Merge remote-tracking branch 'upstream/master' into HEAD

2018-02-17 14:15:29 +01:00 · 2018-02-17 14:15:29 +01:00 · 0586da4b37
commit 0586da4b37
parent b24ce2ae63 9f05e67af2
179 changed files with 4556 additions and 2111 deletions
--- a/lib/maintainers.nix
+++ b/lib/maintainers.nix
@ -327,6 +327,7 @@
  jirkamarsik = "Jirka Marsik <jiri.marsik89@gmail.com>";
  jlesquembre = "José Luis Lafuente <jl@lafuente.me>";
  jluttine = "Jaakko Luttinen <jaakko.luttinen@iki.fi>";
+  Jo = "Joachim Ernst <0x4A6F@shackspace.de>";
  joachifm = "Joachim Fasting <joachifm@fastmail.fm>";
  joamaki = "Jussi Maki <joamaki@gmail.com>";
  joelmo = "Joel Moberg <joel.moberg@gmail.com>";
@ -369,6 +370,7 @@
  kristoff3r = "Kristoffer Søholm <k.soeholm@gmail.com>";
  ktosiek = "Tomasz Kontusz <tomasz.kontusz@gmail.com>";
  kuznero = "Roman Kuznetsov <roman@kuznero.com>";
+  lasandell = "Luke Sandell <lasandell@gmail.com>";
  lassulus = "Lassulus <lassulus@gmail.com>";
  layus = "Guillaume Maudoux <layus.on@gmail.com>";
  ldesgoui = "Lucas Desgouilles <ldesgoui@gmail.com>";
@ -478,6 +480,7 @@
  mudri = "James Wood <lamudri@gmail.com>";
  muflax = "Stefan Dorn <mail@muflax.com>";
  myrl = "Myrl Hex <myrl.0xf@gmail.com>";
+  nadrieril = "Nadrieril Feneanar <nadrieril@gmail.com>";
  namore = "Roman Naumann <namor@hemio.de>";
  nand0p = "Fernando Jose Pando <nando@hex7.com>";
  Nate-Devv = "Nathan Moore <natedevv@gmail.com>";
@ -661,6 +664,7 @@
  sternenseemann = "Lukas Epple <post@lukasepple.de>";
  stesie = "Stefan Siegl <stesie@brokenpipe.de>";
  steveej = "Stefan Junker <mail@stefanjunker.de>";
+  StijnDW = "Stijn DW <stekke@airmail.cc>";
  StillerHarpo = "Florian Engel <florianengel39@gmail.com>";
  stumoss = "Stuart Moss <samoss@gmail.com>";
  SuprDewd = "Bjarki Ágúst Guðmundsson <suprdewd@gmail.com>";
@ -670,6 +674,7 @@
  symphorien = "Guillaume Girol <symphorien_nixpkgs@xlumurb.eu>";
  szczyp = "Szczyp <qb@szczyp.com>";
  sztupi = "Attila Sztupak <attila.sztupak@gmail.com>";
+  tadfisher = "Tad Fisher <tadfisher@gmail.com>";
  taeer = "Taeer Bar-Yam <taeer@necsi.edu>";
  tailhook = "Paul Colomiets <paul@colomiets.name>";
  taketwo = "Sergey Alexandrov <alexandrov88@gmail.com>";
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -75,6 +75,7 @@
  ./programs/cdemu.nix
  ./programs/chromium.nix
  ./programs/command-not-found/command-not-found.nix
+  ./programs/criu.nix
  ./programs/dconf.nix
  ./programs/environment.nix
  ./programs/fish.nix
@ -92,6 +93,7 @@
  ./programs/nano.nix
  ./programs/npm.nix
  ./programs/oblogout.nix
+  ./programs/plotinus.nix
  ./programs/qt5ct.nix
  ./programs/rootston.nix
  ./programs/screen.nix
@ -102,6 +104,7 @@
  ./programs/ssh.nix
  ./programs/ssmtp.nix
  ./programs/sysdig.nix
+  ./programs/systemtap.nix
  ./programs/sway.nix
  ./programs/thefuck.nix
  ./programs/tmux.nix
--- a/nixos/modules/programs/criu.nix
+++ b/nixos/modules/programs/criu.nix
@ -0,0 +1,26 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let cfg = config.programs.criu;
+in {
+
+  options = {
+    programs.criu = {
+      enable = mkOption {
+        default = false;
+        description = ''
+          Install <command>criu</command> along with necessary kernel options.
+        '';
+      };
+    };
+  };
+  config = mkIf cfg.enable {
+    system.requiredKernelConfig = with config.lib.kernelConfig; [
+      (isYes "CHECKPOINT_RESTORE")
+    ];
+    boot.kernel.features.criu = true;
+    environment.systemPackages = [ pkgs.criu ];
+  };
+
+}
--- a/nixos/modules/programs/plotinus.nix
+++ b/nixos/modules/programs/plotinus.nix
@ -0,0 +1,36 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.programs.plotinus;
+in
+{
+  meta = {
+    maintainers = pkgs.plotinus.meta.maintainers;
+    doc = ./plotinus.xml;
+  };
+
+  ###### interface
+
+  options = {
+    programs.plotinus = {
+      enable = mkOption {
+        default = false;
+        description = ''
+          Whether to enable the Plotinus GTK+3 plugin.  Plotinus provides a
+          popup (triggered by Ctrl-Shift-P) to search the menus of a
+          compatible application.
+        '';
+        type = types.bool;
+      };
+    };
+  };
+
+  ###### implementation
+
+  config = mkIf cfg.enable {
+    environment.variables.XDG_DATA_DIRS = [ "${pkgs.plotinus}/share/gsettings-schemas/${pkgs.plotinus.name}" ];
+    environment.variables.GTK3_MODULES = [ "${pkgs.plotinus}/lib/libplotinus.so" ];
+  };
+}
--- a/nixos/modules/programs/plotinus.xml
+++ b/nixos/modules/programs/plotinus.xml
@ -0,0 +1,25 @@
+<chapter xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="module-program-plotinus">
+
+<title>Plotinus</title>
+
+<para><emphasis>Source:</emphasis> <filename>modules/programs/plotinus.nix</filename></para>
+
+<para><emphasis>Upstream documentation:</emphasis> <link xlink:href="https://github.com/p-e-w/plotinus"/></para>
+
+<para>Plotinus is a searchable command palette in every modern GTK+ application.</para>
+
+<para>When in a GTK+3 application and Plotinus is enabled, you can press <literal>Ctrl+Shift+P</literal> to open the command palette.  The command palette provides a searchable list of of all menu items in the application.</para>
+
+<para>To enable Plotinus, add the following to your <filename>configuration.nix</filename>:
+
+<programlisting>
+programs.plotinus.enable = true;
+</programlisting>
+
+</para>
+
+</chapter>
--- a/nixos/modules/programs/systemtap.nix
+++ b/nixos/modules/programs/systemtap.nix
@ -0,0 +1,28 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let cfg = config.programs.systemtap;
+in {
+
+  options = {
+    programs.systemtap = {
+      enable = mkOption {
+        default = false;
+        description = ''
+          Install <command>systemtap</command> along with necessary kernel options.
+        '';
+      };
+    };
+  };
+  config = mkIf cfg.enable {
+    system.requiredKernelConfig = with config.lib.kernelConfig; [
+      (isYes "DEBUG")
+    ];
+    boot.kernel.features.debug = true;
+    environment.systemPackages = [
+      config.boot.kernelPackages.systemtap
+    ];
+  };
+
+}
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@ -205,6 +205,8 @@ with lib;
      "See the 16.09 release notes for more information.")
    (mkRemovedOptionModule [ "services" "phpfpm" "phpIni" ] "")
    (mkRemovedOptionModule [ "services" "dovecot2" "package" ] "")
+    (mkRemovedOptionModule [ "services" "firefox" "syncserver" "user" ] "")
+    (mkRemovedOptionModule [ "services" "firefox" "syncserver" "group" ] "")
    (mkRemovedOptionModule [ "fonts" "fontconfig" "hinting" "style" ] "")
    (mkRemovedOptionModule [ "services" "xserver" "displayManager" "sddm" "themes" ]
      "Set the option `services.xserver.displayManager.sddm.package' instead.")
--- a/nixos/modules/services/cluster/kubernetes/dashboard.nix
+++ b/nixos/modules/services/cluster/kubernetes/dashboard.nix
@ -6,12 +6,12 @@ let
  cfg = config.services.kubernetes.addons.dashboard;

  name = "gcr.io/google_containers/kubernetes-dashboard-amd64";
-	version = "v1.6.3";
+	version = "v1.8.2";

  image = pkgs.dockerTools.pullImage {
    imageName = name;
    imageTag = version;
-    sha256 = "1sf54d96nkgic9hir9c6p14gw24ns1k5d5a0r1sg414kjrvic0b4";
+    sha256 = "11h0fz3wxp0f10fsyqaxjm7l2qg7xws50dv5iwlck5gb1fjmajad";
  };
 in {
  options.services.kubernetes.addons.dashboard = {
--- a/nixos/modules/services/cluster/kubernetes/default.nix
+++ b/nixos/modules/services/cluster/kubernetes/default.nix
@ -301,8 +301,8 @@ in {
          Kubernetes apiserver authorization mode (AlwaysAllow/AlwaysDeny/ABAC/RBAC). See
          <link xlink:href="http://kubernetes.io/docs/admin/authorization.html"/>
        '';
-        default = ["RBAC"];
-        type = types.listOf (types.enum ["AlwaysAllow" "AlwaysDeny" "ABAC" "RBAC"]);
+        default = ["RBAC" "Node"];
+        type = types.listOf (types.enum ["AlwaysAllow" "AlwaysDeny" "ABAC" "RBAC" "Node"]);
      };

      authorizationPolicy = mkOption {
@ -344,7 +344,7 @@ in {
          Kubernetes admission control plugins to use. See
          <link xlink:href="http://kubernetes.io/docs/admin/admission-controllers/"/>
        '';
-        default = ["NamespaceLifecycle" "LimitRanger" "ServiceAccount" "ResourceQuota" "DefaultStorageClass" "DefaultTolerationSeconds"];
+        default = ["NamespaceLifecycle" "LimitRanger" "ServiceAccount" "ResourceQuota" "DefaultStorageClass" "DefaultTolerationSeconds" "NodeRestriction"];
        example = [
          "NamespaceLifecycle" "NamespaceExists" "LimitRanger"
          "SecurityContextDeny" "ServiceAccount" "ResourceQuota"
--- a/nixos/modules/services/hardware/fwupd.nix
+++ b/nixos/modules/services/hardware/fwupd.nix
@ -87,4 +87,8 @@ in {
      "d /var/lib/fwupd 0755 root root -"
    ];
  };
+
+  meta = {
+    maintainers = pkgs.fwupd.maintainers;
+  };
 }
--- a/nixos/modules/services/networking/connman.nix
+++ b/nixos/modules/services/networking/connman.nix
@ -52,6 +52,15 @@ in {
        '';
      };

+      extraFlags = mkOption {
+        type = with types; listOf string;
+        default = [ ];
+        example = [ "--nodnsproxy" ];
+        description = ''
+          Extra flags to pass to connmand
+        '';
+      };
+
    };

  };
@ -81,7 +90,7 @@ in {
        Type = "dbus";
        BusName = "net.connman";
        Restart = "on-failure";
-        ExecStart = "${pkgs.connman}/sbin/connmand --config=${configFile} --nodaemon";
+        ExecStart = "${pkgs.connman}/sbin/connmand --config=${configFile} --nodaemon ${toString cfg.extraFlags}";
        StandardOutput = "null";
      };
    };
--- a/nixos/modules/services/networking/dante.nix
+++ b/nixos/modules/services/networking/dante.nix
@ -47,7 +47,7 @@ in

    systemd.services.dante = {
      description   = "Dante SOCKS v4 and v5 compatible proxy server";
-      after         = [ "network.target" ];
+      after         = [ "network-online.target" ];
      wantedBy      = [ "multi-user.target" ];

      serviceConfig = {
--- a/nixos/modules/services/networking/firefox/sync-server.nix
+++ b/nixos/modules/services/networking/firefox/sync-server.nix
@ -33,6 +33,8 @@ let
 in

 {
+  meta.maintainers = with lib.maintainers; [ nadrieril ];
+
  options = {
    services.firefox.syncserver = {
      enable = mkOption {
@ -70,18 +72,6 @@ in
        '';
      };

-      user = mkOption {
-        type = types.str;
-        default = "syncserver";
-        description = "User account under which syncserver runs.";
-      };
-
-      group = mkOption {
-        type = types.str;
-        default = "syncserver";
-        description = "Group account under which syncserver runs.";
-      };
-
      publicUrl = mkOption {
        type = types.str;
        default = "http://localhost:5000/";
@ -137,7 +127,9 @@ in
  config = mkIf cfg.enable {

    systemd.services.syncserver = let
-      syncServerEnv = pkgs.python.withPackages(ps: with ps; [ syncserver pasteScript ]);
+      syncServerEnv = pkgs.python.withPackages(ps: with ps; [ syncserver pasteScript requests ]);
+      user = "syncserver";
+      group = "syncserver";
    in {
      after = [ "network.target" ];
      description = "Firefox Sync Server";
@ -145,43 +137,43 @@ in
      path = [ pkgs.coreutils syncServerEnv ];

      serviceConfig = {
-        User = cfg.user;
-        Group = cfg.group;
+        User = user;
+        Group = group;
        PermissionsStartOnly = true;
      };

      preStart = ''
        if ! test -e ${cfg.privateConfig}; then
-          mkdir -m 700 -p $(dirname ${cfg.privateConfig})
+          mkdir -p $(dirname ${cfg.privateConfig})
          echo  > ${cfg.privateConfig} '[syncserver]'
+          chmod 600 ${cfg.privateConfig}
          echo >> ${cfg.privateConfig} "secret = $(head -c 20 /dev/urandom | sha1sum | tr -d ' -')"
        fi
-        chown ${cfg.user}:${cfg.group} ${cfg.privateConfig}
+        chmod 600 ${cfg.privateConfig}
+        chmod 755 $(dirname ${cfg.privateConfig})
+        chown ${user}:${group} ${cfg.privateConfig}
+
      '' + optionalString (cfg.sqlUri == defaultSqlUri) ''
        if ! test -e $(dirname ${defaultDbLocation}); then
          mkdir -m 700 -p $(dirname ${defaultDbLocation})
-          chown ${cfg.user}:${cfg.group} $(dirname ${defaultDbLocation})
+          chown ${user}:${group} $(dirname ${defaultDbLocation})
        fi
+
        # Move previous database file if it exists
        oldDb="/var/db/firefox-sync-server.db"
        if test -f $oldDb; then
          mv $oldDb ${defaultDbLocation}
-          chown ${cfg.user}:${cfg.group} ${defaultDbLocation}
+          chown ${user}:${group} ${defaultDbLocation}
        fi
      '';
      serviceConfig.ExecStart = "${syncServerEnv}/bin/paster serve ${syncServerIni}";
    };

-    users.extraUsers = optionalAttrs (cfg.user == "syncserver")
-      (singleton {
-        name = "syncserver";
-        group = cfg.group;
-        isSystemUser = true;
-      });
+    users.users.syncserver = {
+      group = "syncserver";
+      isSystemUser = true;
+    };

-    users.extraGroups = optionalAttrs (cfg.group == "syncserver")
-      (singleton {
-        name = "syncserver";
-      });
+    users.groups.syncserver = {};
  };
 }
--- a/nixos/modules/services/networking/freeradius.nix
+++ b/nixos/modules/services/networking/freeradius.nix
@ -0,0 +1,72 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  cfg = config.services.freeradius;
+
+  freeradiusService = cfg:
+  {
+    description = "FreeRadius server";
+    wantedBy = ["multi-user.target"];
+    after = ["network-online.target"];
+    wants = ["network-online.target"];
+    preStart = ''
+      ${pkgs.freeradius}/bin/radiusd -C -d ${cfg.configDir} -l stdout
+    '';
+
+    serviceConfig = {
+        ExecStart = "${pkgs.freeradius}/bin/radiusd -f -d ${cfg.configDir} -l stdout -xx";
+        ExecReload = [
+          "${pkgs.freeradius}/bin/radiusd -C -d ${cfg.configDir} -l stdout"
+          "${pkgs.coreutils}/bin/kill -HUP $MAINPID"
+        ];
+        User = "radius";
+        ProtectSystem = "full";
+        ProtectHome = "on";
+        Restart = "on-failure";
+        RestartSec = 2;
+    };
+  };
+
+  freeradiusConfig = {
+    enable = mkEnableOption "the freeradius server";
+
+    configDir = mkOption {
+      type = types.path;
+      default = "/etc/raddb";
+      description = ''
+        The path of the freeradius server configuration directory.
+      '';
+    };
+
+  };
+
+in
+
+{
+
+  ###### interface
+
+  options = {
+    services.freeradius = freeradiusConfig;
+  };
+
+
+  ###### implementation
+
+  config = mkIf (cfg.enable) {
+
+    users = {
+      extraUsers.radius = {
+        /*uid = config.ids.uids.radius;*/
+        description = "Radius daemon user";
+      };
+    };
+
+    systemd.services.freeradius = freeradiusService cfg;
+
+  };
+
+}
--- a/nixos/modules/services/networking/prosody.nix
+++ b/nixos/modules/services/networking/prosody.nix
@ -179,6 +179,19 @@ in
        description = "Whether to enable the prosody server";
      };

+      package = mkOption {
+        type = types.package;
+        description = "Prosody package to use";
+        default = pkgs.prosody;
+        defaultText = "pkgs.prosody";
+        example = literalExample ''
+          pkgs.prosody.override {
+            withExtraLibs = [ pkgs.luaPackages.lpty ];
+            withCommunityModules = [ "auth_external" ];
+          };
+        '';
+      };
+
      allowRegistration = mkOption {
        type = types.bool;
        default = false;
@ -306,7 +319,7 @@ in
        User = "prosody";
        Type = "forking";
        PIDFile = "/var/lib/prosody/prosody.pid";
-        ExecStart = "${pkgs.prosody}/bin/prosodyctl start";
+        ExecStart = "${cfg.package}/bin/prosodyctl start";
      };
    };

--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@ -578,6 +578,7 @@ in
        mkdir -p ${cfg.stateDir}/logs
        chmod 700 ${cfg.stateDir}
        chown -R ${cfg.user}:${cfg.group} ${cfg.stateDir}
+        ${cfg.package}/bin/nginx -c ${configFile} -p ${cfg.stateDir} -t
        '';
      serviceConfig = {
        ExecStart = "${cfg.package}/bin/nginx -c ${configFile} -p ${cfg.stateDir}";
--- a/nixos/modules/system/boot/kernel.nix
+++ b/nixos/modules/system/boot/kernel.nix
@ -5,7 +5,7 @@ with lib;
 let

  inherit (config.boot) kernelPatches;
-
+  inherit (config.boot.kernel) features;
  inherit (config.boot.kernelPackages) kernel;

  kernelModulesConf = pkgs.writeText "nixos.conf"
@ -21,11 +21,25 @@ in

  options = {

+    boot.kernel.features = mkOption {
+      default = {};
+      example = literalExample "{ debug = true; }";
+      internal = true;
+      description = ''
+        This option allows to enable or disable certain kernel features.
+        It's not API, because it's about kernel feature sets, that
+        make sense for specific use cases. Mostly along with programs,
+        which would have separate nixos options.
+        `grep features pkgs/os-specific/linux/kernel/common-config.nix`
+      '';
+    };
+
    boot.kernelPackages = mkOption {
      default = pkgs.linuxPackages;
      apply = kernelPackages: kernelPackages.extend (self: super: {
        kernel = super.kernel.override {
          kernelPatches = super.kernel.kernelPatches ++ kernelPatches;
+          features = lib.recursiveUpdate super.kernel.features features;
        };
      });
      # We don't want to evaluate all of linuxPackages for the manual
@ -170,7 +184,7 @@ in
      [ "loglevel=${toString config.boot.consoleLogLevel}" ] ++
      optionals config.boot.vesa [ "vga=0x317" ];

-    boot.kernel.sysctl."kernel.printk" = config.boot.consoleLogLevel;
+    boot.kernel.sysctl."kernel.printk" = mkDefault config.boot.consoleLogLevel;

    boot.kernelModules = [ "loop" "atkbd" ];

--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@ -94,7 +94,7 @@ let
  checkNetwork = checkUnitConfig "Network" [
    (assertOnlyFields [
      "Description" "DHCP" "DHCPServer" "IPForward" "IPMasquerade" "IPv4LL" "IPv4LLRoute"
-      "LLMNR" "MulticastDNS" "Domains" "Bridge" "Bond"
+      "LLMNR" "MulticastDNS" "Domains" "Bridge" "Bond" "IPv6PrivacyExtensions"
    ])
    (assertValueOneOf "DHCP" ["both" "none" "v4" "v6"])
    (assertValueOneOf "DHCPServer" boolValues)
@ -104,6 +104,7 @@ let
    (assertValueOneOf "IPv4LLRoute" boolValues)
    (assertValueOneOf "LLMNR" boolValues)
    (assertValueOneOf "MulticastDNS" boolValues)
+    (assertValueOneOf "IPv6PrivacyExtensions" ["yes" "no" "prefer-public" "kernel"])
  ];

  checkAddress = checkUnitConfig "Address" [
--- a/nixos/modules/system/boot/stage-1-init.sh
+++ b/nixos/modules/system/boot/stage-1-init.sh
@ -167,6 +167,7 @@ done
 # Load the required kernel modules.
 mkdir -p /lib
 ln -s @modulesClosure@/lib/modules /lib/modules
+ln -s @modulesClosure@/lib/firmware /lib/firmware
 echo @extraUtils@/bin/modprobe > /proc/sys/kernel/modprobe
 for i in @kernelModules@; do
    echo "loading module $(basename $i)..."
--- a/nixos/modules/system/boot/stage-1.nix
+++ b/nixos/modules/system/boot/stage-1.nix
@ -13,12 +13,14 @@ let

  kernelPackages = config.boot.kernelPackages;
  modulesTree = config.system.modulesTree;
+  firmware = config.hardware.firmware;


  # Determine the set of modules that we need to mount the root FS.
  modulesClosure = pkgs.makeModulesClosure {
    rootModules = config.boot.initrd.availableKernelModules ++ config.boot.initrd.kernelModules;
    kernel = modulesTree;
+    firmware = firmware;
    allowMissing = true;
  };

--- a/nixos/modules/tasks/network-interfaces-systemd.nix
+++ b/nixos/modules/tasks/network-interfaces-systemd.nix
@ -91,6 +91,7 @@ in
            (if i.useDHCP != null then i.useDHCP else cfg.useDHCP && interfaceIps i == [ ]));
          address = flip map (interfaceIps i)
            (ip: "${ip.address}/${toString ip.prefixLength}");
+          networkConfig.IPv6PrivacyExtensions = "kernel";
        } ];
      })))
      (mkMerge (flip mapAttrsToList cfg.bridges (name: bridge: {
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@ -155,6 +155,16 @@ let
        description = "Name of the interface.";
      };

+      preferTempAddress = mkOption {
+        type = types.bool;
+        default = cfg.enableIPv6;
+        defaultText = literalExample "config.networking.enableIpv6";
+        description = ''
+          When using SLAAC prefer a temporary (IPv6) address over the EUI-64
+          address for originating connections. This is used to reduce tracking.
+        '';
+      };
+
      useDHCP = mkOption {
        type = types.nullOr types.bool;
        default = null;
@ -941,6 +951,11 @@ in
        message = ''
          The networking.interfaces."${i.name}" must not have any defined ips when it is a slave.
        '';
+      })) ++ (flip map interfaces (i: {
+        assertion = i.preferTempAddress -> cfg.enableIPv6;
+        message = ''
+          Temporary addresses are only needed when IPv6 is enabled.
+        '';
      })) ++ [
        {
          assertion = cfg.hostId == null || (stringLength cfg.hostId == 8 && isHexString cfg.hostId);
@ -963,9 +978,10 @@ in
      "net.ipv6.conf.all.disable_ipv6" = mkDefault (!cfg.enableIPv6);
      "net.ipv6.conf.default.disable_ipv6" = mkDefault (!cfg.enableIPv6);
      "net.ipv6.conf.all.forwarding" = mkDefault (any (i: i.proxyARP) interfaces);
-    } // listToAttrs (concatLists (flip map (filter (i: i.proxyARP) interfaces)
-        (i: flip map [ "4" "6" ] (v: nameValuePair "net.ipv${v}.conf.${i.name}.proxy_arp" true))
-      ));
+    } // listToAttrs (flip concatMap (filter (i: i.proxyARP) interfaces)
+        (i: flip map [ "4" "6" ] (v: nameValuePair "net.ipv${v}.conf.${i.name}.proxy_arp" true)))
+      // listToAttrs (flip map (filter (i: i.preferTempAddress) interfaces)
+        (i: nameValuePair "net.ipv6.conf.${i.name}.use_tempaddr" 2));

    # Capabilities won't work unless we have at-least a 4.3 Linux
    # kernel because we need the ambient capability
--- a/nixos/modules/virtualisation/lxd.nix
+++ b/nixos/modules/virtualisation/lxd.nix
@ -38,6 +38,15 @@ in
    environment.systemPackages =
      [ pkgs.lxd ];

+    security.apparmor = {
+      enable = true;
+      profiles = [
+        "${pkgs.lxc}/etc/apparmor.d/usr.bin.lxc-start"
+        "${pkgs.lxc}/etc/apparmor.d/lxc-containers"
+      ];
+      packages = [ pkgs.lxc ];
+    };
+
    systemd.services.lxd =
      { description = "LXD Container Management Daemon";

@ -47,6 +56,10 @@ in
        # TODO(wkennington): Add lvm2 and thin-provisioning-tools
        path = with pkgs; [ acl rsync gnutar xz btrfs-progs gzip dnsmasq squashfsTools iproute iptables ];

+        preStart = ''
+          mkdir -m 0755 -p /var/lib/lxc/rootfs
+        '';
+
        serviceConfig.ExecStart = "@${pkgs.lxd.bin}/bin/lxd lxd --syslog --group lxd";
        serviceConfig.Type = "simple";
        serviceConfig.KillMode = "process"; # when stopping, leave the containers alone
--- a/nixos/release.nix
+++ b/nixos/release.nix
@ -258,8 +258,10 @@ in rec {
  tests.firefox = callTest tests/firefox.nix {};
  tests.firewall = callTest tests/firewall.nix {};
  tests.fleet = callTestOnTheseSystems ["x86_64-linux"] tests/fleet.nix {};
+  #tests.fwupd = callTest tests/fwupd.nix {}; # build during evaluation
  #tests.gitlab = callTest tests/gitlab.nix {};
  tests.gitolite = callTest tests/gitolite.nix {};
+  tests.gjs = callTest tests/gjs.nix {};
  tests.gocd-agent = callTest tests/gocd-agent.nix {};
  tests.gocd-server = callTest tests/gocd-server.nix {};
  tests.gnome3 = callTest tests/gnome3.nix {};
@ -277,6 +279,7 @@ in rec {
  tests.ipv6 = callTest tests/ipv6.nix {};
  tests.jenkins = callTest tests/jenkins.nix {};
  tests.plasma5 = callTest tests/plasma5.nix {};
+  tests.plotinus = callTest tests/plotinus.nix {};
  tests.keymap = callSubTests tests/keymap.nix {};
  tests.initrdNetwork = callTest tests/initrd-network.nix {};
  tests.kafka_0_9 = callTest tests/kafka_0_9.nix {};
--- a/nixos/tests/docker-tools.nix
+++ b/nixos/tests/docker-tools.nix
@ -9,28 +9,31 @@ import ./make-test.nix ({ pkgs, ... }: {
  nodes = {
    docker =
      { config, pkgs, ... }: {
-        virtualisation.docker.enable = true;
+        virtualisation = {
+          diskSize = 1024;
+          docker.enable = true;
+        };
      };
  };

  testScript =
-    let
-      dockerImage = pkgs.dockerTools.buildImage {
-        name = "hello-docker";
-        contents = [ pkgs.hello ];
-        tag = "sometag";
-
-        # TODO: create another test checking whether runAsRoot works as intended.
-
-        config = {
-          Cmd = [ "hello" ];
-        };
-      };
-
-    in ''
+    ''
      $docker->waitForUnit("sockets.target");
-      $docker->succeed("docker load --input='${dockerImage}'");
-      $docker->succeed("docker run hello-docker:sometag");
-    '';

+      $docker->succeed("docker load --input='${pkgs.dockerTools.examples.bash}'");
+      $docker->succeed("docker run ${pkgs.dockerTools.examples.bash.imageName} /bin/bash --version");
+
+      $docker->succeed("docker load --input='${pkgs.dockerTools.examples.nix}'");
+      $docker->succeed("docker run ${pkgs.dockerTools.examples.nix.imageName} /bin/nix-store -qR ${pkgs.nix}");
+
+      # To test the pullImage tool
+      $docker->succeed("docker load --input='${pkgs.dockerTools.examples.nixFromDockerHub}'");
+      $docker->succeed("docker run nixos/nix:1.11 nix-store --version");
+
+      # To test runAsRoot and entry point
+      $docker->succeed("docker load --input='${pkgs.dockerTools.examples.nginx}'");
+      $docker->succeed("docker run --name nginx -d -p 8000:80 ${pkgs.dockerTools.examples.nginx.imageName}");
+      $docker->waitUntilSucceeds('curl http://localhost:8000/');
+      $docker->succeed("docker rm --force nginx");
+    '';
 })
--- a/nixos/tests/fwupd.nix
+++ b/nixos/tests/fwupd.nix
@ -0,0 +1,19 @@
+# run installed tests
+import ./make-test.nix ({ pkgs, ... }: {
+  name = "fwupd";
+
+  meta = {
+    maintainers = pkgs.fwupd.meta.maintainers;
+  };
+
+  machine = { config, pkgs, ... }: {
+    services.fwupd.enable = true;
+    environment.systemPackages = with pkgs; [ gnome-desktop-testing ];
+    environment.variables.XDG_DATA_DIRS = [ "${pkgs.fwupd.installedTests}/share" ];
+    virtualisation.memorySize = 768;
+  };
+
+  testScript = ''
+    $machine->succeed("gnome-desktop-testing-runner");
+  '';
+})
--- a/nixos/tests/gjs.nix
+++ b/nixos/tests/gjs.nix
@ -0,0 +1,19 @@
+# run installed tests
+import ./make-test.nix ({ pkgs, ... }: {
+  name = "gjs";
+
+  meta = {
+    maintainers = pkgs.gnome3.gjs.meta.maintainers;
+  };
+
+  machine = { pkgs, ... }: {
+    imports = [ ./common/x11.nix ];
+    environment.systemPackages = with pkgs; [ gnome-desktop-testing ];
+    environment.variables.XDG_DATA_DIRS = [ "${pkgs.gnome3.gjs.installedTests}/share" ];
+  };
+
+  testScript = ''
+    $machine->waitForX;
+    $machine->succeed("gnome-desktop-testing-runner");
+  '';
+})
--- a/nixos/tests/kubernetes/base.nix
+++ b/nixos/tests/kubernetes/base.nix
@ -7,7 +7,7 @@ let
  mkKubernetesBaseTest =
    { name, domain ? "my.zyx", test, machines
    , pkgs ? import <nixpkgs> { inherit system; }
-    , certs ? import ./certs.nix { inherit pkgs; externalDomain = domain; }
+    , certs ? import ./certs.nix { inherit pkgs; externalDomain = domain; kubelets = attrNames machines; }
    , extraConfiguration ? null }:
    let
      masterName = head (filter (machineName: any (role: role == "master") machines.${machineName}.roles) (attrNames machines));
--- a/nixos/tests/kubernetes/certs.nix
+++ b/nixos/tests/kubernetes/certs.nix
@ -2,7 +2,8 @@
  pkgs ? import <nixpkgs> {},
  internalDomain ? "cloud.yourdomain.net",
  externalDomain ? "myawesomecluster.cluster.yourdomain.net",
-  serviceClusterIp ? "10.0.0.1"
+  serviceClusterIp ? "10.0.0.1",
+  kubelets
 }:
 let
  runWithCFSSL = name: cmd:
@ -123,9 +124,10 @@ let
  };

  apiserver-client = {
-    kubelet = createClientCertKey {
+    kubelet = hostname: createClientCertKey {
      inherit ca;
-      cn = "apiserver-client-kubelet";
+      name = "apiserver-client-kubelet-${hostname}";
+      cn = "system:node:${hostname}.${externalDomain}";
      groups = ["system:nodes"];
    };

@ -175,10 +177,9 @@ in {
    paths = [
      (writeCFSSL (noKey ca))
      (writeCFSSL kubelet)
-      (writeCFSSL apiserver-client.kubelet)
      (writeCFSSL apiserver-client.kube-proxy)
      (writeCFSSL etcd-client)
-    ];
+    ] ++ map (hostname: writeCFSSL (apiserver-client.kubelet hostname)) kubelets;
  };

  admin = writeCFSSL apiserver-client.admin;
--- a/nixos/tests/kubernetes/dns.nix
+++ b/nixos/tests/kubernetes/dns.nix
@ -3,7 +3,7 @@ with import ./base.nix { inherit system; };
 let
  domain = "my.zyx";

-  certs = import ./certs.nix { externalDomain = domain; };
+  certs = import ./certs.nix { externalDomain = domain; kubelets = [ "machine1" "machine2" ]; };

  redisPod = pkgs.writeText "redis-pod.json" (builtins.toJSON {
    kind = "Pod";
--- a/nixos/tests/kubernetes/kubernetes-common.nix
+++ b/nixos/tests/kubernetes/kubernetes-common.nix
@ -29,8 +29,8 @@ let
      tlsKeyFile = "${certs.worker}/kubelet-key.pem";
      hostname = "${config.networking.hostName}.${config.networking.domain}";
      kubeconfig = {
-        certFile = "${certs.worker}/apiserver-client-kubelet.pem";
-        keyFile = "${certs.worker}/apiserver-client-kubelet-key.pem";
+        certFile = "${certs.worker}/apiserver-client-kubelet-${config.networking.hostName}.pem";
+        keyFile = "${certs.worker}/apiserver-client-kubelet-${config.networking.hostName}-key.pem";
      };
    };
    controllerManager = {
--- a/nixos/tests/networking.nix
+++ b/nixos/tests/networking.nix
@ -476,6 +476,63 @@ let
        );
      '';
    };
+    privacy = {
+      name = "Privacy";
+      nodes.router = { config, pkgs, ... }: {
+        virtualisation.vlans = [ 1 ];
+        boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = true;
+        networking = {
+          useNetworkd = networkd;
+          interfaces.eth1 = {
+            ipv6Address = "fd00:1234:5678:1::1";
+            ipv6PrefixLength = 64;
+          };
+        };
+        services.radvd = {
+          enable = true;
+          config = ''
+            interface eth1 {
+              AdvSendAdvert on;
+              AdvManagedFlag on;
+              AdvOtherConfigFlag on;
+
+              prefix fd00:1234:5678:1::/64 {
+                AdvAutonomous on;
+                AdvOnLink on;
+              };
+            };
+          '';
+        };
+      };
+      nodes.client = { config, pkgs, ... }: with pkgs.lib; {
+        virtualisation.vlans = [ 1 ];
+        networking = {
+          useNetworkd = networkd;
+          useDHCP = true;
+          interfaces.eth1 = {
+            preferTempAddress = true;
+            ip4 = mkOverride 0 [ ];
+            ip6 = mkOverride 0 [ ];
+          };
+        };
+      };
+      testScript = { nodes, ... }:
+        ''
+          startAll;
+
+          $client->waitForUnit("network.target");
+          $router->waitForUnit("network-online.target");
+
+          # Wait until we have an ip address
+          $client->waitUntilSucceeds("ip addr show dev eth1 | grep -q 'fd00:1234:5678:1:'");
+
+          # Test vlan 1
+          $client->waitUntilSucceeds("ping -c 1 fd00:1234:5678:1::1");
+
+          # Test address used is temporary
+          $client->succeed("! ip route get fd00:1234:5678:1::1 | grep -q ':[a-f0-9]*ff:fe[a-f0-9]*:'");
+        '';
+    };
  };

 in mapAttrs (const (attrs: makeTest (attrs // {
--- a/nixos/tests/plotinus.nix
+++ b/nixos/tests/plotinus.nix
@ -0,0 +1,27 @@
+import ./make-test.nix ({ pkgs, ... }: {
+  name = "plotinus";
+  meta = {
+    maintainers = pkgs.plotinus.meta.maintainers;
+  };
+
+  machine =
+    { config, pkgs, ... }:
+
+    { imports = [ ./common/x11.nix ];
+      programs.plotinus.enable = true;
+      environment.systemPackages = [ pkgs.gnome3.gnome-calculator pkgs.xdotool ];
+    };
+
+  testScript =
+    ''
+      $machine->waitForX;
+      $machine->execute("xterm -e 'gnome-calculator' &");
+      $machine->waitForWindow(qr/Calculator/);
+      $machine->execute("xdotool key ctrl+shift+p");
+      $machine->sleep(1); # wait for the popup
+      $machine->execute("xdotool key p r e f e r e n c e s Return");
+      $machine->waitForWindow(qr/Preferences/);
+      $machine->screenshot("screen");
+    '';
+
+})
--- a/pkgs/applications/audio/mp3blaster/default.nix
+++ b/pkgs/applications/audio/mp3blaster/default.nix
@ -0,0 +1,27 @@
+{ stdenv, fetchFromGitHub, ncurses }:
+stdenv.mkDerivation rec {
+
+  version = "3.2.6";
+
+  name = "mp3blaster-${version}";
+
+  src = fetchFromGitHub {
+    owner = "stragulus";
+    repo = "mp3blaster";
+    rev = "v${version}";
+    sha256 = "0pzwml3yhysn8vyffw9q9p9rs8gixqkmg4n715vm23ib6wxbliqs";
+  };
+
+  buildInputs = [ ncurses ];
+
+  buildFlags = [ "CXXFLAGS=-Wno-narrowing" ];
+
+  meta = with stdenv.lib; {
+    description = "An audio player for the text console";
+    homepage = http://www.mp3blaster.org/;
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ earldouglas ];
+    platforms = platforms.all;
+  };
+
+}
--- a/pkgs/applications/audio/ncpamixer/default.nix
+++ b/pkgs/applications/audio/ncpamixer/default.nix
@ -0,0 +1,33 @@
+{ stdenv, fetchFromGitHub, cmake, ncurses, libpulseaudio, pkgconfig }:
+
+stdenv.mkDerivation rec {
+
+  name = "ncpamixer-${version}";
+  version = "1.2";
+
+  src = fetchFromGitHub {
+    owner = "fulhax";
+    repo = "ncpamixer";
+    rev = version;
+    sha256 = "01kvd0pg5yraymlln5xdzqj1r6adxfvvza84wxn2481kcxfral54";
+  };
+
+  buildInputs = [ ncurses libpulseaudio ];
+  nativeBuildInputs = [ cmake pkgconfig ];
+
+  configurePhase = ''
+    make PREFIX=$out build/Makefile
+  '';
+
+  buildPhase = ''
+    make build
+  '';
+
+  meta = with stdenv.lib; {
+    description = "An ncurses mixer for PulseAudio inspired by pavucontrol";
+    homepage = https://github.com/fulhax/ncpamixer;
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ StijnDW ];
+  };
+}
--- a/pkgs/applications/audio/non/default.nix
+++ b/pkgs/applications/audio/non/default.nix
@ -4,12 +4,12 @@

 stdenv.mkDerivation rec {
  name = "non-${version}";
-  version = "2017-03-29";
+  version = "2018-02-15";
  src = fetchFromGitHub {
    owner = "original-male";
    repo = "non";
-    rev = "10c31e57291b6e42be53371567a722b62b32d220";
-    sha256 = "080rha4ffp7qycyg1mqcf4vj0s7z8qfvz6bxm0w29xgg2kkmb3fx";
+    rev = "5ae43bb27c42387052a73e5ffc5d33efb9d946a9";
+    sha256 = "1cljkkyi9dxqpqhx8y6l2ja4zjmlya26m26kqxml8gx08vyvddhx";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/applications/audio/paprefs/default.nix
+++ b/pkgs/applications/audio/paprefs/default.nix
@ -1,4 +1,4 @@
-{ fetchurl, stdenv, pkgconfig, libpulseaudio, gtkmm2, libglademm
+{ fetchurl, stdenv, pkgconfig, pulseaudioFull, gtkmm2, libglademm
 , dbus_glib, GConf, gconfmm, intltool }:

 stdenv.mkDerivation rec {
@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
    sha256 = "1c5b3sb881szavly220q31g7rvpn94wr7ywlk00hqb9zaikml716";
  };

-  buildInputs = [ libpulseaudio gtkmm2 libglademm dbus_glib gconfmm ];
+  buildInputs = [ pulseaudioFull gtkmm2 libglademm dbus_glib gconfmm ];

  nativeBuildInputs = [ pkgconfig intltool ];

--- a/pkgs/applications/audio/sunvox/default.nix
+++ b/pkgs/applications/audio/sunvox/default.nix
@ -0,0 +1,48 @@
+{ stdenv, fetchurl, unzip, alsaLib, libX11, libXi, SDL2 }:
+
+let
+  libPath = stdenv.lib.makeLibraryPath [ stdenv.cc.cc alsaLib libX11 libXi SDL2 ];
+  arch =
+    if stdenv.isAarch64
+    then "arm64"
+    else if stdenv.isArm
+    then "arm_armhf_raspberry_pi"
+    else if stdenv.is64bit
+    then "x86_64"
+    else "x86";
+in
+stdenv.mkDerivation rec {
+  name = "SunVox-${version}";
+  version = "1.9.3b";
+
+  src = fetchurl {
+    url = "http://www.warmplace.ru/soft/sunvox/sunvox-${version}.zip";
+    sha256 = "0k74rcq7niw4p17vj3zp9lpgi932896dmzqv4ln43g0pz7l18c8b";
+  };
+
+  buildInputs = [ unzip ];
+
+  unpackPhase = "unzip $src";
+
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p $out/share $out/bin
+    mv sunvox $out/share/
+
+    bin="$out/share/sunvox/sunvox/linux_${arch}/sunvox"
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+             --set-rpath "${libPath}" \
+             "$bin"
+
+    ln -s "$bin" $out/bin/sunvox
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Small, fast and powerful modular synthesizer with pattern-based sequencer";
+    license = licenses.unfreeRedistributable;
+    homepage = "http://www.warmplace.ru/soft/sunvox/";
+    maintainers = with maintainers; [ puffnfresh ];
+    platforms = [ "i686-linux" "x86_64-linux" ];
+  };
+}
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@ -6,6 +6,7 @@ let
    };
  };
 in rec {
+  # linux-bundle
  stable = mkStudio {
    pname = "android-studio";
    version = "3.0.1.0"; # "Android Studio 3.0.1"
@ -25,11 +26,12 @@ in rec {
    };
  };

+  # linux-beta-bundle
  preview = mkStudio {
    pname = "android-studio-preview";
-    version = "3.1.0.10"; # "Android Studio 3.1 Beta 2"
-    build = "173.4580418";
-    sha256Hash = "0s56vbyq6b1q75ss6pqvhzwqzb6xbp6841f3y5cwhrch2xalxjkc";
+    version = "3.1.0.11"; # "Android Studio 3.1 Beta 3"
+    build = "173.4595152";
+    sha256Hash = "0106ggrf4mkxx3a2dn02km8rdq23sf15ifysykcay29skgdmq6wx";

    meta = stable.meta // {
      description = "The Official IDE for Android (preview version)";
--- a/pkgs/applications/misc/albert/default.nix
+++ b/pkgs/applications/misc/albert/default.nix
@ -3,13 +3,13 @@

 mkDerivation rec {
  name    = "albert-${version}";
-  version = "0.14.14";
+  version = "0.14.15";

  src = fetchFromGitHub {
    owner  = "albertlauncher";
    repo   = "albert";
    rev    = "v${version}";
-    sha256 = "1skh709f4y4p0vqabvvysn6fgws2yq8izbwkib7rfjc357chhmi7";
+    sha256 = "1rjp0bmzs8b9blbxz3sfcanyhgmds882pf1g3jx5qp85y64j8507";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/misc/memo/default.nix
+++ b/pkgs/applications/misc/memo/default.nix
@ -1,4 +1,4 @@
-{ fetchFromGitHub, ack , tree, stdenv, ... }:
+{ fetchFromGitHub, ag, tree, stdenv, ... }:

 stdenv.mkDerivation rec {

@ -15,6 +15,9 @@ stdenv.mkDerivation rec {

  installPhase = ''
    mkdir -p $out/{bin,share/man/man1,share/bash-completion/completions}
+    substituteInPlace memo \
+      --replace "ack "  "${ag}/bin/ag " \
+      --replace "tree " "${tree}/bin/tree "
    mv memo $out/bin/
    mv doc/memo.1 $out/share/man/man1/memo.1
    mv completion/memo.bash $out/share/bash-completion/completions/memo.sh
--- a/pkgs/applications/misc/ranger/default.nix
+++ b/pkgs/applications/misc/ranger/default.nix
@ -6,7 +6,7 @@ with stdenv.lib;
 assert imagePreviewSupport -> w3m != null;

 pythonPackages.buildPythonApplication rec {
-  name = "ranger-v${version}";
+  name = "ranger-${version}";
  version = "1.9.0";

  src = fetchFromGitHub {
--- a/pkgs/applications/misc/slic3r-prusa3d/default.nix
+++ b/pkgs/applications/misc/slic3r-prusa3d/default.nix
@ -1,5 +1,6 @@
 { stdenv, fetchFromGitHub, makeWrapper, which, cmake, perl, perlPackages,
-  boost, tbb, wxGTK30, pkgconfig, gtk3, fetchurl, gtk2, bash, mesa_glu }:
+  boost, tbb, wxGTK30, pkgconfig, gtk3, fetchurl, gtk2, bash, mesa_glu,
+  glew, eigen }:
 let
  AlienWxWidgets = perlPackages.buildPerlPackage rec {
    name = "Alien-wxWidgets-0.69";
@ -34,10 +35,14 @@ stdenv.mkDerivation rec {
  name = "slic3r-prusa-edition-${version}";
  version = "1.38.7";

+  enableParallelBuilding = true;
+
  buildInputs = [
    cmake
    perl
    makeWrapper
+    eigen
+    glew
    tbb
    which
    Wx
--- a/pkgs/applications/misc/welle-io/default.nix
+++ b/pkgs/applications/misc/welle-io/default.nix
@ -3,7 +3,7 @@
 , faad2, rtl-sdr, libusb, fftwSinglePrec }:
 let

-  version = "1.0-rc1";
+  version = "1.0-rc2";

 in stdenv.mkDerivation {

@ -13,7 +13,7 @@ in stdenv.mkDerivation {
    owner = "AlbrechtL";
    repo = "welle.io";
    rev = "V${version}";
-    sha256 = "1xi59rmk3rdqqxxxrm2pbllrlsql46vxs95l1pkfx7bp8f7n7rsv";
+    sha256 = "01x4ldq6lvmdrmxi857594nj9xpn2h7848vvf3f54sh1zrawn4k4";
  };

  nativeBuildInputs = [ cmake pkgconfig ];
--- a/pkgs/applications/misc/wsjtx/default.nix
+++ b/pkgs/applications/misc/wsjtx/default.nix
@ -0,0 +1,41 @@
+{ stdenv, fetchurl, asciidoc, asciidoctor, autoconf, automake, cmake,
+  docbook_xsl, fftw, fftwFloat, gfortran, libtool, libpulseaudio, qtbase,
+  qtmultimedia, qtserialport, texinfo, libusb1 }:
+
+stdenv.mkDerivation rec {
+  name = "wsjtx-${version}";
+  version = "1.8.0";
+
+  # This is a composite source tarball containing both wsjtx and a hamlib fork
+  src = fetchurl {
+    url = "http://physics.princeton.edu/pulsar/K1JT/wsjtx-${version}.tgz";
+    sha256 = "21603ad4d5f43cd9c79a6e8cf468bde88c554654012b2c6c1ef9144cfbf668ce";
+  };
+
+  # Hamlib builds with autotools, wsjtx builds with cmake
+  # Omitting pkgconfig because it causes issues locating the built hamlib
+  nativeBuildInputs = [
+    asciidoc asciidoctor autoconf automake cmake docbook_xsl gfortran libtool
+    texinfo
+  ];
+  buildInputs = [ fftw fftwFloat libusb1 qtbase qtmultimedia qtserialport ];
+
+  # Composite build has its own patch step after it extracts the inner archives
+  postPatch = "cp ${./wsjtx.patch} wsjtx.patch";
+
+  meta = with stdenv.lib; {
+    description = "Weak-signal digital communication modes for amateur radio";
+    longDescription = ''
+      WSJT-X implements communication protocols or "modes" called FT8, JT4, JT9,
+      JT65, QRA64, ISCAT, MSK144, and WSPR, as well as one called Echo for
+      detecting and measuring your own radio signals reflected from the Moon.
+      These modes were all designed for making reliable, confirmed ham radio
+      contacts under extreme weak-signal conditions.
+    '';
+    homepage = http://physics.princeton.edu/pulsar/k1jt/wsjtx.html;
+    # Older licenses are for the statically-linked hamlib
+    license = with licenses; [ gpl3Plus gpl2Plus lgpl21Plus ];
+    platforms = platforms.linux;
+    maintainers = [ maintainers.lasandell ];
+  };
+}
--- a/pkgs/applications/misc/wsjtx/wsjtx.patch
+++ b/pkgs/applications/misc/wsjtx/wsjtx.patch
@ -0,0 +1,12 @@
+Index: wsjtx/CMakeLists.txt
+===================================================================
+--- wsjtx/CMakeLists.txt	(revision 8382)
+++ wsjtx/CMakeLists.txt	(working copy)
+@@ -866,6 +866,7 @@
+ find_package (Qt5Widgets 5 REQUIRED)
+ find_package (Qt5Multimedia 5 REQUIRED)
+ find_package (Qt5PrintSupport 5 REQUIRED)
+find_package (Qt5SerialPort 5 REQUIRED)
+ 
+ if (WIN32)
+   add_definitions (-DQT_NEEDS_QTMAIN)
--- a/pkgs/applications/misc/zathura/core/default.nix
+++ b/pkgs/applications/misc/zathura/core/default.nix
@ -1,7 +1,7 @@
 { stdenv, fetchurl, makeWrapper, pkgconfig
 , gtk, girara, ncurses, gettext, docutils
-, file, sqlite, glib, texlive
-, synctexSupport ? true
+, file, sqlite, glib, texlive, libintlOrEmpty
+, gtk-mac-integration, synctexSupport ? true
 }:

 assert synctexSupport -> texlive != null;
@ -19,12 +19,17 @@ stdenv.mkDerivation rec {

  icon = ./icon.xpm;

-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [
+    pkgconfig
+  ] ++ optional stdenv.isDarwin [ libintlOrEmpty ];
+
  buildInputs = [
    file gtk girara
    gettext makeWrapper sqlite glib
-  ] ++ optional synctexSupport texlive.bin.core;
+  ] ++ optional synctexSupport texlive.bin.core
+    ++ optional stdenv.isDarwin [ gtk-mac-integration ];

+  NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isDarwin "-lintl";
  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";

  makeFlags = [
@ -50,7 +55,7 @@ stdenv.mkDerivation rec {
    homepage    = http://pwmt.org/projects/zathura/;
    description = "A core component for zathura PDF viewer";
    license     = licenses.zlib;
-    platforms   = platforms.linux;
+    platforms   = platforms.unix;
    maintainers = with maintainers; [ garbas ];
  };
 }
--- a/pkgs/applications/misc/zathura/djvu/default.nix
+++ b/pkgs/applications/misc/zathura/djvu/default.nix
@ -13,6 +13,13 @@ stdenv.mkDerivation rec {

  patches = [ ./gtkflags.patch ];

+  postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
+    string1='-shared ''${LDFLAGS} -o $@ ''$(OBJECTS) ''${LIBS}'
+    string2='-Wl,-dylib_install_name,''${PLUGIN}.dylib -Wl,-bundle_loader,${zathura_core}/bin/.zathura-wrapped -bundle ''${LDFLAGS} -o $@ ''${OBJECTS} ''${LIBS}'
+    makefileC1=$(sed -r 's/\.so/.dylib/g' Makefile)
+    echo "''${makefileC1/$string1/$string2}" > Makefile
+  '';
+
  makeFlags = [ "PREFIX=$(out)" "PLUGINDIR=$(out)/lib" ];

  meta = with stdenv.lib; {
@ -23,7 +30,7 @@ stdenv.mkDerivation rec {
      djvulibre library.
    '';
    license = licenses.zlib;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
    maintainers = with maintainers; [ garbas ];
  };
 }
--- a/pkgs/applications/misc/zathura/pdf-mupdf/default.nix
+++ b/pkgs/applications/misc/zathura/pdf-mupdf/default.nix
@ -1,5 +1,6 @@
-{ stdenv, lib, fetchurl, pkgconfig, zathura_core, gtk, girara, mupdf, openssl
-, libjpeg, jbig2dec, openjpeg, fetchpatch }:
+{ stdenv, lib, fetchurl, pkgconfig, zathura_core, gtk,
+gtk-mac-integration, girara, mupdf, openssl , libjpeg, jbig2dec,
+openjpeg, fetchpatch }:

 stdenv.mkDerivation rec {
  version = "0.3.2";
@ -11,7 +12,19 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ zathura_core gtk girara openssl mupdf libjpeg jbig2dec openjpeg ];
+
+  buildInputs = [
+    zathura_core gtk girara openssl mupdf libjpeg jbig2dec openjpeg
+  ] ++ stdenv.lib.optional stdenv.isDarwin [
+    gtk-mac-integration
+  ];
+
+  postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
+    string1='-shared ''${LDFLAGS} -o $@ ''$(OBJECTS) ''${LIBS}'
+    string2='-Wl,-dylib_install_name,''${PLUGIN}.dylib -Wl,-bundle_loader,${zathura_core}/bin/.zathura-wrapped -bundle ''${LDFLAGS} -o $@ ''${OBJECTS} ''${LIBS}'
+    makefileC1=$(sed -r 's/\.so/.dylib/g' Makefile)
+    echo "''${makefileC1/$string1/$string2}" > Makefile
+  '';

  makeFlags = [ "PREFIX=$(out)" "PLUGINDIR=$(out)/lib" ];

@ -23,7 +36,7 @@ stdenv.mkDerivation rec {
      using the mupdf rendering library.
    '';
    license = licenses.zlib;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
    maintainers = with maintainers; [ cstrahan ];
  };
 }
--- a/pkgs/applications/misc/zathura/pdf-poppler/default.nix
+++ b/pkgs/applications/misc/zathura/pdf-poppler/default.nix
@ -9,11 +9,18 @@ stdenv.mkDerivation rec {
    sha256 = "1m55m7s7f8ng8a7lmcw9z4n5zv7xk4vp9n6fp9j84z6rk2imf7a2";
  };

-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ poppler zathura_core girara ];
+  nativeBuildInputs = [ pkgconfig zathura_core ];
+  buildInputs = [ poppler girara ];

  makeFlags = [ "PREFIX=$(out)" "PLUGINDIR=$(out)/lib" ];

+  postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
+    string1='-shared ''${LDFLAGS} -o $@ ''$(OBJECTS) ''${LIBS}'
+    string2='-Wl,-dylib_install_name,''${PLUGIN}.dylib -Wl,-bundle_loader,${zathura_core}/bin/.zathura-wrapped -bundle ''${LDFLAGS} -o $@ ''${OBJECTS} ''${LIBS}'
+    makefileC1=$(sed -r 's/\.so/.dylib/g' Makefile)
+    echo "''${makefileC1/$string1/$string2}" > Makefile
+  '';
+
  meta = with lib; {
    homepage = http://pwmt.org/projects/zathura/;
    description = "A zathura PDF plugin (poppler)";
@ -22,7 +29,7 @@ stdenv.mkDerivation rec {
      using the poppler rendering library.
    '';
    license = licenses.zlib;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
    maintainers = with maintainers; [ cstrahan garbas ];
  };
 }
--- a/pkgs/applications/misc/zathura/ps/default.nix
+++ b/pkgs/applications/misc/zathura/ps/default.nix
@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, pkgconfig, gtk, zathura_core, girara, libspectre, gettext }:
+{ stdenv, lib, fetchurl, pkgconfig, gtk2, zathura_core, girara, libspectre, gettext }:

 stdenv.mkDerivation rec {
  name = "zathura-ps-0.2.5";
@ -9,10 +9,17 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ libspectre gettext zathura_core gtk girara ];
+  buildInputs = [ libspectre gettext zathura_core gtk2 girara ];

  patches = [ ./gtkflags.patch ];

+  postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
+    makefileC1=$(sed -r 's/\.so/.dylib/g' Makefile)
+    makefileC2=$(echo "$makefileC1" | sed 's|-shared ''${LDFLAGS} -o $@ ''$(OBJECTS) ''${LIBS}|-Wl,-dylib_install_name,''${PLUGIN}.dylib -Wl,-bundle_loader,${zathura_core}/bin/.zathura-wrapped -bundle ''${LDFLAGS} -o $@ ''${OBJECTS} ''${LIBS}|g' )
+    echo "$makefileC2" > Makefile
+    echo "$makefileC2"
+  '';
+
  makeFlags = [ "PREFIX=$(out)" "PLUGINDIR=$(out)/lib" ];

  meta = with lib; {
@ -23,7 +30,7 @@ stdenv.mkDerivation rec {
      libspectre library.
      '';
    license = licenses.zlib;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
    maintainers = with maintainers; [ cstrahan garbas ];
  };
 }
--- a/pkgs/applications/misc/zathura/wrapper.nix
+++ b/pkgs/applications/misc/zathura/wrapper.nix
@ -11,8 +11,7 @@ in symlinkJoin {
  buildInputs = [ makeWrapper ];

  postBuild = ''
-    wrapProgram $out/bin/zathura \
-      --add-flags --plugins-dir=${pluginsPath}
+    wrapProgram $out/bin/zathura --add-flags --plugins-dir=${pluginsPath}
  '';

  meta = with lib; {
@ -25,7 +24,7 @@ in symlinkJoin {
      as well as an easy usage that mainly focuses on keyboard interaction.
    '';
    license = licenses.zlib;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
    maintainers = with maintainers;[ garbas smironov ];
  };
 }
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@ -144,9 +144,16 @@ let
      # for updated patches and hints about build flags

    # (gentooPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000")
-    ] ++ optionals (versionRange "64" "65") [
+    ]  ++ optionals (versionRange "64" "65") [
      (gentooPatch "chromium-cups-r0.patch" "0hyjlfh062c8h54j4b27y4dq5yzd4w6mxzywk3s02yf6cj3cbkrl")
      (gentooPatch "chromium-angle-r0.patch" "0izdrqwsyr48117dhvwdsk8c6dkrnq2njida1q4mb1lagvwbz7gc")
+    ]  ++ optionals (versionRange "65" "66") [
+      #(gentooPatch "chromium-gcc-r0.patch" "127xdwabizn5gz8rf1qsw62i7m0b5bsfjqxv4kdbsnizmjanddf8")
+      #(gentooPatch "chromium-memcpy-r0.patch" "1d3vra59wjg2lva7ddv55ff6l57mk9k50llsplr0b7vxk0lh0ps5")
+      (gentooPatch "chromium-webrtc-r0.patch" "0qj5b4w9kav51ylpdf38vm5w7p2gx4qp8p45vrfggp7miicg9cmw")
+      #(gentooPatch "chromium-vulkan-r0.patch" "1wphsbc6kyck5qanbc4bv14iw2s67fvp1c0kwz29a2avzkz19s84")
+      #(gentooPatch "chromium-ffmpeg-r0.patch" "0j58g24j6n6vpy6v9wwv34x0dd43m52wg0xcrfkzp72km9wiahff")
+      #(gentooPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000")
    ]  ++ optional enableWideVine ./patches/widevine.patch;

    postPatch = ''
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@ -1,18 +1,18 @@
 # This file is autogenerated from update.sh in the same directory.
 {
  beta = {
-    sha256 = "1ki9ii3r9iv6k7df2zr14ysm6w3fkvhvcwaw3qjm4b4q6ymznshl";
-    sha256bin64 = "0i1g0hv2vji8jx9c973x8nr1ynzsvqjaqcncxj77x6vj9wp0v41p";
-    version = "64.0.3282.140";
+    sha256 = "1ggj1a7v2n4v34kb8gx2hcswlayryr9g62zqlry26bwmvz6qzsx9";
+    sha256bin64 = "1ah8088d8p674dj5bijk5maapmiq9iap1w2i81dl0hhpyqxx3h3i";
+    version = "65.0.3325.73";
  };
  dev = {
-    sha256 = "1b3gyj55xyqsb439szisfn8c4mnpws3pfzrndrl5kgdd239qrfqz";
-    sha256bin64 = "1hmkinzn4gpikjfd8c9j30px3i0x6y8dddn9pyvjzsk6dzfcvknz";
-    version = "65.0.3325.31";
+    sha256 = "13klppyl6rbkd3ffp8y8d95l4mc72gmj45y34wynyfap6b4z1lmh";
+    sha256bin64 = "0w1ipy858p9lbpcrjhs44kncgw7c5qv1929h0w65ybgsggjqh0gz";
+    version = "66.0.3343.3";
  };
  stable = {
-    sha256 = "1ki9ii3r9iv6k7df2zr14ysm6w3fkvhvcwaw3qjm4b4q6ymznshl";
-    sha256bin64 = "1zsgcnilip9rxbs51xvnchp87gh4fmgxzrcf9dhfrnldhji17ikj";
-    version = "64.0.3282.140";
+    sha256 = "0mf4qjmrjnxs7mx9c5pymavmib7l2a2kxiy0kqk3mma1y90qnc7k";
+    sha256bin64 = "0idij274g53lzvgz9h5xxi8l841vvvr78hp25ndbmpv4a2p1d83b";
+    version = "64.0.3282.167";
  };
 }
--- a/pkgs/applications/networking/browsers/falkon/default.nix
+++ b/pkgs/applications/networking/browsers/falkon/default.nix
@ -2,16 +2,17 @@
 , libpthreadstubs, libxcb, libXdmcp, qtsvg, qttools, qtwebengine, qtx11extras, kwallet, openssl }:

 stdenv.mkDerivation rec {
-  # Last qupvilla release is 2.1.2 so we add the .1 although it isn't actually a
-  # release but it is basically 2.1.2 with the falkon name
+  # KDE hasn't made a release of falkon yet so we just track git for now which is
+  # based on the most recent release of qupzilla
+  # This wip version is 2.1.99 so we add the .1
  name = "falkon-${version}.1";
-  version = "2.1.2";
+  version = "2.1.99";

  src = fetchFromGitHub {
    owner  = "KDE";
    repo   = "falkon";
-    rev    = "eecaf2e9d6b572a7f7d2e6dc324e3d79b61c31db";
-    sha256 = "01r5aw10jd0qz7xvad0cqzjbnsj7vwblh54wbq4x1m6xbkp6xcgy";
+    rev    = "dd3c570c41b4b3d0ad17202b78bf14cf1ac56495";
+    sha256 = "07d40cpckaprj74mr06k3mfriwb471bdmq60smls34y62ss55q9d";
  };

  preConfigure = ''
@ -21,8 +22,6 @@ stdenv.mkDerivation rec {
    export FALKON_PREFIX=$out
  '';

-  dontUseCmakeConfigure = true;
-
  buildInputs = [
    libpthreadstubs libxcb libXdmcp
    kwallet
@ -31,8 +30,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ cmake extra-cmake-modules pkgconfig qmake qttools ];

-  # on 2.1.2: RCC: Error in 'autoscroll.qrc': Cannot find file 'locale/ar_SA.qm'
-  enableParallelBuilding = false;
+  enableParallelBuilding = true;

  meta = with stdenv.lib; {
    description = "QtWebEngine based cross-platform web browser";
@ -40,6 +38,5 @@ stdenv.mkDerivation rec {
    license     = licenses.gpl3;
    maintainers = with maintainers; [ peterhoeg ];
    platforms   = platforms.unix;
-    broken      = true;
  };
 }
--- a/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
--- a/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@ -12,12 +12,23 @@ rec {
      sha512 = "ff748780492fc66b3e44c7e7641f16206e4c09514224c62d37efac2c59877bdf428a3670bfb50407166d7b505d4e2ea020626fd776b87f6abb6bc5d2e54c773f";
    };

-    patches =
-      [ ./no-buildconfig.patch ./env_var_for_system_dir.patch ]
-      ++ lib.optional stdenv.isi686 (fetchpatch {
-        url = "https://hg.mozilla.org/mozilla-central/raw-rev/15517c5a5d37";
-        sha256 = "1ba487p3hk4w2w7qqfxgv1y57vp86b8g3xhav2j20qd3j3phbbn7";
-      });
+    patches = [
+      ./no-buildconfig.patch
+      ./env_var_for_system_dir.patch
+
+      # https://bugzilla.mozilla.org/show_bug.cgi?id=1430274
+      # Scheduled for firefox 59
+      (fetchpatch {
+        url = "https://bug1430274.bmoattachments.org/attachment.cgi?id=8943426";
+        sha256 = "12yfss3k61yilrb337dh2rffy5hh83d2f16gqrf5i56r9c33f7hf";
+      })
+
+      # https://bugzilla.mozilla.org/show_bug.cgi?id=1388981
+      # Should have been fixed in firefox 57
+    ] ++ lib.optional stdenv.isi686 (fetchpatch {
+      url = "https://hg.mozilla.org/mozilla-central/raw-rev/15517c5a5d37";
+      sha256 = "1ba487p3hk4w2w7qqfxgv1y57vp86b8g3xhav2j20qd3j3phbbn7";
+    });

    meta = {
      description = "A web browser built from Firefox source tree";
--- a/pkgs/applications/networking/browsers/google-chrome/default.nix
+++ b/pkgs/applications/networking/browsers/google-chrome/default.nix
@ -5,6 +5,7 @@
 , libXcursor, libXext, libXfixes, libXrender, libXScrnSaver, libXcomposite, libxcb
 , alsaLib, libXdamage, libXtst, libXrandr, expat, cups
 , dbus_libs, gtk2, gtk3, gdk_pixbuf, gcc-unwrapped, at_spi2_atk
+, kerberos

 # command line arguments which are always set e.g "--disable-gpu"
 , commandLineArgs ? ""
@ -57,6 +58,7 @@ let
    liberation_ttf curl utillinux xdg_utils wget
    flac harfbuzz icu libpng opusWithCustomModes snappy speechd
    bzip2 libcap at_spi2_atk
+    kerberos
  ] ++ optional pulseSupport libpulseaudio
    ++ [ gtk ];

--- a/pkgs/applications/networking/cluster/kubecfg/default.nix
+++ b/pkgs/applications/networking/cluster/kubecfg/default.nix
@ -1,6 +1,6 @@
 { lib, buildGoPackage, fetchFromGitHub, ... }:

-let version = "0.5.0"; in
+let version = "0.6.0"; in

 buildGoPackage {
  name = "kubecfg-${version}";
@ -9,7 +9,7 @@ buildGoPackage {
    owner = "ksonnet";
    repo = "kubecfg";
    rev = "v${version}";
-    sha256 = "1s8w133p8qkj3dr73jimajm9ddp678lw9k9symj8rjw5p35igr93";
+    sha256 = "12kv1p707kdxjx5l8rcikd1gjwp5xjxdmmyvlpnvyagrphgrwpsf";
  };

  goPackagePath = "github.com/ksonnet/kubecfg";
--- a/pkgs/applications/networking/cluster/kubernetes/default.nix
+++ b/pkgs/applications/networking/cluster/kubernetes/default.nix
@ -8,8 +8,6 @@
    "cmd/kube-controller-manager"
    "cmd/kube-proxy"
    "plugin/cmd/kube-scheduler"
-    "federation/cmd/federation-apiserver"
-    "federation/cmd/federation-controller-manager"
    "test/e2e/e2e.test"
  ]
 }:
@ -18,13 +16,13 @@ with lib;

 stdenv.mkDerivation rec {
  name = "kubernetes-${version}";
-  version = "1.7.9";
+  version = "1.9.1";

  src = fetchFromGitHub {
    owner = "kubernetes";
    repo = "kubernetes";
    rev = "v${version}";
-    sha256 = "0lxagvv8mysw6n0vp5vsccl87b628dgsjrf298dx2dqx7wn7zjgi";
+    sha256 = "1dmq2g138h7fsswmq4l47b44gsl9anmm3ywqyi7y48f1rkvc11mk";
  };

  buildInputs = [ removeReferencesTo makeWrapper which go rsync go-bindata ];
--- a/pkgs/applications/networking/feedreaders/rss2email/default.nix
+++ b/pkgs/applications/networking/feedreaders/rss2email/default.nix
@ -14,12 +14,30 @@ buildPythonApplication rec {
    sha256 = "02wj9zhmc2ym8ba1i0z9pm1c622z2fj7fxwagnxbvpr1402ahmr5";
  };

-  postInstall = ''
-    install -Dm 644 r2e.1 $out/share/man/man1/r2e.1
-    # an alias for better finding the manpage
-    ln -s -T r2e.1 $out/share/man/man1/rss2email.1
+  outputs = [ "out" "man" "doc" ];
+
+  postPatch = ''
+    # sendmail executable is called from PATH instead of sbin by default
+    sed -e 's|/usr/sbin/sendmail|sendmail|' \
+        -i rss2email/config.py
  '';

+  postInstall = ''
+    install -Dm 644 r2e.1 $man/share/man/man1/r2e.1
+    # an alias for better finding the manpage
+    ln -s -T r2e.1 $man/share/man/man1/rss2email.1
+
+    # copy documentation
+    mkdir -p $doc/share/doc/rss2email
+    cp AUTHORS COPYING CHANGELOG README $doc/share/doc/rss2email/
+  '';
+
+  # The tests currently fail, see
+  # https://github.com/rss2email/rss2email/issues/14
+  # postCheck = ''
+  #   env PYTHONPATH=.:$PYTHONPATH python ./test/test.py
+  # '';
+
  meta = with lib; {
    description = "A tool that converts RSS/Atom newsfeeds to email.";
    homepage = https://pypi.python.org/pypi/rss2email;
--- a/pkgs/applications/networking/gns3/server.nix
+++ b/pkgs/applications/networking/gns3/server.nix
@ -4,6 +4,16 @@

 let
  pythonPackages = python3Packages;
+  aiohttp = (stdenv.lib.overrideDerivation pythonPackages.aiohttp
+    (oldAttrs:
+      rec {
+        pname = "aiohttp";
+        version = "2.3.10";
+        src = pythonPackages.fetchPypi {
+          inherit pname version;
+          sha256 = "8adda6583ba438a4c70693374e10b60168663ffa6564c5c75d3c7a9055290964";
+        };
+      }));
  aiohttp-cors = (stdenv.lib.overrideDerivation pythonPackages.aiohttp-cors
    (oldAttrs:
      rec {
@ -14,6 +24,10 @@ let
          inherit pname version;
          sha256 = "11b51mhr7wjfiikvj3nc5s8c7miin2zdhl3yrzcga4mbpkj892in";
        };
+        propagatedBuildInputs = [ aiohttp ]
+          ++ stdenv.lib.optional
+               (pythonPackages.pythonOlder "3.5")
+               pythonPackages.typing;
      }));
 in pythonPackages.buildPythonPackage rec {
  name = "${pname}-${version}";
--- a/pkgs/applications/networking/instant-messengers/stride/default.nix
+++ b/pkgs/applications/networking/instant-messengers/stride/default.nix
@ -0,0 +1,68 @@
+{ stdenv, fetchurl, dpkg, alsaLib, atk, cairo, cups, dbus, expat, fontconfig
+, freetype, gdk_pixbuf, glib, gnome2, nspr, nss, pango, udev, xorg }:
+let
+  fullPath = stdenv.lib.makeLibraryPath [
+    alsaLib
+    atk
+    cairo
+    cups
+    dbus
+    expat
+    fontconfig
+    freetype
+    gdk_pixbuf
+    glib
+    gnome2.GConf
+    gnome2.gtk
+    nspr
+    nss
+    pango
+    udev
+    xorg.libX11
+    xorg.libXScrnSaver
+    xorg.libXcomposite
+    xorg.libXcursor
+    xorg.libXdamage
+    xorg.libXext
+    xorg.libXfixes
+    xorg.libXi
+    xorg.libXrandr
+    xorg.libXrender
+    xorg.libXtst
+    xorg.libxcb
+  ] + ":${stdenv.cc.cc.lib}/lib64";
+in
+stdenv.mkDerivation rec {
+  version = "1.8.18";
+  name = "stride-${version}";
+
+  src = fetchurl {
+    url = "https://packages.atlassian.com/stride-apt-client/pool/stride_${version}_amd64.deb";
+    sha256 = "0hpj3i3xbvckxm7fphqqb3scb31w2cg4riwp593y0gnbivpc0hym";
+  };
+
+  dontBuild = true;
+  dontFixup = true;
+
+  buildInputs = [ dpkg ];
+
+  unpackPhase = ''
+    dpkg-deb -x ${src} ./
+  '';
+
+  installPhase =''
+    mkdir "$out"
+    mv usr/* "$out/"
+    patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --set-rpath "${fullPath}:\$ORIGIN" \
+      "$out/bin/stride"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Desktop client for Atlassian Stride";
+    homepage = https://www.stride.com/;
+    license = licenses.unfree;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ puffnfresh ];
+  };
+}
--- a/pkgs/applications/networking/irc/irssi/default.nix
+++ b/pkgs/applications/networking/irc/irssi/default.nix
@ -1,12 +1,12 @@
 { stdenv, fetchurl, pkgconfig, ncurses, glib, openssl, perl, libintlOrEmpty }:

 stdenv.mkDerivation rec {
-  version = "1.1.0";
+  version = "1.1.1";
  name = "irssi-${version}";

  src = fetchurl {
    url = "https://github.com/irssi/irssi/releases/download/${version}/${name}.tar.gz";
-    sha256 = "0y362v6ncgs77q5axv7vgjm6vcxiaj5chsxj1ha07jaxsr1z7285";
+    sha256 = "09a9p1yfg0m3w7n2a4axvn8874002ly8x0b543sxihzqk29radpa";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/applications/networking/mailreaders/neomutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/neomutt/default.nix
@ -1,6 +1,6 @@
-{ stdenv, fetchFromGitHub, which, autoreconfHook, makeWrapper, writeScript,
-ncurses, perl , cyrus_sasl, gss, gpgme, kerberos, libidn, notmuch, openssl,
-lmdb, libxslt, docbook_xsl, docbook_xml_dtd_42, mime-types }:
+{ stdenv, fetchFromGitHub, gettext, makeWrapper, tcl, which, writeScript
+, ncurses, perl , cyrus_sasl, gss, gpgme, kerberos, libidn, notmuch, openssl
+, lmdb, libxslt, docbook_xsl, docbook_xml_dtd_42, mime-types }:

 let
  muttWrapper = writeScript "mutt" ''
@ -15,14 +15,14 @@ let
  '';

 in stdenv.mkDerivation rec {
-  version = "20171208";
+  version = "20171215";
  name = "neomutt-${version}";

  src = fetchFromGitHub {
    owner  = "neomutt";
    repo   = "neomutt";
    rev    = "neomutt-${version}";
-    sha256 = "1fn28q4akfz0nq3ysp8n53j8yqp2mx6yhbvb59c4zm6zgd4qzgp1";
+    sha256 = "1c7vjl5cl0k41vrxp6l1sj72idz70r2rgaxa2m1yir6zb6qsrsd8";
  };

  buildInputs = [
@ -32,7 +32,7 @@ in stdenv.mkDerivation rec {
  ];

  nativeBuildInputs = [
-    autoreconfHook docbook_xsl docbook_xml_dtd_42 libxslt.bin which makeWrapper
+    docbook_xsl docbook_xml_dtd_42 gettext libxslt.bin makeWrapper tcl which
  ];

  enableParallelBuilding = true;
@ -51,18 +51,14 @@ in stdenv.mkDerivation rec {
  '';

  configureFlags = [
-    "--enable-debug"
-    "--enable-gpgme"
-    "--enable-notmuch"
-    "--with-curses"
-    "--with-gss"
+    "--gpgme"
+    "--gss"
+    "--lmdb"
+    "--notmuch"
+    "--ssl"
+    "--sasl"
    "--with-homespool=mailbox"
-    "--with-idn"
-    "--with-lmdb"
    "--with-mailpath="
-    "--with-sasl"
-    "--with-ssl"
-
    # Look in $PATH at runtime, instead of hardcoding /usr/bin/sendmail
    "ac_cv_path_SENDMAIL=sendmail"
  ];
--- a/pkgs/applications/networking/nextcloud-client/default.nix
+++ b/pkgs/applications/networking/nextcloud-client/default.nix
@ -36,7 +36,10 @@ stdenv.mkDerivation rec {
    "-DINOTIFY_INCLUDE_DIR=${inotify-tools}/include"
  ];

-  postInstall = stdenv.lib.optionalString (withGnomeKeyring) ''
+  postInstall = ''
+    sed -i 's/\(Icon.*\)=nextcloud/\1=Nextcloud/g' \
+      $out/share/applications/nextcloud.desktop
+  '' + stdenv.lib.optionalString (withGnomeKeyring) ''
    wrapProgram "$out/bin/nextcloud" \
      --prefix LD_LIBRARY_PATH : ${stdenv.lib.makeLibraryPath [ libgnome_keyring ]}
  '';
--- a/pkgs/applications/networking/syncthing/add-stcli-target.patch
+++ b/pkgs/applications/networking/syncthing/add-stcli-target.patch
@ -0,0 +1,17 @@
+diff --git i/build.go w/build.go
+index 7d400d6f..1b5e1d25 100644
+--- i/build.go
+++ w/build.go
+@@ -175,6 +175,12 @@ var targets = map[string]target{
+ 			{src: "AUTHORS", dst: "deb/usr/share/doc/syncthing-relaypoolsrv/AUTHORS.txt", perm: 0644},
+ 		},
+ 	},
+	"stcli": {
+		name:        "stcli",
+		description: "Syncthing CLI",
+		buildPkg:    "github.com/syncthing/syncthing/cmd/stcli",
+		binaryName:  "stcli", // .exe will be added automatically for Windows builds
+	},
+ }
+ 
+ func init() {
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@ -1,57 +1,103 @@
-{ stdenv, lib, fetchFromGitHub, go, procps, removeReferencesTo }:
+{ stdenv, lib, go, procps, removeReferencesTo, fetchFromGitHub }:

-stdenv.mkDerivation rec {
-  version = "0.14.44";
-  name = "syncthing-${version}";
+let
+  common = { stname, target, patches ? [], postInstall ? "" }:
+    stdenv.mkDerivation rec {
+      version = "0.14.44";
+      name = "${stname}-${version}";

-  src = fetchFromGitHub {
-    owner  = "syncthing";
-    repo   = "syncthing";
-    rev    = "v${version}";
-    sha256 = "1gdkx6lbzmdz2hqc9slbq41rwgkxmdisnj0iywx4mppmc2b4v6wh";
+      src = fetchFromGitHub {
+        owner  = "syncthing";
+        repo   = "syncthing";
+        rev    = "v${version}";
+        sha256 = "1gdkx6lbzmdz2hqc9slbq41rwgkxmdisnj0iywx4mppmc2b4v6wh";
+      };
+
+      inherit patches;
+
+      buildInputs = [ go ];
+      nativeBuildInputs = [ removeReferencesTo ];
+
+      buildPhase = ''
+        # Syncthing expects that it is checked out in $GOPATH, if that variable is
+        # set.  Since this isn't true when we're fetching source, we can explicitly
+        # unset it and force Syncthing to set up a temporary one for us.
+        env GOPATH= BUILD_USER=nix BUILD_HOST=nix go run build.go -no-upgrade -version v${version} build ${target}
+      '';
+
+      installPhase = ''
+        install -Dm755 ${target} $out/bin/${target}
+        runHook postInstall
+      '';
+
+      inherit postInstall;
+
+      preFixup = ''
+        find $out/bin -type f -exec remove-references-to -t ${go} '{}' '+'
+      '';
+
+      meta = with lib; {
+        homepage = https://www.syncthing.net/;
+        description = "Open Source Continuous File Synchronization";
+        license = licenses.mpl20;
+        maintainers = with maintainers; [ pshendry joko peterhoeg andrew-d ];
+        platforms = platforms.unix;
+      };
+    };
+
+in {
+  syncthing = common {
+    stname = "syncthing";
+    target = "syncthing";
+
+    postInstall = ''
+      # This installs man pages in the correct directory according to the suffix
+      # on the filename
+      for mf in man/*.[1-9]; do
+        mantype="$(echo "$mf" | awk -F"." '{print $NF}')"
+        mandir="$out/share/man/man$mantype"
+        install -Dm644 "$mf" "$mandir/$(basename "$mf")"
+      done
+
+    '' + lib.optionalString (stdenv.isLinux) ''
+      mkdir -p $out/lib/systemd/{system,user}
+
+      substitute etc/linux-systemd/system/syncthing-resume.service \
+                 $out/lib/systemd/system/syncthing-resume.service \
+                 --replace /usr/bin/pkill ${procps}/bin/pkill
+
+      substitute etc/linux-systemd/system/syncthing@.service \
+                 $out/lib/systemd/system/syncthing@.service \
+                 --replace /usr/bin/syncthing $out/bin/syncthing
+
+      substitute etc/linux-systemd/user/syncthing.service \
+                 $out/lib/systemd/user/syncthing.service \
+                 --replace /usr/bin/syncthing $out/bin/syncthing
+    '';
  };

-  buildInputs = [ go removeReferencesTo ];
+  syncthing-cli = common {
+    stname = "syncthing-cli";

-  buildPhase = ''
-    mkdir -p src/github.com/syncthing
-    ln -s $(pwd) src/github.com/syncthing/syncthing
-    export GOPATH=$(pwd)
+    patches = [ ./add-stcli-target.patch ];
+    target = "stcli";
+  };

-    # Syncthing's build.go script expects this working directory
-    cd src/github.com/syncthing/syncthing
+  syncthing-discovery = common {
+    stname = "syncthing-discovery";
+    target = "stdiscosrv";
+  };

-    go run build.go -no-upgrade -version v${version} build
-  '';
+  syncthing-relay = common {
+    stname = "syncthing-relay";
+    target = "strelaysrv";

-  installPhase = ''
-    mkdir -p $out/lib/systemd/{system,user}
+    postInstall = lib.optionalString (stdenv.isLinux) ''
+      mkdir -p $out/lib/systemd/system

-    install -Dm755 syncthing $out/bin/syncthing
-
-  '' + lib.optionalString (stdenv.isLinux) ''
-    substitute etc/linux-systemd/system/syncthing-resume.service \
-               $out/lib/systemd/system/syncthing-resume.service \
-               --replace /usr/bin/pkill ${procps}/bin/pkill
-
-    substitute etc/linux-systemd/system/syncthing@.service \
-               $out/lib/systemd/system/syncthing@.service \
-               --replace /usr/bin/syncthing $out/bin/syncthing
-
-    substitute etc/linux-systemd/user/syncthing.service \
-               $out/lib/systemd/user/syncthing.service \
-               --replace /usr/bin/syncthing $out/bin/syncthing
-  '';
-
-  preFixup = ''
-    find $out/bin -type f -exec remove-references-to -t ${go} '{}' '+'
-  '';
-
-  meta = with stdenv.lib; {
-    homepage = https://www.syncthing.net/;
-    description = "Open Source Continuous File Synchronization";
-    license = licenses.mpl20;
-    maintainers = with maintainers; [ pshendry joko peterhoeg ];
-    platforms = platforms.unix;
+      substitute cmd/strelaysrv/etc/linux-systemd/strelaysrv.service \
+                 $out/lib/systemd/system/strelaysrv.service \
+                 --replace /usr/bin/strelaysrv $out/bin/strelaysrv
+    '';
  };
 }
--- a/pkgs/applications/science/logic/coq/default.nix
+++ b/pkgs/applications/science/logic/coq/default.nix
@ -21,6 +21,7 @@ let
   "8.6.1"     = "0llrxcxwy5j87vbbjnisw42rfw1n1pm5602ssx64xaxx3k176g6l";
   "8.7.0"     = "1h18b7xpnx3ix9vsi5fx4zdcbxy7bhra7gd5c5yzxmk53cgf1p9m";
   "8.7.1"     = "0gjn59jkbxwrihk8fx9d823wjyjh5m9gvj9l31nv6z6bcqhgdqi8";
+   "8.7.2"     = "0a0657xby8wdq4aqb2xsxp3n7pmc2w4yxjmrb2l4kccs1aqvaj4w";
  }."${version}";
  coq-version = builtins.substring 0 3 version;
  camlp5 = ocamlPackages.camlp5_strict;
--- a/pkgs/applications/science/logic/eprover/default.nix
+++ b/pkgs/applications/science/logic/eprover/default.nix
@ -1,4 +1,5 @@
 { stdenv, fetchurl, which }:
+
 stdenv.mkDerivation rec {
  name = "eprover-${version}";
  version = "2.0";
@ -11,7 +12,7 @@ stdenv.mkDerivation rec {
  buildInputs = [ which ];

  preConfigure = ''
-    sed -e 's/ *CC *= gcc$//' -i Makefile.vars
+    sed -e 's/ *CC *= *gcc$//' -i Makefile.vars
  '';
  configureFlags = "--exec-prefix=$(out) --man-prefix=$(out)/share/man";

--- a/pkgs/build-support/kernel/modules-closure.nix
+++ b/pkgs/build-support/kernel/modules-closure.nix
@ -3,13 +3,13 @@
 # the modules identified by `rootModules', plus their dependencies.
 # Also generate an appropriate modules.dep.

-{ stdenvNoCC, kernel, nukeReferences, rootModules
+{ stdenvNoCC, kernel, firmware, nukeReferences, rootModules
 , kmod, allowMissing ? false }:

 stdenvNoCC.mkDerivation {
  name = kernel.name + "-shrunk";
  builder = ./modules-closure.sh;
  buildInputs = [ nukeReferences kmod ];
-  inherit kernel rootModules allowMissing;
+  inherit kernel firmware rootModules allowMissing;
  allowedReferences = ["out"];
 }
--- a/pkgs/build-support/kernel/modules-closure.sh
+++ b/pkgs/build-support/kernel/modules-closure.sh
@ -33,4 +33,13 @@ for module in $closure; do
    echo $target >> $out/insmod-list
 done

+mkdir -p $out/lib/firmware
+for module in $closure; do
+    for i in $(modinfo -F firmware $module); do
+        mkdir -p "$out/lib/firmware/$(dirname "$i")"
+        echo "firmware for $module: $i"
+        cp "$firmware/lib/firmware/$i" "$out/lib/firmware/$i" 2>/dev/null || if test -z "$allowMissing"; then exit 1; fi
+    done
+done
+
 depmod -b $out -a $version
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@ -26,6 +26,7 @@ rec {

  modulesClosure = makeModulesClosure {
    inherit kernel rootModules;
+    firmware = kernel;
  };


--- a/pkgs/common-updater/scripts/update-source-version
+++ b/pkgs/common-updater/scripts/update-source-version
@ -74,7 +74,7 @@ fi
 if [ -z "$newHash" ]; then
    nix-build --no-out-link -A "$attr.src" 2>"$attr.fetchlog" >/dev/null || true
    # FIXME: use nix-build --hash here once https://github.com/NixOS/nix/issues/1172 is fixed
-    newHash=$(egrep -v "killing process|dependencies couldn't be built" "$attr.fetchlog" | tail -n2 | grep "output path .* has .* hash .* when .* was expected" | head -n1 | tr -dc '\040-\177' | tr -d "'" | awk '{ print $(NF-4) }')
+    newHash=$(egrep -v "killing process|dependencies couldn't be built" "$attr.fetchlog" | tail -n2 | sed "s~output path .* has .* hash \(.*\) when .* was expected|fixed-output derivation produced path '.*' with .* hash '\(.*\)' instead of the expected hash '.*'~\1\2~" | head -n1)
 fi

 if [ -z "$newHash" ]; then
--- a/pkgs/data/fonts/tex-gyre/default.nix
+++ b/pkgs/data/fonts/tex-gyre/default.nix
@ -0,0 +1,90 @@
+{ stdenv, fetchzip }:
+
+let
+  mkVariant = variant: { displayName, version, abbreviation, sha256, outputHash }: stdenv.mkDerivation {
+    name = "tex-gyre-${variant}-${version}";
+    inherit version;
+
+    src = fetchzip {
+      url = "http://www.gust.org.pl/projects/e-foundry/tex-gyre/${variant}/${abbreviation}${version}otf.zip";
+      stripRoot = false;
+      inherit sha256;
+    };
+
+    installPhase = ''
+      mkdir -p $out/share/fonts/opentype/
+      cp -v *.otf $out/share/fonts/opentype/
+    '';
+
+    outputHashAlgo = "sha256";
+    outputHashMode = "recursive";
+    outputHash = outputHash;
+
+    meta = with stdenv.lib; {
+      homepage = http://www.gust.org.pl/projects/e-foundry/tex-gyre;
+      # "The TeX Gyre fonts are licensed under the GUST Font License (GFL),
+      # which is a free license, legally equivalent to the LaTeX Project Public
+      # License (LPPL), version 1.3c or later." - GUST website
+      license = licenses.lppl13c;
+      maintainers = with maintainers; [ jtojnar ];
+      platforms = platforms.all;
+    };
+  };
+in stdenv.lib.mapAttrs mkVariant {
+  adventor = {
+    displayName = "Adventor";
+    version = "2.003";
+    sha256 = "13wnb04z9f766ij30x8bpkn4xzv7n466g07dlbimx7qvglxl605g";
+    outputHash = "1cz0lkk2a5fg8r8175h454va499hzln3s99dadxhh147nx1914pm";
+    abbreviation = "qag";
+  };
+  bonum = {
+    displayName = "Bonum";
+    version = "2.004";
+    sha256 = "0qbrs98knx4h0b297c5n3vav4mkal1a95ai2dzmdc10pghfzl8vv";
+    outputHash = "0bid8gzwz50ylmm8jyqf9s4nfvy6cp1x34wbyrh4gyk1ki6hf3z1";
+    abbreviation = "qbk";
+  };
+  chorus = {
+    displayName = "Chorus";
+    version = "2.003";
+    sha256 = "1b0zak27fzmapwbf2jasvsd95vhnqyc92n985d1lc1ivwja1zgfa";
+    outputHash = "0fqifd45c1ys6y98b66lmldfbv7wjb2414fs9swicv4n7xvl3cp1";
+    abbreviation = "qzc";
+  };
+  cursor = {
+    displayName = "Cursor";
+    version = "2.004";
+    sha256 = "0ck3jm33bk2xsxp5d2irzd3j24zb49f0gnjvd1nikg1ivk8w85ng";
+    outputHash = "0i76835xqlkrnlx303mx63m0f4899j056c2ag2fl6p9qk8s4rskp";
+    abbreviation = "qcr";
+  };
+  heros = {
+    displayName = "Heros";
+    version = "2.004";
+    sha256 = "1fj2srxxf6ap913y5yd3dn4jzg828j7381gifs39nm5lnzmgw78y";
+    outputHash = "16y76ab46fxm9k8wfmwx4w0cl96yrmjywz587lyr08s0agp1v3kf";
+    abbreviation = "qhv";
+  };
+  pagella = {
+    displayName = "Pagella";
+    version ="2.004";
+    sha256 = "0b2pjhw1ihnl951slln6d6vafjd3i6p4i947lwybvg8081qfvd9z";
+    outputHash = "0c6s0r14qax3b4amvm9nffwzby8mm4p7r2hfb8yv9jzhjwa5z8rd";
+    abbreviation = "qpl";
+  };
+  schola = {
+    displayName = "Schola";
+    version = "2.005";
+    sha256 = "05z3gk4mm0sa7wwjcv31j2xlzqhwhcncpamn0kn9y0221cdknyp8";
+    outputHash = "1yqq1ngcylhldrh1v35l439k72szq9m4gx6g0wh235fk65chb2bm";
+    abbreviation = "qcs";
+  };
+  termes = {
+    displayName = "Termes";
+    version = "2.004";
+    sha256 = "1aq3yqbgkc3z20dkcqyhicsyq0afbgg4l397z96sd8a16jyz2x8k";
+    outputHash = "1igw821m601h8937pix6yish4d8fxmz3h4j9hripf41bxsiafzzg";
+    abbreviation = "qtm";
+  };
+}
--- a/pkgs/desktops/gnome-3/core/gjs/default.nix
+++ b/pkgs/desktops/gnome-3/core/gjs/default.nix
@ -1,21 +1,41 @@
-{ fetchurl, stdenv, pkgconfig, gnome3, gtk3, gobjectIntrospection
-, spidermonkey_52, pango, readline, glib, libxml2, dbus }:
+{ fetchurl, stdenv, pkgconfig, gnome3, gtk3, atk, gobjectIntrospection
+, spidermonkey_52, pango, readline, glib, libxml2, dbus, gdk_pixbuf
+, makeWrapper }:

 stdenv.mkDerivation rec {
  inherit (import ./src.nix fetchurl) name src;

-  nativeBuildInputs = [ pkgconfig ];
+  outputs = [ "out" "installedTests" ];
+
+  nativeBuildInputs = [ pkgconfig makeWrapper ];
  buildInputs = [ libxml2 gobjectIntrospection gtk3 glib pango readline dbus ];

  propagatedBuildInputs = [ spidermonkey_52 ];

+  configureFlags = [
+    "--enable-installed-tests"
+  ];
+
+  postPatch = ''
+    for f in installed-tests/*.test.in; do
+      substituteInPlace "$f" --subst-var-by pkglibexecdir "$installedTests/libexec/gjs"
+    done
+  '';
+
  postInstall = ''
    sed 's|-lreadline|-L${readline.out}/lib -lreadline|g' -i $out/lib/libgjs.la
+
+    moveToOutput "share/installed-tests" "$installedTests"
+    moveToOutput "libexec/gjs/installed-tests" "$installedTests"
+
+    wrapProgram "$installedTests/libexec/gjs/installed-tests/minijasmine" \
+      --prefix GI_TYPELIB_PATH : "${stdenv.lib.makeSearchPath "lib/girepository-1.0" [ gtk3 atk pango.out gdk_pixbuf ]}:$installedTests/libexec/gjs/installed-tests"
  '';

  meta = with stdenv.lib; {
+    description = "JavaScript bindings for GNOME";
    maintainers = gnome3.maintainers;
    platforms = platforms.linux;
+    license = licenses.lgpl2Plus;
  };
-
 }
--- a/pkgs/desktops/gnome-3/core/gjs/src.nix
+++ b/pkgs/desktops/gnome-3/core/gjs/src.nix
@ -1,10 +1,10 @@
 # Autogenerated by maintainers/scripts/gnome.sh update

 fetchurl: {
-  name = "gjs-1.50.2";
+  name = "gjs-1.50.4";

  src = fetchurl {
-    url = mirror://gnome/sources/gjs/1.50/gjs-1.50.2.tar.xz;
-    sha256 = "2fad902cf7a7806454121c03918755c646fcfd6b08b52d488987db4e2d691ff3";
+    url = mirror://gnome/sources/gjs/1.50/gjs-1.50.4.tar.xz;
+    sha256 = "b336e8709347e3c94245f6cbc3465f9a49f3ae491a25f49f8a97268f5235b93a";
  };
 }
--- a/pkgs/desktops/gnome-3/extensions/appindicator/default.nix
+++ b/pkgs/desktops/gnome-3/extensions/appindicator/default.nix
@ -0,0 +1,33 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  name = "gnome-shell-extension-appindicator-${version}";
+  version = "22";
+
+  src = fetchFromGitHub {
+    owner = "Ubuntu";
+    repo = "gnome-shell-extension-appindicator";
+    rev = "v${version}";
+    sha256 = "1gqw54d55hxjj2hh04p0dx2j40bhi4ck9hgwlz8f7j4v7r37z0qw";
+  };
+
+  # This package has a Makefile, but it's used for building a zip for
+  # publication to extensions.gnome.org. Disable the build phase so
+  # installing doesn't build an unnecessary release.
+  dontBuild = true;
+
+  uuid = "appindicatorsupport@rgcjonas.gmail.com";
+  installPhase = ''
+    mkdir -p $out/share/gnome-shell/extensions/${uuid}
+    cp *.js $out/share/gnome-shell/extensions/${uuid}
+    cp -r interfaces-xml $out/share/gnome-shell/extensions/${uuid}
+    cp metadata.json $out/share/gnome-shell/extensions/${uuid}
+  '';
+
+  meta = with stdenv.lib; {
+    description = "AppIndicator/KStatusNotifierItem support for GNOME Shell";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ jonafato ];
+    homepage = https://github.com/Ubuntu/gnome-shell-extension-appindicator;
+  };
+}
--- a/pkgs/desktops/gnome-3/misc/geary/default.nix
+++ b/pkgs/desktops/gnome-3/misc/geary/default.nix
@ -8,11 +8,11 @@ let
  majorVersion = "0.12";
 in
 stdenv.mkDerivation rec {
-  name = "geary-${majorVersion}.0";
+  name = "geary-${majorVersion}.1";

  src = fetchurl {
    url = "mirror://gnome/sources/geary/${majorVersion}/${name}.tar.xz";
-    sha256 = "0ii4qaqfqx90kvqwg0g9jahygkir4mb03ja55fa55yyx6cq0kwff";
+    sha256 = "12hbpd5j3rb122nrsqmgsg31x82xl0ksm0nmsl614v1dd7crqnh6";
  };

  propagatedUserEnvPkgs = [ gnome3.gnome_themes_standard ];
--- a/pkgs/development/compilers/compcert/default.nix
+++ b/pkgs/development/compilers/compcert/default.nix
@ -19,6 +19,10 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

+  postPatch = ''
+    sed -i -e 's/8\.6\.1|8\.7\.0|8\.7\.1)/8.6.1|8.7.0|8.7.1|8.7.2)/' configure
+  '';
+
  configurePhase = ''
    substituteInPlace ./configure --replace '{toolprefix}gcc' '{toolprefix}cc'
    ./configure -clightgen -prefix $out -toolprefix ${tools}/bin/ '' +
--- a/pkgs/development/compilers/dmd/default.nix
+++ b/pkgs/development/compilers/dmd/default.nix
@ -3,9 +3,9 @@
 , curl, tzdata, gdb, darwin
 , callPackage
 , bootstrapVersion ? false
-, version ? "2.078.1"
-, dmdSha256 ? "0b9lphh4g3r9cyzv4wcfppv9j3w952vvwv615za23acgwav3mqg2"
-, druntimeSha256 ? "16jv40m073cflpkyl0vmg1g58cianybfcsgcvwli7pfryxbgsbrr"
+, version ? "2.078.2"
+, dmdSha256 ? "0x9q4aw4jl36dz7m5111y2sm8jdaj3zg36zhj6vqg1lqpdn3bhls"
+, druntimeSha256 ? "0nfqjcmwqc490bzi3582x1c3zigkf306g4nyd1cyd3vs8lfm6x66"
 , phobosSha256 ? "08ircpf4ilznz638kra272hz8fi5ccvw2cswj5hqckssl1lyqzs8"
 }:

@ -111,7 +111,7 @@ let
    ''

    + stdenv.lib.optionalString stdenv.hostPlatform.isLinux ''
-        # See https://github.com/NixOS/nixpkgs/issues/29443
+        # See https://github.com/dlang/phobos/pull/5960
        substituteInPlace phobos/std/path.d \
            --replace "\"/root" "\"${ROOT_HOME_DIR}"
    '';
--- a/pkgs/development/compilers/gambit/default.nix
+++ b/pkgs/development/compilers/gambit/default.nix
@ -1,19 +1,20 @@
-{ stdenv, fetchurl, fetchgit, git, openssl, autoconf, pkgs }:
+{ stdenv, fetchurl, fetchgit, git, openssl, autoconf, pkgs, makeStaticLibraries }:

 # TODO: distinct packages for gambit-release and gambit-devel

 stdenv.mkDerivation rec {
  name    = "gambit-${version}";
-  version = "4.8.8-427-g37b111a5";
+  version = "4.8.8-435-gd1991ba7";
  bootstrap = import ./bootstrap.nix ( pkgs );

  src = fetchgit {
    url = "https://github.com/feeley/gambit.git";
-    rev = "37b111a5ca3aeff9dc6cb8be470277a8c1e80f24";
-    sha256 = "14l7jql9nh7bjs6c822a17rcp9583l6bb5kiq95allgyf229vy50";
+    rev = "d1991ba7e90ed0149964320f7cafa1a8289e61f0";
+    sha256 = "02harwcsqxxcxgn2yc1y9kyxdp32mampyvnbxrzg2jzfmnp5g6cm";
  };

-  buildInputs = [ openssl git autoconf bootstrap ];
+  # Use makeStaticLibraries to enable creation of statically linked binaries
+  buildInputs = [ git autoconf bootstrap openssl (makeStaticLibraries openssl)];

  configurePhase = ''
    options=(
--- a/pkgs/development/compilers/gerbil/default.nix
+++ b/pkgs/development/compilers/gerbil/default.nix
@ -1,24 +1,26 @@
-{ stdenv, fetchurl, fetchgit, gambit,
+{ stdenv, lib, fetchurl, fetchgit, makeStaticLibraries, gambit,
  coreutils, rsync, bash,
-  openssl, zlib, sqlite, libxml2, libyaml, mysql, lmdb, leveldb }:
+  openssl, zlib, sqlite, libxml2, libyaml, mysql, lmdb, leveldb, postgresql }:

 # TODO: distinct packages for gerbil-release and gerbil-devel
+# TODO: make static compilation work

 stdenv.mkDerivation rec {
  name    = "gerbil-${version}";

-  version = "0.12-DEV-1030-gbbed3bc";
+  version = "0.12-DEV-1404-g0a266db";
  src = fetchgit {
    url = "https://github.com/vyzo/gerbil.git";
-    rev = "bbed3bc4cf7bcaa64eaabdf097192bfcc2bfc928";
-    sha256 = "1dc0j143j860yq72lfjp71fin7hpsy1426azz7rl1szxvjfb7h4r";
+    rev = "0a266db5e2e241272711bc150cc2607204bf2b78";
+    sha256 = "1lvawqn8havfyxkkgfqffc213zq2pgm179l42yj49fy3fhpzia4m";
  };

-  buildInputs = [
-    gambit
-    coreutils rsync bash
-    openssl zlib sqlite libxml2 libyaml mysql.connector-c lmdb leveldb
-  ];
+  # Use makeStaticLibraries to enable creation of statically linked binaries
+  buildInputs_libraries = [ openssl zlib sqlite libxml2 libyaml mysql.connector-c lmdb leveldb postgresql ];
+  buildInputs_staticLibraries = map makeStaticLibraries buildInputs_libraries;
+
+  buildInputs = [ gambit coreutils rsync bash ]
+    ++ buildInputs_libraries ++ buildInputs_staticLibraries;

  NIX_CFLAGS_COMPILE = [ "-I${mysql.connector-c}/include/mysql" "-L${mysql.connector-c}/lib/mysql" ];

@ -30,6 +32,18 @@ stdenv.mkDerivation rec {
    find . -type f -executable -print0 | while IFS= read -r -d ''$'\0' f; do
      substituteInPlace "$f" --replace '#!/usr/bin/env' '#!${coreutils}/bin/env'
    done
+
+    cat > etc/gerbil_static_libraries.sh <<EOF
+#OPENSSL_LIBCRYPTO=${makeStaticLibraries openssl}/lib/libcrypto.a # MISSING!
+#OPENSSL_LIBSSL=${makeStaticLibraries openssl}/lib/libssl.a # MISSING!
+ZLIB=${makeStaticLibraries zlib}/lib/libz.a
+# SQLITE=${makeStaticLibraries sqlite}/lib/sqlite.a # MISSING!
+# LIBXML2=${makeStaticLibraries libxml2}/lib/libxml2.a # MISSING!
+# YAML=${makeStaticLibraries libyaml}/lib/libyaml.a # MISSING!
+MYSQL=${makeStaticLibraries mysql.connector-c}/lib/mariadb/libmariadb.a
+# LMDB=${makeStaticLibraries lmdb}/lib/mysql/libmysqlclient_r.a # MISSING!
+LEVELDB=${makeStaticLibraries lmdb}/lib/libleveldb.a
+EOF
  '';

  buildPhase = ''
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@ -607,7 +607,7 @@ self: super: {
  };

  # Need newer versions of their dependencies than the ones we have in LTS-10.x.
-  cabal2nix = super.cabal2nix.override { hpack = self.hpack_0_25_0; };
+  cabal2nix = super.cabal2nix.override { hpack = self.hpack_0_27_0; };
  hlint = super.hlint.overrideScope (self: super: { haskell-src-exts = self.haskell-src-exts_1_20_1; });

  # https://github.com/bos/configurator/issues/22
@ -1000,21 +1000,13 @@ self: super: {
    '';
  });

-  # Add a flag to enable building against GHC with D4388 applied (the
-  # deterministic profiling symbols patch). The flag is disabled by
-  # default, so we can apply this patch globally.
-  #
-  # https://github.com/ucsd-progsys/liquidhaskell/pull/1233
-  liquidhaskell =
-    let patch = pkgs.fetchpatch
-          { url = https://github.com/ucsd-progsys/liquidhaskell/commit/1aeef1871760b2be46cc1cabd51311997d1d0bc0.patch;
-            sha256 = "0i55n6p3x9as648as0lvxy2alqb1n7c10xv9gp15cvq7zx6c8ydg";
-          };
-    in appendPatch super.liquidhaskell patch;
-
  # https://github.com/nick8325/twee/pull/1
  twee-lib = dontHaddock super.twee-lib;

  # Needs older hlint
  hpio = dontCheck super.hpio;
+
+  # https://github.com/ucsd-progsys/liquidhaskell/issues/1238
+  liquidhaskell = dontHaddock super.liquidhaskell;
+
 }
--- a/pkgs/development/haskell-modules/configuration-ghc-8.4.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-8.4.x.nix
@ -104,13 +104,6 @@ self: super: {
  ## hspec-discover ==2.4.7
  hspec-discover = super.hspec-discover_2_4_8;

-  ## Needs bump to a versioned attribute
-  ## 
-  ##     • No instance for (Semigroup Metadatas)
-  ##         arising from the superclasses of an instance declaration
-  ##     • In the instance declaration for ‘Monoid Metadatas’
-  JuicyPixels = super.JuicyPixels_3_2_9_4;
-
  ## Needs bump to a versioned attribute
  ## 
  ##     • Could not deduce (Semigroup (a :->: b))
@ -135,16 +128,7 @@ self: super: {
  ##     • Could not deduce (Semigroup (Traversal f))
  ##         arising from the superclasses of an instance declaration
  ##       from the context: Applicative f
-  tasty = super.tasty_1_0_0_1;
-
-  ## Needs bump to a versioned attribute
-  ## 
-  ## Setup: Encountered missing dependencies:
-  ## template-haskell >=2.4 && <2.13
-  ## builder for ‘/nix/store/sq6cc33h4zk1wns2fsyv8cj6clcf6hwi-th-lift-0.7.7.drv’ failed with exit code 1
-  ## error: build of ‘/nix/store/sq6cc33h4zk1wns2fsyv8cj6clcf6hwi-th-lift-0.7.7.drv’ failed
-  th-lift = super.th-lift_0_7_8;
-
+  tasty = super.tasty_1_0_1;

  ## On Hackage:

--- a/pkgs/development/haskell-modules/generic-builder.nix
+++ b/pkgs/development/haskell-modules/generic-builder.nix
@ -191,7 +191,7 @@ assert allPkgconfigDepends != [] -> pkgconfig != null;
 stdenv.mkDerivation ({
  name = "${pname}-${version}";

-  outputs = if (args ? outputs) then args.outputs else ([ "out" ] ++ (optional enableSeparateDataOutput "data") ++ (optional enableSeparateDocOutput "doc"));
+  outputs = [ "out" ] ++ (optional enableSeparateDataOutput "data") ++ (optional enableSeparateDocOutput "doc");
  setOutputFlags = false;

  pos = builtins.unsafeGetAttrPos "pname" args;
--- a/pkgs/development/haskell-modules/hackage-packages.nix
+++ b/pkgs/development/haskell-modules/hackage-packages.nix
--- a/pkgs/development/idris-modules/build-builtin-package.nix
+++ b/pkgs/development/idris-modules/build-builtin-package.nix
@ -1,4 +1,4 @@
-# Build one of the packages that come with idris
+# Build one of the packages that comes with idris
 # name: The name of the package
 # deps: The dependencies of the package
 { idris, build-idris-package, lib }: name: deps:
@ -6,20 +6,16 @@ let
  inherit (builtins.parseDrvName idris.name) version;
 in
 build-idris-package {
-  name = "${name}-${version}";
-
-  propagatedBuildInputs = deps;

+  inherit name version;
  inherit (idris) src;

+  idrisDeps = deps;
+
  postUnpack = ''
    sourceRoot=$sourceRoot/libs/${name}
  '';

-  postPatch = ''
-    sed -i ${name}.ipkg -e "/^opts/ s|-i \\.\\./|-i $IDRIS_LIBRARY_PATH/|g"
-  '';
-
  meta = idris.meta // {
    description = "${name} builtin Idris library";
  };
--- a/pkgs/development/idris-modules/build-idris-package.nix
+++ b/pkgs/development/idris-modules/build-idris-package.nix
@ -1,23 +1,46 @@
 # Build an idris package
-#
-# args: Additional arguments to pass to mkDerivation. Generally should include at least
-#       name and src.
-{ stdenv, idris, gmp }: args: stdenv.mkDerivation ({
-  buildPhase = ''
-    idris --build *.ipkg
+{ stdenv, idrisPackages, gmp }:
+  { idrisDeps ? []
+  , name
+  , version
+  , src
+  , meta
+  , extraBuildInputs ? []
+  , postUnpack ? ""
+  , doCheck ? true
+  }:
+let
+  idris-with-packages = idrisPackages.with-packages idrisDeps;
+in
+stdenv.mkDerivation ({
+
+  name = "${name}-${version}";
+
+  inherit postUnpack src doCheck meta;
+
+
+  # Some packages use the style
+  # opts = -i ../../path/to/package
+  # rather than the declarative pkgs attribute so we have to rewrite the path.
+  postPatch = ''
+    sed -i *.ipkg -e "/^opts/ s|-i \\.\\./|-i ${idris-with-packages}/libs/|g"
  '';

-  doCheck = true;
+  buildPhase = ''
+    ${idris-with-packages}/bin/idris --build *.ipkg
+  '';

  checkPhase = ''
    if grep -q test *.ipkg; then
-      idris --testpkg *.ipkg
+      ${idris-with-packages}/bin/idris --testpkg *.ipkg
    fi
  '';

  installPhase = ''
-    idris --install *.ipkg --ibcsubdir $IBCSUBDIR
+    ${idris-with-packages}/bin/idris --install *.ipkg --ibcsubdir $out/libs
  '';

-  buildInputs = [ gmp idris ];
-} // args)
+  buildInputs = [ gmp ] ++ extraBuildInputs;
+
+  propagatedBuildInputs = idrisDeps;
+})
--- a/pkgs/development/idris-modules/default.nix
+++ b/pkgs/development/idris-modules/default.nix
@ -25,14 +25,8 @@
      pruviloj = [ self.prelude self.base ];
    };

-    files = builtins.filter (n: n != "default") (pkgs.lib.mapAttrsToList (name: type: let
-      m = builtins.match "(.*)\\.nix" name;
-    in if m == null then "default" else builtins.head m) (builtins.readDir ./.));
-  in (builtins.listToAttrs (map (name: {
-    inherit name;
-
-    value = callPackage (./. + "/${name}.nix") {};
-  }) files)) // {
+  in
+    {
    inherit idris-no-deps callPackage;
    # See #10450 about why we have to wrap the executable
    idris =
@ -40,7 +34,28 @@
          idris-no-deps
          { path = [ pkgs.gcc ]; lib = [pkgs.gmp]; };

+
+    with-packages = callPackage ./with-packages.nix {} ;
+
+    build-builtin-package = callPackage ./build-builtin-package.nix {};
+
+    build-idris-package = callPackage ./build-idris-package.nix {};
+
+    # Libraries
+
    # A list of all of the libraries that come with idris
    builtins = pkgs.lib.mapAttrsToList (name: value: value) builtins_;
+
+    httpclient = callPackage ./httpclient.nix {};
+
+    lightyear = callPackage ./lightyear.nix {};
+
+    optparse = callPackage ./optparse.nix {};
+
+    wl-pprint = callPackage ./wl-pprint.nix {};
+
+    specdris = callPackage ./specdris.nix {};
+
+
  } // builtins_;
 in fix' (extends overrides idrisPackages)
--- a/pkgs/development/idris-modules/httpclient.nix
+++ b/pkgs/development/idris-modules/httpclient.nix
@ -1,17 +1,20 @@
-{ pkgs
+{ curl
 , build-idris-package
 , fetchFromGitHub
 , lightyear
 , contrib
+, effects
+, prelude
+, base
 , lib
 , idris
 }:

 let
-  date = "2016-12-20";
 in
 build-idris-package {
-  name = "httpclient-${date}";
+  name = "httpclient";
+  version = "2016-12-20";

  src = fetchFromGitHub {
    owner = "justjoheinz";
@ -20,11 +23,14 @@ build-idris-package {
    sha256 = "0sy0q7gri9lwbqdmx9720pby3w1470w7wzn62bf2rir532219hhl";
  };

-  propagatedBuildInputs = [ pkgs.curl lightyear contrib ];
+  idrisDeps = [ prelude base effects lightyear contrib ];
+
+  extraBuildInputs = [ curl ];

  meta = {
    description = "HTTP Client for Idris";
    homepage = https://github.com/justjoheinz/idris-httpclient;
    inherit (idris.meta) platforms;
+    broken = true;
  };
 }
--- a/pkgs/development/idris-modules/idris-wrapper.nix
+++ b/pkgs/development/idris-modules/idris-wrapper.nix
@ -10,8 +10,5 @@ symlinkJoin {
    wrapProgram $out/bin/idris \
      --suffix PATH : ${ stdenv.lib.makeBinPath path } \
      --suffix LIBRARY_PATH : ${stdenv.lib.makeLibraryPath lib}
-
-    mkdir -p $out/nix-support
-    substituteAll ${./setup-hook.sh} $out/nix-support/setup-hook
      '';
  }
--- a/pkgs/development/idris-modules/lightyear.nix
+++ b/pkgs/development/idris-modules/lightyear.nix
@ -10,8 +10,11 @@
 let
  date = "2017-09-10";
 in
-build-idris-package {
-  name = "lightyear-${date}";
+build-idris-package  {
+  name = "lightyear";
+  version = date;
+
+  idrisDeps = [ prelude base effects ];

  src = fetchFromGitHub {
    owner = "ziman";
@ -20,8 +23,6 @@ build-idris-package {
    sha256 = "05x66abhpbdm6yr0afbwfk6w04ysdk78gylj5alhgwhy4jqakv29";
  };

-  propagatedBuildInputs = [ prelude base effects ];
-
  meta = {
    description = "Parser combinators for Idris";
    homepage = https://github.com/ziman/lightyear;
--- a/pkgs/development/idris-modules/setup-hook.sh
+++ b/pkgs/development/idris-modules/setup-hook.sh
@ -1,16 +0,0 @@
-# Library import path
-export IDRIS_LIBRARY_PATH=$PWD/idris-libs
-mkdir -p $IDRIS_LIBRARY_PATH
-
-# Library install path
-export IBCSUBDIR=$out/lib/@name@
-mkdir -p $IBCSUBDIR
-
-addIdrisLibs () {
-  if [ -d $1/lib/@name@ ]; then
-    ln -sv $1/lib/@name@/* $IDRIS_LIBRARY_PATH
-  fi
-}
-
-# All run-time deps
-addEnvHooks 1 addIdrisLibs
--- a/pkgs/development/idris-modules/specdris.nix
+++ b/pkgs/development/idris-modules/specdris.nix
@ -11,7 +11,8 @@ let
  date = "2017-11-11";
 in
 build-idris-package {
-  name = "specdris-${date}";
+  name = "specdris";
+  version = date;

  src = fetchgit {
    url = "https://github.com/pheymann/specdris";
@ -19,21 +20,10 @@ build-idris-package {
    sha256 = "4813c4be1d4c3dd1dad35964b085f83cf9fb44b16824257c72b468d4bafd0e4f";
  };

-  propagatedBuildInputs = [ prelude base effects ];
+  idrisDeps = [ prelude base effects idris ];

-  buildPhase = ''
-    ${idris}/bin/idris --build specdris.ipkg
-  '';
-
-  checkPhase = ''
-      cd test/
-      ${idris}/bin/idris --testpkg test.ipkg
-      cd ../
-    '';
-
-  installPhase = ''
-    ${idris}/bin/idris --install specdris.ipkg --ibcsubdir $IBCSUBDIR
-  '';
+  # The tests attribute is very strange as the tests are a different ipkg
+  doCheck = false;

  meta = {
    description = "A testing library for Idris";
--- a/pkgs/development/idris-modules/with-packages.nix
+++ b/pkgs/development/idris-modules/with-packages.nix
@ -1,46 +1,20 @@
 # Build a version of idris with a set of packages visible
 # packages: The packages visible to idris
-{ stdenv, idris }: packages: stdenv.mkDerivation {
-  inherit (idris) name;
+{ stdenv, idris, symlinkJoin, makeWrapper }: packages:

-  buildInputs = packages;
+let paths = stdenv.lib.closePropagation packages;
+in
+symlinkJoin {

-  preHook = ''
-    mkdir -p $out/lib/${idris.name}
+  name = idris.name + "-with-packages";

-    installIdrisLib () {
-      if [ -d $1/lib/${idris.name} ]; then
-        ln -fsv $1/lib/${idris.name}/* $out/lib/${idris.name}
-      fi
-    }
+  paths = paths ++ [idris] ;

-    envHostTargetHooks+=(installIdrisLib)
-  '';
+  buildInputs = [ makeWrapper ];

-  unpackPhase = ''
-    cat >idris.c <<EOF
-    #include <stdlib.h>
-    #include <unistd.h>
-    #include <stdio.h>
+  postBuild = ''
+    wrapProgram $out/bin/idris \
+      --set IDRIS_LIBRARY_PATH $out/libs
+      '';

-    int main (int argc, char ** argv) {
-      /* idris currently only supports a single library path, so respect it if the user set it */
-      setenv("IDRIS_LIBRARY_PATH", "$out/lib/${idris.name}", 0);
-      execv("${idris}/bin/idris", argv);
-      perror("executing ${idris}/bin/idris");
-      return 127;
-    }
-    EOF
-  '';
-
-  buildPhase = ''
-    $CC -O3 -o idris idris.c
-  '';
-
-  installPhase = ''
-    mkdir -p $out/bin
-    mv idris $out/bin
-  '';
-
-  stripAllList = [ "bin" ];
 }
--- a/pkgs/development/idris-modules/wl-pprint.nix
+++ b/pkgs/development/idris-modules/wl-pprint.nix
@ -6,7 +6,8 @@
 , idris
 }:
 build-idris-package {
-  name = "wl-pprint-2016-09-28";
+  pkName = "wl-pprint";
+  version = "2016-09-28";

  src = fetchFromGitHub {
    owner = "shayan-najd";
@ -19,7 +20,7 @@ build-idris-package {
  # updating this package again.
  doCheck = false;

-  propagatedBuildInputs = [ prelude base ];
+  idrisDeps = [ prelude base ];

  meta = {
    description = "Wadler-Leijen pretty-printing library";
--- a/pkgs/development/interpreters/clojure/default.nix
+++ b/pkgs/development/interpreters/clojure/default.nix
@ -1,16 +1,16 @@
-{ stdenv, fetchurl, jdk, makeWrapper }:
+{ stdenv, fetchurl, jdk, rlwrap, makeWrapper }:

-let version = "1.9.0.273"; in
+let version = "1.9.0.326"; in

 stdenv.mkDerivation {
  name = "clojure-${version}";

  src = fetchurl {
    url = "https://download.clojure.org/install/clojure-tools-${version}.tar.gz";
-    sha256 = "0xmrq3xvr002jgq8m1j0y5ld0rcr49608g3gqxgyxzjqswacglb4";
+    sha256 = "0sf8gy39iz4jxj2wic1lbdwdwbj90k3awhr0kq76gr1z1dwbj6s9";
  };

-  buildInputs = [ jdk makeWrapper ];
+  buildInputs = [ makeWrapper ];

  installPhase = ''
    pwd
@ -20,6 +20,9 @@ stdenv.mkDerivation {
    cp -f clojure-tools-${version}.jar $out/libexec
    sed -i -e "s@PREFIX@$out@g" clojure
    cp -f clj clojure $out/bin
+    for program in $out/bin/{clojure,clj}; do
+      wrapProgram $program --suffix PATH : $out/bin:${jdk.jre}/bin:${rlwrap}/bin
+    done
  '';

  meta = with stdenv.lib; {
--- a/pkgs/development/libraries/acl/default.nix
+++ b/pkgs/development/libraries/acl/default.nix
@ -20,13 +20,14 @@ stdenv.mkDerivation rec {
    sed -e '/^\/\//d' -i include/acl.h
  '';

-  configureFlags = "MAKE=make MSGFMT=msgfmt MSGMERGE=msgmerge XGETTEXT=xgettext ZIP=gzip ECHO=echo SED=sed AWK=gawk";
+  configureFlags = [ "MAKE=make" "MSGFMT=msgfmt" "MSGMERGE=msgmerge" "XGETTEXT=xgettext" "ZIP=gzip" "ECHO=echo" "SED=sed" "AWK=gawk" ];

-  installTargets = "install install-lib install-dev";
+  installTargets = [ "install" "install-lib" "install-dev" ];

-  meta = {
-    homepage = http://savannah.nongnu.org/projects/acl;
+  meta = with stdenv.lib; {
+    homepage = "http://savannah.nongnu.org/projects/acl";
    description = "Library and tools for manipulating access control lists";
-    platforms = stdenv.lib.platforms.linux;
+    platforms = platforms.linux;
+    license = licenses.gpl2Plus;
  };
 }
--- a/Show More
+++ b/Show More