Merge branch 'master' into staging

* master: (33 commits)
  Revert "libxml2: add static output"
  yq: 2.5.0 -> 2.6.0 (#41926)
  yoshimi: 1.5.8 -> 1.5.8.2 (#41925)
  haskell generic-builder: Use separate setup db in more cases
  nixos/tests/morty: fix non-deterministic failure
  texlive: Fix 'match-parens' ruby dependency
  chromium: 67.0.3396.62 -> 67.0.3396.87
  ngspice: Fix regression due to missing X libs (#41890)
  mattermost-desktop: init at 4.1.1 (#40794)
  xcircuit: init at 3.9.73 (#41891)
  yarn: 1.7.0 -> 1.8.0 (#41895)
  Update default.nix (#41842)
  libxml2: add static output
  remarshal: supports darwin
  go-ethereum: 1.8.10 -> 1.8.11
  bazel: add darwin support
  llvm: use native cmake for libc++abi
  kicad-unstable: 2018-03-10 -> 2018-06-12
  cmake: Only apply application-services.patch with 3.11
  nixos/tinc: minor fixes
  ...

doc/languages-frameworks/haskell.section.md

@@ -334,10 +334,29 @@ navigate there.
 
 Finally, you can run
 ```shell
-hoogle server -p 8080 --local
+hoogle server --local -p 8080
 ```
 and navigate to http://localhost:8080/ for your own local
-[Hoogle](https://www.haskell.org/hoogle/).
+[Hoogle](https://www.haskell.org/hoogle/). The `--local` flag makes the hoogle
+server serve files from your nix store over http, without the flag it will use
+`file://` URIs. Note, however, that Firefox and possibly other browsers
+disallow navigation from `http://` to `file://` URIs for security reasons,
+which might be quite an inconvenience. Versions before v5 did not have this
+flag. See
+[this page](http://kb.mozillazine.org/Links_to_local_pages_do_not_work) for
+workarounds.
+
+For NixOS users there's a service which runs this exact command for you.
+Specify the `packages` you want documentation for and the `haskellPackages` set
+you want them to come from. Add the following to `configuration.nix`.
+
+```nix
+services.hoogle = {
+enable = true;
+packages = (hpkgs: with hpkgs; [text cryptonite]);
+haskellPackages = pkgs.haskellPackages;
+};
+```
 
 ### How to build a Haskell project using Stack
 

nixos/doc/manual/release-notes/rl-1809.xml

@@ -288,11 +288,24 @@ inherit (pkgs.nixos {
    </listitem>
    <listitem>
     <para>
-     Recommented way to access the Kubernetes Dashboard is with HTTPS (TLS)
+     Recommended way to access the Kubernetes Dashboard is via HTTPS (TLS)
      Therefore; public service port for the dashboard has changed to 443
      (container port 8443) and scheme to https.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     The option <varname>services.kubernetes.apiserver.address</varname>
+     was renamed to <varname>services.kubernetes.apiserver.bindAddress</varname>.
+     Note that the default value has changed from 127.0.0.1 to 0.0.0.0.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     The option <varname>services.kubernetes.apiserver.publicAddress</varname>
+     was not used and thus has been removed.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 </section>

nixos/modules/module-list.nix

@@ -473,6 +473,7 @@
   ./services/networking/dnschain.nix
   ./services/networking/dnscrypt-proxy.nix
   ./services/networking/dnscrypt-wrapper.nix
+  ./services/networking/dnsdist.nix
   ./services/networking/dnsmasq.nix
   ./services/networking/ejabberd.nix
   ./services/networking/fakeroute.nix

nixos/modules/rename.nix

@@ -32,6 +32,8 @@ with lib;
     (mkRenamedOptionModule [ "services" "i2pd" "extIp" ] [ "services" "i2pd" "address" ])
     (mkRenamedOptionModule [ "services" "kibana" "host" ] [ "services" "kibana" "listenAddress" ])
     (mkRenamedOptionModule [ "services" "kubernetes" "apiserver" "admissionControl" ] [ "services" "kubernetes" "apiserver" "enableAdmissionPlugins" ])
+    (mkRenamedOptionModule [ "services" "kubernetes" "apiserver" "address" ] ["services" "kubernetes" "apiserver" "bindAddress"])
+    (mkRemovedOptionModule [ "services" "kubernetes" "apiserver" "publicAddress" ] "")
     (mkRenamedOptionModule [ "services" "logstash" "address" ] [ "services" "logstash" "listenAddress" ])
     (mkRenamedOptionModule [ "services" "mpd" "network" "host" ] [ "services" "mpd" "network" "listenAddress" ])
     (mkRenamedOptionModule [ "services" "neo4j" "host" ] [ "services" "neo4j" "listenAddress" ])

nixos/modules/services/cluster/kubernetes/dashboard.nix

@@ -4,16 +4,6 @@ with lib;
 
 let
   cfg = config.services.kubernetes.addons.dashboard;
-
-  name = "k8s.gcr.io/kubernetes-dashboard-amd64";
-  version = "v1.8.3";
-
-  image = pkgs.dockerTools.pullImage {
-    imageName = name;
-    imageDigest = "sha256:dc4026c1b595435ef5527ca598e1e9c4343076926d7d62b365c44831395adbd0";
-    finalImageTag = version;
-    sha256 = "18ajcg0q1vignfjk2sm4xj4wzphfz8wah69ps8dklqfvv0164mc8";
-  };
 in {
   options.services.kubernetes.addons.dashboard = {
     enable = mkEnableOption "kubernetes dashboard addon";
@@ -23,10 +13,27 @@ in {
       type = types.bool;
       default = elem "RBAC" config.services.kubernetes.apiserver.authorizationMode;
     };
+
+    version = mkOption {
+      description = "Which version of the kubernetes dashboard to deploy";
+      type = types.str;
+      default = "v1.8.3";
+    };
+
+    image = mkOption {
+      description = "Docker image to seed for the kubernetes dashboard container.";
+      type = types.attrs;
+      default = {
+        imageName = "k8s.gcr.io/kubernetes-dashboard-amd64";
+        imageDigest = "sha256:dc4026c1b595435ef5527ca598e1e9c4343076926d7d62b365c44831395adbd0";
+        finalImageTag = cfg.version;
+        sha256 = "18ajcg0q1vignfjk2sm4xj4wzphfz8wah69ps8dklqfvv0164mc8";
+      };
+    };
   };
 
   config = mkIf cfg.enable {
-    services.kubernetes.kubelet.seedDockerImages = [image];
+    services.kubernetes.kubelet.seedDockerImages = [(pkgs.dockerTools.pullImage cfg.image)];
 
     services.kubernetes.addonManager.addons = {
       kubernetes-dashboard-deployment = {
@@ -36,7 +43,7 @@ in {
           labels = {
             k8s-addon = "kubernetes-dashboard.addons.k8s.io";
             k8s-app = "kubernetes-dashboard";
-            version = version;
+            version = cfg.version;
             "kubernetes.io/cluster-service" = "true";
             "addonmanager.kubernetes.io/mode" = "Reconcile";
           };
@@ -52,7 +59,7 @@ in {
               labels = {
                 k8s-addon = "kubernetes-dashboard.addons.k8s.io";
                 k8s-app = "kubernetes-dashboard";
-                version = version;
+                version = cfg.version;
                 "kubernetes.io/cluster-service" = "true";
               };
               annotations = {
@@ -63,7 +70,7 @@ in {
               priorityClassName = "system-cluster-critical";
               containers = [{
                 name = "kubernetes-dashboard";
-                image = "${name}:${version}";
+                image = with cfg.image; "${imageName}:${finalImageTag}";
                 ports = [{
                   containerPort = 8443;
                   protocol = "TCP";

nixos/modules/services/cluster/kubernetes/default.nix

@@ -73,7 +73,9 @@ let
   mkKubeConfigOptions = prefix: {
     server = mkOption {
       description = "${prefix} kube-apiserver server address.";
-      default = "http://${cfg.apiserver.address}:${toString cfg.apiserver.port}";
+      default = "http://${if cfg.apiserver.advertiseAddress != null
+                          then cfg.apiserver.advertiseAddress
+                          else "127.0.0.1"}:${toString cfg.apiserver.port}";
       type = types.str;
     };
 
@@ -103,12 +105,18 @@ let
     keyFile = mkDefault cfg.kubeconfig.keyFile;
   };
 
-  cniConfig = pkgs.buildEnv {
+  cniConfig =
-    name = "kubernetes-cni-config";
+    if cfg.kubelet.cni.config != [] && !(isNull cfg.kubelet.cni.configDir) then
-    paths = imap (i: entry:
+      throw "Verbatim CNI-config and CNI configDir cannot both be set."
-      pkgs.writeTextDir "${toString (10+i)}-${entry.type}.conf" (builtins.toJSON entry)
+    else if !(isNull cfg.kubelet.cni.configDir) then
-    ) cfg.kubelet.cni.config;
+      cfg.kubelet.cni.configDir
-  };
+    else
+      (pkgs.buildEnv {
+        name = "kubernetes-cni-config";
+        paths = imap (i: entry:
+          pkgs.writeTextDir "${toString (10+i)}-${entry.type}.conf" (builtins.toJSON entry)
+        ) cfg.kubelet.cni.config;
+      });
 
   manifests = pkgs.buildEnv {
     name = "kubernetes-manifests";
@@ -244,18 +252,13 @@ in {
         type = types.listOf types.str;
       };
 
-      address = mkOption {
+      bindAddress = mkOption {
-        description = "Kubernetes apiserver listening address.";
-        default = "127.0.0.1";
-        type = types.str;
-      };
-
-      publicAddress = mkOption {
         description = ''
-          Kubernetes apiserver public listening address used for read only and
+          The IP address on which to listen for the --secure-port port.
-          secure port.
+          The associated interface(s) must be reachable by the rest
+          of the cluster, and by CLI/web clients.
         '';
-        default = cfg.apiserver.address;
+        default = "0.0.0.0";
         type = types.str;
       };
 
@@ -670,6 +673,12 @@ in {
             }]
           '';
         };
+
+        configDir = mkOption {
+          description = "Path to Kubernetes CNI configuration directory.";
+          type = types.nullOr types.path;
+          default = null;
+        };
       };
 
       manifests = mkOption {
@@ -892,7 +901,7 @@ in {
 
     (mkIf cfg.apiserver.enable {
       systemd.services.kube-apiserver = {
-        description = "Kubernetes Kubelet Service";
+        description = "Kubernetes APIServer Service";
         wantedBy = [ "kubernetes.target" ];
         after = [ "network.target" "docker.service" ];
         serviceConfig = {
@@ -906,7 +915,7 @@ in {
             ${optionalString (cfg.etcd.keyFile != null)
               "--etcd-keyfile=${cfg.etcd.keyFile}"} \
             --insecure-port=${toString cfg.apiserver.port} \
-            --bind-address=${toString cfg.apiserver.address} \
+            --bind-address=${cfg.apiserver.bindAddress} \
             ${optionalString (cfg.apiserver.advertiseAddress != null)
               "--advertise-address=${cfg.apiserver.advertiseAddress}"} \
             --allow-privileged=${boolToString cfg.apiserver.allowPrivileged}\

nixos/modules/services/cluster/kubernetes/dns.nix

@@ -4,28 +4,6 @@ with lib;
 
 let
   version = "1.14.10";
-
-  k8s-dns-kube-dns = pkgs.dockerTools.pullImage {
-    imageName = "k8s.gcr.io/k8s-dns-kube-dns-amd64";
-    imageDigest = "sha256:b99fc3eee2a9f052f7eb4cc00f15eb12fc405fa41019baa2d6b79847ae7284a8";
-    finalImageTag = version;
-    sha256 = "0x583znk9smqn0fix7ld8sm5jgaxhqhx3fq97b1wkqm7iwhvl3pj";
-  };
-
-  k8s-dns-dnsmasq-nanny = pkgs.dockerTools.pullImage {
-    imageName = "k8s.gcr.io/k8s-dns-dnsmasq-nanny-amd64";
-    imageDigest = "sha256:bbb2a290a568125b3b996028958eb773f33b5b87a6b37bf38a28f8b62dddb3c8";
-    finalImageTag = version;
-    sha256 = "1fihml7s2mfwgac51cbqpylkwbivc8nyhgi4vb820s83zvl8a6y1";
-  };
-
-  k8s-dns-sidecar = pkgs.dockerTools.pullImage {
-    imageName = "k8s.gcr.io/k8s-dns-sidecar-amd64";
-    imageDigest = "sha256:4f1ab957f87b94a5ec1edc26fae50da2175461f00afecf68940c4aa079bd08a4";
-    finalImageTag = version;
-    sha256 = "08l1bv5jgrhvjzpqpbinrkgvv52snc4fzyd8ya9v18ns2klyz7m0";
-  };
-
   cfg = config.services.kubernetes.addons.dns;
 in {
   options.services.kubernetes.addons.dns = {
@@ -48,13 +26,46 @@ in {
       default = "cluster.local";
       type = types.str;
     };
+
+    kube-dns = mkOption {
+      description = "Docker image to seed for the kube-dns main container.";
+      type = types.attrs;
+      default = {
+        imageName = "k8s.gcr.io/k8s-dns-kube-dns-amd64";
+        imageDigest = "sha256:b99fc3eee2a9f052f7eb4cc00f15eb12fc405fa41019baa2d6b79847ae7284a8";
+        finalImageTag = version;
+        sha256 = "0x583znk9smqn0fix7ld8sm5jgaxhqhx3fq97b1wkqm7iwhvl3pj";
+      };
+    };
+
+    dnsmasq-nanny = mkOption {
+      description = "Docker image to seed for the kube-dns dnsmasq container.";
+      type = types.attrs;
+      default = {
+        imageName = "k8s.gcr.io/k8s-dns-dnsmasq-nanny-amd64";
+        imageDigest = "sha256:bbb2a290a568125b3b996028958eb773f33b5b87a6b37bf38a28f8b62dddb3c8";
+        finalImageTag = version;
+        sha256 = "1fihml7s2mfwgac51cbqpylkwbivc8nyhgi4vb820s83zvl8a6y1";
+      };
+    };
+
+    sidecar = mkOption {
+      description = "Docker image to seed for the kube-dns sidecar container.";
+      type = types.attrs;
+      default = {
+        imageName = "k8s.gcr.io/k8s-dns-sidecar-amd64";
+        imageDigest = "sha256:4f1ab957f87b94a5ec1edc26fae50da2175461f00afecf68940c4aa079bd08a4";
+        finalImageTag = version;
+        sha256 = "08l1bv5jgrhvjzpqpbinrkgvv52snc4fzyd8ya9v18ns2klyz7m0";
+      };
+    };
   };
 
   config = mkIf cfg.enable {
-    services.kubernetes.kubelet.seedDockerImages = [
+    services.kubernetes.kubelet.seedDockerImages = with pkgs.dockerTools; [
-      k8s-dns-kube-dns
+      (pullImage cfg.kube-dns)
-      k8s-dns-dnsmasq-nanny
+      (pullImage cfg.dnsmasq-nanny)
-      k8s-dns-sidecar
+      (pullImage cfg.sidecar)
     ];
 
     services.kubernetes.addonManager.addons = {
@@ -88,7 +99,7 @@ in {
               containers = [
                 {
                   name = "kubedns";
-                  image = "k8s.gcr.io/k8s-dns-kube-dns-amd64:${version}";
+                  image = with cfg.kube-dns; "${imageName}:${finalImageTag}";
                   resources = {
                     limits.memory = "170Mi";
                     requests = {
@@ -154,7 +165,7 @@ in {
                 }
                 {
                   name = "dnsmasq";
-                  image = "k8s.gcr.io/k8s-dns-dnsmasq-nanny-amd64:${version}";
+                  image = with cfg.dnsmasq-nanny; "${imageName}:${finalImageTag}";
                   livenessProbe = {
                     httpGet = {
                       path = "/healthcheck/dnsmasq";
@@ -206,7 +217,7 @@ in {
                 }
                 {
                   name = "sidecar";
-                  image = "k8s.gcr.io/k8s-dns-sidecar-amd64:${version}";
+                  image = with cfg.sidecar; "${imageName}:${finalImageTag}";
                   livenessProbe = {
                     httpGet = {
                       path = "/metrics";

nixos/modules/services/networking/dnsdist.nix

@@ -0,0 +1,61 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.dnsdist;
+  configFile = pkgs.writeText "dndist.conf" ''
+    setLocal('${cfg.listenAddress}:${toString cfg.listenPort}')
+    ${cfg.extraConfig}
+    '';
+in {
+  options = {
+    services.dnsdist = {
+      enable = mkEnableOption "dnsdist domain name server";
+
+      listenAddress = mkOption {
+        type = types.str;
+        description = "Listen IP Address";
+        default = "0.0.0.0";
+      };
+      listenPort = mkOption {
+        type = types.int;
+        description = "Listen port";
+        default = 53;
+      };
+
+      extraConfig = mkOption {
+        type = types.lines;
+        default = ''
+        '';
+        description = ''
+          Extra lines to be added verbatim to dnsdist.conf.
+        '';
+      };
+    };
+  };
+
+  config = mkIf config.services.dnsdist.enable {
+    systemd.services.dnsdist = {
+      description = "dnsdist load balancer";
+      wantedBy = [ "multi-user.target" ];
+      after = ["network.target"];
+
+      serviceConfig = {
+        Restart="on-failure";
+        RestartSec="1";
+        DynamicUser = true;
+        StartLimitInterval="0";
+        PrivateTmp=true;
+        PrivateDevices=true;
+        CapabilityBoundingSet="CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID";
+        ExecStart = "${pkgs.dnsdist}/bin/dnsdist --supervised --disable-syslog --config ${configFile}";
+        ProtectSystem="full";
+        ProtectHome=true;
+        RestrictAddressFamilies="AF_UNIX AF_INET AF_INET6";
+        LimitNOFILE="16384";
+        TasksMax="8192";
+      };
+    };
+  };
+}

nixos/modules/services/networking/tinc.nix

@@ -163,12 +163,7 @@ in
         wantedBy = [ "multi-user.target" ];
         after = [ "network.target" ];
         path = [ data.package ];
-        restartTriggers =
+        restartTriggers = [ config.environment.etc."tinc/${network}/tinc.conf".source ];
-          let
-            drvlist = [ config.environment.etc."tinc/${network}/tinc.conf".source ]
-                        ++ mapAttrsToList (host: _: config.environment.etc."tinc/${network}/hosts/${host}".source) data.hosts;
-          in # drvlist might be too long to be used directly
-            [ (builtins.hashString "sha256" (concatMapStrings (d: d.outPath) drvlist)) ];
         serviceConfig = {
           Type = "simple";
           Restart = "always";
@@ -207,7 +202,8 @@ in
           ${concatStringsSep "\n" (mapAttrsToList (network: data:
             optionalString (versionAtLeast data.package.version "1.1pre") ''
               makeWrapper ${data.package}/bin/tinc "$out/bin/tinc.${network}" \
-                --add-flags "--pidfile=/run/tinc.${network}.pid"
+                --add-flags "--pidfile=/run/tinc.${network}.pid" \
+                --add-flags "--config=/etc/tinc/${network}"
             '') cfg.networks)}
         '';
       };

nixos/tests/morty.nix

@@ -22,9 +22,9 @@ import ./make-test.nix ({ pkgs, ... }:
   testScript =
     { nodes , ... }:
     ''
-      startAll;
+      $mortyProxyWithKey->waitForUnit("default.target");
 
-      $mortyProxyWithKey->waitForUnit("morty");
+      $mortyProxyWithKey->waitForOpenPort(3001);
       $mortyProxyWithKey->succeed("curl -L 127.0.0.1:3001 | grep MortyProxy");
 
     '';

pkgs/applications/altcoins/go-ethereum.nix

@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "go-ethereum-${version}";
-  version = "1.8.10";
+  version = "1.8.11";
   goPackagePath = "github.com/ethereum/go-ethereum";
 
   # Fix for usb-related segmentation faults on darwin
@@ -27,7 +27,7 @@ buildGoPackage rec {
     owner = "ethereum";
     repo = "go-ethereum";
     rev = "v${version}";
-    sha256 = "1n36pz4y3xa4d46mynym98bra79qx5n9lb29chyxfpvi5fmprdg1";
+    sha256 = "1b4za0hszb95jnj97g4xkrgcl0bydllznm0wj6rpi6cwmdr0h8na";
   };
 
   meta = with stdenv.lib; {

pkgs/applications/audio/yoshimi/default.nix

@@ -6,11 +6,11 @@ assert stdenv ? glibc;
 
 stdenv.mkDerivation  rec {
   name = "yoshimi-${version}";
-  version = "1.5.8";
+  version = "1.5.8.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/yoshimi/${name}.tar.bz2";
-    sha256 = "0gwsr5srzy28hwqhfzrc8pswysmyra8kbww3bxfx8bq4mdjifdj6";
+    sha256 = "1kg7d6mnzdwzsqhrf7pmrf1hzgfpbpm5lv8xkaz32wiv391qrnxc";
   };
 
   buildInputs = [

pkgs/applications/networking/browsers/chromium/common.nix

@@ -149,6 +149,7 @@ let
       ./patches/nix_plugin_paths_52.patch
     ]  ++ optionals (versionAtLeast version "68") [
       ./patches/nix_plugin_paths_68.patch
+      (githubPatch "56cb5f7da1025f6db869e840ed34d3b98b9ab899" "04mp5r1yvdvdx6m12g3lw3z51bzh7m3gr73mhblkn4wxdbvi3dcs")
     ] ++ optional enableWideVine ./patches/widevine.patch;
 
     postPatch = ''

pkgs/applications/networking/browsers/chromium/upstream-info.nix

@@ -1,18 +1,18 @@
 # This file is autogenerated from update.sh in the same directory.
 {
   beta = {
-    sha256 = "03bpznpnr22lphixvvc1cr0pn4p7fxjlz0wwysjw9j7i5y9n7vnm";
+    sha256 = "1jfhdisp4j6rrb8zxj2am7vlkjfbwvq1si7cacjwfy624hlhxpxz";
-    sha256bin64 = "06gmn0clhll91pmph07db043006gf2x6nfgxlir4qwqsj2qgdch0";
+    sha256bin64 = "0j3aw4zyg0alizgh73dp3fz8f6y71srdkycnzjm037p3p8m364j1";
-    version = "67.0.3396.62";
+    version = "68.0.3440.17";
   };
   dev = {
-    sha256 = "0hy36r938k6c89alam4a8yy2wynnlcc0zqhhb0jgy3qlnqrksvrc";
+    sha256 = "0acgpi7slwvq5lxaagmn57a6jpz508hwa690ypny8zlhsiaqlxaz";
-    sha256bin64 = "0liqgz8sip5fz5mxb54zagz3p8s24j96p26i5dql935bic7p3lhw";
+    sha256bin64 = "1vjmi9lm8xrkhmzv9sqnln867sm4b80y2z3djz7mj05hkzsb0zr9";
-    version = "68.0.3440.7";
+    version = "69.0.3452.0";
   };
   stable = {
-    sha256 = "03bpznpnr22lphixvvc1cr0pn4p7fxjlz0wwysjw9j7i5y9n7vnm";
+    sha256 = "07fvfarlzl4dcr0vbklzbg08iwvzfkczsqsg0d1p695q1hpsf9sx";
-    sha256bin64 = "16fljvrq2gcpjpyhf1w8s3rv805mknmy2i88n43v2cg7hl35241c";
+    sha256bin64 = "1c2xn84vs1v7gph7l4s408ml6l6c7lnlg4z2vcx20phxmlsgs1xg";
-    version = "67.0.3396.62";
+    version = "67.0.3396.87";
   };
 }

pkgs/applications/networking/cluster/kubernetes/default.nix

@@ -16,13 +16,13 @@ with lib;
 
 stdenv.mkDerivation rec {
   name = "kubernetes-${version}";
-  version = "1.10.3";
+  version = "1.10.4";
 
   src = fetchFromGitHub {
     owner = "kubernetes";
     repo = "kubernetes";
     rev = "v${version}";
-    sha256 = "1la9cdf5a67kg72xn4bn5mib1caiv5vxsjmnxqsmx0m7vhbv5i4n";
+    sha256 = "0q1llnqy83fkx3vhcfjyl3frd41h7g1cvl38lfhsz1z1v9av3bpd";
   };
 
   # Build using golang v1.9 in accordance with https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.10.md#external-dependencies

pkgs/applications/networking/instant-messengers/dino/default.nix

@@ -13,13 +13,13 @@
  }:
 
 stdenv.mkDerivation rec {
-  name = "dino-unstable-2018-04-19";
+  name = "dino-unstable-2018-06-03";
 
   src = fetchFromGitHub {
     owner = "dino";
     repo = "dino";
-    rev = "e80da806022d8aaa32f77f3c7f0333cc1c80829b";
+    rev = "52e116ee44be1667660c08858a28fe8fda125f79";
-    sha256 = "04z4k1s4ck6vmbzlbpiw096ny0wpj4zi3cd0iv9vb2iwdj22gibm";
+    sha256 = "1yybmjd50r41366clrsw21qybbpjfkvim2n5b3dkcagjnifak0zl";
     fetchSubmodules = true;
   };
 

pkgs/applications/networking/instant-messengers/mattermost-desktop/default.nix

@@ -0,0 +1,81 @@
+{ stdenv, lib, fetchurl, gnome2, atk, cairo, gdk_pixbuf, glib, freetype,
+fontconfig, dbus, libX11, xorg, libXi, libXcursor, libXdamage, libXrandr,
+libXcomposite, libXext, libXfixes, libXrender, libXtst, libXScrnSaver, nss,
+nspr, alsaLib, cups, expat, udev }:
+let
+  rpath = lib.makeLibraryPath [
+    alsaLib
+    atk
+    cairo
+    cups
+    dbus
+    expat
+    fontconfig
+    freetype
+    gdk_pixbuf
+    glib
+    gnome2.GConf
+    gnome2.gtk
+    gnome2.pango
+    libX11
+    libXScrnSaver
+    libXcomposite
+    libXcursor
+    libXdamage
+    libXext
+    libXfixes
+    libXi
+    libXrandr
+    libXrender
+    libXtst
+    nspr
+    nss
+    stdenv.cc.cc
+    udev
+    xorg.libxcb
+  ];
+
+in
+  stdenv.mkDerivation rec {
+    name = "mattermost-desktop-${version}";
+    version = "4.1.1";
+
+    src =
+      if stdenv.system == "x86_64-linux" then
+        fetchurl {
+          url = "https://releases.mattermost.com/desktop/${version}/${name}-linux-x64.tar.gz";
+          sha256 = "0kq89xylfv2rfmd4wj08d02gjzywlq1p8xmk313i58334xm7srja";
+        }
+      else if stdenv.system == "i686-linux" then
+        fetchurl {
+          url = "https://releases.mattermost.com/desktop/${version}/${name}-linux-ia32.tar.gz";
+          sha256 = "1jiknxpb44bhxrl0xa57kf3wxlzifbpnn3vblp8l4pr2wx146pzx";
+        }
+      else
+        throw "Mattermost-Desktop is not currently supported on ${stdenv.system}";
+
+    phases = [ "unpackPhase" "installPhase" ];
+    installPhase = ''
+      mkdir -p $out
+      cp -R . $out
+
+      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+               --set-rpath ${rpath}:$out $out/mattermost-desktop
+
+      patchShebangs $out/create_desktop_file.sh
+      $out/create_desktop_file.sh
+
+      mkdir -p $out/{bin,share/applications}
+      cp Mattermost.desktop $out/share/applications/Mattermost.desktop
+      ln -s $out/mattermost-desktop $out/bin/mattermost-desktop
+    '';
+
+    meta = {
+      description = "Mattermost Desktop client";
+      homepage    = https://about.mattermost.com/;
+      license     = lib.licenses.asl20;
+      platforms   = [
+        "x86_64-linux" "i686-linux"
+      ];
+    };
+  }

pkgs/applications/networking/irc/weechat/default.nix

@@ -117,7 +117,7 @@ in if configure == null then weechat else
         ln -s $plugin $out/plugins
       done
     '';
-  in (writeScriptBin weechat.name ''
+  in (writeScriptBin "weechat" ''
     #!${stdenv.shell}
     export WEECHAT_EXTRA_LIBDIR=${pluginsDir}
     ${lib.concatMapStringsSep "\n" (p: lib.optionalString (p ? extraEnv) p.extraEnv) plugins}

pkgs/applications/science/electronics/kicad/unstable.nix

@@ -12,13 +12,13 @@ assert ngspiceSupport -> libngspice != null;
 with lib;
 stdenv.mkDerivation rec {
   name = "kicad-unstable-${version}";
-  version = "2018-03-10";
+  version = "2018-06-12";
 
   src = fetchFromGitHub {
     owner = "KICad";
     repo = "kicad-source-mirror";
-    rev = "17c0917dac12ea0be50ff95cee374a0cd8b7f862";
+    rev = "bc7bd107d980da147ad515aeae0469ddd55c2368";
-    sha256 = "1yn5hj5hjnpb5fkzzlyawg62a96fbfvha49395s22dcp95riqvf0";
+    sha256 = "11nsx52pd3jr2wbzr11glmcs1a9r7z1mqkqx6yvlm0awbgd8qlv8";
   };
 
   postPatch = ''
@@ -38,7 +38,8 @@ stdenv.mkDerivation rec {
       "-DCMAKE_CXX_FLAGS=-I${wxPython}/include/wx-3.0"
     ];
 
-  nativeBuildInputs = [ cmake doxygen  pkgconfig ];
+  # https://www.mail-archive.com/kicad-developers@lists.launchpad.net/msg29840.html
+  nativeBuildInputs = [ (cmake.override {majorVersion = "3.10";}) doxygen  pkgconfig ];
   buildInputs = [
     libGLU_combined zlib libX11 wxGTK pcre libXdmcp gettext glew glm libpthreadstubs
     cairo curl openssl boost

pkgs/applications/science/electronics/ngspice/default.nix

@@ -1,4 +1,5 @@
-{stdenv, fetchurl, readline, bison, flex, libX11, libICE, libXaw, libXext, fftw}:
+{stdenv, fetchurl, bison, flex
+, readline, libX11, libICE, libXaw, libXmu, libXext, libXt, fftw }:
 
 stdenv.mkDerivation {
   name = "ngspice-28";
@@ -9,7 +10,7 @@ stdenv.mkDerivation {
   };
 
   nativeBuildInputs = [ flex bison ];
-  buildInputs = [ readline libX11 libICE libXaw libXext fftw ];
+  buildInputs = [ readline libX11 libICE libXaw libXmu libXext libXt fftw ];
 
   configureFlags = [ "--enable-x" "--with-x" "--with-readline" "--enable-xspice" "--enable-cider" ];
 

pkgs/applications/science/electronics/xcircuit/default.nix

@@ -0,0 +1,31 @@
+{ stdenv, fetchurl, autoreconfHook, automake, pkgconfig
+, cairo, ghostscript, ngspice, tcl, tk, xorg, zlib }:
+
+let
+  version = "3.9.73";
+  name = "xcircuit-${version}";
+  inherit (stdenv.lib) getBin;
+
+in stdenv.mkDerivation {
+  inherit name version;
+
+  src = fetchurl {
+    url = "http://opencircuitdesign.com/xcircuit/archive/${name}.tgz";
+    sha256 = "1kj9hayipplzm4960kx48vxddqj154qnxkccaqj9cnkp62b7q3jg";
+  };
+
+  nativeBuildInputs = [ autoreconfHook automake pkgconfig ];
+  hardeningDisable = [ "format" ];
+
+  configureFlags = "--with-tcl=${tcl}/lib --with-tk=${tk}/lib --with-ngspice=${getBin ngspice}/bin/ngspice";
+
+  buildInputs = with xorg; [ cairo ghostscript libSM libXt libICE libX11 libXpm tcl tk zlib ];
+
+  meta = with stdenv.lib; {
+    description = "Generic drawing program tailored to circuit diagrams";
+    homepage = http://opencircuitdesign.com/xcircuit;
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.spacefrogg ];
+  };
+}

pkgs/build-support/trivial-builders.nix

@@ -72,6 +72,24 @@ rec {
       '';
     };
 
+  # Create a C binary
+  writeCBin = name: code:
+    runCommandCC name
+    {
+      inherit name code;
+      executable = true;
+      passAsFile = ["code"];
+      # Pointless to do this on a remote machine.
+      preferLocalBuild = true;
+      allowSubstitutes = false;
+    }
+    ''
+    n=$out/bin/$name
+    mkdir -p "$(dirname "$n")"
+    mv "$codePath" code.c
+    $CC -x c code.c -o "$n"
+    '';
+
   # Create a forest of symlinks to the files in `paths'.
   symlinkJoin =
     args_@{ name

pkgs/development/compilers/llvm/3.9/libc++abi.nix

@@ -5,7 +5,9 @@ stdenv.mkDerivation {
 
   src = fetch "libcxxabi" "1qi9q06zanqm8awzq83810avmvi52air6gr9zfip8mbg5viqn3cj";
 
-  buildInputs = [ cmake ] ++ stdenv.lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD) libunwind;
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = stdenv.lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD) libunwind;
 
   postUnpack = ''
     unpackFile ${libcxx.src}

pkgs/development/compilers/rust/binaryBuild.nix

@@ -70,7 +70,7 @@ rec {
       # Do NOT, I repeat, DO NOT use `wrapProgram` on $out/bin/rustc
       # (or similar) here. It causes strange effects where rustc loads
       # the wrong libraries in a bootstrap-build causing failures that
-      # are very hard to track dow. For details, see
+      # are very hard to track down. For details, see
       # https://github.com/rust-lang/rust/issues/34722#issuecomment-232164943
     '';
   };

pkgs/development/haskell-modules/generic-builder.nix

@@ -166,8 +166,14 @@ let
     "--configure-option=--host=${hostPlatform.config}"
   ] ++ crossCabalFlags);
 
+  useSeparateSetupDb = setupHaskellDepends != [] || isCross || isGhcjs;
+
   setupCompileFlags = [
-    (optionalString (!coreSetup) "-${nativePackageDbFlag}=$packageConfDir")
+    (optionalString (!coreSetup) "-${nativePackageDbFlag}=${
+      if useSeparateSetupDb
+      then "$setupPackageConfDir"
+      else "$packageConfDir"
+    }")
     (optionalString (isGhcjs || isHaLVM || versionOlder "7.8" ghc.version) "-j$NIX_BUILD_CORES")
     # https://github.com/haskell/cabal/issues/2398
     (optionalString (versionOlder "7.10" ghc.version && !isHaLVM) "-threaded")
@@ -205,9 +211,9 @@ let
 
   nativeGhcCommand = "${nativeGhc.targetPrefix}ghc";
 
-  buildPkgDb = ghcName: ''
+  buildPkgDb = ghcName: packageConfDir: ''
     if [ -d "$p/lib/${ghcName}/package.conf.d" ]; then
-      cp -f "$p/lib/${ghcName}/package.conf.d/"*.conf $packageConfDir/
+      cp -f "$p/lib/${ghcName}/package.conf.d/"*.conf ${packageConfDir}/
       continue
     fi
     if [ -d "$p/include" ]; then
@@ -264,7 +270,7 @@ stdenv.mkDerivation ({
     echo "Build with ${ghc}."
     ${optionalString (hasActiveLibrary && hyperlinkSource) "export PATH=${hscolour}/bin:$PATH"}
 
-  '' + (optionalString (setupHaskellDepends != []) ''
+  '' + (optionalString useSeparateSetupDb ''
     setupPackageConfDir="$TMPDIR/setup-package.conf.d"
     mkdir -p $setupPackageConfDir
   '') + ''
@@ -278,9 +284,9 @@ stdenv.mkDerivation ({
   # dependencies for the build machine.
   #
   # pkgs* arrays defined in stdenv/setup.hs
-  + (optionalString (setupHaskellDepends != []) ''
+  + (optionalString useSeparateSetupDb ''
     for p in "''${pkgsBuildBuild[@]}" "''${pkgsBuildHost[@]}" "''${pkgsBuildTarget[@]}"; do
-      ${buildPkgDb nativeGhc.name}
+      ${buildPkgDb nativeGhc.name "$setupPackageConfDir"}
     done
     ${nativeGhcCommand}-pkg --${nativePackageDbFlag}="$setupPackageConfDir" recache
   '')
@@ -288,7 +294,7 @@ stdenv.mkDerivation ({
     # For normal components
   + ''
     for p in "''${pkgsHostHost[@]}" "''${pkgsHostTarget[@]}"; do
-      ${buildPkgDb ghc.name}
+      ${buildPkgDb ghc.name "$packageConfDir"}
     done
   ''
   # only use the links hack if we're actually building dylibs. otherwise, the
@@ -323,11 +329,7 @@ stdenv.mkDerivation ({
     done
 
     echo setupCompileFlags: $setupCompileFlags
-    ${optionalString (setupHaskellDepends != [])
+    ${nativeGhcCommand} $setupCompileFlags --make -o Setup -odir $TMPDIR -hidir $TMPDIR $i
-       ''
-       echo GHC_PACKAGE_PATH="$setupPackageConfDir:"
-       GHC_PACKAGE_PATH="$setupPackageConfDir:" ''
-    }${nativeGhcCommand} $setupCompileFlags --make -o Setup -odir $TMPDIR -hidir $TMPDIR $i
 
     runHook postCompileBuildDriver
   '';

pkgs/development/tools/build-managers/bazel/default.nix

@@ -1,7 +1,9 @@
-{ stdenv, lib, fetchurl, jdk, zip, unzip, bash, writeScriptBin, coreutils, makeWrapper, which, python
+{ stdenv, lib, fetchurl, jdk, zip, unzip, bash, writeCBin, coreutils, makeWrapper, which, python
 # Always assume all markers valid (don't redownload dependencies).
 # Also, don't clean up environment variables.
 , enableNixHacks ? false
+# Apple dependencies
+, libcxx, CoreFoundation, CoreServices, Foundation
 }:
 
 stdenv.mkDerivation rec {
@@ -13,7 +15,7 @@ stdenv.mkDerivation rec {
     description = "Build tool that builds code quickly and reliably";
     license = licenses.asl20;
     maintainers = [ maintainers.philandstuff ];
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
   };
 
   name = "bazel-${version}";
@@ -29,9 +31,30 @@ stdenv.mkDerivation rec {
 
   # Bazel expects several utils to be available in Bash even without PATH. Hence this hack.
 
-  customBash = writeScriptBin "bash" ''
+  customBash = writeCBin "bash" ''
-    #!${stdenv.shell}
+    #include <stdio.h>
-    PATH="$PATH:${lib.makeBinPath [ coreutils ]}" exec ${bash}/bin/bash "$@"
+    #include <stdlib.h>
+    #include <string.h>
+    #include <unistd.h>
+
+    extern char **environ;
+
+    int main(int argc, char *argv[]) {
+      printf("environ: %s\n", environ[0]);
+      char *path = getenv("PATH");
+      char *pathToAppend = "${lib.makeBinPath [ coreutils ]}";
+      char *newPath;
+      if (path != NULL) {
+        int length = strlen(path) + 1 + strlen(pathToAppend) + 1;
+        newPath = malloc(length * sizeof(char));
+        snprintf(newPath, length, "%s:%s", path, pathToAppend);
+      } else {
+        newPath = pathToAppend;
+      }
+      setenv("PATH", newPath, 1);
+      execve("${bash}/bin/bash", argv, environ);
+      return 0;
+    }
   '';
 
   postPatch = ''
@@ -54,7 +77,7 @@ stdenv.mkDerivation rec {
     makeWrapper
     which
     customBash
-  ];
+  ] ++ lib.optionals (stdenv.isDarwin) [ libcxx CoreFoundation CoreServices Foundation ];
 
   # If TMPDIR is in the unpack dir we run afoul of blaze's infinite symlink
   # detector (see com.google.devtools.build.lib.skyframe.FileFunction).

pkgs/development/tools/packer/default.nix

@@ -1,7 +1,7 @@
 { stdenv, buildGoPackage, fetchFromGitHub }:
 buildGoPackage rec {
   name = "packer-${version}";
-  version = "1.2.0";
+  version = "1.2.4";
 
   goPackagePath = "github.com/hashicorp/packer";
 
@@ -11,7 +11,7 @@ buildGoPackage rec {
     owner = "hashicorp";
     repo = "packer";
     rev = "v${version}";
-    sha256 = "05qsyh6d4qsvabr543ggd4b09fipxzr270cawsx0glmkgw82nkzi";
+    sha256 = "06prn2mq199476zlxi5hxk5yn21mqzbqk8v0fy8s6h91g8h6205n";
   };
 
   meta = with stdenv.lib; {

pkgs/development/tools/remarshal/default.nix

@@ -20,6 +20,5 @@ python3Packages.buildPythonApplication rec {
     license = licenses.mit;
     homepage = https://github.com/dbohdan/remarshal;
     maintainers = with maintainers; [ offline ];
-    platforms = platforms.linux;
   };
 }

pkgs/development/tools/yarn/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "yarn-${version}";
-  version = "1.7.0";
+  version = "1.8.0";
 
   src = fetchzip {
     url = "https://github.com/yarnpkg/yarn/releases/download/v${version}/yarn-v${version}.tar.gz";
-    sha256 = "00fxihv9ih40k6f21a7hb6vkx4h4m6ks0fbai5h9ssi0p4m5j3by";
+    sha256 = "145z9i935kab5pv3pldgs3b1i9ppplc928c71c2lbz8my1z6j77w";
   };
 
   buildInputs = [makeWrapper nodejs];

pkgs/development/tools/yq/default.nix

@@ -2,7 +2,7 @@
 
 buildPythonApplication rec {
   pname = "yq";
-  version = "2.5.0";
+  version = "2.6.0";
 
   propagatedBuildInputs = [ pyyaml xmltodict jq ];
 
@@ -11,7 +11,7 @@ buildPythonApplication rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e9fd2aa32defcd051058e3b6f665873282aa4eed19e11b1db94fe70847535d4c";
+    sha256 = "0wyzg6lwxmzqsblljg9hddkadda7qdpw54sp0pmmbv89hhz7cky6";
   };
 
   meta = with lib; {

pkgs/misc/screensavers/xlockmore/default.nix

@@ -30,6 +30,8 @@ stdenv.mkDerivation rec {
       configureFlags+=" --enable-appdefaultdir=$out/share/X11/app-defaults"
     '';
 
+  hardeningDisable = [ "format" ]; # no build output otherwise
+
   meta = with lib; {
     description = "Screen locker for the X Window System";
     homepage = http://sillycycle.com/xlockmore.html;

pkgs/os-specific/linux/zfs/default.nix

@@ -6,6 +6,7 @@
 , zlib, libuuid, python, attr, openssl
 , libtirpc
 , nfs-utils
+, gawk, gnugrep, gnused, systemd
 
 # Kernel dependencies
 , kernel ? null, spl ? null, splUnstable ? null, splLegacyCrypto ? null
@@ -82,6 +83,9 @@ let
         do
           substituteInPlace "$f" --replace "/lib/udev/vdev_id" "$out/lib/udev/vdev_id"
         done
+        substituteInPlace ./cmd/vdev_id/vdev_id \
+          --replace "PATH=/bin:/sbin:/usr/bin:/usr/sbin" \
+          "PATH=${makeBinPath [ coreutils gawk gnused gnugrep systemd ]}"
 
         ./autogen.sh
         configureFlagsArray+=("--libexecdir=$out/libexec")

pkgs/servers/dns/powerdns/default.nix

@@ -47,6 +47,6 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     # cannot find postgresql libs on macos x
     license = licenses.gpl2;
-    maintainers = [ maintainers.mic92 ];
+    maintainers = with maintainers; [ mic92 disassembler ];
   };
 }

pkgs/tools/typesetting/tex/texlive/combine.nix

@@ -30,7 +30,7 @@ let
     pkgNeedsRuby = pkg: pkg.tlType == "run" && pkg.pname == "match-parens";
     extraInputs =
       lib.optional (lib.any pkgNeedsPython splitBin.wrong) python
-      ++ lib.optional (lib.any pkgNeedsPython splitBin.wrong) ruby;
+      ++ lib.optional (lib.any pkgNeedsRuby splitBin.wrong) ruby;
   };
 
   mkUniquePkgs = pkgs: fastUnique (a: b: a < b) # highlighting hack: >

pkgs/top-level/all-packages.nix

@@ -7711,7 +7711,9 @@ with pkgs;
   bam = callPackage ../development/tools/build-managers/bam {};
 
   bazel_0_4 = callPackage ../development/tools/build-managers/bazel/0.4.nix { };
-  bazel = callPackage ../development/tools/build-managers/bazel { };
+  bazel = callPackage ../development/tools/build-managers/bazel {
+    inherit (darwin.apple_sdk.frameworks) CoreFoundation CoreServices Foundation;
+  };
 
   bazel-buildtools = callPackage ../development/tools/build-managers/bazel/buildtools { };
   buildifier = bazel-buildtools;
@@ -12653,6 +12655,8 @@ with pkgs;
   matterircd = callPackage ../servers/mattermost/matterircd.nix { };
   matterbridge = callPackage ../servers/matterbridge { };
 
+  mattermost-desktop = callPackage ../applications/networking/instant-messengers/mattermost-desktop { };
+
   mediatomb = callPackage ../servers/mediatomb { };
 
   meguca = callPackage ../servers/meguca { };
@@ -20491,6 +20495,7 @@ with pkgs;
 
   qucs = callPackage ../applications/science/electronics/qucs { };
 
+  xcircuit = callPackage ../applications/science/electronics/xcircuit { };
 
   xoscope = callPackage ../applications/science/electronics/xoscope { };