Merge commit 'ba68231273bea4cba01413fd2a0e56d68db9234c' into HEAD

nixos/modules/services/ttys/agetty.nix

@@ -68,14 +68,19 @@ in
     services.mingetty.greetingLine = mkDefault ''<<< Welcome to NixOS ${config.system.nixosLabel} (\m) - \l >>>'';
 
     systemd.services."getty@" =
-      { serviceConfig.ExecStart = gettyCmd "--noclear --keep-baud %I 115200,38400,9600 $TERM";
+      { serviceConfig.ExecStart = [
+          "" # override upstream default with an empty ExecStart
+          (gettyCmd "--noclear --keep-baud %I 115200,38400,9600 $TERM")
+        ];
         restartIfChanged = false;
       };
 
     systemd.services."serial-getty@" =
-      { serviceConfig.ExecStart =
+      let speeds = concatStringsSep "," (map toString config.services.mingetty.serialSpeed); in
-          let speeds = concatStringsSep "," (map toString config.services.mingetty.serialSpeed);
+      { serviceConfig.ExecStart = [
-          in gettyCmd "%I ${speeds} $TERM";
+          "" # override upstream default with an empty ExecStart
+          (gettyCmd "%I ${speeds} $TERM")
+        ];
         restartIfChanged = false;
       };
 

nixos/tests/keymap.nix

@@ -49,6 +49,38 @@ let
     machine.i18n.consoleKeyMap = mkOverride 900 layout;
     machine.services.xserver.layout = mkOverride 900 layout;
     machine.imports = [ ./common/x11.nix extraConfig ];
+    machine.services.xserver.displayManager.slim = {
+      enable = true;
+
+      # Use a custom theme in order to get best OCR results
+      theme = pkgs.runCommand "slim-theme-ocr" {
+        nativeBuildInputs = [ pkgs.imagemagick ];
+      } ''
+        mkdir "$out"
+        convert -size 1x1 xc:white "$out/background.jpg"
+        convert -size 200x100 xc:white "$out/panel.jpg"
+        cat > "$out/slim.theme" <<EOF
+        background_color #ffffff
+        background_style tile
+
+        input_fgcolor #000000
+        msg_color #000000
+
+        session_color #000000
+        session_font Verdana:size=16:bold
+
+        username_msg Username:
+        username_font Verdana:size=16:bold
+        username_color #000000
+        username_x 50%
+        username_y 40%
+
+        password_msg Password:
+        password_x 50%
+        password_y 40%
+        EOF
+      '';
+    };
 
     testScript = ''
       sub waitCatAndDelete ($) {

pkgs/applications/editors/nano/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchFromGitHub
+{ stdenv, hostPlatform, fetchurl, fetchFromGitHub
 , ncurses
 , texinfo
 , gettext ? null
@@ -27,6 +27,8 @@ in stdenv.mkDerivation rec {
     sha256 = "0xjpm2ka56x5ycrgjh06v110na13xlbm42bs8qibk7g578m9cils";
   };
 
+  patches = stdenv.lib.optional hostPlatform.isDarwin stdenv.secure-format-patch;
+
   nativeBuildInputs = [ texinfo ] ++ optional enableNls gettext;
   buildInputs = [ ncurses ];
 

pkgs/applications/science/electronics/verilator/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, perl, flex_2_6_1, bison }:
+{ stdenv, fetchurl, perl, flex, bison }:
 
 stdenv.mkDerivation rec {
   name    = "verilator-${version}";
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   enableParallelBuilding = true;
-  buildInputs = [ perl flex_2_6_1 bison ];
+  buildInputs = [ perl flex bison ];
 
   postInstall = ''
     sed -i -e '3a\#!/usr/bin/env perl' -e '1,3d' $out/bin/{verilator,verilator_coverage,verilator_profcfunc}

pkgs/applications/virtualization/qemu/default.nix

@@ -59,6 +59,10 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "stackprotector" ];
 
+  preConfigure = ''
+    unset CPP # intereferes with dependency calculation
+  '';
+
   configureFlags =
     [ "--smbd=smbd" # use `smbd' from $PATH
       "--audio-drv-list=${audio}"

pkgs/build-support/buildenv/builder.pl

@@ -141,12 +141,11 @@ sub addPkg {
     my $propagatedFN = "$pkgDir/nix-support/propagated-user-env-packages";
     if (-e $propagatedFN) {
         open PROP, "<$propagatedFN" or die;
-        my $propagated = <PROP>;
+        while (my $p = <PROP>) {
-        close PROP;
+            chomp $p;
-        my @propagated = split ' ', $propagated;
-        foreach my $p (@propagated) {
             $postponed{$p} = 1 unless defined $done{$p};
         }
+        close PROP;
     }
 }
 

pkgs/build-support/cc-wrapper/cc-wrapper.sh

@@ -55,7 +55,7 @@ while [ $n -lt ${#params[*]} ]; do
         nonFlagArgs=1
     elif [ "$p" = -m32 ]; then
         if [ -e @out@/nix-support/dynamic-linker-m32 ]; then
-            NIX_LDFLAGS="$NIX_LDFLAGS -dynamic-linker $(cat @out@/nix-support/dynamic-linker-m32)"
+            NIX_LDFLAGS+=" -dynamic-linker $(cat @out@/nix-support/dynamic-linker-m32)"
         fi
     fi
     n=$((n + 1))
@@ -111,9 +111,9 @@ fi
 
 if [[ "$isCpp" = 1 ]]; then
     if [[ "$cppInclude" = 1 ]]; then
-        NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE ${NIX_CXXSTDLIB_COMPILE-@default_cxx_stdlib_compile@}"
+        NIX_CFLAGS_COMPILE+=" ${NIX_CXXSTDLIB_COMPILE-@default_cxx_stdlib_compile@}"
     fi
-    NIX_CFLAGS_LINK="$NIX_CFLAGS_LINK $NIX_CXXSTDLIB_LINK"
+    NIX_CFLAGS_LINK+=" $NIX_CXXSTDLIB_LINK"
 fi
 
 LD=@ldPath@/ld

pkgs/build-support/cc-wrapper/default.nix

@@ -71,22 +71,6 @@ let
         -e 's^addCVars^addCVars${_infixSalt}^g' \
         -e 's^\[ -z "\$crossConfig" \]^\[\[ "${builtins.toString (targetPlatform != hostPlatform)}" || -z "$crossConfig" \]\]^g'
 
-    '' + stdenv.lib.optionalString (textFile == ./setup-hook.sh) ''
-      cat << 'EOF' >> $out
-        for CMD in ar as nm objcopy ranlib strip strings size ld windres
-        do
-          # which is not part of stdenv, but compgen will do for now
-          if
-            PATH=$_PATH type -p ${prefix}$CMD > /dev/null
-          then
-            export ''$(echo "$CMD" | tr "[:lower:]" "[:upper:]")=${prefix}''${CMD};
-          fi
-        done
-      EOF
-
-      sed -i $out -e 's_envHooks_crossEnvHooks_g'
-    '' + ''
-
       # NIX_ things which we don't both use and define, we revert them
       #asymmetric=$(
       #  for pre in "" "\\$"
@@ -105,22 +89,20 @@ let
       done
     '');
 
-  # The dynamic linker has different names on different platforms.
+  # The dynamic linker has different names on different platforms. This is a
+  # shell glob that ought to match it.
   dynamicLinker =
-    if !nativeLibc then
+    /**/ if libc == null then null
-      (if targetPlatform.system == "i686-linux"     then "ld-linux.so.2" else
+    else if targetPlatform.system == "i686-linux"     then "${libc_lib}/lib/ld-linux.so.2"
-       if targetPlatform.system == "x86_64-linux"   then "ld-linux-x86-64.so.2" else
+    else if targetPlatform.system == "x86_64-linux"   then "${libc_lib}/lib/ld-linux-x86-64.so.2"
-       # ARM with a wildcard, which can be "" or "-armhf".
+    # ARM with a wildcard, which can be "" or "-armhf".
-       if targetPlatform.isArm32                    then "ld-linux*.so.3" else
+    else if targetPlatform.isArm32                    then "${libc_lib}/lib/ld-linux*.so.3"
-       if targetPlatform.system == "aarch64-linux"  then "ld-linux-aarch64.so.1" else
+    else if targetPlatform.system == "aarch64-linux"  then "${libc_lib}/lib/ld-linux-aarch64.so.1"
-       if targetPlatform.system == "powerpc-linux"  then "ld.so.1" else
+    else if targetPlatform.system == "powerpc-linux"  then "${libc_lib}/lib/ld.so.1"
-       if targetPlatform.system == "mips64el-linux" then "ld.so.1" else
+    else if targetPlatform.system == "mips64el-linux" then "${libc_lib}/lib/ld.so.1"
-       if targetPlatform.system == "x86_64-darwin"  then "/usr/lib/dyld" else
+    else if targetPlatform.system == "x86_64-darwin"  then "/usr/lib/dyld"
-       if stdenv.lib.hasSuffix "pc-gnu" targetPlatform.config then "ld.so.1" else
+    else if stdenv.lib.hasSuffix "pc-gnu" targetPlatform.config then "ld.so.1"
-       builtins.trace
+    else null;
-         "Don't know the name of the dynamic linker for platform ${targetPlatform.config}, so guessing instead."
-         null)
-    else "";
 
   expand-response-params = if buildPackages.stdenv.cc or null != null && buildPackages.stdenv.cc != "/dev/null"
   then buildPackages.stdenv.mkDerivation {
@@ -145,6 +127,7 @@ stdenv.mkDerivation {
   inherit cc shell libc_bin libc_dev libc_lib binutils_bin coreutils_bin;
   gnugrep_bin = if nativeTools then "" else gnugrep;
 
+  binPrefix = prefix;
 
   passthru = {
     inherit libc nativeTools nativeLibc nativePrefix isGNU isClang default_cxx_stdlib_compile
@@ -175,39 +158,39 @@ stdenv.mkDerivation {
       }
     ''
 
-      # TODO(@Ericson2314): Unify logic next hash break
+    + optionalString (libc != null) (''
-    + optionalString (libc != null) (if (targetPlatform.isDarwin) then ''
+      if [[ -z ''${dynamicLinker+x} ]]; then
-      echo $dynamicLinker > $out/nix-support/dynamic-linker
+        echo "Don't know the name of the dynamic linker for platform '${targetPlatform.config}', so guessing instead." >&2
-
+        dynamicLinker="${libc_lib}/lib/ld*.so.?"
-      echo "export LD_DYLD_PATH=\"$dynamicLinker\"" >> $out/nix-support/setup-hook
-    '' else if dynamicLinker != null then ''
-      dynamicLinker="${libc_lib}/lib/$dynamicLinker"
-      echo $dynamicLinker > $out/nix-support/dynamic-linker
-
-      if [ -e ${libc_lib}/lib/32/ld-linux.so.2 ]; then
-        echo ${libc_lib}/lib/32/ld-linux.so.2 > $out/nix-support/dynamic-linker-m32
       fi
 
-      # The dynamic linker is passed in `ldflagsBefore' to allow
+      # Expand globs to fill array of options
-      # explicit overrides of the dynamic linker by callers to gcc/ld
+      dynamicLinker=($dynamicLinker)
-      # (the *last* value counts, so ours should come first).
+
-      echo "-dynamic-linker" $dynamicLinker > $out/nix-support/libc-ldflags-before
+      case ''${#dynamicLinker[@]} in
-    '' else ''
+        0) echo "No dynamic linker found for platform '${targetPlatform.config}'." >&2;;
-      dynamicLinker=`eval 'echo $libc/lib/ld*.so.?'`
+        1) echo "Using dynamic linker: '$dynamicLinker'" >&2;;
+        *) echo "Multiple dynamic linkers found for platform '${targetPlatform.config}'." >&2;;
+      esac
+
       if [ -n "$dynamicLinker" ]; then
         echo $dynamicLinker > $out/nix-support/dynamic-linker
 
+    '' + (if targetPlatform.isDarwin then ''
+        printf "export LD_DYLD_PATH+=%q\n" "$dynamicLinker" >> $out/nix-support/setup-hook
+    '' else ''
         if [ -e ${libc_lib}/lib/32/ld-linux.so.2 ]; then
           echo ${libc_lib}/lib/32/ld-linux.so.2 > $out/nix-support/dynamic-linker-m32
         fi
 
-        ldflagsBefore="-dynamic-linker $dlinker"
+        ldflagsBefore=(-dynamic-linker "$dynamicLinker")
+    '') + ''
       fi
 
       # The dynamic linker is passed in `ldflagsBefore' to allow
       # explicit overrides of the dynamic linker by callers to gcc/ld
       # (the *last* value counts, so ours should come first).
-      echo "$ldflagsBefore" > $out/nix-support/libc-ldflags-before
+      printWords "''${ldflagsBefore[@]}" > $out/nix-support/libc-ldflags-before
     '')
 
     + optionalString (libc != null) ''
@@ -275,9 +258,9 @@ stdenv.mkDerivation {
       # Propagate the wrapped cc so that if you install the wrapper,
       # you get tools like gcov, the manpages, etc. as well (including
       # for binutils and Glibc).
-      echo ${cc} ${cc.man or ""} ${binutils_bin} ${if libc == null then "" else libc_bin} > $out/nix-support/propagated-user-env-packages
+      printWords ${cc} ${cc.man or ""} ${binutils_bin} ${if libc == null then "" else libc_bin} > $out/nix-support/propagated-user-env-packages
 
-      echo ${toString extraPackages} > $out/nix-support/propagated-native-build-inputs
+      printWords ${toString extraPackages} > $out/nix-support/propagated-native-build-inputs
     ''
 
     + optionalString (targetPlatform.isSunOS && nativePrefix != "") ''
@@ -305,20 +288,24 @@ stdenv.mkDerivation {
         wrap ${prefix}ld.bfd ${preWrap ./ld-wrapper.sh} ${binutils_bin}/bin/${prefix}ld.bfd
       fi
 
-      export real_cc=${prefix}cc
+      # We export environment variables pointing to the wrapped nonstandard
-      export real_cxx=${prefix}c++
+      # cmds, lest some lousy configure script use those to guess compiler
+      # version.
+      export named_cc=${prefix}cc
+      export named_cxx=${prefix}c++
+
       export default_cxx_stdlib_compile="${default_cxx_stdlib_compile}"
 
       if [ -e $ccPath/${prefix}gcc ]; then
         wrap ${prefix}gcc ${preWrap ./cc-wrapper.sh} $ccPath/${prefix}gcc
         ln -s ${prefix}gcc $out/bin/${prefix}cc
-        export real_cc=${prefix}gcc
+        export named_cc=${prefix}gcc
-        export real_cxx=${prefix}g++
+        export named_cxx=${prefix}g++
       elif [ -e $ccPath/clang ]; then
         wrap ${prefix}clang ${preWrap ./cc-wrapper.sh} $ccPath/clang
         ln -s ${prefix}clang $out/bin/${prefix}cc
-        export real_cc=clang
+        export named_cc=${prefix}clang
-        export real_cxx=clang++
+        export named_cxx=${prefix}clang++
       fi
 
       if [ -e $ccPath/${prefix}g++ ]; then

pkgs/build-support/cc-wrapper/ld-wrapper.sh

@@ -64,7 +64,9 @@ extra+=($NIX_LDFLAGS_AFTER $NIX_LDFLAGS_HARDEN)
 # Add all used dynamic libraries to the rpath.
 if [ "$NIX_DONT_SET_RPATH" != 1 ]; then
 
-    libPath=""
+    declare -A libDirsSeen
+    declare -a libDirs
+
     addToLibPath() {
         local path="$1"
         if [ "${path:0:1}" != / ]; then return 0; fi
@@ -76,29 +78,27 @@ if [ "$NIX_DONT_SET_RPATH" != 1 ]; then
                 fi
                 ;;
         esac
-        case $libPath in
+        if [[ -z ${libDirsSeen[$path]} ]]; then
-            *\ $path\ *) return 0 ;;
+            libDirs+=("$path")
-        esac
+            libDirsSeen[$path]=1
-        libPath="$libPath $path "
+        fi
     }
 
+    declare -A rpathsSeen
+    declare -a rpaths
+
     addToRPath() {
         # If the path is not in the store, don't add it to the rpath.
         # This typically happens for libraries in /tmp that are later
         # copied to $out/lib.  If not, we're screwed.
         if [ "${1:0:${#NIX_STORE}}" != "$NIX_STORE" ]; then return 0; fi
-        case $rpath in
+        if [[ -z ${rpathsSeen[$1]} ]]; then
-            *\ $1\ *) return 0 ;;
+            rpaths+=("$1")
-        esac
+            rpathsSeen[$1]=1
-        rpath="$rpath $1 "
+        fi
     }
 
-    libs=""
+    declare -a libs
-    addToLibs() {
-        libs="$libs $1"
-    }
-
-    rpath=""
 
     # First, find all -L... switches.
     allParams=("${params[@]}" ${extra[@]})
@@ -112,10 +112,10 @@ if [ "$NIX_DONT_SET_RPATH" != 1 ]; then
             addToLibPath ${p2}
             n=$((n + 1))
         elif [ "$p" = -l ]; then
-            addToLibs ${p2}
+            libs+=(${p2})
             n=$((n + 1))
         elif [ "${p:0:2}" = -l ]; then
-            addToLibs ${p:2}
+            libs+=(${p:2})
         elif [ "$p" = -dynamic-linker ]; then
             # Ignore the dynamic linker argument, or it
             # will get into the next 'elif'. We don't want
@@ -135,9 +135,8 @@ if [ "$NIX_DONT_SET_RPATH" != 1 ]; then
     # so, add the directory to the rpath.
     # It's important to add the rpath in the order of -L..., so
     # the link time chosen objects will be those of runtime linking.
-
+    for i in ${libDirs[@]}; do
-    for i in $libPath; do
+        for j in ${libs[@]}; do
-        for j in $libs; do
             if [ -f "$i/lib$j.so" ]; then
                 addToRPath $i
                 break
@@ -145,10 +144,9 @@ if [ "$NIX_DONT_SET_RPATH" != 1 ]; then
         done
     done
 
-
     # Finally, add `-rpath' switches.
-    for i in $rpath; do
+    for i in ${rpaths[@]}; do
-        extra+=(-rpath $i)
+        extra+=(-rpath "$i")
     done
 fi
 

pkgs/build-support/cc-wrapper/setup-hook.sh

@@ -1,5 +1,3 @@
-export NIX_CC=@out@
-
 addCVars () {
     if [ -d $1/include ]; then
         export NIX_CFLAGS_COMPILE+=" ${ccIncludeFlag:--isystem} $1/include"
@@ -39,9 +37,26 @@ if [ -n "@coreutils_bin@" ]; then
 fi
 
 if [ -z "$crossConfig" ]; then
-    export CC=@real_cc@
+  ENV_PREFIX=""
-    export CXX=@real_cxx@
 else
-    export BUILD_CC=@real_cc@
+  ENV_PREFIX="BUILD_"
-    export BUILD_CXX=@real_cxx@
 fi
+
+export NIX_${ENV_PREFIX}CC=@out@
+
+export ${ENV_PREFIX}CC=@named_cc@
+export ${ENV_PREFIX}CXX=@named_cxx@
+
+for CMD in \
+    cpp \
+    ar as nm objcopy ranlib strip strings size ld windres
+do
+    if
+        PATH=$_PATH type -p "@binPrefix@$CMD" > /dev/null
+    then
+        export "${ENV_PREFIX}$(echo "$CMD" | tr "[:lower:]" "[:upper:]")=@binPrefix@${CMD}";
+    fi
+done
+
+# No local scope available for sourced files
+unset ENV_PREFIX

pkgs/build-support/fetchurl/builder.sh

@@ -39,7 +39,6 @@ tryDownload() {
           curlexit=$?;
        fi
     done
-    stopNest
 }
 
 
@@ -51,7 +50,6 @@ finish() {
     fi
 
     runHook postFetch
-    stopNest
     exit 0
 }
 

pkgs/build-support/gcc-wrapper-old/builder.sh

@@ -211,5 +211,5 @@ cp -p $utils $out/nix-support/utils.sh
 # tools like gcov, the manpages, etc. as well (including for binutils
 # and Glibc).
 if test -z "$nativeTools"; then
-    echo $gcc $binutils $libc $libc_bin > $out/nix-support/propagated-user-env-packages
+    printWords $gcc $binutils $libc $libc_bin > $out/nix-support/propagated-user-env-packages
 fi

pkgs/build-support/trivial-builders.nix

@@ -84,7 +84,7 @@ rec {
         mkdir -p $out/nix-support
         cp ${script} $out/nix-support/setup-hook
       '' + lib.optionalString (deps != []) ''
-        echo ${toString deps} > $out/nix-support/propagated-native-build-inputs
+        printWords ${toString deps} > $out/nix-support/propagated-native-build-inputs
       '' + lib.optionalString (substitutions != {}) ''
         substituteAll ${script} $out/nix-support/setup-hook
       '');

pkgs/data/misc/dns-root-data/default.nix

@@ -0,0 +1,29 @@
+{ stdenv, lib, fetchurl }:
+
+let
+
+  rootHints = fetchurl {
+    url = "http://www.internic.net/domain/named.root";
+    sha256 = "1zf3ydn44z70gq1kd95lvk9cp68xlbl8vqpswqlhd30qafx6v6d1";
+  };
+
+  rootKey = ./root.key;
+  rootDs = ./root.ds;
+
+in
+
+stdenv.mkDerivation {
+  name = "dns-root-data-2017-07-11";
+
+  buildCommand = ''
+    mkdir $out
+    cp ${rootHints} $out/root.hints
+    cp ${rootKey} $out/root.key
+    cp ${rootDs} $out/root.ds
+  '';
+
+  meta = with lib; {
+    description = "DNS root data including root zone and DNSSEC key";
+    maintainers = with maintainers; [ fpletz ];
+  };
+}

pkgs/data/misc/dns-root-data/root.ds

@@ -0,0 +1,2 @@
+. IN DS 19036 8 2 49AAC11D7B6F6446702E54A1607371607A1A41855200FD2CE1CDDE32F24E8FB5
+. IN DS 20326 8 2 E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D

pkgs/data/misc/dns-root-data/root.key

@@ -0,0 +1,2 @@
+.	172800	IN	DNSKEY	257 3 8 AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjFFVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoXbfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaDX6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpzW5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relSQageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulqQxA+Uk1ihz0= ;{id = 19036 (ksk), size = 2048b}
+.	172800	IN	DNSKEY	257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ;{id = 20326 (ksk), size = 2048b}

pkgs/data/misc/dns-root-data/update-root-key.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p busybox unbound
+
+TMP=`mktemp`
+unbound-anchor -a "$TMP"
+grep -Ev "^($$|;)" "$TMP" | sed -e 's/ ;;.*//' > root.key
+
+unbound-anchor -F -a "$TMP"
+sed '/^;/d' < "$TMP" > root.ds
+rm $TMP

pkgs/data/sgml+xml/stylesheets/xslt/docbook-xsl/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, ruby }:
+{ lib, stdenv, fetchurl }:
 
 let
 
@@ -10,8 +10,6 @@ let
       inherit sha256;
     };
 
-    buildInputs = [ ruby ];
-
     dontBuild = true;
 
     installPhase = ''
@@ -23,9 +21,6 @@ let
       # Backwards compatibility. Will remove eventually.
       mkdir -p $out/xml/xsl
       ln -s $dst $out/xml/xsl/docbook
-
-      ln -sv $dst/epub/bin $out
-      chmod +x $out/bin/dbtoepub
     '';
 
     meta = {

pkgs/desktops/kde-4.14/kde-package/default.nix

@@ -86,7 +86,7 @@ rec {
        };})
         ''
           mkdir -pv $out/nix-support
-          echo "${toString list}" | tee $out/nix-support/propagated-user-env-packages
+          printWords ${toString list} | tee $out/nix-support/propagated-user-env-packages
         '';
 
   # Given manifest module data, return the module

pkgs/development/compilers/ispc/default.nix

@@ -1,4 +1,4 @@
-{stdenv, fetchFromGitHub, bash, which, m4, python, bison, flex_2_6_1, llvmPackages, clangWrapSelf,
+{stdenv, fetchFromGitHub, bash, which, m4, python, bison, flex, llvmPackages, clangWrapSelf,
 testedTargets ? ["sse2" "host"] # the default test target is sse4, but that is not supported by all Hydra agents
 }:
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     m4
     python
     bison
-    flex_2_6_1
+    flex
     llvm
     llvmPackages.clang-unwrapped # we need to link against libclang, so we need the unwrapped
   ];

pkgs/development/compilers/openjdk-darwin/8.nix

@@ -33,7 +33,7 @@ let
       # any package that depends on the JRE has $CLASSPATH set up
       # properly.
       mkdir -p $out/nix-support
-      echo -n "${setJavaClassPath}" > $out/nix-support/propagated-native-build-inputs
+      printWords ${setJavaClassPath} > $out/nix-support/propagated-native-build-inputs
 
       install_name_tool -change /usr/X11/lib/libfreetype.6.dylib ${freetype}/lib/libfreetype.6.dylib $out/jre/lib/libfontmanager.dylib
 

pkgs/development/compilers/openjdk-darwin/default.nix

@@ -23,7 +23,7 @@ let
       # any package that depends on the JRE has $CLASSPATH set up
       # properly.
       mkdir -p $out/nix-support
-      echo -n "${setJavaClassPath}" > $out/nix-support/propagated-native-build-inputs
+      printWords ${setJavaClassPath} > $out/nix-support/propagated-native-build-inputs
 
       install_name_tool -change /usr/X11/lib/libfreetype.6.dylib ${freetype}/lib/libfreetype.6.dylib $out/jre/lib/libfontmanager.dylib
 

pkgs/development/compilers/openjdk/7.nix

@@ -190,7 +190,7 @@ let
       # any package that depends on the JRE has $CLASSPATH set up
       # properly.
       mkdir -p $jre/nix-support
-      echo -n "${setJavaClassPath}" > $jre/nix-support/propagated-native-build-inputs
+      printWords ${setJavaClassPath} > $jre/nix-support/propagated-native-build-inputs
 
       # Set JAVA_HOME automatically.
       mkdir -p $out/nix-support

pkgs/development/compilers/openjdk/8.nix

@@ -203,7 +203,7 @@ let
       # any package that depends on the JRE has $CLASSPATH set up
       # properly.
       mkdir -p $jre/nix-support
-      echo -n "${setJavaClassPath}" > $jre/nix-support/propagated-native-build-inputs
+      printWords ${setJavaClassPath} > $jre/nix-support/propagated-native-build-inputs
 
       # Set JAVA_HOME automatically.
       mkdir -p $out/nix-support

pkgs/development/compilers/oraclejdk/jdk-linux-base.nix

@@ -165,7 +165,7 @@ let result = stdenv.mkDerivation rec {
     ln -s $jrePath/lib/${architecture}/libnpjp2.so $jrePath/lib/${architecture}/plugins
 
     mkdir -p $out/nix-support
-    echo -n "${setJavaClassPath}" > $out/nix-support/propagated-native-build-inputs
+    printWords ${setJavaClassPath} > $out/nix-support/propagated-native-build-inputs
 
     # Set JAVA_HOME automatically.
     cat <<EOF >> $out/nix-support/setup-hook

pkgs/development/compilers/zulu/default.nix

@@ -54,7 +54,7 @@ in stdenv.mkDerivation rec {
     find $out -name "*.so" -exec patchelf --set-rpath "$rpath" {} \;
 
     mkdir -p $out/nix-support
-    echo -n "${setJavaClassPath}" > $out/nix-support/propagated-native-build-inputs
+    printWords ${setJavaClassPath} > $out/nix-support/propagated-native-build-inputs
 
     # Set JAVA_HOME automatically.
     cat <<EOF >> $out/nix-support/setup-hook

pkgs/development/haskell-modules/generic-builder.nix

@@ -218,7 +218,7 @@ stdenv.mkDerivation ({
     configureFlags="${concatStringsSep " " defaultConfigureFlags} $configureFlags"
 
     # nativePkgs defined in stdenv/setup.hs
-    for p in $nativePkgs; do
+    for p in "''${nativePkgs[@]}"; do
       if [ -d "$p/lib/${ghc.name}/package.conf.d" ]; then
         cp -f "$p/lib/${ghc.name}/package.conf.d/"*.conf $packageConfDir/
         continue
@@ -318,7 +318,7 @@ stdenv.mkDerivation ({
     ${optionalString isGhcjs ''
       for exeDir in "$out/bin/"*.jsexe; do
         exe="''${exeDir%.jsexe}"
-        printf '%s\n' '#!${nodejs}/bin/node' > "$exe"
+        printWords '#!${nodejs}/bin/node' > "$exe"
         cat "$exeDir/all.js" >> "$exe"
         chmod +x "$exe"
       done

pkgs/development/interpreters/python/cpython/3.5/default.nix

@@ -70,6 +70,7 @@ in stdenv.mkDerivation {
       url = https://github.com/python/cpython/commit/035ba5da3e53e.patch;
       sha256 = "1y74ir1w5cq542w27rgzgp70chhq2x047db9911mihpab8p2nj71";
     })
+    ./no-ldconfig.patch
   ];
 
   postPatch = ''

pkgs/development/interpreters/python/cpython/3.5/no-ldconfig.patch

@@ -0,0 +1,164 @@
+From f0ed87f4066296b7aa3c095d04672c138506fa45 Mon Sep 17 00:00:00 2001
+From: Frederik Rietdijk <fridh@fridh.nl>
+Date: Sat, 29 Jul 2017 20:33:56 +0200
+Subject: [PATCH] Don't use ldconfig and speed up uuid load
+
+---
+ Lib/ctypes/util.py | 70 ++----------------------------------------------------
+ Lib/uuid.py        | 52 ----------------------------------------
+ 2 files changed, 2 insertions(+), 120 deletions(-)
+
+diff --git a/Lib/ctypes/util.py b/Lib/ctypes/util.py
+index 7684eab81d..e9957d7951 100644
+--- a/Lib/ctypes/util.py
++++ b/Lib/ctypes/util.py
+@@ -95,46 +95,7 @@ elif os.name == "posix":
+     import re, tempfile
+ 
+     def _findLib_gcc(name):
+-        # Run GCC's linker with the -t (aka --trace) option and examine the
+-        # library name it prints out. The GCC command will fail because we
+-        # haven't supplied a proper program with main(), but that does not
+-        # matter.
+-        expr = os.fsencode(r'[^\(\)\s]*lib%s\.[^\(\)\s]*' % re.escape(name))
+-
+-        c_compiler = shutil.which('gcc')
+-        if not c_compiler:
+-            c_compiler = shutil.which('cc')
+-        if not c_compiler:
+-            # No C compiler available, give up
+-            return None
+-
+-        temp = tempfile.NamedTemporaryFile()
+-        try:
+-            args = [c_compiler, '-Wl,-t', '-o', temp.name, '-l' + name]
+-
+-            env = dict(os.environ)
+-            env['LC_ALL'] = 'C'
+-            env['LANG'] = 'C'
+-            try:
+-                proc = subprocess.Popen(args,
+-                                        stdout=subprocess.PIPE,
+-                                        stderr=subprocess.STDOUT,
+-                                        env=env)
+-            except OSError:  # E.g. bad executable
+-                return None
+-            with proc:
+-                trace = proc.stdout.read()
+-        finally:
+-            try:
+-                temp.close()
+-            except FileNotFoundError:
+-                # Raised if the file was already removed, which is the normal
+-                # behaviour of GCC if linking fails
+-                pass
+-        res = re.search(expr, trace)
+-        if not res:
+-            return None
+-        return os.fsdecode(res.group(0))
++        return None
+ 
+ 
+     if sys.platform == "sunos5":
+@@ -256,34 +217,7 @@ elif os.name == "posix":
+     else:
+ 
+         def _findSoname_ldconfig(name):
+-            import struct
+-            if struct.calcsize('l') == 4:
+-                machine = os.uname().machine + '-32'
+-            else:
+-                machine = os.uname().machine + '-64'
+-            mach_map = {
+-                'x86_64-64': 'libc6,x86-64',
+-                'ppc64-64': 'libc6,64bit',
+-                'sparc64-64': 'libc6,64bit',
+-                's390x-64': 'libc6,64bit',
+-                'ia64-64': 'libc6,IA-64',
+-                }
+-            abi_type = mach_map.get(machine, 'libc6')
+-
+-            # XXX assuming GLIBC's ldconfig (with option -p)
+-            regex = os.fsencode(
+-                '\s+(lib%s\.[^\s]+)\s+\(%s' % (re.escape(name), abi_type))
+-            try:
+-                with subprocess.Popen(['/sbin/ldconfig', '-p'],
+-                                      stdin=subprocess.DEVNULL,
+-                                      stderr=subprocess.DEVNULL,
+-                                      stdout=subprocess.PIPE,
+-                                      env={'LC_ALL': 'C', 'LANG': 'C'}) as p:
+-                    res = re.search(regex, p.stdout.read())
+-                    if res:
+-                        return os.fsdecode(res.group(1))
+-            except OSError:
+-                pass
++            return None
+ 
+         def find_library(name):
+             return _findSoname_ldconfig(name) or _get_soname(_findLib_gcc(name))
+diff --git a/Lib/uuid.py b/Lib/uuid.py
+index e96e7e034c..a099ab4b4a 100644
+--- a/Lib/uuid.py
++++ b/Lib/uuid.py
+@@ -455,58 +455,6 @@ def _netbios_getnode():
+             continue
+         return int.from_bytes(bytes, 'big')
+ 
+-# Thanks to Thomas Heller for ctypes and for his help with its use here.
+-
+-# If ctypes is available, use it to find system routines for UUID generation.
+-# XXX This makes the module non-thread-safe!
+-_uuid_generate_time = _UuidCreate = None
+-try:
+-    import ctypes, ctypes.util
+-    import sys
+-
+-    # The uuid_generate_* routines are provided by libuuid on at least
+-    # Linux and FreeBSD, and provided by libc on Mac OS X.
+-    _libnames = ['uuid']
+-    if not sys.platform.startswith('win'):
+-        _libnames.append('c')
+-    for libname in _libnames:
+-        try:
+-            lib = ctypes.CDLL(ctypes.util.find_library(libname))
+-        except Exception:
+-            continue
+-        if hasattr(lib, 'uuid_generate_time'):
+-            _uuid_generate_time = lib.uuid_generate_time
+-            break
+-    del _libnames
+-
+-    # The uuid_generate_* functions are broken on MacOS X 10.5, as noted
+-    # in issue #8621 the function generates the same sequence of values
+-    # in the parent process and all children created using fork (unless
+-    # those children use exec as well).
+-    #
+-    # Assume that the uuid_generate functions are broken from 10.5 onward,
+-    # the test can be adjusted when a later version is fixed.
+-    if sys.platform == 'darwin':
+-        import os
+-        if int(os.uname().release.split('.')[0]) >= 9:
+-            _uuid_generate_time = None
+-
+-    # On Windows prior to 2000, UuidCreate gives a UUID containing the
+-    # hardware address.  On Windows 2000 and later, UuidCreate makes a
+-    # random UUID and UuidCreateSequential gives a UUID containing the
+-    # hardware address.  These routines are provided by the RPC runtime.
+-    # NOTE:  at least on Tim's WinXP Pro SP2 desktop box, while the last
+-    # 6 bytes returned by UuidCreateSequential are fixed, they don't appear
+-    # to bear any relationship to the MAC address of any network device
+-    # on the box.
+-    try:
+-        lib = ctypes.windll.rpcrt4
+-    except:
+-        lib = None
+-    _UuidCreate = getattr(lib, 'UuidCreateSequential',
+-                          getattr(lib, 'UuidCreate', None))
+-except:
+-    pass
+ 
+ def _unixdll_getnode():
+     """Get the hardware address on Unix using ctypes."""
+-- 
+2.13.3
+

pkgs/development/interpreters/python/cpython/3.6/default.nix

@@ -27,7 +27,7 @@ with stdenv.lib;
 
 let
   majorVersion = "3.6";
-  minorVersion = "1";
+  minorVersion = "2";
   minorVersionSuffix = "";
   pythonVersion = majorVersion;
   version = "${majorVersion}.${minorVersion}${minorVersionSuffix}";
@@ -48,7 +48,7 @@ in stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.python.org/ftp/python/${majorVersion}.${minorVersion}/Python-${version}.tar.xz";
-    sha256 = "0ha03sbakxblzyvlramx5fj0ranzmzx4pa2png6nn8gczkfi0650";
+    sha256 = "1ab4vlpdax1ihpiyiwchlgsk36apl4kgdw271wvl9l8ywhxpfacj";
   };
 
   NIX_LDFLAGS = optionalString stdenv.isLinux "-lgcc_s";
@@ -64,6 +64,10 @@ in stdenv.mkDerivation {
     substituteInPlace configure --replace '-Wl,-stack_size,1000000' ' '
   '';
 
+  patches = [
+    ./no-ldconfig.patch
+  ];
+
   postPatch = ''
     # Determinism
     substituteInPlace "Lib/py_compile.py" --replace "source_stats['mtime']" "(1 if 'DETERMINISTIC_BUILD' in os.environ else source_stats['mtime'])"

pkgs/development/interpreters/python/cpython/3.6/no-ldconfig.patch

@@ -0,0 +1,163 @@
+From a831df344ec1c883a0ef04d8cc8f5c53a942f6de Mon Sep 17 00:00:00 2001
+From: Frederik Rietdijk <fridh@fridh.nl>
+Date: Sat, 29 Jul 2017 20:17:40 +0200
+Subject: [PATCH] Don't use ldconfig and speed up uuid load
+
+---
+ Lib/ctypes/util.py | 70 ++----------------------------------------------------
+ Lib/uuid.py        | 51 ---------------------------------------
+ 2 files changed, 2 insertions(+), 119 deletions(-)
+
+diff --git a/Lib/ctypes/util.py b/Lib/ctypes/util.py
+index 339ae8aa8a..2944985c30 100644
+--- a/Lib/ctypes/util.py
++++ b/Lib/ctypes/util.py
+@@ -85,46 +85,7 @@ elif os.name == "posix":
+     import re, tempfile
+ 
+     def _findLib_gcc(name):
+-        # Run GCC's linker with the -t (aka --trace) option and examine the
+-        # library name it prints out. The GCC command will fail because we
+-        # haven't supplied a proper program with main(), but that does not
+-        # matter.
+-        expr = os.fsencode(r'[^\(\)\s]*lib%s\.[^\(\)\s]*' % re.escape(name))
+-
+-        c_compiler = shutil.which('gcc')
+-        if not c_compiler:
+-            c_compiler = shutil.which('cc')
+-        if not c_compiler:
+-            # No C compiler available, give up
+-            return None
+-
+-        temp = tempfile.NamedTemporaryFile()
+-        try:
+-            args = [c_compiler, '-Wl,-t', '-o', temp.name, '-l' + name]
+-
+-            env = dict(os.environ)
+-            env['LC_ALL'] = 'C'
+-            env['LANG'] = 'C'
+-            try:
+-                proc = subprocess.Popen(args,
+-                                        stdout=subprocess.PIPE,
+-                                        stderr=subprocess.STDOUT,
+-                                        env=env)
+-            except OSError:  # E.g. bad executable
+-                return None
+-            with proc:
+-                trace = proc.stdout.read()
+-        finally:
+-            try:
+-                temp.close()
+-            except FileNotFoundError:
+-                # Raised if the file was already removed, which is the normal
+-                # behaviour of GCC if linking fails
+-                pass
+-        res = re.search(expr, trace)
+-        if not res:
+-            return None
+-        return os.fsdecode(res.group(0))
++        return None
+ 
+ 
+     if sys.platform == "sunos5":
+@@ -246,34 +207,7 @@ elif os.name == "posix":
+     else:
+ 
+         def _findSoname_ldconfig(name):
+-            import struct
+-            if struct.calcsize('l') == 4:
+-                machine = os.uname().machine + '-32'
+-            else:
+-                machine = os.uname().machine + '-64'
+-            mach_map = {
+-                'x86_64-64': 'libc6,x86-64',
+-                'ppc64-64': 'libc6,64bit',
+-                'sparc64-64': 'libc6,64bit',
+-                's390x-64': 'libc6,64bit',
+-                'ia64-64': 'libc6,IA-64',
+-                }
+-            abi_type = mach_map.get(machine, 'libc6')
+-
+-            # XXX assuming GLIBC's ldconfig (with option -p)
+-            regex = r'\s+(lib%s\.[^\s]+)\s+\(%s'
+-            regex = os.fsencode(regex % (re.escape(name), abi_type))
+-            try:
+-                with subprocess.Popen(['/sbin/ldconfig', '-p'],
+-                                      stdin=subprocess.DEVNULL,
+-                                      stderr=subprocess.DEVNULL,
+-                                      stdout=subprocess.PIPE,
+-                                      env={'LC_ALL': 'C', 'LANG': 'C'}) as p:
+-                    res = re.search(regex, p.stdout.read())
+-                    if res:
+-                        return os.fsdecode(res.group(1))
+-            except OSError:
+-                pass
++            return None
+ 
+         def _findLib_ld(name):
+             # See issue #9998 for why this is needed
+diff --git a/Lib/uuid.py b/Lib/uuid.py
+index 200c800b34..a099ab4b4a 100644
+--- a/Lib/uuid.py
++++ b/Lib/uuid.py
+@@ -455,57 +455,6 @@ def _netbios_getnode():
+             continue
+         return int.from_bytes(bytes, 'big')
+ 
+-# Thanks to Thomas Heller for ctypes and for his help with its use here.
+-
+-# If ctypes is available, use it to find system routines for UUID generation.
+-# XXX This makes the module non-thread-safe!
+-_uuid_generate_time = _UuidCreate = None
+-try:
+-    import ctypes, ctypes.util
+-    import sys
+-
+-    # The uuid_generate_* routines are provided by libuuid on at least
+-    # Linux and FreeBSD, and provided by libc on Mac OS X.
+-    _libnames = ['uuid']
+-    if not sys.platform.startswith('win'):
+-        _libnames.append('c')
+-    for libname in _libnames:
+-        try:
+-            lib = ctypes.CDLL(ctypes.util.find_library(libname))
+-        except Exception:
+-            continue
+-        if hasattr(lib, 'uuid_generate_time'):
+-            _uuid_generate_time = lib.uuid_generate_time
+-            break
+-    del _libnames
+-
+-    # The uuid_generate_* functions are broken on MacOS X 10.5, as noted
+-    # in issue #8621 the function generates the same sequence of values
+-    # in the parent process and all children created using fork (unless
+-    # those children use exec as well).
+-    #
+-    # Assume that the uuid_generate functions are broken from 10.5 onward,
+-    # the test can be adjusted when a later version is fixed.
+-    if sys.platform == 'darwin':
+-        if int(os.uname().release.split('.')[0]) >= 9:
+-            _uuid_generate_time = None
+-
+-    # On Windows prior to 2000, UuidCreate gives a UUID containing the
+-    # hardware address.  On Windows 2000 and later, UuidCreate makes a
+-    # random UUID and UuidCreateSequential gives a UUID containing the
+-    # hardware address.  These routines are provided by the RPC runtime.
+-    # NOTE:  at least on Tim's WinXP Pro SP2 desktop box, while the last
+-    # 6 bytes returned by UuidCreateSequential are fixed, they don't appear
+-    # to bear any relationship to the MAC address of any network device
+-    # on the box.
+-    try:
+-        lib = ctypes.windll.rpcrt4
+-    except:
+-        lib = None
+-    _UuidCreate = getattr(lib, 'UuidCreateSequential',
+-                          getattr(lib, 'UuidCreate', None))
+-except:
+-    pass
+ 
+ def _unixdll_getnode():
+     """Get the hardware address on Unix using ctypes."""
+-- 
+2.13.3
+

pkgs/development/libraries/dbus/default.nix

@@ -6,8 +6,8 @@ assert x11Support -> libX11 != null
                   && libSM != null;
 
 let
-  version = "1.10.18";
+  version = "1.10.20";
-  sha256 = "0jjirhw6xwz2ffmbg5kr79108l8i1bdaw7szc67n3qpkygaxsjb0";
+  sha256 = "0j0b8rn9fvh1m4nndp9fzq09xw50grp5kfvkv7jgs9al1dwbjx75";
 
 self = stdenv.mkDerivation {
     name = "dbus-${version}";

pkgs/development/libraries/gdal/default.nix

@@ -59,6 +59,8 @@ composableDerivation.composableDerivation {} (fixed: rec {
     wrapPythonPrograms
   '';
 
+  enableParallelBuilding = true;
+
   meta = {
     description = "Translator library for raster geospatial data formats";
     homepage = http://www.gdal.org/;

pkgs/development/libraries/gnutls/generic.nix

@@ -1,6 +1,7 @@
 { lib, fetchurl, stdenv, zlib, lzo, libtasn1, nettle, pkgconfig, lzip
 , guileBindings, guile, perl, gmp, autogen, libidn, p11_kit, libiconv
 , tpmSupport ? false, trousers, which, nettools, libunistring
+, unbound, dns-root-data
 
 # Version dependent args
 , version, src, patches ? [], postPatch ? "", nativeBuildInputs ? []
@@ -32,12 +33,13 @@ stdenv.mkDerivation {
   ++ [
     "--disable-dependency-tracking"
     "--enable-fast-install"
+    "--with-unbound-root-key-file=${dns-root-data}/root.key"
   ] ++ lib.optional guileBindings
     [ "--enable-guile" "--with-guile-site-dir=\${out}/share/guile/site" ];
 
   enableParallelBuilding = true;
 
-  buildInputs = [ lzo lzip libtasn1 libidn p11_kit zlib gmp autogen libunistring ]
+  buildInputs = [ lzo lzip libtasn1 libidn p11_kit zlib gmp autogen libunistring unbound ]
     ++ lib.optional (stdenv.isFreeBSD || stdenv.isDarwin) libiconv
     ++ lib.optional (tpmSupport && stdenv.isLinux) trousers
     ++ lib.optional guileBindings guile

pkgs/development/libraries/gtk+/3.x.nix

@@ -13,7 +13,7 @@ with stdenv.lib;
 
 let
   ver_maj = "3.22";
-  ver_min = "15";
+  ver_min = "16";
   version = "${ver_maj}.${ver_min}";
 in
 stdenv.mkDerivation rec {
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk+/${ver_maj}/gtk+-${version}.tar.xz";
-    sha256 = "c8a012c2a99132629ab043f764a2b7cb6388483a015cd15c7a4288bec3590fdb";
+    sha256 = "3e0c3ad01f3c8c5c9b1cc1ae00852bd55164c8e5a9c1f90ba5e07f14f175fe2c";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/libraries/ldns/default.nix

@@ -1,4 +1,4 @@
-{stdenv, fetchurl, openssl, perl}:
+{stdenv, fetchurl, openssl, perl, dns-root-data}:
 
 stdenv.mkDerivation rec {
   pname = "ldns";
@@ -15,15 +15,27 @@ stdenv.mkDerivation rec {
     patchShebangs doc/doxyparse.pl
   '';
 
-  outputs = [ "out" "dev" "man" ];
+  outputs = [ "out" "dev" "man" "examples" ];
 
   nativeBuildInputs = [ perl ];
   buildInputs = [ openssl ];
 
-  configureFlags = [ "--with-ssl=${openssl.dev}" "--with-drill"];
+  configureFlags = [
+    "--with-ssl=${openssl.dev}"
+    "--with-trust-anchor=${dns-root-data}/root.key"
+    "--with-drill"
+    "--disable-gost"
+  ];
 
   postInstall = ''
     moveToOutput "bin/ldns-config" "$dev"
+
+    pushd examples
+    configureFlagsArray+=( "--bindir=$examples/bin" )
+    configurePhase
+    make
+    make install
+    popd
   '';
 
   meta = with stdenv.lib; {

pkgs/development/libraries/libgcrypt/default.nix

@@ -4,11 +4,11 @@ assert enableCapabilities -> stdenv.isLinux;
 
 stdenv.mkDerivation rec {
   name = "libgcrypt-${version}";
-  version = "1.7.8";
+  version = "1.8.0";
 
   src = fetchurl {
     url = "mirror://gnupg/libgcrypt/${name}.tar.bz2";
-    sha256 = "16f1rsv4y4w2pk1il2jbcqggsb6mrlfva5vayd205fp68zm7d0ll";
+    sha256 = "06w97l88y2c29zf8p8cg0m4k2kiiyj6pqxdl0cxigi3wp2brdr13";
   };
 
   outputs = [ "out" "dev" "info" ];

pkgs/development/libraries/libjpeg-turbo/default.nix

@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   name = "libjpeg-turbo-${version}";
-  version = "1.5.1";
+  version = "1.5.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/libjpeg-turbo/${name}.tar.gz";
-    sha256 = "0v365hm6z6lddcqagjj15wflk66rqyw75m73cqzl65rh4lyrshj1";
+    sha256 = "0a5m0psfp5952y5vrcs0nbdz1y9wqzg2ms0xwrx752034wxr964h";
   }; # github releases still need autotools, surprisingly
 
   patches =

pkgs/development/libraries/libpng/default.nix

@@ -5,13 +5,12 @@
 assert zlib != null;
 
 let
-  version = "1.6.29";
+  version = "1.6.31";
-  patchVersion = "1.6.26";
+  patchVersion = "1.6.31";
-  # patchVersion = version;
+  sha256 = "0hcbxv9qf4f9q7brrk0ndag526glr8lii43grssv45j9w0nn0ai3";
-  sha256 = "0fgjqp7x6jynacmqh6dj72cn6nnf6yxjfqqqfsxrx0pyx22bcia2";
   patch_src = fetchurl {
     url = "mirror://sourceforge/libpng-apng/libpng-${patchVersion}-apng.patch.gz";
-    sha256 = "0b6p2k4afvhk1svargpllcvhxb4g3p857wkqk85cks0yv42ckph1";
+    sha256 = "0f10ih658j514vpvsli0pk378vcmjn78g52cssyg92r4k1r19rla";
   };
   whenPatched = stdenv.lib.optionalString apngSupport;
 

pkgs/development/libraries/libunistring/default.nix

@@ -8,12 +8,14 @@ stdenv.mkDerivation rec {
     sha256 = "1ra1baz2187kbw9im47g6kqb5mx9plq703mkjxaval8rxv5q3q4w";
   };
 
-  patches = stdenv.lib.optional stdenv.isDarwin [ ./clang.patch ];
+  patches = stdenv.lib.optionals stdenv.isDarwin [ ./clang.patch stdenv.secure-format-patch ];
 
   outputs = [ "out" "dev" "info" "doc" ];
 
   propagatedBuildInputs = stdenv.lib.optional (!stdenv.isLinux) libiconv;
 
+  enableParallelBuilding = false;
+
   configureFlags = [
     "--with-libiconv-prefix=${libiconv}"
   ];

pkgs/development/libraries/libuv/default.nix

@@ -2,14 +2,14 @@
 , ApplicationServices, CoreServices }:
 
 stdenv.mkDerivation rec {
-  version = "1.12.0";
+  version = "1.13.1";
   name = "libuv-${version}";
 
   src = fetchFromGitHub {
     owner = "libuv";
     repo = "libuv";
     rev = "v${version}";
-    sha256 = "0m025i0sfm4iv3aiic88x4y4bbhhdb204pmd9r383fsl458fck2p";
+    sha256 = "0k348kgdphha1w4cw78zngq3gqcrhcn0az7k0k4w2bgmdf4ip8z8";
   };
 
   postPatch = let
@@ -17,6 +17,7 @@ stdenv.mkDerivation rec {
       "getnameinfo_basic" "udp_send_hang_loop" # probably network-dependent
       "spawn_setuid_fails" "spawn_setgid_fails" "fs_chown" # user namespaces
       "getaddrinfo_fail" "getaddrinfo_fail_sync"
+      "threadpool_multiple_event_loops" # times out on slow machines
     ]
       # sometimes: timeout (no output), failed uv_listen
       ++ stdenv.lib.optionals stdenv.isDarwin [ "process_title" "emfile" ];

pkgs/development/libraries/mesa/default.nix

@@ -67,7 +67,7 @@ let
 in
 
 let
-  version = "17.1.4";
+  version = "17.1.5";
   branch  = head (splitString "." version);
   driverLink = "/run/opengl-driver" + optionalString stdenv.isi686 "-32";
 in
@@ -82,7 +82,7 @@ stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
       "https://launchpad.net/mesa/trunk/${version}/+download/mesa-${version}.tar.xz"
     ];
-    sha256 = "06f3b0e6a28f0d20b7f3391cf67fe89ae98ecd0a686cd545da76557b6cec9cad";
+    sha256 = "378516b171712687aace4c7ea8b37c85895231d7a6d61e1e27362cf6034fded9";
   };
 
   prePatch = "patchShebangs .";

pkgs/development/libraries/newt/default.nix

@@ -16,6 +16,12 @@ stdenv.mkDerivation rec {
 
   NIX_LDFLAGS = "-lncurses";
 
+  preConfigure = ''
+    # If CPP is set explicitly, configure and make will not agree about which
+    # programs to use at different stages.
+    unset CPP
+  '';
+
   crossAttrs = {
     makeFlags = "CROSS_COMPILE=${stdenv.cc.prefix}";
   };

pkgs/development/libraries/qt-4.x/4.8/default.nix

@@ -114,6 +114,7 @@ stdenv.mkDerivation rec {
       -datadir $out/share/${name}
       -translationdir $out/share/${name}/translations
     "
+    unset LD # Makefile uses gcc for linking; setting LD interferes
   '' + optionalString stdenv.cc.isClang ''
     sed -i 's/QMAKE_CC = gcc/QMAKE_CC = clang/' mkspecs/common/g++-base.conf
     sed -i 's/QMAKE_CXX = g++/QMAKE_CXX = clang++/' mkspecs/common/g++-base.conf

pkgs/development/libraries/science/math/openblas/default.nix

@@ -61,13 +61,13 @@ let
       then blas64_
       else hasPrefix "x86_64" stdenv.system;
 
-  version = "0.2.19";
+  version = "0.2.20";
 in
 stdenv.mkDerivation {
   name = "openblas-${version}";
   src = fetchurl {
     url = "https://github.com/xianyi/OpenBLAS/archive/v${version}.tar.gz";
-    sha256 = "0mw5ra1vjsqiba79zdhqfkqq6v3bla5a5c0wj7vca9qgjzjbah4w";
+    sha256 = "157kpkbpwlr57dkmqiwr3qp9fglfidagv7l6fibrhln6v4aqpwsy";
     name = "openblas-${version}.tar.gz";
   };
 

pkgs/development/libraries/x264/default.nix

@@ -15,6 +15,11 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "lib" ]; # leaving 52 kB of headers
 
+  preConfigure = ''
+    # `AS' is set to the binutils assembler, but we need yasm
+    unset AS
+  '';
+
   configureFlags = [ "--enable-shared" ]
     ++ stdenv.lib.optional (!stdenv.isi686) "--enable-pic"
     ++ stdenv.lib.optional (enable10bit) "--bit-depth=10";

pkgs/development/python-modules/FormEncode/default.nix

@@ -0,0 +1,31 @@
+{ stdenv, buildPythonPackage, fetchPypi, dns, pycountry, nose }:
+
+buildPythonPackage rec {
+  pname = "FormEncode";
+  version = "1.3.1";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1xm77h2mds2prlaz0z4nzkx13g61rx5c2v3vpgjq9d5ij8bzb8md";
+  };
+
+  buildInputs = [ dns pycountry nose ];
+
+  patchPhase = ''
+    # dnspython3 has been superseded, see its PyPI page
+    substituteInPlace setup.py --replace dnspython3 dnspython
+  '';
+
+  preCheck = ''
+    # two tests require dns resolving
+    sed -i 's/test_cyrillic_email/noop/' formencode/tests/test_email.py
+    sed -i 's/test_unicode_ascii_subgroup/noop/' formencode/tests/test_email.py
+  '';
+
+  meta = with stdenv.lib; {
+    description = "FormEncode validates and converts nested structures";
+    homepage = "http://formencode.org";
+    license = licenses.mit;
+  };
+}

pkgs/development/python-modules/actdiag/default.nix

@@ -3,12 +3,12 @@
 
 buildPythonPackage rec {
   pname = "actdiag";
-  version = "0.5.3";
+  version = "0.5.4";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1vr4hnkr0gcvvpaycd8q3vcx029b2f5yv8swhdr8kwspaqb0dvfa";
+    sha256 = "983071777d9941093aaef3be1f67c198a8ac8d2bba264cdd1f337ca415ab46af";
   };
 
   buildInputs = [ pep8 nose unittest2 docutils ];

pkgs/development/python-modules/alabaster/default.nix

@@ -3,12 +3,12 @@
 
 buildPythonPackage rec {
   pname = "alabaster";
-  version = "0.7.7";
+  version = "0.7.10";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f416a84e0d0ddbc288f6b8f2c276d10b40ca1238562cd9ed5a751292ec647b71";
+    sha256 = "37cdcb9e9954ed60912ebc1ca12a9d12178c26637abdf124e3cde2341c257fe0";
   };
 
   propagatedBuildInputs = [ pygments ];

pkgs/development/python-modules/alembic/default.nix

@@ -6,11 +6,11 @@
 buildPythonPackage rec {
   name = "${pname}-${version}";
   pname = "alembic";
-  version = "0.9.2";
+  version = "0.9.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0iw6wysm83hycvrycymf9b4mkji47536kl3x7grynfcbyjcvbdm2";
+    sha256 = "57f2ede554c0b18f1cf811cfbb3b02c586a5422df94922e3821883ba0b8c616c";
   };
 
   buildInputs = [ pytest pytestcov mock coverage ];

pkgs/development/python-modules/aniso8601/default.nix

@@ -3,7 +3,7 @@
 
 buildPythonPackage rec {
   pname = "aniso8601";
-  version = "1.2.0";
+  version = "1.2.1";
   name = "${pname}-${version}";
 
   meta = with stdenv.lib; {
@@ -16,6 +16,6 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "502400f82574afa804cc915d83f15c67533d364dcd594f8a6b9d2053f3404dd4";
+    sha256 = "e7ba4f42d3aea75909c79b1f4c4614768b4f13fbb98fc658a7b6061ddb0be47c";
   };
 }

pkgs/development/python-modules/btrees/default.nix

@@ -5,7 +5,8 @@ buildPythonPackage rec {
   version = "4.4.1";
   name = "${pname}-${version}";
 
-  propagatedBuildInputs = [ persistent zope_interface transaction ];
+  buildInputs = [ transaction ];
+  propagatedBuildInputs = [ persistent zope_interface ];
 
   src = fetchPypi {
     inherit pname version;

pkgs/development/python-modules/celery/fix_endless_python3.6_loop_logger_isa.patch

@@ -0,0 +1,18 @@
+Description: Fix endless loop in logger_isa (Python 3.6)
+Author: George Psarakis <giwrgos.psarakis@gmail.com>
+Origin: upstream, https://github.com/celery/celery/commit/9c950b47eca2b4e93fd2fe52cf80f158e6cf97ad
+Forwarded: not-needed
+Reviewed-By: Nishanth Aravamudan <nish.aravamudan@canonical.com>
+Last-Update: 2017-06-12
+
+--- celery-4.0.2.orig/celery/utils/log.py
++++ celery-4.0.2/celery/utils/log.py
+@@ -82,7 +82,7 @@ def logger_isa(l, p, max=1000):
+         else:
+             if this in seen:
+                 raise RuntimeError(
+-                    'Logger {0!r} parents recursive'.format(l),
++                    'Logger {0!r} parents recursive'.format(l.name),
+                 )
+             seen.add(this)
+             this = this.parent

pkgs/development/python-modules/dask/default.nix

@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "dask";
-  version = "0.14.3";
+  version = "0.15.1";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9bf007f9cedc08f73089f0621ff65ec0882fc0a834acef56830dfd2872908211";
+    sha256 = "f62f19ab5958b13d0ee733db18218c28a9d452a3554446a3dfb5ac3d4a5f7e34";
   };
 
   checkInputs = [ pytest ];

pkgs/development/python-modules/discid/default.nix

@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "discid";
-  version = "1.1.0";
+  version = "1.1.1";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b39d443051b26d0230be7a6c616243daae93337a8711dd5d4119bb6a0e516fa8";
+    sha256 = "78a3bf6c8377fdbe3d85e914a209ff97aa43e35605779639847b510ced31f7b9";
   };
 
   patchPhase = ''

pkgs/development/python-modules/django-raster/default.nix

@@ -3,13 +3,13 @@
   pyparsing, django, celery
 }:
 buildPythonPackage rec {
-  version = "0.4";
+  version = "0.5";
   pname = "django-raster";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://pypi/d/django-raster/${name}.tar.gz";
-    sha256 = "7fd6afa42b07ac51a3873e3d4840325dd3a8a631fdb5b853c76fbbfe59a2b17f";
+    sha256 = "0v1jldb13s4dqq1vaq8ghfv3743jpi9a9n05bqgjm8szlkq8s7ah";
   };
 
   # Tests require a postgresql + postgis server

pkgs/development/python-modules/dkimpy/default.nix

@@ -5,19 +5,24 @@ buildPythonApplication rec {
   name = "${pname}-${majorversion}.${minorversion}";
   pname = "dkimpy";
   majorversion = "0.6";
-  minorversion = "1";
+  minorversion = "2";
 
   src = fetchurl {
     url = "https://launchpad.net/${pname}/${majorversion}/${majorversion}.${minorversion}/+download/${name}.tar.gz";
-    sha256 = "0zmvyw18ww1jqrbqws636w3xki59fyqva553r6s74q5c4jvy36v2";
+    sha256 = "1hagz8qk0v4ijfbcdq4z28bpgr2mkpr498z76i1vam2d50chmakl";
   };
 
   buildInputs = [ pytest ];
   propagatedBuildInputs =  [ openssl dns ];
 
-  patchPhase = ''substituteInPlace dknewkey.py --replace \
+  patchPhase = ''
-     /usr/bin/openssl ${openssl}/bin/openssl
+    substituteInPlace dknewkey.py --replace \
-     '';
+      /usr/bin/openssl ${openssl}/bin/openssl
+  '';
+
+  checkPhase = ''
+    python ./test.py
+  '';
 
   postInstall = ''
     mkdir -p $out/bin $out/libexec
@@ -27,15 +32,16 @@ buildPythonApplication rec {
     makeWrapper "$out/libexec/arcverify.py" $out/bin/arcverify
     makeWrapper "$out/libexec/arcsign.py" $out/bin/arcsign
     makeWrapper "$out/libexec/dknewkey.py" $out/bin/dknewkey
-   '';
+  '';
 
   meta = with stdenv.lib; {
     description = "DKIM + ARC email signing/verification tools + Python module";
-    longDescription = ''Python module that implements DKIM (DomainKeys Identified Mail)
+    longDescription = ''
-      email signing and verification. It also provides a number of convєnient tools
+      Python module that implements DKIM (DomainKeys Identified Mail) email
-      for command line signing and verification, as well as generating new DKIM records.
+      signing and verification. It also provides a number of convєnient tools
-      This version also supports the experimental Authenticated Received Chain (ARC)
+      for command line signing and verification, as well as generating new DKIM
-      protocol.
+      records. This version also supports the experimental Authenticated
+      Received Chain (ARC) protocol.
     '';
     homepage = "https://launchpad.net/dkimpy";
     license = licenses.bsd3;

pkgs/development/python-modules/dns/default.nix

@@ -0,0 +1,23 @@
+{ buildPythonPackage, fetchPypi, lib }:
+
+buildPythonPackage rec {
+  pname = "dnspython";
+  version = "1.15.0";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    extension = "zip";
+    sha256 = "0z5d9vwf211v54bybrhm3qpxclys4dfdfsp7lk2hvf57yzhn7xa0";
+  };
+
+  # needs networking for some tests
+  doCheck = false;
+
+  meta = {
+    description = "A DNS toolkit for Python 3.x";
+    homepage = http://www.dnspython.org;
+    # BSD-like, check http://www.dnspython.org/LICENSE for details
+    license = lib.licenses.free;
+  };
+}

pkgs/development/python-modules/email-validator/default.nix

@@ -0,0 +1,27 @@
+{ stdenv, lib, buildPythonPackage, fetchPypi, isPy3k, dns, idna, ipaddress }:
+
+buildPythonPackage rec {
+  pname = "email_validator";
+  version = "1.0.2";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1ja9149l9ck5n45a72h3is7v476hjny5ybxbcamx1nw6iplsm7k6";
+  };
+
+  doCheck = false;
+
+  propagatedBuildInputs = [
+    dns
+    idna
+  ] ++ (if isPy3k then [ ] else [ ipaddress ]);
+
+  meta = with lib; {
+    description = "A robust email syntax and deliverability validation library for Python 2.x/3.x.";
+    homepage    = https://github.com/JoshData/python-email-validator;
+    license     = licenses.cc0;
+    maintainers = with maintainers; [ siddharthist ];
+    platforms   = platforms.unix;
+  };
+}

pkgs/development/python-modules/faker/default.nix

@@ -0,0 +1,36 @@
+{ stdenv, lib, buildPythonPackage, fetchPypi,
+  # Build inputs
+  dateutil, six,
+  # Test inputs
+  email_validator, nose, mock, ukpostcodeparser }:
+
+buildPythonPackage rec {
+  pname = "Faker";
+  version = "0.7.18";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "310b20f3c497a777622920dca314d90f774028d49c7ee7ccfa96ca4b9d9bf429";
+  };
+
+  checkInputs = [
+    email_validator
+    nose
+    mock
+    ukpostcodeparser
+  ];
+
+  propagatedBuildInputs = [
+    dateutil
+    six
+  ];
+
+  meta = with lib; {
+    description = "A Python library for generating fake user data";
+    homepage    = http://faker.rtfd.org;
+    license     = licenses.mit;
+    maintainers = with maintainers; [ lovek323 ];
+    platforms   = platforms.unix;
+  };
+}

pkgs/development/python-modules/keras/default.nix

@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "Keras";
-  version = "2.0.5";
+  version = "2.0.6";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cbce24758530e070fe1b403d6d21391cbea78c037b70bf6afc1ca9f1f8269eff";
+    sha256 = "0519480abe4ad18b2c2d1bc580eab75edd82c95083d341a1157952f4b00019bb";
   };
 
   checkInputs = [

pkgs/development/python-modules/ldap.nix

@@ -3,13 +3,13 @@
 
 buildPythonPackage rec {
   pname = "python-ldap";
-  version = "2.4.39";
+  version = "2.4.41";
   name = "${pname}-${version}";
   disabled = isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3fb75108d27e8091de80dffa2ba3bf45c7a3bdc357e2959006aed52fa58bb2f3";
+    sha256 = "6d430ecf040f2fc704ee316d3390cb1f5419c191371e1e131baef54a0e42cef0";
   };
 
   # Needed by tests to setup a mockup ldap server.

pkgs/development/python-modules/libagent/default.nix

@@ -5,11 +5,11 @@
 buildPythonPackage rec {
   name = "${pname}-${version}";
   pname = "libagent";
-  version = "0.9.1";
+  version = "0.9.2";
 
   src = fetchPypi{
     inherit pname version;
-    sha256 = "1g19lsid7lqw567w31fif89w088lzbgh27xpb1pshjk1gvags3bc";
+    sha256 = "d6c6dccc0a7693fc966f5962604a69a800e044ac5add3dd030c34cfd4d64311f";
   };
 
   buildInputs = [

pkgs/development/python-modules/libnacl/default.nix

@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "libnacl";
-  version = "1.5.1";
+  version = "1.5.2";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e44e9436e7245b0d8b7322bef67750cb7757834d7ccdb7eb7b723b4813df84fb";
+    sha256 = "c58390b0d191db948fc9ab681f07fdfce2a573cd012356bada47d56795d00ee2";
   };
 
   buildInputs = [ pytest ];

pkgs/development/python-modules/m2r/default.nix

@@ -3,11 +3,11 @@
 buildPythonPackage rec {
   pname = "m2r";
   name = "${pname}-${version}";
-  version = "0.1.6";
+  version = "0.1.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a26bc2e25e0ad3f8650385aea25cf734ac4fcd30e54faec92fd39675da75e527";
+    sha256 = "771631d051a52764fe5b660f97ad028df3aff90c9859d345ccfd17a4c7c2ab39";
   };
 
   propagatedBuildInputs = [ mistune docutils ];

pkgs/development/python-modules/numpy/default.nix

@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "numpy";
-  version = "1.12.1";
+  version = "1.13.1";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://pypi/n/numpy/numpy-${version}.zip";
-    sha256 = "a65266a4ad6ec8936a1bc85ce51f8600634a31a258b722c9274a80ff189d9542";
+    sha256 = "c9b0283776085cb2804efff73e9955ca279ba4edafd58d3ead70b61d209c4fbb";
   };
 
   disabled = isPyPy;
@@ -21,6 +21,7 @@ buildPythonPackage rec {
 
   preConfigure = ''
     sed -i 's/-faltivec//' numpy/distutils/system_info.py
+    export NPY_NUM_BUILD_JOBS=$NIX_BUILD_CORES
   '';
 
   preBuild = ''
@@ -32,6 +33,8 @@ buildPythonPackage rec {
     EOF
   '';
 
+  enableParallelBuilding = true;
+
   checkPhase = ''
     runHook preCheck
     pushd dist

pkgs/development/python-modules/olefile/default.nix

@@ -0,0 +1,19 @@
+{ stdenv, buildPythonPackage, fetchPypi }:
+buildPythonPackage rec {
+  pname = "olefile";
+  version = "0.44";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    extension = "zip";
+    sha256 = "1bbk1xplmrhymqpk6rkb15sg7v9qfih7zh23p6g2fxxas06cmwk1";
+  };
+
+  meta = with stdenv.lib; {
+    description = "Python package to parse, read and write Microsoft OLE2 files";
+    homepage = https://www.decalage.info/python/olefileio;
+    # BSD like + reference to Pillow
+    license = "http://olefile.readthedocs.io/en/latest/License.html";
+  };
+}

pkgs/development/python-modules/pandas/default.nix

@@ -27,12 +27,12 @@ let
   inherit (stdenv) isDarwin;
 in buildPythonPackage rec {
   pname = "pandas";
-  version = "0.20.2";
+  version = "0.20.3";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "92173c976fcca70cb19a958eccdacf98af62ef7301bf786d0321cb8857cdfae6";
+    sha256 = "a777e07633d83d546c55706420179551c8e01075b53c497dcf8ae4036766bc66";
   };
 
   LC_ALL = "en_US.UTF-8";

pkgs/development/python-modules/persistent/default.nix

@@ -0,0 +1,23 @@
+{ buildPythonPackage
+, fetchPypi
+, zope_interface
+, pkgs
+}:
+
+buildPythonPackage rec {
+  pname = "persistent";
+  version = "4.2.4.2";
+  name = "${pname}-${version}";
+
+  propagatedBuildInputs = [ zope_interface ];
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "cf264cd55866c7ffbcbe1328f8d8b28fd042a5dd0c03a03f68c0887df3aa1964";
+  };
+
+  meta = {
+    description = "Automatic persistence for Python objects";
+    homepage = http://www.zope.org/Products/ZODB;
+  };
+}

pkgs/development/python-modules/pillow/default.nix

@@ -0,0 +1,62 @@
+{ stdenv, buildPythonPackage, fetchPypi, isPyPy,
+  nose, olefile,
+  freetype, libjpeg, zlib, libtiff, libwebp, tcl, lcms2, tk, libX11}:
+buildPythonPackage rec {
+  pname = "Pillow";
+  version = "4.2.1";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0wq0fiw964bj5rdmw66mhbfsjnmb13bcdr42krpk2ig5f1cgc967";
+  };
+
+  doCheck = !stdenv.isDarwin && !isPyPy;
+
+  # Disable imagefont tests, because they don't work well with infinality:
+  # https://github.com/python-pillow/Pillow/issues/1259
+  postPatch = ''
+    rm Tests/test_imagefont.py
+  '';
+
+  propagatedBuildInputs = [ olefile ];
+
+  buildInputs = [
+    freetype libjpeg zlib libtiff libwebp tcl nose lcms2 ]
+    ++ stdenv.lib.optionals (isPyPy) [ tk libX11 ];
+
+  # NOTE: we use LCMS_ROOT as WEBP root since there is not other setting for webp.
+  preConfigure = let
+    libinclude' = pkg: ''"${pkg.out}/lib", "${pkg.out}/include"'';
+    libinclude = pkg: ''"${pkg.out}/lib", "${pkg.dev}/include"'';
+  in ''
+    sed -i "setup.py" \
+        -e 's|^FREETYPE_ROOT =.*$|FREETYPE_ROOT = ${libinclude freetype}|g ;
+            s|^JPEG_ROOT =.*$|JPEG_ROOT = ${libinclude libjpeg}|g ;
+            s|^ZLIB_ROOT =.*$|ZLIB_ROOT = ${libinclude zlib}|g ;
+            s|^LCMS_ROOT =.*$|LCMS_ROOT = ${libinclude lcms2}|g ;
+            s|^TIFF_ROOT =.*$|TIFF_ROOT = ${libinclude libtiff}|g ;
+            s|^TCL_ROOT=.*$|TCL_ROOT = ${libinclude' tcl}|g ;'
+    export LDFLAGS="-L${libwebp}/lib"
+    export CFLAGS="-I${libwebp}/include"
+  ''
+  # Remove impurities
+  + stdenv.lib.optionalString stdenv.isDarwin ''
+    substituteInPlace setup.py \
+      --replace '"/Library/Frameworks",' "" \
+      --replace '"/System/Library/Frameworks"' ""
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "https://python-pillow.github.io/";
+    description = "Fork of The Python Imaging Library (PIL)";
+    longDescription = ''
+      The Python Imaging Library (PIL) adds image processing
+      capabilities to your Python interpreter.  This library
+      supports many file formats, and provides powerful image
+      processing and graphics capabilities.
+    '';
+    license = "http://www.pythonware.com/products/pil/license.htm";
+    maintainers = with maintainers; [ goibhniu prikhi ];
+  };
+}

pkgs/development/python-modules/plotly/default.nix

@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "plotly";
-  version = "2.0.10";
+  version = "2.0.12";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8c013a01bb11c4c269c38a7086ffb92d6a2827922c49706131842498a49b3b81";
+    sha256 = "0050da900e4420c15766f8dfb8d252510896511361bf485b9308bc0287f7add0";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/pylint/default.nix

@@ -4,11 +4,11 @@
   buildPythonPackage rec {
     name = "${pname}-${version}";
     pname = "pylint";
-    version = "1.7.1";
+    version = "1.7.2";
 
     src = fetchurl {
       url = "mirror://pypi/p/${pname}/${name}.tar.gz";
-      sha256 = "8b4a7ab6cf5062e40e2763c0b4a596020abada1d7304e369578b522e46a6264a";
+      sha256 = "ea6afb93a9ed810cf52ff3838eb3a15e2bf6a81b80de0eaede1ce442caa5ca69";
     };
 
     buildInputs = [ pytest pytestrunner mccabe configparser backports_functools_lru_cache ];

pkgs/development/python-modules/pyparsing/default.nix

@@ -0,0 +1,20 @@
+{ stdenv, buildPythonPackage, fetchPypi }:
+buildPythonPackage rec {
+    pname = "pyparsing";
+    name = "${pname}-${version}";
+    version = "2.2.0";
+
+    src = fetchPypi {
+      inherit pname version;
+      sha256 = "016b9gh606aa44sq92jslm89bg874ia0yyiyb643fa6dgbsbqch8";
+    };
+
+    # Not everything necessary to run the tests is included in the distribution
+    doCheck = false;
+
+    meta = with stdenv.lib; {
+      homepage = http://pyparsing.wikispaces.com/;
+      description = "An alternative approach to creating and executing simple grammars, vs. the traditional lex/yacc approach, or the use of regular expressions";
+      license = licenses.mit;
+    };
+}

pkgs/development/python-modules/pyroute2/default.nix

@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "pyroute2";
-  version = "0.4.16";
+  version = "0.4.18";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://pypi/p/pyroute2/${name}.tar.gz";
-    sha256 = "5c692efd83369cb44086572b3e1e95ab11f1bc516a89c8ca2429795a789f32a9";
+    sha256 = "bdcff9f598ff4dda7420675ee387426cd9cc79d795ea73eb684a4314d4b00b9e";
   };
 
   # requires root priviledges

pkgs/development/python-modules/pyside/shiboken.nix

@@ -1,4 +1,4 @@
-{ lib, fetchurl, cmake, buildPythonPackage, libxml2, libxslt, pysideApiextractor, pysideGeneratorrunner, python, sphinx, qt4, isPy3k, isPy35 }:
+{ lib, fetchurl, cmake, buildPythonPackage, libxml2, libxslt, pysideApiextractor, pysideGeneratorrunner, python, sphinx, qt4, isPy3k, isPy35, isPy36 }:
 
 # This derivation provides a Python module and should therefore be called via `python-packages.nix`.
 # Python 3.5 is not supported: https://github.com/PySide/Shiboken/issues/77
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     substituteInPlace generator/CMakeLists.txt --replace \
       \"$\{GENERATORRUNNER_PLUGIN_DIR}\" lib/generatorrunner/
   '';
-  patches = if isPy35 then [ ./shiboken_py35.patch ] else null;
+  patches = if (isPy35 || isPy36) then [ ./shiboken_py35.patch ] else null;
 
   cmakeFlags = if isPy3k then "-DUSE_PYTHON3=TRUE" else null;
 

pkgs/development/python-modules/pyside/shiboken_py35.patch

@@ -6,7 +6,7 @@ diff --git a/cmake/Modules/FindPython3Libs.cmake b/cmake/Modules/FindPython3Libs
  # CMAKE_FIND_FRAMEWORKS(Python)
  
 -FOREACH(_CURRENT_VERSION 3.4 3.3 3.2 3.1 3.0)
-+FOREACH(_CURRENT_VERSION 3.5 3.4 3.3 3.2 3.1 3.0)
++FOREACH(_CURRENT_VERSION 3.6 3.5 3.4 3.3 3.2 3.1 3.0)
    IF(_CURRENT_VERSION GREATER 3.1)
        SET(_32FLAGS "m" "u" "mu" "dm" "du" "dmu" "")
    ELSE()

pkgs/development/python-modules/pytest-xdist/default.nix

@@ -3,11 +3,11 @@
 buildPythonPackage rec {
   name = "${pname}-${version}";
   pname = "pytest-xdist";
-  version = "1.16.0";
+  version = "1.18.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "42e5a1e5da9d7cff3e74b07f8692598382f95624f234ff7e00a3b1237e0feba2";
+    sha256 = "10468377901b80255cf192c4603a94ffe8b1f071f5c912868da5f5cb91170dae";
   };
 
   buildInputs = [ pytest setuptools_scm ];

pkgs/development/python-modules/scipy/default.nix

@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "scipy";
-  version = "0.19.0";
+  version = "0.19.1";
   name = "${pname}-${version}";
 
   src = fetchurl {
-    url = "mirror://pypi/s/scipy/scipy-${version}.zip";
+    url = "mirror://pypi/s/scipy/scipy-${version}.tar.gz";
-    sha256 = "4190d34bf9a09626cd42100bbb12e3d96b2daf1a8a3244e991263eb693732122";
+    sha256 = "a19a2ca7a7336495ec180adeaa0dfdcf41e96dbbee90d51c3ed828ba570884e6";
   };
 
   buildInputs = [ gfortran nose numpy.blas ];
@@ -20,6 +20,7 @@ buildPythonPackage rec {
 
   preConfigure = ''
     sed -i '0,/from numpy.distutils.core/s//import setuptools;from numpy.distutils.core/' setup.py
+    export NPY_NUM_BUILD_JOBS=$NIX_BUILD_CORES
   '';
 
   preBuild = ''
@@ -31,6 +32,8 @@ buildPythonPackage rec {
     EOF
   '';
 
+  enableParallelBuilding = true;
+
   checkPhase = ''
     runHook preCheck
     pushd dist

pkgs/development/python-modules/sqlalchemy/default.nix

@@ -11,11 +11,11 @@
 buildPythonPackage rec {
   pname = "SQLAlchemy";
   name = "${pname}-${version}";
-  version = "1.1.11";
+  version = "1.1.12";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "76f76965e9a968ba3aecd2a8bc0d991cea04fd9a182e6c95c81f1551487b0211";
+    sha256 = "d501527319f51a3d9eb639b654222c6f67287228a98ba102b1d0b598eb3266c9";
   };
 
   checkInputs = [ pytest mock pytest_xdist ]

pkgs/development/python-modules/tornado/default.nix

@@ -0,0 +1,28 @@
+{ lib
+, python
+, buildPythonPackage
+, fetchPypi
+, backports_abc
+, backports_ssl_match_hostname
+, certifi
+, singledispatch
+}:
+
+buildPythonPackage rec {
+  pname = "tornado";
+  version = "4.5.1";
+  name = "${pname}-${version}";
+
+  propagatedBuildInputs = [ backports_abc backports_ssl_match_hostname certifi singledispatch ];
+
+  # We specify the name of the test files to prevent
+  # https://github.com/NixOS/nixpkgs/issues/14634
+  checkPhase = ''
+    ${python.interpreter} -m unittest discover *_test.py
+  '';
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "db0904a28253cfe53e7dedc765c71596f3c53bb8a866ae50123320ec1a7b73fd";
+  };
+}

pkgs/development/python-modules/trezor/default.nix

@@ -5,11 +5,11 @@
 buildPythonPackage rec {
   name = "${pname}-${version}";
   pname = "trezor";
-  version = "0.7.15";
+  version = "0.7.16";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f7e4f509263ca172532b4c0a440d164add7cdc021b4370a253d51eba5806b618";
+    sha256 = "6bdb69fc125ba705854e21163be6c7da3aa17c2a3a84f40b6d8a3f6e4a8cb314";
   };
 
   propagatedBuildInputs = [ protobuf3_2 hidapi requests ];

pkgs/development/python-modules/ukpostcodeparser/default.nix

@@ -0,0 +1,22 @@
+{ stdenv, lib, buildPythonPackage, fetchPypi }:
+
+buildPythonPackage rec {
+  pname = "UkPostcodeParser";
+  version = "1.1.1";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "b7a7ac19d48897637c7aaa2f2970288f1c260e4a99140bf04c6086cf65576c6b";
+  };
+
+  doCheck = false;
+
+  meta = with lib; {
+    description = "UK Postcode parser";
+    homepage    = https://github.com/hamstah/ukpostcodeparser;
+    license     = licenses.publicDomain;
+    maintainers = with maintainers; [ siddharthist ];
+    platforms   = platforms.unix;
+  };
+}

pkgs/development/python-modules/vine/default.nix

@@ -3,14 +3,14 @@
 
 buildPythonPackage rec {
   pname = "vine";
-  version = "1.1.3";
+  version = "1.1.4";
   name = "${pname}-${version}";
 
   disable = pythonOlder "2.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0h94x9mc9bspg23lb1f73h7smdzc39ps7z7sm0q38ds9jahmvfc7";
+    sha256 = "52116d59bc45392af9fdd3b75ed98ae48a93e822cee21e5fda249105c59a7a72";
   };
 
   buildInputs = [ case pytest ];

pkgs/development/python-modules/zc_lockfile/default.nix

@@ -0,0 +1,27 @@
+{ buildPythonPackage
+, fetchPypi
+, mock
+, zope_testing
+, stdenv
+}:
+
+buildPythonPackage rec {
+  pname = "zc.lockfile";
+  version = "1.2.1";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "11db91ada7f22fe8aae268d4bfdeae012c4fe655f66bbb315b00822ec00d043e";
+  };
+
+  buildInputs = [ mock ];
+  propagatedBuildInputs = [ zope_testing ];
+
+  meta = with stdenv.lib; {
+    description = "Inter-process locks";
+    homepage =  http://www.python.org/pypi/zc.lockfile;
+    license = licenses.zpt20;
+    maintainers = with maintainers; [ goibhniu ];
+  };
+}

pkgs/development/python-modules/zconfig/default.nix

@@ -2,6 +2,8 @@
 , fetchPypi
 , buildPythonPackage
 , zope_testrunner
+, manuel
+, docutils
 }:
 
 buildPythonPackage rec {
@@ -16,6 +18,7 @@ buildPythonPackage rec {
 
   patches = [ ./skip-broken-test.patch ];
 
+  buildInputs = [ manuel docutils ];
   propagatedBuildInputs = [ zope_testrunner ];
 
   meta = with stdenv.lib; {

pkgs/development/python-modules/zodbpickle/default.nix

@@ -0,0 +1,23 @@
+{ buildPythonPackage
+, isPyPy
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "zodbpickle";
+  version = "0.6.0";
+  name = "${pname}-${version}";
+  disabled = isPyPy; # https://github.com/zopefoundation/zodbpickle/issues/10
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "ea3248be966159e7791e3db0e35ea992b9235d52e7d39835438686741d196665";
+  };
+
+  # fails..
+  doCheck = false;
+
+  meta = {
+    homepage = http://pypi.python.org/pypi/zodbpickle;
+  };
+}

pkgs/development/tools/build-managers/gnumake/3.80/default.nix

@@ -1,18 +0,0 @@
-{stdenv, fetchurl}:
-
-stdenv.mkDerivation {
-  name = "gnumake-3.80";
-
-  src = fetchurl {
-    url = http://tarballs.nixos.org/make-3.80.tar.bz2;
-    sha256 = "06rgz6npynr8whmf7rxgkyvcz0clf3ggwf4cyhj3fcscn3kkk6x9";
-  };
-
-  patches = [./log.patch];
-
-  hardeningDisable = [ "format" ];
-
-  meta = {
-    platforms = stdenv.lib.platforms.unix;
-  };
-}

pkgs/development/tools/build-managers/gnumake/3.80/log.patch

@@ -1,125 +0,0 @@
-diff -rc make-3.80-orig/job.c make-3.80/job.c
-*** make-3.80-orig/job.c	2002-08-10 03:27:17.000000000 +0200
---- make-3.80/job.c	2004-04-02 17:38:04.000000000 +0200
-***************
-*** 987,993 ****
-       appear.  */
-  
-    message (0, (just_print_flag || (!(flags & COMMANDS_SILENT) && !silent_flag))
-! 	   ? "%s" : (char *) 0, p);
-  
-    /* Tell update_goal_chain that a command has been started on behalf of
-       this target.  It is important that this happens here and not in
---- 987,993 ----
-       appear.  */
-  
-    message (0, (just_print_flag || (!(flags & COMMANDS_SILENT) && !silent_flag))
-! 	   ? "\e[3s\e[a%s\e[b" : (char *) 0, p);
-  
-    /* Tell update_goal_chain that a command has been started on behalf of
-       this target.  It is important that this happens here and not in
-diff -rc make-3.80-orig/main.c make-3.80/main.c
-*** make-3.80-orig/main.c	2002-08-10 03:27:17.000000000 +0200
---- make-3.80/main.c	2004-04-02 17:42:50.000000000 +0200
-***************
-*** 254,259 ****
---- 254,263 ----
-     they appear out of date or not.  */
-  
-  int always_make_flag = 0;
-+ 
-+ int logNestingStdout = 0;
-+ int logNestingStderr = 0;
-+ 
-  
-  /* The usage output.  We write it this way to make life easier for the
-     translators, especially those trying to translate to right-to-left
-***************
-*** 827,832 ****
---- 831,845 ----
-  }
-  
-  
-+ static void closeNesting()
-+ {
-+   while (logNestingStdout--)
-+     printf("\e[q");
-+   while (logNestingStderr--)
-+     fprintf(stderr, "\e[q");
-+ }
-+ 
-+ 
-  #ifndef _AMIGA
-  int
-  main (argc, argv, envp)
-***************
-*** 854,859 ****
---- 867,874 ----
-    no_default_sh_exe = 1;
-  #endif
-  
-+   atexit(closeNesting);
-+ 
-    default_goal_file = 0;
-    reading_file = 0;
-  
-***************
-*** 2782,2787 ****
---- 2797,2808 ----
-  
-    /* Use entire sentences to give the translators a fighting chance.  */
-  
-+   if (entering)
-+     {
-+       printf("\e[p");
-+       logNestingStdout++;
-+     }
-+   
-    if (makelevel == 0)
-      if (starting_directory == 0)
-        if (entering)
-***************
-*** 2810,2813 ****
---- 2831,2840 ----
-        else
-          printf (_("%s[%u]: Leaving directory `%s'\n"),
-                  program, makelevel, starting_directory);
-+ 
-+   if (!entering)
-+     {
-+       printf("\e[q");
-+       logNestingStdout--;
-+     }
-  }
-diff -rc make-3.80-orig/make.h make-3.80/make.h
-*** make-3.80-orig/make.h	2002-09-11 18:55:44.000000000 +0200
---- make-3.80/make.h	2004-04-02 17:42:15.000000000 +0200
-***************
-*** 559,562 ****
---- 559,567 ----
-  extern int atomic_stat PARAMS ((const char *file, struct stat *buf));
-  extern struct dirent *atomic_readdir PARAMS ((DIR *dir));
-  
-+ 
-  #endif
-+ 
-+ 
-+ extern int logNestingStdout;
-+ extern int logNestingStderr;
-diff -rc make-3.80-orig/remake.c make-3.80/remake.c
-*** make-3.80-orig/remake.c	2002-08-08 02:11:19.000000000 +0200
---- make-3.80/remake.c	2004-04-04 23:10:19.000000000 +0200
-***************
-*** 1049,1055 ****
---- 1049,1059 ----
-        /* The normal case: start some commands.  */
-        if (!touch_flag || file->cmds->any_recurse)
-  	{
-+           fprintf(stderr, "\e[pbuilding %s\n", file->name);
-+           logNestingStderr++;
-  	  execute_file_commands (file);
-+           fprintf(stderr, "\e[q");
-+           logNestingStderr--;
-  	  return;
-  	}
-  

pkgs/development/tools/build-managers/gnumake/3.82/default.nix

@@ -15,10 +15,6 @@ stdenv.mkDerivation {
 
   patches =
     [
-      # Provide nested log output for subsequent pretty-printing by
-      # nix-log2xml.
-      ./log.patch
-
       # Purity: don't look for library dependencies (of the form
       # `-lfoo') in /lib and /usr/lib.  It's a stupid feature anyway.
       # Likewise, when searching for included Makefiles, don't look in

pkgs/development/tools/build-managers/gnumake/3.82/log.patch

@@ -1,125 +0,0 @@
-diff -rc job.c job.c
-*** job.c	2006-03-20 04:03:04.000000000 +0100
---- job.c	2009-01-19 19:37:28.000000000 +0100
-***************
-*** 1083,1089 ****
-       appear.  */
-  
-    message (0, (just_print_flag || (!(flags & COMMANDS_SILENT) && !silent_flag))
-! 	   ? "%s" : (char *) 0, p);
-  
-    /* Tell update_goal_chain that a command has been started on behalf of
-       this target.  It is important that this happens here and not in
---- 1083,1089 ----
-       appear.  */
-  
-    message (0, (just_print_flag || (!(flags & COMMANDS_SILENT) && !silent_flag))
-!           ? (enable_nested_output ? "\e[3s\e[a%s\e[b" : "%s") : (char *) 0, p);
-  
-    /* Tell update_goal_chain that a command has been started on behalf of
-       this target.  It is important that this happens here and not in
-diff -rc main.c main.c
-*** main.c	2006-03-20 03:36:37.000000000 +0100
---- main.c	2009-01-19 19:41:41.000000000 +0100
-***************
-*** 886,891 ****
---- 886,900 ----
-  }
-  
-  
-+ static void close_nesting()
-+ {
-+   while (stdout_nesting_level--)
-+     printf("\e[q");
-+   while (stderr_nesting_level--)
-+     fprintf(stderr, "\e[q");
-+ }
-+ 
-+ 
-  #ifdef _AMIGA
-  int
-  main (int argc, char **argv)
-***************
-*** 931,936 ****
---- 940,950 ----
-    atexit (close_stdout);
-  #endif
-  
-+   atexit(close_nesting);
-+ 
-+   if (getenv("NIX_INDENT_MAKE"))
-+     enable_nested_output = 1;
-+ 
-    /* Needed for OS/2 */
-    initialize_main(&argc, &argv);
-  
-***************
-*** 3095,3100 ****
---- 3109,3120 ----
-  
-    /* Use entire sentences to give the translators a fighting chance.  */
-  
-+   if (entering && enable_nested_output)
-+     {
-+       printf("\e[p");
-+       stdout_nesting_level++;
-+     }
-+   
-    if (makelevel == 0)
-      if (starting_directory == 0)
-        if (entering)
-***************
-*** 3124,3129 ****
---- 3144,3159 ----
-          printf (_("%s[%u]: Leaving directory `%s'\n"),
-                  program, makelevel, starting_directory);
-  
-+   if (!entering && enable_nested_output)
-+     {
-+       printf("\e[q");
-+       stdout_nesting_level--;
-+     }
-+  
-    /* Flush stdout to be sure this comes before any stderr output.  */
-    fflush (stdout);
-  }
-+ 
-+ int enable_nested_output = 0;
-+ int stdout_nesting_level = 0;
-+ int stderr_nesting_level = 0;
-diff -rc make.h
-*** make.h	2006-02-16 00:54:43.000000000 +0100
---- make.h	2009-01-19 19:32:03.000000000 +0100
-***************
-*** 609,611 ****
---- 609,614 ----
-  
-  #define ENULLLOOP(_v,_c)   do { errno = 0; (_v) = _c; } \
-                             while((_v)==0 && errno==EINTR)
-+ extern int enable_nested_output;
-+ extern int stdout_nesting_level;
-+ extern int stderr_nesting_level;
-diff -rc reremake.c
-*** remake.c	2006-03-20 03:36:37.000000000 +0100
---- remake.c	2009-01-19 19:39:40.000000000 +0100
-***************
-*** 1120,1126 ****
---- 1120,1137 ----
-        /* The normal case: start some commands.  */
-        if (!touch_flag || file->cmds->any_recurse)
-  	{
-+           if (enable_nested_output) 
-+             {
-+               log_working_directory (1);
-+               fprintf(stderr, "\e[pbuilding %s\n", file->name);
-+               stderr_nesting_level++;
-+             }
-  	  execute_file_commands (file);
-+           if (enable_nested_output) 
-+             {
-+               fprintf(stderr, "\e[q");
-+               stderr_nesting_level--;
-+             }
-  	  return;
-  	}
-  

pkgs/development/tools/build-managers/gnumake/4.0/darwin-library_search-dylib.patch

@@ -1,17 +0,0 @@
-Fixed default libpatttern on Darwin, imported from prefix overlay.
-Got merged upstream:
-https://savannah.gnu.org/bugs/?37197
---- default.c.orig	2009-05-02 12:25:24 +0200
-+++ default.c	2009-05-02 12:25:58 +0200
-@@ -509,7 +509,11 @@
- #ifdef __MSDOS__
-     ".LIBPATTERNS", "lib%.a $(DJDIR)/lib/lib%.a",
- #else
-+#ifdef __APPLE__
-+    ".LIBPATTERNS", "lib%.dylib lib%.a",
-+#else
-     ".LIBPATTERNS", "lib%.so lib%.a",
-+#endif
- #endif
- #endif
- 

pkgs/development/tools/build-managers/gnumake/4.0/default.nix

@@ -1,49 +0,0 @@
-{stdenv, fetchurl}:
-
-let version = "4.0"; in
-stdenv.mkDerivation {
-  name = "gnumake-${version}";
-
-  src = fetchurl {
-    url = "mirror://gnu/make/make-${version}.tar.bz2";
-    sha256 = "1nyvn8mknw0mf7727lprva3lisl1y0n03lvar342rrpdmz3qc1p6";
-  };
-
-  /* On Darwin, there are 3 test failures that haven't been investigated
-     yet.  */
-  doCheck = !stdenv.isDarwin && !stdenv.isFreeBSD;
-
-  patches =
-    [
-      # Purity: don't look for library dependencies (of the form
-      # `-lfoo') in /lib and /usr/lib.  It's a stupid feature anyway.
-      # Likewise, when searching for included Makefiles, don't look in
-      # /usr/include and friends.
-      ./impure-dirs.patch
-
-      # a bunch of patches from Gentoo, mostly should be from upstream (unreleased)
-      ./darwin-library_search-dylib.patch
-    ];
-  patchFlags = "-p0";
-
-  meta = {
-    description = "GNU Make, a program controlling the generation of non-source files from sources";
-
-    longDescription =
-      '' Make is a tool which controls the generation of executables and
-         other non-source files of a program from the program's source files.
-
-         Make gets its knowledge of how to build your program from a file
-         called the makefile, which lists each of the non-source files and
-         how to compute it from other files. When you write a program, you
-         should write a makefile for it, so that it is possible to use Make
-         to build and install the program.
-      '';
-
-    homepage = http://www.gnu.org/software/make/;
-
-    license = stdenv.lib.licenses.gpl3Plus;
-    maintainers = [ ];
-    platforms = stdenv.lib.platforms.all;
-  };
-}

pkgs/development/tools/build-managers/gnumake/4.0/impure-dirs.patch

@@ -1,34 +0,0 @@
-diff -rc read.c read.c
-*** read.c	2006-03-17 15:24:20.000000000 +0100
---- read.c	2007-05-24 17:16:31.000000000 +0200
-***************
-*** 99,107 ****
---- 99,109 ----
-  #endif
-      INCLUDEDIR,
-  #ifndef _AMIGA
-+ #if 0    
-      "/usr/gnu/include",
-      "/usr/local/include",
-      "/usr/include",
-+ #endif    
-  #endif
-      0
-    };
-diff -rc reremake.c
-*** remake.c	2006-03-20 03:36:37.000000000 +0100
---- remake.c	2007-05-24 17:06:54.000000000 +0200
-***************
-*** 1452,1460 ****
---- 1452,1462 ----
-    static char *dirs[] =
-      {
-  #ifndef _AMIGA
-+ #if 0
-        "/lib",
-        "/usr/lib",
-  #endif
-+ #endif
-  #if defined(WINDOWS32) && !defined(LIBDIR)
-  /*
-   * This is completely up to the user at product install time. Just define

pkgs/development/tools/build-managers/gnumake/4.1/default.nix

@@ -1,45 +0,0 @@
-{ stdenv, fetchurl }:
-
-let
-  version = "4.1";
-in
-stdenv.mkDerivation {
-  name = "gnumake-${version}";
-
-  src = fetchurl {
-    url = "mirror://gnu/make/make-${version}.tar.bz2";
-    sha256 = "19gwwhik3wdwn0r42b7xcihkbxvjl9r2bdal8nifc3k5i4rn3iqb";
-  };
-
-  patchFlags = "-p0";
-  patches = [
-    # Purity: don't look for library dependencies (of the form `-lfoo') in /lib
-    # and /usr/lib. It's a stupid feature anyway. Likewise, when searching for
-    # included Makefiles, don't look in /usr/include and friends.
-    ./impure-dirs.patch
-
-    # Don't segfault if we can't get a tty name.
-    ./no-tty-name.patch
-  ];
-
-  outputs = [ "out" "doc" ];
-
-  meta = {
-    homepage = http://www.gnu.org/software/make/;
-    description = "A tool to control the generation of non-source files from sources";
-    license = stdenv.lib.licenses.gpl3Plus;
-
-    longDescription = ''
-      Make is a tool which controls the generation of executables and
-      other non-source files of a program from the program's source files.
-
-      Make gets its knowledge of how to build your program from a file
-      called the makefile, which lists each of the non-source files and
-      how to compute it from other files. When you write a program, you
-      should write a makefile for it, so that it is possible to use Make
-      to build and install the program.
-    '';
-
-    platforms = stdenv.lib.platforms.all;
-  };
-}

pkgs/development/tools/build-managers/gnumake/4.1/impure-dirs.patch

@@ -1,34 +0,0 @@
-diff -rc read.c read.c
-*** read.c	2006-03-17 15:24:20.000000000 +0100
---- read.c	2007-05-24 17:16:31.000000000 +0200
-***************
-*** 99,107 ****
---- 99,109 ----
-  #endif
-      INCLUDEDIR,
-  #ifndef _AMIGA
-+ #if 0    
-      "/usr/gnu/include",
-      "/usr/local/include",
-      "/usr/include",
-+ #endif    
-  #endif
-      0
-    };
-diff -rc reremake.c
-*** remake.c	2006-03-20 03:36:37.000000000 +0100
---- remake.c	2007-05-24 17:06:54.000000000 +0200
-***************
-*** 1452,1460 ****
---- 1452,1462 ----
-    static char *dirs[] =
-      {
-  #ifndef _AMIGA
-+ #if 0
-        "/lib",
-        "/usr/lib",
-  #endif
-+ #endif
-  #if defined(WINDOWS32) && !defined(LIBDIR)
-  /*
-   * This is completely up to the user at product install time. Just define

pkgs/development/tools/build-managers/gnumake/4.1/no-tty-name.patch

@@ -1,53 +0,0 @@
-From 292da6f6867b75a5af7ddbb639a1feae022f438f Mon Sep 17 00:00:00 2001
-From: Paul Smith <psmith@gnu.org>
-Date: Mon, 20 Oct 2014 05:54:56 +0000
-Subject: * main.c (main): [SV 43434] Handle NULL returns from ttyname().
-
----
-diff --git main.c main.c
-index b2d169c..0cdb8a8 100644
---- main.c
-+++ main.c
-@@ -1429,13 +1429,18 @@ main (int argc, char **argv, char **envp)
- #ifdef HAVE_ISATTY
-     if (isatty (fileno (stdout)))
-       if (! lookup_variable (STRING_SIZE_TUPLE ("MAKE_TERMOUT")))
--        define_variable_cname ("MAKE_TERMOUT", TTYNAME (fileno (stdout)),
--                               o_default, 0)->export = v_export;
--
-+        {
-+          const char *tty = TTYNAME (fileno (stdout));
-+          define_variable_cname ("MAKE_TERMOUT", tty ? tty : DEFAULT_TTYNAME,
-+                                 o_default, 0)->export = v_export;
-+        }
-     if (isatty (fileno (stderr)))
-       if (! lookup_variable (STRING_SIZE_TUPLE ("MAKE_TERMERR")))
--        define_variable_cname ("MAKE_TERMERR", TTYNAME (fileno (stderr)),
--                               o_default, 0)->export = v_export;
-+        {
-+          const char *tty = TTYNAME (fileno (stderr));
-+          define_variable_cname ("MAKE_TERMERR", tty ? tty : DEFAULT_TTYNAME,
-+                                 o_default, 0)->export = v_export;
-+        }
- #endif
- 
-   /* Reset in case the switches changed our minds.  */
-diff --git makeint.h makeint.h
-index 6223936..2009f41 100644
---- makeint.h
-+++ makeint.h
-@@ -436,10 +436,11 @@ extern struct rlimit stack_limit;
- /* The number of bytes needed to represent the largest integer as a string.  */
- #define INTSTR_LENGTH         CSTRLEN ("18446744073709551616")
- 
-+#define DEFAULT_TTYNAME "true"
- #ifdef HAVE_TTYNAME
- # define TTYNAME(_f) ttyname (_f)
- #else
--# define TTYNAME(_f) "true"
-+# define TTYNAME(_f) DEFAULT_TTYNAME
- #endif
- 
- 
---
-cgit v0.9.0.2

pkgs/development/tools/build-managers/jam/default.nix

@@ -10,6 +10,10 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ yacc ];
 
+  preConfigure = ''
+    unset AR
+  '';
+
   buildPhase = ''
     make jam0
     ./jam0 -j$NIX_BUILD_CORES -sBINDIR=$out/bin install

pkgs/development/tools/misc/gnum4/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl }:
+{ stdenv, hostPlatform, fetchurl }:
 
 stdenv.mkDerivation rec {
   name = "gnum4-1.4.18";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   configureFlags = "--with-syscmd-shell=${stdenv.shell}";
 
   # Upstream is aware of it; it may be in the next release.
-  patches = [ ./s_isdir.patch ];
+  patches = [ ./s_isdir.patch ] ++ stdenv.lib.optional hostPlatform.isDarwin stdenv.secure-format-patch;
 
   # FIXME needs gcc 4.9 in bootstrap tools
   hardeningDisable = [ "stackprotector" ];

pkgs/development/tools/parsing/bison/3.x.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, m4, perl, help2man }:
+{ stdenv, hostPlatform, fetchurl, m4, perl, help2man }:
 
 stdenv.mkDerivation rec {
   name = "bison-3.0.4";
@@ -8,6 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "b67fd2daae7a64b5ba862c66c07c1addb9e6b1b05c5f2049392cfd8a2172952e";
   };
 
+  patches = stdenv.lib.optional hostPlatform.isDarwin stdenv.secure-format-patch;
+
   nativeBuildInputs = [ m4 perl ] ++ stdenv.lib.optional stdenv.isSunOS help2man;
   propagatedBuildInputs = [ m4 ];
 

pkgs/development/tools/parsing/flex/2.5.35.nix

@@ -1,16 +1,14 @@
-{ stdenv, fetchurl, bison, m4 }:
+{ stdenv, fetchurl, autoreconfHook, flex, bison, texinfo, help2man, m4 }:
 
 stdenv.mkDerivation rec {
   name = "flex-2.5.35";
 
   src = fetchurl {
-    # Deleted from original SourceForge and GitHub only provides generated file.
+    url = https://github.com/westes/flex/archive/flex-2-5-35.tar.gz;
-    # Note: binary cache still seems to serve it, too.
+    sha256 = "0wh06nix8bd4w1aq4k2fbbkdq5i30a9lxz3xczf3ff28yy0kfwzm";
-    url = "http://downloads.openwrt.org/sources/${name}.tar.bz2";
-    sha256 = "0ysff249mwhq0053bw3hxh58djc0gy7vjan2z1krrf9n5d5vvv0b";
   };
 
-  buildInputs = [ bison ];
+  nativeBuildInputs = [ flex bison texinfo help2man autoreconfHook ];
 
   propagatedNativeBuildInputs = [ m4 ];