Merge remote-tracking branch 'upstream/master' into HEAD

doc/cross-compilation.xml

@@ -37,16 +37,9 @@
     </para>
     <para>
       In Nixpkgs, these three platforms are defined as attribute sets under the names <literal>buildPlatform</literal>, <literal>hostPlatform</literal>, and <literal>targetPlatform</literal>.
-      All are guaranteed to contain at least a <varname>platform</varname> field, which contains detailed information on the platform.
       All three are always defined at the top level, so one can get at them just like a dependency in a function that is imported with <literal>callPackage</literal>:
       <programlisting>{ stdenv, buildPlatform, hostPlatform, fooDep, barDep, .. }: ...</programlisting>
     </para>
-    <warning><para>
-      These platforms should all have the same structure in all scenarios, but that is currently not the case.
-      When not cross-compiling, they will each contain a <literal>system</literal> field with a short 2-part, hyphen-separated summering string name for the platform.
-      But, when when cross compiling, <literal>hostPlatform</literal> and <literal>targetPlatform</literal> may instead contain <literal>config</literal> with a fuller 3- or 4-part string in the manner of LLVM.
-      We should have all 3 platforms always contain both, and maybe give <literal>config</literal> a better name while we are at it.
-    </para></warning>
     <variablelist>
       <varlistentry>
         <term><varname>buildPlatform</varname></term>
@@ -91,6 +84,56 @@
       This field defined as <varname>hostPlatform</varname> when the host and build platforms differ, but otherwise not defined at all.
       This field is obsolete and will soon disappear—please do not use it.
     </para></note>
+    <para>
+      The exact scheme these fields is a bit ill-defined due to a long and convoluted evolution, but this is slowly being cleaned up.
+      For now, here are few fields can count on them containing:
+    </para>
+    <variablelist>
+      <varlistentry>
+        <term><varname>system</varname></term>
+        <listitem>
+          <para>
+            This is a two-component shorthand for the platform.
+            Examples of this would be "x86_64-darwin" and "i686-linux"; see <literal>lib.systems.doubles</literal> for more.
+            This format isn't very standard, but has built-in support in Nix, such as the <varname>builtins.currentSystem</varname> impure string.
+          </para>
+        </listitem>
+      </varlistentry>
+      <varlistentry>
+        <term><varname>config</varname></term>
+        <listitem>
+          <para>
+            This is a 3- or 4- component shorthand for the platform.
+            Examples of this would be "x86_64-unknown-linux-gnu" and "aarch64-apple-darwin14".
+            This is a standard format called the "LLVM target triple", as they are pioneered by LLVM and traditionally just used for the <varname>targetPlatform</varname>.
+            This format is strictly more informative than the "Nix host double", as the previous format could analogously be termed.
+            This needs a better name than <varname>config</varname>!
+          </para>
+        </listitem>
+      </varlistentry>
+      <varlistentry>
+        <term><varname>parsed</varname></term>
+        <listitem>
+          <para>
+            This is a nix representation of a parsed LLVM target triple with white-listed components.
+            This can be specified directly, or actually parsed from the <varname>config</varname>.
+            [Technically, only one need be specified and the others can be inferred, though the precision of inference may not be very good.]
+            See <literal>lib.systems.parse</literal> for the exact representation, along with some <literal>is*</literal>predicates.
+            These predicates are superior to the ones in <varname>stdenv</varname> as they aren't tied to the build platform (host, as previously discussed, would be a saner default).
+          </para>
+        </listitem>
+      </varlistentry>
+      <varlistentry>
+        <term><varname>platform</varname></term>
+        <listitem>
+          <para>
+            This is, quite frankly, a dumping ground of ad-hoc settings (it's an attribute set).
+            See <literal>lib.systems.platforms</literal> for examples—there's hopefully one in there that will work verbatim for each platform one is working.
+            Please help us triage these flags and give them better homes!
+          </para>
+        </listitem>
+      </varlistentry>
+    </variablelist>
   </section>
 
   <section>

lib/attrsets.nix

@@ -116,7 +116,7 @@ rec {
     listToAttrs (concatMap (name: let v = set.${name}; in if pred name v then [(nameValuePair name v)] else []) (attrNames set));
 
 
-  /* Filter an attribute set recursivelly by removing all attributes for
+  /* Filter an attribute set recursively by removing all attributes for
      which the given predicate return false.
 
      Example:
@@ -334,7 +334,7 @@ rec {
       value = f name (catAttrs name sets);
     }) names);
 
-  /* Implentation note: Common names  appear multiple times in the list of
+  /* Implementation note: Common names  appear multiple times in the list of
      names, hopefully this does not affect the system because the maximal
      laziness avoid computing twice the same expression and listToAttrs does
      not care about duplicated attribute names.
@@ -353,7 +353,7 @@ rec {
   zipAttrs = zipAttrsWith (name: values: values);
 
   /* Does the same as the update operator '//' except that attributes are
-     merged until the given pedicate is verified.  The predicate should
+     merged until the given predicate is verified.  The predicate should
      accept 3 arguments which are the path to reach the attribute, a part of
      the first attribute set and a part of the second attribute set.  When
      the predicate is verified, the value of the first attribute set is

lib/composable-derivation.nix

@@ -39,7 +39,7 @@ let inherit (lib) nv nvs; in
   #
   # issues:
   # * its complicated to understand
-  # * some "features" such as exact merge behaviour are burried in mergeAttrBy
+  # * some "features" such as exact merge behaviour are buried in mergeAttrBy
   #   and defaultOverridableDelayableArgs assuming the default behaviour does
   #   the right thing in the common case
   # * Eelco once said using such fix style functions are slow to evaluate
@@ -48,7 +48,7 @@ let inherit (lib) nv nvs; in
   #   / add patches the way you want without having to declare function arguments
   #
   # nice features:
-  # declaring "optional featuers" is modular. For instance:
+  # declaring "optional features" is modular. For instance:
   #   flags.curl = {
   #     configureFlags = ["--with-curl=${curl.dev}" "--with-curlwrappers"];
   #     buildInputs = [curl openssl];

lib/customisation.nix

@@ -10,7 +10,7 @@ rec {
 
   /* `overrideDerivation drv f' takes a derivation (i.e., the result
      of a call to the builtin function `derivation') and returns a new
-     derivation in which the attributes of the original are overriden
+     derivation in which the attributes of the original are overridden
      according to the function `f'.  The function `f' is called with
      the original derivation attributes.
 

lib/deprecated.nix

@@ -253,11 +253,11 @@ rec {
   # eg { a = 7; } {  a = [ 2 3 ]; } becomes { a = [ 7 2 3 ]; }
   mergeAttrsConcatenateValues = mergeAttrsWithFunc ( a: b: (toList a) ++ (toList b) );
 
-  # merges attributes using //, if a name exisits in both attributes
+  # merges attributes using //, if a name exists in both attributes
   # an error will be triggered unless its listed in mergeLists
   # so you can mergeAttrsNoOverride { buildInputs = [a]; } { buildInputs = [a]; } {} to get
   # { buildInputs = [a b]; }
-  # merging buildPhase does'nt really make sense. The cases will be rare where appending /prefixing will fit your needs?
+  # merging buildPhase doesn't really make sense. The cases will be rare where appending /prefixing will fit your needs?
   # in these cases the first buildPhase will override the second one
   # ! deprecated, use mergeAttrByFunc instead
   mergeAttrsNoOverride = { mergeLists ? ["buildInputs" "propagatedBuildInputs"],

lib/fetchers.nix

@@ -1,4 +1,4 @@
-# snippets that can be shared by mutliple fetchers (pkgs/build-support)
+# snippets that can be shared by multiple fetchers (pkgs/build-support)
 {
 
   proxyImpureEnvVars = [

lib/lists.nix

@@ -191,7 +191,7 @@ rec {
   */
   optional = cond: elem: if cond then [elem] else [];
 
-  /* Return a list or an empty list, dependening on a boolean value.
+  /* Return a list or an empty list, depending on a boolean value.
 
      Example:
        optionals true [ 2 3 ]

lib/maintainers.nix

@@ -452,7 +452,7 @@
   romildo = "José Romildo Malaquias <malaquias@gmail.com>";
   rongcuid = "Rongcui Dong <rongcuid@outlook.com>";
   ronny = "Ronny Pfannschmidt <nixos@ronnypfannschmidt.de>";
-  rszibele = "Richard Szibele <richard_szibele@hotmail.com>";
+  rszibele = "Richard Szibele <richard@szibele.com>";
   rtreffer = "Rene Treffer <treffer+nixos@measite.de>";
   rushmorem = "Rushmore Mushambi <rushmore@webenchanter.com>";
   rvl = "Rodney Lorrimar <dev+nix@rodney.id.au>";

lib/modules.nix

@@ -423,7 +423,7 @@ rec {
     in concatMap (def: if getPrio def == highestPrio then [(strip def)] else []) defs;
 
   /* Sort a list of properties.  The sort priority of a property is
-     1000 by default, but can be overriden by wrapping the property
+     1000 by default, but can be overridden by wrapping the property
      using mkOrder. */
   sortProperties = defs:
     let

lib/strings.nix

@@ -126,8 +126,8 @@ rec {
   */
   makePerlPath = makeSearchPathOutput "lib" "lib/perl5/site_perl";
 
-  /* Dependening on the boolean `cond', return either the given string
-     or the empty string. Useful to contatenate against a bigger string.
+  /* Depending on the boolean `cond', return either the given string
+     or the empty string. Useful to concatenate against a bigger string.
 
      Example:
        optionalString true "some-string"

lib/tests.nix

@@ -231,7 +231,7 @@ runTests {
     };
     in {
       expr = generators.toJSON {} val;
-      # trival implementation
+      # trivial implementation
       expected = builtins.toJSON val;
   };
 
@@ -243,7 +243,7 @@ runTests {
     };
     in {
       expr = generators.toYAML {} val;
-      # trival implementation
+      # trivial implementation
       expected = builtins.toJSON val;
   };
 

lib/types.nix

@@ -52,7 +52,7 @@ rec {
     { # Human-readable representation of the type, should be equivalent to
       # the type function name.
       name
-    , # Description of the type, defined recursively by embedding the the wrapped type if any.
+    , # Description of the type, defined recursively by embedding the wrapped type if any.
       description ? null
     , # Function applied to each definition that should return true if
       # its type-correct, false otherwise.

nixos/modules/module-list.nix

@@ -420,6 +420,7 @@
   ./services/networking/i2p.nix
   ./services/networking/iodine.nix
   ./services/networking/ircd-hybrid/default.nix
+  ./services/networking/keepalived/default.nix
   ./services/networking/kippo.nix
   ./services/networking/kresd.nix
   ./services/networking/lambdabot.nix

nixos/modules/profiles/hardened.nix

@@ -0,0 +1,35 @@
+# A profile with most (vanilla) hardening options enabled by default,
+# potentially at the cost of features and performance.
+
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+{
+  security.hideProcessInformation = mkDefault true;
+
+  security.apparmor.enable = mkDefault true;
+
+  # Restrict ptrace() usage to processes with a pre-defined relationship
+  # (e.g., parent/child)
+  boot.kernel.sysctl."kernel.yama.ptrace_scope" = mkOverride 500 1;
+
+  # Prevent replacing the running kernel image w/o reboot
+  boot.kernel.sysctl."kernel.kexec_load_disabled" = mkDefault true;
+
+  # Restrict access to kernel ring buffer (information leaks)
+  boot.kernel.sysctl."kernel.dmesg_restrict" = mkDefault true;
+
+  # Hide kptrs even for processes with CAP_SYSLOG
+  boot.kernel.sysctl."kernel.kptr_restrict" = mkOverride 500 2;
+
+  # Unprivileged access to bpf() has been used for privilege escalation in
+  # the past
+  boot.kernel.sysctl."kernel.unprivileged_bpf_disabled" = mkDefault true;
+
+  # Disable bpf() JIT (to eliminate spray attacks)
+  boot.kernel.sysctl."net.core.bpf_jit_enable" = mkDefault false;
+
+  # ... or at least apply some hardening to it
+  boot.kernel.sysctl."net.core.bpf_jit_harden" = mkDefault true;
+}

nixos/modules/programs/command-not-found/command-not-found.nix

@@ -8,13 +8,14 @@
 with lib;
 
 let
-
+  cfg = config.programs.command-not-found;
   commandNotFound = pkgs.substituteAll {
     name = "command-not-found";
     dir = "bin";
     src = ./command-not-found.pl;
     isExecutable = true;
     inherit (pkgs) perl;
+    inherit (cfg) dbPath;
     perlFlags = concatStrings (map (path: "-I ${path}/lib/perl5/site_perl ")
       [ pkgs.perlPackages.DBI pkgs.perlPackages.DBDSQLite pkgs.perlPackages.StringShellQuote ]);
   };
@@ -22,13 +23,29 @@ let
 in
 
 {
+  options.programs.command-not-found = {
 
+    enable = mkEnableOption "command-not-found hook for interactive shell";
+
+    dbPath = mkOption {
+      default = "/nix/var/nix/profiles/per-user/root/channels/nixos/programs.sqlite" ;
+      description = ''
+        Absolute path to programs.sqlite.
+
+        By default this file will be provided by your channel
+        (nixexprs.tar.xz).
+      '';
+      type = types.path;
+    };
+  };
+
+  config = mkIf cfg.enable {
     programs.bash.interactiveShellInit =
       ''
         # This function is called whenever a command is not found.
         command_not_found_handle() {
-        local p=/run/current-system/sw/bin/command-not-found
-        if [ -x $p -a -f /nix/var/nix/profiles/per-user/root/channels/nixos/programs.sqlite ]; then
+          local p=${commandNotFound}
+          if [ -x $p -a -f ${cfg.dbPath} ]; then
             # Run the helper program.
             $p "$@"
             # Retry the command if we just installed it.
@@ -48,8 +65,8 @@ in
       ''
         # This function is called whenever a command is not found.
         command_not_found_handler() {
-        local p=/run/current-system/sw/bin/command-not-found
-        if [ -x $p -a -f /nix/var/nix/profiles/per-user/root/channels/nixos/programs.sqlite ]; then
+          local p=${commandNotFound}
+          if [ -x $p -a -f ${cfg.dbPath} ]; then
             # Run the helper program.
             $p "$@"
 
@@ -59,13 +76,13 @@ in
             fi
           else
             # Indicate than there was an error so ZSH falls back to its default handler
+            echo "$1: command not found" >&2
             return 127
           fi
         }
       '';
 
     environment.systemPackages = [ commandNotFound ];
-
-  # TODO: tab completion for uninstalled commands! :-)
+  };
 
 }

nixos/modules/programs/command-not-found/command-not-found.pl

@@ -8,7 +8,7 @@ use Config;
 
 my $program = $ARGV[0];
 
-my $dbPath = "/nix/var/nix/profiles/per-user/root/channels/nixos/programs.sqlite";
+my $dbPath = "@dbPath@";
 
 my $dbh = DBI->connect("dbi:SQLite:dbname=$dbPath", "", "")
     or die "cannot open database `$dbPath'";

nixos/modules/services/misc/bepasty.nix

@@ -21,7 +21,7 @@ in
         configure a number of bepasty servers which will be started with
         gunicorn.
         '';
-      type = with types ; attrsOf (submodule ({
+      type = with types ; attrsOf (submodule ({ config, ... } : {
 
         options = {
 
@@ -34,7 +34,6 @@ in
             default = "127.0.0.1:8000";
           };
 
-
           dataDir = mkOption {
             type = types.str;
             description = ''
@@ -73,10 +72,28 @@ in
             type = types.str;
             description = ''
               server secret for safe session cookies, must be set.
+
+              Warning: this secret is stored in the WORLD-READABLE Nix store!
+
+              It's recommended to use <option>secretKeyFile</option>
+              which takes precedence over <option>secretKey</option>.
               '';
             default = "";
           };
 
+          secretKeyFile = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            description = ''
+              A file that contains the server secret for safe session cookies, must be set.
+
+              <option>secretKeyFile</option> takes precedence over <option>secretKey</option>.
+
+              Warning: when <option>secretKey</option> is non-empty <option>secretKeyFile</option>
+              defaults to a file in the WORLD-READABLE Nix store containing that secret.
+              '';
+          };
+
           workDir = mkOption {
             type = types.str;
             description = ''
@@ -87,11 +104,22 @@ in
           };
 
         };
+        config = {
+          secretKeyFile = mkDefault (
+            if config.secretKey != ""
+            then toString (pkgs.writeTextFile {
+              name = "bepasty-secret-key";
+              text = config.secretKey;
+            })
+            else null
+          );
+        };
       }));
     };
   };
 
   config = mkIf cfg.enable {
+
     environment.systemPackages = [ bepasty ];
 
     # creates gunicorn systemd service for each configured server
@@ -115,7 +143,7 @@ in
           serviceConfig = {
             Type = "simple";
             PrivateTmp = true;
-            ExecStartPre = assert server.secretKey != ""; pkgs.writeScript "bepasty-server.${name}-init" ''
+            ExecStartPre = assert !isNull server.secretKeyFile; pkgs.writeScript "bepasty-server.${name}-init" ''
               #!/bin/sh
               mkdir -p "${server.workDir}"
               mkdir -p "${server.dataDir}"
@@ -123,7 +151,7 @@ in
               cat > ${server.workDir}/bepasty-${name}.conf <<EOF
               SITENAME="${name}"
               STORAGE_FILESYSTEM_DIRECTORY="${server.dataDir}"
-              SECRET_KEY="${server.secretKey}"
+              SECRET_KEY="$(cat "${server.secretKeyFile}")"
               DEFAULT_PERMISSIONS="${server.defaultPermissions}"
               ${server.extraConfig}
               EOF

nixos/modules/services/networking/keepalived/default.nix

@@ -0,0 +1,245 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  cfg = config.services.keepalived;
+
+  keepalivedConf = pkgs.writeText "keepalived.conf" ''
+    global_defs {
+      ${snmpGlobalDefs}
+      ${cfg.extraGlobalDefs}
+    }
+
+    ${vrrpInstancesStr}
+    ${cfg.extraConfig}
+  '';
+
+  snmpGlobalDefs = with cfg.snmp; optionalString enable (
+    optionalString (socket != null) "snmp_socket ${socket}\n"
+    + optionalString enableKeepalived "enable_snmp_keepalived\n"
+    + optionalString enableChecker "enable_snmp_checker\n"
+    + optionalString enableRfc "enable_snmp_rfc\n"
+    + optionalString enableRfcV2 "enable_snmp_rfcv2\n"
+    + optionalString enableRfcV3 "enable_snmp_rfcv3\n"
+    + optionalString enableTraps "enable_traps"
+  );
+
+  vrrpInstancesStr = concatStringsSep "\n" (map (i:
+    ''
+      vrrp_instance ${i.name} {
+        interface ${i.interface}
+        state ${i.state}
+        virtual_router_id ${toString i.virtualRouterId}
+        priority ${toString i.priority}
+        ${optionalString i.noPreempt "nopreempt"}
+
+        ${optionalString i.useVmac (
+          "use_vmac" + optionalString (i.vmacInterface != null) " ${i.vmacInterface}"
+        )}
+        ${optionalString i.vmacXmitBase "vmac_xmit_base"}
+
+        ${optionalString (i.unicastSrcIp != null) "unicast_src_ip ${i.unicastSrcIp}"}
+        unicast_peer {
+          ${concatStringsSep "\n" i.unicastPeers}
+        }
+
+        virtual_ipaddress {
+          ${concatMapStringsSep "\n" virtualIpLine i.virtualIps}
+        }
+
+        ${i.extraConfig}
+      }
+    ''
+  ) vrrpInstances);
+
+  virtualIpLine = (ip:
+    ip.addr
+    + optionalString (notNullOrEmpty ip.brd) " brd ${ip.brd}"
+    + optionalString (notNullOrEmpty ip.dev) " dev ${ip.dev}"
+    + optionalString (notNullOrEmpty ip.scope) " scope ${ip.scope}"
+    + optionalString (notNullOrEmpty ip.label) " label ${ip.label}"
+  );
+
+  notNullOrEmpty = s: !(s == null || s == "");
+
+  vrrpInstances = mapAttrsToList (iName: iConfig:
+    {
+      name = iName;
+    } // iConfig
+  ) cfg.vrrpInstances;
+
+  vrrpInstanceAssertions = i: [
+    { assertion = i.interface != "";
+      message = "services.keepalived.vrrpInstances.${i.name}.interface option cannot be empty.";
+    }
+    { assertion = i.virtualRouterId >= 0 && i.virtualRouterId <= 255;
+      message = "services.keepalived.vrrpInstances.${i.name}.virtualRouterId must be an integer between 0..255.";
+    }
+    { assertion = i.priority >= 0 && i.priority <= 255;
+      message = "services.keepalived.vrrpInstances.${i.name}.priority must be an integer between 0..255.";
+    }
+    { assertion = i.vmacInterface == null || i.useVmac;
+      message = "services.keepalived.vrrpInstances.${i.name}.vmacInterface has no effect when services.keepalived.vrrpInstances.${i.name}.useVmac is not set.";
+    }
+    { assertion = !i.vmacXmitBase || i.useVmac;
+      message = "services.keepalived.vrrpInstances.${i.name}.vmacXmitBase has no effect when services.keepalived.vrrpInstances.${i.name}.useVmac is not set.";
+    }
+  ] ++ flatten (map (virtualIpAssertions i.name) i.virtualIps);
+
+  virtualIpAssertions = vrrpName: ip: [
+    { assertion = ip.addr != "";
+      message = "The 'addr' option for an services.keepalived.vrrpInstances.${vrrpName}.virtualIps entry cannot be empty.";
+    }
+  ];
+
+  pidFile = "/run/keepalived.pid";
+
+in
+{
+
+  options = {
+    services.keepalived = {
+
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to enable Keepalived.
+        '';
+      };
+
+      snmp = {
+
+        enable = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Whether to enable the builtin AgentX subagent.
+          '';
+        };
+
+        socket = mkOption {
+          type = types.nullOr types.str;
+          default = null;
+          description = ''
+            Socket to use for connecting to SNMP master agent. If this value is
+            set to null, keepalived's default will be used, which is
+            unix:/var/agentx/master, unless using a network namespace, when the
+            default is udp:localhost:705.
+          '';
+        };
+
+        enableKeepalived = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Enable SNMP handling of vrrp element of KEEPALIVED MIB.
+          '';
+        };
+
+        enableChecker = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Enable SNMP handling of checker element of KEEPALIVED MIB.
+          '';
+        };
+
+        enableRfc = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Enable SNMP handling of RFC2787 and RFC6527 VRRP MIBs.
+          '';
+        };
+
+        enableRfcV2 = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Enable SNMP handling of RFC2787 VRRP MIB.
+          '';
+        };
+
+        enableRfcV3 = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Enable SNMP handling of RFC6527 VRRP MIB.
+          '';
+        };
+
+        enableTraps = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Enable SNMP traps.
+          '';
+        };
+
+      };
+
+      vrrpInstances = mkOption {
+        type = types.attrsOf (types.submodule (import ./vrrp-options.nix {
+          inherit lib;
+        }));
+        default = {};
+        description = "Declarative vhost config";
+      };
+
+      extraGlobalDefs = mkOption {
+        type = types.lines;
+        default = "";
+        description = ''
+          Extra lines to be added verbatim to the 'global_defs' block of the
+          configuration file
+        '';
+      };
+
+      extraConfig = mkOption {
+        type = types.lines;
+        default = "";
+        description = ''
+          Extra lines to be added verbatim to the configuration file.
+        '';
+      };
+
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    assertions = flatten (map vrrpInstanceAssertions vrrpInstances);
+
+    systemd.timers.keepalived-boot-delay = {
+      description = "Keepalive Daemon delay to avoid instant transition to MASTER state";
+      after = [ "network.target" "network-online.target" "syslog.target" ];
+      requires = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+      timerConfig = {
+        OnActiveSec = "5s";
+        Unit = "keepalived.service";
+      };
+    };
+
+    systemd.services.keepalived = {
+      description = "Keepalive Daemon (LVS and VRRP)";
+      after = [ "network.target" "network-online.target" "syslog.target" ];
+      wants = [ "network-online.target" ];
+      serviceConfig = {
+        Type = "forking";
+        PIDFile = pidFile;
+        KillMode = "process";
+        ExecStart = "${pkgs.keepalived}/sbin/keepalived"
+          + " -f ${keepalivedConf}"
+          + " -p ${pidFile}"
+          + optionalString cfg.snmp.enable " --snmp";
+        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+        Restart = "always";
+        RestartSec = "1s";
+      };
+    };
+  };
+}

nixos/modules/services/networking/keepalived/virtual-ip-options.nix

@@ -0,0 +1,50 @@
+{ lib } :
+
+with lib;
+{
+  options = {
+
+    addr = mkOption {
+      type = types.str;
+      description = ''
+        IP address, optionally with a netmask: IPADDR[/MASK]
+      '';
+    };
+
+    brd = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = ''
+        The broadcast address on the interface.
+      '';
+    };
+
+    dev = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = ''
+        The name of the device to add the address to.
+      '';
+    };
+
+    scope = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = ''
+        The scope of the area where this address is valid.
+      '';
+    };
+
+    label = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = ''
+        Each address may be tagged with a label string. In order to preserve
+        compatibility with Linux-2.0 net aliases, this string must coincide with
+        the name of the device or must be prefixed with the device name followed
+        by colon.
+      '';
+    };
+
+  };
+}

nixos/modules/services/networking/keepalived/vrrp-options.nix

@@ -0,0 +1,121 @@
+{ lib } :
+
+with lib;
+{
+  options = {
+
+    interface = mkOption {
+      type = types.str;
+      description = ''
+        Interface for inside_network, bound by vrrp.
+      '';
+    };
+
+    state = mkOption {
+      type = types.enum [ "MASTER" "BACKUP" ];
+      default = "BACKUP";
+      description = ''
+        Initial state. As soon as the other machine(s) come up, an election will
+        be held and the machine with the highest "priority" will become MASTER.
+        So the entry here doesn't matter a whole lot.
+      '';
+    };
+
+    virtualRouterId = mkOption {
+      type = types.int;
+      description = ''
+        Arbitrary unique number 0..255. Used to differentiate multiple instances
+        of vrrpd running on the same NIC (and hence same socket).
+      '';
+    };
+
+    priority = mkOption {
+      type = types.int;
+      default = 100;
+      description = ''
+        For electing MASTER, highest priority wins. To be MASTER, make 50 more
+        than other machines.
+      '';
+    };
+
+    noPreempt = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        VRRP will normally preempt a lower priority machine when a higher
+        priority machine comes online. "nopreempt" allows the lower priority
+        machine to maintain the master role, even when a higher priority machine
+        comes back online. NOTE: For this to work, the initial state of this
+        entry must be BACKUP.
+      '';
+    };
+
+    useVmac = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Use VRRP Virtual MAC.
+      '';
+    };
+
+    vmacInterface = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = ''
+         Name of the vmac interface to use. keepalived will come up with a name
+         if you don't specify one.
+      '';
+    };
+
+    vmacXmitBase = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Send/Recv VRRP messages from base interface instead of VMAC interface.
+      '';
+    };
+
+    unicastSrcIp = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = ''
+         Default IP for binding vrrpd is the primary IP on interface. If you
+         want to hide location of vrrpd, use this IP as src_addr for unicast
+         vrrp packets.
+      '';
+    };
+
+    unicastPeers = mkOption {
+      type = types.listOf types.str;
+      default = [];
+      description = ''
+        Do not send VRRP adverts over VRRP multicast group. Instead it sends
+        adverts to the following list of ip addresses using unicast design
+        fashion. It can be cool to use VRRP FSM and features in a networking
+        environment where multicast is not supported! IP Addresses specified can
+        IPv4 as well as IPv6.
+      '';
+    };
+
+    virtualIps = mkOption {
+      type = types.listOf (types.submodule (import ./virtual-ip-options.nix {
+        inherit lib;
+      }));
+      default = [];
+      example = literalExample ''
+        TODO: Example
+      '';
+      description = "Declarative vhost config";
+    };
+
+    extraConfig = mkOption {
+      type = types.lines;
+      default = "";
+      description = ''
+        Extra lines to be added verbatim to the vrrp_instance section.
+      '';
+    };
+
+  };
+
+}

nixos/modules/services/x11/display-managers/default.nix

@@ -32,14 +32,8 @@ let
     ''
       #! ${pkgs.bash}/bin/bash
 
-      # SDDM splits "Exec" line in .desktop file by whitespace and pass script path as $1
-      if [[ "$0" = "$1" ]]; then
-        # remove superfluous $1 again
-        shift
-        # join arguments again and evaluate them in a shell context
-        # to interpret shell quoting
-        eval exec "$0" "$@"
-      fi
+      # Handle being called by SDDM.
+      if test "''${1:0:1}" = / ; then eval exec $1 $2 ; fi
 
       ${optionalString cfg.displayManager.logToJournal ''
         if [ -z "$_DID_SYSTEMD_CAT" ]; then

nixos/modules/services/x11/unclutter.nix

@@ -60,7 +60,10 @@ in {
       serviceConfig.ExecStart = ''
         ${cfg.package}/bin/unclutter \
           -idle ${toString cfg.timeout} \
-          -display :${toString config.services.xserver.display} \
+          -display :${toString (
+             let display = config.services.xserver.display;
+             in if display != null then display else 0
+          )} \
           -jitter ${toString (cfg.threeshold - 1)} \
           ${optionalString cfg.keystroke "-keystroke"} \
           ${concatMapStrings (x: " -"+x) cfg.extraOptions} \

nixos/modules/system/boot/loader/grub/grub.nix

@@ -383,7 +383,7 @@ in
         default = false;
         type = types.bool;
         description = ''
-          <para>Whether to invoke <literal>grub-install</literal> with
+          Whether to invoke <literal>grub-install</literal> with
           <literal>--removable</literal>.</para>
 
           <para>Unless you turn this on, GRUB will install itself somewhere in
@@ -412,7 +412,7 @@ in
             the NVRAM state of the computer (like a USB "removable" drive)</para></listitem>
             <listitem><para>You simply dislike the idea of depending on NVRAM
             state to make your drive bootable</para></listitem>
-          </itemizedlist></para>
+          </itemizedlist>
         '';
       };
 

nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py

@@ -1,4 +1,4 @@
-#! @python3@/bin/python3
+#! @python3@/bin/python3 -B
 import argparse
 import shutil
 import os

nixos/tests/misc.nix

@@ -122,7 +122,7 @@ import ./make-test.nix ({ pkgs, ...} : {
 
       # Test hidepid
       subtest "hidepid", sub {
-          $machine->succeed("grep -Fq hidepid=2 /etc/mtab");
+          $machine->succeed("grep -Fq hidepid=2 /proc/mounts");
           $machine->succeed("[ `su - sybil -c 'pgrep -c -u root'` = 0 ]");
           $machine->succeed("[ `su - alice -c 'pgrep -c -u root'` != 0 ]");
       };

pkgs/applications/altcoins/default.nix

@@ -35,6 +35,7 @@ rec {
   namecoind = callPackage ./namecoind.nix { };
 
   ethabi = callPackage ./ethabi.nix { };
+  ethrun = callPackage ./ethrun.nix { };
 
   primecoin  = callPackage ./primecoin.nix { withGui = true; };
   primecoind = callPackage ./primecoin.nix { withGui = false; };

pkgs/applications/altcoins/ethrun.nix

@@ -0,0 +1,24 @@
+{ stdenv, fetchFromGitHub, rustPlatform }:
+
+with rustPlatform;
+
+buildRustPackage rec {
+  name = "ethrun-${version}";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "dapphub";
+    repo = "ethrun";
+    rev = "v${version}";
+    sha256 = "1w651g4p2mc4ljp20l8lwvfx3l3fzyp6gf2izr85vyb1wjbaccqn";
+  };
+
+  depsSha256 = "14x8pbjgkz0g724lnvd9mi2alqd6fipjljw6xsraf9gqwijn1knq";
+
+  meta = {
+    description = "Directly run Ethereum bytecode";
+    homepage = https://github.com/dapphub/ethrun/;
+    maintainers = [stdenv.lib.maintainers.dbrock];
+    inherit version;
+  };
+}

pkgs/applications/editors/atom/env.nix

@@ -10,6 +10,7 @@ let
     xorg.libXrender xorg.libX11 xorg.libXext xorg.libXdamage xorg.libXtst
     xorg.libXcomposite xorg.libXi xorg.libXfixes xorg.libXrandr
     xorg.libXcursor xorg.libxkbfile xorg.libXScrnSaver libcap systemd libnotify
+    xorg.libxcb
   ];
 
   libPathNative = lib.makeLibraryPath packages;

pkgs/applications/editors/emacs-modes/elpa-generated.nix

@@ -175,10 +175,10 @@
       }) {};
     auctex = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
         pname = "auctex";
-        version = "11.90.0";
+        version = "11.90.1";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/auctex-11.90.0.tar";
-          sha256 = "04nsndwcf0dimgc2p1yzzrymc36amzdnjg0158nxplmjkzdp28gy";
+          url = "https://elpa.gnu.org/packages/auctex-11.90.1.tar";
+          sha256 = "0bn5pg6v7zgqxs080bzrsx6789nzdx4622m3020ymzl66017nf0r";
         };
         packageRequires = [];
         meta = {
@@ -644,10 +644,10 @@
     el-search = callPackage ({ elpaBuild, emacs, fetchurl, lib, stream }:
     elpaBuild {
         pname = "el-search";
-        version = "1.3";
+        version = "1.3.1";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/el-search-1.3.tar";
-          sha256 = "0hg7jppdsaxy285bdaban1i096bjx21pqmczz7w9f3nr34n28pyn";
+          url = "https://elpa.gnu.org/packages/el-search-1.3.1.tar";
+          sha256 = "01f5pyalw60dr36w007mvvxry548zrhixzmba1sad19531bry7fc";
         };
         packageRequires = [ emacs stream ];
         meta = {
@@ -681,14 +681,14 @@
           license = lib.licenses.free;
         };
       }) {};
-    enwc = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
+    enwc = callPackage ({ elpaBuild, emacs, fetchurl, lib }: elpaBuild {
         pname = "enwc";
-        version = "1.0";
+        version = "2.0";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/enwc-1.0.tar";
-          sha256 = "19mjkcgnacygzwm5dsayrwpbzfxadp9kdmmghrk1vir2hwixgv8y";
+          url = "https://elpa.gnu.org/packages/enwc-2.0.tar";
+          sha256 = "17w35b06am5n19nlq00ni5w3jvys9i7swyw4glb7081d2jbij2mn";
         };
-        packageRequires = [];
+        packageRequires = [ emacs ];
         meta = {
           homepage = "https://elpa.gnu.org/packages/enwc.html";
           license = lib.licenses.free;
@@ -940,10 +940,10 @@
       }) {};
     ivy = callPackage ({ elpaBuild, emacs, fetchurl, lib }: elpaBuild {
         pname = "ivy";
-        version = "0.9.0";
+        version = "0.9.1";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/ivy-0.9.0.tar";
-          sha256 = "1p5gfy16xik613ib30mv4yac004z4lpsybmraln1badyd6n3b07s";
+          url = "https://elpa.gnu.org/packages/ivy-0.9.1.tar";
+          sha256 = "1jfc3zf6ln7i8pp5j0fpsai2w847v5g77b5fzlxbgvj80g3v5887";
         };
         packageRequires = [ emacs ];
         meta = {

pkgs/applications/kde/default.nix

@@ -75,6 +75,7 @@ let
       kio-extras = callPackage ./kio-extras.nix {};
       kmime = callPackage ./kmime.nix {};
       kmix = callPackage ./kmix.nix {};
+      kolourpaint = callPackage ./kolourpaint.nix {};
       kompare = callPackage ./kompare.nix {};
       konsole = callPackage ./konsole.nix {};
       krfb = callPackage ./krfb.nix {};

pkgs/applications/kde/kolourpaint.nix

@@ -0,0 +1,28 @@
+{ lib
+, kdeApp
+, kdeWrapper
+, extra-cmake-modules
+, kdoctools
+, kdelibs4support
+, libkexiv2
+}:
+
+let
+  unwrapped =
+    kdeApp {
+      name = "kolourpaint";
+      nativeBuildInputs = [ extra-cmake-modules kdoctools ];
+      propagatedBuildInputs = [
+        kdelibs4support
+        libkexiv2
+      ];
+
+      meta = {
+        maintainers = [ lib.maintainers.fridh ];
+        license = with lib.licenses; [ gpl2 ];
+      };
+    };
+in kdeWrapper {
+  inherit unwrapped;
+  targets = ["bin/kolourpaint"];
+}

pkgs/applications/misc/tint2/default.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   name = "tint2-${version}";
-  version = "0.12.12";
+  version = "0.14.1";
 
   src = fetchFromGitLab {
     owner = "o9000";
     repo = "tint2";
     rev = version;
-    sha256 = "0zgcdancsna95sjxslack9lh8f6qnj8d5wm02891mshn2jhgins3";
+    sha256 = "1wxz8sbv4cx3d3s5mbrzffidi3nayh1g6bd8m1ndz61jhv01ypam";
   };
 
   enableParallelBuilding = true;

pkgs/applications/networking/browsers/firefox/default.nix

@@ -4,7 +4,7 @@
 , yasm, mesa, sqlite, unzip, makeWrapper
 , hunspell, libevent, libstartup_notification, libvpx
 , cairo, gstreamer, gst-plugins-base, icu, libpng, jemalloc, libpulseaudio
-, autoconf213, which
+, autoconf213, which, cargo, rustc
 , writeScript, xidel, common-updater-scripts, coreutils, gnused, gnugrep, curl
 , enableGTK3 ? false, gtk3, wrapGAppsHook
 , debugBuild ? false
@@ -48,7 +48,9 @@ common = { pname, version, sha512, updateScript }: stdenv.mkDerivation rec {
     ++ lib.optional enableGTK3 gtk3
     ++ lib.optionals (!passthru.ffmpegSupport) [ gstreamer gst-plugins-base ];
 
-  nativeBuildInputs = [ autoconf213 which gnused pkgconfig perl python ] ++ lib.optional enableGTK3 wrapGAppsHook;
+  nativeBuildInputs =
+    [ autoconf213 which gnused pkgconfig perl python cargo rustc ]
+    ++ lib.optional enableGTK3 wrapGAppsHook;
 
   configureFlags =
     [ "--enable-application=browser"
@@ -151,8 +153,8 @@ in {
 
   firefox-unwrapped = common {
     pname = "firefox";
-    version = "52.0.2";
-    sha512 = "15668625d212acf874b560d0adf738faf3e0df532c549ab94e1d91944542e13bf16265f08fca1eded42820f9b7ad3f0ff70a8b5bc9adde0a79d11e022bb1158e";
+    version = "53.0";
+    sha512 = "36ec810bab58e3d99478455a38427a5efbc74d6dd7d4bb93b700fd7429b9b89250efd0abe4609091483991802090c6373c8434dfc9ba64c79a778e51fd2a2886";
     updateScript = import ./update.nix {
       attrPath = "firefox-unwrapped";
       inherit writeScript lib common-updater-scripts xidel coreutils gnused gnugrep curl;
@@ -161,8 +163,8 @@ in {
 
   firefox-esr-unwrapped = common {
     pname = "firefox-esr";
-    version = "52.0.2esr";
-    sha512 = "a0f31479e5265c7f40d3013c3dc8368c6bdf03f21f1c9054fb2ae5557065584da433b288b493680d6147a3b11155f41bd33ad2a5d53c6eaa507258c7e00d7335";
+    version = "52.1.0esr";
+    sha512 = "ba833904654eda347f83df77e04c8e81572772e8555f187b796ecc30e498b93fb729b6f60935731d9584169adc9d61329155364fddf635cbd11abebe4a600247";
     updateScript = import ./update.nix {
       attrPath = "firefox-esr-unwrapped";
       versionSuffix = "esr";

pkgs/applications/networking/browsers/torbrowser/default.nix

@@ -81,19 +81,19 @@ let
   fteLibPath = makeLibraryPath [ stdenv.cc.cc gmp ];
 
   # Upstream source
-  version = "6.5.1";
+  version = "6.5.2";
 
   lang = "en-US";
 
   srcs = {
     "x86_64-linux" = fetchurl {
       url = "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz";
-      sha256 = "1p2bgavvyzahqpjg9vp14c0s50rmha3v1hs1c8zvz6fj8fgrhn0i";
+      sha256 = "0jn98arczlgjigpmql1qg5b7izabv4zy4mji6vvcg3b8g1ma108r";
     };
 
     "i686-linux" = fetchurl {
       url = "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz";
-      sha256 = "1zfghr01bhpn39wqaw7hyx7yap7xyla4m3mrgz2vi9a5qsyxmbcr";
+      sha256 = "0micxgkbys0py4bj6csbc8xz4gq0x5v2zirgi38krnm5x5riqj3w";
     };
   };
 in

pkgs/applications/networking/dropbox/default.nix

@@ -1,9 +1,9 @@
-{ stdenv, fetchurl, makeDesktopItem, patchelf, makeWrapper
+{ stdenv, fetchurl, makeDesktopItem, patchelf, makeWrapper, makeQtWrapper
 , dbus_libs, fontconfig, freetype, gcc, glib
 , libdrm, libffi, libICE, libSM
 , libX11, libXcomposite, libXext, libXmu, libXrender, libxcb
 , libxml2, libxslt, ncurses, zlib
-, qtbase, qtdeclarative, qtwebkit, makeQtWrapper
+, qtbase, qtdeclarative, qtwebkit, wmctrl
 }:
 
 # this package contains the daemon version of dropbox
@@ -23,11 +23,11 @@
 let
   # NOTE: When updating, please also update in current stable,
   # as older versions stop working
-  version = "23.4.19";
+  version = "24.4.16";
   sha256 =
     {
-      "x86_64-linux" = "09vjic4yi6g6rbliz4b56swqdpjgw0m7gs2n40xhvbqfd35prafs";
-      "i686-linux"   = "0i2x2s7p1lq315z8198wjlfqr5lqj3mxdcqxz44skrbkmqfd9hab";
+      "x86_64-linux" = "01hnx52ag7wfclxnqzs9m09pnmisz9lczxgg3wm47qmwhagnb8la";
+      "i686-linux"   = "1cr0vfjwn60xdv2kh6kmmgf6g0s2y9mqklbfah59pm7k2yr2pvnf";
     }."${stdenv.system}" or (throw "system ${stdenv.system} not supported");
 
   arch =
@@ -98,6 +98,9 @@ in stdenv.mkDerivation {
       --prefix LD_LIBRARY_PATH : "$RPATH"
 
     chmod 755 $out/${appdir}/dropbox
+
+    rm $out/${appdir}/wmctrl
+    ln -s ${wmctrl}/bin/wmctrl $out/${appdir}/wmctrl
   '';
 
   fixupPhase = ''

pkgs/applications/networking/instant-messengers/dino/default.nix

@@ -0,0 +1,62 @@
+{ stdenv, fetchFromGitHub
+, vala, cmake, wrapGAppsHook, pkgconfig, gettext
+, gobjectIntrospection, gnome3, glib, gdk_pixbuf, gtk3, glib_networking
+, xorg, libXdmcp, libxkbcommon
+, libnotify
+, libgcrypt
+, epoxy
+, at_spi2_core
+, sqlite
+, dbus
+, gpgme
+, pcre
+ }:
+
+stdenv.mkDerivation rec {
+  name = "dino-unstable-2017-04-20";
+
+  src = fetchFromGitHub {
+    owner = "dino";
+    repo = "dino";
+    rev = "5c8275ed4efdc7a3a0bc2a9c3a3f46d0383ddcf4";
+    sha256 = "12k3s8k8wmjyg5m0f4f2vp83bp0m9swmrsms81yd1722z3ragxsf";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    vala
+    cmake
+    pkgconfig
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    gobjectIntrospection
+    glib_networking
+    glib
+    gnome3.libgee
+    sqlite
+    gdk_pixbuf
+    gtk3
+    libnotify
+    gpgme
+    libgcrypt
+    pcre
+    xorg.libxcb
+    xorg.libpthreadstubs
+    libXdmcp
+    libxkbcommon
+    epoxy
+    at_spi2_core
+    dbus
+    gettext
+  ];
+
+  meta = with stdenv.lib; {
+    description = "Modern Jabber/XMPP Client using GTK+/Vala";
+    homepage = https://github.com/dino/dino;
+    license = licenses.gpl3;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.mic92 ];
+  };
+}

pkgs/applications/networking/instant-messengers/pidgin-plugins/carbons/default.nix

@@ -0,0 +1,25 @@
+{ stdenv, libxml2, pidgin, pkgconfig, fetchFromGitHub } :
+
+stdenv.mkDerivation rec {
+  name = "pidgin-carbons-${version}";
+  version = "0.1.3";
+
+  src = fetchFromGitHub {
+    owner = "gkdr";
+    repo  = "carbons";
+    rev   = "v${version}";
+    sha256 = "05hcqvsirb7gnpfcszsrgal5q7dajl2wdi2dy7c41zgl377syavw";
+  };
+
+  makeFlags = [ "PURPLE_PLUGIN_DIR=$(out)/lib/pidgin" ];
+
+  buildInputs = [ libxml2 pidgin pkgconfig ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/gkdr/carbons";
+    description = "XEP-0280: Message Carbons plugin for libpurple";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ jb55 ];
+  };
+}

pkgs/applications/networking/mailreaders/mutt/default.nix

@@ -20,11 +20,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "mutt-${version}";
-  version = "1.8.1";
+  version = "1.8.2";
 
   src = fetchurl {
     url = "http://ftp.mutt.org/pub/mutt/${name}.tar.gz";
-    sha256 = "1b8dggq5x1b77a9i9250b3jhv2iddfzhr9rix1yfzckdms65mr8b";
+    sha256 = "0dgjjryp1ggbc6ivy9cfz5jl3gnbahb6d6hcwn7c7wk5npqpn18x";
   };
 
   patchPhase = optionalString (openssl != null) ''

pkgs/applications/office/mytetra/default.nix

@@ -0,0 +1,34 @@
+{ stdenv, fetchurl, qmakeHook, makeQtWrapper, qtsvg }:
+
+let
+  version = "1.42.2";
+in stdenv.mkDerivation rec {
+  name = "mytetra-${version}";
+  src = fetchurl {
+    url = "https://github.com/xintrea/mytetra_dev/archive/v.${version}.tar.gz";
+    sha256 = "1ah44nf4ksxkh01a2zmgvvby4pwczhyq5vcp270rf6visp8v9804";
+  };
+
+  buildInputs = [ qmakeHook makeQtWrapper qtsvg ];
+
+  hardeningDisable = [ "format" ];
+
+  preBuild = ''
+    substituteInPlace mytetra.pro \
+      --replace /usr/local/bin $out/bin \
+      --replace /usr/share $out/share
+
+    substituteInPlace src/views/mainWindow/MainWindow.cpp \
+      --replace ":/resource/pic/logo.svg" "$out/share/icons/hicolor/48x48/apps/mytetra.png"
+  '';
+
+  postInstall = "wrapQtProgram $out/bin/mytetra";
+
+  meta = with stdenv.lib; {
+    description = "Smart manager for information collecting";
+    homepage = http://webhamster.ru/site/page/index/articles/projectcode/138;
+    license = licenses.gpl3;
+    maintainers = [ maintainers.gnidorah ];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/version-management/git-and-tools/default.nix

@@ -74,6 +74,10 @@ rec {
 
   git-radar = callPackage ./git-radar { };
 
+  git-recent = callPackage ./git-recent {
+    utillinux = if stdenv.isLinux then utillinuxMinimal else null;
+  };
+
   git-remote-hg = callPackage ./git-remote-hg { };
 
   git-stree = callPackage ./git-stree { };

pkgs/applications/version-management/git-and-tools/git-recent/default.nix

@@ -0,0 +1,41 @@
+{stdenv, git, less, fetchFromGitHub, makeWrapper
+# utillinuxMinimal is included because we need the column command
+, utillinux ? null
+}:
+
+assert stdenv.isLinux -> utillinux != null;
+
+let
+  binpath = stdenv.lib.makeBinPath
+    ([ git less ]
+    ++ stdenv.lib.optional (utillinux != null) utillinux);
+in stdenv.mkDerivation rec {
+  name = "git-recent-${version}";
+  version = "1.0.3";
+
+  src = fetchFromGitHub {
+    owner = "paulirish";
+    repo = "git-recent";
+    rev = "v${version}";
+    sha256 = "0rckjjrw2xmvmbqaf66i36x59vs1v4pfnmvbinx5iggp7vjly1a4";
+  };
+
+  buildInputs = [ makeWrapper ];
+
+  buildPhase = null;
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp git-recent $out/bin
+    wrapProgram $out/bin/git-recent \
+      --prefix PATH : "${binpath}"
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/paulirish/git-recent;
+    description = "See your latest local git branches, formatted real fancy";
+    license = licenses.mit;
+    platforms = platforms.all;
+    maintainers = [ maintainers.jlesquembre ];
+  };
+}

pkgs/applications/version-management/git-lfs/default.nix

@@ -1,30 +1,33 @@
-{ stdenv, lib, buildGoPackage, fetchFromGitHub }:
+{ stdenv, buildGoPackage, fetchFromGitHub }:
 
 buildGoPackage rec {
   name = "git-lfs-${version}";
-  # NOTE: use versions after 1.2.1
-  version = "1.3.1";
-  rev = "9c9dffb1b5baddfa06f280ef1b5fbf68ecbc90b1";
+  version = "2.0.2";
+  rev = "85e2aec4d949517b4a7a53e4f745689331952b6c";
 
-  goPackagePath = "github.com/github/git-lfs";
+  goPackagePath = "github.com/git-lfs/git-lfs";
 
   src = fetchFromGitHub {
     inherit rev;
-    owner = "github";
+    owner = "git-lfs";
     repo = "git-lfs";
-    sha256 = "0fg48jxh0gmd0w5yy3avascaasxk85019qayaikzfkym8bdqplb2";
+    sha256 = "0cvs17rd4qgaqj9vz6pwx9y3ni8c99gzykc3as92x37962nmq5cy";
   };
 
-  # Tests fail with 'lfstest-gitserver.go:46: main redeclared in this block'
-  excludedPackages = [ "test" ];
-
   preBuild = ''
-    pushd go/src/github.com/github/git-lfs
+    pushd go/src/github.com/git-lfs/git-lfs
     go generate ./commands
     popd
   '';
 
   postInstall = ''
-    rm -v $bin/bin/{man,script}
+    rm -v $bin/bin/{man,script,genmakefile}
   '';
+
+  meta = with stdenv.lib; {
+    description = "Git extension for versioning large files";
+    homepage    = https://git-lfs.github.com/;
+    license     = [ licenses.mit ];
+    maintainers = [ maintainers.twey ];
+  };
 }

pkgs/applications/version-management/gitkraken/default.nix

@@ -9,11 +9,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "gitkraken-${version}";
-  version = "2.3.3";
+  version = "2.4.0";
 
   src = fetchurl {
     url = "https://release.gitkraken.com/linux/v${version}.deb";
-    sha256 = "a6e235ab1a4c1da755af8218ad819fcac6bc89b1a324aa2c0e430f3805cb1a16";
+    sha256 = "1s95wnlyy41s8gy7vq4k8w03qrhxq56fr7idsrgvcv065cf5hqmd";
   };
 
   libPath = makeLibraryPath [

pkgs/applications/version-management/mercurial/default.nix

@@ -4,7 +4,7 @@
 
 let
   # if you bump version, update pkgs.tortoisehg too or ping maintainer
-  version = "3.9.2";
+  version = "4.1.1";
   name = "mercurial-${version}";
   inherit (python2Packages) docutils hg-git dulwich python;
 in python2Packages.buildPythonApplication {
@@ -13,7 +13,7 @@ in python2Packages.buildPythonApplication {
 
   src = fetchurl {
     url = "https://mercurial-scm.org/release/${name}.tar.gz";
-    sha256 = "1kw3cpcjygfapvi5c123limhpbkmg7is2i81pybk1s05gi16l139";
+    sha256 = "17imsf4haqgw364p1z9i416jinmfxfia537b84hcg0rg43hinmv3";
   };
 
   inherit python; # pass it so that the same version can be used in hg2git

pkgs/applications/version-management/tortoisehg/default.nix

@@ -2,11 +2,11 @@
 
 python2Packages.buildPythonApplication rec {
     name = "tortoisehg-${version}";
-    version = "3.9.2";
+    version = "4.1.1";
 
     src = fetchurl {
       url = "https://bitbucket.org/tortoisehg/targz/downloads/${name}.tar.gz";
-      sha256 = "17wcsf91z7dnb7c8vyagasj5vvmas6ms5lx1ny4pnm94qzslkfh2";
+      sha256 = "14fy5p5hx4iij5kyma9679nrprd9lsjr6j047bfyfrwa3l4knj2g";
     };
 
     pythonPath = with python2Packages; [ pyqt4 mercurial qscintilla iniparse ];

pkgs/applications/video/vlc/default.nix

@@ -27,6 +27,12 @@ stdenv.mkDerivation rec {
     sha256 = "1gjkrwlg8ab3skzl67cxb9qzg4187ifckd1z9kpy11q058fyjchn";
   };
 
+  patches = optional withQt5 (fetchurl {
+    name = "Fix-build-using-old-GCC-intrinsics.patch";
+    url = "https://patches.videolan.org/patch/14061/raw/";
+    sha256 = "16v4k7378a590diz11bdvdaqi9cpf6333hp5wr6v5sfrsma8qvpx";
+  });
+
   # Comment-out the Qt 5.5 version check, as we do apply the relevant patch.
   # https://trac.videolan.org/vlc/ticket/16497
   postPatch = if (!withQt5) then null else
@@ -50,6 +56,15 @@ stdenv.mkDerivation rec {
 
   LIVE555_PREFIX = live555;
 
+  preConfigure = ''
+    sed -e "s@/bin/echo@echo@g" -i configure
+  '' + optionalString withQt5 ''
+    # Make sure we only *add* "-std=c++11" to CXXFLAGS instead of overriding the
+    # values figured out by configure (for example "-g -O2").
+    sed -i -re '/^ *CXXFLAGS=("[^$"]+")? *$/s/CXXFLAGS="?/&-std=c++11 /' \
+      configure
+  '';
+
   configureFlags =
     [ "--enable-alsa"
       "--with-kde-solid=$out/share/apps/solid/actions"
@@ -61,8 +76,6 @@ stdenv.mkDerivation rec {
     ]
     ++ optional onlyLibVLC  "--disable-vlc";
 
-  preConfigure = ''sed -e "s@/bin/echo@echo@g" -i configure'';
-
   enableParallelBuilding = true;
 
   preBuild = ''
@@ -76,9 +89,5 @@ stdenv.mkDerivation rec {
     homepage = http://www.videolan.org/vlc/;
     platforms = platforms.linux;
     license = licenses.lgpl21Plus;
-    broken =
-      if withQt5
-      then builtins.compareVersions qtbase.version "5.7.0" >= 0
-      else false;
   };
 }

pkgs/applications/virtualization/qemu/default.nix

@@ -18,7 +18,7 @@
 
 with stdenv.lib;
 let
-  version = "2.8.0";
+  version = "2.8.1";
   audio = optionalString (hasSuffix "linux" stdenv.system) "alsa,"
     + optionalString pulseSupport "pa,"
     + optionalString sdlSupport "sdl,";
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "http://wiki.qemu.org/download/qemu-${version}.tar.bz2";
-    sha256 = "0qjy3rcrn89n42y5iz60kgr0rrl29hpnj8mq2yvbc1wrcizmvzfs";
+    sha256 = "1kdv8aa800rbsz9qnm4saw79vr052p83by21ryah68ics9z4r3h1";
   };
 
   buildInputs =
@@ -64,80 +64,52 @@ stdenv.mkDerivation rec {
     ./no-etc-install.patch
 
     # bugfixes
-    (fetchurl {
-      name = "qemu-vnc-do-not-disconnect-on-EAGAIN.patch";
-      url = "https://anonscm.debian.org/cgit/pkg-qemu/qemu.git/plain/debian/patches/vnc-do-not-disconnect-on-EAGAIN.patch?h=debian/qemu_2.8%2bdfsg-3";
-      sha256 = "1nqhfgfw1pzhid094pk204qy36r6n7w1yilsiwabgcsyxs5bymnh";
-    })
-
+    # xhci: fix event queue IRQ handling
     (upstreamPatch "qemu-fix-win7-xhci" "7da76e12cc5cc902dda4c168d8d608fd4e61cbc5"
       "0m1ggbxziy7vqz9007ypzg23cni8cc4db36wlnhxz0kdpq70c6x0")
 
+    # xhci: only free completed transfers
     (upstreamPatch "qemu-xhci-free-completed-transfers" "f94d18d6c6df388fde196d3ab252f57e33843a8b"
       "0lk19qss6ky7cqnvis54742cr2z0vl8c64chhch0kp6n83hray9x")
 
-    # security fixes from debian
-    (fetchurl {
-      name = "CVE-2016-9602.patch";
-      url = "https://anonscm.debian.org/cgit/pkg-qemu/qemu.git/plain/debian/patches/9pfs-symlink-attack-fixes-CVE-2016-9602.patch?h=debian/qemu_2.8%2bdfsg-3";
-      sha256 = "0f7m1k3hbw9v0dwqn53ds36s7s334vlidvbn0682s9r2sq0sjlkv";
-    })
-
-    (fetchurl {
-      name = "CVE-2017-2630.patch";
-      url = "https://anonscm.debian.org/cgit/pkg-qemu/qemu.git/plain/debian/patches/nbd_client-fix-drop_sync-CVE-2017-2630.patch?h=debian/qemu_2.8%2bdfsg-3";
-      sha256 = "1gdxaari53iwgj3gyczz30rhg8lj6xqycxym4snw9z5vmkyj1bbq";
-    })
-
-    (fetchurl {
-      name = "CVE-2017-6058.patch";
-      url = "https://anonscm.debian.org/cgit/pkg-qemu/qemu.git/plain/debian/patches/vmxnet3-fix-memory-corruption-on-vlan-header-stripping-CVE-2017-6058.patch?h=debian/qemu_2.8%2bdfsg-3";
-      sha256 = "0w8az2cr116mnijxjd4aprl8dvfdj76gm7ddajmngdslxiax601f";
-    })
-
     # security fixes from upstream
+    # net: imx: limit buffer descriptor count
     (upstreamPatch "CVE-2016-7907" "81f17e0d435c3db3a3e67e0d32ebf9c98973211f"
       "0dzghbm3jmnyw34kd40a6akrr1cpizd9hdzqmhlc2ljab7pr1rcb")
 
+    # watchdog: 6300esb: add exit function
     (upstreamPatch "CVE-2016-10155" "eb7a20a3616085d46aa6b4b4224e15587ec67e6e"
       "1xk00fyls0hdza11dyfrnzcn6gibmmcrwy7sxgp6iizp6wgzi3vw")
 
-    (upstreamPatch "CVE-2017-2615" "62d4c6bd5263bb8413a06c80144fc678df6dfb64"
-      "0miph2x4d474issa44hmc542zxmkc7lsr4ncb7pwarq6j7v52l8h")
-
-    (upstreamPatch "CVE-2017-2620" "92f2b88cea48c6aeba8de568a45f2ed958f3c298"
-      "1kz12qmvfccy7xilsrxahbs67jycv4zjfbijxivadvx9klxs1n58")
-
+    # audio: ac97: add exit function
     (upstreamPatch "CVE-2017-5525" "12351a91da97b414eec8cdb09f1d9f41e535a401"
       "190b4aqr35p4lb3rjarknfi1ip1c9zizliqp1dd6frx4364y5yp2")
 
+    # audio: es1370: add exit function
     (upstreamPatch "CVE-2017-5526" "069eb7b2b8fc47c7cb52e5a4af23ea98d939e3da"
       "05xgzd3zldk3x2vqpjag9z5ilhdkpkyh633fb5kvnz8scns6v86f")
 
+    # serial: fix memory leak in serial exit
     (upstreamPatch "CVE-2017-5579" "8409dc884a201bf74b30a9d232b6bbdd00cb7e2b"
       "0lbcyhif1kdcy8my0bv8aqr2f421kmljcch3plrjzj9pgcm4sv83")
 
-    (upstreamPatch "CVE-2017-5667" "42922105beb14c2fc58185ea022b9f72fb5465e9"
-      "049vq70is3fj9bf4ysfj3s44iz93qhyqn6xijck32w1x6yyzqyx4")
-
-    (upstreamPatch "CVE-2017-5667-fix" "913a87885f589d263e682c2eb6637c6e14538061"
-      "0nm1k2r9n6r86dvjr16hxak2vcsinj7ijlqw5i6f4y5h2sh37wr5")
-
+    # megasas: fix guest-triggered memory leak
     (upstreamPatch "CVE-2017-5856" "765a707000e838c30b18d712fe6cb3dd8e0435f3"
       "03pjkn8l8rp9ip5h5rm1dp0nrwd43nmgpwamz4z1vy3rli1z3yjw")
 
+    # virtio-gpu: fix resource leak in virgl_cmd_resource_unref
     (upstreamPatch "CVE-2017-5857" "5e8e3c4c75c199aa1017db816fca02be2a9f8798"
       "1kz14rmxf049zl5m27apzpbvy8dk0g47n9gnwy0nm70g65rl1dh8")
 
+    # usb: ccid: check ccid apdu length
     (upstreamPatch "CVE-2017-5898" "c7dfbf322595ded4e70b626bf83158a9f3807c6a"
       "1y2j0qw04s8fl0cs8i619y08kj75lxn3c0y19g710fzpk3rq8dvn")
 
-    (upstreamPatch "CVE-2017-5931" "a08aaff811fb194950f79711d2afe5a892ae03a4"
-      "0hlih9jhbb1mb174hvxs7pf7lgcs7s9g705ri9rliw7wrhqdpja5")
-
+    # xhci: apply limits to loops
     (upstreamPatch "CVE-2017-5973" "f89b60f6e5fee3923bedf80e82b4e5efc1bb156b"
       "06niyighjxb4p5z2as3mqfmrwrzn4sq47j7raipbq9gnda7x9sw6")
 
+    # sd: sdhci: check transfer mode register in multi block transfer
     (upstreamPatch "CVE-2017-5987" "6e86d90352adf6cb08295255220295cf23c4286e"
       "09yfxf93cisx8rhm0h48ib1ibwfs420k5pqpz8dnz33nci9567jm")
 

pkgs/applications/virtualization/qemu/no-etc-install.patch

@@ -1,6 +1,6 @@
 --- a/Makefile
 +++ b/Makefile
-@@ -418,7 +418,7 @@
+@@ -461,7 +461,7 @@
  
  
  install: all $(if $(BUILD_DOCS),install-doc) \

pkgs/build-support/fetchurl/default.nix

@@ -92,7 +92,7 @@ let
 
 in
 
-if md5 != "" then throw "fetchsvnssh does not support md5 anymore, please use sha256 or sha512"
+if md5 != "" then throw "fetchurl does not support md5 anymore, please use sha256 or sha512"
 else if (!hasHash) then throw "Specify hash for fetchurl fixed-output derivation: ${stdenv.lib.concatStringsSep ", " urls_}"
 else stdenv.mkDerivation {
   name =

pkgs/build-support/rust/fetch-cargo-deps

@@ -1,3 +1,18 @@
+# copied from libgit2 source code 'repo-template.h'
+makeGitTemplate() {
+    local target="$1"
+    mkdir -p -m777 "$target/info" "$target/pack" "$target/objects" "$target/refs"
+    mkdir -p -m777 "$target/refs/heads" "$target/refs/tags" "$target/objects/info" "$target/objects/pack"
+    cat <<'EOF' > "$target/description"
+Unnamed repository; edit this file 'description' to name the repository.
+EOF
+    chmod 666 "$target/description"
+    cat <<'EOF' > "$target/info/exclude"
+# File patterns to ignore; see `git help ignore` for more information.
+# Lines that start with '#' are comments.
+EOF
+}
+
 fetchCargoDeps() {
     src=$(realpath $1)
     out=$(realpath $2)
@@ -6,6 +21,23 @@ fetchCargoDeps() {
 
     mkdir $out
 
+    # Configure git template dir to make libgit2 more deterministic
+    #
+    # Without a template dir, libgit2 defaults to /usr/share/git-core/templates,
+    # which can vary between systems if sandboxed builds aren't used.
+    #
+    # Note: we explictly set --tmpdir for mktemp here to make it more friendly
+    # for nix-shell users, where $TMPDIR is not necessarily set to NIX_BUILD_TOP
+    echo "Setting up git templatedir"
+    export GIT_TEMPLATE_DIR="$(mktemp -d --tmpdir=$NIX_BUILD_TOP git-template.XXX)"
+    makeGitTemplate "$GIT_TEMPLATE_DIR"
+    export XDG_CONFIG_HOME="$(mktemp -d --tmpdir=$NIX_BUILD_TOP home.XXX)"
+    mkdir -p $XDG_CONFIG_HOME/git
+    cat <<EOF > $XDG_CONFIG_HOME/git/config
+[init]
+  templatedir = $GIT_TEMPLATE_DIR
+EOF
+
     # Configure cargo to fetch from a local copy of the crates.io registry
 
     echo "Using rust registry from $rustRegistry"

pkgs/data/icons/elementary-icon-theme/default.nix

@@ -1,7 +1,7 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  version = "4.0.1.1";
+  version = "4.0.3";
 
   package-name = "elementary-icon-theme";
 
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://launchpad.net/elementaryicons/4.x/${version}/+download/${name}.tar.xz";
-    sha256 = "1p20569lxgkif4gzvgpisd8vg93zxd6447y634lv7ay85nq4lx76";
+    sha256 = "0i3cp0wiy4g6d6symyfv3hvmw97109lfakd4qyphabbqllc9xlxb";
   };
 
   dontBuild = true;

pkgs/data/icons/hicolor-icon-theme/default.nix

@@ -13,6 +13,6 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Default fallback theme used by implementations of the icon theme specification";
     homepage = http://icon-theme.freedesktop.org/releases/;
-    platforms = stdenv.lib.platforms.linux;
+    platforms = with stdenv.lib.platforms; linux ++ darwin;
   };
 }

pkgs/data/misc/iana-etc/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "iana-etc-${version}";
-  version = "20170328";
+  version = "20170417";
 
   src = fetchurl {
     url = "https://github.com/Mic92/iana-etc/releases/download/${version}/iana-etc-${version}.tar.gz";
-    sha256 = "0c0zgijmh035wan3pvz8ykkmkdbraml4b9kx36b4j1lj9fhgy1yk";
+    sha256 = "0gzv8ldyf3g70m4k3m50p2gbqwvxa343v2q4xcnl1jqfgw9db5wf";
   };
 
   installPhase = ''
@@ -14,9 +14,10 @@ stdenv.mkDerivation rec {
     cp services protocols $out/etc/
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     homepage = https://github.com/Mic92/iana-etc;
     description = "IANA protocol and port number assignments (/etc/protocols and /etc/services)";
-    platforms = stdenv.lib.platforms.unix;
+    platforms = platforms.unix;
+    license = licenses.mit;
   };
 }

pkgs/desktops/enlightenment/default.nix

@@ -10,4 +10,5 @@ rec {
   econnman = callPackage ./econnman.nix { };
   terminology = callPackage ./terminology.nix { };
   rage = callPackage ./rage.nix { };
+  ephoto = callPackage ./ephoto.nix { };
 }

pkgs/desktops/enlightenment/ephoto.nix

@@ -0,0 +1,39 @@
+{ stdenv, fetchurl, pkgconfig, efl }:
+
+stdenv.mkDerivation rec {
+  name = "ephoto-${version}";
+  version = "1.0";
+  
+  src = fetchurl {
+    url = "http://www.smhouston.us/stuff/${name}.tar.gz";
+    sha256 = "0l6zrk22fap6pylmzxwp6nycy8l5wdc7jza890h4zrwmpfag8w31";
+  };
+
+  nativeBuildInputs = [
+    pkgconfig
+  ];
+
+  buildInputs = [
+    efl
+ ];
+
+  NIX_CFLAGS_COMPILE = [
+    "-I${efl}/include/ecore-con-1"
+    "-I${efl}/include/ecore-evas-1"
+    "-I${efl}/include/ecore-imf-1"
+    "-I${efl}/include/ecore-input-1"
+    "-I${efl}/include/eet-1"
+    "-I${efl}/include/eldbus-1"
+    "-I${efl}/include/emile-1"
+    "-I${efl}/include/ethumb-1"
+    "-I${efl}/include/ethumb-client-1"
+  ];
+
+  meta = {
+    description = "Image viewer and editor written using the Enlightenment Foundation Libraries";
+    homepage = http://smhouston.us/ephoto/;
+    license = stdenv.lib.licenses.bsd2;
+    platforms = stdenv.lib.platforms.linux;
+    maintainers = [ stdenv.lib.maintainers.romildo ];
+  };
+}

pkgs/desktops/gnome-3/3.22/core/adwaita-icon-theme/default.nix

@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   postInstall = '' rm -rf "$out/locale" '';
 
   meta = with stdenv.lib; {
-    platforms = platforms.linux;
+    platforms = with platforms; linux ++ darwin;
     maintainers = gnome3.maintainers;
   };
 }

pkgs/desktops/mate/mate-icon-theme/default.nix

@@ -4,11 +4,11 @@ stdenv.mkDerivation rec {
   name = "mate-icon-theme-${version}";
   version = "${major-ver}.${minor-ver}";
   major-ver = "1.18";
-  minor-ver = "0";
+  minor-ver = "1";
 
   src = fetchurl {
     url = "http://pub.mate-desktop.org/releases/${major-ver}/${name}.tar.xz";
-    sha256 = "19bd9zlfc1jfdl7imvfy1vq35a0jvxq5fldmr2c5bq0kyasvww6i";
+    sha256 = "1217nza3ilmy6x3b9i1b75lpq7lpvhs18s0c2n3j6zhxdqy61nlm";
   };
 
   nativeBuildInputs = [ pkgconfig intltool iconnamingutils ];

pkgs/desktops/mate/mate-themes/default.nix

@@ -6,15 +6,15 @@ stdenv.mkDerivation rec {
   version = "${major-ver}.${minor-ver}";
   major-ver = gnome3.version;
   minor-ver = {
-    "3.20" = "16";
-    "3.22" = "7";
+    "3.20" = "19";
+    "3.22" = "10";
   }."${major-ver}";
 
   src = fetchurl {
     url = "http://pub.mate-desktop.org/releases/themes/${major-ver}/${name}.tar.xz";
     sha256 = {
-      "3.20" = "1dvzljpq6cscr82gnsqagf23inb039q84fnawraj0nhfjif11r7v";
-      "3.22" = "1kjchqkds0zj32x7cjfcq96zakcmhva1yg0nxfd6369a5nwkp5k0";
+      "3.20" = "11b8g374dkjhbs7x7khpriabvkip4dmfkma5myzfv6m54qlj3b8g";
+      "3.22" = "03ficjfxa4qpx4vcshhk2zxryivckxpw7wcjgbn8xqnjk3lgzjcb";
     }."${major-ver}";
   };
 

pkgs/desktops/xfce/panel-plugins/xfce4-whiskermenu-plugin.nix

@@ -4,7 +4,7 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
   p_name  = "xfce4-whiskermenu-plugin";
-  version = "1.6.2";
+  version = "1.7.2";
 
   name = "${p_name}-${version}";
 
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     owner = "gottcode";
     repo = "xfce4-whiskermenu-plugin";
     rev = "v${version}";
-    sha256 = "0vfyav01hynjm7p73wwbwnn2l8l9a0hkz755wmjzr6qv06f9019d";
+    sha256 = "1rpazgnjp443abc31bgi6gp9q3sgbg13v7v74nn7vf6kl4v725ah";
   };
 
   nativeBuildInputs = [ cmake pkgconfig intltool ];

pkgs/development/compilers/cmucl/binary.nix

@@ -2,7 +2,7 @@
 
 let
   inherit (stdenv) system;
-  version = "21a";
+  version = "21b";
   downloadUrl = arch:
     "http://common-lisp.net/project/cmucl/downloads/release/" +
     "${version}/cmucl-${version}-${arch}.tar.bz2";
@@ -13,7 +13,7 @@ let
   dist =
     if system == "i686-linux" then fetchDist {
         arch = "x86-linux";
-        sha256 = "0w8dcaiasfd4fbj340zaf6wcjfgc4wzkvr24gbxa5rr3aw10rl02";
+        sha256 = "13k3b5ygnbsq6n2i3r5i4ljw3r1qlskn2p5f4x9hrx6vfvbb3k7a";
       }
     else throw "Unsupported platform for cmucl.";
 in

pkgs/development/compilers/dale/default.nix

@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, cmake, libffi, llvm_35, perl }:
 
-let version = "20170416";
+let version = "20170419";
     doCheck = false;
 in stdenv.mkDerivation {
   name = "dale-${version}";
@@ -8,8 +8,8 @@ in stdenv.mkDerivation {
   src = fetchFromGitHub {
     owner = "tomhrr";
     repo = "dale";
-    rev = "ecc5ea91efef8a263c7dddd6925983df5b5258b2";
-    sha256 = "0naly7jsfriiqf68q210ay9ppcvidbwwcxksy5zwy1m17aq5kxaw";
+    rev = "64e072d0520a134b9ae8038104fa977776b6e0af";
+    sha256 = "1apvq3v6ra8x0sj8gg9yavqsyxiggh2wnh1zbw2ccpg723bssl4a";
   };
 
   buildInputs = [ cmake libffi llvm_35 ] ++
@@ -28,8 +28,10 @@ in stdenv.mkDerivation {
       S-expressions for syntax and supports syntactic macros.
     '';
     homepage = "https://github.com/tomhrr/dale";
-    license = licenses.mit;
+    license = licenses.bsd3;
     maintainers = with maintainers; [ amiloradovsky ];
-    platforms = platforms.linux;  # fails on Darwin, linking vs. FFI
+    platforms = with platforms; [ "i686-linux" "x86_64-linux" ];
+    # failed on Darwin: linker couldn't find the FFI lib
+    # failed on AArch64: because LLVM 3.5 is failed there
   };
 }

pkgs/development/compilers/halvm/2.4.0.nix

@@ -6,6 +6,7 @@ stdenv.mkDerivation rec {
   version = "2.4.0";
   name = "HaLVM-${version}";
   isHaLVM = true;
+  enableParallelBuilding = false;
   isGhcjs = false;
   src = fetchgit {
     rev = "65fad65966eb7e60f234453a35aeb564a09d2595";
@@ -31,7 +32,10 @@ stdenv.mkDerivation rec {
     patchShebangs .
   '';
   hardeningDisable = ["all"];
-  postInstall = "$out/bin/halvm-ghc-pkg recache";
+  postInstall = ''
+    patchShebangs $out/bin
+    $out/bin/halvm-ghc-pkg recache
+  '';
   passthru = {
     inherit bootPkgs;
     cross.config = "halvm";

pkgs/development/compilers/ocaml/4.04.nix

@@ -1,8 +1,8 @@
 import ./generic.nix {
   major_version = "4";
   minor_version = "04";
-  patch_version = "0";
-  sha256 = "1d2nk3kq4dyzz8dls45r13jprq5by3q8kshc8kvxzm8n4fnnvvb4";
+  patch_version = "1";
+  sha256 = "11f2kcldpad9h5ihi1crad5lvv2501iccb2g4c8m197fnjac8b12";
 
   # If the executable is stipped it does not work
   dontStrip = true;

pkgs/development/compilers/openjdk/8.nix

@@ -21,42 +21,42 @@ let
     else
       throw "openjdk requires i686-linux or x86_64 linux";
 
-  update = "121";
-  build = "13";
+  update = "131";
+  build = "11";
   baseurl = "http://hg.openjdk.java.net/jdk8u/jdk8u";
   repover = "jdk8u${update}-b${build}";
   paxflags = if stdenv.isi686 then "msp" else "m";
   jdk8 = fetchurl {
              url = "${baseurl}/archive/${repover}.tar.gz";
-             sha256 = "1ns0lnl5n05k1kgp8d6fyyk6gx57sx7rmlcc33d3vxhr58560nbv";
+             sha256 = "1k401wsickbdy50yxjd26v8qm9519kxayaj3b103cr6ygp2rd9s6";
           };
   langtools = fetchurl {
              url = "${baseurl}/langtools/archive/${repover}.tar.gz";
-             sha256 = "0vj5mnqw80r4xqlmiab7wbrkhz3rl8ijhwqplkbs42wad75lvnh8";
+             sha256 = "1qj75bb17a9czvxz7rm246w97cavglrssx0l1mkbickx0i0wamm8";
           };
   hotspot = fetchurl {
              url = "${baseurl}/hotspot/archive/${repover}.tar.gz";
-             sha256 = "0mcjjc34jvckg1f1x9v7gik3h5y4kx7skkfgzhknh14637jzb2hs";
+             sha256 = "0kh8rk5y3n4g3hyjzflc8nwc0kyakjivpwlpj1bncsm1sykw8lr8";
           };
   corba = fetchurl {
              url = "${baseurl}/corba/archive/${repover}.tar.gz";
-             sha256 = "0bxf1mrpmxgjmg40yi3ww7lh22f6h0nrvlvf5jwwzf4hb3a3998g";
+             sha256 = "0gqa58mwwyf6mbgp48j1akv1y8yq55zpwfziqrbdbpkcsaf603n7";
           };
   jdk = fetchurl {
              url = "${baseurl}/jdk/archive/${repover}.tar.gz";
-             sha256 = "10f641ngwiqr2z6hbz0xkyfh8h3z7kdxj5b1d30rgynzghf5wksr";
+             sha256 = "0ymvvi7srr9qkss20s1yg3x2mjw178bscrnxa6s8y82gsw02y820";
           };
   jaxws = fetchurl {
              url = "${baseurl}/jaxws/archive/${repover}.tar.gz";
-             sha256 = "1bgjpivlxi0qlmhvz838zzkzz26d4ly8b0c963kx0lpabz8p99xi";
+             sha256 = "0507mxvir4s536pdz45pvmahwa6s3h2yhg6rwdzrb568ab06asmi";
           };
   jaxp = fetchurl {
              url = "${baseurl}/jaxp/archive/${repover}.tar.gz";
-             sha256 = "17bcb5ic1ifk5rda1dzjd1483k9mah5npjg5dg77iyziq8kprvri";
+             sha256 = "0igbg8axk028kqs9q11m8hb5bg2fa0qcwffbpfbhilyw5gmf7cy8";
           };
   nashorn = fetchurl {
              url = "${baseurl}/nashorn/archive/${repover}.tar.gz";
-             sha256 = "19fmlipqk9qiv7jc84b0z022q403nyp7b32a5qqqcn6aavdqnf7c";
+             sha256 = "0l63zm5a7ql3xvfxy5kzazq2184mpx0zyqzinjmq7v0q573g8xak";
           };
   openjdk8 = stdenv.mkDerivation {
     name = "openjdk-8u${update}b${build}";

pkgs/development/compilers/oraclejdk/jdk8cpu-linux.nix

@@ -1,9 +1,9 @@
 import ./jdk-linux-base.nix {
   productVersion = "8";
-  patchVersion = "121";
+  patchVersion = "131";
   downloadUrl = http://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html;
-  sha256_i686 = "0k1xyg000qmd96c2r2m8l84ygn6dmjf1ih5yjzq1zry5d0aczmpp";
-  sha256_x86_64 = "1g0hh9ccmsrdfa9493k31v2vd6yiymwd1nclgjh29wxfy41h5qwp";
+  sha256_i686 = "0m3i1n1im1nlwb06wlsdajv19cd3zhrjkw8zbyjfznydn6qs4s80";
+  sha256_x86_64 = "0dhj623ya01glcl3iir9ajifcrf6awhvpk936x9cxfj8zfyibck2";
   jceName = "jce_policy-8.zip";
   jceDownloadUrl = http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html;
   sha256JCE = "0n8b6b8qmwb14lllk2lk1q1ahd3za9fnjigz5xn65mpg48whl0pk";

pkgs/development/compilers/oraclejdk/jdk8psu-linux.nix

@@ -1,9 +1,9 @@
 import ./jdk-linux-base.nix {
   productVersion = "8";
-  patchVersion = "121";
+  patchVersion = "131";
   downloadUrl = http://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html;
-  sha256_i686 = "0k1xyg000qmd96c2r2m8l84ygn6dmjf1ih5yjzq1zry5d0aczmpp";
-  sha256_x86_64 = "1g0hh9ccmsrdfa9493k31v2vd6yiymwd1nclgjh29wxfy41h5qwp";
+  sha256_i686 = "0m3i1n1im1nlwb06wlsdajv19cd3zhrjkw8zbyjfznydn6qs4s80";
+  sha256_x86_64 = "0dhj623ya01glcl3iir9ajifcrf6awhvpk936x9cxfj8zfyibck2";
   jceName = "jce_policy-8.zip";
   jceDownloadUrl = http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html;
   sha256JCE = "0n8b6b8qmwb14lllk2lk1q1ahd3za9fnjigz5xn65mpg48whl0pk";

pkgs/development/compilers/sbcl/1.2.5.nix

@@ -1,84 +0,0 @@
-{ stdenv, fetchurl, sbclBootstrap, clisp, which}:
-
-stdenv.mkDerivation rec {
-  name    = "sbcl-${version}";
-  version = "1.2.5";
-
-  src = fetchurl {
-    url    = "mirror://sourceforge/project/sbcl/sbcl/${version}/${name}-source.tar.bz2";
-    sha256 = "0nmb9amygr5flzk2z9fa6wzwqknbgd2qrkybxkxkamvbdwyayvzr";
-  };
-
-  buildInputs = [ which ]
-    ++ (stdenv.lib.optional stdenv.isDarwin sbclBootstrap)
-    ++ (stdenv.lib.optional stdenv.isLinux clisp)
-    ;
-
-  patchPhase = ''
-    echo '"${version}.nixos"' > version.lisp-expr
-    echo "
-    (lambda (features)
-      (flet ((enable (x)
-               (pushnew x features))
-             (disable (x)
-               (setf features (remove x features))))
-        (enable :sb-thread))) " > customize-target-features.lisp
-
-    pwd
-
-    # SBCL checks whether files are up-to-date in many places..
-    # Unfortunately, same timestamp is not good enough
-    sed -e 's@> x y@>= x y@' -i contrib/sb-aclrepl/repl.lisp
-    sed -e '/(date)/i((= date 2208988801) 2208988800)' -i contrib/asdf/asdf.lisp
-    sed -i src/cold/slam.lisp -e \
-      '/file-write-date input/a)'
-    sed -i src/cold/slam.lisp -e \
-      '/file-write-date output/i(or (and (= 2208988801 (file-write-date output)) (= 2208988801 (file-write-date input)))'
-    sed -i src/code/target-load.lisp -e \
-      '/date defaulted-fasl/a)'
-    sed -i src/code/target-load.lisp -e \
-      '/date defaulted-source/i(or (and (= 2208988801 (file-write-date defaulted-source-truename)) (= 2208988801 (file-write-date defaulted-fasl-truename)))'
-
-    # Fix software version retrieval
-    sed -e "s@/bin/uname@$(which uname)@g" -i src/code/*-os.lisp
-
-    # Fix the tests
-    sed -e '/deftest pwent/inil' -i contrib/sb-posix/posix-tests.lisp
-    sed -e '/deftest grent/inil' -i contrib/sb-posix/posix-tests.lisp
-    sed -e '/deftest .*ent.non-existing/,+5d' -i contrib/sb-posix/posix-tests.lisp
-    sed -e '/deftest \(pw\|gr\)ent/,+3d' -i contrib/sb-posix/posix-tests.lisp
-
-    sed -e '5,$d' -i contrib/sb-bsd-sockets/tests.lisp
-    sed -e '5,$d' -i contrib/sb-simple-streams/*test*.lisp
-
-    # Use whatever `cc` the stdenv provides
-    substituteInPlace src/runtime/Config.x86-64-darwin --replace gcc cc
-  '';
-
-  preBuild = ''
-    export INSTALL_ROOT=$out
-    mkdir -p test-home
-    export HOME=$PWD/test-home
-  '';
-
-  buildPhase = if stdenv.isLinux
-    then ''
-      sh make.sh clisp --prefix=$out
-    ''
-    else ''
-      sh make.sh --prefix=$out --xc-host='${sbclBootstrap}/bin/sbcl --disable-debugger --no-userinit --no-sysinit'
-    '';
-
-  installPhase = ''
-    INSTALL_ROOT=$out sh install.sh
-  '';
-
-  meta = {
-    description = "Lisp compiler";
-    homepage = http://www.sbcl.org;
-    license = stdenv.lib.licenses.bsd3;
-    maintainers = [stdenv.lib.maintainers.raskin];
-    platforms = stdenv.lib.platforms.linux;
-    inherit version;
-  };
-}

pkgs/development/compilers/sbcl/bootstrap.nix

@@ -8,15 +8,20 @@ let
       sha256 = "006pr88053wclvbjfjdypnbiw8wymbzdzi7a6kbkpdfn4zf5943j";
     };
     x86_64-linux = rec {
-      version = "1.2.15";
+      version = "1.3.16";
       system = "x86-64-linux";
-      sha256 = "1bpbfz9x2w73hy2kh8p0kd4m1p6pin90h2zycq52r3bbz8yv47aw";
+      sha256 = "0sq2dylwwyqfwkbdvcgqwz3vay9v895zpb0fyzsiwy31d1x9pr2s";
     };
     i686-linux = rec {
       version = "1.2.7";
       system = "x86-linux";
       sha256 = "07f3bz4br280qvn85i088vpzj9wcz8wmwrf665ypqx181pz2ai3j";
     };
+    aarch64-linux = rec {
+      version = "1.3.16";
+      system = "arm64-linux";
+      sha256 = "0q1brz9c49xgdljzfx8rpxxnlwhadxkcy5kg0mcd9wnxygind1cl";
+    };
     armv7l-linux = rec {
       version = "1.2.14";
       system = "armhf-linux";

pkgs/development/compilers/sbcl/default.nix

@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   name    = "sbcl-${version}";
-  version = "1.3.15";
+  version = "1.3.16";
 
   src = fetchurl {
     url    = "mirror://sourceforge/project/sbcl/sbcl/${version}/${name}-source.tar.bz2";
-    sha256 = "11db8pkv3i8ajyb295dh9nl0niyrkh9gjqv4vlaa1dl1vzck5ddi";
+    sha256 = "0qw8kcn66sr1k7ilm6i66dk3ybym722ccxa4xi8w7bkhgc0ripdp";
   };
 
   patchPhase = ''

pkgs/development/compilers/scala/2.11.nix

@@ -1,11 +1,11 @@
 { stdenv, fetchurl, makeWrapper, jre, gnugrep, coreutils }:
 
 stdenv.mkDerivation rec {
-  name = "scala-2.11.10";
+  name = "scala-2.11.11";
 
   src = fetchurl {
     url = "http://www.scala-lang.org/files/archive/${name}.tgz";
-    sha256 = "10rs8ak3qyxggw24ga3gjcpl3x8r1b3ykrdfrym1n154b1rrs904";
+    sha256 = "02whsszxabyhyrbcmgg3figaxknmfzy4f3wmgrqqwik89jk7q0qj";
   };
 
   propagatedBuildInputs = [ jre ] ;

pkgs/development/compilers/scala/default.nix

@@ -1,11 +1,11 @@
 { stdenv, fetchurl, makeWrapper, jre, gnugrep, coreutils }:
 
 stdenv.mkDerivation rec {
-  name = "scala-2.12.1";
+  name = "scala-2.12.2";
 
   src = fetchurl {
     url = "http://www.scala-lang.org/files/archive/${name}.tgz";
-    sha256 = "0nf37ix3rrm50s7dacwlyr8fl1hgrbxbw5yz21qf58rj8n46ic2d";
+    sha256 = "1xd68q9h0vzqndar3r4mvabbd7naa25fbiciahkhxwgw8sr6hq8r";
   };
 
   propagatedBuildInputs = [ jre ] ;

pkgs/development/haskell-modules/configuration-common.nix

@@ -686,8 +686,12 @@ self: super: {
     then appendConfigureFlag super.gtk "-fhave-quartz-gtk"
     else super.gtk;
 
-  # https://github.com/commercialhaskell/stack/issues/3001
-  stack = doJailbreak super.stack;
+  # The stack people don't bother making their own code compile in an LTS-based
+  # environment: https://github.com/commercialhaskell/stack/issues/3001.
+  stack = super.stack.overrideScope (self: super: {
+    store-core = self.store-core_0_3;
+    store = self.store_0_3_1;
+  });
 
   # The latest Hoogle needs versions not yet in LTS Haskell 7.x.
   hoogle = super.hoogle.override { haskell-src-exts = self.haskell-src-exts_1_19_1; };
@@ -758,13 +762,6 @@ self: super: {
   # https://github.com/roelvandijk/terminal-progress-bar/issues/13
   terminal-progress-bar = doJailbreak super.terminal-progress-bar;
 
-  # https://github.com/NixOS/nixpkgs/issues/19612
-  wai-app-file-cgi = (dontCheck super.wai-app-file-cgi).overrideScope (self: super: {
-    http-client = self.http-client_0_5_5;
-    http-client-tls = self.http-client-tls_0_3_3_1;
-    http-conduit = self.http-conduit_2_2_3;
-  });
-
   # https://hydra.nixos.org/build/42769611/nixlog/1/raw
   # note: the library is unmaintained, no upstream issue
   dataenc = doJailbreak super.dataenc;
@@ -775,10 +772,6 @@ self: super: {
   # horribly outdated (X11 interface changed a lot)
   sindre = markBroken super.sindre;
 
-  # https://github.com/jmillikin/haskell-dbus/pull/7
-  # http://hydra.cryp.to/build/498404/log/raw
-  dbus = dontCheck (appendPatch super.dbus ./patches/hdbus-semicolons.patch);
-
   # Test suite occasionally runs for 1+ days on Hydra.
   distributed-process-tests = dontCheck super.distributed-process-tests;
 

pkgs/development/haskell-modules/configuration-ghc-7.0.x.nix

@@ -62,6 +62,7 @@ self: super: {
 
   # Setup: Can't find transitive deps for haddock
   doctest = dontHaddock super.doctest;
+  hsdns = dontHaddock super.hsdns;
 
   # Needs hashable on pre 7.10.x compilers.
   nats_1 = addBuildDepend super.nats_1 self.hashable;

pkgs/development/haskell-modules/configuration-ghc-7.2.x.nix

@@ -63,6 +63,7 @@ self: super: {
 
   # Setup: Can't find transitive deps for haddock
   doctest = dontHaddock super.doctest;
+  hsdns = dontHaddock super.hsdns;
 
   # Needs hashable on pre 7.10.x compilers.
   nats_1 = addBuildDepend super.nats_1 self.hashable;

pkgs/development/haskell-modules/configuration-ghc-head.nix

@@ -53,7 +53,7 @@ self: super: {
     postPatch = "sed -i -e 's|base < 4.8|base|' hspec-expectations.cabal";
   });
   utf8-string = overrideCabal super.utf8-string (drv: {
-    postPatch = "sed -i -e 's|base >= 3 && < 4.8|base|' utf8-string.cabal";
+    postPatch = "sed -i -e 's|base >= 4.3 && < 4.10|base|' utf8-string.cabal";
   });
 
   # bos/attoparsec#92
@@ -87,6 +87,7 @@ self: super: {
   llvm-general = markBrokenVersion "3.4.5.3" super.llvm-general;
 
   # A bunch of jailbreaks due to 'base' bump
+  old-time = doJailbreak super.old-time;
   old-locale = doJailbreak super.old-locale;
   primitive = doJailbreak super.primitive;
   test-framework = doJailbreak super.test-framework;

pkgs/development/haskell-modules/configuration-hackage2nix.yaml

@@ -37,8 +37,7 @@ core-packages:
   - ghcjs-base-0
 
 default-package-overrides:
-  - store < 0.4.1               # https://github.com/fpco/store/issues/104
-  # LTS Haskell 8.8
+  # LTS Haskell 8.11
   - abstract-deque ==0.3
   - abstract-par ==0.3.3
   - AC-Vector ==2.3.2
@@ -55,6 +54,7 @@ default-package-overrides:
   - aeson-better-errors ==0.9.1.0
   - aeson-casing ==0.1.0.5
   - aeson-compat ==0.3.6
+  - aeson-diff ==1.1.0.2
   - aeson-extra ==0.4.0.0
   - aeson-generic-compat ==0.0.1.0
   - aeson-injector ==1.0.7.0
@@ -65,6 +65,7 @@ default-package-overrides:
   - airship ==0.6.0
   - alarmclock ==0.4.0.2
   - alex ==3.2.1
+  - algebraic-graphs ==0.0.4
   - alternators ==0.1.1.1
   - ALUT ==2.4.0.2
   - amazonka ==1.4.5
@@ -165,18 +166,22 @@ default-package-overrides:
   - ansigraph ==0.3.0.2
   - app-settings ==0.2.0.11
   - appar ==0.1.4
+  - apportionment ==0.0.0.2
   - arbtt ==0.9.0.12
   - arithmoi ==0.4.3.0
   - array-memoize ==0.6.0
+  - arrow-extras ==0.1.0.1
   - arrow-list ==0.7
   - ascii-progress ==0.3.3.0
   - asciidiagram ==1.3.3
   - asn1-encoding ==0.9.5
   - asn1-parse ==0.9.4
   - asn1-types ==0.3.2
-  - async ==2.1.1
+  - async ==2.1.1.1
   - async-dejafu ==0.1.3.0
   - async-extra ==0.1.0.0
+  - async-refresh ==0.2.0
+  - async-refresh-tokens ==0.1.0
   - atom-basic ==0.2.4
   - atom-conduit ==0.4.0.1
   - atomic-primops ==0.8.0.4
@@ -184,6 +189,7 @@ default-package-overrides:
   - attoparsec ==0.13.1.0
   - attoparsec-binary ==0.2
   - attoparsec-expr ==0.1.1.2
+  - audacity ==0.0.1.1
   - authenticate ==1.3.3.2
   - authenticate-oauth ==1.6
   - auto ==0.4.3.1
@@ -195,9 +201,10 @@ default-package-overrides:
   - avers-server ==0.0.18.0
   - avwx ==0.3.0.2
   - b9 ==0.5.31
+  - backprop ==0.0.3.0
   - bake ==0.5
   - bank-holidays-england ==0.1.0.5
-  - base-compat ==0.9.2
+  - base-compat ==0.9.3
   - base-noprelude ==4.9.1.0
   - base-orphans ==0.5.4
   - base-prelude ==1.0.1.1
@@ -214,6 +221,7 @@ default-package-overrides:
   - bencode ==0.6.0.0
   - bento ==0.1.0
   - between ==0.11.0.0
+  - bibtex ==0.1.0.6
   - bifunctors ==5.4.1
   - bimap ==0.3.2
   - bimap-server ==0.1.0.1
@@ -260,6 +268,7 @@ default-package-overrides:
   - bloodhound ==0.12.1.0
   - blosum ==0.1.1.4
   - bmp ==1.2.6.3
+  - board-games ==0.1.0.6
   - boltzmann-samplers ==0.1.0.0
   - bookkeeping ==0.2.1.1
   - bool-extras ==0.4.0
@@ -278,6 +287,7 @@ default-package-overrides:
   - bson-lens ==0.1.1
   - btrfs ==0.1.2.3
   - buffer-builder ==0.2.4.4
+  - buffer-pipe ==0.0
   - bumper ==0.6.0.3
   - bv ==0.4.1
   - byteable ==0.1.1
@@ -304,6 +314,7 @@ default-package-overrides:
   - cache ==0.1.0.0
   - cacophony ==0.9.2
   - cairo ==0.13.3.1
+  - calendar-recycling ==0.0
   - call-stack ==0.1.0
   - camfort ==0.901
   - carray ==0.1.6.6
@@ -311,6 +322,7 @@ default-package-overrides:
   - case-insensitive ==1.2.0.8
   - cased ==0.1.0.0
   - cases ==0.1.3.2
+  - casing ==0.1.2.1
   - cassava ==0.4.5.1
   - cassava-conduit ==0.3.5.1
   - cassava-megaparsec ==0.1.0
@@ -345,12 +357,12 @@ default-package-overrides:
   - cipher-rc4 ==0.1.4
   - circle-packing ==0.1.0.5
   - clang-pure ==0.2.0.2
-  - clash-ghc ==0.7.0.1
-  - clash-lib ==0.7
-  - clash-prelude ==0.11
-  - clash-systemverilog ==0.7
-  - clash-verilog ==0.7
-  - clash-vhdl ==0.7
+  - clash-ghc ==0.7.1
+  - clash-lib ==0.7.1
+  - clash-prelude ==0.11.1
+  - clash-systemverilog ==0.7.1
+  - clash-verilog ==0.7.1
+  - clash-vhdl ==0.7.1
   - classy-prelude ==1.2.0.1
   - classy-prelude-conduit ==1.2.0
   - classy-prelude-yesod ==1.2.0
@@ -377,6 +389,7 @@ default-package-overrides:
   - codo-notation ==0.5.2
   - colorful-monoids ==0.2.1.0
   - colour ==2.3.3
+  - comfort-graph ==0.0.2
   - commutative ==0.0.1.4
   - comonad ==5
   - comonad-transformers ==4.0
@@ -384,10 +397,12 @@ default-package-overrides:
   - compactmap ==0.1.4.2
   - composition ==1.0.2.1
   - composition-extra ==2.0.0
+  - concise ==0.1.0.0
   - concurrency ==1.0.0.0
   - concurrent-output ==1.7.9
+  - concurrent-split ==0.0.1
   - concurrent-supply ==0.1.8
-  - conduit ==1.2.9
+  - conduit ==1.2.9.1
   - conduit-combinators ==1.1.1
   - conduit-connection ==0.1.0.3
   - conduit-extra ==1.1.15
@@ -418,7 +433,7 @@ default-package-overrides:
   - cookie ==0.4.2.1
   - countable ==1.0
   - courier ==0.1.1.4
-  - cpphs ==1.20.4
+  - cpphs ==1.20.5
   - cprng-aes ==0.6.1
   - cpu ==0.1.2
   - cpuinfo ==0.1.0.1
@@ -458,16 +473,25 @@ default-package-overrides:
   - cubicspline ==0.1.2
   - cue-sheet ==0.1.0
   - curl ==1.3.8
+  - cutter ==0.0
   - darcs ==2.12.5
   - data-accessor ==0.2.2.7
   - data-accessor-mtl ==0.2.0.4
+  - data-accessor-template ==0.2.1.13
+  - data-accessor-transformers ==0.2.1.7
   - data-binary-ieee754 ==0.4.4
+  - data-bword ==0.1.0.1
   - data-check ==0.1.0
+  - data-checked ==0.3
   - data-default ==0.7.1.1
   - data-default-class ==0.1.2.0
   - data-default-instances-containers ==0.0.1
   - data-default-instances-dlist ==0.0.1
   - data-default-instances-old-locale ==0.0.1
+  - data-dword ==0.3.1
+  - data-endian ==0.1.1
+  - data-fix ==0.0.4
+  - data-has ==0.2.1.0
   - data-hash ==0.2.0.1
   - data-inttrie ==0.1.2
   - data-lens-light ==0.1.2.2
@@ -475,7 +499,10 @@ default-package-overrides:
   - data-msgpack ==0.0.9
   - data-or ==1.0.0.5
   - data-ordlist ==0.4.7.0
+  - data-ref ==0.0.1.1
   - data-reify ==0.6.1
+  - data-serializer ==0.3
+  - data-textual ==0.3.0.2
   - datasets ==0.2.1
   - dataurl ==0.1.0.0
   - DAV ==1.3.1
@@ -487,7 +514,8 @@ default-package-overrides:
   - dejafu ==0.4.0.0
   - dependent-map ==0.2.4.0
   - dependent-sum ==0.4
-  - deriving-compat ==0.3.5
+  - derive ==2.6.2
+  - deriving-compat ==0.3.6
   - descriptive ==0.9.4
   - diagrams ==1.4
   - diagrams-builder ==0.8.0.1
@@ -503,6 +531,7 @@ default-package-overrides:
   - diagrams-solve ==0.1.0.1
   - diagrams-svg ==1.4.1
   - dice ==0.1
+  - dictionaries ==0.1.0.1
   - Diff ==0.3.4
   - diff3 ==0.3.0
   - digest ==0.0.1.2
@@ -512,7 +541,7 @@ default-package-overrides:
   - directory-tree ==0.12.1
   - discount ==0.1.1
   - disk-free-space ==0.1.0.1
-  - disposable ==0.2.0.3
+  - disposable ==0.2.0.4
   - distance ==0.1.0.0
   - distributed-closure ==0.3.4.0
   - distributed-process ==0.6.6
@@ -546,6 +575,7 @@ default-package-overrides:
   - DRBG ==0.5.5
   - drifter ==0.2.2
   - drifter-postgresql ==0.1.0
+  - dsp ==0.2.3.1
   - dual-tree ==0.2.0.9
   - dvorak ==0.1.0.0
   - dynamic-state ==0.2.2.0
@@ -559,6 +589,7 @@ default-package-overrides:
   - EdisonAPI ==1.3.1
   - EdisonCore ==1.3.1.1
   - edit-distance ==0.2.2.1
+  - edit-distance-vector ==1.0.0.4
   - editor-open ==0.6.0.0
   - effect-handlers ==0.1.0.8
   - effin ==0.3.0.2
@@ -582,21 +613,26 @@ default-package-overrides:
   - engine-io-wai ==1.0.6
   - EntrezHTTP ==1.0.3
   - entropy ==0.3.7
+  - enummapset ==0.5.2.1
   - enummapset-th ==0.6.1.1
+  - enumset ==0.0.4
   - envelope ==0.2.1.0
   - envparse ==0.4
   - envy ==1.3.0.2
   - epub-metadata ==4.5
   - eq ==4.0.4
+  - equal-files ==0.0.5.3
   - equivalence ==0.3.2
   - erf ==2.0.0.0
   - errors ==2.1.3
   - ersatz ==0.3.1
   - esqueleto ==2.5.1
+  - etc ==0.0.0.2
   - etcd ==1.0.5
-  - ether ==0.4.0.2
+  - ether ==0.4.1.0
   - euphoria ==0.8.0.0
   - event ==0.1.4
+  - event-list ==0.1.1.3
   - eventstore ==0.14.0.1
   - exact-combinatorics ==0.2.0.8
   - exact-pi ==0.4.1.2
@@ -609,16 +645,18 @@ default-package-overrides:
   - exhaustive ==1.1.3
   - exp-pairs ==0.1.5.2
   - expiring-cache-map ==0.0.6.1
+  - explicit-exception ==0.1.8
   - extensible ==0.3.7
   - extensible-effects ==1.11.0.4
   - extensible-exceptions ==0.1.1.4
-  - extra ==1.5.1
+  - extra ==1.5.2
   - extract-dependencies ==0.2.0.1
   - fail ==4.9.0.0
   - farmhash ==0.1.0.5
   - fast-builder ==0.0.0.6
   - fast-digits ==0.2.1.0
   - fast-logger ==2.4.10
+  - fast-math ==1.0.2
   - fasta ==0.10.4.2
   - fay ==0.23.1.16
   - fay-base ==0.20.0.1
@@ -643,6 +681,7 @@ default-package-overrides:
   - fingertree-psqueue ==0.3
   - finite-typelits ==0.1.1.0
   - fixed ==0.2.1.1
+  - fixed-length ==0.2
   - fixed-vector ==0.9.0.0
   - fixed-vector-hetero ==0.3.1.1
   - flac ==0.1.1
@@ -666,7 +705,7 @@ default-package-overrides:
   - format-numbers ==0.1.0.0
   - formatting ==6.2.4
   - fortran-src ==0.1.0.4
-  - foundation ==0.0.4
+  - foundation ==0.0.6
   - Frames ==0.1.9
   - free ==4.12.4
   - free-vl ==0.1.4
@@ -681,11 +720,12 @@ default-package-overrides:
   - fsnotify-conduit ==0.1.0.0
   - funcmp ==1.8
   - fuzzcheck ==0.1.1
+  - fuzzy ==0.1.0.0
   - gd ==3000.7.3
   - Genbank ==1.0.3
   - general-games ==1.0.5
   - generic-aeson ==0.2.0.8
-  - generic-deriving ==1.11.1
+  - generic-deriving ==1.11.2
   - generic-random ==0.4.1.0
   - generic-xmlpickler ==0.1.0.5
   - GenericPretty ==1.2.1
@@ -703,7 +743,7 @@ default-package-overrides:
   - ghc-syb-utils ==0.2.3
   - ghc-tcplugins-extra ==0.2
   - ghc-typelits-extra ==0.2.2
-  - ghc-typelits-knownnat ==0.2.3
+  - ghc-typelits-knownnat ==0.2.4
   - ghc-typelits-natnormalise ==0.5.2
   - ghcid ==0.6.6
   - ghcjs-base-stub ==0.1.0.2
@@ -717,7 +757,7 @@ default-package-overrides:
   - gi-gio ==2.0.11
   - gi-glib ==2.0.11
   - gi-gobject ==2.0.11
-  - gi-gtk ==3.0.11
+  - gi-gtk ==3.0.13
   - gi-javascriptcore ==3.0.11
   - gi-pango ==1.0.12
   - gi-soup ==2.4.11
@@ -737,6 +777,7 @@ default-package-overrides:
   - gitlib-test ==3.1.0.3
   - gitrev ==1.2.0
   - gitson ==0.5.2
+  - gl ==0.8.0
   - glabrous ==0.3.1
   - glaze ==0.2.0.2
   - glazier ==0.7.0.0
@@ -749,6 +790,7 @@ default-package-overrides:
   - gloss-rendering ==1.10.3.5
   - GLURaw ==2.0.0.3
   - GLUT ==2.7.0.11
+  - gnuplot ==0.5.4.1
   - gogol ==0.1.1
   - gogol-adexchange-buyer ==0.1.1
   - gogol-adexchange-seller ==0.1.1
@@ -875,7 +917,7 @@ default-package-overrides:
   - hackage-db ==1.22
   - hackage-security ==0.5.2.2
   - hackernews ==1.1.1.0
-  - haddock-library ==1.4.2
+  - haddock-library ==1.4.3
   - hailgun ==0.4.1.2
   - hailgun-simple ==0.1.0.0
   - hakyll ==4.9.5.1
@@ -896,12 +938,12 @@ default-package-overrides:
   - harp ==0.4.2
   - hasbolt ==0.1.1.2
   - hashable ==1.2.6.0
-  - hashable-time ==0.2
+  - hashable-time ==0.2.0.1
   - hashmap ==1.3.2
   - hashtables ==1.2.1.1
   - haskeline ==0.7.3.1
   - haskell-gi ==0.20.1
-  - haskell-gi-base ==0.20.1
+  - haskell-gi-base ==0.20.2
   - haskell-import-graph ==1.0.1
   - haskell-lexer ==1.0.1
   - haskell-names ==0.8.0
@@ -940,12 +982,13 @@ default-package-overrides:
   - HCodecs ==0.5
   - hdaemonize ==0.5.2
   - HDBC ==2.4.0.1
+  - HDBC-mysql ==0.7.1.0
   - HDBC-session ==0.1.1.0
   - hdevtools ==0.1.5.0
   - heap ==1.0.3
   - heaps ==0.3.3
   - hebrew-time ==0.1.1
-  - hedis ==0.9.7
+  - hedis ==0.9.8
   - here ==1.2.9
   - heredoc ==0.2.0.0
   - heterocephalus ==1.0.4.0
@@ -1010,6 +1053,7 @@ default-package-overrides:
   - hsass ==0.4.1
   - hsb2hs ==0.3.1
   - hscolour ==1.24.1
+  - hscurses ==1.4.2.0
   - hsdns ==1.7
   - hse-cpp ==0.2
   - hsebaysdk ==0.4.0.0
@@ -1021,13 +1065,15 @@ default-package-overrides:
   - hsinstall ==1.5
   - hslogger ==1.2.10
   - hslua ==0.4.1
+  - hslua-aeson ==0.1.0.3
   - hsndfile ==0.8.0
   - hsndfile-vector ==0.5.2
-  - HsOpenSSL ==0.11.4.4
+  - HsOpenSSL ==0.11.4.6
   - HsOpenSSL-x509-system ==0.1.0.3
   - hsp ==0.10.0
   - hspec ==2.4.3
   - hspec-attoparsec ==0.1.0.2
+  - hspec-checkers ==0.1.0.2
   - hspec-contrib ==0.4.0
   - hspec-core ==2.4.3
   - hspec-discover ==2.4.3
@@ -1041,6 +1087,7 @@ default-package-overrides:
   - hspec-wai ==0.8.0
   - hspec-wai-json ==0.8.0
   - hspec-webdriver ==1.2.0
+  - hsshellscript ==3.4.1
   - hstatistics ==0.3
   - hstatsd ==0.1
   - HStringTemplate ==0.8.5
@@ -1054,10 +1101,10 @@ default-package-overrides:
   - html-email-validate ==0.2.0.0
   - htoml ==1.0.0.3
   - HTTP ==4000.3.6
-  - http-api-data ==0.3.5
+  - http-api-data ==0.3.6
   - http-client ==0.5.6.1
-  - http-client-openssl ==0.2.0.4
-  - http-client-tls ==0.3.4
+  - http-client-openssl ==0.2.0.5
+  - http-client-tls ==0.3.4.1
   - http-common ==0.8.2.0
   - http-conduit ==2.2.3.1
   - http-date ==0.0.6.1
@@ -1067,6 +1114,7 @@ default-package-overrides:
   - http-streams ==0.8.4.0
   - http-types ==0.9.1
   - http2 ==1.6.3
+  - httpd-shed ==0.4.0.3
   - human-readable-duration ==0.2.0.3
   - HUnit ==1.5.0.0
   - HUnit-approx ==1.1
@@ -1104,6 +1152,7 @@ default-package-overrides:
   - ieee754 ==0.8.0
   - if ==0.1.0.0
   - IfElse ==0.85
+  - iff ==0.0.6
   - ignore ==0.1.1.0
   - ilist ==0.2.0.0
   - imagesize-conduit ==1.1
@@ -1120,13 +1169,14 @@ default-package-overrides:
   - inline-c-cpp ==0.1.0.0
   - inline-java ==0.6.1
   - inline-r ==0.9.0.1
-  - insert-ordered-containers ==0.2.0.0
+  - insert-ordered-containers ==0.2.1.0
   - instance-control ==0.1.1.1
   - integer-logarithms ==1.0.1
   - integration ==0.2.1
   - intero ==0.1.20
   - interpolate ==0.1.0
   - interpolatedstring-perl6 ==1.0.0
+  - interpolation ==0.1.0.1
   - IntervalMap ==0.5.2.0
   - intervals ==0.7.2
   - intro ==0.1.0.10
@@ -1140,7 +1190,7 @@ default-package-overrides:
   - io-storage ==0.3
   - io-streams ==1.3.6.1
   - io-streams-haproxy ==1.0.0.1
-  - ip6addr ==0.5.2
+  - ip6addr ==0.5.3
   - iproute ==1.7.1
   - IPv6Addr ==0.6.3
   - irc ==0.6.1.0
@@ -1158,6 +1208,7 @@ default-package-overrides:
   - ixset ==1.0.7
   - ixset-typed ==0.3.1
   - jailbreak-cabal ==1.3.2
+  - javascript-extras ==0.3.1.0
   - jmacro ==0.6.14
   - jmacro-rpc ==0.3.2
   - jmacro-rpc-happstack ==0.3.2
@@ -1168,6 +1219,7 @@ default-package-overrides:
   - js-flot ==0.8.3
   - js-jquery ==3.1.1
   - json ==0.9.1
+  - json-ast ==0.3.1
   - json-builder ==0.3
   - json-rpc-generic ==0.2.1.2
   - json-schema ==0.7.4.1
@@ -1210,8 +1262,10 @@ default-package-overrides:
   - language-thrift ==0.10.0.0
   - large-hashable ==0.1.0.4
   - largeword ==1.2.5
+  - latex ==0.1.0.3
   - lattices ==1.5.0
   - lazy-csv ==0.5.1
+  - lazyio ==0.1.0.4
   - lca ==0.3
   - leapseconds-announced ==2017
   - lens ==4.15.1
@@ -1221,9 +1275,10 @@ default-package-overrides:
   - lens-family ==1.2.1
   - lens-family-core ==1.2.1
   - lens-family-th ==0.5.0.0
+  - lens-labels ==0.1.0.1
   - lens-regex ==0.1.0
   - lens-simple ==0.1.0.9
-  - lentil ==1.0.8.0
+  - lentil ==1.0.9.0
   - leveldb-haskell ==0.6.4
   - lexer-applicative ==2.1.0.1
   - lhs2tex ==1.19
@@ -1250,6 +1305,7 @@ default-package-overrides:
   - list-prompt ==0.1.1.0
   - list-t ==1
   - ListLike ==4.5.1
+  - llvm-hs-pure ==4.0.0.0
   - lmdb ==0.2.5
   - loch-th ==0.2.1
   - log ==0.7
@@ -1274,12 +1330,14 @@ default-package-overrides:
   - machines-io ==0.2.0.13
   - machines-process ==0.2.0.8
   - magic ==1.1
+  - magicbane ==0.1.1
   - mainland-pretty ==0.4.1.4
   - makefile ==0.1.1.0
   - managed ==1.0.5
   - mandrill ==0.5.3.1
   - markdown ==0.1.16
   - markdown-unlit ==0.4.0
+  - markov-chain ==0.0.3.4
   - markup ==3.1.0
   - marvin ==0.2.3
   - marvin-interpolate ==1.1
@@ -1288,10 +1346,13 @@ default-package-overrides:
   - matplotlib ==0.4.3
   - matrices ==0.4.4
   - matrix ==0.3.5.0
-  - matrix-market-attoparsec ==0.1.0.5
+  - matrix-market-attoparsec ==0.1.0.7
   - maximal-cliques ==0.1.1
   - mbox ==0.3.3
+  - mbox-utility ==0.0
   - mcmc-types ==1.0.3
+  - mediabus ==0.3.2.1
+  - mediabus-rtp ==0.3.2.1
   - median-stream ==0.7.0.0
   - mega-sdist ==0.3.0.2
   - megaparsec ==5.2.0
@@ -1313,10 +1374,13 @@ default-package-overrides:
   - microlens-mtl ==0.1.10.0
   - microlens-platform ==0.3.8.0
   - microlens-th ==0.4.1.1
+  - midi ==0.2.2.1
+  - midi-music-box ==0.0.0.3
   - mighty-metropolis ==1.2.0
   - mime-mail ==0.4.13.1
   - mime-mail-ses ==0.3.2.3
   - mime-types ==0.1.0.7
+  - minio-hs ==0.2.1
   - mintty ==0.1.1
   - misfortune ==0.1.1.2
   - missing-foreign ==0.1.1
@@ -1324,6 +1388,7 @@ default-package-overrides:
   - mixed-types-num ==0.1.0.1
   - mmap ==0.5.9
   - mmorph ==1.0.9
+  - mnist-idx ==0.1.2.8
   - mockery ==0.3.4
   - modify-fasta ==0.8.2.3
   - monad-control ==1.0.1.0
@@ -1360,6 +1425,7 @@ default-package-overrides:
   - mono-traversable-instances ==0.1.0.0
   - monoid-extras ==0.4.2
   - monoid-subclasses ==0.4.3.1
+  - monoid-transformer ==0.0.3
   - monoidal-containers ==0.3.0.1
   - morte ==1.6.6
   - mountpoints ==1.0.2
@@ -1374,6 +1440,7 @@ default-package-overrides:
   - multiset-comb ==0.2.4.1
   - multistate ==0.7.1.1
   - murmur-hash ==0.1.0.9
+  - mushu ==0.1.1
   - MusicBrainz ==0.2.4
   - mustache ==2.1.3
   - mutable-containers ==0.3.3
@@ -1407,6 +1474,7 @@ default-package-overrides:
   - network-conduit-tls ==1.2.2
   - network-house ==0.1.0.2
   - network-info ==0.2.0.8
+  - network-ip ==0.3
   - network-msgpack-rpc ==0.0.3
   - network-multicast ==0.2.0
   - Network-NineP ==0.4.1
@@ -1424,13 +1492,17 @@ default-package-overrides:
   - nicify-lib ==1.0.1
   - NineP ==0.0.2.1
   - nix-paths ==1.0.0.1
+  - non-empty ==0.3
   - non-empty-sequence ==0.2.0.2
+  - non-negative ==0.1.1
   - nonce ==1.0.2
   - nondeterminism ==1.4
   - NoTrace ==0.3.0.1
   - nsis ==0.3.1
   - numbers ==3000.2.0.1
   - numeric-extras ==0.1
+  - numeric-prelude ==0.4.2
+  - numeric-quest ==0.2.0.1
   - NumInstances ==1.4
   - numtype-dk ==0.5.0.1
   - oanda-rest-api ==0.3.0.0
@@ -1443,6 +1515,7 @@ default-package-overrides:
   - old-locale ==1.0.0.7
   - old-time ==1.1.0.3
   - once ==0.2
+  - one-liner ==0.8.1
   - OneTuple ==0.2.1
   - oo-prototypes ==0.1.0.0
   - opaleye ==0.5.3.0
@@ -1461,7 +1534,7 @@ default-package-overrides:
   - optional-args ==1.0.1
   - options ==1.2.1.1
   - optparse-applicative ==0.13.2.0
-  - optparse-generic ==1.1.4
+  - optparse-generic ==1.1.5
   - optparse-helper ==0.2.1.1
   - optparse-simple ==0.0.3
   - optparse-text ==0.1.1.0
@@ -1477,7 +1550,7 @@ default-package-overrides:
   - pandoc-citeproc ==0.10.4.1
   - pandoc-types ==1.17.0.5
   - pango ==0.13.3.1
-  - parallel ==3.2.1.0
+  - parallel ==3.2.1.1
   - parallel-io ==0.3.3
   - parseargs ==0.2.0.8
   - parsec ==3.1.11
@@ -1527,7 +1600,7 @@ default-package-overrides:
   - pipes-category ==0.2.0.1
   - pipes-concurrency ==2.0.7
   - pipes-csv ==1.4.3
-  - pipes-extras ==1.0.8
+  - pipes-extras ==1.0.9
   - pipes-fluid ==0.5.0.3
   - pipes-group ==1.0.6
   - pipes-misc ==0.2.5.0
@@ -1550,8 +1623,10 @@ default-package-overrides:
   - pointedlist ==0.6.1
   - pointful ==1.0.9
   - pointless-fun ==1.1.0.6
+  - poly-arity ==0.1.0
   - polynomials-bernstein ==1.1.2
   - polyparse ==1.12
+  - pooled-io ==0.0.2.1
   - posix-paths ==0.2.1.1
   - posix-realtime ==0.0.0.4
   - post-mess-age ==0.2.1.0
@@ -1567,6 +1642,7 @@ default-package-overrides:
   - pred-set ==0.0.1
   - prednote ==0.36.0.4
   - prefix-units ==0.2.0
+  - prelude-compat ==0.0.0.1
   - prelude-extras ==0.4.0.3
   - prelude-safeenum ==0.1.1.2
   - preprocessor-tools ==1.0.1
@@ -1581,6 +1657,7 @@ default-package-overrides:
   - primes ==0.2.1.0
   - primitive ==0.6.1.0
   - printcess ==0.1.0.3
+  - probability ==0.2.5.1
   - process-extras ==0.7.1
   - product-profunctors ==0.7.1.0
   - profiteur ==0.4.2.2
@@ -1591,8 +1668,14 @@ default-package-overrides:
   - prometheus-client ==0.1.0.1
   - prometheus-metrics-ghc ==0.1.0.1
   - prompt ==0.1.1.2
+  - proto-lens ==0.2.0.1
+  - proto-lens-arbitrary ==0.1.0.2
+  - proto-lens-combinators ==0.1.0.6
+  - proto-lens-descriptors ==0.2.0.1
+  - proto-lens-optparse ==0.1.0.2
+  - proto-lens-protoc ==0.2.0.1
   - protobuf ==0.2.1.1
-  - protobuf-simple ==0.1.0.3
+  - protobuf-simple ==0.1.0.4
   - protocol-buffers ==2.4.0
   - protocol-buffers-descriptor ==2.4.0
   - protolude ==0.1.10
@@ -1631,6 +1714,7 @@ default-package-overrides:
   - random-tree ==0.6.0.5
   - range ==0.1.2.0
   - range-set-list ==0.1.2.0
+  - rank-product ==0.2.0.1
   - rank1dynamic ==0.3.3.0
   - Rasterific ==0.7.2.1
   - rasterific-svg ==0.3.2.1
@@ -1641,6 +1725,7 @@ default-package-overrides:
   - rawfilepath ==0.1.1
   - rawstring-qm ==0.2.3.0
   - rdf ==0.1.0.1
+  - rdtsc ==1.3.0.1
   - read-editor ==0.1.0.2
   - read-env-var ==0.1.0.1
   - readable ==0.3.1
@@ -1655,6 +1740,7 @@ default-package-overrides:
   - ref-fd ==0.4.0.1
   - refact ==0.3.0.2
   - references ==0.3.2.1
+  - refined ==0.1.2.1
   - reflection ==2.1.2
   - reform ==0.2.7.1
   - reform-blaze ==0.2.4.3
@@ -1674,7 +1760,7 @@ default-package-overrides:
   - regex-tdfa ==1.2.2
   - regex-tdfa-text ==1.0.0.3
   - reinterpret-cast ==0.1.0
-  - relational-query ==0.8.3.5
+  - relational-query ==0.8.3.6
   - relational-query-HDBC ==0.6.0.2
   - relational-record ==0.1.7.1
   - relational-schemas ==0.1.3.1
@@ -1722,6 +1808,8 @@ default-package-overrides:
   - safe-exceptions-checked ==0.1.0
   - safecopy ==0.9.3.1
   - SafeSemaphore ==0.10.1
+  - sample-frame ==0.0.3
+  - sample-frame-np ==0.0.4.1
   - sampling ==0.3.2
   - sandi ==0.4.0
   - sandman ==0.2.0.1
@@ -1730,7 +1818,7 @@ default-package-overrides:
   - scalpel ==0.5.0
   - scalpel-core ==0.5.0
   - scanner ==0.2
-  - scientific ==0.3.4.11
+  - scientific ==0.3.4.12
   - scotty ==0.11.0
   - scrape-changes ==0.1.0.5
   - scrypt ==0.5.0
@@ -1752,7 +1840,7 @@ default-package-overrides:
   - serf ==0.1.1.0
   - servant ==0.9.1.1
   - servant-aeson-specs ==0.5.2.0
-  - servant-auth-cookie ==0.4.3.3
+  - servant-auth-cookie ==0.4.4
   - servant-blaze ==0.7.1
   - servant-cassava ==0.8
   - servant-client ==0.9.1.1
@@ -1764,7 +1852,9 @@ default-package-overrides:
   - servant-lucid ==0.7.1
   - servant-mock ==0.8.1.1
   - servant-purescript ==0.6.0.0
+  - servant-ruby ==0.2.1.0
   - servant-server ==0.9.1.1
+  - servant-static-th ==0.1.0.3
   - servant-subscriber ==0.5.0.3
   - servant-swagger ==1.1.2
   - servant-swagger-ui ==0.2.2.2.2.8
@@ -1774,6 +1864,7 @@ default-package-overrides:
   - serversession-frontend-wai ==1.0
   - serversession-frontend-yesod ==1.0
   - servius ==1.2.0.2
+  - set-cover ==0.0.8
   - set-monad ==0.2.0.0
   - setenv ==0.1.1.3
   - setlocale ==1.0.0.4
@@ -1811,8 +1902,9 @@ default-package-overrides:
   - smoothie ==0.4.2.6
   - smtLib ==1.0.8
   - smtp-mail ==0.1.4.6
+  - snap-blaze ==0.2.1.5
   - snap-core ==1.0.2.0
-  - snap-server ==1.0.1.1
+  - snap-server ==1.0.2.0
   - snowflake ==0.1.1.1
   - soap ==0.2.3.3
   - soap-openssl ==0.1.0.2
@@ -1841,6 +1933,7 @@ default-package-overrides:
   - Spock-worker ==0.3.1.0
   - spool ==0.1
   - spoon ==0.3.1
+  - spreadsheet ==0.1.3.4
   - sql-words ==0.1.4.1
   - sqlite-simple ==0.4.13.0
   - sqlite-simple-errors ==0.6.0.0
@@ -1848,6 +1941,7 @@ default-package-overrides:
   - stache ==0.2.2
   - stack-run-auto ==0.1.1.4
   - stack-type ==0.1.0.0
+  - stackage-curator ==0.14.5
   - state-plus ==0.1.2
   - stateref ==0.3
   - statestack ==0.2.0.5
@@ -1863,6 +1957,7 @@ default-package-overrides:
   - stm-containers ==0.2.15
   - stm-delay ==0.1.1.1
   - stm-extras ==0.1.0.2
+  - stm-split ==0.0.1
   - stm-stats ==0.2.0.0
   - stm-supply ==0.2.0.0
   - STMonadTrans ==0.4.3
@@ -1870,6 +1965,10 @@ default-package-overrides:
   - storable-complex ==0.2.2
   - storable-endian ==0.2.6
   - storable-record ==0.0.3.1
+  - storable-tuple ==0.0.3.2
+  - storablevector ==0.2.12
+  - storablevector-carray ==0.0
+  - store ==0.4.2
   - store-core ==0.4
   - Strafunski-StrategyLib ==5.0.0.10
   - stratosphere ==0.4.2
@@ -1914,6 +2013,7 @@ default-package-overrides:
   - system-posix-redirect ==1.1.0.1
   - syz ==0.2.0.0
   - tabular ==0.2.2.7
+  - tagchup ==0.4.0.5
   - tagged ==0.8.5
   - tagged-binary ==0.2.0.0
   - tagged-identity ==0.1.1
@@ -1944,16 +2044,19 @@ default-package-overrides:
   - tasty-smallcheck ==0.8.1
   - tasty-stats ==0.2.0.2
   - tasty-tap ==0.0.4
-  - tasty-th ==0.1.5
+  - tasty-th ==0.1.7
   - Taxonomy ==1.0.2
   - TCache ==0.12.1
   - tce-conf ==1.3
   - tcp-streams ==0.6.0.0
   - tcp-streams-openssl ==0.6.0.0
+  - tdigest ==0.1
+  - tdigest-Chart ==0
   - telegram-api ==0.6.1.0
   - template ==0.2.0.10
   - temporary ==1.2.0.4
   - temporary-rc ==1.2.0.3
+  - termcolor ==0.2.0.0
   - terminal-progress-bar ==0.1.1
   - terminal-size ==0.3.2.1
   - terminfo ==0.4.0.2
@@ -1973,16 +2076,19 @@ default-package-overrides:
   - text-format ==0.3.1.1
   - text-generic-pretty ==1.2.1
   - text-icu ==0.7.0.1
+  - text-latin1 ==0.3
   - text-ldap ==0.1.1.8
   - text-manipulate ==0.2.0.1
   - text-metrics ==0.2.0
   - text-postgresql ==0.0.2.2
+  - text-printer ==0.5
   - text-region ==0.1.0.1
   - text-show ==3.4.1.1
   - text-show-instances ==3.5
   - text-zipper ==0.10
   - textlocal ==0.1.0.5
   - tf-random ==0.5
+  - tfp ==1.0.0.2
   - th-data-compat ==0.0.2.2
   - th-desugar ==1.6
   - th-expand-syns ==0.4.2.0
@@ -2002,6 +2108,7 @@ default-package-overrides:
   - through-text ==0.1.0.0
   - thumbnail-plus ==1.0.5
   - thyme ==0.3.5.5
+  - tibetan-utils ==0.1.1.2
   - tidal ==0.8.2
   - time-compat ==0.1.0.3
   - time-lens ==0.4.0.1
@@ -2031,7 +2138,7 @@ default-package-overrides:
   - tree-fun ==0.8.1.0
   - trifecta ==1.6.2.1
   - true-name ==0.1.0.2
-  - tsv2csv ==0.1.0.1
+  - tsv2csv ==0.1.0.2
   - ttrie ==0.1.2.1
   - tttool ==1.7.0.1
   - tuple ==0.3.0.2
@@ -2040,10 +2147,15 @@ default-package-overrides:
   - turtle ==1.3.2
   - turtle-options ==0.1.0.4
   - twitter-feed ==0.2.0.11
+  - twitter-types ==0.7.2.2
+  - twitter-types-lens ==0.7.2
   - type-aligned ==0.9.6
   - type-assertions ==0.1.0.0
+  - type-combinators ==0.2.4.3
   - type-eq ==0.5
   - type-fun ==0.1.1
+  - type-hint ==0.1
+  - type-level-integers ==0.0.1
   - type-level-kv-list ==1.1.0
   - type-level-numbers ==0.1.1.1
   - type-list ==0.5.0.0
@@ -2062,6 +2174,9 @@ default-package-overrides:
   - unbounded-delays ==0.1.0.10
   - uncertain ==0.3.1.0
   - unexceptionalio ==0.3.0
+  - unfoldable ==0.9.2
+  - unfoldable-restricted ==0.0.2
+  - unicode ==0.0
   - unicode-show ==0.1.0.2
   - unicode-transforms ==0.2.1
   - unification-fd ==0.10.0.1
@@ -2070,6 +2185,8 @@ default-package-overrides:
   - uniplate ==1.6.12
   - uniq-deep ==1.1.0.0
   - Unique ==0.4.6.1
+  - unique ==0
+  - unit-constraint ==0.0.0
   - units ==2.4
   - units-defs ==2.0.1.1
   - units-parser ==0.1.0.0
@@ -2085,6 +2202,7 @@ default-package-overrides:
   - Unixutils ==1.54.1
   - unlit ==0.4.0.0
   - unordered-containers ==0.2.8.0
+  - unsafe ==0.0
   - uri-bytestring ==0.2.3.1
   - uri-encode ==1.5.0.5
   - uri-templater ==0.2.1.0
@@ -2110,7 +2228,7 @@ default-package-overrides:
   - vcswrapper ==0.1.5
   - vector ==0.11.0.0
   - vector-algorithms ==0.7.0.1
-  - vector-binary-instances ==0.2.3.4
+  - vector-binary-instances ==0.2.3.5
   - vector-buffer ==0.4.1
   - vector-fftw ==0.1.3.7
   - vector-instances ==3.4
@@ -2130,13 +2248,14 @@ default-package-overrides:
   - vty ==5.15
   - wai ==3.2.1.1
   - wai-app-static ==3.1.6.1
+  - wai-cli ==0.1.1
   - wai-conduit ==3.0.0.3
   - wai-cors ==0.2.5
   - wai-eventsource ==3.0.0
   - wai-extra ==3.0.19.1
   - wai-handler-launch ==3.0.2.2
   - wai-logger ==2.3.0
-  - wai-middleware-auth ==0.1.1.2
+  - wai-middleware-auth ==0.1.2.0
   - wai-middleware-caching ==0.1.0.2
   - wai-middleware-caching-lru ==0.1.0.0
   - wai-middleware-caching-redis ==0.2.0.0
@@ -2145,6 +2264,7 @@ default-package-overrides:
   - wai-middleware-crowd ==0.1.4.2
   - wai-middleware-metrics ==0.2.4
   - wai-middleware-prometheus ==0.1.0.1
+  - wai-middleware-rollbar ==0.3.0
   - wai-middleware-static ==0.8.1
   - wai-middleware-throttle ==0.2.1.0
   - wai-middleware-verbs ==0.3.2
@@ -2157,7 +2277,7 @@ default-package-overrides:
   - wai-transformers ==0.0.7
   - wai-websockets ==3.0.1.1
   - waitra ==0.0.4.0
-  - warp ==3.2.11.1
+  - warp ==3.2.11.2
   - warp-tls ==3.2.3
   - wave ==0.1.4
   - wavefront ==0.7.1
@@ -2176,6 +2296,7 @@ default-package-overrides:
   - webpage ==0.0.5
   - webrtc-vad ==0.1.0.3
   - websockets ==0.10.0.0
+  - websockets-rpc ==0.0.2
   - websockets-snap ==0.10.2.0
   - weigh ==0.0.3
   - wikicfp-scraper ==0.1.0.8
@@ -2204,7 +2325,7 @@ default-package-overrides:
   - wordpass ==1.0.0.7
   - Workflow ==0.8.3
   - wrap ==0.0.0
-  - wreq ==0.5.0.0
+  - wreq ==0.5.0.1
   - writer-cps-full ==0.1.0.0
   - writer-cps-lens ==0.1.0.1
   - writer-cps-morph ==0.1.0.2
@@ -2227,6 +2348,7 @@ default-package-overrides:
   - xlsx ==0.4.3
   - xlsx-tabular ==0.2.2
   - xml ==1.3.14
+  - xml-basic ==0.1.1.3
   - xml-conduit ==1.4.0.4
   - xml-conduit-parse ==0.3.1.0
   - xml-conduit-writer ==0.1.1.1
@@ -2254,7 +2376,7 @@ default-package-overrides:
   - yesod-auth-basic ==0.1.0.2
   - yesod-auth-hashdb ==1.6.0.1
   - yesod-bin ==1.5.2.2
-  - yesod-core ==1.4.32
+  - yesod-core ==1.4.33
   - yesod-eventsource ==1.4.1
   - yesod-fay ==0.8.0
   - yesod-form ==1.4.11
@@ -2284,11 +2406,15 @@ default-package-overrides:
   - yi-rope ==0.8
   - yi-snippet ==0.13.5
   - yjtools ==0.9.18
+  - yoga ==0.0.0.1
+  - youtube ==0.2.1
   - zero ==0.1.4
   - zeromq4-haskell ==0.6.5
   - zip ==0.1.10
   - zip-archive ==0.3.0.5
   - zippers ==0.2.2
+  - ziptastic-client ==0.3.0.1
+  - ziptastic-core ==0.2.0.1
   - zlib ==0.6.1.2
   - zlib-bindings ==0.1.1.5
   - zlib-lens ==0.1.2.1
@@ -2321,6 +2447,8 @@ extra-packages:
   - seqid < 0.2                         # newer versions depend on transformers 0.4.x which we cannot provide in GHC 7.8.x
   - seqid-streams < 0.2                 # newer versions depend on transformers 0.4.x which we cannot provide in GHC 7.8.x
   - split < 0.2                         # newer versions don't work with GHC 6.12.3
+  - store < 0.4                         # needed by stack 1.4.0
+  - store-core < 0.4                    # needed by stack 1.4.0
   - tar < 0.4.2.0                       # later versions don't work with GHC < 7.6.x
   - transformers == 0.4.3.*             # the latest version isn't supported by mtl yet
   - vector < 0.10.10                    # newer versions don't work with GHC 6.12.3

pkgs/development/haskell-modules/configuration-nix.nix

@@ -126,8 +126,7 @@ self: super: builtins.intersectAttrs super {
   glib = disableHardening (addPkgconfigDepend (addBuildTool super.glib self.gtk2hs-buildtools) pkgs.glib) ["fortify"];
   gtk3 = disableHardening (super.gtk3.override { inherit (pkgs) gtk3; }) ["fortify"];
   gtk = disableHardening (addPkgconfigDepend (addBuildTool super.gtk self.gtk2hs-buildtools) pkgs.gtk2) ["fortify"];
-  gtksourceview2 = (addPkgconfigDepend super.gtksourceview2 pkgs.gtk2).override { inherit (pkgs.gnome2) gtksourceview; };
-  gtksourceview3 = super.gtksourceview3.override { inherit (pkgs.gnome3) gtksourceview; };
+  gtksourceview2 = addPkgconfigDepend super.gtksourceview2 pkgs.gtk2;
 
   # Need WebkitGTK, not just webkit.
   webkit = super.webkit.override { webkit = pkgs.webkitgtk2; };

pkgs/development/haskell-modules/default.nix

@@ -6,102 +6,12 @@
 
 let
 
-  inherit (stdenv.lib) fix' extends makeOverridable makeExtensible;
-  inherit (import ./lib.nix { inherit pkgs; }) overrideCabal;
-
-  haskellPackages = self:
-    let
-
-      mkDerivationImpl = pkgs.callPackage ./generic-builder.nix {
-        inherit stdenv;
-        inherit (pkgs) fetchurl pkgconfig glibcLocales coreutils gnugrep gnused;
-        nodejs = pkgs.nodejs-slim;
-        jailbreak-cabal = if (self.ghc.cross or null) != null
-          then self.ghc.bootPkgs.jailbreak-cabal
-          else self.jailbreak-cabal;
-        inherit (self) ghc;
-        hscolour = overrideCabal self.hscolour (drv: {
-          isLibrary = false;
-          doHaddock = false;
-          hyperlinkSource = false;      # Avoid depending on hscolour for this build.
-          postFixup = "rm -rf $out/lib $out/share $out/nix-support";
-        });
-        cpphs = overrideCabal (self.cpphs.overrideScope (self: super: {
-          mkDerivation = drv: super.mkDerivation (drv // {
-            enableSharedExecutables = false;
-            enableSharedLibraries = false;
-            doHaddock = false;
-            useCpphs = false;
-          });
-        })) (drv: {
-            isLibrary = false;
-            postFixup = "rm -rf $out/lib $out/share $out/nix-support";
-        });
-      };
-
-      mkDerivation = makeOverridable mkDerivationImpl;
-
-      callPackageWithScope = scope: drv: args: (stdenv.lib.callPackageWith scope drv args) // {
-        overrideScope = f: callPackageWithScope (mkScope (fix' (extends f scope.__unfix__))) drv args;
-      };
-
-      mkScope = scope: pkgs // pkgs.xorg // pkgs.gnome2 // scope;
-      defaultScope = mkScope self;
-      callPackage = drv: args: callPackageWithScope defaultScope drv args;
-
-      withPackages = packages: callPackage ./with-packages-wrapper.nix {
-        inherit (self) llvmPackages;
-        haskellPackages = self;
-        inherit packages;
-      };
-
-      haskellSrc2nix = { name, src, sha256 ? null }:
-        let
-          sha256Arg = if isNull sha256 then "--sha256=" else ''--sha256="${sha256}"'';
-        in pkgs.stdenv.mkDerivation {
-          name = "cabal2nix-${name}";
-          buildInputs = [ pkgs.cabal2nix ];
-          phases = ["installPhase"];
-          LANG = "en_US.UTF-8";
-          LOCALE_ARCHIVE = pkgs.lib.optionalString pkgs.stdenv.isLinux "${pkgs.glibcLocales}/lib/locale/locale-archive";
-          installPhase = ''
-            export HOME="$TMP"
-            mkdir -p "$out"
-            cabal2nix --compiler=${self.ghc.name} --system=${stdenv.system} ${sha256Arg} "${src}" > "$out/default.nix"
-          '';
-      };
-
-      hackage2nix = name: version: haskellSrc2nix {
-        name   = "${name}-${version}";
-        sha256 = ''$(sed -e 's/.*"SHA256":"//' -e 's/".*$//' "${all-cabal-hashes}/${name}/${version}/${name}.json")'';
-        src    = "${all-cabal-hashes}/${name}/${version}/${name}.cabal";
-      };
-
-    in
-      import ./hackage-packages.nix { inherit pkgs stdenv callPackage; } self // {
-
-        inherit mkDerivation callPackage haskellSrc2nix hackage2nix;
-
-        callHackage = name: version: self.callPackage (self.hackage2nix name version);
-
-        # Creates a Haskell package from a source package by calling cabal2nix on the source.
-        callCabal2nix = name: src: self.callPackage (self.haskellSrc2nix { inherit src name; });
-
-        ghcWithPackages = selectFrom: withPackages (selectFrom self);
-
-        ghcWithHoogle = selectFrom:
-          let
-            packages = selectFrom self;
-            hoogle = callPackage ./hoogle.nix {
-              inherit packages;
-            };
-          in withPackages (packages ++ [ hoogle ]);
-
-        ghc = ghc // {
-          withPackages = self.ghcWithPackages;
-          withHoogle = self.ghcWithHoogle;
-        };
+  inherit (stdenv.lib) extends makeExtensible;
+  inherit (import ./lib.nix { inherit pkgs; }) overrideCabal makePackageSet;
 
+  haskellPackages = makePackageSet {
+    package-set = import ./hackage-packages.nix;
+    inherit ghc;
   };
 
   commonConfiguration = import ./configuration-common.nix { inherit pkgs; };

pkgs/development/haskell-modules/lib.nix

@@ -1,6 +1,7 @@
 { pkgs }:
 
 rec {
+  makePackageSet = pkgs.callPackage ./make-package-set.nix {};
 
   overrideCabal = drv: f: (drv.override (args: args // {
     mkDerivation = drv: (args.mkDerivation drv).override f;

pkgs/development/haskell-modules/make-package-set.nix

@@ -0,0 +1,107 @@
+# This expression takes a file like `hackage-packages.nix` and constructs
+# a full package set out of that.
+
+# required dependencies:
+{ pkgs, stdenv, all-cabal-hashes }:
+
+# arguments:
+#  * ghc package to use
+#  * package-set: a function that takes { pkgs, stdenv, callPackage } as first arg and `self` as second
+{ ghc, package-set }:
+
+# return value: a function from self to the package set
+self: let
+
+  inherit (stdenv.lib) fix' extends makeOverridable;
+  inherit (import ./lib.nix { inherit pkgs; }) overrideCabal;
+
+  mkDerivationImpl = pkgs.callPackage ./generic-builder.nix {
+    inherit stdenv;
+    inherit (pkgs) fetchurl pkgconfig glibcLocales coreutils gnugrep gnused;
+    nodejs = pkgs.nodejs-slim;
+    jailbreak-cabal = if (self.ghc.cross or null) != null
+      then self.ghc.bootPkgs.jailbreak-cabal
+      else self.jailbreak-cabal;
+    inherit (self) ghc;
+    hscolour = overrideCabal self.hscolour (drv: {
+      isLibrary = false;
+      doHaddock = false;
+      hyperlinkSource = false;      # Avoid depending on hscolour for this build.
+      postFixup = "rm -rf $out/lib $out/share $out/nix-support";
+    });
+    cpphs = overrideCabal (self.cpphs.overrideScope (self: super: {
+      mkDerivation = drv: super.mkDerivation (drv // {
+        enableSharedExecutables = false;
+        enableSharedLibraries = false;
+        doHaddock = false;
+        useCpphs = false;
+      });
+    })) (drv: {
+        isLibrary = false;
+        postFixup = "rm -rf $out/lib $out/share $out/nix-support";
+    });
+  };
+
+  mkDerivation = makeOverridable mkDerivationImpl;
+
+  callPackageWithScope = scope: drv: args: (stdenv.lib.callPackageWith scope drv args) // {
+    overrideScope = f: callPackageWithScope (mkScope (fix' (extends f scope.__unfix__))) drv args;
+  };
+
+  mkScope = scope: pkgs // pkgs.xorg // pkgs.gnome2 // scope;
+  defaultScope = mkScope self;
+  callPackage = drv: args: callPackageWithScope defaultScope drv args;
+
+  withPackages = packages: callPackage ./with-packages-wrapper.nix {
+    inherit (self) llvmPackages;
+    haskellPackages = self;
+    inherit packages;
+  };
+
+  haskellSrc2nix = { name, src, sha256 ? null }:
+    let
+      sha256Arg = if isNull sha256 then "--sha256=" else ''--sha256="${sha256}"'';
+    in pkgs.stdenv.mkDerivation {
+      name = "cabal2nix-${name}";
+      buildInputs = [ pkgs.cabal2nix ];
+      phases = ["installPhase"];
+      LANG = "en_US.UTF-8";
+      LOCALE_ARCHIVE = pkgs.lib.optionalString pkgs.stdenv.isLinux "${pkgs.glibcLocales}/lib/locale/locale-archive";
+      installPhase = ''
+        export HOME="$TMP"
+        mkdir -p "$out"
+        cabal2nix --compiler=${self.ghc.name} --system=${stdenv.system} ${sha256Arg} "${src}" > "$out/default.nix"
+      '';
+  };
+
+  hackage2nix = name: version: haskellSrc2nix {
+    name   = "${name}-${version}";
+    sha256 = ''$(sed -e 's/.*"SHA256":"//' -e 's/".*$//' "${all-cabal-hashes}/${name}/${version}/${name}.json")'';
+    src    = "${all-cabal-hashes}/${name}/${version}/${name}.cabal";
+  };
+
+in package-set { inherit pkgs stdenv callPackage; } self // {
+
+    inherit mkDerivation callPackage haskellSrc2nix hackage2nix;
+
+    callHackage = name: version: self.callPackage (self.hackage2nix name version);
+
+    # Creates a Haskell package from a source package by calling cabal2nix on the source.
+    callCabal2nix = name: src: self.callPackage (self.haskellSrc2nix { inherit src name; });
+
+    ghcWithPackages = selectFrom: withPackages (selectFrom self);
+
+    ghcWithHoogle = selectFrom:
+      let
+        packages = selectFrom self;
+        hoogle = callPackage ./hoogle.nix {
+          inherit packages;
+        };
+      in withPackages (packages ++ [ hoogle ]);
+
+    ghc = ghc // {
+      withPackages = self.ghcWithPackages;
+      withHoogle = self.ghcWithHoogle;
+    };
+
+  }

pkgs/development/haskell-modules/patches/hdbus-semicolons.patch

@@ -1,34 +0,0 @@
-From 8fd84b4d6ba257ac93a61bce3378777840e8bf80 Mon Sep 17 00:00:00 2001
-From: Nikolay Amiantov <ab@fmap.me>
-Date: Sat, 5 Nov 2016 14:27:04 +0300
-Subject: [PATCH] getSessionAddress: take first bus address from
- semicolon-separated variable
-
----
- lib/DBus/Address.hs | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/lib/DBus/Address.hs b/lib/DBus/Address.hs
-index 72ac99d..596b18c 100644
---- a/lib/DBus/Address.hs
-+++ b/lib/DBus/Address.hs
-@@ -18,6 +18,7 @@ module DBus.Address where
- import qualified Control.Exception
- import           Data.Char (digitToInt, ord, chr)
- import           Data.List (intercalate)
-+import           Data.Maybe (listToMaybe)
- import qualified Data.Map
- import           Data.Map (Map)
- import qualified System.Environment
-@@ -152,7 +153,7 @@ getSystemAddress = do
- getSessionAddress :: IO (Maybe Address)
- getSessionAddress = do
- 	env <- getenv "DBUS_SESSION_BUS_ADDRESS"
--	return (env >>= parseAddress)
-+	return $ maybe Nothing listToMaybe (env >>= parseAddresses)
- 
- -- | Returns the address in the environment variable
- -- @DBUS_STARTER_ADDRESS@, which must be set.
--- 
-2.10.1
-

pkgs/development/interpreters/picolisp/default.nix

@@ -3,10 +3,10 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "picoLisp-${version}";
-  version = "16.6";
+  version = "16.12";
   src = fetchurl {
     url = "http://www.software-lab.de/${name}.tgz";
-    sha256 = "0y9b4wqpgx0j0igbp4h7k0bw3hvp7dnrhl3fsaagjpp305b003z3";
+    sha256 = "1k3x6mvk9b34iiyml142bzh3gf241f25ywjlaagbxzb9vklpws75";
   };
   buildInputs = optional stdenv.is64bit jdk;
   patchPhase = optionalString stdenv.isArm ''

pkgs/development/interpreters/python/cpython/3.6/default.nix

@@ -26,7 +26,7 @@ with stdenv.lib;
 
 let
   majorVersion = "3.6";
-  minorVersion = "0";
+  minorVersion = "1";
   minorVersionSuffix = "";
   pythonVersion = majorVersion;
   version = "${majorVersion}.${minorVersion}${minorVersionSuffix}";
@@ -47,7 +47,7 @@ in stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.python.org/ftp/python/${majorVersion}.${minorVersion}/Python-${version}.tar.xz";
-    sha256 = "08inlbb2vb8lahw6wfq654lqk6l1x7ncpggp6a92vqw5yq2gkidh";
+    sha256 = "0ha03sbakxblzyvlramx5fj0ranzmzx4pa2png6nn8gczkfi0650";
   };
 
   NIX_LDFLAGS = optionalString stdenv.isLinux "-lgcc_s";
@@ -63,14 +63,6 @@ in stdenv.mkDerivation {
     substituteInPlace configure --replace '-Wl,-stack_size,1000000' ' '
   '';
 
-  patches = [
-    (fetchpatch {
-      name = "glibc-2.25-failed-to-get-random-numbers.patch";
-      url = https://github.com/python/cpython/commit/ff558f5aba4.patch;
-      sha256 = "1k12gpn69np94cm942vaf40sv7gsxqf20rv1m3parzgi1gs4hqa3";
-    })
-  ];
-
   postPatch = ''
     # Determinism
     substituteInPlace "Lib/py_compile.py" --replace "source_stats['mtime']" "(1 if 'DETERMINISTIC_BUILD' in os.environ else source_stats['mtime'])"

pkgs/development/libraries/aspell/default.nix

@@ -23,12 +23,27 @@ stdenv.mkDerivation rec {
     );
   '';
 
-  # Note: Users should define the `ASPELL_CONF' environment variable to
-  # `data-dir $HOME/.nix-profile/lib/aspell/' so that they can access
-  # dictionaries installed in their profile.
-  #
-  # We can't use `$out/etc/aspell.conf' for that purpose since Aspell
-  # doesn't expand environment variables such as `$HOME'.
+  postInstall = ''
+    local prog="$out/bin/aspell"
+    local hidden="$out/bin/.aspell-wrapped"
+    mv "$prog" "$hidden"
+    cat > "$prog" <<END
+    #! $SHELL -e
+    if [ -z "\$ASPELL_CONF" ]; then
+      for p in \$NIX_PROFILES; do
+        if [ -d "\$p/lib/aspell" ]; then
+          ASPELL_CONF="data-dir \$p/lib/aspell"
+        fi
+      done
+      if [ -z "\$ASPELL_CONF" ] && [ -d "\$HOME/.nix-profile/lib/aspell" ]; then
+        ASPELL_CONF="data-dir \$HOME/.nix-profile/lib/aspell"
+      fi
+      export ASPELL_CONF
+    fi
+    exec "$hidden" "\$@"
+    END
+    chmod +x "$prog"
+  '';
 
   meta = {
     description = "Spell checker for many languages";

pkgs/development/libraries/curlcpp/default.nix

@@ -1,13 +1,14 @@
 { stdenv, fetchFromGitHub, cmake, curl }: 
 
-stdenv.mkDerivation {
-  name = "curlcpp-20160901";
+stdenv.mkDerivation rec {
+  name = "curlcpp-${version}";
+  version = "1.0";
 
   src = fetchFromGitHub {
     owner = "JosephP91";
     repo = "curlcpp";
-    rev = "98286da1d6c9f6158344a8e272eae5030cbf6c0e";
-    sha256 = "00nm2b8ik1yvaz5dp1b61jid841jv6zf8k5ma2nxbf1di1apqh0d";
+    rev = "${version}";
+    sha256 = "1akibhrmqsy0dlz9lq93508bhkh7r1l0aycbzy2x45a9gqxfdi4q";
   };
 
   buildInputs = [ cmake curl ];
@@ -17,7 +18,7 @@ stdenv.mkDerivation {
     description = "Object oriented C++ wrapper for CURL";
     platforms = platforms.unix;
     license = licenses.mit;
-    maintainers = [ maintainers.juliendehos ];
+    maintainers = with maintainers; [ juliendehos rszibele ];
   };
 }
 

pkgs/development/libraries/hivex/default.nix

@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   name = "hivex-${version}";
-  version = "1.3.11";
+  version = "1.3.14";
 
   src = fetchurl {
     url = "http://libguestfs.org/download/hivex/${name}.tar.gz";
-    sha256 = "0y3nqykwy58divxkv7gmsb067dasyfz3apbp437hl57rgrndyfn6";
+    sha256 = "0aqv28prjcmc66znw0wgaxjijg5mjm44bgn1iil8a4dlbsgv4p7b";
   };
 
   patches = [ ./hivex-syms.patch ];

pkgs/development/libraries/hivex/hivex-syms.patch

@@ -1,6 +1,6 @@
-diff -rupN hivex-1.3.11/lib/Makefile.am hivex-1.3.11-new/lib/Makefile.am
---- hivex-1.3.11/lib/Makefile.am	2013-09-10 13:04:12.000000000 +0200
-+++ hivex-1.3.11-new/lib/Makefile.am	2014-11-06 01:31:05.956106861 +0100
+diff -rupN hivex-1.3.14/lib/Makefile.am hivex-1.3.14-new/lib/Makefile.am
+--- hivex-1.3.14/lib/Makefile.am	2013-09-10 13:04:12.000000000 +0200
++++ hivex-1.3.14-new/lib/Makefile.am	2014-11-06 01:31:05.956106861 +0100
 @@ -40,8 +40,7 @@ libhivex_la_SOURCES = \
  
  libhivex_la_LIBADD =  ../gnulib/lib/libgnu.la $(LTLIBOBJS)

pkgs/development/libraries/hunspell/default.nix

@@ -1,16 +1,21 @@
-{ stdenv, fetchurl, ncurses, readline }:
+{ stdenv, fetchurl, ncurses, readline, autoreconfHook }:
 
 stdenv.mkDerivation rec {
-  name = "hunspell-1.3.3";
+  version = "1.6.1";
+  name = "hunspell-${version}";
 
   src = fetchurl {
-    url = "mirror://sourceforge/hunspell/${name}.tar.gz";
-    sha256 = "0v14ff9s37vkh45diaddndcrj0hmn67arh8xh8k79q9c1vgc1cm7";
+    url = "https://github.com/hunspell/hunspell/archive/v${version}.tar.gz";
+    sha256 = "0j9c20sj7bgd6f77193g1ihy8w905byk2gdhdc0r9dsh7irr7x9h";
   };
 
   outputs = [ "bin" "dev" "out" "man" ];
 
   buildInputs = [ ncurses readline ];
+  nativeBuildInputs = [ autoreconfHook ];
+
+  autoreconfFlags = "-vfi";
+
   configureFlags = [ "--with-ui" "--with-readline" ];
 
   hardeningDisable = [ "format" ];

pkgs/development/libraries/libbsd/darwin.patch

@@ -0,0 +1,675 @@
+diff --git a/configure.ac b/configure.ac
+index 5a432d4..a69ae0b 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -55,7 +55,7 @@ AS_CASE([$host_os],
+ )
+ 
+ # Checks for header files.
+-AC_CHECK_HEADERS([sys/ndir.h sys/dir.h ndir.h dirent.h])
++AC_CHECK_HEADERS([sys/ndir.h sys/dir.h ndir.h dirent.h stdio_ext.h])
+ 
+ # Checks for typedefs, structures, and compiler characteristics.
+ AC_TYPE_UID_T
+@@ -143,6 +143,31 @@ AC_CHECK_FUNCS([clearenv dirfd fopencookie __fpurge \
+                 pstat_getproc sysconf])
+ AM_CONDITIONAL(HAVE_GETENTROPY, [test "x$ac_cv_func_getentropy" = "xtrue"])
+ 
++HostOS=`echo "$host" | sed 's/.*-//'`
++os_is_macosx=false
++nonLinuxOS=false
++AC_SUBST(HostOS)
++case ${HostOS} in
++	darwin* | powerpc*-*-darwin* | freebsd* | netbsd* | openbsd*)
++		os_is_macosx=true
++		nonLinuxOS=true
++		echo HostOS="$HostOS"
++		;;
++	*)
++		echo host="$host"
++		echo HostOS="$HostOS"
++		os_is_macosx=false
++		nonLinuxOS=false
++		;;
++esac		
++AM_CONDITIONAL([IS_DARWIN], [test x$os_is_macosx = xtrue])
++AM_COND_IF([IS_DARWIN],
++	[AC_DEFINE([IS_DARWIN], [1], [Get HostOS Type is Darwin])])
++
++AM_CONDITIONAL([NON_LINUX], [test x$userdefine_gethostbyname_r = xtrue])
++AM_COND_IF([NON_LINUX],
++	[AC_DEFINE([NON_LINUX], [1], [Get HostOS Type])])
++
+ AC_CONFIG_FILES([
+ 	Makefile
+ 	include/Makefile
+diff --git a/include/bsd/libutil.h b/include/bsd/libutil.h
+index ebb6160..ce882bf 100644
+--- a/include/bsd/libutil.h
++++ b/include/bsd/libutil.h
+@@ -39,7 +39,9 @@
+ #ifndef _LIBUTIL_H_
+ #define _LIBUTIL_H_
+ 
++#ifdef HAVE_FEATURES_H
+ #include <features.h>
++#endif
+ #include <sys/cdefs.h>
+ #include <sys/types.h>
+ #include <stdint.h>
+diff --git a/include/bsd/stdio.h b/include/bsd/stdio.h
+index 7697425..ef34c4f 100644
+--- a/include/bsd/stdio.h
++++ b/include/bsd/stdio.h
+@@ -44,12 +44,16 @@
+ __BEGIN_DECLS
+ const char *fmtcheck(const char *, const char *);
+ 
++#if !defined(darwin) && !defined(__APPLE__) && !defined(MACOSX)
+ /* XXX: The function requires cooperation from the system libc to store the
+  * line buffer in the FILE struct itself. */
+ char *fgetln(FILE *fp, size_t *lenp)
+ 	__attribute__((deprecated("This functions cannot be safely ported, "
+ 	                          "use getline(3) instead, as it is supported "
+ 	                          "by GNU and POSIX.1-2008.")));
++#else
++char *fgetln(FILE *fp, size_t *lenp);
++#endif
+ 
+ /*
+  * Note: We diverge from the FreeBSD, OpenBSD and DragonFlyBSD declarations,
+diff --git a/include/bsd/string.h b/include/bsd/string.h
+index ee2f953..a3ab077 100644
+--- a/include/bsd/string.h
++++ b/include/bsd/string.h
+@@ -37,11 +37,14 @@
+ #include <sys/types.h>
+ 
+ __BEGIN_DECLS
+-size_t strlcpy(char *dst, const char *src, size_t siz);
+-size_t strlcat(char *dst, const char *src, size_t siz);
+ char *strnstr(const char *str, const char *find, size_t str_len);
++#if defined(darwin) || defined(__APPLE__) || defined(MACOSX)
++size_t bsd_strlcpy(char *dst, const char *src, size_t siz);
++size_t bsd_strlcat(char *dst, const char *src, size_t siz);
++void bsd_strmode(mode_t mode, char *str);
++#else
+ void strmode(mode_t mode, char *str);
+-
++#endif
+ void explicit_bzero(void *buf, size_t len);
+ __END_DECLS
+ 
+diff --git a/src/Makefile.am b/src/Makefile.am
+index ad83dbf..0f2a7ee 100644
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -54,17 +54,21 @@ libbsd_la_DEPENDENCIES = \
+ 	libbsd.map
+ libbsd_la_LIBADD = \
+ 	$(CLOCK_GETTIME_LIBS)
++
++if IS_DARWIN
++libbsd_la_LDFLAGS = \
++	-Wl \
++	-version-number $(LIBBSD_ABI)
++else
+ libbsd_la_LDFLAGS = \
+ 	-Wl,--version-script=$(srcdir)/libbsd.map \
+ 	-version-number $(LIBBSD_ABI)
++endif
++
+ libbsd_la_SOURCES = \
+ 	arc4random.c \
+-	arc4random.h \
+-	arc4random_unix.h \
+-	arc4random_openbsd.h \
+ 	arc4random_uniform.c \
+ 	bsd_getopt.c \
+-	chacha_private.h \
+ 	closefrom.c \
+ 	dehumanize_number.c \
+ 	err.c \
+@@ -117,6 +121,15 @@ libbsd_la_SOURCES += \
+ 	$(nil)
+ endif
+ 
++noinst_HEADERS = \
++	arc4random.h \
++	arc4random_bsd.h \
++	arc4random_linux.h \
++	arc4random_unix.h \
++	arc4random_osx.h \
++	arc4random_openbsd.h \
++	chacha_private.h
++
+ libbsd_ctor_a_SOURCES = \
+ 	setproctitle_ctor.c \
+ 	$(nil)
+diff --git a/src/arc4random_bsd.h b/src/arc4random_bsd.h
+new file mode 100644
+index 0000000..ece2f85
+--- /dev/null
++++ b/src/arc4random_bsd.h
+@@ -0,0 +1,86 @@
++/*	$OpenBSD: arc4random_freebsd.h,v 1.2 2015/01/15 06:57:18 deraadt Exp $	*/
++
++/*
++ * Copyright (c) 1996, David Mazieres <dm@uun.org>
++ * Copyright (c) 2008, Damien Miller <djm@openbsd.org>
++ * Copyright (c) 2013, Markus Friedl <markus@openbsd.org>
++ * Copyright (c) 2014, Theo de Raadt <deraadt@openbsd.org>
++ *
++ * Permission to use, copy, modify, and distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
++ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
++ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
++ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++/*
++ * Stub functions for portability.
++ */
++
++#include <sys/mman.h>
++
++#include <pthread.h>
++#include <signal.h>
++
++static pthread_mutex_t arc4random_mtx = PTHREAD_MUTEX_INITIALIZER;
++#define _ARC4_LOCK()   pthread_mutex_lock(&arc4random_mtx)
++#define _ARC4_UNLOCK() pthread_mutex_unlock(&arc4random_mtx)
++
++/*
++ * Unfortunately, pthread_atfork() is broken on FreeBSD (at least 9 and 10) if
++ * a program does not link to -lthr. Callbacks registered with pthread_atfork()
++ * appear to fail silently. So, it is not always possible to detect a PID
++ * wraparound.
++ */
++#define _ARC4_ATFORK(f) pthread_atfork(NULL, NULL, (f))
++
++static inline void
++_getentropy_fail(void)
++{
++	raise(SIGKILL);
++}
++
++static volatile sig_atomic_t _rs_forked;
++
++static inline void
++_rs_forkhandler(void)
++{
++	_rs_forked = 1;
++}
++
++static inline void
++_rs_forkdetect(void)
++{
++	static pid_t _rs_pid = 0;
++	pid_t pid = getpid();
++
++	if (_rs_pid == 0 || _rs_pid != pid || _rs_forked) {
++		_rs_pid = pid;
++		_rs_forked = 0;
++		if (rs)
++			memset(rs, 0, sizeof(*rs));
++	}
++}
++
++static inline int
++_rs_allocate(struct _rs **rsp, struct _rsx **rsxp)
++{
++	if ((*rsp = mmap(NULL, sizeof(**rsp), PROT_READ|PROT_WRITE,
++	    MAP_ANON|MAP_PRIVATE, -1, 0)) == MAP_FAILED)
++		return (-1);
++
++	if ((*rsxp = mmap(NULL, sizeof(**rsxp), PROT_READ|PROT_WRITE,
++	    MAP_ANON|MAP_PRIVATE, -1, 0)) == MAP_FAILED) {
++		munmap(*rsp, sizeof(**rsp));
++		return (-1);
++	}
++
++	_ARC4_ATFORK(_rs_forkhandler);
++	return (0);
++}
+diff --git a/src/arc4random_linux.h b/src/arc4random_linux.h
+new file mode 100644
+index 0000000..d61a8db
+--- /dev/null
++++ b/src/arc4random_linux.h
+@@ -0,0 +1,86 @@
++/*	$OpenBSD: arc4random_linux.h,v 1.8 2014/08/13 06:04:10 deraadt Exp $	*/
++
++/*
++ * Copyright (c) 1996, David Mazieres <dm@uun.org>
++ * Copyright (c) 2008, Damien Miller <djm@openbsd.org>
++ * Copyright (c) 2013, Markus Friedl <markus@openbsd.org>
++ * Copyright (c) 2014, Theo de Raadt <deraadt@openbsd.org>
++ *
++ * Permission to use, copy, modify, and distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
++ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
++ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
++ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++/*
++ * Stub functions for portability.
++ */
++
++#include <sys/mman.h>
++
++#include <pthread.h>
++#include <signal.h>
++
++static pthread_mutex_t arc4random_mtx = PTHREAD_MUTEX_INITIALIZER;
++#define _ARC4_LOCK()   pthread_mutex_lock(&arc4random_mtx)
++#define _ARC4_UNLOCK() pthread_mutex_unlock(&arc4random_mtx)
++
++#ifdef __GLIBC__
++extern void *__dso_handle;
++extern int __register_atfork(void (*)(void), void(*)(void), void (*)(void), void *);
++#define _ARC4_ATFORK(f) __register_atfork(NULL, NULL, (f), __dso_handle)
++#else
++#define _ARC4_ATFORK(f) pthread_atfork(NULL, NULL, (f))
++#endif
++
++static inline void
++_getentropy_fail(void)
++{
++	raise(SIGKILL);
++}
++
++static volatile sig_atomic_t _rs_forked;
++
++static inline void
++_rs_forkhandler(void)
++{
++	_rs_forked = 1;
++}
++
++static inline void
++_rs_forkdetect(void)
++{
++	static pid_t _rs_pid = 0;
++	pid_t pid = getpid();
++
++	if (_rs_pid == 0 || _rs_pid != pid || _rs_forked) {
++		_rs_pid = pid;
++		_rs_forked = 0;
++		if (rs)
++			memset(rs, 0, sizeof(*rs));
++	}
++}
++
++static inline int
++_rs_allocate(struct _rs **rsp, struct _rsx **rsxp)
++{
++	if ((*rsp = mmap(NULL, sizeof(**rsp), PROT_READ|PROT_WRITE,
++	    MAP_ANON|MAP_PRIVATE, -1, 0)) == MAP_FAILED)
++		return (-1);
++
++	if ((*rsxp = mmap(NULL, sizeof(**rsxp), PROT_READ|PROT_WRITE,
++	    MAP_ANON|MAP_PRIVATE, -1, 0)) == MAP_FAILED) {
++		munmap(*rsp, sizeof(**rsp));
++		return (-1);
++	}
++
++	_ARC4_ATFORK(_rs_forkhandler);
++	return (0);
++}
+diff --git a/src/arc4random_osx.h b/src/arc4random_osx.h
+new file mode 100644
+index 0000000..14771a6
+--- /dev/null
++++ b/src/arc4random_osx.h
+@@ -0,0 +1,82 @@
++/*	$OpenBSD: arc4random_osx.h,v 1.10 2015/09/11 11:52:55 deraadt Exp $	*/
++
++/*
++ * Copyright (c) 1996, David Mazieres <dm@uun.org>
++ * Copyright (c) 2008, Damien Miller <djm@openbsd.org>
++ * Copyright (c) 2013, Markus Friedl <markus@openbsd.org>
++ * Copyright (c) 2014, Theo de Raadt <deraadt@openbsd.org>
++ *
++ * Permission to use, copy, modify, and distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
++ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
++ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
++ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++/*
++ * Stub functions for portability.
++ */
++
++#include <sys/mman.h>
++
++#include <unistd.h>
++#include <pthread.h>
++#include <signal.h>
++
++static pthread_mutex_t arc4random_mtx = PTHREAD_MUTEX_INITIALIZER;
++#define _ARC4_LOCK()   pthread_mutex_lock(&arc4random_mtx)
++#define _ARC4_UNLOCK() pthread_mutex_unlock(&arc4random_mtx)
++
++#define _ARC4_ATFORK(f) pthread_atfork(NULL, NULL, (f))
++
++static inline void
++_getentropy_fail(void)
++{
++	raise(SIGKILL);
++}
++
++static volatile sig_atomic_t _rs_forked;
++
++static inline void
++_rs_forkhandler(void)
++{
++	_rs_forked = 1;
++}
++
++static inline void
++_rs_forkdetect(void)
++{
++	static pid_t _rs_pid = 0;
++	pid_t pid = getpid();
++
++	if (_rs_pid == 0 || _rs_pid != pid || _rs_forked) {
++		_rs_pid = pid;
++		_rs_forked = 0;
++		if (rs)
++			memset(rs, 0, sizeof(*rs));
++	}
++}
++
++static inline int
++_rs_allocate(struct _rs **rsp, struct _rsx **rsxp)
++{
++	if ((*rsp = mmap(NULL, sizeof(**rsp), PROT_READ|PROT_WRITE,
++	    MAP_ANON|MAP_PRIVATE, -1, 0)) == MAP_FAILED)
++		return (-1);
++
++	if ((*rsxp = mmap(NULL, sizeof(**rsxp), PROT_READ|PROT_WRITE,
++	    MAP_ANON|MAP_PRIVATE, -1, 0)) == MAP_FAILED) {
++		munmap(*rsp, sizeof(**rsp));
++		*rsp = NULL;
++		return (-1);
++	}
++
++	_ARC4_ATFORK(_rs_forkhandler);
++	return (0);
++}
+diff --git a/src/fgetln.c b/src/fgetln.c
+index 4d1726e..9c73788 100644
+--- a/src/fgetln.c
++++ b/src/fgetln.c
+@@ -30,7 +30,9 @@
+ #include <sys/types.h>
+ #include <string.h>
+ 
++#if !defined(darwin) && !defined(__APPLE__) && !defined(MACOSX)
+ #include "local-link.h"
++#endif
+ 
+ #ifdef HAVE_GETLINE
+ struct filebuf {
+@@ -75,9 +77,11 @@ fgetln(FILE *stream, size_t *len)
+ 		return fb->buf;
+ 	}
+ }
++#if !defined(darwin) && !defined(__APPLE__) && !defined(MACOSX)
+ libbsd_link_warning(fgetln,
+                     "This functions cannot be safely ported, use getline(3) "
+                     "instead, as it is supported by GNU and POSIX.1-2008.")
++#endif
+ #else
+ #error "Function fgetln() needs to be ported."
+ #endif
+diff --git a/src/fpurge.c b/src/fpurge.c
+index 462535a..e7eb46f 100644
+--- a/src/fpurge.c
++++ b/src/fpurge.c
+@@ -26,9 +26,11 @@
+ 
+ #include <errno.h>
+ #include <stdio.h>
++#if HAVE___FPURGE
+ #include <stdio_ext.h>
++#endif
+ 
+-#ifdef HAVE___FPURGE
++#ifdef HAVE___FPURGE                   /* glibc >= 2.2, Haiku, Solaris >= 7 */
+ int
+ fpurge(FILE *fp)
+ {
+@@ -42,5 +44,55 @@ fpurge(FILE *fp)
+ 	return 0;
+ }
+ #else
+-#error "Function fpurge() needs to be ported."
++#define fp_ fp
++//#error "Function fpurge() needs to be ported."
++//#elif HAVE_FPURGE                   /* FreeBSD, NetBSD, OpenBSD, DragonFly, Mac OS X, Cygwin 1.7 */
++int
++fpurge(FILE *fp)
++{
++	if (fp == NULL || fileno(fp) < 0) {
++		errno = EBADF;
++		return EOF;
++	}
++
++  /* Call the system's fpurge function.  */
++# undef fpurge
++# if !HAVE_DECL_FPURGE
++  extern int fpurge (FILE *);
++# endif
++  int result = fpurge (fp);
++# if defined __sferror || defined __DragonFly__ /* FreeBSD, NetBSD, OpenBSD, DragonFly, Mac OS X, Cygwin */
++  if (result == 0)
++    /* Correct the invariants that fpurge broke.
++       <stdio.h> on BSD systems says:
++         "The following always hold: if _flags & __SRD, _w is 0."
++       If this invariant is not fulfilled and the stream is read-write but
++       currently reading, subsequent putc or fputc calls will write directly
++       into the buffer, although they shouldn't be allowed to.  */
++    if ((fp_->_flags & __SRD) != 0)
++      fp_->_w = 0;
++#endif
++  return result;
++}
++//#endif
++#endif
++
++#ifdef TEST
++int
++main()
++{
++	static FILE fp_bad;
++	FILE *fp;
++
++	if (fpurge(&fp_bad) == 0)
++		return 1;
++
++	fp = fopen("/dev/zero", "r");
++	if (fpurge(fp) < 0)
++		return 1;
++
++	fclose(fp);
++
++	return 0;
++}
+ #endif
+diff --git a/src/funopen.c b/src/funopen.c
+index 7d6ae31..9963162 100644
+--- a/src/funopen.c
++++ b/src/funopen.c
+@@ -137,6 +137,7 @@ funopen(const void *cookie,
+ 
+ 	return fopencookie(cookiewrap, mode, funcswrap);
+ }
++#elif defined(darwin) || defined(__APPLE__) || defined(MACOSX)
+ #else
+ #error "Function funopen() needs to be ported."
+ #endif
+diff --git a/src/getentropy.c b/src/getentropy.c
+index 3f11a1e..8a23a07 100644
+--- a/src/getentropy.c
++++ b/src/getentropy.c
+@@ -28,9 +28,7 @@
+ #include "getentropy_linux.c"
+ #elif defined(__GNU__)
+ #include "getentropy_hurd.c"
+-#elif defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
+-#include "getentropy_bsd.c"
+-#elif defined(__NetBSD__)
++#elif defined(__FreeBSD__) || defined(__FreeBSD_kernel__) || defined(__NetBSD__)
+ #include "getentropy_bsd.c"
+ #elif defined(__sun)
+ #include "getentropy_solaris.c"
+diff --git a/src/hash/sha512.h b/src/hash/sha512.h
+index 4f368a1..ab22fc1 100644
+--- a/src/hash/sha512.h
++++ b/src/hash/sha512.h
+@@ -29,7 +29,11 @@
+ #ifndef _SHA512_H_
+ #define _SHA512_H_
+ 
++#if defined(darwin) || defined(__APPLE__) || defined(MACOSX)
++#include <stdint.h>
++#else
+ #include <sys/types.h>
++#endif
+ 
+ #define SHA512_DIGEST_LENGTH		64
+ 
+diff --git a/src/hash/sha512c.c b/src/hash/sha512c.c
+index c2a93be..f69013d 100644
+--- a/src/hash/sha512c.c
++++ b/src/hash/sha512c.c
+@@ -27,7 +27,11 @@
+ #include <sys/cdefs.h>
+ __FBSDID("$FreeBSD$");
+ 
++#if defined(darwin) || defined(__APPLE__) || defined(MACOSX)
++#include <machine/endian.h>
++#else
+ #include <sys/endian.h>
++#endif
+ #include <sys/types.h>
+ 
+ #include <string.h>
+diff --git a/src/nlist.c b/src/nlist.c
+index 0cffe55..f785b61 100644
+--- a/src/nlist.c
++++ b/src/nlist.c
+@@ -27,6 +27,7 @@
+  * SUCH DAMAGE.
+  */
+ 
++#if !defined(darwin) && !defined(__APPLE__) && !defined(MACOSX)
+ #if defined(LIBC_SCCS) && !defined(lint)
+ static char sccsid[] = "@(#)nlist.c	8.1 (Berkeley) 6/4/93";
+ #endif /* LIBC_SCCS and not lint */
+@@ -409,3 +410,4 @@ elf_sym_to_nlist(struct nlist *nl, Elf_Sym *s, Elf_Shdr *shdr, int shnum)
+ 		nl->n_type |= N_EXT;
+ }
+ #endif /* _NLIST_DO_ELF */
++#endif
+diff --git a/src/setproctitle.c b/src/setproctitle.c
+index c18c61c..b1b1591 100644
+--- a/src/setproctitle.c
++++ b/src/setproctitle.c
+@@ -32,6 +32,11 @@
+ #include <unistd.h>
+ #include <string.h>
+ 
++#if defined(darwin) || defined(__APPLE__) || defined(MACOSX)
++#define __asm__(x)
++extern char **environ;
++#endif
++
+ static struct {
+ 	/* Original value. */
+ 	const char *arg0;
+@@ -287,7 +292,14 @@ __asm__(".symver setproctitle_impl,setproctitle@@LIBBSD_0.5");
+  * for code linking against that version, and change the default to use the
+  * new version, so that new code depends on the implemented version. */
+ #ifdef HAVE_TYPEOF
++#if defined(darwin) || defined(__APPLE__) || defined(MACOSX)
++//
++// HACK: even weak aliasing breaks in clang so just comment this out for now
++//
++// extern typeof(setproctitle_impl) setproctitle_stub __attribute__((weak, alias("setproctitle_impl")));
++#else
+ extern typeof(setproctitle_impl) setproctitle_stub __attribute__((alias("setproctitle_impl")));
++#endif
+ #else
+ void setproctitle_stub(const char *fmt, ...)
+ 	__attribute__((alias("setproctitle_impl")));
+diff --git a/src/strlcat.c b/src/strlcat.c
+index 21c8afb..e036132 100644
+--- a/src/strlcat.c
++++ b/src/strlcat.c
+@@ -27,7 +27,11 @@
+  * If retval >= siz, truncation occurred.
+  */
+ size_t
++#if defined(darwin) || defined(__APPLE__) || defined(MACOSX)
++bsd_strlcat(char *dst, const char *src, size_t siz)
++#else
+ strlcat(char *dst, const char *src, size_t siz)
++#endif
+ {
+ 	char *d = dst;
+ 	const char *s = src;
+diff --git a/src/strlcpy.c b/src/strlcpy.c
+index 1719d35..c63591d 100644
+--- a/src/strlcpy.c
++++ b/src/strlcpy.c
+@@ -25,7 +25,11 @@
+  * Returns strlen(src); if retval >= siz, truncation occurred.
+  */
+ size_t
++#if defined(darwin) || defined(__APPLE__) || defined(MACOSX)
++bsd_strlcpy(char *dst, const char *src, size_t siz)
++#else
+ strlcpy(char *dst, const char *src, size_t siz)
++#endif
+ {
+ 	char *d = dst;
+ 	const char *s = src;
+diff --git a/src/strmode.c b/src/strmode.c
+index 8d825ae..c1b5f8d 100644
+--- a/src/strmode.c
++++ b/src/strmode.c
+@@ -37,7 +37,11 @@ static char sccsid[] = "@(#)strmode.c	8.3 (Berkeley) 8/15/94";
+ #include <string.h>
+ 
+ void
++#if defined(darwin) || defined(__APPLE__) || defined(MACOSX)
++bsd_strmode(mode_t mode, char *p)
++#else
+ strmode(mode_t mode, char *p)
++#endif
+ {
+ 	 /* print type */
+ 	switch (mode & S_IFMT) {

pkgs/development/libraries/libbsd/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, autoreconfHook }:
 
 stdenv.mkDerivation rec {
   name = "libbsd-${version}";
@@ -9,10 +9,16 @@ stdenv.mkDerivation rec {
     sha256 = "1a1l7afchlvvj2zfi7ajcg26bbkh5i98y2v5h9j5p1px9m7n6jwk";
   };
 
+  # darwin changes configure.ac which means we need to regenerate
+  # the configure scripts
+  nativeBuildInputs = [ autoreconfHook ];
+
+  patches = stdenv.lib.optionals stdenv.isDarwin [ ./darwin.patch ];
+
   meta = with stdenv.lib; {
     description = "Common functions found on BSD systems";
     homepage = http://libbsd.freedesktop.org/;
     license = licenses.bsd3;
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
   };
 }

pkgs/development/libraries/libguestfs/default.nix

@@ -1,32 +1,45 @@
 { stdenv, fetchurl, pkgconfig, autoreconfHook, makeWrapper
 , ncurses, cpio, gperf, perl, cdrkit, flex, bison, qemu, pcre, augeas, libxml2
 , acl, libcap, libcap_ng, libconfig, systemd, fuse, yajl, libvirt, hivex
-, gmp, readline, file, libintlperl, GetoptLong, SysVirt, numactl, xen, libapparmor }:
+, gmp, readline, file, libintlperl, GetoptLong, SysVirt, numactl, xen, libapparmor
+, getopt, perlPackages, ocamlPackages }:
 
 stdenv.mkDerivation rec {
   name = "libguestfs-${version}";
-  version = "1.29.5";
+  version = "1.36.3";
 
   appliance = fetchurl {
-    url = "http://libguestfs.org/download/binaries/appliance/appliance-1.26.0.tar.xz";
-    sha256 = "1kzvgmy845kclvr93y6rdpss2q0p8yfqg14r0i1pi5r4zc68yvj4";
+    url = "http://libguestfs.org/download/binaries/appliance/appliance-1.36.1.tar.xz";
+    sha256 = "1klvr13gpg615hgjvviwpxlj839lbwwsrq7x100qg5zmmjfhl125";
   };
 
   src = fetchurl {
-    url = "http://libguestfs.org/download/1.29-development/libguestfs-${version}.tar.gz";
-    sha256 = "1il0p3irwcyfdm83935hj4bvxsx0kdfn8dvqmg2lbzap17jvzj8h";
+    url = "http://libguestfs.org/download/1.36-stable/libguestfs-${version}.tar.gz";
+    sha256 = "0dhb69b7svjgnrmbyvizdz5vsgsrr95ypz0qvp3kz83jyj6sa76m";
   };
 
   buildInputs = [
     makeWrapper pkgconfig autoreconfHook ncurses cpio gperf perl
     cdrkit flex bison qemu pcre augeas libxml2 acl libcap libcap_ng libconfig
     systemd fuse yajl libvirt gmp readline file hivex libintlperl GetoptLong
-    SysVirt numactl xen libapparmor
-  ];
+    SysVirt numactl xen libapparmor getopt perlPackages.ModuleBuild
+  ] ++ (with ocamlPackages; [ ocaml findlib ocamlbuild ocaml_libvirt ocaml_gettext ounit ]);
 
+  prePatch = ''
+    # build-time scripts
+    substituteInPlace run.in        --replace '#!/bin/bash' '#!/bin/sh'
+    substituteInPlace ocaml-link.sh --replace '#!/bin/bash' '#!/bin/sh'
+
+    # $(OCAMLLIB) is read-only "${ocamlPackages.ocaml}/lib/ocaml"
+    substituteInPlace ocaml/Makefile.am            --replace '$(DESTDIR)$(OCAMLLIB)' '$(out)/lib/ocaml'
+    substituteInPlace ocaml/Makefile.in            --replace '$(DESTDIR)$(OCAMLLIB)' '$(out)/lib/ocaml'
+    substituteInPlace v2v/test-harness/Makefile.am --replace '$(DESTDIR)$(OCAMLLIB)' '$(out)/lib/ocaml'
+    substituteInPlace v2v/test-harness/Makefile.in --replace '$(DESTDIR)$(OCAMLLIB)' '$(out)/lib/ocaml'
+  '';
   configureFlags = "--disable-appliance --disable-daemon";
   patches = [ ./libguestfs-syms.patch ];
   NIX_CFLAGS_COMPILE="-I${libxml2.dev}/include/libxml2/";
+  installFlags = "REALLY_INSTALL=yes";
 
   postInstall = ''
     for bin in $out/bin/*; do

pkgs/development/libraries/libguestfs/libguestfs-syms.patch

@@ -1,7 +1,7 @@
-diff -rupN libguestfs-1.29.5/src/Makefile.am libguestfs-1.29.5-new/src/Makefile.am
---- libguestfs-1.29.5/src/Makefile.am	2014-11-05 16:43:08.000000000 +0100
-+++ libguestfs-1.29.5-new/src/Makefile.am	2014-11-05 20:07:45.760730596 +0100
-@@ -167,8 +167,7 @@ libguestfs_la_LIBADD = \
+diff --git a/lib/Makefile.am b/lib/Makefile.am
+--- a/lib/Makefile.am
++++ b/lib/Makefile.am
+@@ -168,8 +168,7 @@ libguestfs_la_LIBADD = \
  # Force libtool to name the library 'libguestfs.so.0.$(MAX_PROC_NR).0'.
  # Include the version script to limit which symbols are exported.
  libguestfs_la_LDFLAGS = \

pkgs/development/libraries/libiconv/default.nix

@@ -3,11 +3,12 @@
 assert !stdenv.isLinux || stdenv ? cross; # TODO: improve on cross
 
 stdenv.mkDerivation rec {
-  name = "libiconv-1.14";
+  name = "libiconv-${version}";
+  version = "1.15";
 
   src = fetchurl {
     url = "mirror://gnu/libiconv/${name}.tar.gz";
-    sha256 = "04q6lgl3kglmmhw59igq1n7v3rp1rpkypl366cy1k1yn2znlvckj";
+    sha256 = "0y1ij745r4p48mxq84rax40p10ln7fc7m243p8k8sia519i3dxfc";
   };
 
   patches = lib.optionals stdenv.isCygwin [

pkgs/development/libraries/libpst/default.nix

@@ -2,11 +2,11 @@
   pkgconfig, bzip2, xmlto, gettext, imagemagick, doxygen }:
 
 stdenv.mkDerivation rec {
-  name = "libpst-0.6.68";
+  name = "libpst-0.6.70";
 
   src = fetchurl {
       url = "http://www.five-ten-sg.com/libpst/packages/${name}.tar.gz";
-      sha256 = "06mcaga36i65n1ifr5pw6ghcb1cjfqwrmm1xmaw1sckqf2iqx2by";
+      sha256 = "1m378vxh1sf9ry8k11x773xpy5f6cab5gkzqglz0jp9hc431r60r";
     };
 
   buildInputs = [ autoreconfHook boost python2 libgsf pkgconfig bzip2

pkgs/development/libraries/mapnik/default.nix

@@ -1,6 +1,9 @@
 { stdenv, fetchzip
 , boost, cairo, freetype, gdal, harfbuzz, icu, libjpeg, libpng, libtiff
 , libwebp, libxml2, proj, python2, scons, sqlite, zlib
+
+# supply a postgresql package to enable the PostGIS input plugin
+, postgresql ? null
 }:
 
 stdenv.mkDerivation rec {
@@ -21,6 +24,9 @@ stdenv.mkDerivation rec {
   buildInputs =
     [ boost cairo freetype gdal harfbuzz icu libjpeg libpng libtiff
       libwebp libxml2 proj python2 sqlite zlib
+
+      # optional inputs
+      postgresql
     ];
 
   configurePhase = ''

pkgs/development/libraries/mlt/default.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   name = "mlt-${version}";
-  version = "6.2.0";
+  version = "6.4.1";
 
   src = fetchFromGitHub {
     owner = "mltframework";
     repo = "mlt";
     rev = "v${version}";
-    sha256 = "17jwz1lf9ilaxvgvhg7z86dhcsk95m4wlszy4gn7wab2ns5zhdm7";
+    sha256 = "0k9vj21n6qxdjd0vvj22cwi35igajjzh5fbjza766izdbijv2i2w";
   };
 
   buildInputs = [