Merge branch 'master' into fetchGitRepo

2017-03-26 20:17:03 +10:00 · 2017-03-26 20:17:03 +10:00 · 62e115af5b
commit 62e115af5b
parent 1f545f01bb 09c91f5fea
214 changed files with 3449 additions and 1925 deletions
--- a/.mention-bot
+++ b/.mention-bot
@ -2,7 +2,8 @@
  "userBlacklist": [
    "civodul",
    "jhasse",
-    "shlevy"
+    "shlevy",
+    "bbenoist"
  ],
  "alwaysNotifyForPaths": [
    { "name": "FRidh", "files": ["pkgs/top-level/python-packages.nix", "pkgs/development/interpreters/python/*", "pkgs/development/python-modules/*" ] },
--- a/.travis.yml
+++ b/.travis.yml
@ -1,8 +1,14 @@
 language: nix
+sudo: true
+# 'sudo: false' == containers that start fast, but only get 4G ram;
+# 'sudo: true'  == VMs that start slow, but with 8G
+# ..as per:  https://docs.travis-ci.com/user/ci-environment/#Virtualization-environments
+# Nixpkgs PR tests OOM with 4G: https://github.com/NixOS/nixpkgs/issues/24200
+
 matrix:
    include:
        - os: linux
-          sudo: false
+          sudo: required
          script:
              - ./maintainers/scripts/travis-nox-review-pr.sh nixpkgs-verify nixpkgs-manual nixpkgs-tarball nixpkgs-unstable
              - ./maintainers/scripts/travis-nox-review-pr.sh nixos-options nixos-manual
--- a/lib/maintainers.nix
+++ b/lib/maintainers.nix
@ -60,7 +60,6 @@
  badi = "Badi' Abdul-Wahid <abdulwahidc@gmail.com>";
  balajisivaraman = "Balaji Sivaraman<sivaraman.balaji@gmail.com>";
  Baughn = "Svein Ove Aas <sveina@gmail.com>";
-  bbenoist = "Baptist BENOIST <return_0@live.com>";
  bcarrell = "Brandon Carrell <brandoncarrell@gmail.com>";
  bcdarwin = "Ben Darwin <bcdarwin@gmail.com>";
  bdimcheff = "Brandon Dimcheff <brandon@dimcheff.com>";
@ -399,6 +398,7 @@
  pjones = "Peter Jones <pjones@devalot.com>";
  pkmx = "Chih-Mao Chen <pkmx.tw@gmail.com>";
  plcplc = "Philip Lykke Carlsen <plcplc@gmail.com>";
+  plumps = "Maksim Bronsky <maks.bronsky@web.de";
  pmahoney = "Patrick Mahoney <pat@polycrystal.org>";
  pmiddend = "Philipp Middendorf <pmidden@secure.mailbox.org>";
  polyrod = "Maurizio Di Pietro <dc1mdp@gmail.com>";
--- a/nixos/doc/manual/development/sources.xml
+++ b/nixos/doc/manual/development/sources.xml
@ -27,8 +27,8 @@ a subdirectory of the Nixpkgs repository.) The remote
 <literal>channels</literal> refers to a read-only repository that
 tracks the Nixpkgs/NixOS channels (see <xref linkend="sec-upgrading"/>
 for more information about channels). Thus, the Git branch
-<literal>channels/nixos-14.12</literal> will contain the latest built
-and tested version available in the <literal>nixos-14.12</literal>
+<literal>channels/nixos-17.03</literal> will contain the latest built
+and tested version available in the <literal>nixos-17.03</literal>
 channel.</para>

 <para>It’s often inconvenient to develop directly on the master
@ -39,9 +39,9 @@ branch based on your current NixOS version:

 <screen>
 $ nixos-version
-14.04.273.ea1952b (Baboon)
+17.09pre104379.6e0b727 (Hummingbird)

-$ git checkout -b local ea1952b
+$ git checkout -b local e3938c8
 </screen>

 Or, to base your local branch on the latest version available in a
@ -49,17 +49,17 @@ NixOS channel:

 <screen>
 $ git remote update channels
-$ git checkout -b local channels/nixos-14.12
+$ git checkout -b local channels/nixos-17.03
 </screen>

-(Replace <literal>nixos-14.12</literal> with the name of the channel
+(Replace <literal>nixos-17.03</literal> with the name of the channel
 you want to use.) You can use <command>git merge</command> or
 <command>git rebase</command> to keep your local branch in sync with
 the channel, e.g.

 <screen>
 $ git remote update channels
-$ git merge channels/nixos-14.12
+$ git merge channels/nixos-17.03
 </screen>

 You can use <command>git cherry-pick</command> to copy commits from
--- a/nixos/doc/manual/installation/installing-uefi.xml
+++ b/nixos/doc/manual/installation/installing-uefi.xml
@ -26,7 +26,8 @@ changes:
    <literal>vfat</literal> filesystem.</para>
  </listitem>
  <listitem>
-    <para>You must set <option>boot.loader.systemd-boot.enable</option> to
+    <para>Instead of <option>boot.loader.grub.device</option>,
+    you must set <option>boot.loader.systemd-boot.enable</option> to
    <literal>true</literal>. <command>nixos-generate-config</command>
    should do this automatically for new configurations when booted in
    UEFI mode.</para>
--- a/nixos/doc/manual/installation/upgrading.xml
+++ b/nixos/doc/manual/installation/upgrading.xml
@ -15,12 +15,12 @@ been built.  These channels are:
 <itemizedlist>
  <listitem>
    <para><emphasis>Stable channels</emphasis>, such as <literal
-    xlink:href="https://nixos.org/channels/nixos-14.12">nixos-14.12</literal>.
+    xlink:href="https://nixos.org/channels/nixos-17.03">nixos-17.03</literal>.
    These only get conservative bug fixes and package upgrades.  For
    instance, a channel update may cause the Linux kernel on your
-    system to be upgraded from 3.4.66 to 3.4.67 (a minor bug fix), but
-    not from 3.4.<replaceable>x</replaceable> to
-    3.11.<replaceable>x</replaceable> (a major change that has the
+    system to be upgraded from 4.9.16 to 4.9.17 (a minor bug fix), but
+    not from 4.9.<replaceable>x</replaceable> to
+    4.11.<replaceable>x</replaceable> (a major change that has the
    potential to break things).  Stable channels are generally
    maintained until the next stable branch is created.</para>
    <para></para>
@ -34,7 +34,7 @@ been built.  These channels are:
  </listitem>
  <listitem>
    <para><emphasis>Small channels</emphasis>, such as <literal
-    xlink:href="https://nixos.org/channels/nixos-14.12-small">nixos-14.12-small</literal>
+    xlink:href="https://nixos.org/channels/nixos-17.03-small">nixos-17.03-small</literal>
    or <literal
    xlink:href="https://nixos.org/channels/nixos-unstable-small">nixos-unstable-small</literal>. These
    are identical to the stable and unstable channels described above,
@ -55,8 +55,8 @@ appliances.)</para>

 <para>When you first install NixOS, you’re automatically subscribed to
 the NixOS channel that corresponds to your installation source.   For
-instance, if you installed from a 14.12 ISO, you will be subscribed to
-the <literal>nixos-14.12</literal> channel.  To see which NixOS
+instance, if you installed from a 17.03 ISO, you will be subscribed to
+the <literal>nixos-17.03</literal> channel.  To see which NixOS
 channel you’re subscribed to, run the following as root:

 <screen>
@ -71,16 +71,16 @@ To switch to a different NixOS channel, do
 </screen>

 (Be sure to include the <literal>nixos</literal> parameter at the
-end.)  For instance, to use the NixOS 14.12 stable channel:
+end.)  For instance, to use the NixOS 17.03 stable channel:

 <screen>
-# nix-channel --add https://nixos.org/channels/nixos-14.12 nixos
+# nix-channel --add https://nixos.org/channels/nixos-17.03 nixos
 </screen>

 If you have a server, you may want to use the “small” channel instead:

 <screen>
-# nix-channel --add https://nixos.org/channels/nixos-14.12-small nixos
+# nix-channel --add https://nixos.org/channels/nixos-17.03-small nixos
 </screen>

 And if you want to live on the bleeding edge:
@ -130,7 +130,7 @@ runs, see <command>systemctl list-timers</command>.)  You can also
 specify a channel explicitly, e.g.

 <programlisting>
-system.autoUpgrade.channel = https://nixos.org/channels/nixos-15.09;
+system.autoUpgrade.channel = https://nixos.org/channels/nixos-17.03;
 </programlisting>

 </para>
--- a/nixos/doc/manual/release-notes/rl-1709.xml
+++ b/nixos/doc/manual/release-notes/rl-1709.xml
@ -49,6 +49,18 @@ following incompatible changes:</para>
      rest of the system on a stable release.
    </para>
  </listitem>
+  <listitem>
+    <para>
+      Updated to FreeType 2.7.1, including a new TrueType engine.
+      The new engine replaces the Infinality engine which was the default in
+      NixOS. The default font rendering settings are now provided by
+      fontconfig-penultimate, replacing fontconfig-ultimate; the new defaults
+      are less invasive and provide rendering that is more consistent with
+      other systems and hopefully with each font designer's intent. Some
+      system-wide configuration has been removed from the Fontconfig NixOS
+      module where user Fontconfig settings are available.
+    </para>
+  </listitem>

 </itemizedlist>

--- a/nixos/modules/config/fonts/fontconfig-penultimate.nix
+++ b/nixos/modules/config/fonts/fontconfig-penultimate.nix
@ -0,0 +1,57 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.fonts.fontconfig.penultimate;
+
+  latestVersion  = pkgs.fontconfig.configVersion;
+
+  # The configuration to be included in /etc/font/
+  confPkg = pkgs.runCommand "font-penultimate-conf" {} ''
+    support_folder=$out/etc/fonts/conf.d
+    latest_folder=$out/etc/fonts/${latestVersion}/conf.d
+
+    mkdir -p $support_folder
+    mkdir -p $latest_folder
+
+    # fontconfig ultimate various configuration files
+    ln -s ${pkgs.fontconfig-penultimate}/etc/fonts/conf.d/*.conf \
+          $support_folder
+    ln -s ${pkgs.fontconfig-penultimate}/etc/fonts/conf.d/*.conf \
+          $latest_folder
+  '';
+
+in
+{
+
+  options = {
+
+    fonts = {
+
+      fontconfig = {
+
+        penultimate = {
+          enable = mkOption {
+            type = types.bool;
+            default = true;
+            description = ''
+              Enable fontconfig-penultimate settings to supplement the
+              NixOS defaults by providing per-font rendering defaults and
+              metric aliases.
+            '';
+          };
+        };
+
+      };
+    };
+
+  };
+
+  config = mkIf (config.fonts.fontconfig.enable && cfg.enable) {
+
+    fonts.fontconfig.confPackages = [ confPkg ];
+
+  };
+
+}
--- a/nixos/modules/config/fonts/fontconfig-ultimate.nix
+++ b/nixos/modules/config/fonts/fontconfig-ultimate.nix
@ -43,7 +43,7 @@ in
        ultimate = {
          enable = mkOption {
            type = types.bool;
-            default = true;
+            default = false;
            description = ''
              Enable fontconfig-ultimate settings (formerly known as
              Infinality). Besides the customizable settings in this NixOS
@ -63,15 +63,6 @@ in
              <literal>none</literal> disables the substitutions.
            '';
          };
-
-          preset = mkOption {
-            type = types.enum ["ultimate1" "ultimate2" "ultimate3" "ultimate4" "ultimate5" "osx" "windowsxp"];
-            default = "ultimate3";
-            description = ''
-              FreeType rendering settings preset. Any of the presets may be
-              customized by setting environment variables.
-            '';
-          };
        };
      };
    };
@ -81,7 +72,6 @@ in
  config = mkIf (config.fonts.fontconfig.enable && cfg.enable) {

    fonts.fontconfig.confPackages = [ confPkg ];
-    environment.variables."INFINALITY_FT" = cfg.preset;

  };

--- a/nixos/modules/config/fonts/fontconfig.nix
+++ b/nixos/modules/config/fonts/fontconfig.nix
@ -75,23 +75,23 @@ let cfg = config.fonts.fontconfig;
      <fontconfig>

        <!-- Default rendering settings -->
-        <match target="font">
-          <edit mode="assign" name="hinting">
+        <match target="pattern">
+          <edit mode="append" name="hinting">
            ${fcBool cfg.hinting.enable}
          </edit>
-          <edit mode="assign" name="autohint">
+          <edit mode="append" name="autohint">
            ${fcBool cfg.hinting.autohint}
          </edit>
-          <edit mode="assign" name="hintstyle">
-            <const>hint${cfg.hinting.style}</const>
+          <edit mode="append" name="hintstyle">
+            <const>hintslight</const>
          </edit>
-          <edit mode="assign" name="antialias">
+          <edit mode="append" name="antialias">
            ${fcBool cfg.antialias}
          </edit>
-          <edit mode="assign" name="rgba">
+          <edit mode="append" name="rgba">
            <const>${cfg.subpixel.rgba}</const>
          </edit>
-          <edit mode="assign" name="lcdfilter">
+          <edit mode="append" name="lcdfilter">
            <const>lcd${cfg.subpixel.lcdfilter}</const>
          </edit>
        </match>
@ -304,7 +304,11 @@ in
        antialias = mkOption {
          type = types.bool;
          default = true;
-          description = "Enable font antialiasing.";
+          description = ''
+            Enable font antialiasing. At high resolution (> 200 DPI),
+            antialiasing has no visible effect; users of such displays may want
+            to disable this option.
+          '';
        };

        dpi = mkOption {
@ -320,7 +324,7 @@ in
          type = types.lines;
          default = "";
          description = ''
-            System-wide customization file contents, has higher priority than 
+            System-wide customization file contents, has higher priority than
            <literal>defaultFonts</literal> settings.
          '';
        };
@ -358,7 +362,12 @@ in
          enable = mkOption {
            type = types.bool;
            default = true;
-            description = "Enable TrueType hinting.";
+            description = ''
+              Enable font hinting. Hinting aligns glyphs to pixel boundaries to
+              improve rendering sharpness at low resolution. At high resolution
+              (> 200 dpi) hinting will do nothing (at best); users of such
+              displays may want to disable this option.
+            '';
          };

          autohint = mkOption {
@ -370,16 +379,6 @@ in
              correctly-hinted fonts.
            '';
          };
-
-          style = mkOption {
-            type = types.enum ["none" "slight" "medium" "full"];
-            default = "full";
-            description = ''
-              TrueType hinting style, one of <literal>none</literal>,
-              <literal>slight</literal>, <literal>medium</literal>, or
-              <literal>full</literal>.
-            '';
-          };
        };

        includeUserConf = mkOption {
@ -398,7 +397,15 @@ in
            default = "rgb";
            type = types.enum ["rgb" "bgr" "vrgb" "vbgr" "none"];
            description = ''
-              Subpixel order.
+              Subpixel order. The overwhelming majority of displays are
+              <literal>rgb</literal> in their normal orientation. Select
+              <literal>vrgb</literal> for mounting such a display 90 degrees
+              clockwise from its normal orientation or <literal>vbgr</literal>
+              for mounting 90 degrees counter-clockwise. Select
+              <literal>bgr</literal> in the unlikely event of mounting 180
+              degrees from the normal orientation. Reverse these directions in
+              the improbable event that the display's native subpixel order is
+              <literal>bgr</literal>.
            '';
          };

@ -406,7 +413,9 @@ in
            default = "default";
            type = types.enum ["none" "default" "light" "legacy"];
            description = ''
-              FreeType LCD filter.
+              FreeType LCD filter. At high resolution (> 200 DPI), LCD filtering
+              has no visible effect; users of such displays may want to select
+              <literal>none</literal>.
            '';
          };

--- a/nixos/modules/installer/cd-dvd/channel.nix
+++ b/nixos/modules/installer/cd-dvd/channel.nix
@ -6,6 +6,16 @@
 with lib;

 let
+  # Do not include these things:
+  #   - The '.git' directory
+  #   - Result symlinks from nix-build ('result', 'result-2', 'result-bin', ...)
+  #   - VIM/Emacs swap/backup files ('.swp', '.swo', '.foo.swp', 'foo~', ...)
+  filterFn = path: type: let basename = baseNameOf (toString path); in
+    if type == "directory" then basename != ".git"
+    else if type == "symlink" then builtins.match "^result(|-.*)$" basename == null
+    else builtins.match "^((|\..*)\.sw[a-z]|.*~)$" basename == null;
+
+  nixpkgs = builtins.filterSource filterFn pkgs.path;

  # We need a copy of the Nix expressions for Nixpkgs and NixOS on the
  # CD.  These are installed into the "nixos" channel of the root
@ -15,12 +25,11 @@ let
    { }
    ''
      mkdir -p $out
-      cp -prd ${pkgs.path} $out/nixos
+      cp -prd ${nixpkgs} $out/nixos
      chmod -R u+w $out/nixos
      if [ ! -e $out/nixos/nixpkgs ]; then
        ln -s . $out/nixos/nixpkgs
      fi
-      rm -rf $out/nixos/.git
      echo -n ${config.system.nixosVersionSuffix} > $out/nixos/.version-suffix
    '';

--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -1,8 +1,9 @@
 [
  ./config/debug-info.nix
  ./config/fonts/corefonts.nix
-  ./config/fonts/fontconfig-ultimate.nix
  ./config/fonts/fontconfig.nix
+  ./config/fonts/fontconfig-penultimate.nix
+  ./config/fonts/fontconfig-ultimate.nix
  ./config/fonts/fontdir.nix
  ./config/fonts/fonts.nix
  ./config/fonts/ghostscript.nix
@ -274,6 +275,7 @@
  ./services/misc/gpsd.nix
  #./services/misc/ihaskell.nix
  ./services/misc/irkerd.nix
+  ./services/misc/jackett.nix
  ./services/misc/leaps.nix
  ./services/misc/mantisbt.nix
  ./services/misc/mathics.nix
@ -294,6 +296,7 @@
  ./services/misc/parsoid.nix
  ./services/misc/phd.nix
  ./services/misc/plex.nix
+  ./services/misc/radarr.nix
  ./services/misc/redmine.nix
  ./services/misc/rippled.nix
  ./services/misc/ripple-rest.nix
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@ -141,9 +141,6 @@ with lib;
    # Unity3D
    (mkRenamedOptionModule [ "programs" "unity3d" "enable" ] [ "security" "chromiumSuidSandbox" "enable" ])

-    # fontconfig-ultimate
-    (mkRenamedOptionModule [ "fonts" "fontconfig" "ultimate" "rendering" ] [ "fonts" "fontconfig" "ultimate" "preset" ])
-
    # murmur
    (mkRenamedOptionModule [ "services" "murmur" "welcome" ] [ "services" "murmur" "welcometext" ])

@ -202,6 +199,7 @@ with lib;
      "See the 16.09 release notes for more information.")
    (mkRemovedOptionModule [ "services" "phpfpm" "phpIni" ] "")
    (mkRemovedOptionModule [ "services" "dovecot2" "package" ] "")
+    (mkRemovedOptionModule [ "fonts" "fontconfig" "hinting" "style" ] "")
    (mkRemovedOptionModule [ "services" "xserver" "displayManager" "sddm" "themes" ]
      "Set the option `services.xserver.displayManager.sddm.package' instead.")
  ];
--- a/nixos/modules/security/wrappers/default.nix
+++ b/nixos/modules/security/wrappers/default.nix
@ -177,6 +177,35 @@ in
          # programs to be wrapped.
          WRAPPER_PATH=${config.system.path}/bin:${config.system.path}/sbin

+          # Remove the old /var/setuid-wrappers path from the system...
+          #
+          # TODO: this is only necessary for upgrades 16.09 => 17.x;
+          # this conditional removal block needs to be removed after
+          # the release.
+          if [ -d /var/setuid-wrappers ]; then
+            rm -rf /var/setuid-wrappers
+            ln -s /run/wrappers/bin /var/setuid-wrappers
+          fi
+
+          # Remove the old /run/setuid-wrappers-dir path from the
+          # system as well...
+          #
+          # TODO: this is only necessary for upgrades 16.09 => 17.x;
+          # this conditional removal block needs to be removed after
+          # the release.
+          if [ -d /run/setuid-wrapper-dirs ]; then
+            rm -rf /run/setuid-wrapper-dirs
+            ln -s /run/wrappers/bin /run/setuid-wrapper-dirs
+          fi
+
+          # TODO: this is only necessary for upgrades 16.09 => 17.x;
+          # this conditional removal block needs to be removed after
+          # the release.
+          if readlink -f /run/booted-system | grep nixos-17 > /dev/null; then
+            rm -rf /run/setuid-wrapper-dirs
+            rm -rf /var/setuid-wrappers
+          fi
+
          # We want to place the tmpdirs for the wrappers to the parent dir.
          wrapperDir=$(mktemp --directory --tmpdir="${parentWrapperDir}" wrappers.XXXXXXXXXX)
          chmod a+rx $wrapperDir
--- a/nixos/modules/services/misc/jackett.nix
+++ b/nixos/modules/services/misc/jackett.nix
@ -0,0 +1,44 @@
+{ config, pkgs, lib, mono, ... }:
+
+with lib;
+
+let
+  cfg = config.services.jackett;
+in
+{
+  options = {
+    services.jackett = {
+      enable = mkEnableOption "Jackett";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.jackett = {
+      description = "Jackett";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      preStart = ''
+        test -d /var/lib/jackett/ || {
+          echo "Creating jackett data directory in /var/lib/jackett/"
+          mkdir -p /var/lib/jackett/
+        }
+        chown -R jackett /var/lib/jackett/
+        chmod 0700 /var/lib/jackett/
+      '';
+
+      serviceConfig = {
+        Type = "simple";
+        User = "jackett";
+        Group = "nogroup";
+        PermissionsStartOnly = "true";
+        ExecStart = "${pkgs.jackett}/bin/Jackett";
+        Restart = "on-failure";
+      };
+    };
+
+    users.extraUsers.jackett = {
+      home = "/var/lib/jackett";
+    };
+
+  };
+}
--- a/nixos/modules/services/misc/radarr.nix
+++ b/nixos/modules/services/misc/radarr.nix
@ -0,0 +1,44 @@
+{ config, pkgs, lib, mono, ... }:
+
+with lib;
+
+let
+  cfg = config.services.radarr;
+in
+{
+  options = {
+    services.radarr = {
+      enable = mkEnableOption "Radarr";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.radarr = {
+      description = "Radarr";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      preStart = ''
+        test -d /var/lib/radarr/ || {
+          echo "Creating radarr data directory in /var/lib/radarr/"
+          mkdir -p /var/lib/radarr/
+        }
+        chown -R radarr /var/lib/radarr/
+        chmod 0700 /var/lib/radarr/
+      '';
+
+      serviceConfig = {
+        Type = "simple";
+        User = "radarr";
+        Group = "nogroup";
+        PermissionsStartOnly = "true";
+        ExecStart = "${pkgs.radarr}/bin/Radarr";
+        Restart = "on-failure";
+      };
+    };
+
+    users.extraUsers.radarr = {
+      home = "/var/lib/radarr";
+    };
+
+  };
+}
--- a/nixos/modules/services/network-filesystems/openafs-client/default.nix
+++ b/nixos/modules/services/network-filesystems/openafs-client/default.nix
@ -76,6 +76,7 @@ in
      description = "AFS client";
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];
+      serviceConfig = { RemainAfterExit = true; };

      preStart = ''
        mkdir -p -m 0755 /afs
--- a/nixos/modules/services/networking/dnscrypt-proxy.nix
+++ b/nixos/modules/services/networking/dnscrypt-proxy.nix
@ -220,6 +220,8 @@ in
        ${getLib pkgs.attr}/lib/libattr.so.* mr, # */

        ${resolverList} r,
+
+        /run/systemd/notify rw,
      }
    '');
    })
--- a/nixos/modules/services/networking/nftables.nix
+++ b/nixos/modules/services/networking/nftables.nix
@ -17,6 +17,17 @@ in

          This conflicts with the standard networking firewall, so make sure to
          disable it before using nftables.
+
+          Note that if you have Docker enabled you will not be able to use
+          nftables without intervention. Docker uses iptables internally to
+          setup NAT for containers. This module disables the ip_tables kernel
+          module, however Docker automatically loads the module. Please see [1]
+          for more information.
+
+          There are other programs that use iptables internally too, such as
+          libvirt.
+
+          [1]: https://github.com/NixOS/nixpkgs/issues/24318#issuecomment-289216273
        '';
    };
    networking.nftables.ruleset = mkOption {
--- a/nixos/modules/services/web-servers/phpfpm/default.nix
+++ b/nixos/modules/services/web-servers/phpfpm/default.nix
@ -147,7 +147,6 @@ in {
          cfgFile = fpmCfgFile pool poolConfig;
        in {
          Slice = "phpfpm.slice";
-          PrivateTmp = true;
          PrivateDevices = true;
          ProtectSystem = "full";
          ProtectHome = true;
--- a/nixos/modules/services/x11/desktop-managers/enlightenment.nix
+++ b/nixos/modules/services/x11/desktop-managers/enlightenment.nix
@ -64,7 +64,7 @@ in
    security.wrappers.e_freqset.source = "${e.enlightenment.out}/bin/e_freqset";

    environment.etc = singleton
-      { source = "${pkgs.xkeyboard_config}/etc/X11/xkb";
+      { source = xcfg.xkbDir;
        target = "X11/xkb";
      };

--- a/nixos/modules/services/x11/desktop-managers/plasma5.nix
+++ b/nixos/modules/services/x11/desktop-managers/plasma5.nix
@ -176,7 +176,7 @@ in
      environment.pathsToLink = [ "/share" ];

      environment.etc = singleton {
-        source = "${pkgs.xkeyboard_config}/etc/X11/xkb";
+        source = xcfg.xkbDir;
        target = "X11/xkb";
      };

--- a/nixos/modules/services/x11/display-managers/default.nix
+++ b/nixos/modules/services/x11/display-managers/default.nix
@ -24,7 +24,7 @@ let
    Xft.lcdfilter: lcd${fontconfig.subpixel.lcdfilter}
    Xft.hinting: ${if fontconfig.hinting.enable then "1" else "0"}
    Xft.autohint: ${if fontconfig.hinting.autohint then "1" else "0"}
-    Xft.hintstyle: hint${fontconfig.hinting.style}
+    Xft.hintstyle: hintslight
  '';

  # file provided by services.xserver.displayManager.session.script
--- a/nixos/modules/services/x11/display-managers/gdm.nix
+++ b/nixos/modules/services/x11/display-managers/gdm.nix
@ -99,8 +99,7 @@ in
    services.xserver.displayManager.job =
      {
        environment = {
-          GDM_X_SERVER_EXTRA_ARGS = toString
-            (filter (arg: arg != "-terminate") cfg.xserverArgs);
+          GDM_X_SERVER = "${cfg.xserverBin} ${toString cfg.xserverArgs}";
          GDM_SESSIONS_DIR = "${cfg.session.desktops}";
          # Find the mouse
          XCURSOR_PATH = "~/.icons:${config.system.path}/share/icons";
--- a/nixos/modules/system/boot/loader/grub/install-grub.pl
+++ b/nixos/modules/system/boot/loader/grub/install-grub.pl
@ -443,9 +443,40 @@ my $confFile = $grubVersion == 1 ? "$bootPath/grub/menu.lst" : "$bootPath/grub/g
 my $tmpFile = $confFile . ".tmp";
 writeFile($tmpFile, $conf);

+
+# check whether to install GRUB EFI or not
+sub getEfiTarget {
+    if ($grubVersion == 1) {
+        return "no"
+    } elsif (($grub ne "") && ($grubEfi ne "")) {
+        # EFI can only be installed when target is set;
+        # A target is also required then for non-EFI grub
+        if (($grubTarget eq "") || ($grubTargetEfi eq "")) { die }
+        else { return "both" }
+    } elsif (($grub ne "") && ($grubEfi eq "")) {
+        # TODO: It would be safer to disallow non-EFI grub installation if no taget is given.
+        #       If no target is given, then grub auto-detects the target which can lead to errors.
+        #       E.g. it seems as if grub would auto-detect a EFI target based on the availability
+        #       of a EFI partition.
+        #       However, it seems as auto-detection is currently relied on for non-x86_64 and non-i386
+        #       architectures in NixOS. That would have to be fixed in the nixos modules first.
+        return "no"
+    } elsif (($grub eq "") && ($grubEfi ne "")) {
+        # EFI can only be installed when target is set;
+        if ($grubTargetEfi eq "") { die }
+        else {return "only" }
+    } else {
+        # prevent an installation if neither grub nor grubEfi is given
+        return "neither"
+    }
+}
+
+my $efiTarget = getEfiTarget();
+
 # Append entries detected by os-prober
 if (get("useOSProber") eq "true") {
-    system(get("shell"), "-c", "pkgdatadir=$grub/share/grub $grub/etc/grub.d/30_os-prober >> $tmpFile");
+    my $targetpackage = ($efiTarget eq "no") ? $grub : $grubEfi;
+    system(get("shell"), "-c", "pkgdatadir=$targetpackage/share/grub $targetpackage/etc/grub.d/30_os-prober >> $tmpFile");
 }

 # Atomically switch to the new config
@ -498,36 +529,7 @@ sub getDeviceTargets {
    }
    return @devices;
 }
-
-# check whether to install GRUB EFI or not
-sub getEfiTarget {
-    if ($grubVersion == 1) {
-        return "no"
-    } elsif (($grub ne "") && ($grubEfi ne "")) {
-        # EFI can only be installed when target is set;
-        # A target is also required then for non-EFI grub
-        if (($grubTarget eq "") || ($grubTargetEfi eq "")) { die }
-        else { return "both" }
-    } elsif (($grub ne "") && ($grubEfi eq "")) {
-        # TODO: It would be safer to disallow non-EFI grub installation if no taget is given.
-        #       If no target is given, then grub auto-detects the target which can lead to errors.
-        #       E.g. it seems as if grub would auto-detect a EFI target based on the availability
-        #       of a EFI partition.
-        #       However, it seems as auto-detection is currently relied on for non-x86_64 and non-i386
-        #       architectures in NixOS. That would have to be fixed in the nixos modules first.
-        return "no"
-    } elsif (($grub eq "") && ($grubEfi ne "")) {
-        # EFI can only be installed when target is set;
-        if ($grubTargetEfi eq "") { die }
-        else {return "only" }
-    } else {
-        # prevent an installation if neither grub nor grubEfi is given
-        return "neither"
-    }
-}
-
 my @deviceTargets = getDeviceTargets();
-my $efiTarget = getEfiTarget();
 my $prevGrubState = readGrubState();
 my @prevDeviceTargets = split/,/, $prevGrubState->devices;

--- a/nixos/modules/tasks/network-interfaces-systemd.nix
+++ b/nixos/modules/tasks/network-interfaces-systemd.nix
@ -59,15 +59,16 @@ in
    systemd.network =
      let
        domains = cfg.search ++ (optional (cfg.domain != null) cfg.domain);
-        genericNetwork = override: {
-          DHCP = override (dhcpStr cfg.useDHCP);
-        } // optionalAttrs (cfg.defaultGateway != null) {
-          gateway = override [ cfg.defaultGateway.address ];
-        } // optionalAttrs (cfg.defaultGateway6 != null) {
-          gateway = override [ cfg.defaultGateway6.address ];
-        } // optionalAttrs (domains != [ ]) {
-          domains = override domains;
-        };
+        genericNetwork = override:
+          let gateway = optional (cfg.defaultGateway != null) cfg.defaultGateway.address
+            ++ optional (cfg.defaultGateway6 != null) cfg.defaultGateway6.address;
+          in {
+            DHCP = override (dhcpStr cfg.useDHCP);
+          } // optionalAttrs (gateway != [ ]) {
+            gateway = override gateway;
+          } // optionalAttrs (domains != [ ]) {
+            domains = override domains;
+          };
      in mkMerge [ {
        enable = true;
        networks."99-main" = genericNetwork mkDefault;
--- a/nixos/modules/virtualisation/google-compute-image.nix
+++ b/nixos/modules/virtualisation/google-compute-image.nix
@ -62,7 +62,7 @@ in

          mkdir -p /mnt/nix/store
          echo "copying everything (will take a while)..."
-          cp -prd $storePaths /mnt/nix/store/
+          ${pkgs.rsync}/bin/rsync -a $storePaths /mnt/nix/store/

          # Register the paths in the Nix database.
          printRegistration=1 perl ${pkgs.pathsFromGraph} /tmp/xchg/closure | \
--- a/nixos/modules/virtualisation/xen-dom0.nix
+++ b/nixos/modules/virtualisation/xen-dom0.nix
@ -29,7 +29,6 @@ in

    virtualisation.xen.package = mkOption {
      type = types.package;
-      default = pkgs.xen;
      defaultText = "pkgs.xen";
      example = literalExample "pkgs.xen-light";
      description = ''
@ -39,7 +38,6 @@ in

    virtualisation.xen.qemu = mkOption {
      type = types.path;
-      default = "${pkgs.xen}/lib/xen/bin/qemu-system-i386";
      defaultText = "\${pkgs.xen}/lib/xen/bin/qemu-system-i386";
      example = literalExample "''${pkgs.qemu_xen-light}/bin/qemu-system-i386";
      description = ''
@ -49,7 +47,6 @@ in

    virtualisation.xen.qemu-package = mkOption {
      type = types.package;
-      default = pkgs.xen;
      defaultText = "pkgs.xen";
      example = literalExample "pkgs.qemu_xen-light";
      description = ''
@ -136,6 +133,9 @@ in
      message = "Xen currently does not support EFI boot";
    } ];

+    virtualisation.xen.package = mkDefault pkgs.xen;
+    virtualisation.xen.qemu = mkDefault "${pkgs.xen}/lib/xen/bin/qemu-system-i386";
+    virtualisation.xen.qemu-package = mkDefault pkgs.xen;
    virtualisation.xen.stored = mkDefault "${cfg.package}/bin/oxenstored";

    environment.systemPackages = [ cfg.package ];
--- a/nixos/release-combined.nix
+++ b/nixos/release-combined.nix
@ -92,7 +92,7 @@ in rec {
        (all nixos.tests.openssh)
        (all nixos.tests.printing)
        (all nixos.tests.proxy)
-        (all nixos.tests.sddm)
+        (all nixos.tests.sddm.default)
        (all nixos.tests.simple)
        (all nixos.tests.udisks2)
        (all nixos.tests.xfce)
--- a/nixos/release.nix
+++ b/nixos/release.nix
@ -296,7 +296,7 @@ in rec {
  tests.quake3 = callTest tests/quake3.nix {};
  tests.runInMachine = callTest tests/run-in-machine.nix {};
  tests.samba = callTest tests/samba.nix {};
-  tests.sddm = callTest tests/sddm.nix {};
+  tests.sddm = callSubTests tests/sddm.nix {};
  tests.simple = callTest tests/simple.nix {};
  tests.smokeping = callTest tests/smokeping.nix {};
  tests.taskserver = callTest tests/taskserver.nix {};
--- a/nixos/tests/plasma5.nix
+++ b/nixos/tests/plasma5.nix
@ -8,25 +8,27 @@ import ./make-test.nix ({ pkgs, ...} :

  machine = { lib, ... }: {
    imports = [ ./common/user-account.nix ];
-    virtualisation.memorySize = 1024;
    services.xserver.enable = true;
-    services.xserver.displayManager.sddm = {
-      enable = true;
-      autoLogin = {
-        enable = true;
-        user = "alice";
-      };
-    };
+    services.xserver.displayManager.sddm.enable = true;
    services.xserver.desktopManager.plasma5.enable = true;
    services.xserver.desktopManager.default = "plasma5";
-    virtualisation.writableStore = false; # FIXME
+    virtualisation.memorySize = 1024;
  };

-  testScript = { nodes, ... }:
-  let xdo = "${pkgs.xdotool}/bin/xdotool"; in
-   ''
+  enableOCR = true;
+
+  testScript = { nodes, ... }: let
+    user = nodes.machine.config.users.extraUsers.alice;
+    xdo = "${pkgs.xdotool}/bin/xdotool";
+  in ''
    startAll;

+    # Wait for display manager to start
+    $machine->waitForText(qr/${user.description}/);
+    $machine->screenshot("sddm");
+
+    # Log in
+    $machine->sendChars("${user.password}\n");
    $machine->waitForFile("/home/alice/.Xauthority");
    $machine->succeed("xauth merge ~alice/.Xauthority");

--- a/nixos/tests/sddm.nix
+++ b/nixos/tests/sddm.nix
@ -1,28 +1,66 @@
-import ./make-test.nix ({ pkgs, ...} : {
-  name = "sddm";
-  meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ ttuegel ];
-  };
+{ system ? builtins.currentSystem }:

-  machine = { lib, ... }: {
-    imports = [ ./common/user-account.nix ];
-    services.xserver.enable = true;
-    services.xserver.displayManager.sddm = {
-      enable = true;
-      autoLogin = {
-        enable = true;
-        user = "alice";
+with import ../lib/testing.nix { inherit system; };
+
+let
+  inherit (pkgs) lib;
+
+  tests = {
+    default = {
+      name = "sddm";
+
+      machine = { lib, ... }: {
+        imports = [ ./common/user-account.nix ];
+        services.xserver.enable = true;
+        services.xserver.displayManager.sddm.enable = true;
+        services.xserver.windowManager.default = "icewm";
+        services.xserver.windowManager.icewm.enable = true;
+        services.xserver.desktopManager.default = "none";
      };
-    };
-    services.xserver.windowManager.default = "icewm";
-    services.xserver.windowManager.icewm.enable = true;
-    services.xserver.desktopManager.default = "none";
-  };

-  testScript = { nodes, ... }: ''
-    startAll;
-    $machine->waitForFile("/home/alice/.Xauthority");
-    $machine->succeed("xauth merge ~alice/.Xauthority");
-    $machine->waitForWindow("^IceWM ");
-  '';
-})
+      enableOCR = true;
+
+      testScript = { nodes, ... }: let
+        user = nodes.machine.config.users.extraUsers.alice;
+      in ''
+        startAll;
+        $machine->waitForText(qr/ALICE/);
+        $machine->screenshot("sddm");
+        $machine->sendChars("${user.password}\n");
+        $machine->waitForFile("/home/alice/.Xauthority");
+        $machine->succeed("xauth merge ~alice/.Xauthority");
+        $machine->waitForWindow("^IceWM ");
+      '';
+    };
+
+    autoLogin = {
+      name = "sddm-autologin";
+      meta = with pkgs.stdenv.lib.maintainers; {
+        maintainers = [ ttuegel ];
+      };
+
+      machine = { lib, ... }: {
+        imports = [ ./common/user-account.nix ];
+        services.xserver.enable = true;
+        services.xserver.displayManager.sddm = {
+          enable = true;
+          autoLogin = {
+            enable = true;
+            user = "alice";
+          };
+        };
+        services.xserver.windowManager.default = "icewm";
+        services.xserver.windowManager.icewm.enable = true;
+        services.xserver.desktopManager.default = "none";
+      };
+
+      testScript = { nodes, ... }: ''
+        startAll;
+        $machine->waitForFile("/home/alice/.Xauthority");
+        $machine->succeed("xauth merge ~alice/.Xauthority");
+        $machine->waitForWindow("^IceWM ");
+      '';
+    };
+  };
+in
+  lib.mapAttrs (lib.const makeTest) tests
--- a/pkgs/applications/altcoins/bitcoin-classic.nix
+++ b/pkgs/applications/altcoins/bitcoin-classic.nix
@ -1,20 +1,24 @@
-{ stdenv, fetchurl, pkgconfig, autoreconfHook, openssl, db48, boost
-, zlib, miniupnpc, qt4, utillinux, protobuf, qrencode
+{ stdenv, fetchFromGitHub, pkgconfig, autoreconfHook, openssl, db48, boost
+, zlib, miniupnpc, qt4, utillinux, protobuf, qrencode, libevent
 , withGui }:

 with stdenv.lib;
+
 stdenv.mkDerivation rec {

  name = "bitcoin" + (toString (optional (!withGui) "d")) + "-classic-" + version;
-  version = "0.11.2.cl1.b1";
+  version = "1.2.3";

-  src = fetchurl {
-    url = "https://github.com/bitcoinclassic/bitcoinclassic/archive/v${version}.tar.gz";
-    sha256 = "1szsnx5aijk3hx7qkqzbqsr0basg8ydwp20mh3bhnf4ljryy2049";
+  src = fetchFromGitHub {
+    owner = "bitcoinclassic";
+    repo = "bitcoinclassic";
+    rev = "v${version}";
+    sha256 = "0y99c8zv42ps3pxp46p3fqj9sir580v7s5qyi3cxva12mq2z0cql";
  };

-  buildInputs = [ pkgconfig autoreconfHook openssl db48 boost zlib
-                  miniupnpc utillinux protobuf ]
+  nativeBuildInputs = [ pkgconfig autoreconfHook ];
+  buildInputs = [ openssl db48 boost zlib
+                  miniupnpc utillinux protobuf libevent ]
                  ++ optionals withGui [ qt4 qrencode ];

  configureFlags = [ "--with-boost-libdir=${boost.out}/lib" ]
@ -35,7 +39,7 @@ stdenv.mkDerivation rec {
      continue to release updates that are in line with Satoshi’s whitepaper &
      vision, and are agreed upon by the community.
    '';
-    homepage = "https://bitcoinclassic.com/";
+    homepage = https://bitcoinclassic.com/;
    maintainers = with maintainers; [ jefdaj ];
    license = licenses.mit;
    platforms = platforms.unix;
--- a/pkgs/applications/altcoins/default.nix
+++ b/pkgs/applications/altcoins/default.nix
@ -16,6 +16,7 @@ rec {
  dogecoin  = callPackage ./dogecoin.nix { withGui = true; };
  dogecoind = callPackage ./dogecoin.nix { withGui = false; };

+  freicoin = callPackage ./freicoin.nix { boost = pkgs.boost155; };
  go-ethereum = callPackage ./go-ethereum.nix { };

  litecoin  = callPackage ./litecoin.nix { withGui = true; };
@ -33,5 +34,4 @@ rec {
  primecoind = callPackage ./primecoin.nix { withGui = false; };

  stellar-core = callPackage ./stellar-core.nix { };
-
 }
--- a/pkgs/applications/altcoins/freicoin.nix
+++ b/pkgs/applications/altcoins/freicoin.nix
@ -0,0 +1,32 @@
+{ fetchFromGitHub, stdenv, db, boost, gmp, mpfr, miniupnpc, qt4, qmake4Hook, unzip }:
+
+stdenv.mkDerivation rec {
+  version = "0.8.6-2";
+  name = "freicoin-${version}";
+
+  src = fetchFromGitHub {
+    owner = "freicoin";
+    repo = "freicoin";
+    rev = "v${version}";
+    sha256 = "1m5pcnfhwhcj7q00p2sy3h73rkdm3w6grmljgiq53gshcj08cq1z";
+  };
+
+  # I think that openssl and zlib are required, but come through other
+  # packages
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp freicoin-qt $out/bin
+    '';
+
+  nativeBuildInputs = [ qmake4Hook ];
+  buildInputs = [ db boost gmp mpfr miniupnpc qt4 ];
+
+  meta = with stdenv.lib; {
+    description = "Peer-to-peer currency with demurrage fee";
+    homepage = http://freicoi.in/;
+    license = licenses.mit;
+    maintainers = [ maintainers.viric ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/audio/drumgizmo/default.nix
+++ b/pkgs/applications/audio/drumgizmo/default.nix
@ -3,12 +3,12 @@
 }:

 stdenv.mkDerivation rec {
-  version = "0.9.11";
+  version = "0.9.12";
  name = "drumgizmo-${version}";

  src = fetchurl {
    url = "http://www.drumgizmo.org/releases/${name}/${name}.tar.gz";
-    sha256 = "04hf3nhccwr98n2081rrvfccz50nly6k3gbk9zxccp1522qz5xvf";
+    sha256 = "0kqrss9v3vpznmh4jgi3783wmprr645s3i485jlvdscpysjfkh6z";
  };

  configureFlags = [ "--enable-lv2" ];
--- a/pkgs/applications/audio/drumkv1/default.nix
+++ b/pkgs/applications/audio/drumkv1/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "drumkv1-${version}";
-  version = "0.8.0";
+  version = "0.8.1";

  src = fetchurl {
    url = "mirror://sourceforge/drumkv1/${name}.tar.gz";
-    sha256 = "1n2kd468kn71yp2asmamprvblmdlvh0zd8lsh3598dwi4b7aa3ga";
+    sha256 = "0l6kjb1q9vslwy56836a0c65mf8z8ycam5vzz3k4qvd8g74bs1zq";
  };

  buildInputs = [ libjack2 alsaLib libsndfile liblo lv2 qt5.qtbase qt5.qttools ];
--- a/pkgs/applications/audio/spotify/default.nix
+++ b/pkgs/applications/audio/spotify/default.nix
@ -8,7 +8,7 @@ let
  # Please update the stable branch!
  # Latest version number can be found at:
  # http://repository-origin.spotify.com/pool/non-free/s/spotify-client/
-  version = "1.0.49.125.g72ee7853-111";
+  version = "1.0.52.717.g2f08534a-47";

  deps = [
    alsaLib
@ -53,7 +53,7 @@ stdenv.mkDerivation {
  src =
    fetchurl {
      url = "https://repository-origin.spotify.com/pool/non-free/s/spotify-client/spotify-client_${version}_amd64.deb";
-      sha256 = "0l008x06d257vcw6gq3q90hvv93cq6mxpj11by1np6bzzg61qv8x";
+      sha256 = "1xqd4pjb69zmbac5fq3pckgr4khlkzfkx8b029qzjc2hi52zfnj7";
    };

  buildInputs = [ dpkg makeWrapper ];
--- a/pkgs/applications/display-managers/sddm/default.nix
+++ b/pkgs/applications/display-managers/sddm/default.nix
@ -29,10 +29,9 @@ let

    buildInputs = [
      libxcb libpthreadstubs libXdmcp libXau pam systemd
-      qtbase qtdeclarative
    ];

-    propagatedUserEnvPkgs = builtins.map lib.getBin [
+    propagatedBuildInputs = [
      qtbase qtdeclarative
    ];

@ -98,6 +97,7 @@ stdenv.mkDerivation {
      addToSearchPath RUNTIME_XDG_CONFIG_DIRS "$pkg/etc/xdg"
    done

+    mkdir -p "$out/bin"
    makeQtWrapper "$unwrapped/bin/sddm" "$out/bin/sddm"

    mkdir -p "$out/share/sddm"
--- a/pkgs/applications/editors/codeblocks/default.nix
+++ b/pkgs/applications/editors/codeblocks/default.nix
@ -1,20 +1,23 @@
-{ stdenv, fetchurl, autoconf, automake, libtool, pkgconfig, file, zip, wxGTK, gtk2
+{ stdenv, fetchurl, autoreconfHook, libtool, pkgconfig, file, zip, wxGTK, gtk2
 , contribPlugins ? false, hunspell, gamin, boost
 }:

+with stdenv.lib;
+
 with { inherit (stdenv.lib) optionalString optional optionals; };

 stdenv.mkDerivation rec {
  name = "${pname}-${stdenv.lib.optionalString contribPlugins "full-"}${version}";
-  version = "13.12";
+  version = "16.01";
  pname = "codeblocks";

  src = fetchurl {
-    url = "mirror://sourceforge/codeblocks/Sources/${version}/codeblocks_${version}-1.tar.gz";
-    sha256 = "044njhps4cm1ijfdyr5f9wjyd0vblhrz9b4603ma52wcdq25093p";
+    url = "mirror://sourceforge/codeblocks/Sources/${version}/codeblocks_${version}.tar.gz";
+    sha256 = "00sskm91r20ywydwqwx6v7z3nwn9lyh5297c5wp3razldlh9vyrh";
  };

-  buildInputs = [ automake autoconf libtool pkgconfig file zip wxGTK gtk2 ]
+  nativeBuildInputs = [ autoreconfHook pkgconfig libtool file zip ];
+  buildInputs = [ wxGTK gtk2 ]
    ++ optionals contribPlugins [ hunspell gamin boost ];
  enableParallelBuilding = true;
  patches = [ ./writable-projects.patch ];
@ -25,9 +28,9 @@ stdenv.mkDerivation rec {

  # Fix boost 1.59 compat
  # Try removing in the next version
-  CPPFLAGS = "-DBOOST_ERROR_CODE_HEADER_ONLY -DBOOST_SYSTEM_NO_DEPRECATED";
+  #CPPFLAGS = "-DBOOST_ERROR_CODE_HEADER_ONLY -DBOOST_SYSTEM_NO_DEPRECATED";

-  meta = with stdenv.lib; {
+  meta = {
    maintainers = [ maintainers.linquize ];
    platforms = platforms.all;
    description = "The open source, cross platform, free C, C++ and Fortran IDE";
--- a/pkgs/applications/editors/geany/default.nix
+++ b/pkgs/applications/editors/geany/default.nix
@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
    '';
    homepage = http://www.geany.org/;
    license = "GPL";
-    maintainers = [ maintainers.bbenoist ];
+    maintainers = [];
    platforms = platforms.all;
  };
 }
--- a/pkgs/applications/editors/vscode/default.nix
+++ b/pkgs/applications/editors/vscode/default.nix
@ -2,24 +2,24 @@
  makeWrapper, libXScrnSaver }:

 let
-  version = "1.10.0";
-  rev = "49129d126e2c3c5592cfc8a509d872067b69d262";
+  version = "1.10.2";
+  rev = "8076a19fdcab7e1fc1707952d652f0bb6c6db331";
  channel = "stable";

  # The revision can be obtained with the following command (see https://github.com/NixOS/nixpkgs/issues/22465):
  # curl -w "%{url_effective}\n" -I -L -s -S https://vscode-update.azurewebsites.net/latest/linux-x64/stable -o /dev/null

-  sha256 = if stdenv.system == "i686-linux"    then "14ip00ysnn6daw7ws3vgnhib18pi7r1z1szfr7s996awbq12ir3i"
-      else if stdenv.system == "x86_64-linux"  then "1krrshsx2pjkr4pc1d6zad664f5khdbhwaq8lpx1aagxxd921mx6"
-      else if stdenv.system == "x86_64-darwin" then "1y574b4wpkk06a36clajx57ydj7a0scn2gms4070cqaf0afzy19f"
+  sha256 = if stdenv.system == "i686-linux"    then "1rhwrpv17c8j06qja7i58cggzka8jm9v9h27jy22z30yxjz0p241"
+      else if stdenv.system == "x86_64-linux"  then "1c1w7wc39a5vdap8j143ym976p9l9iwns1y28mcgjwrihdlb5wb8"
+      else if stdenv.system == "x86_64-darwin" then "1zznsn84k79lqirzv950q7caq7c88yh2gglwjc11y8k69awmlpva"
      else throw "Unsupported system: ${stdenv.system}";

  urlBase = "https://az764295.vo.msecnd.net/${channel}/${rev}/";

  urlStr = if stdenv.system == "i686-linux" then
-        urlBase + "code-${channel}-code_${version}-1488384152_i386.tar.gz"
+        urlBase + "code-${channel}-code_${version}-1488982317_i386.tar.gz"
      else if stdenv.system == "x86_64-linux" then
-        urlBase + "code-${channel}-code_${version}-1488387854_amd64.tar.gz"
+        urlBase + "code-${channel}-code_${version}-1488981323_amd64.tar.gz"
      else if stdenv.system == "x86_64-darwin" then
        urlBase + "VSCode-darwin-${channel}.zip"
      else throw "Unsupported system: ${stdenv.system}";
@ -47,17 +47,22 @@ in
      then [ unzip makeWrapper libXScrnSaver ]
      else [ makeWrapper libXScrnSaver ];

-    installPhase = ''
-      mkdir -p $out/lib/vscode $out/bin
-      cp -r ./* $out/lib/vscode
-      ln -s $out/lib/vscode/code $out/bin
+    installPhase =
+      if stdenv.system == "x86_64-darwin" then ''
+        mkdir -p $out/lib/vscode $out/bin
+        cp -r ./* $out/lib/vscode
+        ln -s $out/lib/vscode/Contents/Resources/app/bin/code $out/bin
+      '' else ''
+        mkdir -p $out/lib/vscode $out/bin
+        cp -r ./* $out/lib/vscode
+        ln -s $out/lib/vscode/code $out/bin

-      mkdir -p $out/share/applications
-      cp $desktopItem/share/applications/* $out/share/applications
+        mkdir -p $out/share/applications
+        cp $desktopItem/share/applications/* $out/share/applications

-      mkdir -p $out/share/pixmaps
-      cp $out/lib/vscode/resources/app/resources/linux/code.png $out/share/pixmaps/code.png
-    '';
+        mkdir -p $out/share/pixmaps
+        cp $out/lib/vscode/resources/app/resources/linux/code.png $out/share/pixmaps/code.png
+      '';

    postFixup = lib.optionalString (stdenv.system == "i686-linux" || stdenv.system == "x86_64-linux") ''
      patchelf \
--- a/pkgs/applications/graphics/graphicsmagick/cmyka-bounds.patch
+++ b/pkgs/applications/graphics/graphicsmagick/cmyka-bounds.patch
@ -0,0 +1,36 @@
+# HG changeset patch
+# User Bob Friesenhahn <bfriesen@GraphicsMagick.org>
+# Date 1487905610 21600
+# Node ID 6156b4c2992d855ece6079653b3b93c3229fc4b8
+# Parent  0392c4305a4369984ec8069055acc470c0a73647
+Fix out of bounds access when reading CMYKA tiff which claims wrong samples/pixel.
+
+diff -r 0392c4305a43 -r 6156b4c2992d coders/tiff.c
+--- a/coders/tiff.c	Sun Jan 29 10:04:57 2017 -0600
+++ b/coders/tiff.c	Thu Feb 23 21:06:50 2017 -0600
+@@ -1230,8 +1230,8 @@
+                   case 0:
+                     if (samples_per_pixel == 1)
+                       *quantum_type=GrayQuantum;
+-                      else
+-                        *quantum_type=RedQuantum;
+                    else
+                      *quantum_type=RedQuantum;
+                     break;
+                   case 1:
+                     *quantum_type=GreenQuantum;
+@@ -1411,12 +1411,12 @@
+               }
+             else
+               {
+-                if (image->matte)
+                if (image->matte && samples_per_pixel >= 5)
+                   {
+                     *quantum_type=CMYKAQuantum;
+                     *quantum_samples=5;
+                   }
+-                else
+                else if (samples_per_pixel >= 4)
+                   {
+                     *quantum_type=CMYKQuantum;
+                     *quantum_samples=4;
--- a/pkgs/applications/graphics/graphicsmagick/default.nix
+++ b/pkgs/applications/graphics/graphicsmagick/default.nix
@ -42,6 +42,7 @@ stdenv.mkDerivation {
      url = "https://sources.debian.net/data/main/g/graphicsmagick/1.3.25-7/debian/patches/CVE-2016-9830.patch";
      sha256 = "0qh15sd7nx7vf9sld4453iml951bwsx2fx84hxc7plhds2k3gjpa";
    })
+    ./cmyka-bounds.patch
  ];

  configureFlags = [
--- a/pkgs/applications/misc/audio/sox/default.nix
+++ b/pkgs/applications/misc/audio/sox/default.nix
@ -9,6 +9,7 @@
 , enableLibsndfile ? true, libsndfile ? null
 # amrnb and amrwb are unfree, disabled by default
 , enableAMR ? false, amrnb ? null, amrwb ? null
+, enableLibpulseaudio ? true, libpulseaudio ? null
 }:

 with stdenv.lib;
@ -30,7 +31,8 @@ stdenv.mkDerivation rec {
    optional enableFLAC flac ++
    optional enablePNG libpng ++
    optional enableLibsndfile libsndfile ++
-    optionals enableAMR [ amrnb amrwb ];
+    optionals enableAMR [ amrnb amrwb ] ++
+    optional enableLibpulseaudio libpulseaudio;

  meta = {
    description = "Sample Rate Converter for audio";
--- a/pkgs/applications/misc/direwolf/default.nix
+++ b/pkgs/applications/misc/direwolf/default.nix
@ -1,38 +1,43 @@
-{ stdenv, fetchFromGitHub, unzip, alsaLib }:
-let
-  version = "1.2";
-in
+{ stdenv, fetchFromGitHub
+, espeak, alsaLib, perl
+, python }:
+
+with stdenv.lib;
+
 stdenv.mkDerivation rec {
  name = "direwolf-${version}";
-  inherit version;
+  version = "1.3";

  src = fetchFromGitHub {
    owner = "wb2osz";
    repo = "direwolf";
-    rev = "8b81a32";
-    sha256 = "0r4fgdxghh292bzhqshr7zl5cg2lfsvlgmy4d5vqcli7x6qa1gcs";
+    rev = version;
+    sha256 = "1x6vvl3fy70ic5pqvqsyr0bkqwim8m9jaqnm5ls8z8i66rwq23fg";
  };

  buildInputs = [
-    unzip alsaLib
-  ];
+    espeak perl python
+  ] ++ (optional stdenv.isLinux alsaLib);

  patchPhase = ''
-    substituteInPlace Makefile.linux \
-      --replace "/usr/local" "$out" \
-      --replace "/usr/share" "$out/share"
-  '';
+        substituteInPlace Makefile.* \
+          --replace /usr/share $out/share

-  preInstall = ''
-    mkdir -p $out/bin
-  '';
+        substituteInPlace dwespeak.sh \
+          --replace espeak ${espeak}/bin/espeak
+        '';

-  meta = with stdenv.lib; {
+  installPhase = ''
+    mkdir -p $out/bin 
+    make INSTALLDIR=$out install
+    '';
+
+  meta = {
    description = "A Soundcard Packet TNC, APRS Digipeater, IGate, APRStt gateway";
    # On the page: This page will be disappearing on October 8, 2015.
-    homepage = https://home.comcast.net/~wb2osz/site/;
+    homepage = https://github.com/wb2osz/direwolf/;
    license = licenses.gpl2;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
    maintainers = [ maintainers.the-kenny ];
  };
 }
--- a/pkgs/applications/misc/emem/default.nix
+++ b/pkgs/applications/misc/emem/default.nix
@ -2,14 +2,14 @@

 stdenv.mkDerivation rec {
  pname = "emem";
-  version = "0.2.46";
+  version = "0.2.47";
  name = "${pname}-${version}";

  inherit jdk;

  src = fetchurl {
    url = "https://github.com/ebzzry/${pname}/releases/download/v${version}/${pname}.jar";
-    sha256 = "1wyckyh8jknkrcd8bvlf9m16xpi85hvhz42zv80by0hvsxgsibvy";
+    sha256 = "0hz862g7k42kik9vgzskqr99321llmmakl54ay9vsykvcxs632mx";
  };

  phases = [ "buildPhase" "installPhase" ];
--- a/pkgs/applications/misc/exercism/default.nix
+++ b/pkgs/applications/misc/exercism/default.nix
@ -2,7 +2,7 @@

 buildGoPackage rec {
  name    = "exercism-${version}";
-  version = "2.3.0";
+  version = "2.4.0";

  goPackagePath = "github.com/exercism/cli";

@ -10,7 +10,7 @@ buildGoPackage rec {
    owner  = "exercism";
    repo   = "cli";
    rev    = "v${version}";
-    sha256 = "1zhvvmsh5kw739kylk0bqj1wa6vjyahz43dlxdpv42h8gfiiksf5";
+    sha256 = "1hl13sr4ymqg9sjhkxdmhf8cfw69cic3bysw34xfv2j6bjjxfwaa";
  };

  meta = with stdenv.lib; {
--- a/pkgs/applications/misc/freicoin/default.nix
+++ b/pkgs/applications/misc/freicoin/default.nix
@ -1,28 +0,0 @@
-{ fetchurl, stdenv, db, boost, gmp, mpfr, miniupnpc, qt4, qmake4Hook, unzip }:
-
-stdenv.mkDerivation rec {
-  version = "0.8.3-1";
-  name = "freicoin-${version}";
-
-  src = fetchurl {
-    url = "https://github.com/freicoin/freicoin/archive/v${version}.zip";
-    sha256 = "0v3mh8a96nnb86mkyaylyjj7qfdrl7i9gvybh7f8w2hrl9paszfh";
-  };
-
-  # I think that openssl and zlib are required, but come through other
-  # packages
-  buildInputs = [ db boost gmp mpfr miniupnpc qt4 unzip qmake4Hook ];
-
-  installPhase = ''
-    mkdir -p $out/bin
-    cp freicoin-qt $out/bin
-  '';
-
-  meta = {
-    description = "Peer-to-peer currency with demurrage fee";
-    homepage = "http://freicoi.in/";
-    license = stdenv.lib.licenses.mit;
-    maintainers = with stdenv.lib.maintainers; [viric];
-    platforms = with stdenv.lib.platforms; linux;
-  };
-}
--- a/pkgs/applications/misc/galculator/default.nix
+++ b/pkgs/applications/misc/galculator/default.nix
@ -1,17 +1,20 @@
-{ stdenv, fetchurl
-, intltool, pkgconfig, gtk }:
+{ stdenv, fetchFromGitHub
+, autoreconfHook, intltool
+, gtk, pkgconfig, flex }:

 stdenv.mkDerivation rec {
-  
  name = "galculator-${version}";
-  version = "2.1.3";
+  version = "2.1.4";

-  src = fetchurl {
-    url = "mirror://sourceforge/galculator/${name}.tar.gz";
-    sha256 = "12m7dldjk10lpkdxk7zpk98n32ci65zmxidghihb7n1m3rhp3q17";
+  src = fetchFromGitHub {
+    owner = "galculator";
+    repo = "galculator";
+    rev = "v${version}";
+    sha256 = "0q0hb62f266709ncyq96bpx4a40a1i6dc5869byvd7x285sx1c2w";
  };

-  buildInputs = [ intltool pkgconfig gtk ];
+  nativeBuildInputs = [ autoreconfHook intltool pkgconfig ];
+  buildInputs = [ gtk flex ];

  meta = with stdenv.lib; {
    description = "A GTK 2/3 algebraic and RPN calculator";
--- a/pkgs/applications/misc/get_iplayer/default.nix
+++ b/pkgs/applications/misc/get_iplayer/default.nix
@ -1,9 +1,20 @@
-{stdenv, fetchurl, atomicparsley, flvstreamer, ffmpeg, makeWrapper, perl, buildPerlPackage, perlPackages, rtmpdump}:
+{stdenv, fetchFromGitHub, atomicparsley, flvstreamer, ffmpeg, makeWrapper, perl, buildPerlPackage, perlPackages, rtmpdump}:
+
+with stdenv.lib;
+
 buildPerlPackage rec {
  name = "get_iplayer-${version}";
-  version = "2.97";
+  version = "2.99";
+  
+  src = fetchFromGitHub {
+    owner = "get-iplayer";
+    repo = "get_iplayer";
+    rev = "v${version}";
+    sha256 = "085bgwkjnaqp96gvd2s8qmkw69rz91si1sgzqdqbplkzj9bk2qii";
+  };

-  buildInputs = [makeWrapper perl];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perl ];
  propagatedBuildInputs = with perlPackages; [HTMLParser HTTPCookies LWP XMLLibXML XMLSimple];

  preConfigure = "touch Makefile.PL";
@ -13,21 +24,15 @@ buildPerlPackage rec {
  installPhase = ''
    mkdir -p $out/bin $out/share/man/man1
    cp get_iplayer $out/bin
-    wrapProgram $out/bin/get_iplayer --suffix PATH : ${stdenv.lib.makeBinPath [ atomicparsley ffmpeg flvstreamer rtmpdump ]} --prefix PERL5LIB : $PERL5LIB
+    wrapProgram $out/bin/get_iplayer --suffix PATH : ${makeBinPath [ atomicparsley ffmpeg flvstreamer rtmpdump ]} --prefix PERL5LIB : $PERL5LIB
    cp get_iplayer.1 $out/share/man/man1
  '';
-  
-  src = fetchurl {
-    url = "https://github.com/get-iplayer/get_iplayer/archive/v${version}.tar.gz";
-    sha256 = "0bb6kmzjmazwfxq5ip7yxm39vssfgz3v5vfx1114wfssp6pw0r44";
-  };

  meta = {
    description = "Downloads TV and radio from BBC iPlayer";
-    license = stdenv.lib.licenses.gpl3Plus;
+    license = licenses.gpl3Plus;
    homepage = https://squarepenguin.co.uk/;
-    downloadPage = https://github.com/get-iplayer/get_iplayer/releases;
-    platforms = stdenv.lib.platforms.all;
+    platforms = platforms.all;
  };
  
 }
--- a/pkgs/applications/misc/gkrellm/default.nix
+++ b/pkgs/applications/misc/gkrellm/default.nix
@ -1,15 +1,19 @@
 { fetchurl, stdenv, gettext, pkgconfig, glib, gtk2, libX11, libSM, libICE
 , IOKit ? null }:

+with stdenv.lib;
+
 stdenv.mkDerivation rec {
-  name = "gkrellm-2.3.5";
+  name = "gkrellm-2.3.10";
+
  src = fetchurl {
-    url = "http://members.dslextreme.com/users/billw/gkrellm/${name}.tar.bz2";
-    sha256 = "12rc6zaa7kb60b9744lbrlfkxxfniprm6x0mispv63h4kh75navh";
+    url = "http://gkrellm.srcbox.net/releases/${name}.tar.bz2";
+    sha256 = "0rnpzjr0ys0ypm078y63q4aplcgdr5nshjzhmz330n6dmnxci7lb";
  };

-  buildInputs = [gettext pkgconfig glib gtk2 libX11 libSM libICE]
-    ++ stdenv.lib.optionals stdenv.isDarwin [ IOKit ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [gettext glib gtk2 libX11 libSM libICE]
+    ++ optionals stdenv.isDarwin [ IOKit ];

  hardeningDisable = [ "format" ];

@ -22,12 +26,11 @@ stdenv.mkDerivation rec {
       sed -i "$i" -e "s|/usr/X11R6|${libX11.dev}|g ; s|-lICE|-lX11 -lICE|g"
     done '';

-  buildPhase = ''
-     make PREFIX="$out" '';
-  installPhase = ''
-     make install PREFIX="$out" '';
+   installPhase = ''
+     make DESTDIR=$out install
+     '';

-  meta = {
+   meta = {
    description = "Themeable process stack of system monitors";
    longDescription =
      '' GKrellM is a single process stack of system monitors which supports
@ -35,10 +38,9 @@ stdenv.mkDerivation rec {
         or any other theme.
      '';

-    homepage = http://members.dslextreme.com/users/billw/gkrellm/gkrellm.html;
-    license = stdenv.lib.licenses.gpl3Plus;
-
+    homepage = http://gkrellm.srcbox.net;
+    license = licenses.gpl3Plus;
    maintainers = [ ];
-    platforms = stdenv.lib.platforms.unix;
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/applications/misc/gmrun/default.nix
+++ b/pkgs/applications/misc/gmrun/default.nix
@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
    '';
    homepage = "http://sourceforge.net/projects/gmrun/";
    license = "GPL";
-    maintainers = [ stdenv.lib.maintainers.bbenoist ];
+    maintainers = [];
    platforms = stdenv.lib.platforms.all;
  };
 }
--- a/pkgs/applications/misc/gpa/default.nix
+++ b/pkgs/applications/misc/gpa/default.nix
@ -1,14 +1,15 @@
 { stdenv, fetchurl, intltool, pkgconfig, gtk2, gpgme, libgpgerror, libassuan }:

 stdenv.mkDerivation rec {
-  name = "gpa-0.9.9";
+  name = "gpa-0.9.10";

  src = fetchurl {
    url = "mirror://gnupg/gpa/${name}.tar.bz2";
-    sha256 = "0d235hcqai7m3qb7m9kvr2r4qg4714f87j9fdplwrlz1p4wdfa38";
+    sha256 = "09xphbi2456qynwqq5n0yh0zdmdi2ggrj3wk4hsyh5lrzlvcrff3";
  };

-  buildInputs = [ intltool pkgconfig gtk2 gpgme libgpgerror libassuan ];
+  nativeBuildInputs = [ intltool pkgconfig ];
+  buildInputs = [ gtk2 gpgme libgpgerror libassuan ];

  meta = with stdenv.lib; {
    description = "Graphical user interface for the GnuPG";
--- a/pkgs/applications/misc/gphoto2/default.nix
+++ b/pkgs/applications/misc/gphoto2/default.nix
@ -3,17 +3,17 @@
 }:

 stdenv.mkDerivation rec {
-  name = "gphoto2-2.5.8";
+  name = "gphoto2-2.5.11";

  src = fetchurl {
    url = "mirror://sourceforge/gphoto/${name}.tar.bz2";
-    sha256 = "0kgfql6c64ha1gahjdwlqhmkslnfywmc2fkys4c5682zv4awvax9";
+    sha256 = "1sgr6rsvzzagcwhc8fxbnvz3k02wr2hab0vrbvcb04k5l3b48a1r";
  };

-  nativeBuildInputs = [ pkgconfig gettext ];
-  buildInputs = [ libgphoto2 libexif popt libjpeg readline libtool ];
+  nativeBuildInputs = [ pkgconfig gettext libtool ];
+  buildInputs = [ libgphoto2 libexif popt libjpeg readline ];

-  meta = {
+  meta = with stdenv.lib; {
    description = "A ready to use set of digital camera software applications";
    longDescription = ''

@ -22,8 +22,8 @@ stdenv.mkDerivation rec {

    '';
    homepage = http://www.gphoto.org/;
-    license = stdenv.lib.licenses.gpl2Plus;
-    platforms = with stdenv.lib.platforms; unix;
-    maintainers = with stdenv.lib.maintainers; [ jcumming ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.unix;
+    maintainers = [ maintainers.jcumming ];
  };
 }
--- a/pkgs/applications/misc/gpscorrelate/default.nix
+++ b/pkgs/applications/misc/gpscorrelate/default.nix
@ -1,17 +1,22 @@
-{ fetchurl, stdenv, pkgconfig, exiv2, libxml2, gtk2
+{ fetchFromGitHub, stdenv, pkgconfig, exiv2, libxml2, gtk2
 , libxslt, docbook_xsl, docbook_xml_dtd_42 }:

 stdenv.mkDerivation rec {
-  name = "gpscorrelate-1.6.0";
+  name = "gpscorrelate-${version}";
+  version = "1.6.1";

-  src = fetchurl {
-    url = "http://freefoote.dview.net/linux/${name}.tar.gz";
-    sha256 = "1j0b244xkvvf0i4iivp4dw9k4xgyasx4sapd91mnwki35fy49sp0";
+  src = fetchFromGitHub {
+    owner = "freefoote";
+    repo = "gpscorrelate";
+    rev = version;
+    sha256 = "1z0fc75rx7dl6nnydksa578qv116j2c2xs1czfiijzxjghx8njdj";
  };

+  nativeBuildInputs = [ pkgconfig ];
  buildInputs = [
-    pkgconfig exiv2 libxml2 gtk2
-    libxslt docbook_xsl docbook_xml_dtd_42
+    exiv2 libxml2 gtk2
+    libxslt docbook_xsl 
+    docbook_xml_dtd_42
  ];

  patchPhase = ''
@ -19,7 +24,7 @@ stdenv.mkDerivation rec {
        -es",^[[:blank:]]*prefix[[:blank:]]*=.*$,prefix = $out,g"
  '';

-  meta = {
+  meta = with stdenv.lib; {
    description = "A GPS photo correlation tool, to add EXIF geotags";

    longDescription = ''
@ -38,9 +43,8 @@ stdenv.mkDerivation rec {
      one takes the GPS data in a different format.
    '';

-    license = stdenv.lib.licenses.gpl2Plus;
-
-    homepage = http://freefoote.dview.net/linux_gpscorr.html;
-    platforms = stdenv.lib.platforms.linux;
+    license = licenses.gpl2Plus;
+    homepage = https://github.com/freefoote/gpscorrelate;
+    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/misc/iterm2/default.nix
+++ b/pkgs/applications/misc/iterm2/default.nix
@ -2,16 +2,19 @@

 stdenv.mkDerivation rec {
  name = "iterm2-${version}";
-  version = "3.0.4";
+  version = "3.0.14";

  src = fetchFromGitHub {
    owner = "gnachman";
    repo = "iTerm2";
    rev = "v${version}";
-    sha256 = "0ffg9l2jvv503h13nd5rjkn5xrahswcqqwmm052qzd6d0lmqjm93";
+    sha256 = "03m0ja11w9910z96yi8fzq3436y8xl14q031rdb2w3sapjd54qrj";
  };

  patches = [ ./disable_updates.patch ];
+  postPatch = ''
+    sed -i -e 's/CODE_SIGN_IDENTITY = "Developer ID Application"/CODE_SIGN_IDENTITY = ""/g' ./iTerm2.xcodeproj/project.pbxproj
+  '';
  makeFlagsArray = ["Deployment"];
  installPhase = ''
    mkdir -p "$out/Applications"
--- a/pkgs/applications/misc/keepassx/community.nix
+++ b/pkgs/applications/misc/keepassx/community.nix
@ -7,13 +7,13 @@ with stdenv.lib;

 stdenv.mkDerivation rec {
  name = "keepassx-community-${version}";
-  version = "2.1.2";
+  version = "2.1.3";

  src = fetchFromGitHub {
    owner = "keepassxreboot";
    repo = "keepassxc";
    rev = "${version}";
-    sha256 = "0ncc157xki1mzxfa41bgwjfsz5jq9sq750ka578lq61smyzh5lq6";
+    sha256 = "1zamk3dc44fn61b880i3l1r0np2sx2hs05cvcf2x4748r3xicacf";
  };

  cmakeFlags = optional (withKeePassHTTP) [ "-DWITH_XC_HTTP=ON" ];
--- a/pkgs/applications/misc/octoprint/plugins.nix
+++ b/pkgs/applications/misc/octoprint/plugins.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, octoprint, pythonPackages }:
+{ stdenv, fetchFromGitHub, fetchpatch, octoprint, pythonPackages }:

 let
  buildPlugin = args: pythonPackages.buildPythonApplication (args // {
@ -23,6 +23,11 @@ let

      patches = [
        ./m33-fio-one-library.patch
+        # Fix incompatibility with new OctoPrint
+        (fetchpatch {
+          url = "https://github.com/foosel/M33-Fio/commit/bdf2422dee3fb8e53b33f087f734956c3b209d72.patch";
+          sha256 = "0jm415sx6d3m0z4gfhbnxlasg08zf3f3mslaj4amn9wbvsik9s5d";
+        })
      ];

      postPatch = ''
--- a/pkgs/applications/misc/xfe/default.nix
+++ b/pkgs/applications/misc/xfe/default.nix
@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
    '';
    homepage = "http://sourceforge.net/projects/xfe/";
    license = stdenv.lib.licenses.gpl2;
-    maintainers = [ stdenv.lib.maintainers.bbenoist ];
+    maintainers = [];
    platforms = stdenv.lib.platforms.linux;
  };
 }
--- a/pkgs/applications/networking/browsers/surf/webkit2.nix
+++ b/pkgs/applications/networking/browsers/surf/webkit2.nix
@ -6,9 +6,9 @@

 let
  # http://git.suckless.org/surf/log/?h=surf-webkit2
-  rev = "37e43501d80710533f3ec0bd61ee84916c8524a4";
-  sha256 = "1q388rzm4irpaam4z8xycbyh5dgkjlar5jn1iw7zfls1pbpzr5br";
-  date = "2017-03-06";
+  rev = "7e02344a615a61246ccce1c7f770e88fbd57756e";
+  sha256 = "11f93fbjhl7nfgwkcc45lcm3x1wk5h87ap8fbw9w855021i57pp6";
+  date = "2017-03-22";
 in

 stdenv.mkDerivation rec {
--- a/pkgs/applications/networking/browsers/torbrowser/default.nix
+++ b/pkgs/applications/networking/browsers/torbrowser/default.nix
@ -0,0 +1,301 @@
+{ stdenv
+, fetchurl
+, makeDesktopItem
+
+# Common run-time dependencies
+, zlib
+
+# libxul run-time dependencies
+, alsaLib
+, atk
+, cairo
+, dbus
+, dbus_glib
+, fontconfig
+, freetype
+, gdk_pixbuf
+, glib
+, gtk2
+, libX11
+, libXext
+, libXrender
+, libXt
+, pango
+
+# Pulseaudio support
+, pulseaudioSupport ? mediaSupport
+, libpulseaudio
+
+# Media support (implies pulseaudio support)
+, mediaSupport ? false
+, gstreamer
+, gst-plugins-base
+, gst-plugins-good
+, gst-ffmpeg
+, gmp
+, ffmpeg
+}:
+
+with stdenv.lib;
+
+let
+  libPath = makeLibraryPath ([
+    alsaLib
+    atk
+    cairo
+    dbus
+    dbus_glib
+    fontconfig
+    freetype
+    gdk_pixbuf
+    glib
+    gtk2
+    libX11
+    libXext
+    libXrender
+    libXt
+    pango
+    stdenv.cc.cc
+    zlib
+  ]
+  ++ optionals pulseaudioSupport [ libpulseaudio ]
+  ++ optionals mediaSupport [
+    gstreamer
+    gst-plugins-base
+    gmp
+    ffmpeg
+  ]);
+
+  gstPluginsPath = concatMapStringsSep ":" (x:
+    "${x}/lib/gstreamer-0.10") [
+      gstreamer
+      gst-plugins-base
+      gst-plugins-good
+      gst-ffmpeg
+    ];
+
+  # Upstream source
+  version = "6.5.1";
+
+  lang = "en-US";
+
+  srcs = {
+    "x86_64-linux" = fetchurl {
+      url = "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz";
+      sha256 = "1p2bgavvyzahqpjg9vp14c0s50rmha3v1hs1c8zvz6fj8fgrhn0i";
+    };
+
+    "i686-linux" = fetchurl {
+      url = "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz";
+      sha256 = "1zfghr01bhpn39wqaw7hyx7yap7xyla4m3mrgz2vi9a5qsyxmbcr";
+    };
+  };
+in
+
+stdenv.mkDerivation rec {
+  name = "tor-browser-${version}";
+  inherit version;
+
+  src = srcs."${stdenv.system}" or (throw "unsupported system: ${stdenv.system}");
+
+  preferLocalBuild = true;
+
+  desktopItem = makeDesktopItem {
+    name = "torbrowser";
+    exec = "tor-browser";
+    icon = "torbrowser";
+    desktopName = "Tor Browser";
+    genericName = "Web Browser";
+    comment = meta.description;
+    categories = "Network;WebBrowser;Security;";
+  };
+
+  buildCommand = ''
+    # For convenience ...
+    TBB_IN_STORE=$out/share/tor-browser
+    interp=$(< $NIX_CC/nix-support/dynamic-linker)
+
+    # Unpack & enter
+    mkdir -p "$TBB_IN_STORE"
+    tar xf "${src}" -C "$TBB_IN_STORE" --strip-components=2
+    pushd "$TBB_IN_STORE"
+
+    # Set ELF interpreter
+    for exe in firefox TorBrowser/Tor/tor ; do
+      patchelf --set-interpreter "$interp" "$exe"
+    done
+
+    # The final libPath.  Note, we could split this into firefoxLibPath
+    # and torLibPath for accuracy, but this is more convenient ...
+    libPath=${libPath}:$TBB_IN_STORE:$TBB_IN_STORE/TorBrowser/Tor
+
+    # Prepare for autoconfig.
+    #
+    # See https://developer.mozilla.org/en-US/Firefox/Enterprise_deployment
+    cat >defaults/pref/autoconfig.js <<EOF
+    //
+    pref("general.config.filename", "mozilla.cfg");
+    pref("general.config.obscure_value", 0);
+    EOF
+
+    # Hard-coded Firefox preferences.
+    cat >mozilla.cfg <<EOF
+    // First line must be a comment
+
+    // Always update via Nix
+    lockPref("app.update.auto", false);
+    lockPref("app.update.enabled", false);
+    lockPref("extensions.update.autoUpdateDefault", false);
+    lockPref("extensions.update.enabled", false);
+
+    // User should never change these.  Locking prevents these
+    // values from being written to prefs.js, avoiding Store
+    // path capture.
+    lockPref("extensions.torlauncher.torrc-defaults_path", "$TBB_IN_STORE/TorBrowser/Data/Tor/torrc-defaults");
+    lockPref("extensions.torlauncher.tor_path", "$TBB_IN_STORE/TorBrowser/Tor/tor");
+
+    // Reset pref that captures store paths.
+    clearPref("extensions.xpiState");
+
+    // Stop obnoxious first-run redirection.
+    lockPref("noscript.firstRunRedirection", false);
+    EOF
+
+    # Hard-code path to TBB fonts; see also FONTCONFIG_FILE in
+    # the wrapper below.
+    FONTCONFIG_FILE=$TBB_IN_STORE/TorBrowser/Data/fontconfig/fonts.conf
+    sed -i "$FONTCONFIG_FILE" \
+        -e "s,<dir>fonts</dir>,<dir>$TBB_IN_STORE/fonts</dir>,"
+
+    # Move default extension overrides into distribution dir, to avoid
+    # having to synchronize between local state and store.
+    mv TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js defaults/pref/torbrowser.js
+
+    # Hard-code paths to geoip data files, to prevent them from being
+    # copied into the local state directory.
+    cat >>TorBrowser/Data/Tor/torrc-defaults <<EOF
+    GeoIPFile $TBB_IN_STORE/TorBrowser/Data/Tor/geoip
+    GeoIPv6File $TBB_IN_STORE/TorBrowser/Data/Tor/geoip6
+    EOF
+
+    # Generate wrapper
+    mkdir -p $out/bin
+    cat > "$out/bin/tor-browser" << EOF
+    #! ${stdenv.shell}
+    set -o errexit -o nounset
+
+    # Enter local state directory.
+    REAL_HOME=\$HOME
+    TBB_HOME=\''${TBB_HOME:-''${XDG_DATA_HOME:-\$REAL_HOME/.local/share}/tor-browser}
+    HOME=\$TBB_HOME
+
+    mkdir -p "\$HOME"
+    cd "\$HOME"
+
+    # Initialize empty TBB local state directory hierarchy.  We
+    # intentionally mirror the layout that TBB would see if executed from
+    # the unpacked bundle dir.
+    mkdir -p "\$HOME/TorBrowser" "\$HOME/TorBrowser/Data"
+
+    # Initialize the Tor data directory.
+    mkdir -p "\$HOME/TorBrowser/Data/Tor"
+
+    # Initialize the browser profile state.  Note that the only data
+    # copied from the Store payload is the initial bookmark file, which is
+    # never updated once created.  All other files under user's profile
+    # dir are generated by TBB.
+    mkdir -p "\$HOME/TorBrowser/Data/Browser/profile.default"
+    cp -u --no-preserve=mode,owner "$TBB_IN_STORE/TorBrowser/Data/Browser/profile.default/bookmarks.html" \
+      "\$HOME/TorBrowser/Data/Browser/profile.default/bookmarks.html"
+
+    # Clear out some files that tend to capture store references but are
+    # easily generated by firefox at startup.
+    rm -f "\$HOME/TorBrowser/Data/Browser/profile.default"/{compatibility.ini,extensions.ini,extensions.json}
+
+    # Ensure that we're always using the up-to-date extensions.
+    ln -snf "$TBB_IN_STORE/TorBrowser/Data/Browser/profile.default/extensions" \
+      "\$HOME/TorBrowser/Data/Browser/profile.default/extensions"
+
+    ${optionalString pulseaudioSupport ''
+      # Figure out some envvars for pulseaudio
+      : "\''${XDG_RUNTIME_DIR:=/run/user/\$(id -u)}"
+      : "\''${XDG_CONFIG_HOME:=\$REAL_HOME/.config}"
+      : "\''${PULSE_SERVER:=\$XDG_RUNTIME_DIR/pulse/native}"
+      : "\''${PULSE_COOKIE:=\$XDG_CONFIG_HOME/pulse/cookie}"
+    ''}
+
+    # Font cache files capture store paths; clear them out on the off
+    # chance that TBB would continue using old font files.
+    rm -rf "\$HOME/.cache/fontconfig"
+
+    # Lift-off
+    #
+    # XAUTHORITY and DISPLAY are required for TBB to work at all.
+    #
+    # DBUS_SESSION_BUS_ADDRESS is inherited to avoid auto-launch; to
+    # prevent that, set it to an empty/invalid value prior to running
+    # tor-browser.
+    #
+    # PULSE_SERVER is necessary for audio playback.
+    #
+    # Setting FONTCONFIG_FILE is required to make fontconfig read the TBB
+    # fonts.conf; upstream uses FONTCONFIG_PATH, but FC_DEBUG=1024
+    # indicates the system fonts.conf being used instead.
+    exec env -i \
+      HOME="\$HOME" \
+      XAUTHORITY="\$XAUTHORITY" \
+      DISPLAY="\$DISPLAY" \
+      DBUS_SESSION_BUS_ADDRESS="\$DBUS_SESSION_BUS_ADDRESS" \
+      \
+      PULSE_SERVER="\''${PULSE_SERVER:-}" \
+      PULSE_COOKIE="\''${PULSE_COOKIE:-}" \
+      \
+      GST_PLUGIN_SYSTEM_PATH="${optionalString mediaSupport gstPluginsPath}" \
+      GST_REGISTRY="/dev/null" \
+      GST_REGISTRY_UPDATE="no" \
+      \
+      FONTCONFIG_FILE="$FONTCONFIG_FILE" \
+      \
+      LD_LIBRARY_PATH="$libPath" \
+      \
+      "$TBB_IN_STORE/firefox" \
+        --class "Tor Browser" \
+        -no-remote \
+        -profile "\$HOME/TorBrowser/Data/Browser/profile.default" \
+        "\''${@}"
+    EOF
+    chmod +x $out/bin/tor-browser
+
+    # Easier access to docs
+    mkdir -p $out/share/doc
+    ln -s $TBB_IN_STORE/TorBrowser/Docs $out/share/doc/tor-browser
+
+    # Install .desktop item
+    mkdir -p $out/share/applications
+    cp $desktopItem/share/applications"/"* $out/share/applications
+
+    # Install icons
+    mkdir -p $out/share/pixmaps
+    cp browser/icons/mozicon128.png $out/share/pixmaps/torbrowser.png
+
+    # Check installed apps
+    echo "Checking bundled Tor ..."
+    LD_LIBRARY_PATH=$libPath $TBB_IN_STORE/TorBrowser/Tor/tor --version >/dev/null
+
+    echo "Checking tor-browser wrapper ..."
+    DISPLAY="" XAUTHORITY="" DBUS_SESSION_BUS_ADDRESS="" TBB_HOME=$(mktemp -d) \
+      $out/bin/tor-browser --version >/dev/null
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Tor Browser Bundle";
+    homepage = https://www.torproject.org/;
+    platforms = attrNames srcs;
+    maintainers = with maintainers; [ offline matejc doublec thoughtpolice joachifm ];
+    hydraPlatforms = [];
+    # MPL2.0+, GPL+, &c.  While it's not entirely clear whether
+    # the compound is "libre" in a strict sense (some components place certain
+    # restrictions on redistribution), it's free enough for our purposes.
+    license = licenses.free;
+  };
+}
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@ -27,7 +27,7 @@ let
      export HOME=$TMP
    '';

-    doCheck = builtins.compareVersions version "0.8.8" >= 0;
+    doCheck = builtins.compareVersions version "0.9.0" >= 0;

    meta = with stdenv.lib; {
      description = "Tool for building, changing, and versioning infrastructure";
--- a/pkgs/applications/networking/irc/irssi/default.nix
+++ b/pkgs/applications/networking/irc/irssi/default.nix
@ -1,12 +1,12 @@
 { stdenv, fetchurl, pkgconfig, ncurses, glib, openssl, perl, libintlOrEmpty }:

 stdenv.mkDerivation rec {
-  version = "1.0.1";
+  version = "1.0.2";
  name = "irssi-${version}";

  src = fetchurl {
    url = "https://github.com/irssi/irssi/releases/download/${version}/${name}.tar.gz";
-    sha256 = "1nqrm376bipvh4x483vygydjzs05n4fmfzip1gfakq1vfqqfhshr";
+    sha256 = "1fas6dqz6g8m2400spvkhfxihj3w06qb917h4vhcb716g9wpjkwf";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/applications/networking/p2p/tribler/default.nix
+++ b/pkgs/applications/networking/p2p/tribler/default.nix
@ -9,7 +9,7 @@ stdenv.mkDerivation rec {

  src = fetchgit {
    url = "https://github.com/Tribler/tribler";
-    rev = "v${revision}";
+    rev = revision;
    sha256 = "16mk76qgg7fgca11yvpygicxqbkc0kn6r82x73fly2310pagd845";
    fetchSubmodules = true;
  };
--- a/pkgs/applications/science/math/geogebra/default.nix
+++ b/pkgs/applications/science/math/geogebra/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  name = "geogebra-${version}";
-  version = "5-0-338-0";
+  version = "5-0-346-0";

  preferLocalBuild = true;

  src = fetchurl {
    url = "http://download.geogebra.org/installers/5.0/GeoGebra-Linux-Portable-${version}.tar.bz2";
-    sha256 = "1namwib3912zjizgl9swan0fwgmq9kvfq5k5y8lz818vh4lv88kx";
+    sha256 = "13yiksdk5qwa7c5zp5l0h3czqq31qlf04ncgrh8mn7z70ng1f3l4";
  };

  srcIcon = fetchurl {
--- a/pkgs/applications/science/math/speedcrunch/default.nix
+++ b/pkgs/applications/science/math/speedcrunch/default.nix
@ -31,6 +31,6 @@ stdenv.mkDerivation rec {
    '';
    maintainers = with maintainers; [ gebner ];
    platforms = platforms.all;
+    broken = builtins.compareVersions qtbase.version "5.8.0" >= 0;
  };
-
 }
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@ -11,7 +11,7 @@
 }:

 let
-  version = "2.12.0";
+  version = "2.12.2";
  svn = subversionClient.override { perlBindings = true; };
 in

@ -20,7 +20,7 @@ stdenv.mkDerivation {

  src = fetchurl {
    url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "09r0lcjj5v2apj39f0ziqzjq2bi1jpnhszc9q4n0ab86g5j7c88q";
+    sha256 = "0jlccxx7l4c76h830y8lhrxr4kqksrxqlnmj3xb8sqbfa0irw6nj";
  };

  hardeningDisable = [ "format" ];
@ -30,7 +30,6 @@ stdenv.mkDerivation {
    ./symlinks-in-bin.patch
    ./git-sh-i18n.patch
    ./ssh-path.patch
-    ./ssl-cert-file.patch
  ];

  postPatch = ''
--- a/pkgs/applications/version-management/git-and-tools/git/ssl-cert-file.patch
+++ b/pkgs/applications/version-management/git-and-tools/git/ssl-cert-file.patch
@ -1,11 +0,0 @@
-diff -ru git-2.7.4-orig/http.c git-2.7.4/http.c
--- git-2.7.4-orig/http.c	2016-03-17 21:47:59.000000000 +0100
-+++ git-2.7.4/http.c	2016-04-12 11:38:33.187070848 +0200
-@@ -544,6 +544,7 @@
- #if LIBCURL_VERSION_NUM >= 0x070908
- 	set_from_env(&ssl_capath, "GIT_SSL_CAPATH");
- #endif
-+	set_from_env(&ssl_cainfo, "SSL_CERT_FILE");
- 	set_from_env(&ssl_cainfo, "GIT_SSL_CAINFO");
- 
- 	set_from_env(&user_agent, "GIT_HTTP_USER_AGENT");
--- a/pkgs/applications/version-management/gitkraken/default.nix
+++ b/pkgs/applications/version-management/gitkraken/default.nix
@ -1,19 +1,21 @@
-{stdenv, lib, libXcomposite, libgnome_keyring, makeWrapper, udev, curl, alsaLib
-  ,libXfixes, atk, gtk2, libXrender, pango, gnome2, cairo, freetype, fontconfig
-  ,libX11, libXi, libXext, libXcursor, glib, libXScrnSaver, libxkbfile, libXtst
-  ,nss, nspr, cups, fetchurl, expat, gdk_pixbuf, libXdamage, libXrandr, dbus
+{ stdenv, lib, libXcomposite, libgnome_keyring, makeWrapper, udev, curl, alsaLib
+, libXfixes, atk, gtk2, libXrender, pango, gnome2, cairo, freetype, fontconfig
+, libX11, libXi, libXext, libXcursor, glib, libXScrnSaver, libxkbfile, libXtst
+, nss, nspr, cups, fetchurl, expat, gdk_pixbuf, libXdamage, libXrandr, dbus
 }:

+with stdenv.lib;
+
 stdenv.mkDerivation rec {
  name = "gitkraken-${version}";
-  version = "2.2.0";
+  version = "2.2.1";

  src = fetchurl {
    url = "https://release.gitkraken.com/linux/v${version}.tar.gz";
-    sha256 = "0a3ed917e6e937af4dd180144fbb4ad8b99b35b5d8c1f0684a55de38189a812d";
+    sha256 = "12nyw2dh9ylrms264dbw0xzyif0znmba32zyfq7kdp0iay0wvgqd";
  };

-  libPath = stdenv.lib.makeLibraryPath [
+  libPath = makeLibraryPath [
    stdenv.cc.cc.lib
    curl
    udev
@ -47,24 +49,26 @@ stdenv.mkDerivation rec {
    libgnome_keyring
  ];

-  phases = [ "unpackPhase" "installPhase" ];
+  nativeBuildInputs = [ makeWrapper ];

-  buildInputs = [ makeWrapper ];
+  dontBuild = true;

  installPhase = ''
    mkdir -p "$out/opt/gitkraken"
    cp -r ./* "$out/opt/gitkraken"
-    fixupPhase
+  '';
+
+  postFixup = ''
    patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
             --set-rpath "$libPath:$out/opt/gitkraken" "$out/opt/gitkraken/gitkraken"
    wrapProgram $out/opt/gitkraken/gitkraken \
-      --prefix LD_PRELOAD : "${stdenv.lib.makeLibraryPath [ curl ]}/libcurl.so.4" \
-      --prefix LD_PRELOAD : "${stdenv.lib.makeLibraryPath [ libgnome_keyring ]}/libgnome-keyring.so.0"
+      --prefix LD_PRELOAD : "${makeLibraryPath [ curl ]}/libcurl.so.4" \
+      --prefix LD_PRELOAD : "${makeLibraryPath [ libgnome_keyring ]}/libgnome-keyring.so.0"
    mkdir "$out/bin"
    ln -s "$out/opt/gitkraken/gitkraken" "$out/bin/gitkraken"
  '';

-  meta = with stdenv.lib; {
+  meta = {
    homepage = https://www.gitkraken.com/;
    description = "The downright luxurious and most popular Git client for Windows, Mac & Linux";
    license = licenses.unfree;
--- a/pkgs/applications/version-management/gogs/default.nix
+++ b/pkgs/applications/version-management/gogs/default.nix
@ -3,25 +3,26 @@
 , sqliteSupport ? true
 }:

+with stdenv.lib;
+
 buildGoPackage rec {
  name = "gogs-${version}";
-  version = "0.9.113";
+  version = "0.10.18";

  src = fetchFromGitHub {
    owner = "gogits";
    repo = "gogs";
    rev = "v${version}";
-    sha256 = "1zk83c9jiazfw3221yi2sidp7917q3dxb2xb7wrjg4an18gj46j7";
+    sha256 = "1f1dlickjpdilf4j295i9v2h4ig4pf5d2mnpbr59wh14bby4bh0y";
  };

  patchPhase = ''
-    substituteInPlace models/repo.go \
-      --replace '#!/usr/bin/env' '#!${coreutils}/bin/env'
-  '';
+    patchShebangs .
+    '';

-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];

-  buildFlags = stdenv.lib.optionalString sqliteSupport "-tags sqlite";
+  buildFlags = optionalString sqliteSupport "-tags sqlite";

  outputs = [ "bin" "out" "data" ];

@ -30,7 +31,7 @@ buildGoPackage rec {
    cp -R $src/{public,templates} $data

    wrapProgram $bin/bin/gogs \
-      --prefix PATH : ${stdenv.lib.makeBinPath [ bash git gzip openssh ]} \
+      --prefix PATH : ${makeBinPath [ bash git gzip openssh ]} \
      --run 'export GOGS_WORK_DIR=''${GOGS_WORK_DIR:-$PWD}' \
      --run 'mkdir -p "$GOGS_WORK_DIR" && cd "$GOGS_WORK_DIR"' \
      --run "ln -fs $data/{public,templates} ."
@ -42,7 +43,7 @@ buildGoPackage rec {
  meta = {
    description = "A painless self-hosted Git service";
    homepage = "https://gogs.io";
-    license = stdenv.lib.licenses.mit;
-    maintainers = with stdenv.lib.maintainers; [ schneefux ];
+    license = licenses.mit;
+    maintainers = [ maintainers.schneefux ];
  };
 }
--- a/pkgs/applications/version-management/mercurial/default.nix
+++ b/pkgs/applications/version-management/mercurial/default.nix
@ -7,8 +7,9 @@ let
  version = "3.9.2";
  name = "mercurial-${version}";
  inherit (python2Packages) docutils hg-git dulwich python;
-in python2Packages.mkPythonDerivation {
+in python2Packages.buildPythonApplication {
  inherit name;
+  format = "other";

  src = fetchurl {
    url = "https://mercurial-scm.org/release/${name}.tar.gz";
--- a/pkgs/applications/version-management/yadm/default.nix
+++ b/pkgs/applications/version-management/yadm/default.nix
@ -1,6 +1,6 @@
 { stdenv, fetchurl, fetchFromGitHub }:

-let version = "1.05"; in
+let version = "1.07"; in
 stdenv.mkDerivation {
  name = "yadm-${version}";

@ -8,7 +8,7 @@ stdenv.mkDerivation {
    owner  = "TheLocehiliosan";
    repo   = "yadm";
    rev    = "${version}";
-    sha256 = "11bqgz28qzgb3iz8xvda9z0mh5r1a9m032pqm772ypiixsfz8hdd";
+    sha256 = "0kkxrvw17pmrx1dq0dq53jb9pm545firakrxc48znfw54n2036fw";
  };

  buildCommand = ''
--- a/pkgs/applications/video/kodi/default.nix
+++ b/pkgs/applications/video/kodi/default.nix
@ -44,12 +44,12 @@ let
    sha256 = "14jicb26s20nr3qmfpazszpc892yjwjn81zbsb8szy3a5xs19y81";
  };
 in stdenv.mkDerivation rec {
-    name = "kodi-" + version;
-    version = "17.0";
+    name = "kodi-${version}";
+    version = "17.1";

    src = fetchurl {
      url = "https://github.com/xbmc/xbmc/archive/${version}-${rel}.tar.gz";
-      sha256 = "0ib59x733yf8ivsw82qlsq43jn5214n668nrn5df2flpjcjgmzsb";
+      sha256 = "1vmvrq0qdjnphw34yils2b5jnm05cmsg777hc4lwqz5mrc1kjgrh";
    };

    buildInputs = [
@ -97,9 +97,18 @@ in stdenv.mkDerivation rec {
    '';

    preConfigure = ''
+      patchShebangs .
      ./bootstrap
+      # tests here fail
+      sed -i '/TestSystemInfo.cpp/d' xbmc/utils/test/{Makefile,CMakeLists.txt}
+      # tests here trigger a segfault in kodi.bin
+      sed -i '/TestWebServer.cpp/d'  xbmc/network/test/{Makefile,CMakeLists.txt}
    '';

+    enableParallelBuild = true;
+
+    doCheck = true;
+
    configureFlags = [ "--enable-libcec" ]
    ++ lib.optional (!sambaSupport) "--disable-samba"
    ++ lib.optional vdpauSupport "--enable-vdpau"
@ -110,19 +119,17 @@ in stdenv.mkDerivation rec {
    postInstall = ''
      for p in $(ls $out/bin/) ; do
        wrapProgram $out/bin/$p \
-          --prefix PATH ":" "${python2}/bin" \
-          --prefix PATH ":" "${glxinfo}/bin" \
-          --prefix PATH ":" "${xdpyinfo}/bin" \
+          --prefix PATH ":" "${lib.makeBinPath
+              [ python2 glxinfo xdpyinfo ]}" \
          --prefix LD_LIBRARY_PATH ":" "${lib.makeLibraryPath
-              [ curl systemd libmad libvdpau libcec libcec_platform rtmpdump libass SDL2 ]
-            }"
+              [ curl systemd libmad libvdpau libcec libcec_platform rtmpdump libass SDL2 ]}"
      done
    '';

    meta = with stdenv.lib; {
      homepage = http://kodi.tv/;
      description = "Media center";
-      license = stdenv.lib.licenses.gpl2;
+      license = licenses.gpl2;
      platforms = platforms.linux;
      maintainers = with maintainers; [ domenkozar titanous edwtjo ];
    };
--- a/pkgs/applications/video/obs-studio/default.nix
+++ b/pkgs/applications/video/obs-studio/default.nix
@ -27,12 +27,10 @@ in stdenv.mkDerivation rec {
  src = fetchFromGitHub {
    owner = "jp9000";
    repo = "obs-studio";
-    rev = "${version}";
-    sha256 = "0mvjmkq5zlcppjqy18933w7r7rz1mpr2jpf8ipd0famdlgyacix6";
+    rev = "624aa2a5";
+    sha256 = "1bs82rqyq7wjjg99mh23ap8z5bmrhjfnza5iyjx808fzqc0bgzaj";
  };

-  patches = [ ./segfault-patch-systray.patch ];
-
  nativeBuildInputs = [ cmake
                      ];

--- a/pkgs/applications/video/obs-studio/segfault-patch-systray.patch
+++ b/pkgs/applications/video/obs-studio/segfault-patch-systray.patch
@ -1,40 +0,0 @@
-From c31e0f682431508ccd2d3c0f74e6e16fc71445d8 Mon Sep 17 00:00:00 2001
-From: Cray Elliott <MP2E@archlinux.us>
-Date: Fri, 10 Mar 2017 03:48:36 -0800
-Subject: [PATCH] Fix segfault in Linux when no system tray exists
-
-previously, switching workspaces while obs-studio is running resulted in a
-segfault if no system tray was available
---
- UI/window-basic-main.cpp | 16 +++++++++-------
- 1 file changed, 9 insertions(+), 7 deletions(-)
-
-diff --git a/UI/window-basic-main.cpp b/UI/window-basic-main.cpp
-index 8590dd75..024854d6 100644
--- a/UI/window-basic-main.cpp
-+++ b/UI/window-basic-main.cpp
-@@ -2916,13 +2916,15 @@ void OBSBasic::closeEvent(QCloseEvent *event)
-
- void OBSBasic::changeEvent(QEvent *event)
- {
-	if (event->type() == QEvent::WindowStateChange &&
-	    isMinimized() &&
-	    trayIcon->isVisible() &&
-	    sysTrayMinimizeToTray()) {
-
-		ToggleShowHide();
-	}
-+  if (trayIcon) {
-+	  if (event->type() == QEvent::WindowStateChange &&
-+	      isMinimized() &&
-+	      trayIcon->isVisible() &&
-+	      sysTrayMinimizeToTray()) {
-+
-+	  	ToggleShowHide();
-+	  }
-+  }
- }
-
- void OBSBasic::on_actionShow_Recordings_triggered()
--
-2.12.0
--- a/pkgs/applications/window-managers/awesome/default.nix
+++ b/pkgs/applications/window-managers/awesome/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, luaPackages, cairo, cmake, imagemagick, pkgconfig, gdk_pixbuf
+{ stdenv, fetchurl, fetchFromGitHub, luaPackages, cairo, cmake, imagemagick, pkgconfig, gdk_pixbuf
 , xorg, libstartup_notification, libxdg_basedir, libpthreadstubs
 , xcb-util-cursor, makeWrapper, pango, gobjectIntrospection, unclutter
 , compton, procps, iproute, coreutils, curl, alsaUtils, findutils, xterm
@ -38,6 +38,13 @@ with luaPackages; stdenv.mkDerivation rec {
                  xorg.xcbutilrenderutil xorg.xcbutilwm libxkbcommon
                  xcbutilxrm ];

+  patches = [
+    (fetchurl {
+      url = "https://patch-diff.githubusercontent.com/raw/awesomeWM/awesome/pull/1639.patch";
+      sha256 = "00piynmbxajd2xbg960gmf0zlqn7m489f4ww482y49ravfy1jhsj";
+    })
+  ];
+
  #cmakeFlags = "-DGENERATE_MANPAGES=ON";

  LD_LIBRARY_PATH = "${stdenv.lib.makeLibraryPath [ cairo pango gobjectIntrospection ]}";
--- a/pkgs/build-support/emacs/buffer.nix
+++ b/pkgs/build-support/emacs/buffer.nix
@ -39,6 +39,8 @@
      (make-local-variable 'process-environment)
      (put 'process-environment 'permanent-local t)
      (inherit-local 'process-environment)
+      ; setenv modifies in place, so copy the environment first
+      (setq process-environment (copy-tree process-environment))
      (setenv "PATH" (concat "${lib.makeSearchPath "bin" pkgs}:" (getenv "PATH")))
      (inherit-local-permanent exec-path (append '(${builtins.concatStringsSep " " (map (p: "\"${p}/bin\"") pkgs)}) exec-path))

--- a/pkgs/build-support/fetchrepoproject/default.nix
+++ b/pkgs/build-support/fetchrepoproject/default.nix
@ -27,13 +27,23 @@ let

 in

-stdenv.mkDerivation {
+with stdenv.lib;

+let
+  extraRepoInitFlags = [
+    (optionalString (repoRepoURL != "") "--repo-url=${repoRepoURL}")
+    (optionalString (repoRepoRev != "") "--repo-branch=${repoRepoRev}")
+    (optionalString (referenceDir != "") "--reference=${referenceDir}")
+  ];
+in
+
+stdenv.mkDerivation {
  buildCommand = ''
    mkdir .repo
    ${optionalString (local_manifests != []) ''
    mkdir ./.repo/local_manifests
    for local_manifest in ${concatMapStringsSep " " toString local_manifests}
+
    do
      cp $local_manifest ./.repo/local_manifests/$(stripHash $local_manifest; echo $strippedName)
    done
--- a/pkgs/build-support/kde/wrapper.nix
+++ b/pkgs/build-support/kde/wrapper.nix
@ -1,4 +1,4 @@
-{ stdenv, lib, makeWrapper, buildEnv }:
+{ stdenv, lib, makeWrapper, buildEnv, gtk3, dconf }:

 packages:

@ -47,10 +47,11 @@ stdenv.mkDerivation {
                    --argv0 '"$0"' \
                    --suffix PATH : "$env/bin" \
                    --prefix XDG_CONFIG_DIRS : "$env/etc/xdg" \
-                    --prefix XDG_DATA_DIRS : "$env/share" \
+                    --prefix XDG_DATA_DIRS : "$env/share:${gtk3}/share/gsettings-schemas/${gtk3.name}" \
                    --set QML_IMPORT_PATH "$env/lib/qt5/imports" \
                    --set QML2_IMPORT_PATH "$env/lib/qt5/qml" \
-                    --set QT_PLUGIN_PATH "$env/lib/qt5/plugins"
+                    --set QT_PLUGIN_PATH "$env/lib/qt5/plugins" \
+                    --prefix GIO_EXTRA_MODULES : "${dconf.lib}/lib/gio/modules"
                good="1"
                break
            fi
--- a/pkgs/build-support/setup-systemd-units.nix
+++ b/pkgs/build-support/setup-systemd-units.nix
@ -0,0 +1,83 @@
+# | Build a script to install and start a set of systemd units on any
+# systemd-based system.
+#
+# Creates a symlink at /etc/systemd-static/${namespace} for slightly
+# improved atomicity.
+{ writeScriptBin
+, bash
+, coreutils
+, systemd
+, runCommand
+, lib
+}:
+  { units     # : AttrSet String (Either Path { path : Path, wanted-by : [ String ] })
+              # ^ A set whose names are unit names and values are
+              # either paths to the corresponding unit files or a set
+              # containing the path and the list of units this unit
+              # should be wanted-by (none by default).
+              #
+              # The names should include the unit suffix
+              # (e.g. ".service")
+  , namespace # : String
+              # The namespace for the unit files, to allow for
+              # multiple independent unit sets managed by
+              # `setupSystemdUnits`.
+  }:
+    let static = runCommand "systemd-static" {}
+          ''
+            mkdir -p $out
+            ${lib.concatStringsSep "\n" (lib.mapAttrsToList (nm: file:
+                "ln -sv ${file.path or file} $out/${nm}"
+             ) units)}
+          '';
+        add-unit-snippet = name: file:
+          ''
+            oldUnit=$(readlink -f "$unitDir/${name}" || echo "$unitDir/${name}")
+            if [ -f "$oldUnit" -a "$oldUnit" != "${file.path or file}" ]; then
+              unitsToStop+=("${name}")
+            fi
+            ln -sf "/etc/systemd-static/${namespace}/${name}" \
+              "$unitDir/.${name}.tmp"
+            mv -T "$unitDir/.${name}.tmp" "$unitDir/${name}"
+            ${lib.concatStringsSep "\n" (map (unit:
+                ''
+                  mkdir -p "$unitDir/${unit}.wants"
+                  ln -sf "../${name}" \
+                    "$unitDir/${unit}.wants/.${name}.tmp"
+                  mv -T "$unitDir/${unit}.wants/.${name}.tmp" \
+                    "$unitDir/${unit}.wants/${name}"
+                ''
+              ) file.wanted-by or [])}
+            unitsToStart+=("${name}")
+          '';
+    in
+      writeScriptBin "setup-systemd-units"
+        ''
+          #!${bash}/bin/bash -e
+          export PATH=${coreutils}/bin:${systemd}/bin
+
+          unitDir=/etc/systemd/system
+          if [ ! -w "$unitDir" ]; then
+            unitDir=/etc/systemd-mutable/system
+            mkdir -p "$unitDir"
+          fi
+          declare -a unitsToStop unitsToStart
+
+          oldStatic=$(readlink -f /etc/systemd-static/${namespace} || true)
+          if [ "$oldStatic" != "${static}" ]; then
+            ${lib.concatStringsSep "\n"
+                (lib.mapAttrsToList add-unit-snippet units)}
+            if [ ''${#unitsToStop[@]} -ne 0 ]; then
+              echo "Stopping unit(s) ''${unitsToStop[@]}" >&2
+              systemctl stop "''${unitsToStop[@]}"
+            fi
+            mkdir -p /etc/systemd-static
+            ln -sfT ${static} /etc/systemd-static/.${namespace}.tmp
+            mv -T /etc/systemd-static/.${namespace}.tmp /etc/systemd-static/${namespace}
+            systemctl daemon-reload
+            echo "Starting unit(s) ''${unitsToStart[@]}" >&2
+            systemctl start "''${unitsToStart[@]}"
+          else
+            echo "Units unchanged, doing nothing" >&2
+          fi
+        ''
--- a/pkgs/data/fonts/fontconfig-penultimate/default.nix
+++ b/pkgs/data/fonts/fontconfig-penultimate/default.nix
@ -0,0 +1,26 @@
+{ stdenv, fetchFromGitHub }:
+
+let version = "0.2.1"; in
+stdenv.mkDerivation {
+  name = "fontconfig-penultimate-${version}";
+
+  src = fetchFromGitHub {
+    owner = "ttuegel";
+    repo = "fontconfig-penultimate";
+    rev = version;
+    sha256 = "14arpalmpn7ig2myxslk4jdg6lm0cnmwsxy7zl0j7yr417k1kprf";
+  };
+
+  installPhase = ''
+    mkdir -p $out/etc/fonts/conf.d
+    cp *.conf $out/etc/fonts/conf.d
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/ttuegel/fontconfig-penultimate;
+    description = "Sensible defaults for Fontconfig";
+    license = licenses.asl20;
+    maintainers = [ maintainers.ttuegel ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/desktops/gnome-3/3.22/core/dconf/default.nix
+++ b/pkgs/desktops/gnome-3/3.22/core/dconf/default.nix
@ -13,6 +13,8 @@ stdenv.mkDerivation rec {
    sha256 = "1jaqsr1r0grpd25rbsc2v3vb0sc51lia9w31wlqswgqsncp2k0w6";
  };

+  outputs = [ "out" "lib" "dev" ];
+
  buildInputs = [ vala_0_32 libxslt pkgconfig glib dbus_glib gnome3.gtk libxml2
                  intltool docbook_xsl docbook_xsl_ns makeWrapper ];

--- a/pkgs/desktops/gnome-3/3.22/core/gdm/default.nix
+++ b/pkgs/desktops/gnome-3/3.22/core/gdm/default.nix
@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
  enableParallelBuilding = true;

  # Disable Access Control because our X does not support FamilyServerInterpreted yet
-  patches = [ #./xserver_path.patch # gdm now uses wayland
+  patches = [ ./xserver_path.patch
              ./sessions_dir.patch
              ./gdm-x-session_extra_args.patch
              ./gdm-session-worker_xserver-path.patch
--- a/pkgs/desktops/gnome-3/3.22/core/zenity/default.nix
+++ b/pkgs/desktops/gnome-3/3.22/core/zenity/default.nix
@ -1,5 +1,5 @@
 { stdenv, fetchurl, pkgconfig, cairo, libxml2, libxslt, gnome3, pango
-, gnome_doc_utils, intltool, libX11, which, itstool }:
+, gnome_doc_utils, intltool, libX11, which, itstool, wrapGAppsHook }:

 stdenv.mkDerivation rec {
  inherit (import ./src.nix fetchurl) name src;
@ -10,7 +10,7 @@ stdenv.mkDerivation rec {

  buildInputs = [ gnome3.gtk libxml2 libxslt libX11 itstool ];

-  nativeBuildInputs = [ pkgconfig intltool gnome_doc_utils which ];
+  nativeBuildInputs = [ pkgconfig intltool gnome_doc_utils which wrapGAppsHook ];

  meta = with stdenv.lib; {
    platforms = platforms.linux;
--- a/pkgs/desktops/plasma-5/fetch.sh
+++ b/pkgs/desktops/plasma-5/fetch.sh
@ -1 +1 @@
-WGET_ARGS=( http://download.kde.org/stable/plasma/5.9.3/ -A '*.tar.xz' )
+WGET_ARGS=( http://download.kde.org/stable/plasma/5.9.4/ -A '*.tar.xz' )
--- a/pkgs/desktops/plasma-5/srcs.nix
+++ b/pkgs/desktops/plasma-5/srcs.nix
@ -3,323 +3,323 @@

 {
  bluedevil = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/bluedevil-5.9.3.tar.xz";
-      sha256 = "0cfk0khcd62ficsmpxhiqwfdgwzv771ndlf0s7b8ghqqyckq6bld";
-      name = "bluedevil-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/bluedevil-5.9.4.tar.xz";
+      sha256 = "1a31vsaiy7kzbw79kjiia5a966xc9ba3phxhyqmdzvllf9jw5xdc";
+      name = "bluedevil-5.9.4.tar.xz";
    };
  };
  breeze = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/breeze-5.9.3.tar.xz";
-      sha256 = "0f1h7ky9chsnbm8r85lwipc1sh7kb32jdaj3wl9qd7k0q4j115x0";
-      name = "breeze-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/breeze-5.9.4.tar.xz";
+      sha256 = "07i13g9iyq9j2vx22z7krnkahil3qljxpzgmqai8m67gwhgvn1zj";
+      name = "breeze-5.9.4.tar.xz";
    };
  };
  breeze-grub = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/breeze-grub-5.9.3.tar.xz";
-      sha256 = "1hbvmyj1f5f8v0pc70w93ck27xw25m4x70vnbhgqi91y5dd1gh49";
-      name = "breeze-grub-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/breeze-grub-5.9.4.tar.xz";
+      sha256 = "0rn7dgmw495575lcsnlgvx8r8sjjaaw3b1s0l43d2r186zay0nkr";
+      name = "breeze-grub-5.9.4.tar.xz";
    };
  };
  breeze-gtk = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/breeze-gtk-5.9.3.tar.xz";
-      sha256 = "12qa4wllgr52ycdprlxq0h4pgykbbs0vbmmmiardpzlrplm0an26";
-      name = "breeze-gtk-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/breeze-gtk-5.9.4.tar.xz";
+      sha256 = "1xjrhi6cq5dd5qslphdjrg018ni1z9xdac7cg33wl8bsvzcl0xgl";
+      name = "breeze-gtk-5.9.4.tar.xz";
    };
  };
  breeze-plymouth = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/breeze-plymouth-5.9.3.tar.xz";
-      sha256 = "0vz0hgx3hl03h4rkfrcaydaddljam3jbg6gd7n600a068p74s2mm";
-      name = "breeze-plymouth-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/breeze-plymouth-5.9.4.tar.xz";
+      sha256 = "1vwlvnbsc67xzqvrpgkva1rlim075x9ffjlsxfk38gmq00b7s88g";
+      name = "breeze-plymouth-5.9.4.tar.xz";
    };
  };
  discover = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/discover-5.9.3.tar.xz";
-      sha256 = "0xkf08k4jz5ym406bpnjf3xsx0il9wka4jp2k38bkl3sxh2s900f";
-      name = "discover-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/discover-5.9.4.tar.xz";
+      sha256 = "1pf2qawa32x94ljqscfbpmkbxk5awlqbf9jw9w7rfqwd5z9cgzzf";
+      name = "discover-5.9.4.tar.xz";
    };
  };
  kactivitymanagerd = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/kactivitymanagerd-5.9.3.tar.xz";
-      sha256 = "0ywby3ijq4hjljy5qwd7rybpk2x4scairjffiy5n1jg7lq6sm44r";
-      name = "kactivitymanagerd-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/kactivitymanagerd-5.9.4.tar.xz";
+      sha256 = "04i4zmbblsx3xz3vq4m88qd3ky0r5v26ivjchzpcpgkczqv85x1j";
+      name = "kactivitymanagerd-5.9.4.tar.xz";
    };
  };
  kde-cli-tools = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/kde-cli-tools-5.9.3.tar.xz";
-      sha256 = "1p9zjp9jmknyh82d6av3xhy461fsdppjxrxbmrlm9z6nsjyp0m0a";
-      name = "kde-cli-tools-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/kde-cli-tools-5.9.4.tar.xz";
+      sha256 = "1a2ssv7mphqnzwphd8nkh0g0g4w9b2r0ah0a9wd5ssnr5xg3izm8";
+      name = "kde-cli-tools-5.9.4.tar.xz";
    };
  };
  kdecoration = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/kdecoration-5.9.3.tar.xz";
-      sha256 = "1z37llaqf9mrb4aif75dfvbhr51rrgfpncv70v916jddcf90q4i9";
-      name = "kdecoration-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/kdecoration-5.9.4.tar.xz";
+      sha256 = "12cfp4svhxfygbjhymnmwyryx6r117mkdy2iq9adbq5af3gak972";
+      name = "kdecoration-5.9.4.tar.xz";
    };
  };
  kde-gtk-config = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/kde-gtk-config-5.9.3.tar.xz";
-      sha256 = "1wxk3brwq105258ndx5l98n78q2h2idigkpp5s2xzmzw05m3gg6r";
-      name = "kde-gtk-config-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/kde-gtk-config-5.9.4.tar.xz";
+      sha256 = "0cg3myr3jr9i4vxpqbd8gs7yrscxn15a96zqvgsbjczlfmxanq86";
+      name = "kde-gtk-config-5.9.4.tar.xz";
    };
  };
  kdeplasma-addons = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/kdeplasma-addons-5.9.3.tar.xz";
-      sha256 = "1k3fsrafrd72qymyi2ij36al7k92mnssz90kmmh830pszif16js3";
-      name = "kdeplasma-addons-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/kdeplasma-addons-5.9.4.tar.xz";
+      sha256 = "019d3d3pkw1c6l7dggasr7g7yj9kl3xd2hsawch1s9ba420fd6fp";
+      name = "kdeplasma-addons-5.9.4.tar.xz";
    };
  };
  kgamma5 = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/kgamma5-5.9.3.tar.xz";
-      sha256 = "02s3j1c5gjcv7b79448sizs6hdw91jysq9prkzznprw6jbb615v1";
-      name = "kgamma5-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/kgamma5-5.9.4.tar.xz";
+      sha256 = "0qwgjdrjfc48d8j62iwz6d61nxd7ddcsxn7wmxgbgl3l36p5j0jv";
+      name = "kgamma5-5.9.4.tar.xz";
    };
  };
  khotkeys = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/khotkeys-5.9.3.tar.xz";
-      sha256 = "0jv77rpx01cl15qf9vzndpks2q2lgq8dhjq4pg34zh8khr03snlf";
-      name = "khotkeys-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/khotkeys-5.9.4.tar.xz";
+      sha256 = "0lhgkvnrzsxpw6vpn0xam1a4dgkfb0k9h3nchaf93fyl8745j4q0";
+      name = "khotkeys-5.9.4.tar.xz";
    };
  };
  kinfocenter = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/kinfocenter-5.9.3.tar.xz";
-      sha256 = "14zaqrjf77008dc5c071hw75vd4dwvvmgkyz74vhs94i7bspzy6a";
-      name = "kinfocenter-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/kinfocenter-5.9.4.tar.xz";
+      sha256 = "14vf27s501r6ac2gxashwi3ynlcncjp03rahz61wry1dsm9wsc4x";
+      name = "kinfocenter-5.9.4.tar.xz";
    };
  };
  kmenuedit = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/kmenuedit-5.9.3.tar.xz";
-      sha256 = "1m7naiy6jq031psdx4jsxq7vsldn9j4girq820m24inh2ky105zk";
-      name = "kmenuedit-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/kmenuedit-5.9.4.tar.xz";
+      sha256 = "1lx7g67qc7amx8jsna7b13hhq85pv4969d9824qfciwywj19sx4x";
+      name = "kmenuedit-5.9.4.tar.xz";
    };
  };
  kscreen = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/kscreen-5.9.3.tar.xz";
-      sha256 = "1z3cihgjqrkg5h4y4gm1ah60r0vfpxrngry10fcc6343arbyk1bb";
-      name = "kscreen-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/kscreen-5.9.4.tar.xz";
+      sha256 = "1g4i4rwnmni3q3crbywkp0s199bp0bl8cx97d37cp9qh6drsgrxx";
+      name = "kscreen-5.9.4.tar.xz";
    };
  };
  kscreenlocker = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/kscreenlocker-5.9.3.tar.xz";
-      sha256 = "0ccpgfp1gz07yiw98sqjlc097cac4z9qdcrwxm65bvqjj777by1a";
-      name = "kscreenlocker-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/kscreenlocker-5.9.4.tar.xz";
+      sha256 = "0cn194bmab7qgv1x7gg81l0mj3k9x1is9whn8h7g02pzn5c6gqlj";
+      name = "kscreenlocker-5.9.4.tar.xz";
    };
  };
  ksshaskpass = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/ksshaskpass-5.9.3.tar.xz";
-      sha256 = "0jk6k5bn2aqjjl3li5qpmihk57d5hc197cpqjaj61a0bapab42hw";
-      name = "ksshaskpass-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/ksshaskpass-5.9.4.tar.xz";
+      sha256 = "1w1m55i8i9f3npcczqiy1knarbh2j4cp8ispif1s4j6k3vixqnka";
+      name = "ksshaskpass-5.9.4.tar.xz";
    };
  };
  ksysguard = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/ksysguard-5.9.3.tar.xz";
-      sha256 = "0paypcwah41p2ygmfwzhw8mdfh47a6x0190yngxn8j0jhzfyllca";
-      name = "ksysguard-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/ksysguard-5.9.4.tar.xz";
+      sha256 = "04hzqkna22vsa12z04cy50s2jzglllfhd5vz33vk2wj6zgghwd0h";
+      name = "ksysguard-5.9.4.tar.xz";
    };
  };
  kwallet-pam = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/kwallet-pam-5.9.3.tar.xz";
-      sha256 = "1pmsfp6pn1r3crg5z5v7sz413v9qvn0j4n9l88zbw538lz2scpna";
-      name = "kwallet-pam-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/kwallet-pam-5.9.4.tar.xz";
+      sha256 = "0l6ganmp2ml0icfkrqcq4vngm8f4pl76p6w13a3m8x2k2wrsbynw";
+      name = "kwallet-pam-5.9.4.tar.xz";
    };
  };
  kwayland-integration = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/kwayland-integration-5.9.3.tar.xz";
-      sha256 = "1r3cryv10lkvl1nrpq21w4kj9jd270m3p3dw07d888b891rgmzb7";
-      name = "kwayland-integration-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/kwayland-integration-5.9.4.tar.xz";
+      sha256 = "11vqi293azv5cpz2rrngxsqqaj7swcmxivgm688yz6wzbm8gyd1x";
+      name = "kwayland-integration-5.9.4.tar.xz";
    };
  };
  kwin = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/kwin-5.9.3.tar.xz";
-      sha256 = "119cy472x5ssrr54v14pbs85gfrsjhz99ms8flb1xp38jb14xxhk";
-      name = "kwin-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/kwin-5.9.4.tar.xz";
+      sha256 = "0qckhk6vd31mwhawb0i636l4vx99v0v84nam2dhpd0rcdk2b0dm1";
+      name = "kwin-5.9.4.tar.xz";
    };
  };
  kwrited = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/kwrited-5.9.3.tar.xz";
-      sha256 = "0liqspd4m6xly48vv85abnaxfvsjcbgg58843j9fpnzkk9nlj98q";
-      name = "kwrited-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/kwrited-5.9.4.tar.xz";
+      sha256 = "1prbn0f6a1cywn2ivzv39bxfc5nxmgxp7gqlxqg87ajig43gvdb7";
+      name = "kwrited-5.9.4.tar.xz";
    };
  };
  libkscreen = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/libkscreen-5.9.3.tar.xz";
-      sha256 = "1nxhbxmr0kmyp745bf3vd21xcjpv7jac9bdagraiqfcmwj4f86gb";
-      name = "libkscreen-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/libkscreen-5.9.4.tar.xz";
+      sha256 = "1h39910ry59wd179fk02ck10ydaby3il4q3rnxlnn9qph0kiy3pv";
+      name = "libkscreen-5.9.4.tar.xz";
    };
  };
  libksysguard = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/libksysguard-5.9.3.tar.xz";
-      sha256 = "0fj7rycawarg7iydml0xw20nkyxlwa2nl5chxbbcs5mnmvpfv6ig";
-      name = "libksysguard-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/libksysguard-5.9.4.tar.xz";
+      sha256 = "1gpfqr8prk96vwy9dkxlgf4lc3ck04a31src9mix8a6wrr01ppqm";
+      name = "libksysguard-5.9.4.tar.xz";
    };
  };
  milou = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/milou-5.9.3.tar.xz";
-      sha256 = "1pmk9czmpz0mfqmkv7gl9wdlj8b7wwixv1zb43q24a471qby2xf3";
-      name = "milou-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/milou-5.9.4.tar.xz";
+      sha256 = "18xzx99ml6gcglly9p98rscs6dxhdgn9pkc5mn7apwnp7865kbfw";
+      name = "milou-5.9.4.tar.xz";
    };
  };
  oxygen = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/oxygen-5.9.3.tar.xz";
-      sha256 = "1v529wp9ll1hzb48xswigzf2r23k84f4cd7am2fnj73p3a0rg5ia";
-      name = "oxygen-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/oxygen-5.9.4.tar.xz";
+      sha256 = "0fmysq3j0v18hz6hfp7qgrj3ghmaf3c1gam9c9263sf9q1dghk0q";
+      name = "oxygen-5.9.4.tar.xz";
    };
  };
  plasma-desktop = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/plasma-desktop-5.9.3.tar.xz";
-      sha256 = "0582n21nd15834mxc54pq1nx9a5z8ds3yz0x0lc5m35ps7abh7im";
-      name = "plasma-desktop-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/plasma-desktop-5.9.4.tar.xz";
+      sha256 = "1p3iq5rmfznsi4174zjavs945wysf763ha46vd83mz0w7583j6cd";
+      name = "plasma-desktop-5.9.4.tar.xz";
    };
  };
  plasma-integration = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/plasma-integration-5.9.3.tar.xz";
-      sha256 = "1yq3i0sqsn0m2y62npyad1nv17hgc0fm35cfq5fdjd96sr356znl";
-      name = "plasma-integration-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/plasma-integration-5.9.4.tar.xz";
+      sha256 = "1mk59p214184m2q8wfik8gkfxxikrvric0v8c09lamybg15pas8m";
+      name = "plasma-integration-5.9.4.tar.xz";
    };
  };
  plasma-nm = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/plasma-nm-5.9.3.tar.xz";
-      sha256 = "1i5djnbimkwcbjh6bi0cdw98qskli4jd1c8a8dbwqqh5pyqbrf66";
-      name = "plasma-nm-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/plasma-nm-5.9.4.tar.xz";
+      sha256 = "0sbvyyhx7gxg1li5y1h7jv1s3krp2ch6zzhm9ad1l17w589kij9x";
+      name = "plasma-nm-5.9.4.tar.xz";
    };
  };
  plasma-pa = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/plasma-pa-5.9.3.tar.xz";
-      sha256 = "0br83bnm6g7lzw4hwkppk8l6scbzblr3m3mi64a852lnxxvdwn01";
-      name = "plasma-pa-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/plasma-pa-5.9.4.tar.xz";
+      sha256 = "0hincgm6x613sw3mywq64i27laahqzy7qjiv24g8h3ppw75a32i8";
+      name = "plasma-pa-5.9.4.tar.xz";
    };
  };
  plasma-sdk = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/plasma-sdk-5.9.3.tar.xz";
-      sha256 = "104rhybchdjqnglzp3bpjv8052n2gi44bn58nyb6wz6gkzg3xzrb";
-      name = "plasma-sdk-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/plasma-sdk-5.9.4.tar.xz";
+      sha256 = "0nw49kaw7323dmaq8hh4zrhvy6ga6svg2g0zhxj0cjjwgbk31pfw";
+      name = "plasma-sdk-5.9.4.tar.xz";
    };
  };
  plasma-tests = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/plasma-tests-5.9.3.tar.xz";
-      sha256 = "1wpbfna9yjvzc5fhgnw2hwnq04vzb3qfy42zrwbijy8sl6csgzzp";
-      name = "plasma-tests-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/plasma-tests-5.9.4.tar.xz";
+      sha256 = "0m6dlx29785kh1pxm0xyym85k475s8gdjds6ywgpblj9lh5rm4v5";
+      name = "plasma-tests-5.9.4.tar.xz";
    };
  };
  plasma-workspace = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/plasma-workspace-5.9.3.tar.xz";
-      sha256 = "0lnb36qnkw5z7w1y5ykiz6xfhc4h21dzlbhddipvd97bxycad6vg";
-      name = "plasma-workspace-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/plasma-workspace-5.9.4.tar.xz";
+      sha256 = "0pazgn45a445wknd3xp7jnsg6k5ddqv4pjrz2ggkbaz9mrllgbqm";
+      name = "plasma-workspace-5.9.4.tar.xz";
    };
  };
  plasma-workspace-wallpapers = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/plasma-workspace-wallpapers-5.9.3.tar.xz";
-      sha256 = "1ikjj41nn5hn9r3glfhqsizawhkpw3cvybqq0ym4zky9lvbxzxb0";
-      name = "plasma-workspace-wallpapers-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/plasma-workspace-wallpapers-5.9.4.tar.xz";
+      sha256 = "0jngl7a86xr09g87iydw8fi4ggh6hmz5vaznx4xqh403xf9pl281";
+      name = "plasma-workspace-wallpapers-5.9.4.tar.xz";
    };
  };
  polkit-kde-agent = {
-    version = "1-5.9.3";
+    version = "1-5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/polkit-kde-agent-1-5.9.3.tar.xz";
-      sha256 = "0kfafag3bqp03aaa5dn7f8mkc174s80mwn98linl1dn12np2wv2q";
-      name = "polkit-kde-agent-1-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/polkit-kde-agent-1-5.9.4.tar.xz";
+      sha256 = "10x3vgdjkvzmnv5zl65q0mj6gxlcl620kyva1cx3qhq93w68jfjc";
+      name = "polkit-kde-agent-1-5.9.4.tar.xz";
    };
  };
  powerdevil = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/powerdevil-5.9.3.tar.xz";
-      sha256 = "1sphmngckfns5sx0n95njf39m02fg3q7bdafwrw8i4lv2svb1axj";
-      name = "powerdevil-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/powerdevil-5.9.4.tar.xz";
+      sha256 = "1fpp06criw51lpg21f3xm4gd9yzjj08lr5j8908qz2dywqlp91rv";
+      name = "powerdevil-5.9.4.tar.xz";
    };
  };
  sddm-kcm = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/sddm-kcm-5.9.3.tar.xz";
-      sha256 = "142na2cnx5v459798fq6gx30k9v0i10myfyvgv562n1x79nbkyl0";
-      name = "sddm-kcm-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/sddm-kcm-5.9.4.tar.xz";
+      sha256 = "1zrda4vzvqh6vs93yl2g4b63siqb5cqhrp4kknzm571djiar26ll";
+      name = "sddm-kcm-5.9.4.tar.xz";
    };
  };
  systemsettings = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/systemsettings-5.9.3.tar.xz";
-      sha256 = "15ihvbkp91dz1z1z5dqgqyziiklzq2zkl3ns8dqzs3pbpki7jbqc";
-      name = "systemsettings-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/systemsettings-5.9.4.tar.xz";
+      sha256 = "03h5dagghjg6qhjbf0fnlhwh2v1nh7w22g00g1qzi8yrads1icy1";
+      name = "systemsettings-5.9.4.tar.xz";
    };
  };
  user-manager = {
-    version = "5.9.3";
+    version = "5.9.4";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.9.3/user-manager-5.9.3.tar.xz";
-      sha256 = "1s91zgh1rcqrpyh9fiklwqj2m78ify5fv83kh9zvyl4bapgyb0gn";
-      name = "user-manager-5.9.3.tar.xz";
+      url = "${mirror}/stable/plasma/5.9.4/user-manager-5.9.4.tar.xz";
+      sha256 = "1cjwkxb5qzj8sbkhcyyzw1axzddb2pwbd16wmaqpiz9qh2k4mr64";
+      name = "user-manager-5.9.4.tar.xz";
    };
  };
 }
--- a/pkgs/development/compilers/ghcjs/head.nix
+++ b/pkgs/development/compilers/ghcjs/head.nix
@ -1,22 +1,26 @@
 { fetchgit, fetchFromGitHub, bootPkgs }:

 bootPkgs.callPackage ./base.nix {
-  version = "0.2.020161101";
+  version = "0.2.020170323";

  # deprecated on HEAD, directly included in the distribution
  ghcjs-prim = null;
  inherit bootPkgs;

  ghcjsSrc = fetchFromGitHub {
-    owner = "ghcjs";
+    # TODO: switch back to the regular ghcjs repo
+    # when https://github.com/ghcjs/ghcjs/pull/573 is merged.
+    owner = "basvandijk";
    repo = "ghcjs";
-    rev = "2dc14802e78d7d9dfa35395d5dbfc9c708fb83e6";
-    sha256 = "0cvmapbrwg0h1pbz648isc2l84z694ylnfm8ncd1g4as28lmj0pz";
+    rev = "e6cdc71964a1c2e4184416a493e9d384c408914c";
+    sha256 = "00fk9qwyx4vpvr0h9jbqxwlrvl6w63l5sq8r357prsp6xyv5zniz";
  };
  ghcjsBootSrc = fetchgit {
-    url = git://github.com/ghcjs/ghcjs-boot.git;
-    rev = "b000a4f4619b850bf3f9a45c9058f7a51e7709c8";
-    sha256 = "164v0xf33r6mnympp6s70v8j6g7ccyg7z95gjp43bq150ppvisbq";
+    # TODO: switch back to git://github.com/ghcjs/ghcjs-boot.git
+    # when https://github.com/ghcjs/ghcjs-boot/pull/41 is merged.
+    url = git://github.com/basvandijk/ghcjs-boot.git;
+    rev = "19a3b157ecb807c2224daffda5baecc92b76af35";
+    sha256 = "16sgr8vfr1nx5ljnk8gckgjk70zpa67ix4dbr9aizkwyz41ilfrb";
    fetchSubmodules = true;
  };

--- a/pkgs/development/compilers/ghcjs/head_stage2.nix
+++ b/pkgs/development/compilers/ghcjs/head_stage2.nix
@ -2,107 +2,117 @@

 {
  async = callPackage
-    ({ mkDerivation, base, HUnit, stdenv, stm, test-framework
-      , test-framework-hunit
-      }:
-      mkDerivation {
-        pname = "async";
-        version = "2.1.0";
-        src = "${ghcjsBoot}/boot/async";
-        doCheck = false;
-        libraryHaskellDepends = [ base stm ];
-        testHaskellDepends = [
-          base HUnit test-framework test-framework-hunit
-        ];
-        jailbreak = true;
-        homepage = "https://github.com/simonmar/async";
-        description = "Run IO operations asynchronously and wait for their results";
-        license = stdenv.lib.licenses.bsd3;
-      }) {};
+    ({ mkDerivation, base, HUnit, stm, test-framework
+     , test-framework-hunit, stdenv
+     }:
+     mkDerivation {
+       pname = "async";
+       version = "2.1.1";
+       src = "${ghcjsBoot}/boot/async";
+       doCheck = false;
+       libraryHaskellDepends = [ base stm ];
+       testHaskellDepends = [
+         base HUnit test-framework test-framework-hunit
+       ];
+       jailbreak = true;
+       homepage = "https://github.com/simonmar/async";
+       description = "Run IO operations asynchronously and wait for their results";
+       license = stdenv.lib.licenses.bsd3;
+     }) {};
  aeson = callPackage
-    ({ mkDerivation, attoparsec, base, bytestring, containers, deepseq
-      , dlist, fail, ghc-prim, hashable, HUnit, mtl, QuickCheck, scientific
-      , stdenv, syb, tagged, template-haskell, test-framework
-      , test-framework-hunit, test-framework-quickcheck2, text, time
-      , transformers, unordered-containers, vector
-      }:
-      mkDerivation {
-        pname = "aeson";
-        version = "0.11.2.0";
-        src = "${ghcjsBoot}/boot/aeson";
-        doCheck = false;
-        libraryHaskellDepends = [
-          attoparsec base bytestring containers deepseq dlist fail ghc-prim
-          hashable mtl scientific syb tagged template-haskell text time transformers
-          unordered-containers vector
-        ];
-        testHaskellDepends = [
-          attoparsec base bytestring containers ghc-prim HUnit QuickCheck
-          template-haskell test-framework test-framework-hunit
-          test-framework-quickcheck2 text time unordered-containers vector
-        ];
-        jailbreak = true;
-        homepage = "https://github.com/bos/aeson";
-        description = "Fast JSON parsing and encoding";
-        license = stdenv.lib.licenses.bsd3;
-      }) {};
+    ({ mkDerivation, attoparsec, base, base-compat, base-orphans
+     , base16-bytestring, bytestring, containers, deepseq, directory
+     , dlist, fetchgit, filepath, generic-deriving, ghc-prim, hashable
+     , hashable-time, HUnit, integer-logarithms, QuickCheck
+     , quickcheck-instances, scientific, stdenv, tagged
+     , template-haskell, test-framework, test-framework-hunit
+     , test-framework-quickcheck2, text, time, time-locale-compat
+     , unordered-containers, uuid-types, vector
+     }:
+     mkDerivation {
+       pname = "aeson";
+       version = "1.1.1.0";
+       src = "${ghcjsBoot}/boot/aeson";
+       libraryHaskellDepends = [
+         attoparsec base base-compat bytestring containers deepseq dlist
+         ghc-prim hashable scientific tagged template-haskell text time
+         time-locale-compat unordered-containers uuid-types vector
+       ];
+       testHaskellDepends = [
+         attoparsec base base-compat base-orphans base16-bytestring
+         bytestring containers directory dlist filepath generic-deriving
+         ghc-prim hashable hashable-time HUnit integer-logarithms QuickCheck
+         quickcheck-instances scientific tagged template-haskell
+         test-framework test-framework-hunit test-framework-quickcheck2 text
+         time time-locale-compat unordered-containers uuid-types vector
+       ];
+       jailbreak = true;
+       homepage = "https://github.com/bos/aeson";
+       description = "Fast JSON parsing and encoding";
+       license = stdenv.lib.licenses.bsd3;
+     }) {};
  attoparsec = callPackage
-    ({ mkDerivation, array, base, bytestring, containers, deepseq
-      , QuickCheck, quickcheck-unicode, scientific, stdenv
-      , test-framework, test-framework-quickcheck2, text, transformers
-      , vector
-      }:
-      mkDerivation {
-        pname = "attoparsec";
-        version = "0.13.0.2";
-        src = "${ghcjsBoot}/boot/attoparsec";
-        doCheck = false;
-        libraryHaskellDepends = [
-          array base bytestring containers deepseq scientific text
-          transformers
-        ];
-        testHaskellDepends = [
-          array base bytestring containers deepseq QuickCheck
-          quickcheck-unicode scientific test-framework
-          test-framework-quickcheck2 text transformers vector
-        ];
-        jailbreak = true;
-        homepage = "https://github.com/bos/attoparsec";
-        description = "Fast combinator parsing for bytestrings and text";
-        license = stdenv.lib.licenses.bsd3;
-      }) {};
+    ({ mkDerivation, array, base, bytestring, case-insensitive
+     , containers, criterion, deepseq, directory, filepath, ghc-prim
+     , http-types, parsec, QuickCheck, quickcheck-unicode, scientific
+     , tasty, tasty-quickcheck, text, transformers, unordered-containers
+     , vector, stdenv
+     }:
+     mkDerivation {
+       pname = "attoparsec";
+       version = "0.13.1.0";
+       src = "${ghcjsBoot}/boot/attoparsec";
+       libraryHaskellDepends = [
+         array base bytestring containers deepseq scientific text
+         transformers
+       ];
+       testHaskellDepends = [
+         array base bytestring deepseq QuickCheck quickcheck-unicode
+         scientific tasty tasty-quickcheck text transformers vector
+       ];
+       benchmarkHaskellDepends = [
+         array base bytestring case-insensitive containers criterion deepseq
+         directory filepath ghc-prim http-types parsec scientific text
+         transformers unordered-containers vector
+       ];
+       jailbreak = true;
+       homepage = "https://github.com/bos/attoparsec";
+       description = "Fast combinator parsing for bytestrings and text";
+       license = stdenv.lib.licenses.bsd3;
+     }) {};
  case-insensitive = callPackage
-    ({ mkDerivation, base, bytestring, deepseq, hashable, HUnit, stdenv
-      , test-framework, test-framework-hunit, text
-      }:
-      mkDerivation {
-        pname = "case-insensitive";
-        version = "1.2.0.6";
-        src = "${ghcjsBoot}/boot/case-insensitive";
-        doCheck = false;
-        libraryHaskellDepends = [ base bytestring deepseq hashable text ];
-        testHaskellDepends = [
-          base bytestring HUnit test-framework test-framework-hunit text
-        ];
-        jailbreak = true;
-        homepage = "https://github.com/basvandijk/case-insensitive";
-        description = "Case insensitive string comparison";
-        license = stdenv.lib.licenses.bsd3;
-      }) {};
+    ({ mkDerivation, base, bytestring, criterion, deepseq, hashable
+     , HUnit, test-framework, test-framework-hunit, text, stdenv
+     }:
+     mkDerivation {
+       pname = "case-insensitive";
+       version = "1.2.0.8";
+       src = "${ghcjsBoot}/boot/case-insensitive";
+       doCheck = false;
+       libraryHaskellDepends = [ base bytestring deepseq hashable text ];
+       testHaskellDepends = [
+         base bytestring HUnit test-framework test-framework-hunit text
+       ];
+       benchmarkHaskellDepends = [ base bytestring criterion deepseq ];
+       jailbreak = true;
+       homepage = "https://github.com/basvandijk/case-insensitive";
+       description = "Case insensitive string comparison";
+       license = stdenv.lib.licenses.bsd3;
+     }) {};
  dlist = callPackage
    ({ mkDerivation, base, Cabal, deepseq, QuickCheck, stdenv }:
-      mkDerivation {
-        pname = "dlist";
-        version = "0.7.1.2";
-        src = "${ghcjsBoot}/boot/dlist";
-        doCheck = false;
-        libraryHaskellDepends = [ base deepseq ];
-        testHaskellDepends = [ base Cabal QuickCheck ];
-        jailbreak = true;
-        homepage = "https://github.com/spl/dlist";
-        description = "Difference lists";
-        license = stdenv.lib.licenses.bsd3;
-      }) {};
+     mkDerivation {
+       pname = "dlist";
+       version = "0.8.0.2";
+       src = "${ghcjsBoot}/boot/dlist";
+       doCheck = false;
+       libraryHaskellDepends = [ base deepseq ];
+       testHaskellDepends = [ base Cabal QuickCheck ];
+       jailbreak = true;
+       homepage = "https://github.com/spl/dlist";
+       description = "Difference lists";
+       license = stdenv.lib.licenses.bsd3;
+     }) {};
  extensible-exceptions = callPackage
    ({ mkDerivation, base, stdenv }:
      mkDerivation {
@ -175,29 +185,29 @@
        license = stdenv.lib.licenses.bsd3;
      }) {};
  scientific = callPackage
-    ({ mkDerivation, base, binary, bytestring, containers, deepseq, ghc-prim
-      , hashable, integer-gmp, QuickCheck, smallcheck, stdenv, tasty
-      , tasty-ant-xml, tasty-hunit, tasty-quickcheck, tasty-smallcheck
-      , text, vector
-      }:
-      mkDerivation {
-        pname = "scientific";
-        version = "0.3.4.7";
-        src = "${ghcjsBoot}/boot/scientific";
-        doCheck = false;
-        libraryHaskellDepends = [
-          base binary bytestring containers deepseq ghc-prim hashable
-          integer-gmp text vector
-        ];
-        testHaskellDepends = [
-          base bytestring QuickCheck smallcheck tasty tasty-ant-xml
-          tasty-hunit tasty-quickcheck tasty-smallcheck text
-        ];
-        jailbreak = true;
-        homepage = "https://github.com/basvandijk/scientific";
-        description = "Numbers represented using scientific notation";
-        license = stdenv.lib.licenses.bsd3;
-      }) {};
+    ({ mkDerivation, base, binary, bytestring, containers, criterion
+     , deepseq, ghc-prim, hashable, integer-gmp, integer-logarithms
+     , QuickCheck, smallcheck, tasty, tasty-ant-xml, tasty-hunit
+     , tasty-quickcheck, tasty-smallcheck, text, vector, stdenv
+     }:
+     mkDerivation {
+       pname = "scientific";
+       version = "0.3.4.10";
+       src = "${ghcjsBoot}/boot/scientific";
+       libraryHaskellDepends = [
+         base binary bytestring containers deepseq ghc-prim hashable
+         integer-gmp integer-logarithms text vector
+       ];
+       testHaskellDepends = [
+         base binary bytestring QuickCheck smallcheck tasty tasty-ant-xml
+         tasty-hunit tasty-quickcheck tasty-smallcheck text
+       ];
+       benchmarkHaskellDepends = [ base criterion ];
+       jailbreak = true;
+       homepage = "https://github.com/basvandijk/scientific";
+       description = "Numbers represented using scientific notation";
+       license = stdenv.lib.licenses.bsd3;
+     }) {};
  stm = callPackage
    ({ mkDerivation, array, base, stdenv }:
      mkDerivation {
@ -224,6 +234,23 @@
        description = "Scrap Your Boilerplate";
        license = stdenv.lib.licenses.bsd3;
      }) {};
+  tagged = callPackage
+    ({ mkDerivation, base, deepseq, template-haskell, transformers
+     , transformers-compat, stdenv
+     }:
+     mkDerivation {
+       pname = "tagged";
+       version = "0.8.5";
+       src = "${ghcjsBoot}/boot/tagged";
+       doCheck = false;
+       libraryHaskellDepends = [
+         base deepseq template-haskell transformers transformers-compat
+       ];
+       jailbreak = true;
+       homepage = "http://github.com/ekmett/tagged";
+       description = "Haskell 98 phantom types to avoid unsafely passing dummy arguments";
+       license = stdenv.lib.licenses.bsd3;
+     }) {};
  text = callPackage
    ({ mkDerivation, array, base, binary, bytestring, deepseq, directory
      , ghc-prim, HUnit, integer-gmp, QuickCheck, quickcheck-unicode
@ -249,25 +276,52 @@
        license = stdenv.lib.licenses.bsd3;
      }) {};
  unordered-containers = callPackage
-    ({ mkDerivation, base, ChasingBottoms, containers, deepseq, hashable
-      , HUnit, QuickCheck, stdenv, test-framework, test-framework-hunit
-      , test-framework-quickcheck2
-      }:
-      mkDerivation {
-        pname = "unordered-containers";
-        version = "0.2.7.0";
-        src = "${ghcjsBoot}/boot/unordered-containers";
-        doCheck = false;
-        libraryHaskellDepends = [ base deepseq hashable ];
-        testHaskellDepends = [
-          base ChasingBottoms containers hashable HUnit QuickCheck
-          test-framework test-framework-hunit test-framework-quickcheck2
-        ];
-        jailbreak = true;
-        homepage = "https://github.com/tibbe/unordered-containers";
-        description = "Efficient hashing-based container types";
-        license = stdenv.lib.licenses.bsd3;
-      }) {};
+    ({ mkDerivation, base, bytestring, ChasingBottoms, containers
+     , criterion, deepseq, deepseq-generics, hashable, hashmap, HUnit
+     , mtl, QuickCheck, random, test-framework, test-framework-hunit
+     , test-framework-quickcheck2, stdenv
+     }:
+     mkDerivation {
+       pname = "unordered-containers";
+       version = "0.2.7.2";
+       src = "${ghcjsBoot}/boot/unordered-containers";
+       libraryHaskellDepends = [ base deepseq hashable ];
+       testHaskellDepends = [
+         base ChasingBottoms containers hashable HUnit QuickCheck
+         test-framework test-framework-hunit test-framework-quickcheck2
+       ];
+       benchmarkHaskellDepends = [
+         base bytestring containers criterion deepseq deepseq-generics
+         hashable hashmap mtl random
+       ];
+       jailbreak = true;
+       homepage = "https://github.com/tibbe/unordered-containers";
+       description = "Efficient hashing-based container types";
+       license = stdenv.lib.licenses.bsd3;
+     }) {};
+  uuid-types = callPackage
+    ({ mkDerivation, base, binary, bytestring, containers, criterion
+     , deepseq, hashable, HUnit, QuickCheck, random, stdenv, tasty
+     , tasty-hunit, tasty-quickcheck, text
+     }:
+     mkDerivation {
+       pname = "uuid-types";
+       version = "1.0.3";
+       src = "${ghcjsBoot}/boot/uuid/uuid-types";
+       libraryHaskellDepends = [
+         base binary bytestring deepseq hashable random text
+       ];
+       testHaskellDepends = [
+         base bytestring HUnit QuickCheck tasty tasty-hunit tasty-quickcheck
+       ];
+       benchmarkHaskellDepends = [
+         base bytestring containers criterion deepseq random
+       ];
+       jailbreak = true;
+       homepage = "https://github.com/aslatter/uuid";
+       description = "Type definitions for Universally Unique Identifiers";
+       license = stdenv.lib.licenses.bsd3;
+     }) {};
  vector = callPackage
    ({ mkDerivation, base, deepseq, ghc-prim, primitive, QuickCheck
      , random, stdenv, template-haskell, test-framework
--- a/pkgs/development/compilers/kotlin/default.nix
+++ b/pkgs/development/compilers/kotlin/default.nix
@ -1,12 +1,12 @@
 { stdenv, fetchurl, makeWrapper, jre, unzip }:

 stdenv.mkDerivation rec {
-  version = "1.1";
+  version = "1.1.1";
  name = "kotlin-${version}";

  src = fetchurl {
    url = "https://github.com/JetBrains/kotlin/releases/download/v${version}/kotlin-compiler-${version}.zip";
-    sha256 = "179m5y56fi50qvxsm075h0547swib7n2pfdn8a4axk9wpwldni5a";
+    sha256 = "1c96l1bkll0l8c82cfzmph0z38f96r3x68zmggq4s8hhdqgwk8mc";
  };

  propagatedBuildInputs = [ jre ] ;
--- a/pkgs/development/compilers/llvm/3.7/libc++abi.nix
+++ b/pkgs/development/compilers/llvm/3.7/libc++abi.nix
@ -1,6 +1,12 @@
-{ stdenv, cmake, fetch, libcxx, libunwind, llvm, version }:
+{ stdenv, cmake, fetch, fetchpatch, libcxx, libunwind, llvm, version }:

-stdenv.mkDerivation {
+let
+  # Newer LLVMs (3.8 onwards) have changed how some basic C++ stuff works, which breaks builds of this older version
+  llvm38-and-above = fetchpatch {
+    url    = "https://trac.macports.org/raw-attachment/ticket/50304/0005-string-Fix-exception-declaration.patch";
+    sha256 = "1lm38n7s0l5dbl7kp4i49pvzxz1mcvlr2vgsnj47agnwhhm63jvr";
+  };
+in stdenv.mkDerivation {
  name = "libc++abi-${version}";

  src = fetch "libcxxabi" "0ambfcmr2nh88hx000xb7yjm9lsqjjz49w5mlf6dlxzmj3nslzx4";
@ -16,6 +22,13 @@ stdenv.mkDerivation {
    export TRIPLE=x86_64-apple-darwin
  '';

+  # I can't use patches directly because this is actually a patch for libc++'s source, which we manually extract
+  # into the libc++abi build environment above.
+  prePatch = ''(
+    cd ../libcxx-*
+    patch -p1 < ${llvm38-and-above}
+  )'';
+
  installPhase = if stdenv.isDarwin
    then ''
      for file in lib/*.dylib; do
--- a/pkgs/development/compilers/llvm/3.9/clang/default.nix
+++ b/pkgs/development/compilers/llvm/3.9/clang/default.nix
@ -29,12 +29,23 @@ let
      sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' lib/Driver/ToolChains.cpp
    '';

+    outputs = [ "out" "python" ];
+
    # Clang expects to find LLVMgold in its own prefix
    # Clang expects to find sanitizer libraries in its own prefix
    postInstall = ''
      ln -sv ${llvm}/lib/LLVMgold.so $out/lib
      ln -sv ${llvm}/lib/clang/${version}/lib $out/lib/clang/${version}/
      ln -sv $out/bin/clang $out/bin/cpp
+
+      mkdir -p $python/bin $python/share/clang/
+      mv $out/bin/{git-clang-format,scan-view} $python/bin
+      if [ -e $out/bin/set-xcode-analyzer ]; then
+        mv $out/bin/set-xcode-analyzer $python/bin
+      fi
+      mv $out/share/clang/*.py $python/share/clang
+
+      rm $out/bin/c-index-test
    '';

    enableParallelBuilding = true;
--- a/pkgs/development/compilers/llvm/3.9/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.9/llvm.nix
@ -40,8 +40,7 @@ in stdenv.mkDerivation rec {
  outputs = [ "out" ] ++ stdenv.lib.optional enableSharedLibraries "lib";

  buildInputs = [ perl groff cmake libxml2 python libffi ]
-    ++ stdenv.lib.optionals stdenv.isDarwin
-         [ libcxxabi darwin.cctools darwin.apple_sdk.libs.xpc ];
+    ++ stdenv.lib.optionals stdenv.isDarwin [ libcxxabi ];

  propagatedBuildInputs = [ ncurses zlib ];

@ -53,11 +52,15 @@ in stdenv.mkDerivation rec {
      sha256 = "11sq86spw41v72f676igksapdlsgh7fiqp5qkkmgfj0ndqcn9skf";
    }}
  ''
-  # hacky fix: New LLVM releases require a newer OS X SDK than
-  # 10.9. This is a temporary measure until nixpkgs darwin support is
-  # updated.
+  # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
+  # to get it, but they're unfree. Since LLVM is rather central to the stdenv, we patch out TSAN support so that Hydra
+  # can build this. If we didn't do it, basically the entire nixpkgs on Darwin would have an unfree dependency and we'd
+  # get no binary cache for the entire platform. If you really find yourself wanting the TSAN, make this controllable by
+  # a flag and turn the flag off during the stdenv build. I realize that this LLVM isn't used in the stdenv but I want to
+  # keep it consistent with 4.0. We really shouldn't be copying and pasting all this code around...
  + stdenv.lib.optionalString stdenv.isDarwin ''
-        sed -i 's/os_trace(\(.*\)");$/printf(\1\\n");/g' ./projects/compiler-rt/lib/sanitizer_common/sanitizer_mac.cc
+    substituteInPlace ./projects/compiler-rt/cmake/config-ix.cmake \
+      --replace 'set(COMPILER_RT_HAS_TSAN TRUE)' 'set(COMPILER_RT_HAS_TSAN FALSE)'
  ''
  # Patch llvm-config to return correct library path based on --link-{shared,static}.
  + stdenv.lib.optionalString (enableSharedLibraries) ''
@ -85,7 +88,6 @@ in stdenv.mkDerivation rec {
    ++ stdenv.lib.optionals (isDarwin) [
    "-DLLVM_ENABLE_LIBCXX=ON"
    "-DCAN_TARGET_i386=false"
-    "-DCMAKE_LIBTOOL=${darwin.cctools}/bin/libtool"
  ];

  postBuild = ''
--- a/pkgs/development/compilers/manticore/builder.sh
+++ b/pkgs/development/compilers/manticore/builder.sh
@ -1,24 +0,0 @@
-#!@shell@
-
-source $stdenv/setup
-echo "Building Manticore research compiler."
-set -xe
-
-PATH=$smlnj/bin:$PATH
-
-mkdir -p $out/bin
-
-# Manticore seems to use the MLB files from the build tree,
-# so for now we copy the whole build tree into the store:
-cd $out/
-tar xf $src
-mv manticore* repo_checkout
-cd repo_checkout/
-# TODO: At the very least, this could probably be cut down to a subset
-# of the repo.
-
-${autoconf}/bin/autoheader -Iconfig
-${autoconf}/bin/autoconf -Iconfig
-./configure --prefix=$out
-make build -j
-make install
--- a/pkgs/development/compilers/manticore/default.nix
+++ b/pkgs/development/compilers/manticore/default.nix
@ -1,14 +1,41 @@
-{ stdenv, fetchurl, coreutils, autoconf, automake, smlnj }:
+{ stdenv, fetchFromGitHub, coreutils, autoreconfHook, smlnj }:

-stdenv.mkDerivation rec {
+let
+    rev = "592a5714595b4448b646a7d49df04c285668c2f8";
+in stdenv.mkDerivation rec {
  name = "manticore-${version}";
  version = "2014.08.18";
-  builder = ./builder.sh;
-  src = fetchurl {
-    url = https://github.com/rrnewton/manticore_temp_mirror/archive/snapshot-20140818.tar.gz; 
-    sha256 = "1x52xpj5gbcpqjqm6aw6ssn901f353zypj3d5scm8i3ad777y29d";
+ 
+  src = fetchFromGitHub {
+    owner = "rrnewton";
+    repo = "manticore_temp_mirror";
+    sha256 = "1snwlm9a31wfgvzb80y7r7yvc6n0k0bi675lqwzll95as7cdswwi";
+    inherit rev;
  };
-  inherit stdenv coreutils autoconf automake smlnj;
+
+  enableParallelBuilding = false;
+ 
+  nativeBuildInputs = [ autoreconfHook ];
+  
+  buildInputs = [ coreutils smlnj ];
+
+  autoreconfFlags = "-Iconfig -vfi";
+
+  unpackPhase = ''
+    mkdir -p $out
+    cd $out
+    unpackFile $src
+    mv manticore_temp_mirror-${rev}-src repo_checkout
+    cd repo_checkout
+    chmod u+w . -R
+  ''; 
+  
+  postPatch = ''
+    patchShebangs .
+    substituteInPlace configure.ac --replace 'MANTICORE_ROOT=`pwd`' 'MANTICORE_ROOT=$out/repo_checkout'
+  '';
+
+  preInstall = "mkdir -p $out/bin";

  meta = {
    description = "A parallel, pure variant of Standard ML";
--- a/pkgs/development/compilers/ponyc/default.nix
+++ b/pkgs/development/compilers/ponyc/default.nix
@ -3,13 +3,13 @@

 stdenv.mkDerivation ( rec {
  name = "ponyc-${version}";
-  version = "0.11.3";
+  version = "0.11.4";

  src = fetchFromGitHub {
    owner = "ponylang";
    repo = "ponyc";
    rev = version;
-    sha256 = "08wh8rh17bf043glvn7778bwpxyzpm95kgfll645hf2m65n5ncsh";
+    sha256 = "0csssmc9dcm2ib9k5qhglnjyrqsmci9b5q0b5cxwvl5z1llib9hg";
  };

  buildInputs = [ llvm makeWrapper which ];
--- a/pkgs/development/compilers/smlnj/default.nix
+++ b/pkgs/development/compilers/smlnj/default.nix
@ -38,7 +38,7 @@ in stdenv.mkDerivation {
  '' + stdenv.lib.optionalString stdenv.isDarwin (with darwin; ''
    sed -i '/^[[:space:]]*\*x86-darwin\*)$/,/^[[:space:]]*\*) ;;/ c\
 \  \*x86-darwin\*)\
-\    INCLFILE=${osx_sdk}/Developer/SDKs/${osx_sdk.name}/usr/include/unistd.h\
+\    INCLFILE=${apple_sdk.sdk}/include/unistd.h\
 \    ;;\
 \  \*) ;;
 ' base/runtime/config/gen-posix-names.sh
--- a/pkgs/development/haskell-modules/configuration-ghcjs.nix
+++ b/pkgs/development/haskell-modules/configuration-ghcjs.nix
@ -181,8 +181,6 @@ self: super:
      ] drv.libraryHaskellDepends;
  });

-  semigroups = addBuildDepends super.semigroups [ self.hashable self.unordered-containers self.text self.tagged ];
-
  transformers-compat = overrideCabal super.transformers-compat (drv: {
    configureFlags = [];
  });
--- a/pkgs/development/libraries/cairo/default.nix
+++ b/pkgs/development/libraries/cairo/default.nix
@ -19,13 +19,6 @@ stdenv.mkDerivation rec {
    sha1 = "c6f7b99986f93c9df78653c3e6a3b5043f65145e";
  };

-  infinality = fetchFromGitHub {
-    owner = "bohoomil";
-    repo = "fontconfig-ultimate";
-    rev = "730f5e77580677e86522c1f2119aa78803741759";
-    sha256 = "1hbrdpm6xcczs2c2iid7by8h7dsd0jcf7an88s150njyqnjzxjg7";
-  };
-
  patches = [
    # from https://bugs.freedesktop.org/show_bug.cgi?id=98165
    (fetchpatch {
@ -35,10 +28,6 @@ stdenv.mkDerivation rec {
    })
  ];

-  prePatch = ''
-    patches="$patches $(echo $infinality/*_cairo-iu/*.patch)"
-  '';
-
  outputs = [ "out" "dev" "devdoc" ];
  outputBin = "dev"; # very small

--- a/pkgs/development/libraries/fontconfig/2.10.nix
+++ b/pkgs/development/libraries/fontconfig/2.10.nix
@ -8,13 +8,11 @@ stdenv.mkDerivation rec {
    sha256 = "0llraqw86jmw4vzv7inskp3xxm2gc64my08iwq5mzncgfdbfza4f";
  };

-  infinality_patch =
-    let subvers = "1";
-      in fetchurl {
-        url = http://www.infinality.net/fedora/linux/zips/fontconfig-infinality-1-20130104_1.tar.bz2;
-        sha256 = "1fm5xx0mx2243jrq5rxk4v0ajw2nawpj23399h710bx6hd1rviq7";
-      }
-    ;
+  patches = [
+    # FreeType 2.7 prefixes PCF font family names with the foundry name.
+    # The output of fc-list and fc-query change which breaks the tests.
+    ./test-pcf-family-names-freetype-2.7.patch
+  ];

  outputs = [ "bin" "dev" "lib" "out" ]; # $out contains all the config

@ -44,10 +42,6 @@ stdenv.mkDerivation rec {
  # Don't try to write to /var/cache/fontconfig at install time.
  installFlags = "sysconfdir=$(out)/etc fc_cachedir=$(TMPDIR)/dummy RUN_FC_CACHE_TEST=false";

-  postInstall = ''
-    cd "$out/etc/fonts" && tar xvf ${infinality_patch}
-  '';
-
  passthru = {
    # Empty for backward compatibility, there was no versioning before 2.11
    configVersion = "";
--- a/Show More
+++ b/Show More