Merge remote-tracking branch 'upstream/master'

2017-04-24 10:25:40 +02:00 · 2017-04-24 10:25:40 +02:00 · 1f80c7f837
commit 1f80c7f837
parent 636789c1a9 229e3383f4
106 changed files with 1913 additions and 1443 deletions
--- a/doc/cross-compilation.xml
+++ b/doc/cross-compilation.xml
@ -167,6 +167,11 @@
      Because of this, a best-of-both-worlds solution is in the works with no splicing or explicit access of <varname>buildPackages</varname> needed.
      For now, feel free to use either method.
    </para>
+    <note><para>
+      There is also a "backlink" <varname>__targetPackages</varname>, yielding a package set whose <varname>buildPackages</varname> is the current package set.
+      This is a hack, though, to accommodate compilers with lousy build systems.
+      Please do not use this unless you are absolutely sure you are packaging such a compiler and there is no other way.
+    </para></note>
  </section>

 </section>
--- a/doc/languages-frameworks/ruby.xml
+++ b/doc/languages-frameworks/ruby.xml
@ -16,8 +16,7 @@ $ cd sensu
 $ cat > Gemfile
 source 'https://rubygems.org'
 gem 'sensu'
-$ nix-shell -p bundler --command "bundler package --path /tmp/vendor/bundle"
-$ $(nix-build '<nixpkgs>' -A bundix)/bin/bundix
+$ $(nix-build '<nixpkgs>' -A bundix)/bin/bundix --magic
 $ cat > default.nix
 { lib, bundlerEnv, ruby }:

--- a/doc/multiple-output.xml
+++ b/doc/multiple-output.xml
@ -16,7 +16,6 @@

 <section><title>Installing a split package</title>
  <para>When installing a package via <varname>systemPackages</varname> or <command>nix-env</command> you have several options:</para>
-  <warning><para>Currently <command>nix-env</command> almost always installs all outputs until https://github.com/NixOS/nix/pull/815 gets merged.</para></warning>
  <itemizedlist>
    <listitem><para>You can install particular outputs explicitly, as each is available in the Nix language as an attribute of the package.  The <varname>outputs</varname> attribute contains a list of output names.</para></listitem>
    <listitem><para>You can let it use the default outputs.  These are handled by <varname>meta.outputsToInstall</varname> attribute that contains a list of output names.</para>
--- a/lib/maintainers.nix
+++ b/lib/maintainers.nix
@ -452,7 +452,7 @@
  romildo = "José Romildo Malaquias <malaquias@gmail.com>";
  rongcuid = "Rongcui Dong <rongcuid@outlook.com>";
  ronny = "Ronny Pfannschmidt <nixos@ronnypfannschmidt.de>";
-  rszibele = "Richard Szibele <richard_szibele@hotmail.com>";
+  rszibele = "Richard Szibele <richard@szibele.com>";
  rtreffer = "Rene Treffer <treffer+nixos@measite.de>";
  rushmorem = "Rushmore Mushambi <rushmore@webenchanter.com>";
  rvl = "Rodney Lorrimar <dev+nix@rodney.id.au>";
--- a/nixos/lib/make-disk-image.nix
+++ b/nixos/lib/make-disk-image.nix
@ -33,42 +33,124 @@

 , name ? "nixos-disk-image"

-  # This prevents errors while checking nix-store validity, see
-  # https://github.com/NixOS/nix/issues/1134
-, fixValidity ? true
-
 , format ? "raw"
 }:

 with lib;

-pkgs.vmTools.runInLinuxVM (
+let
+  # Copied from https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/installer/cd-dvd/channel.nix
+  # TODO: factor out more cleanly
+
+  # Do not include these things:
+  #   - The '.git' directory
+  #   - Result symlinks from nix-build ('result', 'result-2', 'result-bin', ...)
+  #   - VIM/Emacs swap/backup files ('.swp', '.swo', '.foo.swp', 'foo~', ...)
+  filterFn = path: type: let basename = baseNameOf (toString path); in
+    if type == "directory" then basename != ".git"
+    else if type == "symlink" then builtins.match "^result(|-.*)$" basename == null
+    else builtins.match "^((|\..*)\.sw[a-z]|.*~)$" basename == null;
+
+  nixpkgs = builtins.filterSource filterFn pkgs.path;
+
+  channelSources = pkgs.runCommand "nixos-${config.system.nixosVersion}" {} ''
+    mkdir -p $out
+    cp -prd ${nixpkgs} $out/nixos
+    chmod -R u+w $out/nixos
+    if [ ! -e $out/nixos/nixpkgs ]; then
+      ln -s . $out/nixos/nixpkgs
+    fi
+    rm -rf $out/nixos/.git
+    echo -n ${config.system.nixosVersionSuffix} > $out/nixos/.version-suffix
+  '';
+
+  metaClosure = pkgs.writeText "meta" ''
+    ${config.system.build.toplevel}
+    ${config.nix.package.out}
+    ${channelSources}
+  '';
+
+  prepareImageInputs = with pkgs; [ rsync utillinux parted e2fsprogs lkl fakeroot config.system.build.nixos-prepare-root ] ++ stdenv.initialPath;
+
+  # I'm preserving the line below because I'm going to search for it across nixpkgs to consolidate
+  # image building logic. The comment right below this now appears in 4 different places in nixpkgs :)
+  # !!! should use XML.
+  sources = map (x: x.source) contents;
+  targets = map (x: x.target) contents;
+
+  prepareImage = ''
+    export PATH=${pkgs.lib.makeSearchPathOutput "bin" "bin" prepareImageInputs}
+
+    mkdir $out
+    diskImage=nixos.raw
+    truncate -s ${toString diskSize}M $diskImage
+
+    ${if partitioned then ''
+      parted $diskImage -- mklabel msdos mkpart primary ext4 1M -1s
+      offset=$((2048*512))
+    '' else ''
+      offset=0
+    ''}
+
+    mkfs.${fsType} -F -L nixos -E offset=$offset $diskImage
+  
+    root="$PWD/root"
+    mkdir -p $root
+
+    # Copy arbitrary other files into the image
+    # Semi-shamelessly copied from make-etc.sh. I (@copumpkin) shall factor this stuff out as part of
+    # https://github.com/NixOS/nixpkgs/issues/23052.
+    set -f
+    sources_=(${concatStringsSep " " sources})
+    targets_=(${concatStringsSep " " targets})
+    set +f
+
+    for ((i = 0; i < ''${#targets_[@]}; i++)); do
+      source="''${sources_[$i]}"
+      target="''${targets_[$i]}"
+
+      if [[ "$source" =~ '*' ]]; then
+        # If the source name contains '*', perform globbing.
+        mkdir -p $root/$target
+        for fn in $source; do
+          rsync -a --no-o --no-g "$fn" $root/$target/
+        done
+      else
+        mkdir -p $root/$(dirname $target)
+        if ! [ -e $root/$target ]; then
+          rsync -a --no-o --no-g $source $root/$target
+        else
+          echo "duplicate entry $target -> $source"
+          exit 1
+        fi
+      fi
+    done
+
+    # TODO: Nix really likes to chown things it creates to its current user...
+    fakeroot nixos-prepare-root $root ${channelSources} ${config.system.build.toplevel} closure
+
+    echo "copying staging root to image..."
+    cptofs ${pkgs.lib.optionalString partitioned "-P 1"} -t ${fsType} -i $diskImage $root/* /
+  '';
+in pkgs.vmTools.runInLinuxVM (
  pkgs.runCommand name
-    { preVM =
-        ''
-          mkdir $out
-          diskImage=$out/nixos.${if format == "qcow2" then "qcow2" else "img"}
-          ${pkgs.vmTools.qemu}/bin/qemu-img create -f ${format} $diskImage "${toString diskSize}M"
-          mv closure xchg/
-        '';
-      buildInputs = with pkgs; [ utillinux perl e2fsprogs parted rsync ];
-
-      # I'm preserving the line below because I'm going to search for it across nixpkgs to consolidate
-      # image building logic. The comment right below this now appears in 4 different places in nixpkgs :)
-      # !!! should use XML.
-      sources = map (x: x.source) contents;
-      targets = map (x: x.target) contents;
-
-      exportReferencesGraph =
-        [ "closure" config.system.build.toplevel ];
-      inherit postVM;
+    { preVM = prepareImage;
+      buildInputs = with pkgs; [ utillinux e2fsprogs ];
+      exportReferencesGraph = [ "closure" metaClosure ];
+      postVM = ''
+        ${if format == "raw" then ''
+          mv $diskImage $out/nixos.img
+          diskImage=$out/nixos.img
+        '' else ''
+          ${pkgs.qemu}/bin/qemu-img convert -f raw -O qcow2 $diskImage $out/nixos.qcow2
+          diskImage=$out/nixos.qcow2
+        ''}
+        ${postVM}
+      '';
      memSize = 1024;
    }
    ''
      ${if partitioned then ''
-        # Create a single / partition.
-        parted /dev/vda mklabel msdos
-        parted /dev/vda -- mkpart primary ext2 1M -1s
        . /sys/class/block/vda1/uevent
        mknod /dev/vda1 b $MAJOR $MINOR
        rootDisk=/dev/vda1
@ -76,74 +158,34 @@ pkgs.vmTools.runInLinuxVM (
        rootDisk=/dev/vda
      ''}

-      # Create an empty filesystem and mount it.
-      mkfs.${fsType} -L nixos $rootDisk
-      mkdir /mnt
-      mount $rootDisk /mnt
-
-      # Register the paths in the Nix database.
-      printRegistration=1 perl ${pkgs.pathsFromGraph} /tmp/xchg/closure | \
-          ${config.nix.package.out}/bin/nix-store --load-db --option build-users-group ""
-
-      ${if fixValidity then ''
-        # Add missing size/hash fields to the database. FIXME:
-        # exportReferencesGraph should provide these directly.
-        ${config.nix.package.out}/bin/nix-store --verify --check-contents --option build-users-group ""
-      '' else ""}
-
-      # In case the bootloader tries to write to /dev/sda…
+      # Some tools assume these exist
      ln -s vda /dev/xvda
      ln -s vda /dev/sda

-      # Install the closure onto the image
-      USER=root ${config.system.build.nixos-install}/bin/nixos-install \
-        --closure ${config.system.build.toplevel} \
-        --no-channel-copy \
-        --no-root-passwd \
-        ${optionalString (!installBootLoader) "--no-bootloader"}
+      mountPoint=/mnt
+      mkdir $mountPoint
+      mount $rootDisk $mountPoint

-      # Install a configuration.nix.
+      # Install a configuration.nix
      mkdir -p /mnt/etc/nixos
      ${optionalString (configFile != null) ''
        cp ${configFile} /mnt/etc/nixos/configuration.nix
      ''}

-      # Remove /etc/machine-id so that each machine cloning this image will get its own id
-      rm -f /mnt/etc/machine-id
+      mount --rbind /dev  $mountPoint/dev
+      mount --rbind /proc $mountPoint/proc
+      mount --rbind /sys  $mountPoint/sys

-      # Copy arbitrary other files into the image
-      # Semi-shamelessly copied from make-etc.sh. I (@copumpkin) shall factor this stuff out as part of
-      # https://github.com/NixOS/nixpkgs/issues/23052.
-      set -f
-      sources_=($sources)
-      targets_=($targets)
-      set +f
+      # Set up core system link, GRUB, etc.
+      NIXOS_INSTALL_BOOTLOADER=1 chroot $mountPoint /nix/var/nix/profiles/system/bin/switch-to-configuration boot

-      for ((i = 0; i < ''${#targets_[@]}; i++)); do
-        source="''${sources_[$i]}"
-        target="''${targets_[$i]}"
+      # TODO: figure out if I should activate, but for now I won't
+      # chroot $mountPoint /nix/var/nix/profiles/system/activate

-        if [[ "$source" =~ '*' ]]; then
+      # The above scripts will generate a random machine-id and we don't want to bake a single ID into all our images
+      rm -f $mountPoint/etc/machine-id

-          # If the source name contains '*', perform globbing.
-          mkdir -p /mnt/$target
-          for fn in $source; do
-            rsync -a --no-o --no-g "$fn" /mnt/$target/
-          done
-
-        else
-
-          mkdir -p /mnt/$(dirname $target)
-          if ! [ -e /mnt/$target ]; then
-            rsync -a --no-o --no-g $source /mnt/$target
-          else
-            echo "duplicate entry $target -> $source"
-            exit 1
-          fi
-        fi
-      done
-
-      umount /mnt
+      umount -R /mnt

      # Make sure resize2fs works. Note that resize2fs has stricter criteria for resizing than a normal
      # mount, so the `-c 0` and `-i 0` don't affect it. Setting it to `now` doesn't produce deterministic
--- a/nixos/maintainers/scripts/ec2/amazon-image.nix
+++ b/nixos/maintainers/scripts/ec2/amazon-image.nix
@ -6,10 +6,7 @@ let
  cfg = config.amazonImage;
 in {

-  imports =
-    [ ../../../modules/installer/cd-dvd/channel.nix
-      ../../../modules/virtualisation/amazon-image.nix
-    ];
+  imports = [ ../../../modules/virtualisation/amazon-image.nix ];

  options.amazonImage = {
    contents = mkOption {
--- a/nixos/modules/installer/tools/nixos-prepare-root.sh
+++ b/nixos/modules/installer/tools/nixos-prepare-root.sh
@ -70,7 +70,7 @@ for i in $closures; do
            rsync -a $j $mountPoint/nix/store/
        done

-        nix-store --register-validity < $i
+        nix-store --option build-users-group root --register-validity < $i
    fi
 done

--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -102,7 +102,9 @@
  ./programs/wvdial.nix
  ./programs/xfs_quota.nix
  ./programs/xonsh.nix
+  ./programs/zsh/oh-my-zsh.nix
  ./programs/zsh/zsh.nix
+  ./programs/zsh/zsh-syntax-highlighting.nix
  ./rename.nix
  ./security/acme.nix
  ./security/apparmor.nix
--- a/nixos/modules/profiles/hardened.nix
+++ b/nixos/modules/profiles/hardened.nix
@ -0,0 +1,35 @@
+# A profile with most (vanilla) hardening options enabled by default,
+# potentially at the cost of features and performance.
+
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+{
+  security.hideProcessInformation = mkDefault true;
+
+  security.apparmor.enable = mkDefault true;
+
+  # Restrict ptrace() usage to processes with a pre-defined relationship
+  # (e.g., parent/child)
+  boot.kernel.sysctl."kernel.yama.ptrace_scope" = mkOverride 500 1;
+
+  # Prevent replacing the running kernel image w/o reboot
+  boot.kernel.sysctl."kernel.kexec_load_disabled" = mkDefault true;
+
+  # Restrict access to kernel ring buffer (information leaks)
+  boot.kernel.sysctl."kernel.dmesg_restrict" = mkDefault true;
+
+  # Hide kptrs even for processes with CAP_SYSLOG
+  boot.kernel.sysctl."kernel.kptr_restrict" = mkOverride 500 2;
+
+  # Unprivileged access to bpf() has been used for privilege escalation in
+  # the past
+  boot.kernel.sysctl."kernel.unprivileged_bpf_disabled" = mkDefault true;
+
+  # Disable bpf() JIT (to eliminate spray attacks)
+  boot.kernel.sysctl."net.core.bpf_jit_enable" = mkDefault false;
+
+  # ... or at least apply some hardening to it
+  boot.kernel.sysctl."net.core.bpf_jit_harden" = mkDefault true;
+}
--- a/nixos/modules/programs/zsh/oh-my-zsh.nix
+++ b/nixos/modules/programs/zsh/oh-my-zsh.nix
@ -0,0 +1,66 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.programs.zsh.oh-my-zsh;
+in
+  {
+    options = {
+      programs.zsh.oh-my-zsh = {
+        enable = mkOption {
+          default = false;
+          description = ''
+            Enable oh-my-zsh.
+          '';
+        };
+
+        plugins = mkOption {
+          default = [];
+          type = types.listOf(types.str);
+          description = ''
+            List of oh-my-zsh plugins
+          '';
+        };
+
+        custom = mkOption {
+          default = "";
+          type = types.str;
+          description = ''
+            Path to a custom oh-my-zsh package to override config of oh-my-zsh.
+          '';
+        };
+
+        theme = mkOption {
+          default = "";
+          type = types.str;
+          description = ''
+            Name of the theme to be used by oh-my-zsh.
+          '';
+        };
+      };
+    };
+
+    config = mkIf cfg.enable {
+      environment.systemPackages = with pkgs; [ oh-my-zsh ];
+
+      programs.zsh.interactiveShellInit = with pkgs; with builtins; ''
+        # oh-my-zsh configuration generated by NixOS
+        export ZSH=${oh-my-zsh}/share/oh-my-zsh
+
+        ${optionalString (length(cfg.plugins) > 0)
+          "plugins=(${concatStringsSep " " cfg.plugins})"
+        }
+
+        ${optionalString (stringLength(cfg.custom) > 0)
+          "ZSH_CUSTOM=\"${cfg.custom}\""
+        }
+
+        ${optionalString (stringLength(cfg.theme) > 0)
+          "ZSH_THEME=\"${cfg.theme}\""
+        }
+
+        source $ZSH/oh-my-zsh.sh
+      '';
+    };
+  }
--- a/nixos/modules/programs/zsh/zsh-syntax-highlighting.nix
+++ b/nixos/modules/programs/zsh/zsh-syntax-highlighting.nix
@ -0,0 +1,43 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.programs.zsh.syntax-highlighting;
+in
+  {
+    options = {
+      programs.zsh.syntax-highlighting = {
+        enable = mkOption {
+          default = false;
+          type = types.bool;
+          description = ''
+            Enable zsh-syntax-highlighting.
+          '';
+        };
+
+        highlighters = mkOption {
+          default = [ "main" ];
+          type = types.listOf(types.str);
+          description = ''
+            Specifies the highlighters to be used by zsh-syntax-highlighting.
+
+            The following defined options can be found here:
+            https://github.com/zsh-users/zsh-syntax-highlighting/blob/master/docs/highlighters.md
+          '';
+        };
+      };
+    };
+
+    config = mkIf cfg.enable {
+      environment.systemPackages = with pkgs; [ zsh-syntax-highlighting ];
+
+      programs.zsh.interactiveShellInit = with pkgs; with builtins; ''
+        source ${zsh-syntax-highlighting}/share/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh
+
+        ${optionalString (length(cfg.highlighters) > 0)
+          "ZSH_HIGHLIGHT_HIGHLIGHTERS=(${concatStringsSep " " cfg.highlighters})"
+        }
+      '';
+    };
+  }
--- a/nixos/modules/programs/zsh/zsh.nix
+++ b/nixos/modules/programs/zsh/zsh.nix
@ -84,14 +84,6 @@ in
        type = types.bool;
      };

-      enableSyntaxHighlighting = mkOption {
-        default = false;
-        description = ''
-          Enable zsh-syntax-highlighting
-        '';
-        type = types.bool;
-      };
-      
      enableAutosuggestions = mkOption {
        default = false;
        description = ''
@ -130,10 +122,6 @@ in

        ${if cfg.enableCompletion then "autoload -U compinit && compinit" else ""}

-        ${optionalString (cfg.enableSyntaxHighlighting)
-          "source ${pkgs.zsh-syntax-highlighting}/share/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh"
-        }
-
        ${optionalString (cfg.enableAutosuggestions)
          "source ${pkgs.zsh-autosuggestions}/share/zsh-autosuggestions/zsh-autosuggestions.zsh"
        }
@ -143,7 +131,6 @@ in

        ${cfge.interactiveShellInit}

-
        HELPDIR="${pkgs.zsh}/share/zsh/$ZSH_VERSION/help"
      '';

@ -206,8 +193,7 @@ in
    environment.etc."zinputrc".source = ./zinputrc;

    environment.systemPackages = [ pkgs.zsh ]
-      ++ optional cfg.enableCompletion pkgs.nix-zsh-completions
-      ++ optional cfg.enableSyntaxHighlighting pkgs.zsh-syntax-highlighting;
+      ++ optional cfg.enableCompletion pkgs.nix-zsh-completions;

    environment.pathsToLink = optional cfg.enableCompletion "/share/zsh";

--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@ -204,5 +204,8 @@ with lib;
      "Set the option `services.xserver.displayManager.sddm.package' instead.")
    (mkRemovedOptionModule [ "fonts" "fontconfig" "forceAutohint" ] "")
    (mkRemovedOptionModule [ "fonts" "fontconfig" "renderMonoTTFAsBitmap" ] "")
+
+    # ZSH
+    (mkRenamedOptionModule [ "programs" "zsh" "enableSyntaxHighlighting" ] [ "programs" "zsh" "syntax-highlighting" "enable" ])
  ];
 }
--- a/nixos/modules/services/scheduling/fcron.nix
+++ b/nixos/modules/services/scheduling/fcron.nix
@ -149,7 +149,7 @@ in
          --group fcron \
          --directory /var/spool/fcron
        # load system crontab file
-        #${pkgs.fcron}/bin/fcrontab -u systab ${pkgs.writeText "systab" cfg.systab}
+        /run/wrappers/bin/fcrontab -u systab ${pkgs.writeText "systab" cfg.systab}
      '';

      serviceConfig = {
--- a/nixos/modules/services/x11/display-managers/default.nix
+++ b/nixos/modules/services/x11/display-managers/default.nix
@ -32,14 +32,8 @@ let
    ''
      #! ${pkgs.bash}/bin/bash

-      # SDDM splits "Exec" line in .desktop file by whitespace and pass script path as $1
-      if [[ "$0" = "$1" ]]; then
-        # remove superfluous $1 again
-        shift
-        # join arguments again and evaluate them in a shell context
-        # to interpret shell quoting
-        eval exec "$0" "$@"
-      fi
+      # Handle being called by SDDM.
+      if test "''${1:0:1}" = / ; then eval exec $1 $2 ; fi

      ${optionalString cfg.displayManager.logToJournal ''
        if [ -z "$_DID_SYSTEMD_CAT" ]; then
--- a/nixos/modules/services/x11/display-managers/slim.nix
+++ b/nixos/modules/services/x11/display-managers/slim.nix
@ -17,6 +17,7 @@ let
      login_cmd exec ${pkgs.stdenv.shell} ${dmcfg.session.script} "%session"
      halt_cmd ${config.systemd.package}/sbin/shutdown -h now
      reboot_cmd ${config.systemd.package}/sbin/shutdown -r now
+      logfile /dev/stderr
      ${optionalString (cfg.defaultUser != null) ("default_user " + cfg.defaultUser)}
      ${optionalString (cfg.defaultUser != null) ("focus_password yes")}
      ${optionalString cfg.autoLogin "auto_login yes"}
@ -128,11 +129,7 @@ in
  config = mkIf cfg.enable {

    services.xserver.displayManager.job =
-      { preStart =
-          ''
-            rm -f /var/log/slim.log
-          '';
-        environment =
+      { environment =
          { SLIM_CFGFILE = slimConfig;
            SLIM_THEMESDIR = slimThemesDir;
          };
--- a/nixos/release-combined.nix
+++ b/nixos/release-combined.nix
@ -94,6 +94,7 @@ in rec {
        (all nixos.tests.proxy)
        (all nixos.tests.sddm.default)
        (all nixos.tests.simple)
+        (all nixos.tests.slim)
        (all nixos.tests.udisks2)
        (all nixos.tests.xfce)

--- a/nixos/release.nix
+++ b/nixos/release.nix
@ -299,6 +299,7 @@ in rec {
  tests.samba = callTest tests/samba.nix {};
  tests.sddm = callSubTests tests/sddm.nix {};
  tests.simple = callTest tests/simple.nix {};
+  tests.slim = callTest tests/slim.nix {};
  tests.smokeping = callTest tests/smokeping.nix {};
  tests.taskserver = callTest tests/taskserver.nix {};
  tests.tomcat = callTest tests/tomcat.nix {};
--- a/nixos/tests/misc.nix
+++ b/nixos/tests/misc.nix
@ -122,7 +122,7 @@ import ./make-test.nix ({ pkgs, ...} : {

      # Test hidepid
      subtest "hidepid", sub {
-          $machine->succeed("grep -Fq hidepid=2 /etc/mtab");
+          $machine->succeed("grep -Fq hidepid=2 /proc/mounts");
          $machine->succeed("[ `su - sybil -c 'pgrep -c -u root'` = 0 ]");
          $machine->succeed("[ `su - alice -c 'pgrep -c -u root'` != 0 ]");
      };
--- a/nixos/tests/slim.nix
+++ b/nixos/tests/slim.nix
@ -0,0 +1,66 @@
+import ./make-test.nix ({ pkgs, ...} : {
+  name = "slim";
+
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ aszlig ];
+  };
+
+  machine = { pkgs, lib, ... }: {
+    imports = [ ./common/user-account.nix ];
+    services.xserver.enable = true;
+    services.xserver.windowManager.default = "icewm";
+    services.xserver.windowManager.icewm.enable = true;
+    services.xserver.desktopManager.default = "none";
+    services.xserver.displayManager.slim = {
+      enable = true;
+
+      # Use a custom theme in order to get best OCR results
+      theme = pkgs.runCommand "slim-theme-ocr" {
+        nativeBuildInputs = [ pkgs.imagemagick ];
+      } ''
+        mkdir "$out"
+        convert -size 1x1 xc:white "$out/background.jpg"
+        convert -size 200x100 xc:white "$out/panel.jpg"
+        cat > "$out/slim.theme" <<EOF
+        background_color #ffffff
+        background_style tile
+
+        input_fgcolor #000000
+        msg_color #000000
+
+        session_color #000000
+        session_font Verdana:size=16:bold
+
+        username_msg Username:
+        username_font Verdana:size=16:bold
+        username_color #000000
+        username_x 50%
+        username_y 40%
+
+        password_msg Password:
+        password_x 50%
+        password_y 40%
+        EOF
+      '';
+    };
+  };
+
+  enableOCR = true;
+
+  testScript = { nodes, ... }: let
+    user = nodes.machine.config.users.extraUsers.alice;
+  in ''
+    startAll;
+    $machine->waitForText(qr/Username:/);
+    $machine->sendChars("${user.name}\n");
+    $machine->waitForText(qr/Password:/);
+    $machine->sendChars("${user.password}\n");
+
+    $machine->waitForFile('${user.home}/.Xauthority');
+    $machine->succeed('xauth merge ${user.home}/.Xauthority');
+    $machine->waitForWindow('^IceWM ');
+
+    # Make sure SLiM doesn't create a log file
+    $machine->fail('test -e /var/log/slim.log');
+  '';
+})
--- a/pkgs/applications/display-managers/slim/default.nix
+++ b/pkgs/applications/display-managers/slim/default.nix
@ -22,6 +22,10 @@ stdenv.mkDerivation rec {
      # Ensure that sessions appear in sort order, rather than in
      # directory order.
      ./sort-sessions.patch
+
+      # Allow to set logfile to a special "/dev/stderr" in order to continue
+      # logging to stderr and thus to the journal.
+      ./no-logfile.patch
    ];

  preConfigure = "substituteInPlace CMakeLists.txt --replace /lib $out/lib";
--- a/pkgs/applications/display-managers/slim/no-logfile.patch
+++ b/pkgs/applications/display-managers/slim/no-logfile.patch
@ -0,0 +1,80 @@
+diff --git a/log.cpp b/log.cpp
+index b44677a..7c89dda 100644
+--- a/log.cpp
+++ b/log.cpp
+@@ -1,23 +1,31 @@
+ #include "log.h"
+ #include <iostream>
+#include <cstring>
+ 
+ bool
+ LogUnit::openLog(const char * filename)
+ {
+-	if (logFile.is_open()) {
+	if (isFile && logFile.is_open()) {
+ 		cerr << APPNAME
+ 			<< ": opening a new Log file, while another is already open"
+ 			<< endl;
+-		logFile.close();
+		closeLog();
+ 	}
+-	logFile.open(filename, ios_base::app);
+ 
+-	return !(logFile.fail());
+	if (strcmp(filename, "/dev/stderr") == 0) {
+		isFile = false;
+		return true;
+	} else {
+		logFile.open(filename, ios_base::app);
+		isFile = true;
+		return !(logFile.fail());
+	}
+ }
+ 
+ void
+ LogUnit::closeLog()
+ {
+	if (!isFile) return;
+ 	if (logFile.is_open())
+ 		logFile.close();
+ }
+diff --git a/log.h b/log.h
+index b7810be..ad548a2 100644
+--- a/log.h
+++ b/log.h
+@@ -9,11 +9,14 @@
+ #endif
+ #include "const.h"
+ #include <fstream>
+#include <iostream>
+ 
+ using namespace std;
+ 
+ static class LogUnit {
+ 	ofstream logFile;
+	bool isFile;
+	inline ostream &getStream() { return isFile ? logFile : cerr; }
+ public:
+ 	bool openLog(const char * filename);
+ 	void closeLog();
+@@ -22,17 +25,17 @@ public:
+ 
+ 	template<typename Type>
+ 	LogUnit & operator<<(const Type & text) {
+-		logFile << text; logFile.flush();
+		getStream() << text; getStream().flush();
+ 		return *this;
+ 	}
+ 
+ 	LogUnit & operator<<(ostream & (*fp)(ostream&)) {
+-		logFile << fp; logFile.flush();
+		getStream() << fp; getStream().flush();
+ 		return *this;
+ 	}
+ 
+ 	LogUnit & operator<<(ios_base & (*fp)(ios_base&)) {
+-		logFile << fp; logFile.flush();
+		getStream() << fp; getStream().flush();
+ 		return *this;
+ 	}
+ } logStream;
--- a/pkgs/applications/graphics/tesseract/default.nix
+++ b/pkgs/applications/graphics/tesseract/default.nix
@ -58,6 +58,6 @@ stdenv.mkDerivation rec {
    homepage = http://code.google.com/p/tesseract-ocr/;
    license = stdenv.lib.licenses.asl20;
    maintainers = with stdenv.lib.maintainers; [viric];
-    platforms = with stdenv.lib.platforms; linux;
+    platforms = with stdenv.lib.platforms; linux ++ darwin;
  };
 }
--- a/pkgs/applications/misc/girara/default.nix
+++ b/pkgs/applications/misc/girara/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, gtk, gettext, ncurses
+{ stdenv, fetchurl, pkgconfig, gtk, gettext, ncurses, libiconv, libintlOrEmpty
 , withBuildColors ? true
 }:

@ -18,7 +18,10 @@ stdenv.mkDerivation rec {
      --replace 'ifdef TPUT_AVAILABLE' 'ifneq ($(TPUT_AVAILABLE), 0)'
  '';

-  buildInputs = [ pkgconfig gtk gettext ];
+  buildInputs = [ pkgconfig gtk gettext libintlOrEmpty ]
+    ++ stdenv.lib.optional stdenv.isDarwin libiconv;
+
+  NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isDarwin "-lintl";

  makeFlags = [
    "PREFIX=$(out)"
@ -35,7 +38,7 @@ stdenv.mkDerivation rec {
      that focuses on simplicity and minimalism.
    '';
    license = licenses.zlib;
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
    maintainers = [ maintainers.garbas ];
  };
 }
--- a/pkgs/applications/misc/wordnet/default.nix
+++ b/pkgs/applications/misc/wordnet/default.nix
@ -42,6 +42,6 @@ stdenv.mkDerivation {
    homepage = http://wordnet.princeton.edu/;

    maintainers = [ ];
-    platforms = stdenv.lib.platforms.gnu;  # arbitrary choice
+    platforms = with stdenv.lib.platforms; linux ++ darwin;
  };
 }
--- a/pkgs/applications/networking/browsers/firefox-bin/default.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, config, makeWrapper
+{ stdenv, fetchurl, config, wrapGAppsHook
 , alsaLib
 , atk
 , cairo
@ -77,7 +77,7 @@ stdenv.mkDerivation {

  src = fetchurl { inherit (source) url sha512; };

-  phases = "unpackPhase installPhase";
+  phases = [ "unpackPhase" "installPhase" "fixupPhase" ];

  libPath = stdenv.lib.makeLibraryPath
    [ stdenv.cc.cc
@ -124,11 +124,12 @@ stdenv.mkDerivation {
      stdenv.cc.cc
    ];

-  buildInputs = [ makeWrapper gtk3 defaultIconTheme ];
+  buildInputs = [ wrapGAppsHook gtk3 defaultIconTheme ];

  # "strip" after "patchelf" may break binaries.
  # See: https://github.com/NixOS/patchelf/issues/10
-  dontStrip = 1;
+  dontStrip = true;
+  dontPatchELF = true;

  installPhase =
    ''
@ -155,22 +156,7 @@ stdenv.mkDerivation {
      # wrapFirefox expects "$out/lib" instead of "$out/usr/lib"
      ln -s "$out/usr/lib" "$out/lib"

-      # Create a desktop item.
-      mkdir -p $out/share/applications
-      cat > $out/share/applications/firefox.desktop <<EOF
-      [Desktop Entry]
-      Type=Application
-      Exec=$out/bin/firefox
-      Icon=$out/usr/lib/firefox-bin-${version}/browser/icons/mozicon128.png
-      Name=Firefox
-      GenericName=Web Browser
-      Categories=Application;Network;
-      EOF
-
-      wrapProgram "$out/bin/firefox" \
-        --argv0 "$out/bin/.firefox-wrapped" \
-        --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH:" \
-        --suffix XDG_DATA_DIRS : "$XDG_ICON_DIRS"
+      gappsWrapperArgs+=(--argv0 "$out/bin/.firefox-wrapped")
    '';

  passthru.ffmpegSupport = true;
--- a/pkgs/applications/networking/browsers/firefox-bin/sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/sources.nix
--- a/pkgs/applications/networking/browsers/firefox/default.nix
+++ b/pkgs/applications/networking/browsers/firefox/default.nix
@ -4,7 +4,7 @@
 , yasm, mesa, sqlite, unzip, makeWrapper
 , hunspell, libevent, libstartup_notification, libvpx
 , cairo, gstreamer, gst-plugins-base, icu, libpng, jemalloc, libpulseaudio
-, autoconf213, which
+, autoconf213, which, cargo, rustc
 , writeScript, xidel, common-updater-scripts, coreutils, gnused, gnugrep, curl
 , enableGTK3 ? false, gtk3, wrapGAppsHook
 , debugBuild ? false
@ -48,7 +48,9 @@ common = { pname, version, sha512, updateScript }: stdenv.mkDerivation rec {
    ++ lib.optional enableGTK3 gtk3
    ++ lib.optionals (!passthru.ffmpegSupport) [ gstreamer gst-plugins-base ];

-  nativeBuildInputs = [ autoconf213 which gnused pkgconfig perl python ] ++ lib.optional enableGTK3 wrapGAppsHook;
+  nativeBuildInputs =
+    [ autoconf213 which gnused pkgconfig perl python cargo rustc ]
+    ++ lib.optional enableGTK3 wrapGAppsHook;

  configureFlags =
    [ "--enable-application=browser"
@ -151,8 +153,8 @@ in {

  firefox-unwrapped = common {
    pname = "firefox";
-    version = "52.0.2";
-    sha512 = "15668625d212acf874b560d0adf738faf3e0df532c549ab94e1d91944542e13bf16265f08fca1eded42820f9b7ad3f0ff70a8b5bc9adde0a79d11e022bb1158e";
+    version = "53.0";
+    sha512 = "36ec810bab58e3d99478455a38427a5efbc74d6dd7d4bb93b700fd7429b9b89250efd0abe4609091483991802090c6373c8434dfc9ba64c79a778e51fd2a2886";
    updateScript = import ./update.nix {
      attrPath = "firefox-unwrapped";
      inherit writeScript lib common-updater-scripts xidel coreutils gnused gnugrep curl;
@ -161,8 +163,8 @@ in {

  firefox-esr-unwrapped = common {
    pname = "firefox-esr";
-    version = "52.0.2esr";
-    sha512 = "a0f31479e5265c7f40d3013c3dc8368c6bdf03f21f1c9054fb2ae5557065584da433b288b493680d6147a3b11155f41bd33ad2a5d53c6eaa507258c7e00d7335";
+    version = "52.1.0esr";
+    sha512 = "ba833904654eda347f83df77e04c8e81572772e8555f187b796ecc30e498b93fb729b6f60935731d9584169adc9d61329155364fddf635cbd11abebe4a600247";
    updateScript = import ./update.nix {
      attrPath = "firefox-esr-unwrapped";
      versionSuffix = "esr";
--- a/pkgs/applications/networking/instant-messengers/dino/default.nix
+++ b/pkgs/applications/networking/instant-messengers/dino/default.nix
@ -13,13 +13,13 @@
 }:

 stdenv.mkDerivation rec {
-  name = "dino-unstable-2017-04-20";
+  name = "dino-unstable-2017-04-24";

  src = fetchFromGitHub {
    owner = "dino";
    repo = "dino";
-    rev = "5c8275ed4efdc7a3a0bc2a9c3a3f46d0383ddcf4";
-    sha256 = "12k3s8k8wmjyg5m0f4f2vp83bp0m9swmrsms81yd1722z3ragxsf";
+    rev = "3eb9aa0fa79ea9fcebb5f702f81c2e54aafdc8cc";
+    sha256 = "0z9ql419q53f20bw4pfwsafxl4qqnz0ip91qibsf9jn5d56kcdwv";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/networking/instant-messengers/franz/default.nix
+++ b/pkgs/applications/networking/instant-messengers/franz/default.nix
@ -25,15 +25,18 @@ in stdenv.mkDerivation rec {
      "16l9jma2hiwzl9l41yhrwribcgmxca271rq0cfbbm9701mmmciyy";
  };

-  phases = [ "unpackPhase" "installPhase" "postFixup" ];
+  # don't remove runtime deps
+  dontPatchELF = true;

-  deps = with xorg; [
-   gtk2 atk glib pango gdk_pixbuf cairo freetype fontconfig dbus
-   libXi libXcursor libXdamage libXrandr libXcomposite libXext libXfixes
-   libXrender libX11 libXtst libXScrnSaver gnome2.GConf nss nspr alsaLib
-   cups expat stdenv.cc.cc
-
-   udev libnotify
+  deps = (with xorg; [
+    libXi libXcursor libXdamage libXrandr libXcomposite libXext libXfixes
+    libXrender libX11 libXtst libXScrnSaver
+  ]) ++ [
+    gtk2 atk glib pango gdk_pixbuf cairo freetype fontconfig dbus
+    gnome2.GConf nss nspr alsaLib cups expat stdenv.cc.cc
+  # runtime deps
+  ] ++ [
+    udev libnotify
  ];

  unpackPhase = ''
@ -42,19 +45,20 @@ in stdenv.mkDerivation rec {

  installPhase = ''
    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" Franz
-    patchelf --set-rpath "$out/share/franz:${stdenv.lib.makeLibraryPath deps}" Franz
+    patchelf --set-rpath "$out/opt/franz:${stdenv.lib.makeLibraryPath deps}" Franz

-    mkdir -p $out/bin $out/share/franz
-    cp -r * $out/share/franz
-    ln -s $out/share/franz/Franz $out/bin
+    mkdir -p $out/bin $out/opt/franz
+    cp -r * $out/opt/franz
+    ln -s $out/opt/franz/Franz $out/bin

+    # provide desktop item and icon
    mkdir -p $out/share/applications $out/share/pixmaps
    ln -s ${desktopItem}/share/applications/* $out/share/applications
-    ln -s $out/share/franz/resources/app.asar.unpacked/assets/franz.png $out/share/pixmaps
+    ln -s $out/opt/franz/resources/app.asar.unpacked/assets/franz.png $out/share/pixmaps
  '';

  postFixup = ''
-    paxmark m $out/share/franz/Franz
+    paxmark m $out/opt/franz/Franz
  '';

  meta = with stdenv.lib; {
--- a/pkgs/applications/networking/instant-messengers/rambox/default.nix
+++ b/pkgs/applications/networking/instant-messengers/rambox/default.nix
@ -12,7 +12,6 @@ let
    url = "https://raw.githubusercontent.com/saenzramiro/rambox/9e4444e6297dd35743b79fe23f8d451a104028d5/resources/Icon.png";
    sha256 = "0r00l4r5mlbgn689i3rp6ks11fgs4h2flvrlggvm2qdd974d1x0b";
  };
-
  desktopItem = makeDesktopItem rec {
    name = "Rambox";
    exec = "rambox";
@ -30,31 +29,35 @@ in stdenv.mkDerivation rec {
      "13xmljsdahffdzndg30qxh8mj7bgd9jwkxknrvlh3l6w35pbj085";
  };

-  phases = [ "unpackPhase" "installPhase" "postFixup" ];
+  # don't remove runtime deps
+  dontPatchELF = true;

-  deps = with xorg; [
-   gtk2 atk glib pango gdk_pixbuf cairo freetype fontconfig dbus
-   libXi libXcursor libXdamage libXrandr libXcomposite libXext libXfixes
-   libXrender libX11 libXtst libXScrnSaver gnome2.GConf nss nspr alsaLib
-   cups expat stdenv.cc.cc
-
-   udev libnotify
+  deps = (with xorg; [
+    libXi libXcursor libXdamage libXrandr libXcomposite libXext libXfixes
+    libXrender libX11 libXtst libXScrnSaver
+  ]) ++ [
+    gtk2 atk glib pango gdk_pixbuf cairo freetype fontconfig dbus
+    gnome2.GConf nss nspr alsaLib cups expat stdenv.cc.cc
+  # runtime deps
+  ] ++ [
+    udev libnotify
  ];

  installPhase = ''
    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" rambox
-    patchelf --set-rpath "$out/share/rambox:${stdenv.lib.makeLibraryPath deps}" rambox
+    patchelf --set-rpath "$out/opt/rambox:${stdenv.lib.makeLibraryPath deps}" rambox

-    mkdir -p $out/bin $out/share/rambox
-    cp -r * $out/share/rambox
-    ln -s $out/share/rambox/rambox $out/bin
+    mkdir -p $out/bin $out/opt/rambox
+    cp -r * $out/opt/rambox
+    ln -s $out/opt/rambox/rambox $out/bin

+    # provide desktop item
    mkdir -p $out/share/applications
    ln -s ${desktopItem}/share/applications/* $out/share/applications
  '';

  postFixup = ''
-    paxmark m $out/share/rambox/rambox
+    paxmark m $out/opt/rambox/rambox
  '';

  meta = with stdenv.lib; {
--- a/pkgs/applications/networking/ipfs/default.nix
+++ b/pkgs/applications/networking/ipfs/default.nix
@ -2,15 +2,15 @@

 buildGoPackage rec {
  name = "ipfs-${version}";
-  version = "0.4.8";
-  rev = "8e7484ed794d1aecb3e773e9003ae64c7b78bb87";
+  version = "0.4.6";
+  rev = "ed729423ce548785834cdcaa21aab11ebc3a1b1a";

  goPackagePath = "github.com/ipfs/go-ipfs";

  extraSrcPaths = [
    (fetchgx {
      inherit name src;
-      sha256 = "1h4n74n65z4sw3fqz8nfcrwisbvvwwfq69909w3kgrjsxs7505s5";
+      sha256 = "1wwzbps3ry3vlrr0iqhvxd44x0wi99dcp5hlxvh79dc0g9r7myfk";
    })
  ];

@ -18,7 +18,7 @@ buildGoPackage rec {
    owner = "ipfs";
    repo = "go-ipfs";
    inherit rev;
-    sha256 = "15jcg0wbm7g82fsmhc1vxrsszbxcghls3rsyv35n1hv5k5r5d5nh";
+    sha256 = "1b262k1lhb1g68l8hghly4pdrxx1c6wbv6ij6dg399zdwqzczl13";
  };

  meta = with stdenv.lib; {
--- a/pkgs/applications/networking/irc/weechat/default.nix
+++ b/pkgs/applications/networking/irc/weechat/default.nix
@ -21,12 +21,12 @@ let
 in

 stdenv.mkDerivation rec {
-  version = "1.7";
+  version = "1.7.1";
  name = "weechat-${version}";

  src = fetchurl {
    url = "http://weechat.org/files/src/weechat-${version}.tar.bz2";
-    sha256 = "1l34rgr83nf2h71mwzhv5c0x03msrwv3kzx3cwzczx72xrih12n7";
+    sha256 = "1020m1lsm8lg9n0dlxgp2wbn9b0r11g8r0namnzi2x6gvxn7iyf0";
  };

  outputs = [ "out" "doc" ];
--- a/pkgs/applications/networking/mailreaders/sylpheed/default.nix
+++ b/pkgs/applications/networking/mailreaders/sylpheed/default.nix
@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
    homepage = http://sylpheed.sraoss.jp/en/;
    description = "A lightweight and user-friendly e-mail client";
    maintainers = [ maintainers.eelco ];
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
    license = "GPL";
  };
 }
--- a/pkgs/applications/networking/mailreaders/thunderbird/default.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/default.nix
@ -6,7 +6,7 @@
 , cairo, gstreamer, gst-plugins-base, icu, libpng, jemalloc
 , autoconf213, which, m4
 , writeScript, xidel, common-updater-scripts, coreutils, gnused, gnugrep, curl
-, enableGTK3 ? false, gtk3, wrapGAppsHook
+, enableGTK3 ? false, gtk3, wrapGAppsHook, makeWrapper
 , enableCalendar ? true
 , debugBuild ? false
 , # If you want the resulting program to call itself "Thunderbird" instead
@ -15,9 +15,12 @@
  # Mozilla Foundation, see
  # http://www.mozilla.org/foundation/trademarks/.
  enableOfficialBranding ? false
+, makeDesktopItem
 }:

-stdenv.mkDerivation rec {
+let
+  wrapperTool = if enableGTK3 then wrapGAppsHook else makeWrapper;
+in stdenv.mkDerivation rec {
  name = "thunderbird-${version}";
  version = "52.0.1";

@ -46,8 +49,8 @@ stdenv.mkDerivation rec {
    ]
    ++ lib.optional enableGTK3 gtk3;

-  # from firefox + m4
-  nativeBuildInputs = [ m4 autoconf213 which gnused pkgconfig perl python ] ++ lib.optional enableGTK3 wrapGAppsHook;
+  # from firefox + m4 + wrapperTool
+  nativeBuildInputs = [ m4 autoconf213 which gnused pkgconfig perl python wrapperTool ];

  configureFlags =
    [ # from firefox, but without sound libraries (alsa, libvpx, pulseaudio)
@ -100,13 +103,61 @@ stdenv.mkDerivation rec {
      paxmark m ../objdir/dist/bin/xpcshell
    '';

+  dontWrapGApps = true; # we do it ourselves
  postInstall =
    ''
      # For grsecurity kernels
      paxmark m $out/lib/thunderbird-[0-9]*/thunderbird

-      # Needed to find Mozilla runtime
-      gappsWrapperArgs+=(--argv0 "$out/bin/.thunderbird-wrapped")
+      # TODO: Move to a dev output?
+      rm -rf $out/include $out/lib/thunderbird-devel-* $out/share/idl
+
+      # $binary is a symlink to $target.
+      # We wrap $target by replacing the $binary symlink.
+      local target="$out/lib/thunderbird-${version}/thunderbird"
+      local binary="$out/bin/thunderbird"
+
+      # Wrap correctly, this is needed to
+      # 1) find Mozilla runtime, because argv0 must be the real thing,
+      #    or a symlink thereto. It cannot be the wrapper itself
+      # 2) detect itself as the default mailreader across builds
+      gappsWrapperArgs+=(
+        --argv0 "$target"
+        --set MOZ_APP_LAUNCHER thunderbird
+      )
+      ${
+        # We wrap manually because wrapGAppsHook does not detect the symlink
+        # To mimic wrapGAppsHook, we run it with dontWrapGApps, so
+        # gappsWrapperArgs gets defined correctly
+        lib.optionalString enableGTK3 "wrapGAppsHook"
+      }
+
+      # "$binary" is a symlink, replace it by the wrapper
+      rm "$binary"
+      makeWrapper "$target" "$binary" "''${gappsWrapperArgs[@]}"
+
+      ${ let desktopItem = makeDesktopItem {
+          name = "thunderbird";
+          exec = "thunderbird %U";
+          desktopName = "Thunderbird";
+          icon = "$out/lib/thunderbird-${version}/chrome/icons/default/default256.png";
+          genericName = "Main Reader";
+          categories = "Application;Network";
+          mimeType = stdenv.lib.concatStringsSep ";" [
+            # Email
+            "x-scheme-handler/mailto"
+            "message/rfc822"
+            # Newsgroup
+            "x-scheme-handler/news"
+            "x-scheme-handler/snews"
+            "x-scheme-handler/nntp"
+            # Feed
+            "x-scheme-handler/feed"
+            "application/rss+xml"
+            "application/x-extension-rss"
+          ];
+        }; in desktopItem.buildCommand
+      }
    '';

  postFixup =
--- a/pkgs/applications/office/antiword/default.nix
+++ b/pkgs/applications/office/antiword/default.nix
@ -13,6 +13,7 @@ stdenv.mkDerivation {

  prePatch = ''
    sed -i -e "s|/usr/local/bin|$out/bin|g" -e "s|/usr/share|$out/share|g" Makefile antiword.h
+    substituteInPlace Makefile --replace "gcc" "cc"
  '';

  patches = [ ./10_fix_buffer_overflow_wordole_c.patch ];
@ -25,6 +26,6 @@ stdenv.mkDerivation {
    license = stdenv.lib.licenses.gpl2;

    maintainers = [ stdenv.lib.maintainers.peti ];
-    platforms = stdenv.lib.platforms.linux;
+    platforms = with stdenv.lib.platforms; linux ++ darwin;
  };
 }
--- a/pkgs/applications/office/mytetra/default.nix
+++ b/pkgs/applications/office/mytetra/default.nix
@ -0,0 +1,34 @@
+{ stdenv, fetchurl, qmakeHook, makeQtWrapper, qtsvg }:
+
+let
+  version = "1.42.2";
+in stdenv.mkDerivation rec {
+  name = "mytetra-${version}";
+  src = fetchurl {
+    url = "https://github.com/xintrea/mytetra_dev/archive/v.${version}.tar.gz";
+    sha256 = "1ah44nf4ksxkh01a2zmgvvby4pwczhyq5vcp270rf6visp8v9804";
+  };
+
+  buildInputs = [ qmakeHook makeQtWrapper qtsvg ];
+
+  hardeningDisable = [ "format" ];
+
+  preBuild = ''
+    substituteInPlace mytetra.pro \
+      --replace /usr/local/bin $out/bin \
+      --replace /usr/share $out/share
+
+    substituteInPlace src/views/mainWindow/MainWindow.cpp \
+      --replace ":/resource/pic/logo.svg" "$out/share/icons/hicolor/48x48/apps/mytetra.png"
+  '';
+
+  postInstall = "wrapQtProgram $out/bin/mytetra";
+
+  meta = with stdenv.lib; {
+    description = "Smart manager for information collecting";
+    homepage = http://webhamster.ru/site/page/index/articles/projectcode/138;
+    license = licenses.gpl3;
+    maintainers = [ maintainers.gnidorah ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/science/electronics/fritzing/default.nix
+++ b/pkgs/applications/science/electronics/fritzing/default.nix
@ -1,24 +1,45 @@
-{ stdenv, fetchurl, qtbase, qtsvg, qmakeHook, boost }:
+{ stdenv, fetchpatch, fetchFromGitHub, makeQtWrapper, qmakeHook, pkgconfig
+, qtbase, qtsvg, qtserialport, boost, libgit2
+}:

 stdenv.mkDerivation rec {
-  version = "0.9.0b";
  name = "fritzing-${version}";
+  version = "0.9.3b";

-  src = fetchurl {
-    url = "http://fritzing.org/download/${version}/source-tarball/fritzing-${version}.source.tar_1.bz2";
-    sha256 = "181qnknq1j5x075icpw2qk0sc4wcj9f2hym533vs936is0wxp2gk";
+  src = fetchFromGitHub {
+    owner = "fritzing";
+    repo = "fritzing-app";
+    rev = version;
+    sha256 = "0hpyc550xfhr6gmnc85nq60w00rm0ljm0y744dp0z88ikl04f4s3";
  };

-  unpackPhase = ''
-    tar xjf ${src}
-  '';
+  parts = fetchFromGitHub {
+    owner = "fritzing";
+    repo = "fritzing-parts";
+    rev = version;
+    sha256 = "1d2v8k7p176j0lczx4vx9n9gbg3vw09n2c4b6w0wj5wqmifywhc1";
+  };

-  buildInputs = [ qtbase qtsvg boost qmakeHook ];
+  patches = [(fetchpatch {
+    name = "0001-Squashed-commit-of-the-following.patch";
+    url = "https://aur.archlinux.org/cgit/aur.git/plain/0001-Squashed-commit-of-the-following.patch?h=fritzing";
+    sha256 = "1cv6myidxhy28i8m8v13ghzkvx5978p9dcd8v7885y0l1h3108mf";
+  })];
+
+  buildInputs = [ qtbase qtsvg qtserialport boost libgit2 ];
+
+  nativeBuildInputs = [ qmakeHook makeQtWrapper pkgconfig ];

  qmakeFlags = [ "phoenix.pro" ];

+  enableParallelBuilding = true;
+
  preConfigure = ''
-    cd fritzing-${version}.source
+    ln -s "$parts" parts
+  '';
+
+  postInstall = ''
+    wrapQtProgram $out/bin/Fritzing
  '';

  meta = {
--- a/pkgs/applications/video/dvdauthor/default.nix
+++ b/pkgs/applications/video/dvdauthor/default.nix
@ -22,6 +22,6 @@ stdenv.mkDerivation rec{
    description = "Tools for generating DVD files to be played on standalone DVD players";
    homepage = http://dvdauthor.sourceforge.net/;
    license = licenses.gpl2;
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
  };
 }
--- a/pkgs/applications/video/mpv/default.nix
+++ b/pkgs/applications/video/mpv/default.nix
@ -79,13 +79,13 @@ let
  };
 in stdenv.mkDerivation rec {
  name = "mpv-${version}";
-  version = "0.24.0";
+  version = "0.25.0";

  src = fetchFromGitHub {
    owner = "mpv-player";
    repo  = "mpv";
    rev    = "v${version}";
-    sha256 = "1aq1lvhw4l0i2gc9x6ijaaj2h3894jbcpd4j055n0y9vg9vqm6yy";
+    sha256 = "16r3fyq472hzxnh6g3gm520pmw1ybslaki3pqjm2d9jnd2md1pa5";
  };

  patchPhase = ''
--- a/pkgs/applications/virtualization/OVMF/default.nix
+++ b/pkgs/applications/virtualization/OVMF/default.nix
@ -9,10 +9,11 @@ let
  else
    throw "Unsupported architecture";

+  version = (builtins.parseDrvName edk2.name).version;
 in

 stdenv.mkDerivation (edk2.setup "OvmfPkg/OvmfPkg${targetArch}.dsc" {
-  name = "OVMF-2014-12-10";
+  name = "OVMF-${version}";

  # TODO: properly include openssl for secureBoot
  buildInputs = [nasm iasl] ++ stdenv.lib.optionals (secureBoot == true) [ openssl ];
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@ -18,7 +18,7 @@

 with stdenv.lib;
 let
-  version = "2.8.0";
+  version = "2.9.0";
  audio = optionalString (hasSuffix "linux" stdenv.system) "alsa,"
    + optionalString pulseSupport "pa,"
    + optionalString sdlSupport "sdl,";
@ -33,7 +33,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "http://wiki.qemu.org/download/qemu-${version}.tar.bz2";
-    sha256 = "0qjy3rcrn89n42y5iz60kgr0rrl29hpnj8mq2yvbc1wrcizmvzfs";
+    sha256 = "053c7ivp3li7cdagzkp2wdc5myybzjf826r6qfkcf0xvn4bv5gq0";
  };

  buildInputs =
@ -54,94 +54,8 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

-  patches = let
-    upstreamPatch = name: commit: sha256: fetchurl {
-      name = "${name}.patch";
-      url = "http://git.qemu-project.org/?p=qemu.git;a=patch;h=${commit}";
-      inherit sha256;
-    };
-  in [
-    ./no-etc-install.patch
-
-    # bugfixes
-    (fetchurl {
-      name = "qemu-vnc-do-not-disconnect-on-EAGAIN.patch";
-      url = "https://anonscm.debian.org/cgit/pkg-qemu/qemu.git/plain/debian/patches/vnc-do-not-disconnect-on-EAGAIN.patch?h=debian/qemu_2.8%2bdfsg-3";
-      sha256 = "1nqhfgfw1pzhid094pk204qy36r6n7w1yilsiwabgcsyxs5bymnh";
-    })
-
-    (upstreamPatch "qemu-fix-win7-xhci" "7da76e12cc5cc902dda4c168d8d608fd4e61cbc5"
-      "0m1ggbxziy7vqz9007ypzg23cni8cc4db36wlnhxz0kdpq70c6x0")
-
-    (upstreamPatch "qemu-xhci-free-completed-transfers" "f94d18d6c6df388fde196d3ab252f57e33843a8b"
-      "0lk19qss6ky7cqnvis54742cr2z0vl8c64chhch0kp6n83hray9x")
-
-    # security fixes from debian
-    (fetchurl {
-      name = "CVE-2016-9602.patch";
-      url = "https://anonscm.debian.org/cgit/pkg-qemu/qemu.git/plain/debian/patches/9pfs-symlink-attack-fixes-CVE-2016-9602.patch?h=debian/qemu_2.8%2bdfsg-3";
-      sha256 = "0f7m1k3hbw9v0dwqn53ds36s7s334vlidvbn0682s9r2sq0sjlkv";
-    })
-
-    (fetchurl {
-      name = "CVE-2017-2630.patch";
-      url = "https://anonscm.debian.org/cgit/pkg-qemu/qemu.git/plain/debian/patches/nbd_client-fix-drop_sync-CVE-2017-2630.patch?h=debian/qemu_2.8%2bdfsg-3";
-      sha256 = "1gdxaari53iwgj3gyczz30rhg8lj6xqycxym4snw9z5vmkyj1bbq";
-    })
-
-    (fetchurl {
-      name = "CVE-2017-6058.patch";
-      url = "https://anonscm.debian.org/cgit/pkg-qemu/qemu.git/plain/debian/patches/vmxnet3-fix-memory-corruption-on-vlan-header-stripping-CVE-2017-6058.patch?h=debian/qemu_2.8%2bdfsg-3";
-      sha256 = "0w8az2cr116mnijxjd4aprl8dvfdj76gm7ddajmngdslxiax601f";
-    })
-
-    # security fixes from upstream
-    (upstreamPatch "CVE-2016-7907" "81f17e0d435c3db3a3e67e0d32ebf9c98973211f"
-      "0dzghbm3jmnyw34kd40a6akrr1cpizd9hdzqmhlc2ljab7pr1rcb")
-
-    (upstreamPatch "CVE-2016-10155" "eb7a20a3616085d46aa6b4b4224e15587ec67e6e"
-      "1xk00fyls0hdza11dyfrnzcn6gibmmcrwy7sxgp6iizp6wgzi3vw")
-
-    (upstreamPatch "CVE-2017-2615" "62d4c6bd5263bb8413a06c80144fc678df6dfb64"
-      "0miph2x4d474issa44hmc542zxmkc7lsr4ncb7pwarq6j7v52l8h")
-
-    (upstreamPatch "CVE-2017-2620" "92f2b88cea48c6aeba8de568a45f2ed958f3c298"
-      "1kz12qmvfccy7xilsrxahbs67jycv4zjfbijxivadvx9klxs1n58")
-
-    (upstreamPatch "CVE-2017-5525" "12351a91da97b414eec8cdb09f1d9f41e535a401"
-      "190b4aqr35p4lb3rjarknfi1ip1c9zizliqp1dd6frx4364y5yp2")
-
-    (upstreamPatch "CVE-2017-5526" "069eb7b2b8fc47c7cb52e5a4af23ea98d939e3da"
-      "05xgzd3zldk3x2vqpjag9z5ilhdkpkyh633fb5kvnz8scns6v86f")
-
-    (upstreamPatch "CVE-2017-5579" "8409dc884a201bf74b30a9d232b6bbdd00cb7e2b"
-      "0lbcyhif1kdcy8my0bv8aqr2f421kmljcch3plrjzj9pgcm4sv83")
-
-    (upstreamPatch "CVE-2017-5667" "42922105beb14c2fc58185ea022b9f72fb5465e9"
-      "049vq70is3fj9bf4ysfj3s44iz93qhyqn6xijck32w1x6yyzqyx4")
-
-    (upstreamPatch "CVE-2017-5667-fix" "913a87885f589d263e682c2eb6637c6e14538061"
-      "0nm1k2r9n6r86dvjr16hxak2vcsinj7ijlqw5i6f4y5h2sh37wr5")
-
-    (upstreamPatch "CVE-2017-5856" "765a707000e838c30b18d712fe6cb3dd8e0435f3"
-      "03pjkn8l8rp9ip5h5rm1dp0nrwd43nmgpwamz4z1vy3rli1z3yjw")
-
-    (upstreamPatch "CVE-2017-5857" "5e8e3c4c75c199aa1017db816fca02be2a9f8798"
-      "1kz14rmxf049zl5m27apzpbvy8dk0g47n9gnwy0nm70g65rl1dh8")
-
-    (upstreamPatch "CVE-2017-5898" "c7dfbf322595ded4e70b626bf83158a9f3807c6a"
-      "1y2j0qw04s8fl0cs8i619y08kj75lxn3c0y19g710fzpk3rq8dvn")
-
-    (upstreamPatch "CVE-2017-5931" "a08aaff811fb194950f79711d2afe5a892ae03a4"
-      "0hlih9jhbb1mb174hvxs7pf7lgcs7s9g705ri9rliw7wrhqdpja5")
-
-    (upstreamPatch "CVE-2017-5973" "f89b60f6e5fee3923bedf80e82b4e5efc1bb156b"
-      "06niyighjxb4p5z2as3mqfmrwrzn4sq47j7raipbq9gnda7x9sw6")
-
-    (upstreamPatch "CVE-2017-5987" "6e86d90352adf6cb08295255220295cf23c4286e"
-      "09yfxf93cisx8rhm0h48ib1ibwfs420k5pqpz8dnz33nci9567jm")
-
-  ] ++ optional nixosTestRunner ./force-uid0-on-9p.patch;
+  patches = [ ./no-etc-install.patch ]
+    ++ optional nixosTestRunner ./force-uid0-on-9p.patch;

  hardeningDisable = [ "stackprotector" ];

--- a/pkgs/applications/virtualization/qemu/no-etc-install.patch
+++ b/pkgs/applications/virtualization/qemu/no-etc-install.patch
@ -1,11 +1,10 @@
 --- a/Makefile
 +++ b/Makefile
-@@ -418,7 +418,7 @@
+@@ -597,7 +597,7 @@
 
 
- install: all $(if $(BUILD_DOCS),install-doc) \
-install-datadir install-localstatedir
-+install-datadir
+-install: all $(if $(BUILD_DOCS),install-doc) install-datadir install-localstatedir
+install: all $(if $(BUILD_DOCS),install-doc) install-datadir
 ifneq ($(TOOLS),)
- 	$(call install-prog,$(TOOLS),$(DESTDIR)$(bindir))
+	$(call install-prog,$(subst qemu-ga,qemu-ga$(EXESUF),$(TOOLS)),$(DESTDIR)$(bindir))
 endif
--- a/pkgs/data/fonts/emacs-all-the-icons-fonts/default.nix
+++ b/pkgs/data/fonts/emacs-all-the-icons-fonts/default.nix
@ -0,0 +1,37 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  name = "emacs-all-the-icons-fonts-${version}";
+  version = "2.50";
+
+  src = fetchFromGitHub {
+    owner = "domtronn";
+    repo = "all-the-icons.el";
+    rev = "2.5.0";
+    sha256 = "125qw96rzbkv39skxk5511jrcx9hxm0fqcmny6213wzswgdn37z3";
+  };
+
+  installPhase = ''
+    mkdir -p $out/share/fonts/all-the-icons
+    for font in $src/fonts/*.ttf; do cp $font $out/share/fonts/all-the-icons; done
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Icon fonts for emacs all-the-icons";
+    longDescription = ''
+      The emacs package all-the-icons provides icons to improve
+      presentation of information in emacs. This package provides
+      the fonts needed to make the package work properly.
+    '';
+    homepage = https://github.com/domtronn/all-the-icons.el;
+
+    /*
+    The fonts come under a mixture of licenses - the MIT license,
+    SIL OFL license, and Apache license v2.0. See the GitHub page
+    for further information.
+    */
+    license = licenses.free;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ rlupton20 ];
+  };
+}
--- a/pkgs/desktops/gnome-3/3.22/core/dconf/default.nix
+++ b/pkgs/desktops/gnome-3/3.22/core/dconf/default.nix
@ -18,8 +18,13 @@ stdenv.mkDerivation rec {
  buildInputs = [ vala_0_32 libxslt pkgconfig glib dbus_glib gnome3.gtk libxml2
                  intltool docbook_xsl docbook_xsl_ns makeWrapper ];

+  postConfigure = stdenv.lib.optionalString stdenv.isDarwin ''
+    substituteInPlace client/Makefile \
+      --replace "-soname=libdconf.so.1" "-install_name,libdconf.so.1"
+  '';
+
  meta = with stdenv.lib; {
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
    maintainers = gnome3.maintainers;
  };
 }
--- a/pkgs/desktops/gnome-3/3.22/core/vte/default.nix
+++ b/pkgs/desktops/gnome-3/3.22/core/vte/default.nix
@ -13,7 +13,7 @@ stdenv.mkDerivation rec {

  preConfigure = "patchShebangs .";

-  configureFlags = [ "--enable-introspection" ];
+  configureFlags = [ "--enable-introspection" "--disable-Bsymbolic" ];

  enableParallelBuilding = true;

@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
    '';
    license = licenses.lgpl2;
    maintainers = with maintainers; [ astsmtl antono lethalman ];
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
  };
 }

--- a/pkgs/development/compilers/colm/default.nix
+++ b/pkgs/development/compilers/colm/default.nix
@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
    description = "A programming language for the analysis and transformation of computer languages";
    homepage = http://www.colm.net/open-source/colm;
    license = licenses.gpl2;
-    platforms = [ "x86_64-linux" ];
+    platforms = [ "x86_64-linux" "x86_64-darwin" ];
    maintainers = with maintainers; [ pSub ];
  };
 }
--- a/pkgs/development/compilers/halvm/2.4.0.nix
+++ b/pkgs/development/compilers/halvm/2.4.0.nix
@ -32,7 +32,10 @@ stdenv.mkDerivation rec {
    patchShebangs .
  '';
  hardeningDisable = ["all"];
-  postInstall = "$out/bin/halvm-ghc-pkg recache";
+  postInstall = ''
+    patchShebangs $out/bin
+    $out/bin/halvm-ghc-pkg recache
+  '';
  passthru = {
    inherit bootPkgs;
    cross.config = "halvm";
@ -45,6 +48,5 @@ stdenv.mkDerivation rec {
    description = "The Haskell Lightweight Virtual Machine (HaLVM): GHC running on Xen";
    maintainers = with stdenv.lib.maintainers; [ dmjio ];
    inherit (bootPkgs.ghc.meta) license platforms;
-    broken = true;  # http://hydra.nixos.org/build/51814615
  };
 }
--- a/pkgs/development/compilers/ponyc/default.nix
+++ b/pkgs/development/compilers/ponyc/default.nix
@ -3,13 +3,13 @@

 stdenv.mkDerivation ( rec {
  name = "ponyc-${version}";
-  version = "0.13.0";
+  version = "0.13.1";

  src = fetchFromGitHub {
    owner = "ponylang";
    repo = "ponyc";
    rev = version;
-    sha256 = "1agb7aiii7pl8zsh3h0lfzghmm1ajj15gx1j48xjyvplxixdgn9j";
+    sha256 = "1x3w7mxpwgf2bn2c1qqxbj4w5gp775l7r42lj9jvspayb6a6w28s";
  };

  buildInputs = [ llvm makeWrapper which ];
--- a/pkgs/development/coq-modules/QuickChick/default.nix
+++ b/pkgs/development/coq-modules/QuickChick/default.nix
@ -1,16 +1,16 @@
 {stdenv, fetchgit, coq, coqPackages}:

-let revision = "b73a594af5460567dc233b2f2e7b0f781ae0490d"; in
+let revision = "04785ee692036e7ba9f4c4e380b1995128a97bf8"; in

 stdenv.mkDerivation rec {

  name = "coq-QuickChick-${coq.coq-version}-${version}";
-  version = "20150605-${builtins.substring 0 7 revision}";
+  version = "20170422-${builtins.substring 0 7 revision}";

  src = fetchgit {
    url = git://github.com/QuickChick/QuickChick.git;
    rev = revision;
-    sha256 = "1prlihkgi2yvgzd62x80fsnxp5w1n0wyk7zrd6zwa8dbqx9pbr09";
+    sha256 = "1x5idk9d9r5mj1w54676a5j92wr1id7c9dmknkpmnh78rgrqzy5j";
  };

  buildInputs = [ coq.ocaml coq.camlp5 ];
--- a/pkgs/development/libraries/curlcpp/default.nix
+++ b/pkgs/development/libraries/curlcpp/default.nix
@ -1,13 +1,14 @@
 { stdenv, fetchFromGitHub, cmake, curl }: 

-stdenv.mkDerivation {
-  name = "curlcpp-20160901";
+stdenv.mkDerivation rec {
+  name = "curlcpp-${version}";
+  version = "1.0";

  src = fetchFromGitHub {
    owner = "JosephP91";
    repo = "curlcpp";
-    rev = "98286da1d6c9f6158344a8e272eae5030cbf6c0e";
-    sha256 = "00nm2b8ik1yvaz5dp1b61jid841jv6zf8k5ma2nxbf1di1apqh0d";
+    rev = "${version}";
+    sha256 = "1akibhrmqsy0dlz9lq93508bhkh7r1l0aycbzy2x45a9gqxfdi4q";
  };

  buildInputs = [ cmake curl ];
@ -15,9 +16,9 @@ stdenv.mkDerivation {
  meta = with stdenv.lib; {
    homepage = "http://josephp91.github.io/curlcpp/";
    description = "Object oriented C++ wrapper for CURL";
-    platforms = platforms.unix ;
+    platforms = platforms.unix;
    license = licenses.mit;
-    maintainers = [ maintainers.juliendehos ];
+    maintainers = with maintainers; [ juliendehos rszibele ];
  };
 }

--- a/pkgs/development/libraries/exempi/default.nix
+++ b/pkgs/development/libraries/exempi/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, expat, zlib, boost }:
+{ stdenv, fetchurl, expat, zlib, boost, libiconv, darwin }:

 stdenv.mkDerivation rec {
  name = "exempi-2.4.2";
@ -12,11 +12,12 @@ stdenv.mkDerivation rec {
    "--with-boost=${boost.dev}"
  ];

-  buildInputs = [ expat zlib boost ];
+  buildInputs = [ expat zlib boost ]
+    ++ stdenv.lib.optionals stdenv.isDarwin [ libiconv darwin.apple_sdk.frameworks.CoreServices ];

  meta = with stdenv.lib; {
    homepage = http://libopenraw.freedesktop.org/wiki/Exempi/;
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
    license = licenses.bsd3;
  };
 }
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
      code, LGPL or LGPL-compatible for the supporting library).
    '';
    license     = licenses.lgpl2Plus;
-    platforms   = platforms.linux;
+    platforms   = platforms.linux ++ platforms.darwin;
  };

  src = fetchurl {
--- a/pkgs/development/libraries/hunspell/default.nix
+++ b/pkgs/development/libraries/hunspell/default.nix
@ -1,16 +1,21 @@
-{ stdenv, fetchurl, ncurses, readline }:
+{ stdenv, fetchurl, ncurses, readline, autoreconfHook }:

 stdenv.mkDerivation rec {
-  name = "hunspell-1.3.3";
+  version = "1.6.1";
+  name = "hunspell-${version}";

  src = fetchurl {
-    url = "mirror://sourceforge/hunspell/${name}.tar.gz";
-    sha256 = "0v14ff9s37vkh45diaddndcrj0hmn67arh8xh8k79q9c1vgc1cm7";
+    url = "https://github.com/hunspell/hunspell/archive/v${version}.tar.gz";
+    sha256 = "0j9c20sj7bgd6f77193g1ihy8w905byk2gdhdc0r9dsh7irr7x9h";
  };

  outputs = [ "bin" "dev" "out" "man" ];

  buildInputs = [ ncurses readline ];
+  nativeBuildInputs = [ autoreconfHook ];
+
+  autoreconfFlags = "-vfi";
+
  configureFlags = [ "--with-ui" "--with-readline" ];

  hardeningDisable = [ "format" ];
--- a/pkgs/development/libraries/kde-frameworks/extra-cmake-modules/default.nix
+++ b/pkgs/development/libraries/kde-frameworks/extra-cmake-modules/default.nix
@ -12,7 +12,7 @@ kdeFramework {
  setupHook = ./setup-hook.sh;

  meta = with lib; {
-    platforms = lib.platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
    homepage = "http://www.kde.org";
    license = licenses.bsd2;
    maintainers = [ maintainers.ttuegel ];
--- a/pkgs/development/libraries/libconfig/default.nix
+++ b/pkgs/development/libraries/libconfig/default.nix
@ -14,6 +14,6 @@ stdenv.mkDerivation rec {
    description = "A simple library for processing structured configuration files";
    license = licenses.lgpl3;
    maintainers = [ maintainers.goibhniu ];
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
  };
 }
--- a/pkgs/development/libraries/libconfuse/default.nix
+++ b/pkgs/development/libraries/libconfuse/default.nix
@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
      quick to integrate with your code.
    '';
    license = licenses.isc;
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
    maintainers = with maintainers; [ nckx ];
  };
 }
--- a/pkgs/development/libraries/libdiscid/default.nix
+++ b/pkgs/development/libraries/libdiscid/default.nix
@ -1,21 +1,25 @@
-{ stdenv, fetchurl, cmake, pkgconfig }:
+{ stdenv, fetchurl, cmake, pkgconfig, darwin }:

 stdenv.mkDerivation rec {
  name = "libdiscid-${version}";
  version = "0.6.2";

  nativeBuildInputs = [ cmake pkgconfig ];
+
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.IOKit ];
  
  src = fetchurl {
    url = "http://ftp.musicbrainz.org/pub/musicbrainz/libdiscid/${name}.tar.gz";
    sha256 = "1f9irlj3dpb5gyfdnb1m4skbjvx4d4hwiz2152f83m0d9jn47r7r";
  };

+  NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isDarwin "-framework CoreFoundation -framework IOKit";
+
  meta = with stdenv.lib; {
    description = "A C library for creating MusicBrainz DiscIDs from audio CDs";
    homepage = http://musicbrainz.org/doc/libdiscid;
    maintainers = with maintainers; [ ehmry ];
    license = licenses.lgpl21;
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
  };
 }
--- a/pkgs/development/libraries/libdvdread/default.nix
+++ b/pkgs/development/libraries/libdvdread/default.nix
@ -22,6 +22,6 @@ stdenv.mkDerivation rec {
    description = "A library for reading DVDs";
    license = stdenv.lib.licenses.gpl2;
    maintainers = [ stdenv.lib.maintainers.wmertens ];
-    platforms = stdenv.lib.platforms.linux;
+    platforms = with stdenv.lib.platforms; linux ++ darwin;
  };
 }
--- a/pkgs/development/libraries/libfm/default.nix
+++ b/pkgs/development/libraries/libfm/default.nix
@ -24,6 +24,6 @@ stdenv.mkDerivation rec {
    license = licenses.lgpl21Plus;
    description = "A glib-based library for file management";
    maintainers = [ maintainers.ttuegel ];
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
  };
 }
--- a/pkgs/development/libraries/libgtop/default.nix
+++ b/pkgs/development/libraries/libgtop/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, glib, pkgconfig, perl, intltool, gobjectIntrospection }:
+{ stdenv, fetchurl, glib, pkgconfig, perl, intltool, gobjectIntrospection, libintlOrEmpty }:
 stdenv.mkDerivation rec {
  name = "libgtop-${version}";
  major = "2.34";
@ -10,9 +10,12 @@ stdenv.mkDerivation rec {
  };

  propagatedBuildInputs = [ glib ];
+  buildInputs = libintlOrEmpty;
  nativeBuildInputs = [ pkgconfig perl intltool gobjectIntrospection ];

+  NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isDarwin "-lintl";
+
  meta = {
-    platforms = stdenv.lib.platforms.linux;
+    platforms = with stdenv.lib.platforms; linux ++ darwin;
  };
 }
--- a/pkgs/development/libraries/libinfinity/default.nix
+++ b/pkgs/development/libraries/libinfinity/default.nix
@ -3,7 +3,8 @@
 , documentation ? false # build documentation
 , avahiSupport ? false # build support for Avahi in libinfinity
 , stdenv, fetchurl, pkgconfig, glib, libxml2, gnutls, gsasl
-, gtk2 ? null, gtkdoc ? null, avahi ? null, libdaemon ? null, libidn, gss }:
+, gtk2 ? null, gtkdoc ? null, avahi ? null, libdaemon ? null, libidn, gss
+, libintlOrEmpty }:

 let
  edf = flag: feature: (if flag then "--with-" else "--without-") + feature;
@ -17,7 +18,7 @@ in stdenv.mkDerivation rec {
    sha256 = "1idsxb6rz4i55g3vi2sv7hmm57psbccpb57yc4jgphaq6ydgqsr6";
  };

-  buildInputs = [ pkgconfig glib libxml2 gsasl libidn gss ]
+  buildInputs = [ pkgconfig glib libxml2 gsasl libidn gss libintlOrEmpty ]
    ++ optional gtkWidgets gtk2
    ++ optional documentation gtkdoc
    ++ optional avahiSupport avahi
@ -34,12 +35,14 @@ in stdenv.mkDerivation rec {
    ${edf avahiSupport "avahi"}
  '';

+  NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isDarwin "-lintl";
+
  meta = {
    homepage = http://gobby.0x539.de/;
    description = "An implementation of the Infinote protocol written in GObject-based C";
    license = stdenv.lib.licenses.lgpl2Plus;
    maintainers = [ stdenv.lib.maintainers.phreedom ];
-    platforms = stdenv.lib.platforms.linux;
+    platforms = with stdenv.lib.platforms; linux ++ darwin;
  };

 }
--- a/pkgs/development/libraries/liblo/default.nix
+++ b/pkgs/development/libraries/liblo/default.nix
@ -13,6 +13,6 @@ stdenv.mkDerivation rec {
    homepage = http://sourceforge.net/projects/liblo;
    license = stdenv.lib.licenses.gpl2;
    maintainers = [stdenv.lib.maintainers.marcweber];
-    platforms = stdenv.lib.platforms.linux;
+    platforms = with stdenv.lib.platforms; linux ++ darwin;
  };
 }
--- a/pkgs/development/libraries/menu-cache/default.nix
+++ b/pkgs/development/libraries/menu-cache/default.nix
@ -18,6 +18,6 @@ stdenv.mkDerivation {
    license = licenses.gpl2Plus;
    description = "Library to read freedesktop.org menu files";
    maintainers = [ maintainers.ttuegel ];
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
  };
 }
--- a/pkgs/development/libraries/opencv/default.nix
+++ b/pkgs/development/libraries/opencv/default.nix
@ -5,11 +5,12 @@
 , enableJPEG ? true, libjpeg
 , enablePNG ? true, libpng
 , enableTIFF ? true, libtiff
-, enableEXR ? true, openexr, ilmbase
+, enableEXR ? (!stdenv.isDarwin), openexr, ilmbase
 , enableJPEG2K ? true, jasper
 , enableFfmpeg ? false, ffmpeg
 , enableGStreamer ? false, gst_all
 , enableEigen ? false, eigen
+, darwin
 }:

 let
@ -48,6 +49,7 @@ stdenv.mkDerivation rec {
    ++ lib.optional enableFfmpeg ffmpeg
    ++ lib.optionals enableGStreamer (with gst_all; [ gstreamer gst-plugins-base ])
    ++ lib.optional enableEigen eigen
+    ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ Cocoa QTKit ])
    ;

  propagatedBuildInputs = lib.optional enablePython pythonPackages.numpy;
@ -76,11 +78,11 @@ stdenv.mkDerivation rec {

  passthru = lib.optionalAttrs enablePython { pythonPath = []; };

-  meta = {
+  meta = with stdenv.lib; {
    description = "Open Computer Vision Library with more than 500 algorithms";
    homepage = http://opencv.org/;
-    license = stdenv.lib.licenses.bsd3;
-    maintainers = with stdenv.lib.maintainers; [viric flosse];
-    platforms = with stdenv.lib.platforms; linux;
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ viric flosse ];
+    platforms = platforms.linux ++ platforms.darwin;
  };
 }
--- a/pkgs/development/libraries/qtstyleplugins/default.nix
+++ b/pkgs/development/libraries/qtstyleplugins/default.nix
@ -1,13 +1,13 @@
 { stdenv, fetchFromGitHub, qmakeHook, qtbase, pkgconfig, gtk2 }:

 stdenv.mkDerivation rec {
-  name = "qtstyleplugins-2016-12-01";
+  name = "qtstyleplugins-2017-03-11";

  src = fetchFromGitHub {
    owner = "qt";
    repo = "qtstyleplugins";
-    rev = "7aa47640c202cc4a9c16aa7df98191236743c8ba";
-    sha256 = "0pysgn5yhbh85rv7syvf2w9g1gj1z1nwspjri39dc95vj108lin5";
+    rev = "335dbece103e2cbf6c7cf819ab6672c2956b17b3";
+    sha256 = "085wyn85nrmzr8nv5zv7fi2kqf8rp1gnd30h72s30j55xvhmxvmy";
  };

  buildInputs = [ qmakeHook pkgconfig gtk2 ];
@ -23,6 +23,5 @@ stdenv.mkDerivation rec {
    license = licenses.lgpl21;
    maintainers = [ maintainers.gnidorah ];
    platforms = platforms.linux;
-    broken = builtins.compareVersions qtbase.version "5.7.0" > 0;
  };
 }
--- a/pkgs/development/libraries/qtwebkit-plugins/default.nix
+++ b/pkgs/development/libraries/qtwebkit-plugins/default.nix
@ -15,7 +15,7 @@ stdenv.mkDerivation {
  buildInputs = [ qtwebkit hunspell ];

  postPatch = ''
-    sed -i "s,-lhunspell,-lhunspell-1.3," src/spellcheck/spellcheck.pri
+    sed -i "s,-lhunspell,-lhunspell-1.6," src/spellcheck/spellcheck.pri
    sed -i "s,\$\$\[QT_INSTALL_PLUGINS\],$out/lib/qt5/plugins," src/src.pro
  '';

--- a/pkgs/development/libraries/qwt/6_qt4.nix
+++ b/pkgs/development/libraries/qwt/6_qt4.nix
@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
    homepage = http://qwt.sourceforge.net/;
    # LGPL 2.1 plus a few exceptions (more liberal)
    license = stdenv.lib.licenses.qwt;
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
    maintainers = [ maintainers.bjornfor ];
    branch = "6";
  };
--- a/pkgs/development/libraries/zimg/default.nix
+++ b/pkgs/development/libraries/zimg/default.nix
@ -17,7 +17,7 @@ stdenv.mkDerivation rec{
    description = "Scaling, colorspace conversion and dithering library";
    homepage    = https://github.com/sekrit-twc/zimg;
    license     = licenses.wtfpl;
-    platforms   = platforms.linux; # check upstream issue #52
+    platforms   = platforms.linux ++ platforms.darwin;
    maintainers = with maintainers; [ rnhmjoj ];
  };
 }
--- a/pkgs/development/node-packages/README.md
+++ b/pkgs/development/node-packages/README.md
@ -2,7 +2,7 @@ Node.js packages
 ===============
 To add a package from [NPM](https://www.npmjs.com/) to nixpkgs:

- 1. Install node2nix: `nix-env -f '<nixpkgs>' -iA node2nix`.
+ 1. Install node2nix: `nix-env -f '<nixpkgs>' -iA nodePackages.node2nix`.
 2. Modify `pkgs/development/node-packages/node-packages.json`, to add, update,
    or remove package entries.
 3. Run the script: `cd pkgs/development/node-packages && sh generate.sh`.
--- a/pkgs/development/python-modules/pyspread/default.nix
+++ b/pkgs/development/python-modules/pyspread/default.nix
@ -0,0 +1,57 @@
+{ buildPythonPackage
+, fetchPypi
+, isPy3k
+, stdenv
+, numpy
+, wxPython
+, matplotlib
+, pycairo
+, python-gnupg
+, xlrd
+, xlwt
+, jedi
+, pyenchant
+, basemap
+, pygtk
+, makeDesktopItem
+}:
+
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "pyspread";
+  version = "1.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0m1a4zvzrfrnc42j8mrbm7747w03nzyl9z02wjagccmlhi6nd9hx";
+  };
+
+  propagatedBuildInputs = [ numpy wxPython matplotlib pycairo python-gnupg xlrd xlwt jedi pyenchant basemap pygtk ];
+  # Could also (optionally) add pyrsvg and python bindings for libvlc
+
+  # Tests try to access X Display
+  doCheck = false;
+
+  disabled = isPy3k;
+
+  desktopItem = makeDesktopItem rec {
+    name = pname;
+    exec = name;
+    icon = name;
+    desktopName = "Pyspread";
+    genericName = "Spreadsheet";
+    comment = meta.description;
+    categories = "Development;Spreadsheet;";
+  };
+
+  postInstall = ''
+    mkdir -p $out/share/applications
+    cp $desktopItem/share/applications/* $out/share/applications
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Pyspread is a non-traditional spreadsheet application that is based on and written in the programming language Python";
+    homepage = https://manns.github.io/pyspread/;
+    license = licenses.gpl3;
+  };
+}
--- a/pkgs/development/python-modules/wxPython/3.0.nix
+++ b/pkgs/development/python-modules/wxPython/3.0.nix
@ -12,6 +12,8 @@
 , isPy3k
 , isPyPy
 , python
+, cairo
+, pango
 }:

 assert wxGTK.unicode;
@ -43,6 +45,15 @@ buildPythonPackage rec {
    # this check is supposed to only return false on older systems running non-framework python
    substituteInPlace src/osx_cocoa/_core_wrap.cpp \
      --replace "return wxPyTestDisplayAvailable();" "return true;"
+  '' + lib.optionalString (!stdenv.isDarwin) ''
+    substituteInPlace wx/lib/wxcairo.py \
+      --replace 'cairoLib = None' 'cairoLib = ctypes.CDLL("${cairo}/lib/libcairo.so")'
+    substituteInPlace wx/lib/wxcairo.py \
+      --replace '_dlls = dict()' '_dlls = {k: ctypes.CDLL(v) for k, v in [
+        ("gdk",        "${wxGTK.gtk}/lib/libgtk-x11-2.0.so"),
+        ("pangocairo", "${pango.out}/lib/libpangocairo-1.0.so"),
+        ("appsvc",     None)
+      ]}'
  '';

  NIX_LDFLAGS = lib.optionalString (!stdenv.isDarwin) "-lX11 -lgdk-x11-2.0";
--- a/pkgs/development/ruby-modules/bundix/default.nix
+++ b/pkgs/development/ruby-modules/bundix/default.nix
@ -5,9 +5,9 @@ buildRubyGem rec {

  name = "${gemName}-${version}";
  gemName = "bundix";
-  version = "2.0.8";
+  version = "2.1.0";

-  sha256 = "0ikpf2g01izadjpdnc4k2rb9v4g11f1jk2y5alxc7n7rxjkwdc66";
+  sha256 = "5a073c59dfc7e2367c47e6513fc8914d27e11c08f82bc1103c4793dfb2837bef";

  buildInputs = [bundler];

--- a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
@ -1,16 +1,16 @@
 { lib, buildGoPackage, fetchFromGitLab, fetchurl, go-bindata }:

 let
-  version = "9.0.0";
+  version = "9.1.0";
  # Gitlab runner embeds some docker images these are prebuilt for arm and x86_64
  docker_x86_64 = fetchurl {
    url = "https://gitlab-ci-multi-runner-downloads.s3.amazonaws.com/v${version}/docker/prebuilt-x86_64.tar.xz";
-    sha256 = "1f170akb7j7imgr18m32fy6v3rk98inrjl5a4xymfpivwwqyv9p8";
+    sha256 = "1mdcw755fygnf30v0gr13mx20zjqmxg5w2kj3k2jgcsh3gyrvymr";
  };

  docker_arm = fetchurl {
    url = "https://gitlab-ci-multi-runner-downloads.s3.amazonaws.com/v${version}/docker/prebuilt-arm.tar.xz";
-    sha256 = "15mlix8j7bqjg5y07c439d7s197c16zxffknx42z1i3qxcz2mpa4";
+    sha256 = "1m5p6mlhy3xf0chrjlfpdyp24pv32b61s8iryh6a617i91vpzjg6";
  };
 in
 buildGoPackage rec {
@ -29,7 +29,7 @@ buildGoPackage rec {
    owner = "gitlab-org";
    repo = "gitlab-ci-multi-runner";
    rev = "v${version}";
-    sha256 = "1csha30lcwm1mk6hqbh0j8bb25apyni23szw79l8xjhmiw2ch619";
+    sha256 = "0n8hcj2b1pb95x4bd7fb9ri43vgc4h2dj2v3iiziw2imqjyphfx4";
  };

  buildInputs = [ go-bindata ];
--- a/pkgs/development/tools/continuous-integration/gitlab-runner/v1.nix
+++ b/pkgs/development/tools/continuous-integration/gitlab-runner/v1.nix
@ -1,16 +1,16 @@
 { lib, buildGoPackage, fetchFromGitLab, fetchurl, go-bindata }:

 let
-  version = "1.11.1";
+  version = "1.11.2";
  # Gitlab runner embeds some docker images these are prebuilt for arm and x86_64
  docker_x86_64 = fetchurl {
    url = "https://gitlab-ci-multi-runner-downloads.s3.amazonaws.com/v${version}/docker/prebuilt-x86_64.tar.xz";
-    sha256 = "1fahwvwdli6glxsljrd030x15y18jwk72lg1xmrgms409r9y308m";
+    sha256 = "08lacd2p7915y7yjnwkj2k0b0x4qj9kc53p7qgvmq8kdi31xnh4z";
  };

  docker_arm = fetchurl {
    url = "https://gitlab-ci-multi-runner-downloads.s3.amazonaws.com/v${version}/docker/prebuilt-arm.tar.xz";
-    sha256 = "0nqda27qcb6r1p2xc2973g08fwb8cnmyc9rswy6776r8ypagn2zw";
+    sha256 = "0lzvx3jfy8493q8zkbs7kgm5a3jgsi3f2x25jwg4lx7agcwwsygw";
  };
 in
 buildGoPackage rec {
@ -29,7 +29,7 @@ buildGoPackage rec {
    owner = "gitlab-org";
    repo = "gitlab-ci-multi-runner";
    rev = "v${version}";
-    sha256 = "0ix00p9f01fg8m6p3b1c20hqrcv7pivh6hq92pb9qyiyzmcfap47";
+    sha256 = "1sjvlb5981ykc8hr4kp1ibh9jw2wdjjp9zs2nqs9lpsav4nda5fr";
  };

  buildInputs = [ go-bindata ];
--- a/pkgs/development/tools/parsing/antlr/3.4.nix
+++ b/pkgs/development/tools/parsing/antlr/3.4.nix
@ -33,6 +33,6 @@ stdenv.mkDerivation rec {
      walk parse trees.
    '';
    homepage = http://www.antlr.org/;
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
  };
 }
--- a/pkgs/games/mudlet/libs.patch
+++ b/pkgs/games/mudlet/libs.patch
@ -7,7 +7,7 @@
 -        -llua5.1 \
 -        -lhunspell \
 +        -llua \
-+        -lhunspell-1.3 \
+        -lhunspell-1.6 \
         -L/usr/local/lib/ \
         -lyajl \
         -lGLU \
--- a/pkgs/misc/emulators/wine/sources.nix
+++ b/pkgs/misc/emulators/wine/sources.nix
@ -31,6 +31,7 @@ in rec {
  };

  unstable = fetchurl rec {
+    # NOTE: Don't forget to change the SHA256 for staging as well.
    version = "2.6";
    url = "https://dl.winehq.org/wine/source/2.x/wine-${version}.tar.xz";
    sha256 = "1h5ajw50fax2pg9p4wch6824zxdd85g2gh9nkbllfxj3ixsn9zz6";
@ -39,7 +40,7 @@ in rec {

  staging = fetchFromGitHub rec {
    inherit (unstable) version;
-    sha256 = "1l0sjbsajr4m7w3ar2ljwr3ffmwyv57g85a068ard3v8fv4nil22";
+    sha256 = "1j1fsq7pb7rxi7ppagrk93gmg5wk3anr9js0civxiqd3h8d4lsz2";
    owner = "wine-compholio";
    repo = "wine-staging";
    rev = "v${version}";
--- a/pkgs/misc/vim-plugins/default.nix
+++ b/pkgs/misc/vim-plugins/default.nix
--- a/pkgs/misc/vim-plugins/vim-plugin-names
+++ b/pkgs/misc/vim-plugins/vim-plugin-names
@ -33,6 +33,7 @@
 "github:bbchung/clighter8"
 "github:benekastah/neomake"
 "github:bitc/vim-hdevtools"
+"github:bronson/vim-trailing-whitespace"
 "github:christoomey/vim-sort-motion"
 "github:christoomey/vim-tmux-navigator"
 "github:ctjhoa/spacevim"
@ -40,6 +41,7 @@
 "github:derekelkins/agda-vim"
 "github:derekwyatt/vim-scala"
 "github:digitaltoad/vim-jade"
+"github:dleonard0/pony-vim-syntax"
 "github:dracula/vim"
 "github:eagletmt/neco-ghc"
 "github:eikenb/acp"
--- a/pkgs/misc/xosd/default.nix
+++ b/pkgs/misc/xosd/default.nix
@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
    description = "Displays text on your screen";
    homepage = http://sourceforge.net/projects/libxosd;
    license = licenses.gpl2;
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
    maintainers = with maintainers; [ pSub ];
  };
 }
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@ -101,8 +101,8 @@ rec {

  grsecurity_testing = grsecPatch
    { kver   = "4.9.24";
-      grrev  = "201704210851";
-      sha512 = "398cnj7cnzp2vxy54y1538bgqrg2gbz2f7wnx2yhv5xgdwc9b87z9r0d7znk3ah79vrpr2m87394m6zk7d96sjq483y4nm9b1rz5pmn";
+      grrev  = "201704220732";
+      sha512 = "0n9v066z3qh296fyvsg1gnygy7jd0cy0pnywxzglh58dnibl28q2ywjnp4ff30andzzq7rvjkk4n151xvs1n04pf2azkgz6igwfisg7";
    };

  # This patch relaxes grsec constraints on the location of usermode helpers,
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@ -123,7 +123,7 @@ in
    # to be adapted
    zfsStable = common {
      # comment/uncomment if breaking kernel versions are known
-      incompatibleKernelVersion = "4.10";
+      incompatibleKernelVersion = "4.11";

      version = "0.6.5.9";

--- a/pkgs/servers/etcd/default.nix
+++ b/pkgs/servers/etcd/default.nix
@ -4,7 +4,7 @@ with lib;

 buildGoPackage rec {
  name = "etcd-${version}";
-  version = "3.0.6"; # After updating check that nixos tests pass
+  version = "3.1.6"; # After updating check that nixos tests pass
  rev = "v${version}";

  goPackagePath = "github.com/coreos/etcd";
@ -13,10 +13,16 @@ buildGoPackage rec {
    inherit rev;
    owner = "coreos";
    repo = "etcd";
-    sha256 = "163qji360y21nr1wnl16nbvvgdgqgbny4c3v3igp87q9p78sdf75";
+    sha256 = "1qgi6zxnijzr644w2da2gbn3gw2qwk6a3z3qmdln0r2rjnm70sx0";
  };

-  goDeps = ./deps.nix;
+  subPackages = [
+    "cmd/etcd"
+    "cmd/etcdctl"
+    "cmd/tools/benchmark"
+    "cmd/tools/etcd-dump-db"
+    "cmd/tools/etcd-dump-logs"
+  ];

  buildInputs = [ libpcap ];

--- a/pkgs/servers/etcd/deps.nix
+++ b/pkgs/servers/etcd/deps.nix
@ -1,335 +0,0 @@
-[
-{
-  goPackagePath = "github.com/beorn7/perks";
-  fetch = {
-    type = "git";
-    url = "https://github.com/beorn7/perks";
-    rev = "4c0e84591b9aa9e6dcfdf3e020114cd81f89d5f9";
-    sha256 = "1hrybsql68xw57brzj805xx2mghydpdiysv3gbhr7f5wlxj2514y";
-  };
-}
-{
-  goPackagePath = "github.com/boltdb/bolt";
-  fetch = {
-    type = "git";
-    url = "https://github.com/boltdb/bolt";
-    rev = "583e8937c61f1af6513608ccc75c97b6abdf4ff9";
-    sha256 = "0cp5v9iypg9ysiq40k3h3lg7aisxplnmxshha7nama6b170izyay";
-  };
-}
-{
-  goPackagePath = "github.com/cloudfoundry-incubator/candiedyaml";
-  fetch = {
-    type = "git";
-    url = "https://github.com/cloudfoundry-incubator/candiedyaml";
-    rev = "99c3df83b51532e3615f851d8c2dbb638f5313bf";
-    sha256 = "106nibg7423642gbkg88c5x2jxfz6nmxbribhwb8cr1rn9vpjaxs";
-  };
-}
-{
-  goPackagePath = "github.com/cockroachdb/cmux";
-  fetch = {
-    type = "git";
-    url = "https://github.com/cockroachdb/cmux";
-    rev = "b64f5908f4945f4b11ed4a0a9d3cc1e23350866d";
-    sha256 = "1by4f3x7j3r3z1sdx1v04r494hn6jaag7lc03prrgx455j8i0jlh";
-  };
-}
-{
-  goPackagePath = "github.com/coreos/etcd";
-  fetch = {
-    type = "git";
-    url = "https://github.com/coreos/etcd.git";
-    rev = "9efa00d1030d4bf62eb8e5ec130023aeb1b8e2d0";
-    sha256 = "163qji360y21nr1wnl16nbvvgdgqgbny4c3v3igp87q9p78sdf75";
-  };
-}
-{
-  goPackagePath = "github.com/coreos/go-semver";
-  fetch = {
-    type = "git";
-    url = "https://github.com/coreos/go-semver";
-    rev = "8ab6407b697782a06568d4b7f1db25550ec2e4c6";
-    sha256 = "1gghi5bnqj50hfxhqc1cxmynqmh2yk9ii7ab9gsm75y5cp94ymk0";
-  };
-}
-{
-  goPackagePath = "github.com/coreos/go-systemd";
-  fetch = {
-    type = "git";
-    url = "https://github.com/coreos/go-systemd";
-    rev = "5c49e4850c879a0ddc061e8f4adcf307de8a8bc2";
-    sha256 = "1w16bnrgfjb5rwha7g8rdjhpgjf8bzmlzhrda5bfvc9ymj3qjibk";
-  };
-}
-{
-  goPackagePath = "github.com/coreos/pkg";
-  fetch = {
-    type = "git";
-    url = "https://github.com/coreos/pkg";
-    rev = "3ac0863d7acf3bc44daf49afef8919af12f704ef";
-    sha256 = "0l5ans1ls2gknkrnhymgc0zbgg5nqjbjbqc51r611adcr0m6gg8l";
-  };
-}
-{
-  goPackagePath = "github.com/ghodss/yaml";
-  fetch = {
-    type = "git";
-    url = "https://github.com/ghodss/yaml";
-    rev = "aa0c862057666179de291b67d9f093d12b5a8473";
-    sha256 = "0cbc78n8l7h1gdzhrvahplcvr4v7n8v23vkgskfp843rcx5h6isr";
-  };
-}
-{
-  goPackagePath = "github.com/gogo/protobuf";
-  fetch = {
-    type = "git";
-    url = "https://github.com/gogo/protobuf";
-    rev = "f20a1444730c7d9949b880a0309e737d007def25";
-    sha256 = "12wa3r2cb2v1m65phbkh692ldlklk459z4x6avpc6im0zkr6r73c";
-  };
-}
-{
-  goPackagePath = "github.com/golang/protobuf";
-  fetch = {
-    type = "git";
-    url = "https://github.com/golang/protobuf";
-    rev = "f592bd283e9ef86337a432eb50e592278c3d534d";
-    sha256 = "01gxhzn9m6jz6ihwxfycnx39zf5pmkan61l278cnynsb8mibdpvb";
-  };
-}
-{
-  goPackagePath = "github.com/google/btree";
-  fetch = {
-    type = "git";
-    url = "https://github.com/google/btree";
-    rev = "7d79101e329e5a3adf994758c578dab82b90c017";
-    sha256 = "1c1hsy5s2pfawg3l9954jmqmy4yc2zp3f7i87m00km2yqgb8xpd0";
-  };
-}
-{
-  goPackagePath = "github.com/grpc-ecosystem/grpc-gateway";
-  fetch = {
-    type = "git";
-    url = "https://github.com/grpc-ecosystem/grpc-gateway";
-    rev = "5e0e028ba0a015710eaebf6e47af18812c9f2767";
-    sha256 = "00s4wxzs6lz5al7y2hxi6r4bxhx5b0ajk5rwxrnb4a4mhlaii8pk";
-  };
-}
-{
-  goPackagePath = "github.com/jonboulle/clockwork";
-  fetch = {
-    type = "git";
-    url = "https://github.com/jonboulle/clockwork";
-    rev = "e3653ace2d63753697e0e5b07b9393971c0bba9d";
-    sha256 = "1avzqhks12a8x2yzpvjsf3k0gv9cy7zx2z88hn0scacnxkphisvc";
-  };
-}
-{
-  goPackagePath = "github.com/matttproud/golang_protobuf_extensions";
-  fetch = {
-    type = "git";
-    url = "https://github.com/matttproud/golang_protobuf_extensions";
-    rev = "c12348ce28de40eed0136aa2b644d0ee0650e56c";
-    sha256 = "1d0c1isd2lk9pnfq2nk0aih356j30k3h1gi2w0ixsivi5csl7jya";
-  };
-}
-{
-  goPackagePath = "github.com/prometheus/client_golang";
-  fetch = {
-    type = "git";
-    url = "https://github.com/prometheus/client_golang";
-    rev = "c5b7fccd204277076155f10851dad72b76a49317";
-    sha256 = "1xqny3147g12n4j03kxm8s9mvdbs3ln6i56c655mybrn9jjy48kd";
-  };
-}
-{
-  goPackagePath = "github.com/prometheus/client_model";
-  fetch = {
-    type = "git";
-    url = "https://github.com/prometheus/client_model";
-    rev = "fa8ad6fec33561be4280a8f0514318c79d7f6cb6";
-    sha256 = "11a7v1fjzhhwsl128znjcf5v7v6129xjgkdpym2lial4lac1dhm9";
-  };
-}
-{
-  goPackagePath = "github.com/prometheus/common";
-  fetch = {
-    type = "git";
-    url = "https://github.com/prometheus/common";
-    rev = "ebdfc6da46522d58825777cf1f90490a5b1ef1d8";
-    sha256 = "0js62pj8600773wx6labpd772yyhz5ivim7dnl7b862wblbmc8mq";
-  };
-}
-{
-  goPackagePath = "github.com/prometheus/procfs";
-  fetch = {
-    type = "git";
-    url = "https://github.com/prometheus/procfs";
-    rev = "abf152e5f3e97f2fafac028d2cc06c1feb87ffa5";
-    sha256 = "0cp8lznv1b4zhi3wnbjkfxwzhkqd3wbmiy6mwgjanip8l9l3ykws";
-  };
-}
-{
-  goPackagePath = "github.com/spf13/cobra";
-  fetch = {
-    type = "git";
-    url = "https://github.com/spf13/cobra";
-    rev = "7c674d9e72017ed25f6d2b5e497a1368086b6a6f";
-    sha256 = "0an935r7lc11a744mvdrsy56rs2w0ah3gdclvr4gzd5iqr9ap3dr";
-  };
-}
-{
-  goPackagePath = "github.com/spf13/pflag";
-  fetch = {
-    type = "git";
-    url = "https://github.com/spf13/pflag";
-    rev = "6454a84b6da0ea8b628d5d8a26759f62c6c161b4";
-    sha256 = "06rfi73jhkncn8gxy6klgmba5947k9gpwdswipdpz680yxczcwna";
-  };
-}
-{
-  goPackagePath = "github.com/ugorji/go";
-  fetch = {
-    type = "git";
-    url = "https://github.com/ugorji/go";
-    rev = "4a1cb5252a6951f715a85d0e4be334c2a2dbf2a2";
-    sha256 = "0izpijk3piihl4fnqg8ncnp5ivbq41pg3xf7iagg4fbg5id4pxbx";
-  };
-}
-{
-  goPackagePath = "github.com/xiang90/probing";
-  fetch = {
-    type = "git";
-    url = "https://github.com/xiang90/probing";
-    rev = "07dd2e8dfe18522e9c447ba95f2fe95262f63bb2";
-    sha256 = "0r8rq27yigz72mk8z7p61yjfan8id021dnp1v421ln9byzpvabn2";
-  };
-}
-{
-  goPackagePath = "golang.org/x/crypto";
-  fetch = {
-    type = "git";
-    url = "https://go.googlesource.com/crypto";
-    rev = "88d0005bf4c3ec17306ecaca4281a8d8efd73e91";
-    sha256 = "1d3x0rwfd4cml06ka8gy74wxrw94m2z7qgz6ky0rgmxcr7p5iikz";
-  };
-}
-{
-  goPackagePath = "golang.org/x/net";
-  fetch = {
-    type = "git";
-    url = "https://go.googlesource.com/net";
-    rev = "7394c112eae4dba7e96bfcfe738e6373d61772b4";
-    sha256 = "1p8wsxnbsp2lq6hbza2n0zgv4sgpxzzjjlrmcngkhxj47kp3hin7";
-  };
-}
-{
-  goPackagePath = "google.golang.org/grpc";
-  fetch = {
-    type = "git";
-    url = "https://github.com/grpc/grpc-go";
-    rev = "0032a855ba5c8a3c8e0d71c2deef354b70af1584";
-    sha256 = "0qkynp65jwk6jk932k7kwxs5v6fzlfsb1fay71a00dwr36f44s67";
-  };
-}
-{
-  goPackagePath = "github.com/urfave/cli";
-  fetch = {
-    type = "git";
-    url = "https://github.com/urfave/cli";
-    rev = "168c95418e66e019fe17b8f4f5c45aa62ff80e23";
-    sha256 = "1gdvvim2f1zigcmbpcgypgn7nvpnlr87grbg7lw13fbpy6fnlw2n";
-  };
-}
-{
-  goPackagePath = "github.com/mattn/go-runewidth";
-  fetch = {
-    type = "git";
-    url = "https://github.com/mattn/go-runewidth";
-    rev = "d6bea18f789704b5f83375793155289da36a3c7f";
-    sha256 = "1hnigpn7rjbwd1ircxkyx9hvi0xmxr32b2jdy2jzw6b3jmcnz1fs";
-  };
-}
-{
-  goPackagePath = "github.com/olekukonko/tablewriter";
-  fetch = {
-    type = "git";
-    url = "https://github.com/olekukonko/tablewriter";
-    rev = "daf2955e742cf123959884fdff4685aa79b63135";
-    sha256 = "1fvl251ms7qmzfbi853kdgghqkrmyy6n1605mfy50nhgvw03z203";
-  };
-}
-{
-  goPackagePath = "github.com/dustin/go-humanize";
-  fetch = {
-    type = "git";
-    url = "https://github.com/dustin/go-humanize";
-    rev = "2fcb5204cdc65b4bec9fd0a87606bb0d0e3c54e8";
-    sha256 = "1m2qgn5vh5m66ggmclgikvwc05np2r7sxgpvlj2jip5d61x29j5k";
-  };
-}
-{
-  goPackagePath = "github.com/bgentry/speakeasy";
-  fetch = {
-    type = "git";
-    url = "https://github.com/bgentry/speakeasy";
-    rev = "a1ccbf2c40dfc8ce514b5c5c6e6d1429ea6880da";
-    sha256 = "0xqpc1qhdcs5blp1mkrppfb1x0rcv4a445mj0yzdwshbzkw5di01";
-  };
-}
-{
-  goPackagePath = "github.com/kr/pty";
-  fetch = {
-    type = "git";
-    url = "https://github.com/kr/pty";
-    rev = "ce7fa45920dc37a92de8377972e52bc55ffa8d57";
-    sha256 = "0mdlr2mmwjznw2id0l4200xjajq9dh1kxn3z7d3ksn0b5fwinzmk";
-  };
-}
-{
-  goPackagePath = "github.com/golang/groupcache";
-  fetch = {
-    type = "git";
-    url = "https://github.com/golang/groupcache";
-    rev = "a6b377e3400b08991b80d6805d627f347f983866";
-    sha256 = "125a6zdaxj916yp2rlrkg8xw00vjf5ga9xwdg4clby8wj4fysma2";
-  };
-}
-{
-  goPackagePath = "gopkg.in/cheggaaa/pb.v1";
-  fetch = {
-    type = "git";
-    url = "https://gopkg.in/cheggaaa/pb.v1";
-    rev = "9453b2db37f4d8bc63751daca63bbe7049eb5e74";
-    sha256 = "0py7dxvm3ydxcw260x7r7xbjww1vkil3rhyy3f9njmjydyb303rb";
-  };
-}
-{
-  goPackagePath = "github.com/golang/glog";
-  fetch = {
-    type = "git";
-    url = "https://github.com/golang/glog";
-    rev = "23def4e6c14b4da8ac2ed8007337bc5eb5007998";
-    sha256 = "0jb2834rw5sykfr937fxi8hxi2zy80sj2bdn9b3jb4b26ksqng30";
-  };
-}
-{
-  goPackagePath = "github.com/spacejam/loghisto";
-  fetch = {
-    type = "git";
-    url = "https://github.com/spacejam/loghisto";
-    rev = "9d1d8c1fd2a4ac852bf2e312f2379f553345fda7";
-    sha256 = "0r31y4ci35pp11wqdyarimdq5a703byk3cf6d67adsa4nw0ysfm1";
-  };
-}
-{
-  goPackagePath = "github.com/akrennmair/gopcap";
-  fetch = {
-    type = "git";
-    url = "https://github.com/akrennmair/gopcap";
-    rev = "00e11033259acb75598ba416495bb708d864a010";
-    sha256 = "0xfw7x5a36w0g76imjvgk055360xg0nva42qhmflfvll7ldxq96a";
-  };
-}
-]
--- a/pkgs/servers/rt/default.nix
+++ b/pkgs/servers/rt/default.nix
@ -1,5 +1,35 @@
-{ stdenv, fetchurl, perl }:
+{ stdenv, buildEnv, fetchurl, perl, perlPackages, makeWrapper }:

+# This package isn't extremely useful as it is, but is getting close.
+# After running:
+#
+#   nix-build . -A rt
+#
+# I created a config file named myconfig.pm with:
+#
+#   use utf8;
+#   Set($rtname, '127.0.0.1');
+#   # These dirs need to be pre-created:
+#   Set($MasonSessionDir, '/home/grahamc/foo/sessiondir/');
+#   Set($MasonDataDir, '/home/grahamc/foo/localstate/');
+#   Set($WebPort, 8080);
+#
+#   Set($DatabaseType, "SQLite");
+#   Set( $DatabaseName, '/home/grahamc/projects/foo/my.db' );
+#
+#   1;
+#
+# and ran
+#
+#  RT_SITE_CONFIG=$(pwd)/myconfig.pm ./result/bin/rt-setup-database --action init
+#
+# Then:
+#
+#   RT_SITE_CONFIG=$(pwd)/myconfig.pm ./result/bin/rt-server
+#
+# Make sure to check out result/etc/RT_Config.pm
+#
+# Good luck.
 stdenv.mkDerivation rec {
  name = "rt-${version}";

@ -12,14 +42,58 @@ stdenv.mkDerivation rec {

  patches = [ ./override-generated.patch ];

-  buildInputs = [ perl ];
+  buildInputs = [
+    makeWrapper
+    perl
+    (buildEnv {
+      name = "rt-perl-deps";
+      paths = (with perlPackages; [
+        ApacheSession BusinessHours CGIEmulatePSGI CGIPSGI
+        CSSMinifierXP CSSSquish ConvertColor CryptEksblowfish
+        CryptSSLeay DBDSQLite DBDmysql DBIxSearchBuilder DataGUID
+        DataICal DataPagePageset DateExtract DateManip
+        DateTimeFormatNatural DevelGlobalDestruction EmailAddress
+        EmailAddressList FCGI FCGIProcManager FileShareDir FileWhich
+        GD GDGraph GnuPGInterface GraphViz HTMLFormatTextWithLinks
+        HTMLFormatTextWithLinksAndTables HTMLMason
+        HTMLMasonPSGIHandler HTMLQuoted HTMLRewriteAttributes
+        HTMLScrubber IPCRun IPCRun3 JSON JavaScriptMinifierXS LWP
+        LWPProtocolHttps LocaleMaketextFuzzy LocaleMaketextLexicon
+        LogDispatch MIMETools MIMETypes MailTools ModuleRefresh
+        ModuleVersionsReport MozillaCA NetCIDR NetIP PerlIOeol Plack
+        RegexpCommon RegexpCommonnetCIDR RegexpIPv6 RoleBasic
+        ScopeUpper Starlet SymbolGlobalName TermReadKey
+        TextPasswordPronounceable TextQuoted TextTemplate
+        TextWikiFormat TextWrapper TimeParseDate TreeSimple
+        UNIVERSALrequire XMLRSS
+      ]);
+    })
+  ];

-  dontBuild = true;
+  preConfigure = ''
+    configureFlags="$configureFlags --with-web-user=$UID"
+    configureFlags="$configureFlags --with-web-group=$(id -g)"
+    configureFlags="$configureFlags --with-rt-group=$(id -g)"
+    configureFlags="$configureFlags --with-bin-owner=$UID"
+    configureFlags="$configureFlags --with-libs-owner=$UID"
+    configureFlags="$configureFlags --with-libs-group=$(id -g)"
+  '';
+  configureFlags = [
+    "--enable-graphviz"
+    "--enable-gd"
+    "--enable-gpg"
+    "--with-db-type=SQLite"
+  ];

-  installPhase = ''
-    mkdir $out
-    cp -a {bin,docs,etc,lib,sbin,share} $out
-    find $out -name '*.in' -exec rm '{}' \;
+  buildPhase = ''
+    make testdeps | grep -i missing | sort
+  '';
+
+  preFixup = ''
+    for i in $(find $out/bin -type f; find $out/sbin -type f); do
+      wrapProgram $i \
+          --prefix PERL5LIB ':' $PERL5LIB
+    done
  '';

  meta = {
--- a/pkgs/shells/mksh/default.nix
+++ b/pkgs/shells/mksh/default.nix
@ -1,33 +1,22 @@
-{ stdenv, fetchurl, groff }:
+{ stdenv, fetchurl }:

 stdenv.mkDerivation rec {
  name = "mksh-${version}";
-  version = "52c";
+  version = "55";

  src = fetchurl {
    urls = [
      "http://www.mirbsd.org/MirOS/dist/mir/mksh/mksh-R${version}.tgz"
      "http://pub.allbsd.org/MirOS/dist/mir/mksh/mksh-R${version}.tgz"
    ];
-    sha256 = "19ivsic15903hv3ipzk0kvkaxardw7b99s8l5iw3y415lz71ld66";
+    sha256 = "0mssqd2wp3cs9x01v6g66iy3ymdxagbyw2c0v597vnc1l6s2rm6f";
  };

-  buildInputs = [ groff ];
-
-  hardeningDisable = [ "format" ];
-
-  buildPhase = ''
-    mkdir build-dir/
-    cp mksh.1 dot.mkshrc build-dir/
-    cd build-dir/
-    sh ../Build.sh -c lto
-  '';
+  buildPhase = ''sh ./Build.sh -r -c lto'';

  installPhase = ''
-    mkdir -p $out/bin $out/share/man/man1 $out/share/mksh $out/bin
    install -D -m 755 mksh $out/bin/mksh
    install -D -m 644 mksh.1 $out/share/man/man1/mksh.1
-    install -D -m 644 mksh.cat1 $out/share/mksh/mksh.cat1
    install -D -m 644 dot.mkshrc $out/share/mksh/mkshrc
  '';

@ -41,8 +30,8 @@ stdenv.mkDerivation rec {
      systems.
    '';
    homepage = "https://www.mirbsd.org/mksh.htm";
-    license = licenses.free;
-    maintainers = with maintainers; [ AndersonTorres nckx ];
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ AndersonTorres nckx joachifm ];
    platforms = platforms.unix;
  };

--- a/pkgs/stdenv/booter.nix
+++ b/pkgs/stdenv/booter.nix
@ -41,6 +41,35 @@
 # other words, this does a foldr not foldl.
 stageFuns: let

+  /* "dfold" a ternary function `op' between successive elements of `list' as if
+     it was a doubly-linked list with `lnul' and `rnul` base cases at either
+     end. In precise terms, `fold op lnul rnul [x_0 x_1 x_2 ... x_n-1]` is the
+     same as
+
+       let
+         f_-1  = lnul;
+         f_0   = op f_-1   x_0  f_1;
+         f_1   = op f_0    x_1  f_2;
+         f_2   = op f_1    x_2  f_3;
+         ...
+         f_n   = op f_n-1  x_n  f_n+1;
+         f_n+1 = rnul;
+       in
+         f_0
+  */
+  dfold = op: lnul: rnul: list:
+    let
+      len = builtins.length list;
+      go = pred: n:
+        if n == len
+        then rnul
+        else let
+          # Note the cycle -- call-by-need ensures finite fold.
+          cur  = op pred (builtins.elemAt list n) succ;
+          succ = go cur (n + 1);
+        in cur;
+    in go lnul 0;
+
  # Take the list and disallow custom overrides in all but the final stage,
  # and allow it in the final flag. Only defaults this boolean field if it
  # isn't already set.
@ -55,19 +84,21 @@ stageFuns: let

  # Adds the stdenv to the arguments, and sticks in it the previous stage for
  # debugging purposes.
-  folder = stageFun: finalSoFar: let
-    args = stageFun finalSoFar;
+  folder = nextStage: stageFun: prevStage: let
+    args = stageFun prevStage;
    args' = args // {
      stdenv = args.stdenv // {
        # For debugging
-        __bootPackages = finalSoFar;
+        __bootPackages = prevStage;
+        __hatPackages = nextStage;
      };
    };
  in
    if args.__raw or false
    then args'
    else allPackages ((builtins.removeAttrs args' ["selfBuild"]) // {
-      buildPackages = if args.selfBuild or true then null else finalSoFar;
+      buildPackages = if args.selfBuild or true then null else prevStage;
+      __targetPackages = if args.selfBuild or true then null else nextStage;
    });

-in lib.lists.fold folder {} withAllowCustomOverrides
+in dfold folder {} {} withAllowCustomOverrides
--- a/pkgs/tools/compression/lhasa/default.nix
+++ b/pkgs/tools/compression/lhasa/default.nix
@ -16,6 +16,6 @@ stdenv.mkDerivation {
    license = stdenv.lib.licenses.isc;
    homepage = http://fragglet.github.io/lhasa;
    maintainers = with stdenv.lib; [ maintainers.sander ];
-    platforms = stdenv.lib.platforms.linux;
+    platforms = with stdenv.lib.platforms; linux ++ darwin;
  };
 }
--- a/pkgs/tools/graphics/icoutils/default.nix
+++ b/pkgs/tools/graphics/icoutils/default.nix
@ -27,6 +27,6 @@ stdenv.mkDerivation rec {
    homepage = http://www.nongnu.org/icoutils/;
    description = "Set of programs to deal with Microsoft Windows(R) icon and cursor files";
    license = stdenv.lib.licenses.gpl3Plus;
-    platforms = with stdenv.lib.platforms; linux;
+    platforms = with stdenv.lib.platforms; linux ++ darwin;
  };
 }
--- a/pkgs/tools/misc/asciinema/default.nix
+++ b/pkgs/tools/misc/asciinema/default.nix
@ -4,7 +4,7 @@ let
  pythonPackages = python3Packages;
 in pythonPackages.buildPythonApplication rec {
  name = "asciinema-${version}";
-  version = "1.3.0";
+  version = "1.4.0";

  buildInputs = with pythonPackages; [ nose ];
  propagatedBuildInputs = with pythonPackages; [ requests2 ];
@ -13,9 +13,14 @@ in pythonPackages.buildPythonApplication rec {
    owner = "asciinema";
    repo = "asciinema";
    rev = "v${version}";
-    sha256 = "1hx7xipyy9w72iwlawldlif9qk3f7b8jx8c1wcx114pqbjz5d347";
+    sha256 = "1m2gjqxb5gqyz19lvp7jmwp7cxjc6nb0b2rrlsg3z2bl6vmi1xn2";
  };

+  patchPhase = ''
+    # disable one test which is failing with -> OSError: out of pty devices
+    rm tests/pty_recorder_test.py
+  '';
+
  checkPhase = ''
    nosetests
  '';
--- a/pkgs/tools/misc/desktop-file-utils/default.nix
+++ b/pkgs/tools/misc/desktop-file-utils/default.nix
@ -1,4 +1,6 @@
-{ stdenv, fetchurl, pkgconfig, glib }:
+{ stdenv, fetchurl, pkgconfig, glib, libintlOrEmpty }:
+
+with stdenv.lib;

 stdenv.mkDerivation rec {
  name = "desktop-file-utils-0.22";
@ -8,11 +10,13 @@ stdenv.mkDerivation rec {
    sha256 = "1ianvr2a69yjv4rpyv30w7yjsmnsb23crrka5ndqxycj4rkk4dc4";
  };

-  buildInputs = [ pkgconfig glib ];
+  buildInputs = [ pkgconfig glib libintlOrEmpty ];
+
+  NIX_LDFLAGS = optionalString stdenv.isDarwin "-lintl";

  meta = {
    homepage = http://www.freedesktop.org/wiki/Software/desktop-file-utils;
    description = "Command line utilities for working with .desktop files";
-    platforms = stdenv.lib.platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
  };
 }
--- a/pkgs/tools/misc/system-config-printer/default.nix
+++ b/pkgs/tools/misc/system-config-printer/default.nix
@ -1,19 +1,19 @@
-{ stdenv, fetchurl, udev, intltool, pkgconfig, glib, xmlto
+{ stdenv, fetchurl, udev, intltool, pkgconfig, glib, xmlto, wrapGAppsHook
 , makeWrapper, gtk3, docbook_xml_dtd_412, docbook_xsl
 , libxml2, desktop_file_utils, libusb1, cups, gdk_pixbuf, pango, atk, libnotify
+, gobjectIntrospection, libgnome_keyring3
 , cups-filters
 , pythonPackages
 , withGUI ? true
 }:

-let majorVersion = "1.5";
-
-in stdenv.mkDerivation rec {
-  name = "system-config-printer-${majorVersion}.7";
+stdenv.mkDerivation rec {
+  name = "system-config-printer-${version}";
+  version = "1.5.9";

  src = fetchurl {
-    url = "http://cyberelk.net/tim/data/system-config-printer/${majorVersion}/${name}.tar.xz";
-    sha256 = "1vxczk22f58nbikvj47s2x1gzh6q4mbgwnf091p00h3b6nxppdgn";
+    url = "https://github.com/zdohnal/system-config-printer/releases/download/v${version}/${name}.tar.gz";
+    sha256 = "03bwlpsiqpxzcwd78a7rmwiww4jnqd7kl7il4kx78l1r57lasd2r";
  };

  patches = [ ./detect_serverbindir.patch ];
@ -22,8 +22,12 @@ in stdenv.mkDerivation rec {
    [ intltool pkgconfig glib udev libusb1 cups xmlto
      libxml2 docbook_xml_dtd_412 docbook_xsl desktop_file_utils
      pythonPackages.python pythonPackages.wrapPython
+      libnotify gobjectIntrospection gdk_pixbuf pango atk
+      libgnome_keyring3
    ];

+  nativeBuildInputs = [ wrapGAppsHook ];
+
  pythonPath = with pythonPackages;
    [ pycups pycurl dbus-python pygobject3 requests2 pycairo pythonPackages.pycurl ];

@ -33,36 +37,22 @@ in stdenv.mkDerivation rec {
      "--with-systemdsystemunitdir=$(out)/etc/systemd/system"
    ];

-  stripDebugList = "bin lib etc/udev";
+  stripDebugList = [ "bin" "lib" "etc/udev" ];

  postInstall =
-    let
-      giTypelibPath = stdenv.lib.makeSearchPath "lib/girepository-1.0" [ gdk_pixbuf.out gtk3.out pango.out atk.out libnotify.out ];
-    in
    ''
-      export makeWrapperArgs="--set prefix $out \
-          --set GI_TYPELIB_PATH ${giTypelibPath} \
-          --set CUPS_DATADIR ${cups-filters}/share/cups"
-      wrapPythonPrograms
-
-      # The program imports itself, so we need to move shell wrappers to a proper place.
-      fixupWrapper() {
-        mv "$out/share/system-config-printer/$2.py" \
-           "$out/bin/$1"
-        sed -i "s/.$2.py-wrapped/$2.py/g" "$out/bin/$1"
-        mv "$out/share/system-config-printer/.$2.py-wrapped" \
-           "$out/share/system-config-printer/$2.py"
-      }
-      fixupWrapper scp-dbus-service scp-dbus-service
-      fixupWrapper system-config-printer system-config-printer
-      fixupWrapper system-config-printer-applet applet
-      # This __init__.py is both executed and imported.
-      ( cd $out/share/system-config-printer/troubleshoot
-        mv .__init__.py-wrapped __init__.py
+      buildPythonPath "$out $pythonPath"
+      gappsWrapperArgs+=(
+        --prefix PATH "$program_PATH"
+        --set CUPS_DATADIR "${cups-filters}/share/cups"
      )

+      find $out/share/system-config-printer -name \*.py -type f -perm -0100 -print0 | while read -d "" f; do
+        patchPythonScript "$f"
+      done
+
      # The below line will be unneeded when the next upstream release arrives.
-      sed -i -e "s|/usr/bin|$out/bin|" "$out/share/dbus-1/services/org.fedoraproject.Config.Printing.service"
+      sed -i -e "s|/usr/local/bin|$out/bin|" "$out/share/dbus-1/services/org.fedoraproject.Config.Printing.service"

      # Manually expand literal "$(out)", which have failed to expand
      sed -e "s|ExecStart=\$(out)|ExecStart=$out|" \
--- a/pkgs/tools/networking/flvstreamer/default.nix
+++ b/pkgs/tools/networking/flvstreamer/default.nix
@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
  };

  buildPhase = ''
-    make posix
+    make CC=cc posix
  '';

  installPhase = ''
@ -34,6 +34,6 @@ stdenv.mkDerivation rec {
    homepage = http://savannah.nongnu.org/projects/flvstreamer;

    maintainers = [ stdenv.lib.maintainers.thammers ];
-    platforms = stdenv.lib.platforms.linux;
+    platforms = with stdenv.lib.platforms; linux ++ darwin;
  };
 }
--- a/pkgs/tools/networking/miniupnpc/default.nix
+++ b/pkgs/tools/networking/miniupnpc/default.nix
@ -19,7 +19,7 @@ let
      meta = {
        homepage = http://miniupnp.free.fr/;
        description = "A client that implements the UPnP Internet Gateway Device (IGD) specification";
-        platforms = with stdenv.lib.platforms; linux ++ freebsd;
+        platforms = with stdenv.lib.platforms; linux ++ freebsd ++ darwin;
      };
    };
 in {
--- a/pkgs/tools/system/cron/default.nix
+++ b/pkgs/tools/system/cron/default.nix
@ -13,7 +13,7 @@ stdenv.mkDerivation {

  preBuild = ''
    substituteInPlace Makefile --replace ' -o root' ' ' --replace 111 755
-    makeFlags="DESTROOT=$out"
+    makeFlags="DESTROOT=$out CC=cc"

    # We want to ignore the $glibc/include/paths.h definition of
    # sendmail path.
@ -35,6 +35,6 @@ stdenv.mkDerivation {

  meta = {
    description = "Daemon for running commands at specific times (Vixie Cron)";
-    platforms = stdenv.lib.platforms.linux;
+    platforms = with stdenv.lib.platforms; linux ++ darwin;
  };
 }
--- a/pkgs/tools/system/runit/default.nix
+++ b/pkgs/tools/system/runit/default.nix
@ -1,4 +1,6 @@
 { stdenv, fetchurl
+
+# Build runit-init as a static binary
 , static ? false
 }:

@ -19,7 +21,9 @@ stdenv.mkDerivation rec {

  buildInputs = stdenv.lib.optionals static [ stdenv.cc.libc stdenv.cc.libc.static ];

-  postPatch = stdenv.lib.optionalString (!static) ''
+  postPatch = ''
+    sed -i "s,\(#define RUNIT\) .*,\1 \"$out/bin/runit\"," src/runit.h
+  '' + stdenv.lib.optionalString (!static) ''
    sed -i 's,-static,,g' src/Makefile
  '';

--- a/pkgs/tools/text/patchutils/default.nix
+++ b/pkgs/tools/text/patchutils/default.nix
@ -1,13 +1,15 @@
 { stdenv, fetchurl }:

 stdenv.mkDerivation rec {
-  name = "patchutils-0.3.4";
+  name = "patchutils-0.3.3";

  src = fetchurl {
    url = "http://cyberelk.net/tim/data/patchutils/stable/${name}.tar.xz";
-    sha256 = "0xp8mcfyi5nmb5a2zi5ibmyshxkb1zv1dgmnyn413m7ahgdx8mfg";
+    sha256 = "0g5df00cj4nczrmr4k791l7la0sq2wnf8rn981fsrz1f3d2yix4i";
  };

+  patches = [ ./drop-comments.patch ]; # we would get into a cycle when using fetchpatch on this one
+
  hardeningDisable = [ "format" ];

  meta = with stdenv.lib; {
--- a/pkgs/tools/text/patchutils/drop-comments.patch
+++ b/pkgs/tools/text/patchutils/drop-comments.patch
@ -0,0 +1,84 @@
+From 58987954647f51dc42fb13b7759923c6170dd905 Mon Sep 17 00:00:00 2001
+From: Tim Waugh <twaugh@redhat.com>
+Date: Fri, 9 May 2014 16:23:27 +0100
+Subject: Make --clean drop comments after '@@' lines as well (trac #29).
+
+
+diff --git a/Makefile.am b/Makefile.am
+index 99ad2a3..f3c6dbc 100644
+--- a/Makefile.am
+++ b/Makefile.am
+@@ -198,6 +198,7 @@ TESTS = tests/newline1/run-test \
+ 	tests/convert1/run-test \
+ 	tests/convert2/run-test \
+ 	tests/clean1/run-test \
+	tests/clean2/run-test \
+ 	tests/stdin/run-test
+ 
+ # These ones don't work yet.
+diff --git a/src/filterdiff.c b/src/filterdiff.c
+index 383e72b..6ca2316 100644
+--- a/src/filterdiff.c
+++ b/src/filterdiff.c
+@@ -2,7 +2,7 @@
+  * filterdiff - extract (or exclude) a diff from a diff file
+  * lsdiff - show which files are modified by a patch
+  * grepdiff - show files modified by a patch containing a regexp
+- * Copyright (C) 2001, 2002, 2003, 2004, 2008, 2009, 2011 Tim Waugh <twaugh@redhat.com>
+ * Copyright (C) 2001, 2002, 2003, 2004, 2008, 2009, 2011, 2013, 2014 Tim Waugh <twaugh@redhat.com>
+  *
+  * This program is free software; you can redistribute it and/or modify
+  * it under the terms of the GNU General Public License as published by
+@@ -408,7 +408,8 @@ do_unified (FILE *f, char *header[2], int match, char **line,
+ 							 " Hunk #%lu, %s",
+ 							 hunknum, bestname);
+ 
+-					fputs (trailing, output_to);
+					fputs (clean_comments ? "\n" : trailing,
+					       output_to);
+ 					break;
+ 				case Before:
+ 					// Note the initial line number
+diff --git a/tests/clean2/run-test b/tests/clean2/run-test
+new file mode 100755
+index 0000000..42320df
+--- /dev/null
+++ b/tests/clean2/run-test
+@@ -0,0 +1,34 @@
+#!/bin/sh
+
+# This is a filterdiff(1) testcase.
+# Test: Make sure --clean removes hunk-level comments.
+
+
+. ${top_srcdir-.}/tests/common.sh
+
+cat << EOF > diff
+non-diff line
+--- a/file1
++++ b/file1
+@@ -0,0 +1 @@ this is a hunk-level comment
++a
+EOF
+
+${FILTERDIFF} --clean diff 2>errors >filtered || exit 1
+[ -s errors ] && exit 1
+
+cat << EOF | cmp - filtered || exit 1
+--- a/file1
++++ b/file1
+@@ -0,0 +1 @@
++a
+EOF
+
+${FILTERDIFF} --clean -x file1 diff 2>errors >filtered || exit 1
+[ -s errors ] && exit 1
+cat << EOF | cmp - filtered || exit 1
+--- a/file1
++++ b/file1
+@@ -0,0 +1 @@
++a
+EOF
+-- 
+cgit v0.10.1
+
--- a/pkgs/tools/text/ripgrep/default.nix
+++ b/pkgs/tools/text/ripgrep/default.nix
@ -4,16 +4,16 @@ with rustPlatform;

 buildRustPackage rec {
  name = "ripgrep-${version}";
-  version = "0.5.0";
+  version = "0.5.1";

  src = fetchFromGitHub {
    owner = "BurntSushi";
    repo = "ripgrep";
    rev = "${version}";
-    sha256 = "13mg624867hqxp9pzpq1gn9kqkvbaqcphdjia3bz5wvff1cbxkfy";
+    sha256 = "1fbvc419gh1rix8v3bh9a63r993kvfizp49p5ps6y22wggpy0k77";
  };

-  depsSha256 = "0glw8xk77w2h1xg6c451fg8cmwx3vz7dyzdrbf0i8d84yq8sh0i1";
+  depsSha256 = "0vyrcgcmlf3lbp15nip2cm8xv4n6qldfbl0iwy3jb69i2mazi6nm";

  preFixup = ''
    mkdir -p "$out/man/man1"
--- a/Show More
+++ b/Show More