7qa65g1p6r3ic2h6dz7w0aa0qzsy8wi29";
-      name = "kio-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kio-5.38.0.tar.xz";
+      sha256 = "15qmr2ghrj7pgqxrgpvhdp9g5vaap9mzlmry6ayph75m1afb4fpl";
+      name = "kio-5.38.0.tar.xz";
    };
  };
  kirigami2 = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kirigami2-5.37.0.tar.xz";
-      sha256 = "1z42rsi8nzshrbv8m8vxkay4dq46kggglhgxbbgg2q00y8gjq9dd";
-      name = "kirigami2-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kirigami2-5.38.0.tar.xz";
+      sha256 = "18k41j5ijmgmzgl2rv4ac0bnxlax3505zi1nmqm8bkdpznhfr13c";
+      name = "kirigami2-5.38.0.tar.xz";
    };
  };
  kitemmodels = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kitemmodels-5.37.0.tar.xz";
-      sha256 = "1nlpzzp4m0ghfz1p2hrwn4lbhjhxc8b8q8kbzqbh9hmwmimbzzrr";
-      name = "kitemmodels-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kitemmodels-5.38.0.tar.xz";
+      sha256 = "0s20in4jjd2pvv9bn79lvgqqlf806hw014icp51f5hfknrhpdyjc";
+      name = "kitemmodels-5.38.0.tar.xz";
    };
  };
  kitemviews = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kitemviews-5.37.0.tar.xz";
-      sha256 = "17r7vnlyiiifhrz4gb4fifshn1jb4c67lhadczi8d301rzk7wwsm";
-      name = "kitemviews-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kitemviews-5.38.0.tar.xz";
+      sha256 = "0ldi8qzs2sbhz8l57nshjrnwhjl9mhw90kcqw71cldp41wm0pps6";
+      name = "kitemviews-5.38.0.tar.xz";
    };
  };
  kjobwidgets = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kjobwidgets-5.37.0.tar.xz";
-      sha256 = "1162dxhpspd7p1735npp0amrxr5b0j467f5651k2rv6mvqfmqr4b";
-      name = "kjobwidgets-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kjobwidgets-5.38.0.tar.xz";
+      sha256 = "0vp6nc73c9788nrib742k9nzqbx4m8m77ipqh9dnnkx4ggrhsd55";
+      name = "kjobwidgets-5.38.0.tar.xz";
    };
  };
  kjs = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/portingAids/kjs-5.37.0.tar.xz";
-      sha256 = "046hy8ji4i6p2xp5gnqa8dk82sv6sbh4xg67y79i82bbi97dvq9b";
-      name = "kjs-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/portingAids/kjs-5.38.0.tar.xz";
+      sha256 = "0diw580k5kyv60bqhnxhqinlrn0b3p3n89iy0kdgjgnr6197fwy1";
+      name = "kjs-5.38.0.tar.xz";
    };
  };
  kjsembed = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/portingAids/kjsembed-5.37.0.tar.xz";
-      sha256 = "0w2wk5azf1b45db58qj0cdc1l056x9s1xcd09ibavx5xmdvq6br0";
-      name = "kjsembed-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/portingAids/kjsembed-5.38.0.tar.xz";
+      sha256 = "0nb07n54208gnmag7h3dhc8hri2s83ln1c9wq6c0xw7jchaz9z8a";
+      name = "kjsembed-5.38.0.tar.xz";
    };
  };
  kmediaplayer = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/portingAids/kmediaplayer-5.37.0.tar.xz";
-      sha256 = "0fqxrkcwwzg11zsax9q169lisnfp9jsqg4ccd6xvv8kpkz3g04jp";
-      name = "kmediaplayer-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/portingAids/kmediaplayer-5.38.0.tar.xz";
+      sha256 = "1qb2g8j871gf38i2dk2j9ags848fa3kqdjl3l4924hf28az0g736";
+      name = "kmediaplayer-5.38.0.tar.xz";
    };
  };
  knewstuff = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/knewstuff-5.37.0.tar.xz";
-      sha256 = "1scnxhxx4g8j4wml6x8i5v00rpaxyzzcm7vqbra2axbql5d8g8ny";
-      name = "knewstuff-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/knewstuff-5.38.0.tar.xz";
+      sha256 = "1l4cmfcsljg7v5l6341fxcp7c7i615l8351l941dwcmw4yng0lj0";
+      name = "knewstuff-5.38.0.tar.xz";
    };
  };
  knotifications = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/knotifications-5.37.0.tar.xz";
-      sha256 = "0gvv6jal7n4m3y30ragjlyhghq3y2782d422im9klxqzlgdgvkb6";
-      name = "knotifications-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/knotifications-5.38.0.tar.xz";
+      sha256 = "1jvmv2hi3dbf0bd2b61l9s5lb1dx2rjl9z7pw1fb5j20910k6zgd";
+      name = "knotifications-5.38.0.tar.xz";
    };
  };
  knotifyconfig = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/knotifyconfig-5.37.0.tar.xz";
-      sha256 = "14kjckynszv8015p17j578l3knmkmw25d8r8ks4wavgj3db9bik5";
-      name = "knotifyconfig-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/knotifyconfig-5.38.0.tar.xz";
+      sha256 = "05hgglm6ypbaplxr43632zh5fmgsz6543110169k9fbjnczyhcyk";
+      name = "knotifyconfig-5.38.0.tar.xz";
    };
  };
  kpackage = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kpackage-5.37.0.tar.xz";
-      sha256 = "1ikf55q2pk8vm70pqm7rmakja309zjh9z1lg0xqslq1pqd6xki7s";
-      name = "kpackage-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kpackage-5.38.0.tar.xz";
+      sha256 = "0v4j3kqgg52rlmdxmd98aqw0hk7i2xqsw9mhhxfs9c7vm1x05sxn";
+      name = "kpackage-5.38.0.tar.xz";
    };
  };
  kparts = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kparts-5.37.0.tar.xz";
-      sha256 = "0jrd8idkz8nhkda2rwgf8rysqngiv4r5ajmrzp2kfz1pr91a6l5h";
-      name = "kparts-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kparts-5.38.0.tar.xz";
+      sha256 = "19ba749pwnb7xvmr7lryn6z53zb49hqn0xq4j9fmbic95nh039zp";
+      name = "kparts-5.38.0.tar.xz";
    };
  };
  kpeople = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kpeople-5.37.0.tar.xz";
-      sha256 = "1qgp4wqp985ac1m9wakpsvk3c2driwkwrjkc3aic7dyr1p456qsf";
-      name = "kpeople-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kpeople-5.38.0.tar.xz";
+      sha256 = "0yd29436bgfw6jjjr9n38hx8561mrlgl5vynci6ng9bx1jflay0x";
+      name = "kpeople-5.38.0.tar.xz";
    };
  };
  kplotting = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kplotting-5.37.0.tar.xz";
-      sha256 = "0k4s0qvhjm9h1bmg16l32g4bsdrp2jrcila4dgzvrb56447px0zw";
-      name = "kplotting-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kplotting-5.38.0.tar.xz";
+      sha256 = "1hvfqm6i5fsyssb51w3yybsil8h9cbqgd2n8k0wnz99m8xifzn72";
+      name = "kplotting-5.38.0.tar.xz";
    };
  };
  kpty = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kpty-5.37.0.tar.xz";
-      sha256 = "0wb873r1ycgi11s0qx3lhvz54703yz5sax6fb6wdmri5c05gzd5a";
-      name = "kpty-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kpty-5.38.0.tar.xz";
+      sha256 = "0cgh8hixrplgc280652jlvk8ibcddmjvflwb0gjawd9iq7lcb66y";
+      name = "kpty-5.38.0.tar.xz";
    };
  };
  kross = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/portingAids/kross-5.37.0.tar.xz";
-      sha256 = "06pk6f6v82pd7x9rsmkhkp5r9sgcbrc503lqckl8d7argbb7j4k1";
-      name = "kross-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/portingAids/kross-5.38.0.tar.xz";
+      sha256 = "1dccg214cqpyn3nninalpknglfmchz2k1fk4rlgq53wf4n6w23b7";
+      name = "kross-5.38.0.tar.xz";
    };
  };
  krunner = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/krunner-5.37.0.tar.xz";
-      sha256 = "171qbhr1yszl2gcffm47p5wiwj71w9yhvk6srhvfpiwfyh61a4ld";
-      name = "krunner-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/krunner-5.38.0.tar.xz";
+      sha256 = "16fhl5zm8scyxk83mpkavvzkn23qgzcblg315jy6klr5bz9jxgcm";
+      name = "krunner-5.38.0.tar.xz";
    };
  };
  kservice = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kservice-5.37.0.tar.xz";
-      sha256 = "1zxs5yzd3rmy33vsip4c4igk9g38kzaggw8c29sxmgr8vgdrnvhr";
-      name = "kservice-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kservice-5.38.0.tar.xz";
+      sha256 = "0zaamvxhfx4xdy2m8spyhi0hdv6p0fn5hqn9pyi5l8xdixnwjc9d";
+      name = "kservice-5.38.0.tar.xz";
    };
  };
  ktexteditor = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/ktexteditor-5.37.0.tar.xz";
-      sha256 = "0y04s1nwkf0np6iymjxf0jssin28qw2901kpb3iw8gd52ni5rrks";
-      name = "ktexteditor-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/ktexteditor-5.38.0.tar.xz";
+      sha256 = "195ygv1j4wfvly31g22wxz9sshhqyi1yyf2mv1v63d9ci88v7rri";
+      name = "ktexteditor-5.38.0.tar.xz";
    };
  };
  ktextwidgets = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/ktextwidgets-5.37.0.tar.xz";
-      sha256 = "1p8ns75sbnapm6ds16hx36q9vlnz9phgy28rx0gm1ckxqvm4yzr5";
-      name = "ktextwidgets-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/ktextwidgets-5.38.0.tar.xz";
+      sha256 = "120jxab8w1vhqcckda51r0x2pmfb2qd2h6inhivl72c4m5x89w7f";
+      name = "ktextwidgets-5.38.0.tar.xz";
    };
  };
  kunitconversion = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kunitconversion-5.37.0.tar.xz";
-      sha256 = "1qvq61sbv9naj5ndi5xjwx7ami0xa6bqiajr912kbbbp2257cjsi";
-      name = "kunitconversion-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kunitconversion-5.38.0.tar.xz";
+      sha256 = "10k0xfb11r7l1bdnlanqgdwwx8wrs8bmnswb2y85xxr7wwsqnlvc";
+      name = "kunitconversion-5.38.0.tar.xz";
    };
  };
  kwallet = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kwallet-5.37.0.tar.xz";
-      sha256 = "1l7jl3y0rzx2whnbp6w5p6kg71vwyccp2nwxxgcxr6541m0nihsz";
-      name = "kwallet-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kwallet-5.38.0.tar.xz";
+      sha256 = "1qysdj4nmkxywj7bzqdc78ifnqjnkrz9qbp4a49acpng2y4zw1nw";
+      name = "kwallet-5.38.0.tar.xz";
    };
  };
  kwayland = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kwayland-5.37.0.tar.xz";
-      sha256 = "0d4c8l8k38pgj73kzlf1hsq52w31wy9wgpwph1bv0cq5yn2rjiyr";
-      name = "kwayland-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kwayland-5.38.0.tar.xz";
+      sha256 = "0gd58nvyc39waj7vv2c68r59qqpv0jppm95548j2p924w48syjj0";
+      name = "kwayland-5.38.0.tar.xz";
    };
  };
  kwidgetsaddons = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kwidgetsaddons-5.37.0.tar.xz";
-      sha256 = "1jmk377r1h4is2il7chh6bq8wbj21psf4b1yiw84iivg38vlpid4";
-      name = "kwidgetsaddons-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kwidgetsaddons-5.38.0.tar.xz";
+      sha256 = "1yh48qxdqz3rk020wr897vkzsi4nhh37lxbg6211xrlirn0lzvj5";
+      name = "kwidgetsaddons-5.38.0.tar.xz";
    };
  };
  kwindowsystem = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kwindowsystem-5.37.0.tar.xz";
-      sha256 = "0pd2n0j5pdv1x7wf4mwcpimnah73g6l0xidhqbpg37p829jix2k2";
-      name = "kwindowsystem-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kwindowsystem-5.38.0.tar.xz";
+      sha256 = "02xrin8lshvqkw12d0692z40h3g61f4crh28jcmi5zqlaxiyn5ic";
+      name = "kwindowsystem-5.38.0.tar.xz";
    };
  };
  kxmlgui = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kxmlgui-5.37.0.tar.xz";
-      sha256 = "0jrvjlxkg9knj61b2gj2w6l96jlmww9kn4ij808ir35365x3cdg2";
-      name = "kxmlgui-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kxmlgui-5.38.0.tar.xz";
+      sha256 = "12cmyhm05nkr9xj7cpnqihrlndfqn1kjkzhcn1ywj20y1gd3mxv4";
+      name = "kxmlgui-5.38.0.tar.xz";
    };
  };
  kxmlrpcclient = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/kxmlrpcclient-5.37.0.tar.xz";
-      sha256 = "1jn9v86dpfx43qcdcsp6lpnga9q6aa5vxjkkg4wg0wbxmw4w9gvq";
-      name = "kxmlrpcclient-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/kxmlrpcclient-5.38.0.tar.xz";
+      sha256 = "0g9ah59h8vq68yg4pfdbqx44xrs856wrr181rsdbsizj0qj3hyaa";
+      name = "kxmlrpcclient-5.38.0.tar.xz";
    };
  };
  modemmanager-qt = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/modemmanager-qt-5.37.0.tar.xz";
-      sha256 = "1fqf43kvj1v1mcdlbfxbh6sh3ycvg35aml2ywh2a684iz4qzq1aq";
-      name = "modemmanager-qt-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/modemmanager-qt-5.38.0.tar.xz";
+      sha256 = "18ham8lrxblywc634n49237js5y5k6qgjf5zrjc8gzapn934l89w";
+      name = "modemmanager-qt-5.38.0.tar.xz";
    };
  };
  networkmanager-qt = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/networkmanager-qt-5.37.0.tar.xz";
-      sha256 = "01px9n97gyvyyfg3dp1k7dik9fprgx9i28hg8wjr2rb5dlr99jd1";
-      name = "networkmanager-qt-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/networkmanager-qt-5.38.0.tar.xz";
+      sha256 = "10d28nrkppmmfl9pwq2hkrvi461acf29djdzala4l37mp4dwvbf8";
+      name = "networkmanager-qt-5.38.0.tar.xz";
    };
  };
  oxygen-icons5 = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/oxygen-icons5-5.37.0.tar.xz";
-      sha256 = "1rns7n93f83qp5q11a7r5y87y0hvc0q95ar57cqy0fxsqrg4614h";
-      name = "oxygen-icons5-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/oxygen-icons5-5.38.0.tar.xz";
+      sha256 = "0fk97r3br5myqpnfalz67l5hkamxc5vc5swa68wpg1xih6jc3iid";
+      name = "oxygen-icons5-5.38.0.tar.xz";
    };
  };
  plasma-framework = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/plasma-framework-5.37.0.tar.xz";
-      sha256 = "0kamvxfzrbx3msn0cp3k20clqchz9jg5wlazz3h6p6zmrk5v16bh";
-      name = "plasma-framework-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/plasma-framework-5.38.0.tar.xz";
+      sha256 = "1dvhqfi34v44h0wj0m68k477hmx53x9zsf4mh03xq164w1yz68sg";
+      name = "plasma-framework-5.38.0.tar.xz";
    };
  };
  prison = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/prison-5.37.0.tar.xz";
-      sha256 = "1icsirwfh7zscm8x9g2gp7aqzhs81ahhjflwjcwpz9bh0r9f1wb7";
-      name = "prison-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/prison-5.38.0.tar.xz";
+      sha256 = "0prj3z6s3aighmk4qarfljca7j9cy7ypvgh8rv5di3jb2v4nbg4m";
+      name = "prison-5.38.0.tar.xz";
    };
  };
  solid = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/solid-5.37.0.tar.xz";
-      sha256 = "1gb9gnp1a11q5abl97b7sq1if2rqcrcs0f33sakpxf1z9y0ppg8l";
-      name = "solid-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/solid-5.38.0.tar.xz";
+      sha256 = "1b3c5drx4m1x4ai0ziz0yan16a5s3ghf0py37mb92qyimq586lhh";
+      name = "solid-5.38.0.tar.xz";
    };
  };
  sonnet = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/sonnet-5.37.0.tar.xz";
-      sha256 = "0sb6i464riadgb2q73nj0vy6xavr2m1sszrvghr20nj7i64f3kk0";
-      name = "sonnet-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/sonnet-5.38.0.tar.xz";
+      sha256 = "1355p88swnk828gsbnm3v4gryffnwbzjcdq49k8jwywzb65bnwxa";
+      name = "sonnet-5.38.0.tar.xz";
    };
  };
  syntax-highlighting = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/syntax-highlighting-5.37.0.tar.xz";
-      sha256 = "1l56pb84z7sy0qq8xkd5w5v5418bm9n4qds0vd39ch655d47bl72";
-      name = "syntax-highlighting-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/syntax-highlighting-5.38.0.tar.xz";
+      sha256 = "101ng0l3jfg8x9bns9z38jk3iayijwcb299kf860vfy0nki8gf6l";
+      name = "syntax-highlighting-5.38.0.tar.xz";
    };
  };
  threadweaver = {
-    version = "5.37.0";
+    version = "5.38.0";
    src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.37/threadweaver-5.37.0.tar.xz";
-      sha256 = "1hb3721r1zbbyj211886sfkcxk18k0rsdhcg9ssagx10f29rpxx4";
-      name = "threadweaver-5.37.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.38/threadweaver-5.38.0.tar.xz";
+      sha256 = "1d89l9lknc1q25cz9r8iwc1a102q788mj01ghnl6ydss65rclvfv";
+      name = "threadweaver-5.38.0.tar.xz";
    };
  };
 }
--- a/pkgs/development/libraries/libffi/default.nix
+++ b/pkgs/development/libraries/libffi/default.nix
@ -10,7 +10,11 @@ stdenv.mkDerivation rec {
    sha256 = "0dya49bnhianl0r65m65xndz6ls2jn1xngyn72gd28ls3n7bnvnh";
  };

-  patches = stdenv.lib.optional stdenv.isCygwin ./3.2.1-cygwin.patch;
+  patches = stdenv.lib.optional stdenv.isCygwin ./3.2.1-cygwin.patch ++
+    stdenv.lib.optional stdenv.isAarch64 (fetchurl {
+      url = https://src.fedoraproject.org/rpms/libffi/raw/ccffc1700abfadb0969495a6e51b964117fc03f6/f/libffi-aarch64-rhbz1174037.patch;
+      sha256 = "1vpirrgny43hp0885rswgv3xski8hg7791vskpbg3wdjdpb20wbc";
+    });

  outputs = [ "out" "dev" "man" "info" ];

--- a/pkgs/development/pharo/launcher/default.nix
+++ b/pkgs/development/pharo/launcher/default.nix
@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
     secs=5
     echo -n "Running headless Pharo for $secs seconds to check for a crash... "
     timeout $secs \
-       "${pharo}/bin/pharo" -nodisplay PharoLauncher.image --no-quit eval 'true'
+       "${pharo}/bin/pharo" --nodisplay PharoLauncher.image --no-quit eval 'true'
     test "$?" == 124 && echo "ok")
  '';

--- a/pkgs/development/python-modules/altair/default.nix
+++ b/pkgs/development/python-modules/altair/default.nix
@ -19,6 +19,8 @@ buildPythonPackage rec {
  '';

  propagatedBuildInputs = [ vega pandas ipython traitlets ];
+  # Disabling checks, MockRequest object has no method send()
+  doCheck = false;

  meta = with stdenv.lib; {
    description = "A declarative statistical visualization library for Python.";
--- a/pkgs/development/python-modules/arelle/default.nix
+++ b/pkgs/development/python-modules/arelle/default.nix
@ -1,7 +1,7 @@
 { gui ? true,
  buildPythonPackage, fetchFromGitHub, lib,
  sphinx_1_2, lxml, isodate, numpy, pytest,
-  tkinter ? null,
+  tkinter ? null, py3to2,
  ... }:

 let
@ -26,6 +26,7 @@ buildPythonPackage {
  buildInputs = [
    sphinx_1_2
    pytest
+    py3to2
  ];
  propagatedBuildInputs = [
    lxml
--- a/Show More
+++ b/Show More