Merge branch 'master' into staging

.github/CONTRIBUTING.md

@@ -32,4 +32,4 @@ See the nixpkgs manual for more details on how to [Submit changes to nixpkgs](ht
 
 ## Reviewing contributions
 
-See the nixpkgs manual for more details on how to [Review contributions](http://hydra.nixos.org/job/nixpkgs/trunk/manual/latest/download-by-type/doc/manual#chap-reviewing-contributions).
+See the nixpkgs manual for more details on how to [Review contributions](https://nixos.org/nixpkgs/manual/#sec-reviewing-contributions).

.mention-bot

@@ -1,7 +1,8 @@
 {
   "userBlacklist": [
     "civodul",
-    "jhasse"
+    "jhasse",
+    "shlevy"
   ],
   "alwaysNotifyForPaths": [
     { "name": "FRidh", "files": ["pkgs/top-level/python-packages.nix", "pkgs/development/interpreters/python/*", "pkgs/development/python-modules/*" ] },

nixos/lib/make-squashfs.nix

@@ -25,6 +25,6 @@ stdenv.mkDerivation {
 
       # Generate the squashfs image.
       mksquashfs nix-path-registration $storePaths $out \
-        -keep-as-directory -all-root
+        -keep-as-directory -all-root -comp xz
     '';
 }

nixos/modules/profiles/base.nix

@@ -7,7 +7,7 @@
   # Include some utilities that are useful for installing or repairing
   # the system.
   environment.systemPackages = [
-    pkgs.w3m # needed for the manual anyway
+    pkgs.w3m-nox # needed for the manual anyway
     pkgs.testdisk # useful for repairing boot problems
     pkgs.mssys # for writing Microsoft boot sectors / MBRs
     pkgs.efibootmgr
@@ -42,8 +42,6 @@
     # Some compression/archiver tools.
     pkgs.unzip
     pkgs.zip
-    pkgs.dar # disk archiver
-    pkgs.cabextract
   ];
 
   # Include support for various filesystems.

nixos/modules/profiles/minimal.nix

@@ -14,4 +14,6 @@ with lib;
 
   programs.man.enable = mkDefault false;
   programs.info.enable = mkDefault false;
+
+  sound.enable = mkDefault false;
 }

nixos/modules/services/cluster/kubernetes.nix

@@ -5,28 +5,62 @@ with lib;
 let
   cfg = config.services.kubernetes;
 
+  skipAttrs = attrs: map (filterAttrs (k: v: k != "enable"))
+    (filter (v: !(hasAttr "enable" v) || v.enable) attrs);
+
+  infraContainer = pkgs.dockerTools.buildImage {
+    name = "pause";
+    tag = "latest";
+    contents = cfg.package.pause;
+    config.Cmd = "/bin/pause";
+  };
+
+  kubeconfig = pkgs.writeText "kubeconfig" (builtins.toJSON {
+    apiVersion = "v1";
+    kind = "Config";
+    clusters = [{
+      name = "local";
+      cluster.certificate-authority = cfg.kubeconfig.caFile;
+      cluster.server = cfg.kubeconfig.server;
+    }];
+    users = [{
+      name = "kubelet";
+      user = {
+        client-certificate = cfg.kubeconfig.certFile;
+        client-key = cfg.kubeconfig.keyFile;
+      };
+    }];
+    contexts = [{
+      context = {
+        cluster = "local";
+        user = "kubelet";
+      };
+      current-context = "kubelet-context";
+    }];
+  });
+
+  policyFile = pkgs.writeText "kube-policy"
+    concatStringsSep "\n" (map (builtins.toJSON cfg.apiserver.authorizationPolicy));
+
+  cniConfig = pkgs.buildEnv {
+    name = "kubernetes-cni-config";
+    paths = imap (i: entry:
+      pkgs.writeTextDir "${10+i}-${entry.type}.conf" (builtins.toJSON entry)
+    ) cfg.kubelet.cni.config;
+  };
+
+  manifests = pkgs.buildEnv {
+    name = "kubernetes-manifests";
+    paths = mapAttrsToList (name: manifest:
+      pkgs.writeTextDir "${name}.json" (builtins.toJSON manifest)
+    ) cfg.kubelet.manifests;
+  };
+
 in {
 
   ###### interface
 
   options.services.kubernetes = {
-    package = mkOption {
-      description = "Kubernetes package to use.";
-      type = types.package;
-    };
-
-    verbose = mkOption {
-      description = "Kubernetes enable verbose mode for debugging";
-      default = false;
-      type = types.bool;
-    };
-
-    etcdServers = mkOption {
-      description = "Kubernetes list of etcd servers to watch.";
-      default = [ "127.0.0.1:2379" ];
-      type = types.listOf types.str;
-    };
-
     roles = mkOption {
       description = ''
         Kubernetes role that this machine should take.
@@ -38,18 +72,76 @@ in {
       type = types.listOf (types.enum ["master" "node"]);
     };
 
+    package = mkOption {
+      description = "Kubernetes package to use.";
+      type = types.package;
+      default = pkgs.kubernetes;
+    };
+
+    verbose = mkOption {
+      description = "Kubernetes enable verbose mode for debugging";
+      default = false;
+      type = types.bool;
+    };
+
+    etcd = {
+      servers = mkOption {
+        description = "List of etcd servers. By default etcd is started, except if this option is changed.";
+        default = ["http://127.0.0.1:2379"];
+        type = types.listOf types.str;
+      };
+
+      keyFile = mkOption {
+        description = "Etcd key file";
+        default = null;
+        type = types.nullOr types.path;
+      };
+
+      certFile = mkOption {
+        description = "Etcd cert file";
+        default = null;
+        type = types.nullOr types.path;
+      };
+
+      caFile = mkOption {
+        description = "Etcd ca file";
+        default = null;
+        type = types.nullOr types.path;
+      };
+    };
+
+    kubeconfig = {
+      server = mkOption {
+        description = "Kubernetes apiserver server address";
+        default = "http://${cfg.apiserver.address}:${toString cfg.apiserver.port}";
+        type = types.str;
+      };
+
+      caFile = mkOption {
+        description = "Certificate authrority file to use to connect to kuberentes apiserver";
+        type = types.nullOr types.path;
+        default = null;
+      };
+
+      certFile = mkOption {
+        description = "Client certificate file to use to connect to kubernetes";
+        type = types.nullOr types.path;
+        default = null;
+      };
+
+      keyFile = mkOption {
+        description = "Client key file to use to connect to kubernetes";
+        type = types.nullOr types.path;
+        default = null;
+      };
+    };
+
     dataDir = mkOption {
       description = "Kubernetes root directory for managing kubelet files.";
       default = "/var/lib/kubernetes";
       type = types.path;
     };
 
-    dockerCfg = mkOption {
-      description = "Kubernetes contents of dockercfg file.";
-      default = "";
-      type = types.lines;
-    };
-
     apiserver = {
       enable = mkOption {
         description = "Whether to enable kubernetes apiserver.";
@@ -72,6 +164,16 @@ in {
         type = types.str;
       };
 
+      advertiseAddress = mkOption {
+        description = ''
+          Kubernetes apiserver IP address on which to advertise the apiserver
+          to members of the cluster. This address must be reachable by the rest
+          of the cluster.
+        '';
+        default = null;
+        type = types.nullOr types.str;
+      };
+
       port = mkOption {
         description = "Kubernetes apiserver listening port.";
         default = 8080;
@@ -80,41 +182,36 @@ in {
 
       securePort = mkOption {
         description = "Kubernetes apiserver secure port.";
-        default = 6443;
+        default = 443;
         type = types.int;
       };
 
       tlsCertFile = mkOption {
         description = "Kubernetes apiserver certificate file.";
-        default = "";
+        default = null;
-        type = types.str;
+        type = types.nullOr types.path;
       };
 
-      tlsPrivateKeyFile = mkOption {
+      tlsKeyFile = mkOption {
         description = "Kubernetes apiserver private key file.";
-        default = "";
+        default = null;
-        type = types.str;
+        type = types.nullOr types.path;
       };
 
       clientCaFile = mkOption {
         description = "Kubernetes apiserver CA file for client auth.";
-        default = "";
+        default = null;
-        type = types.str;
+        type = types.nullOr types.path;
       };
 
       tokenAuth = mkOption {
         description = ''
           Kubernetes apiserver token authentication file. See
-          <link xlink:href="http://kubernetes.io/v1.0/docs/admin/authentication.html"/>
+          <link xlink:href="http://kubernetes.io/docs/admin/authentication.html"/>
         '';
-        default = {};
+        default = null;
-        example = literalExample ''
+        example = ''token,user,uid,"group1,group2,group3"'';
-          {
+        type = types.nullOr types.lines;
-            alice = "abc123";
-            bob = "xyz987";
-          }
-        '';
-        type = types.attrsOf types.str;
       };
 
       authorizationMode = mkOption {
@@ -148,13 +245,13 @@ in {
 
       allowPrivileged = mkOption {
         description = "Whether to allow privileged containers on kubernetes.";
-        default = false;
+        default = true;
         type = types.bool;
       };
 
       portalNet = mkOption {
         description = "Kubernetes CIDR notation IP range from which to assign portal IPs";
-        default = "10.10.10.10/16";
+        default = "10.10.10.10/24";
         type = types.str;
       };
 
@@ -171,9 +268,9 @@ in {
       admissionControl = mkOption {
         description = ''
           Kubernetes admission control plugins to use. See
-          <link xlink:href="http://kubernetes.io/v1.0/docs/admin/admission-controllers.html"/>
+          <link xlink:href="http://kubernetes.io/docs/admin/admission-controllers/"/>
         '';
-        default = ["AlwaysAdmit"];
+        default = ["NamespaceLifecycle" "LimitRanger" "ServiceAccount" "ResourceQuota"];
         example = [
           "NamespaceLifecycle" "NamespaceExists" "LimitRanger"
           "SecurityContextDeny" "ServiceAccount" "ResourceQuota"
@@ -181,15 +278,40 @@ in {
         type = types.listOf types.str;
       };
 
-      serviceAccountKey = mkOption {
+      serviceAccountKeyFile = mkOption {
         description = ''
           Kubernetes apiserver PEM-encoded x509 RSA private or public key file,
-          used to verify ServiceAccount tokens.
+          used to verify ServiceAccount tokens. By default tls private key file
+          is used.
         '';
         default = null;
         type = types.nullOr types.path;
       };
 
+      kubeletClientCaFile = mkOption {
+        description = "Path to a cert file for connecting to kubelet";
+        default = null;
+        type = types.nullOr types.path;
+      };
+
+      kubeletClientCertFile = mkOption {
+        description = "Client certificate to use for connections to kubelet";
+        default = null;
+        type = types.nullOr types.path;
+      };
+
+      kubeletClientKeyFile = mkOption {
+        description = "Key to use for connections to kubelet";
+        default = null;
+        type = types.nullOr types.path;
+      };
+
+      kubeletHttps = mkOption {
+        description = "Whether to use https for connections to kubelet";
+        default = true;
+        type = types.bool;
+      };
+
       extraOpts = mkOption {
         description = "Kubernetes apiserver extra command line options.";
         default = "";
@@ -216,10 +338,10 @@ in {
         type = types.int;
       };
 
-      master = mkOption {
+      leaderElect = mkOption {
-        description = "Kubernetes apiserver address";
+        description = "Whether to start leader election before executing main loop";
-        default = "${cfg.apiserver.address}:${toString cfg.apiserver.port}";
+        type = types.bool;
-        type = types.str;
+        default = false;
       };
 
       extraOpts = mkOption {
@@ -248,13 +370,13 @@ in {
         type = types.int;
       };
 
-      master = mkOption {
+      leaderElect = mkOption {
-        description = "Kubernetes apiserver address";
+        description = "Whether to start leader election before executing main loop";
-        default = "${cfg.apiserver.address}:${toString cfg.apiserver.port}";
+        type = types.bool;
-        type = types.str;
+        default = false;
       };
 
-      serviceAccountPrivateKey = mkOption {
+      serviceAccountKeyFile = mkOption {
         description = ''
           Kubernetes controller manager PEM-encoded private RSA key file used to
           sign service account tokens
@@ -272,6 +394,12 @@ in {
         type = types.nullOr types.path;
       };
 
+      clusterCidr = mkOption {
+        description = "Kubernetes controller manager CIDR Range for Pods in cluster";
+        default = "10.10.0.0/16";
+        type = types.str;
+      };
+
       extraOpts = mkOption {
         description = "Kubernetes controller manager extra command line options.";
         default = "";
@@ -292,6 +420,12 @@ in {
         type = types.bool;
       };
 
+      registerSchedulable = mkOption {
+        description = "Register the node as schedulable. No-op if register-node is false.";
+        default = true;
+        type = types.bool;
+      };
+
       address = mkOption {
         description = "Kubernetes kubelet info server listening address.";
         default = "0.0.0.0";
@@ -304,6 +438,18 @@ in {
         type = types.int;
       };
 
+      tlsCertFile = mkOption {
+        description = "File containing x509 Certificate for HTTPS.";
+        default = null;
+        type = types.nullOr types.path;
+      };
+
+      tlsKeyFile = mkOption {
+        description = "File containing x509 private key matching tlsCertFile.";
+        default = null;
+        type = types.nullOr types.path;
+      };
+
       healthz = {
         bind = mkOption {
           description = "Kubernetes kubelet healthz listening address.";
@@ -326,19 +472,10 @@ in {
 
       allowPrivileged = mkOption {
         description = "Whether to allow kubernetes containers to request privileged mode.";
-        default = false;
+        default = true;
         type = types.bool;
       };
 
-      apiServers = mkOption {
-        description = ''
-          Kubernetes kubelet list of Kubernetes API servers for publishing events,
-          and reading pods and services.
-        '';
-        default = ["${cfg.apiserver.address}:${toString cfg.apiserver.port}"];
-        type = types.listOf types.str;
-      };
-
       cadvisorPort = mkOption {
         description = "Kubernetes kubelet local cadvisor port.";
         default = 4194;
@@ -347,16 +484,62 @@ in {
 
       clusterDns = mkOption {
         description = "Use alternative dns.";
-        default = "";
+        default = "10.10.1.1";
         type = types.str;
       };
 
       clusterDomain = mkOption {
         description = "Use alternative domain.";
-        default = "kubernetes.io";
+        default = "cluster.local";
         type = types.str;
       };
 
+      networkPlugin = mkOption {
+        description = "Network plugin to use by kubernetes";
+        type = types.nullOr (types.enum ["cni" "kubenet"]);
+        default = "kubenet";
+      };
+
+      cni = {
+        packages = mkOption {
+          description = "List of network plugin packages to install";
+          type = types.listOf types.package;
+          default = [];
+        };
+
+        config = mkOption {
+          description = "Kubernetes CNI configuration";
+          type = types.listOf types.attrs;
+          default = [];
+          example = literalExample ''
+            [{
+              "cniVersion": "0.2.0",
+              "name": "mynet",
+              "type": "bridge",
+              "bridge": "cni0",
+              "isGateway": true,
+              "ipMasq": true,
+              "ipam": {
+                  "type": "host-local",
+                  "subnet": "10.22.0.0/16",
+                  "routes": [
+                      { "dst": "0.0.0.0/0" }
+                  ]
+              }
+            } {
+              "cniVersion": "0.2.0",
+              "type": "loopback"
+            }]
+          '';
+        };
+      };
+
+      manifests = mkOption {
+        description = "List of manifests to bootstrap with kubelet";
+        type = types.attrsOf types.attrs;
+        default = {};
+      };
+
       extraOpts = mkOption {
         description = "Kubernetes kubelet extra command line options.";
         default = "";
@@ -377,12 +560,6 @@ in {
         type = types.str;
       };
 
-      master = mkOption {
-        description = "Kubernetes apiserver address";
-        default = "${cfg.apiserver.address}:${toString cfg.apiserver.port}";
-        type = types.str;
-      };
-
       extraOpts = mkOption {
         description = "Kubernetes proxy extra command line options.";
         default = "";
@@ -390,23 +567,23 @@ in {
       };
     };
 
-    kube2sky = {
+    dns = {
-      enable = mkEnableOption "Whether to enable kube2sky dns service.";
+      enable = mkEnableOption "kubernetes dns service.";
+
+      port = mkOption {
+        description = "Kubernetes dns listening port";
+        default = 53;
+        type = types.int;
+      };
 
       domain = mkOption  {
-        description = "Kuberntes kube2sky domain under which all DNS names will be hosted.";
+        description = "Kuberntes dns domain under which to create names.";
         default = cfg.kubelet.clusterDomain;
         type = types.str;
       };
 
-      master = mkOption {
-        description = "Kubernetes apiserver address";
-        default = "${cfg.apiserver.address}:${toString cfg.apiserver.port}";
-        type = types.str;
-      };
-
       extraOpts = mkOption {
-        description = "Kubernetes kube2sky extra command line options.";
+        description = "Kubernetes dns extra command line options.";
         default = "";
         type = types.str;
       };
@@ -416,50 +593,118 @@ in {
   ###### implementation
 
   config = mkMerge [
+    (mkIf cfg.kubelet.enable {
+      systemd.services.kubelet = {
+        description = "Kubernetes Kubelet Service";
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" "docker.service" "kube-apiserver.service" ];
+        path = with pkgs; [ gitMinimal openssh docker utillinux iproute ethtool thin-provisioning-tools iptables ];
+        preStart = ''
+          docker load < ${infraContainer}
+          rm /opt/cni/bin/* || true
+          ${concatMapStringsSep "\n" (p: "ln -fs ${p.plugins}/* /opt/cni/bin") cfg.kubelet.cni.packages}
+        '';
+        serviceConfig = {
+          ExecStart = ''${cfg.package}/bin/kubelet \
+            --pod-manifest-path=${manifests} \
+            --kubeconfig=${kubeconfig} \
+            --require-kubeconfig \
+            --address=${cfg.kubelet.address} \
+            --port=${toString cfg.kubelet.port} \
+            --register-node=${if cfg.kubelet.registerNode then "true" else "false"} \
+            --register-schedulable=${if cfg.kubelet.registerSchedulable then "true" else "false"} \
+            ${optionalString (cfg.kubelet.tlsCertFile != null)
+              "--tls-cert-file=${cfg.kubelet.tlsCertFile}"} \
+            ${optionalString (cfg.kubelet.tlsKeyFile != null)
+              "--tls-private-key-file=${cfg.kubelet.tlsKeyFile}"} \
+            --healthz-bind-address=${cfg.kubelet.healthz.bind} \
+            --healthz-port=${toString cfg.kubelet.healthz.port} \
+            --hostname-override=${cfg.kubelet.hostname} \
+            --allow-privileged=${if cfg.kubelet.allowPrivileged then "true" else "false"} \
+            --root-dir=${cfg.dataDir} \
+            --cadvisor_port=${toString cfg.kubelet.cadvisorPort} \
+            ${optionalString (cfg.kubelet.clusterDns != "")
+              "--cluster-dns=${cfg.kubelet.clusterDns}"} \
+            ${optionalString (cfg.kubelet.clusterDomain != "")
+              "--cluster-domain=${cfg.kubelet.clusterDomain}"} \
+            --pod-infra-container-image=pause \
+            ${optionalString (cfg.kubelet.networkPlugin != null)
+              "--network-plugin=${cfg.kubelet.networkPlugin}"} \
+            --cni-conf-dir=${cniConfig} \
+            --reconcile-cidr \
+            --hairpin-mode=hairpin-veth \
+            ${optionalString cfg.verbose "--v=6 --log_flush_frequency=1s"} \
+            ${cfg.kubelet.extraOpts}
+          '';
+          WorkingDirectory = cfg.dataDir;
+        };
+      };
+
+      environment.etc = mapAttrs' (name: manifest:
+        nameValuePair "kubernetes/manifests/${name}.json" {
+          text = builtins.toJSON manifest;
+          mode = "0755";
+        }
+      ) cfg.kubelet.manifests;
+
+      # Allways include cni plugins
+      services.kubernetes.kubelet.cni.packages = [pkgs.cni];
+    })
+
     (mkIf cfg.apiserver.enable {
       systemd.services.kube-apiserver = {
-        description = "Kubernetes Api Server";
+        description = "Kubernetes Kubelet Service";
         wantedBy = [ "multi-user.target" ];
-        requires = ["kubernetes-setup.service"];
+        after = [ "network.target" "docker.service" ];
-        after = [ "network.target" "etcd.service" "kubernetes-setup.service" ];
         serviceConfig = {
-          ExecStart = let
+          ExecStart = ''${cfg.package}/bin/kube-apiserver \
-            authorizationPolicyFile =
+            --etcd-servers=${concatStringsSep "," cfg.etcd.servers} \
-              pkgs.writeText "kubernetes-policy"
+            ${optionalString (cfg.etcd.caFile != null)
-                (builtins.toJSON cfg.apiserver.authorizationPolicy);
+              "--etcd-cafile=${cfg.etcd.caFile}"} \
-            tokenAuthFile =
+            ${optionalString (cfg.etcd.certFile != null)
-              pkgs.writeText "kubernetes-auth"
+              "--etcd-certfile=${cfg.etcd.certFile}"} \
-                (concatImapStringsSep "\n" (i: v: v + "," + (toString i))
+            ${optionalString (cfg.etcd.keyFile != null)
-                    (mapAttrsToList (name: token: token + "," + name) cfg.apiserver.tokenAuth));
+              "--etcd-keyfile=${cfg.etcd.keyFile}"} \
-          in ''${cfg.package}/bin/kube-apiserver \
-            --etcd-servers=${concatMapStringsSep "," (f: "http://${f}") cfg.etcdServers} \
-            --insecure-bind-address=${cfg.apiserver.address} \
             --insecure-port=${toString cfg.apiserver.port} \
-            --bind-address=${cfg.apiserver.publicAddress} \
+            --bind-address=0.0.0.0 \
+            ${optionalString (cfg.apiserver.advertiseAddress != null)
+              "--advertise-address=${cfg.apiserver.advertiseAddress}"} \
             --allow-privileged=${if cfg.apiserver.allowPrivileged then "true" else "false"} \
-            ${optionalString (cfg.apiserver.tlsCertFile!="")
+            ${optionalString (cfg.apiserver.tlsCertFile != null)
               "--tls-cert-file=${cfg.apiserver.tlsCertFile}"} \
-            ${optionalString (cfg.apiserver.tlsPrivateKeyFile!="")
+            ${optionalString (cfg.apiserver.tlsKeyFile != null)
-              "--tls-private-key-file=${cfg.apiserver.tlsPrivateKeyFile}"} \
+              "--tls-private-key-file=${cfg.apiserver.tlsKeyFile}"} \
-            ${optionalString (cfg.apiserver.tokenAuth!=[])
+            ${optionalString (cfg.apiserver.tokenAuth != null)
-              "--token-auth-file=${tokenAuthFile}"} \
+              "--token-auth-file=${cfg.apiserver.tokenAuth}"} \
-            ${optionalString (cfg.apiserver.clientCaFile!="")
+            --kubelet-https=${if cfg.apiserver.kubeletHttps then "true" else "false"} \
+            ${optionalString (cfg.apiserver.kubeletClientCaFile != null)
+              "--kubelet-certificate-authority=${cfg.apiserver.kubeletClientCaFile}"} \
+            ${optionalString (cfg.apiserver.kubeletClientCertFile != null)
+              "--kubelet-client-certificate=${cfg.apiserver.kubeletClientCertFile}"} \
+            ${optionalString (cfg.apiserver.kubeletClientKeyFile != null)
+              "--kubelet-client-key=${cfg.apiserver.kubeletClientKeyFile}"} \
+            ${optionalString (cfg.apiserver.clientCaFile != null)
               "--client-ca-file=${cfg.apiserver.clientCaFile}"} \
             --authorization-mode=${cfg.apiserver.authorizationMode} \
             ${optionalString (cfg.apiserver.authorizationMode == "ABAC")
-              "--authorization-policy-file=${authorizationPolicyFile}"} \
+              "--authorization-policy-file=${policyFile}"} \
             --secure-port=${toString cfg.apiserver.securePort} \
             --service-cluster-ip-range=${cfg.apiserver.portalNet} \
-            ${optionalString (cfg.apiserver.runtimeConfig!="")
+            ${optionalString (cfg.apiserver.runtimeConfig != "")
               "--runtime-config=${cfg.apiserver.runtimeConfig}"} \
             --admission_control=${concatStringsSep "," cfg.apiserver.admissionControl} \
-            ${optionalString (cfg.apiserver.serviceAccountKey!=null)
+            ${optionalString (cfg.apiserver.serviceAccountKeyFile!=null)
-              "--service-account-key-file=${cfg.apiserver.serviceAccountKey}"} \
+              "--service-account-key-file=${cfg.apiserver.serviceAccountKeyFile}"} \
-            --logtostderr=true \
+            ${optionalString cfg.verbose "--v=6"} \
-            ${optionalString cfg.verbose "--v=6 --log-flush-frequency=1s"} \
+            ${optionalString cfg.verbose "--log-flush-frequency=1s"} \
             ${cfg.apiserver.extraOpts}
           '';
+          WorkingDirectory = cfg.dataDir;
           User = "kubernetes";
+          Group = "kubernetes";
+          AmbientCapabilities = "cap_net_bind_service";
+          Restart = "on-failure";
+          RestartSec = 5;
         };
       };
     })
@@ -468,17 +713,20 @@ in {
       systemd.services.kube-scheduler = {
         description = "Kubernetes Scheduler Service";
         wantedBy = [ "multi-user.target" ];
-        after = [ "network.target" "kubernetes-apiserver.service" ];
+        after = [ "kube-apiserver.service" ];
         serviceConfig = {
           ExecStart = ''${cfg.package}/bin/kube-scheduler \
             --address=${cfg.scheduler.address} \
             --port=${toString cfg.scheduler.port} \
-            --master=${cfg.scheduler.master} \
+            --leader-elect=${if cfg.scheduler.leaderElect then "true" else "false"} \
-            --logtostderr=true \
+            --kubeconfig=${kubeconfig} \
-            ${optionalString cfg.verbose "--v=6 --log-flush-frequency=1s"} \
+            ${optionalString cfg.verbose "--v=6"} \
+            ${optionalString cfg.verbose "--log-flush-frequency=1s"} \
             ${cfg.scheduler.extraOpts}
           '';
+          WorkingDirectory = cfg.dataDir;
           User = "kubernetes";
+          Group = "kubernetes";
         };
       };
     })
@@ -487,113 +735,94 @@ in {
       systemd.services.kube-controller-manager = {
         description = "Kubernetes Controller Manager Service";
         wantedBy = [ "multi-user.target" ];
-        after = [ "network.target" "kubernetes-apiserver.service" ];
+        after = [ "kube-apiserver.service" ];
         serviceConfig = {
           ExecStart = ''${cfg.package}/bin/kube-controller-manager \
             --address=${cfg.controllerManager.address} \
             --port=${toString cfg.controllerManager.port} \
-            --master=${cfg.controllerManager.master} \
+            --kubeconfig=${kubeconfig} \
-            ${optionalString (cfg.controllerManager.serviceAccountPrivateKey!=null)
+            --leader-elect=${if cfg.controllerManager.leaderElect then "true" else "false"} \
-              "--service-account-private-key-file=${cfg.controllerManager.serviceAccountPrivateKey}"} \
+            ${if (cfg.controllerManager.serviceAccountKeyFile!=null)
+              then "--service-account-private-key-file=${cfg.controllerManager.serviceAccountKeyFile}"
+              else "--service-account-private-key-file=/var/run/kubernetes/apiserver.key"} \
             ${optionalString (cfg.controllerManager.rootCaFile!=null)
               "--root-ca-file=${cfg.controllerManager.rootCaFile}"} \
-            --logtostderr=true \
+            ${optionalString (cfg.controllerManager.clusterCidr!=null)
-            ${optionalString cfg.verbose "--v=6 --log-flush-frequency=1s"} \
+              "--cluster-cidr=${cfg.controllerManager.clusterCidr}"} \
+            --allocate-node-cidrs=true \
+            ${optionalString cfg.verbose "--v=6"} \
+            ${optionalString cfg.verbose "--log-flush-frequency=1s"} \
             ${cfg.controllerManager.extraOpts}
           '';
+          WorkingDirectory = cfg.dataDir;
           User = "kubernetes";
+          Group = "kubernetes";
         };
       };
     })
 
-    (mkIf cfg.kubelet.enable {
-      systemd.services.kubelet = {
-        description = "Kubernetes Kubelet Service";
-        wantedBy = [ "multi-user.target" ];
-        requires = ["kubernetes-setup.service"];
-        after = [ "network.target" "etcd.service" "docker.service" "kubernetes-setup.service" ];
-        path = [ pkgs.gitMinimal pkgs.openssh ];
-        script = ''
-          export PATH="/bin:/sbin:/usr/bin:/usr/sbin:$PATH"
-          exec ${cfg.package}/bin/kubelet \
-            --api-servers=${concatMapStringsSep "," (f: "http://${f}") cfg.kubelet.apiServers}  \
-            --register-node=${if cfg.kubelet.registerNode then "true" else "false"} \
-            --address=${cfg.kubelet.address} \
-            --port=${toString cfg.kubelet.port} \
-            --healthz-bind-address=${cfg.kubelet.healthz.bind} \
-            --healthz-port=${toString cfg.kubelet.healthz.port} \
-            --hostname-override=${cfg.kubelet.hostname} \
-            --allow-privileged=${if cfg.kubelet.allowPrivileged then "true" else "false"} \
-            --root-dir=${cfg.dataDir} \
-            --cadvisor_port=${toString cfg.kubelet.cadvisorPort} \
-            ${optionalString (cfg.kubelet.clusterDns != "")
-                ''--cluster-dns=${cfg.kubelet.clusterDns}''} \
-            ${optionalString (cfg.kubelet.clusterDomain != "")
-                ''--cluster-domain=${cfg.kubelet.clusterDomain}''} \
-            --logtostderr=true \
-            ${optionalString cfg.verbose "--v=6 --log_flush_frequency=1s"} \
-            ${cfg.kubelet.extraOpts}
-          '';
-        serviceConfig.WorkingDirectory = cfg.dataDir;
-      };
-    })
-
     (mkIf cfg.proxy.enable {
       systemd.services.kube-proxy = {
         description = "Kubernetes Proxy Service";
         wantedBy = [ "multi-user.target" ];
-        after = [ "network.target" "etcd.service" ];
+        after = [ "kube-apiserver.service" ];
+        path = [pkgs.iptables];
         serviceConfig = {
           ExecStart = ''${cfg.package}/bin/kube-proxy \
-            --master=${cfg.proxy.master} \
+            --kubeconfig=${kubeconfig} \
             --bind-address=${cfg.proxy.address} \
-            --logtostderr=true \
+            ${optionalString cfg.verbose "--v=6"} \
-            ${optionalString cfg.verbose "--v=6 --log-flush-frequency=1s"} \
+            ${optionalString cfg.verbose "--log-flush-frequency=1s"} \
-            ${cfg.proxy.extraOpts}
+            ${cfg.controllerManager.extraOpts}
           '';
-          Restart = "always"; # Retry connection
+          WorkingDirectory = cfg.dataDir;
-          RestartSec = "5s";
         };
       };
     })
 
-    (mkIf cfg.kube2sky.enable {
+    (mkIf cfg.dns.enable {
-      systemd.services.kube2sky = {
+      systemd.services.kube-dns = {
-        description = "Kubernetes Dns Bridge Service";
+        description = "Kubernetes Dns Service";
         wantedBy = [ "multi-user.target" ];
-        after = [ "network.target" "skydns.service" "etcd.service" "kubernetes-apiserver.service" ];
+        after = [ "kube-apiserver.service" ];
         serviceConfig = {
-          ExecStart = ''${cfg.package}/bin/kube2sky \
+          ExecStart = ''${cfg.package}/bin/kube-dns \
-            -etcd-server=http://${head cfg.etcdServers} \
+            --kubecfg-file=${kubeconfig} \
-            -domain=${cfg.kube2sky.domain} \
+            --dns-port=${toString cfg.dns.port} \
-            -kube_master_url=http://${cfg.kube2sky.master} \
+            --domain=${cfg.dns.domain} \
-            -logtostderr=true \
+            ${optionalString cfg.verbose "--v=6"} \
-            ${optionalString cfg.verbose "--v=6 --log-flush-frequency=1s"} \
+            ${optionalString cfg.verbose "--log-flush-frequency=1s"} \
-            ${cfg.kube2sky.extraOpts}
+            ${cfg.dns.extraOpts}
           '';
+          WorkingDirectory = cfg.dataDir;
           User = "kubernetes";
+          Group = "kubernetes";
+          AmbientCapabilities = "cap_net_bind_service";
+          SendSIGHUP = true;
         };
       };
     })
 
+    (mkIf cfg.kubelet.enable {
+      boot.kernelModules = ["br_netfilter"];
+    })
+
     (mkIf (any (el: el == "master") cfg.roles) {
+      virtualisation.docker.enable = mkDefault true;
+      services.kubernetes.kubelet.enable = mkDefault true;
+      services.kubernetes.kubelet.allowPrivileged = mkDefault true;
       services.kubernetes.apiserver.enable = mkDefault true;
       services.kubernetes.scheduler.enable = mkDefault true;
       services.kubernetes.controllerManager.enable = mkDefault true;
-      services.kubernetes.kube2sky.enable = mkDefault true;
+      services.etcd.enable = mkDefault (cfg.etcd.servers == ["http://127.0.0.1:2379"]);
     })
 
     (mkIf (any (el: el == "node") cfg.roles) {
       virtualisation.docker.enable = mkDefault true;
+      virtualisation.docker.logDriver = mkDefault "json-file";
       services.kubernetes.kubelet.enable = mkDefault true;
       services.kubernetes.proxy.enable = mkDefault true;
-    })
+      services.kubernetes.dns.enable = mkDefault true;
-
-    (mkIf (any (el: el == "node" || el == "master") cfg.roles) {
-      services.etcd.enable = mkDefault true;
-
-      services.skydns.enable = mkDefault true;
-      services.skydns.domain = mkDefault cfg.kubelet.clusterDomain;
     })
 
     (mkIf (
@@ -601,24 +830,16 @@ in {
         cfg.scheduler.enable ||
         cfg.controllerManager.enable ||
         cfg.kubelet.enable ||
-        cfg.proxy.enable
+        cfg.proxy.enable ||
+        cfg.dns.enable
     ) {
-      systemd.services.kubernetes-setup = {
+      systemd.tmpfiles.rules = [
-        description = "Kubernetes setup.";
+        "d /opt/cni/bin 0755 root root -"
-        serviceConfig.Type = "oneshot";
+        "d /var/run/kubernetes 0755 kubernetes kubernetes -"
-        script = ''
+        "d /var/lib/kubernetes 0755 kubernetes kubernetes -"
-          mkdir -p /var/run/kubernetes
+      ];
-          chown kubernetes /var/lib/kubernetes
-
-          rm ${cfg.dataDir}/.dockercfg || true
-          ln -fs ${pkgs.writeText "kubernetes-dockercfg" cfg.dockerCfg} ${cfg.dataDir}/.dockercfg
-        '';
-      };
-
-      services.kubernetes.package = mkDefault pkgs.kubernetes;
 
       environment.systemPackages = [ cfg.package ];
-
       users.extraUsers = singleton {
         name = "kubernetes";
         uid = config.ids.uids.kubernetes;
@@ -630,6 +851,5 @@ in {
       };
       users.extraGroups.kubernetes.gid = config.ids.gids.kubernetes;
     })
-
   ];
 }

nixos/modules/services/monitoring/collectd.nix

@@ -9,7 +9,7 @@ let
     BaseDir "${cfg.dataDir}"
     PIDFile "${cfg.pidFile}"
     AutoLoadPlugin ${if cfg.autoLoadPlugin then "true" else "false"}
-    Hostname ${config.networking.hostName}
+    Hostname "${config.networking.hostName}"
 
     LoadPlugin syslog
     <Plugin "syslog">

nixos/modules/services/network-filesystems/tahoe.nix

@@ -233,6 +233,12 @@ in
             serviceConfig = {
               Type = "simple";
               PIDFile = pidfile;
+              # Believe it or not, Tahoe is very brittle about the order of
+              # arguments to $(tahoe start). The node directory must come first,
+              # and arguments which alter Twisted's behavior come afterwards.
+              ExecStart = ''
+                ${settings.package}/bin/tahoe start ${nodedir} -n -l- --pidfile=${pidfile}
+              '';
             };
             preStart = ''
               if [ \! -d ${nodedir} ]; then
@@ -248,12 +254,6 @@ in
               # ln -s /etc/tahoe-lafs/introducer-${node}.cfg ${nodedir}/tahoe.cfg
               cp /etc/tahoe-lafs/introducer-${node}.cfg ${nodedir}/tahoe.cfg
             '';
-            # Believe it or not, Tahoe is very brittle about the order of
-            # arguments to $(tahoe start). The node directory must come first,
-            # and arguments which alter Twisted's behavior come afterwards.
-            script = ''
-              tahoe start ${nodedir} -n -l- --pidfile=${pidfile}
-            '';
           });
         users.extraUsers = flip mapAttrs' cfg.introducers (node: _:
           nameValuePair "tahoe.introducer-${node}" {
@@ -333,6 +333,12 @@ in
             serviceConfig = {
               Type = "simple";
               PIDFile = pidfile;
+              # Believe it or not, Tahoe is very brittle about the order of
+              # arguments to $(tahoe start). The node directory must come first,
+              # and arguments which alter Twisted's behavior come afterwards.
+              ExecStart = ''
+                ${settings.package}/bin/tahoe start ${nodedir} -n -l- --pidfile=${pidfile}
+              '';
             };
             preStart = ''
               if [ \! -d ${nodedir} ]; then
@@ -348,12 +354,6 @@ in
               # ln -s /etc/tahoe-lafs/${node}.cfg ${nodedir}/tahoe.cfg
               cp /etc/tahoe-lafs/${node}.cfg ${nodedir}/tahoe.cfg
             '';
-            # Believe it or not, Tahoe is very brittle about the order of
-            # arguments to $(tahoe start). The node directory must come first,
-            # and arguments which alter Twisted's behavior come afterwards.
-            script = ''
-              tahoe start ${nodedir} -n -l- --pidfile=${pidfile}
-            '';
           });
         users.extraUsers = flip mapAttrs' cfg.nodes (node: _:
           nameValuePair "tahoe.${node}" {

nixos/modules/services/x11/display-managers/default.nix

@@ -82,12 +82,12 @@ let
 
       # Speed up application start by 50-150ms according to
       # http://kdemonkey.blogspot.nl/2008/04/magic-trick.html
-      rm -rf $HOME/.compose-cache
+      rm -rf "$HOME/.compose-cache"
-      mkdir $HOME/.compose-cache
+      mkdir "$HOME/.compose-cache"
 
       # Work around KDE errors when a user first logs in and
       # .local/share doesn't exist yet.
-      mkdir -p $HOME/.local/share
+      mkdir -p "$HOME/.local/share"
 
       unset _DID_SYSTEMD_CAT
 
@@ -148,7 +148,7 @@ let
       allowSubstitutes = false;
     }
     ''
-      mkdir -p $out
+      mkdir -p "$out"
       ${concatMapStrings (n: ''
         cat - > "$out/${n}.desktop" << EODESKTOP
         [Desktop Entry]

nixos/modules/services/x11/window-managers/i3.nix

@@ -3,52 +3,58 @@
 with lib;
 
 let
-  wmCfg = config.services.xserver.windowManager;
+  cfg = config.services.xserver.windowManager.i3;
+in
+
+{
+  options.services.xserver.windowManager.i3 = {
+    enable = mkEnableOption "i3 window manager";
 
-  i3option = name: {
-    enable = mkEnableOption name;
     configFile = mkOption {
-      default = null;
+      default     = null;
-      type = types.nullOr types.path;
+      type        = with types; nullOr path;
       description = ''
         Path to the i3 configuration file.
         If left at the default value, $HOME/.i3/config will be used.
       '';
     };
+
     extraSessionCommands = mkOption {
-      default = "";
+      default     = "";
-      type = types.lines;
+      type        = types.lines;
       description = ''
         Shell commands executed just before i3 is started.
       '';
     };
+
+    package = mkOption {
+      type        = types.package;
+      default     = pkgs.i3;
+      defaultText = "pkgs.i3";
+      example     = "pkgs.i3-gaps";
+      description = ''
+        i3 package to use.
+      '';
+    };
   };
 
-  i3config = name: pkg: cfg: {
+  config = mkIf cfg.enable {
     services.xserver.windowManager.session = [{
-      inherit name;
+      name  = "i3";
       start = ''
         ${cfg.extraSessionCommands}
 
-        ${pkg}/bin/i3 ${optionalString (cfg.configFile != null)
+        ${cfg.package}/bin/i3 ${optionalString (cfg.configFile != null)
           "-c \"${cfg.configFile}\""
         } &
         waitPID=$!
       '';
     }];
-    environment.systemPackages = [ pkg ];
+    environment.systemPackages = [ cfg.package ];
   };
 
-in
+  imports = [
-
+    (mkRemovedOptionModule [ "services" "xserver" "windowManager" "i3-gaps" "enable" ]
-{
+      "Use services.xserver.windowManager.i3.enable and set services.xserver.windowManager.i3.package to pkgs.i3-gaps to use i3-gaps.")
-  options.services.xserver.windowManager = {
-    i3 = i3option "i3";
-    i3-gaps = i3option "i3-gaps";
-  };
-
-  config = mkMerge [
-    (mkIf wmCfg.i3.enable (i3config "i3" pkgs.i3 wmCfg.i3))
-    (mkIf wmCfg.i3-gaps.enable (i3config "i3-gaps" pkgs.i3-gaps wmCfg.i3-gaps))
   ];
 }

nixos/tests/kubernetes.nix

@@ -1,182 +1,408 @@
-# This test runs two node kubernetes cluster and checks if simple redis pod works
+{ system ? builtins.currentSystem }:
 
-import ./make-test.nix ({ pkgs, ...} : rec {
+with import ../lib/testing.nix { inherit system; };
-  name = "kubernetes";
+with import ../lib/qemu-flags.nix;
-  meta = with pkgs.stdenv.lib.maintainers; {
+with pkgs.lib;
-    maintainers = [ offline ];
+
+let
+  redisPod = pkgs.writeText "redis-master-pod.json" (builtins.toJSON {
+    kind = "Pod";
+    apiVersion = "v1";
+    metadata.name = "redis";
+    metadata.labels.name = "redis";
+    spec.containers = [{
+      name = "redis";
+      image = "redis";
+      args = ["--bind" "0.0.0.0"];
+      imagePullPolicy = "Never";
+      ports = [{
+        name = "redis-server";
+        containerPort = 6379;
+      }];
+    }];
+  });
+
+  redisService = pkgs.writeText "redis-service.json" (builtins.toJSON {
+    kind = "Service";
+    apiVersion = "v1";
+    metadata.name = "redis";
+    spec = {
+      ports = [{port = 6379; targetPort = 6379;}];
+      selector = {name = "redis";};
+    };
+  });
+
+  redisImage = pkgs.dockerTools.buildImage {
+    name = "redis";
+    tag = "latest";
+    contents = pkgs.redis;
+    config.Entrypoint = "/bin/redis-server";
   };
 
-  redisMaster = builtins.toFile "redis-master-pod.yaml" ''
+  testSimplePod = ''
-      id: redis-master-pod
+    $kubernetes->execute("docker load < ${redisImage}");
-      kind: Pod
+    $kubernetes->waitUntilSucceeds("kubectl create -f ${redisPod}");
-      apiVersion: v1beta1
+    $kubernetes->succeed("kubectl create -f ${redisService}");
-      desiredState:
+    $kubernetes->waitUntilSucceeds("kubectl get pod redis | grep Running");
-        manifest:
+    $kubernetes->succeed("nc -z \$\(dig \@10.10.0.1 redis.default.svc.cluster.local +short\) 6379");
-          version: v1beta1
-          id: redis-master-pod
-          containers:
-            - name: master
-              image: master:5000/nix
-              cpu: 100
-              ports:
-                - name: redis-server
-                  containerPort: 6379
-                  hostPort: 6379
-              volumeMounts:
-                - name: nix-store
-                  mountPath: /nix/store
-                  readOnly: true
-              volumeMounts:
-                - name: system-profile
-                  mountPath: /bin
-                  readOnly: true
-              command:
-                - /bin/redis-server
-          volumes:
-            - name: nix-store
-              source:
-                hostDir:
-                  path: /nix/store
-            - name: system-profile
-              source:
-                hostDir:
-                  path: /run/current-system/sw/bin
-      labels:
-        name: redis
-        role: master
   '';
+in {
+  # This test runs kubernetes on a single node
+  trivial = makeTest {
+    name = "kubernetes-trivial";
 
-  nodes = {
+    nodes = {
-    master =
+      kubernetes =
-      { config, pkgs, lib, nodes, ... }:
+        { config, pkgs, lib, nodes, ... }:
-        {
+          {
-          virtualisation.memorySize = 768;
+            virtualisation.memorySize = 768;
-          services.kubernetes = {
+            virtualisation.diskSize = 2048;
-            roles = ["master" "node"];
+
-            dockerCfg = ''{"master:5000":{}}'';
+            programs.bash.enableCompletion = true;
-            controllerManager.machines = ["master" "node"];
+
-            apiserver.address = "0.0.0.0";
+            services.kubernetes.roles = ["master" "node"];
-            verbose = true;
+            virtualisation.docker.extraOptions = "--iptables=false --ip-masq=false -b cbr0";
+
+            networking.bridges.cbr0.interfaces = [];
+            networking.interfaces.cbr0 = {};
           };
-          virtualisation.docker.extraOptions = "--iptables=false --ip-masq=false -b cbr0 --insecure-registry master:5000";
+    };
 
-          services.etcd = {
+    testScript = ''
-            listenPeerUrls = ["http://0.0.0.0:7001"];
+      startAll;
-            initialAdvertisePeerUrls = ["http://master:7001"];
-            initialCluster = ["master=http://master:7001" "node=http://node:7001"];
-          };
-          services.dockerRegistry.enable = true;
-          services.dockerRegistry.host = "0.0.0.0";
-          services.dockerRegistry.port = 5000;
 
-          virtualisation.vlans = [ 1 2 ];
+      $kubernetes->waitUntilSucceeds("kubectl get nodes | grep kubernetes | grep Ready");
-          networking.bridges = {
-            cbr0.interfaces = [ "eth2" ];
-          };
-          networking.interfaces = {
-            cbr0 = {
-              ipAddress = "10.10.0.1";
-              prefixLength = 24;
-            };
-            eth2.ip4 = lib.mkOverride 0 [ ];
-          };
-          networking.localCommands = ''
-            ip route add 10.10.0.0/16 dev cbr0
-            ip route flush cache
-          '';
-          networking.extraHosts = "127.0.0.1 master";
 
-          networking.firewall.enable = false;
+      ${testSimplePod}
-          #networking.firewall.allowedTCPPorts = [ 4001 7001 ];
+    '';
-
-          environment.systemPackages = [ pkgs.redis ];
-        };
-
-    node =
-      { config, pkgs, lib, nodes, ... }:
-        {
-          services.kubernetes = {
-            roles = ["node"];
-            dockerCfg = ''{"master:5000":{}}'';
-            kubelet.apiServers = ["master:8080"];
-            verbose = true;
-          };
-          virtualisation.docker.extraOptions = "--iptables=false --ip-masq=false -b cbr0 --insecure-registry master:5000";
-          services.etcd = {
-            listenPeerUrls = ["http://0.0.0.0:7001"];
-            initialAdvertisePeerUrls = ["http://node:7001"];
-            initialCluster = ["master=http://master:7001" "node=http://node:7001"];
-          };
-
-          virtualisation.vlans = [ 1 2 ];
-          networking.bridges = {
-            cbr0.interfaces = [ "eth2" ];
-          };
-          networking.interfaces = {
-            cbr0 = {
-              ipAddress = "10.10.1.1";
-              prefixLength = 24;
-            };
-            eth2.ip4 = lib.mkOverride 0 [ ];
-          };
-          networking.localCommands = ''
-            ip route add 10.10.0.0/16 dev cbr0
-            ip route flush cache
-          '';
-          networking.extraHosts = "127.0.0.1 node";
-
-          networking.firewall.enable = false;
-          #networking.firewall.allowedTCPPorts = [ 4001 7001 ];
-
-          environment.systemPackages = [ pkgs.redis ];
-        };
-
-    client =
-      { config, pkgs, nodes, ... }:
-        {
-          virtualisation.docker.enable = true;
-          virtualisation.docker.extraOptions = "--insecure-registry master:5000";
-          environment.systemPackages = [ pkgs.kubernetes ];
-          environment.etc."test/redis-master-pod.yaml".source = redisMaster;
-          environment.etc."test/pause".source = "${pkgs.kubernetes}/bin/kube-pause";
-          environment.etc."test/Dockerfile".source = pkgs.writeText "Dockerfile" ''
-            FROM scratch
-            ADD pause /
-            ENTRYPOINT ["/pause"]
-          '';
-        };
   };
 
-  testScript = ''
+  cluster = let
-    startAll;
+    runWithOpenSSL = file: cmd: pkgs.runCommand file {
+      buildInputs = [ pkgs.openssl ];
+    } cmd;
 
-    $master->waitForUnit("kubernetes-apiserver.service");
+    ca_key = runWithOpenSSL "ca-key.pem" "openssl genrsa -out $out 2048";
-    $master->waitForUnit("kubernetes-scheduler.service");
+    ca_pem = runWithOpenSSL "ca.pem" ''
-    $master->waitForUnit("kubernetes-controller-manager.service");
+      openssl req \
-    $master->waitForUnit("kubernetes-kubelet.service");
+        -x509 -new -nodes -key ${ca_key} \
-    $master->waitForUnit("kubernetes-proxy.service");
+        -days 10000 -out $out -subj "/CN=etcd-ca"
+    '';
+    etcd_key = runWithOpenSSL "etcd-key.pem" "openssl genrsa -out $out 2048";
+    etcd_csr = runWithOpenSSL "etcd.csr" ''
+      openssl req \
+        -new -key ${etcd_key} \
+        -out $out -subj "/CN=etcd" \
+        -config ${openssl_cnf}
+    '';
+    etcd_cert = runWithOpenSSL "etcd.pem" ''
+      openssl x509 \
+        -req -in ${etcd_csr} \
+        -CA ${ca_pem} -CAkey ${ca_key} \
+        -CAcreateserial -out $out \
+        -days 365 -extensions v3_req \
+        -extfile ${openssl_cnf}
+    '';
 
-    $node->waitForUnit("kubernetes-kubelet.service");
+    etcd_client_key = runWithOpenSSL "etcd-client-key.pem"
-    $node->waitForUnit("kubernetes-proxy.service");
+      "openssl genrsa -out $out 2048";
 
-    $master->waitUntilSucceeds("kubectl get minions | grep master");
+    etcd_client_csr = runWithOpenSSL "etcd-client-key.pem" ''
-    $master->waitUntilSucceeds("kubectl get minions | grep node");
+      openssl req \
+        -new -key ${etcd_client_key} \
+        -out $out -subj "/CN=etcd-client" \
+        -config ${client_openssl_cnf}
+    '';
 
-    $client->waitForUnit("docker.service");
+    etcd_client_cert = runWithOpenSSL "etcd-client.crt" ''
-    $client->succeed("tar cv --files-from /dev/null | docker import - nix");
+      openssl x509 \
-    $client->succeed("docker tag nix master:5000/nix");
+        -req -in ${etcd_client_csr} \
-    $master->waitForUnit("docker-registry.service");
+        -CA ${ca_pem} -CAkey ${ca_key} -CAcreateserial \
-    $client->succeed("docker push master:5000/nix");
+        -out $out -days 365 -extensions v3_req \
-    $client->succeed("mkdir -p /root/pause");
+        -extfile ${client_openssl_cnf}
-    $client->succeed("cp /etc/test/pause /root/pause/");
+    '';
-    $client->succeed("cp /etc/test/Dockerfile /root/pause/");
-    $client->succeed("cd /root/pause && docker build -t master:5000/pause .");
-    $client->succeed("docker push master:5000/pause");
 
-    subtest "simple pod", sub {
+    apiserver_key = runWithOpenSSL "apiserver-key.pem" "openssl genrsa -out $out 2048";
-      $client->succeed("kubectl create -f ${redisMaster} -s http://master:8080");
-      $client->waitUntilSucceeds("kubectl get pods -s http://master:8080 | grep redis-master | grep -i running");
-    }
 
-  '';
+    apiserver_csr = runWithOpenSSL "apiserver.csr" ''
-})
+      openssl req \
+        -new -key ${apiserver_key} \
+        -out $out -subj "/CN=kube-apiserver" \
+        -config ${apiserver_cnf}
+    '';
+
+    apiserver_cert = runWithOpenSSL "apiserver.pem" ''
+      openssl x509 \
+        -req -in ${apiserver_csr} \
+        -CA ${ca_pem} -CAkey ${ca_key} -CAcreateserial \
+        -out $out -days 365 -extensions v3_req \
+        -extfile ${apiserver_cnf}
+    '';
+
+    worker_key = runWithOpenSSL "worker-key.pem" "openssl genrsa -out $out 2048";
+
+    worker_csr = runWithOpenSSL "worker.csr" ''
+      openssl req \
+        -new -key ${worker_key} \
+        -out $out -subj "/CN=kube-worker" \
+        -config ${worker_cnf}
+    '';
+
+    worker_cert = runWithOpenSSL "worker.pem" ''
+      openssl x509 \
+        -req -in ${worker_csr} \
+        -CA ${ca_pem} -CAkey ${ca_key} -CAcreateserial \
+        -out $out -days 365 -extensions v3_req \
+        -extfile ${worker_cnf}
+    '';
+
+    openssl_cnf = pkgs.writeText "openssl.cnf" ''
+      [req]
+      req_extensions = v3_req
+      distinguished_name = req_distinguished_name
+      [req_distinguished_name]
+      [ v3_req ]
+      basicConstraints = CA:FALSE
+      keyUsage = digitalSignature, keyEncipherment
+      extendedKeyUsage = serverAuth
+      subjectAltName = @alt_names
+      [alt_names]
+      DNS.1 = etcd1
+      DNS.2 = etcd2
+      DNS.3 = etcd3
+      IP.1 = 127.0.0.1
+    '';
+
+    client_openssl_cnf = pkgs.writeText "client-openssl.cnf" ''
+      [req]
+      req_extensions = v3_req
+      distinguished_name = req_distinguished_name
+      [req_distinguished_name]
+      [ v3_req ]
+      basicConstraints = CA:FALSE
+      keyUsage = digitalSignature, keyEncipherment
+      extendedKeyUsage = clientAuth
+    '';
+
+    apiserver_cnf = pkgs.writeText "apiserver-openssl.cnf" ''
+      [req]
+      req_extensions = v3_req
+      distinguished_name = req_distinguished_name
+      [req_distinguished_name]
+      [ v3_req ]
+      basicConstraints = CA:FALSE
+      keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+      subjectAltName = @alt_names
+      [alt_names]
+      DNS.1 = kubernetes
+      DNS.2 = kubernetes.default
+      DNS.3 = kubernetes.default.svc
+      DNS.4 = kubernetes.default.svc.cluster.local
+      IP.1 = 10.10.10.1
+    '';
+
+    worker_cnf = pkgs.writeText "worker-openssl.cnf" ''
+      [req]
+      req_extensions = v3_req
+      distinguished_name = req_distinguished_name
+      [req_distinguished_name]
+      [ v3_req ]
+      basicConstraints = CA:FALSE
+      keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+      subjectAltName = @alt_names
+      [alt_names]
+      DNS.1 = kubeWorker1
+      DNS.2 = kubeWorker2
+    '';
+
+    etcdNodeConfig = {
+      virtualisation.memorySize = 128;
+
+      services = {
+        etcd = {
+          enable = true;
+          keyFile = etcd_key;
+          certFile = etcd_cert;
+          trustedCaFile = ca_pem;
+          peerClientCertAuth = true;
+          listenClientUrls = ["https://0.0.0.0:2379"];
+          listenPeerUrls = ["https://0.0.0.0:2380"];
+        };
+      };
+
+      environment.variables = {
+        ETCDCTL_CERT_FILE = "${etcd_client_cert}";
+        ETCDCTL_KEY_FILE = "${etcd_client_key}";
+        ETCDCTL_CA_FILE = "${ca_pem}";
+        ETCDCTL_PEERS = "https://127.0.0.1:2379";
+      };
+
+      networking.firewall.allowedTCPPorts = [ 2379 2380 ];
+    };
+
+    kubeConfig = {
+      virtualisation.diskSize = 2048;
+      programs.bash.enableCompletion = true;
+
+      services.flannel = {
+        enable = true;
+        network = "10.10.0.0/16";
+        iface = "eth1";
+        etcd = {
+          endpoints = ["https://etcd1:2379" "https://etcd2:2379" "https://etcd3:2379"];
+          keyFile = etcd_client_key;
+          certFile = etcd_client_cert;
+          caFile = ca_pem;
+        };
+      };
+
+      # vxlan
+      networking.firewall.allowedUDPPorts = [ 8472 ];
+
+      systemd.services.docker.after = ["flannel.service"];
+      systemd.services.docker.serviceConfig.EnvironmentFile = "/run/flannel/subnet.env";
+      virtualisation.docker.extraOptions = "--iptables=false --ip-masq=false --bip $FLANNEL_SUBNET";
+
+      services.kubernetes.verbose = true;
+      services.kubernetes.etcd = {
+        servers = ["https://etcd1:2379" "https://etcd2:2379" "https://etcd3:2379"];
+        keyFile = etcd_client_key;
+        certFile = etcd_client_cert;
+        caFile = ca_pem;
+      };
+
+      environment.systemPackages = [ pkgs.bind pkgs.tcpdump pkgs.utillinux ];
+    };
+
+    kubeMasterConfig = {pkgs, ...}: {
+      require = [kubeConfig];
+
+      # kube apiserver
+      networking.firewall.allowedTCPPorts = [ 443 ];
+
+      virtualisation.memorySize = 512;
+
+      services.kubernetes = {
+        roles = ["master"];
+        scheduler.leaderElect = true;
+        controllerManager.leaderElect = true;
+
+        apiserver = {
+          publicAddress = "0.0.0.0";
+          advertiseAddress = "192.168.1.8";
+          tlsKeyFile = apiserver_key;
+          tlsCertFile = apiserver_cert;
+          clientCaFile = ca_pem;
+          kubeletClientCaFile = ca_pem;
+          kubeletClientKeyFile = worker_key;
+          kubeletClientCertFile = worker_cert;
+        };
+      };
+    };
+
+    kubeWorkerConfig = { pkgs, ... }: {
+      require = [kubeConfig];
+
+      virtualisation.memorySize = 512;
+
+      # kubelet
+      networking.firewall.allowedTCPPorts = [ 10250 ];
+
+      services.kubernetes = {
+        roles = ["node"];
+        kubeconfig = {
+          server = "https://kubernetes:443";
+          caFile = ca_pem;
+          certFile = worker_cert;
+          keyFile = worker_key;
+        };
+        kubelet = {
+          tlsKeyFile = worker_key;
+          tlsCertFile = worker_cert;
+        };
+      };
+    };
+  in makeTest {
+    name = "kubernetes-cluster";
+
+    nodes = {
+      etcd1 = { config, pkgs, nodes, ... }: {
+        require = [etcdNodeConfig];
+        services.etcd = {
+          advertiseClientUrls = ["https://etcd1:2379"];
+          initialCluster = ["etcd1=https://etcd1:2380" "etcd2=https://etcd2:2380" "etcd3=https://etcd3:2380"];
+          initialAdvertisePeerUrls = ["https://etcd1:2380"];
+        };
+      };
+
+      etcd2 = { config, pkgs, ... }: {
+        require = [etcdNodeConfig];
+        services.etcd = {
+          advertiseClientUrls = ["https://etcd2:2379"];
+          initialCluster = ["etcd1=https://etcd1:2380" "etcd2=https://etcd2:2380" "etcd3=https://etcd3:2380"];
+          initialAdvertisePeerUrls = ["https://etcd2:2380"];
+        };
+      };
+
+      etcd3 = { config, pkgs, ... }: {
+        require = [etcdNodeConfig];
+        services.etcd = {
+          advertiseClientUrls = ["https://etcd3:2379"];
+          initialCluster = ["etcd1=https://etcd1:2380" "etcd2=https://etcd2:2380" "etcd3=https://etcd3:2380"];
+          initialAdvertisePeerUrls = ["https://etcd3:2380"];
+        };
+      };
+
+      kubeMaster1 = { config, pkgs, lib, nodes, ... }: {
+        require = [kubeMasterConfig];
+      };
+
+      kubeMaster2 = { config, pkgs, lib, nodes, ... }: {
+        require = [kubeMasterConfig];
+      };
+
+      # Kubernetes TCP load balancer
+      kubernetes = { config, pkgs, ... }: {
+        # kubernetes
+        networking.firewall.allowedTCPPorts = [ 443 ];
+
+        services.haproxy.enable = true;
+        services.haproxy.config = ''
+          global
+              log 127.0.0.1 local0 notice
+              user haproxy
+              group haproxy
+
+          defaults
+              log global
+              retries 2
+              timeout connect 3000
+              timeout server 5000
+              timeout client 5000
+
+          listen kubernetes
+              bind 0.0.0.0:443
+              mode tcp
+              option ssl-hello-chk
+              balance roundrobin
+              server kube-master-1 kubeMaster1:443 check
+              server kube-master-2 kubeMaster2:443 check
+        '';
+      };
+
+      kubeWorker1 = { config, pkgs, lib, nodes, ... }: {
+        require = [kubeWorkerConfig];
+      };
+
+      kubeWorker2 = { config, pkgs, lib, nodes, ... }: {
+        require = [kubeWorkerConfig];
+      };
+    };
+
+    testScript = ''
+      startAll;
+
+      ${testSimplePod}
+    '';
+  };
+}

pkgs/applications/audio/deadbeef/plugins/mpris2.nix

@@ -1,12 +1,12 @@
 { stdenv, fetchurl, pkgconfig, deadbeef, glib }:
 
 stdenv.mkDerivation rec {
-  version = "1.8";
   name = "deadbeef-mpris2-plugin-${version}";
+  version = "1.10";
 
   src = fetchurl {
     url = "https://github.com/Serranya/deadbeef-mpris2-plugin/releases/download/v${version}/${name}.tar.xz";
-    sha256 = "1xg880zlxbqz7hs5g7xwc128l08j8c3isn45rdi138hi4fqbyjfi";
+    sha256 = "083fbvi06y85khr8hdm4rl5alxdanjbbyphizyr4hi93d7a0jg75";
   };
 
   nativeBuildInputs = [ pkgconfig ];
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "MPRISv2 plugin for the DeaDBeeF music player";
-    homepage = https://github.com/Serranya/deadbeef-mpris2-plugin/;
+    homepage = "https://github.com/Serranya/deadbeef-mpris2-plugin/";
     license = licenses.gpl2;
     platforms = platforms.linux;
     maintainers = [ maintainers.abbradar ];

pkgs/applications/audio/mopidy-gmusic/default.nix

@@ -2,14 +2,19 @@
 
 pythonPackages.buildPythonApplication rec {
   name = "mopidy-gmusic-${version}";
-  version = "1.0.0";
+  version = "2.0.0";
 
   src = fetchurl {
     url = "https://github.com/mopidy/mopidy-gmusic/archive/v${version}.tar.gz";
-    sha256 = "0yfilzfamy1bxnmgb1xk56jrk4sz0i7vcnc0a8klrm9sc7agnm9i";
+    sha256 = "1xryw2aixfza3brxlgjdlg0lghlb17g7kay9zy56mlzp0jr7m87j";
   };
 
-  propagatedBuildInputs = [ mopidy pythonPackages.requests2 pythonPackages.gmusicapi ];
+  propagatedBuildInputs = [
+    mopidy
+    pythonPackages.requests2
+    pythonPackages.gmusicapi
+    pythonPackages.cachetools
+  ];
 
   doCheck = false;
 

pkgs/applications/audio/svox/default.nix

@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   name = "svox-${version}";
-  version = "2016-01-25";
+  version = "2016-10-20";
 
   src = fetchgit {
     url = "https://android.googlesource.com/platform/external/svox";
-    rev = "dfb9937746b1828d093faf3b1494f9dc403f392d";
+    rev = "2dd8f16e4436520b93e93aa72b92acad92c0127d";
-    sha256 = "1gkfj5avikzmr2vv8bhf83n15jcbz4phz5j13l0qnh3gjzh4f1bk";
+    sha256 = "064h3zb9bn1z6xbv15iy6l4rlxx8fqzy54s898qvafjhz6kawj9g";
   };
 
   postPatch = ''

pkgs/applications/display-managers/sddm/default.nix

@@ -57,7 +57,7 @@ let
 
     meta = with stdenv.lib; {
       description = "QML based X11 display manager";
-      homepage = https://github.com/sddm/sddm;
+      homepage = "https://github.com/sddm/sddm";
       platforms = platforms.linux;
       maintainers = with maintainers; [ abbradar ttuegel ];
     };

pkgs/applications/editors/emacs-modes/elpa-generated.nix

@@ -175,10 +175,10 @@
       }) {};
     auctex = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
         pname = "auctex";
-        version = "11.89.6";
+        version = "11.89.7";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/auctex-11.89.6.tar";
+          url = "https://elpa.gnu.org/packages/auctex-11.89.7.tar";
-          sha256 = "1lfaki8s9ri6ds88mhpxwqb2jrjf7hbs1w3nxhg307344lac07gy";
+          sha256 = "03sxdh6dv4m98yq09hxcph2lgidai8ky22i9acjcp6vfjlsb9mlf";
         };
         packageRequires = [];
         meta = {
@@ -335,10 +335,10 @@
     company = callPackage ({ cl-lib ? null, elpaBuild, emacs, fetchurl, lib }:
     elpaBuild {
         pname = "company";
-        version = "0.9.0";
+        version = "0.9.2";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/company-0.9.0.tar";
+          url = "https://elpa.gnu.org/packages/company-0.9.2.tar";
-          sha256 = "1d090j1xv97nbxzz0iq4gmzjijggm8wsd0y1zfsa8syrq8qa0ajs";
+          sha256 = "10divixs06gq9nm8s8x0q12ir07y27d06l52ix2dn84zvj853z4z";
         };
         packageRequires = [ cl-lib emacs ];
         meta = {
@@ -619,10 +619,10 @@
     el-search = callPackage ({ elpaBuild, emacs, fetchurl, lib, stream }:
     elpaBuild {
         pname = "el-search";
-        version = "1.0.1";
+        version = "1.1.2";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/el-search-1.0.1.tar";
+          url = "https://elpa.gnu.org/packages/el-search-1.1.2.tar";
-          sha256 = "14l7zq4bm5ihybpj8qvqpzzmgjsyhr8yq2d4jmadk35q5hlx1cbb";
+          sha256 = "1cav55nx1045c3xasi5d76yyqi68ygp9dpqv9bazrqgcpsmw6y8b";
         };
         packageRequires = [ emacs stream ];
         meta = {
@@ -712,10 +712,10 @@
       }) {};
     exwm = callPackage ({ elpaBuild, fetchurl, lib, xelb }: elpaBuild {
         pname = "exwm";
-        version = "0.11";
+        version = "0.12";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/exwm-0.11.tar";
+          url = "https://elpa.gnu.org/packages/exwm-0.12.tar";
-          sha256 = "108n09b6512y05rskq754hzwc5nzqmkq1lfrarl34my41wsc1qnf";
+          sha256 = "1h964w9ir8plam45c194af74g5q1wdvgwrldlmlcplcswlsn3n4z";
         };
         packageRequires = [ xelb ];
         meta = {
@@ -1351,10 +1351,10 @@
       }) {};
     org = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
         pname = "org";
-        version = "20161102";
+        version = "20161118";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/org-20161102.tar";
+          url = "https://elpa.gnu.org/packages/org-20161118.tar";
-          sha256 = "12v9jhakdxcmlw9zrcrh1fwi3kh6z0qva90hpnr0zjqyj72i0wir";
+          sha256 = "1w9g8r08kaiw9f4fjsj0hbffzq85rj734j5lxvbaafbnz7dbklk1";
         };
         packageRequires = [];
         meta = {
@@ -1703,10 +1703,10 @@
       }) {};
     spinner = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
         pname = "spinner";
-        version = "1.7.1";
+        version = "1.7.3";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/spinner-1.7.1.el";
+          url = "https://elpa.gnu.org/packages/spinner-1.7.3.el";
-          sha256 = "1fmwzdih0kbyvs8bn38mpm4sbs2mikqy2vdykfy9g20wpa8vb681";
+          sha256 = "19kp1mmndbmw11sgvv2ggfjl4pyf5zrsbh3871f0965pw9z8vahd";
         };
         packageRequires = [];
         meta = {
@@ -1901,15 +1901,15 @@
           license = lib.licenses.free;
         };
       }) {};
-    validate = callPackage ({ cl-lib ? null, elpaBuild, emacs, fetchurl, lib }:
+    validate = callPackage ({ cl-lib ? null, elpaBuild, emacs, fetchurl, lib, seq }:
     elpaBuild {
         pname = "validate";
-        version = "1.0.0";
+        version = "1.0.2";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/validate-1.0.0.el";
+          url = "https://elpa.gnu.org/packages/validate-1.0.2.el";
-          sha256 = "10js4qds5xi5a89s4v4fz6f71b25g3x8jm1lcpf9s75i1q1xiysk";
+          sha256 = "19xhd9mxkdcisspz5q3bnvf6jjsvmhjjrpw3pq5lgyqbcz8k8dsr";
         };
-        packageRequires = [ cl-lib emacs ];
+        packageRequires = [ cl-lib emacs seq ];
         meta = {
           homepage = "https://elpa.gnu.org/packages/validate.html";
           license = lib.licenses.free;
@@ -2049,10 +2049,10 @@
     xelb = callPackage ({ cl-generic, elpaBuild, emacs, fetchurl, lib }:
     elpaBuild {
         pname = "xelb";
-        version = "0.11";
+        version = "0.12";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/xelb-0.11.tar";
+          url = "https://elpa.gnu.org/packages/xelb-0.12.tar";
-          sha256 = "12qgbv30dizp7kadq9kg7nfyg5qfbfy14s833zg95fqqa87qg90j";
+          sha256 = "0i9n0f3ibj4a5pwcsvwrah9m0fz32m0x6a9wsmjn3li20v8pcb81";
         };
         packageRequires = [ cl-generic emacs ];
         meta = {

pkgs/applications/editors/emacs-modes/org-generated.nix

@@ -1,10 +1,10 @@
 { callPackage }: {
     org = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
         pname = "org";
-        version = "20161102";
+        version = "20161118";
         src = fetchurl {
-          url = "http://orgmode.org/elpa/org-20161102.tar";
+          url = "http://orgmode.org/elpa/org-20161118.tar";
-          sha256 = "1mj100pnxskgrfmabj0vdmsijmr7v5ir7c18aypv92nh3fnmiz0f";
+          sha256 = "1lk2j93zcaamj2m2720nxsza7j35054kg72w35w9z1bbiqmv2haj";
         };
         packageRequires = [];
         meta = {
@@ -14,10 +14,10 @@
       }) {};
     org-plus-contrib = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
         pname = "org-plus-contrib";
-        version = "20161102";
+        version = "20161118";
         src = fetchurl {
-          url = "http://orgmode.org/elpa/org-plus-contrib-20161102.tar";
+          url = "http://orgmode.org/elpa/org-plus-contrib-20161118.tar";
-          sha256 = "124rizp50jaqshcmrr7x2132x5sy7q81nfb37482j9wzrc9l7b95";
+          sha256 = "1la8qw18akqc4p7p0qi675xm3r149vwazzjc2gkik97p12ip83z7";
         };
         packageRequires = [];
         meta = {

pkgs/applications/editors/idea/default.nix

@@ -120,12 +120,12 @@ in
 {
   clion = buildClion rec {
     name = "clion-${version}";
-    version = "2016.2.3";
+    version = "2016.3";
     description  = "C/C++ IDE. New. Intelligent. Cross-platform";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/cpp/CLion-${version}.tar.gz";
-      sha256 = "1gcglxmffq815r97wyy2wx1jsv467qyys8c0m5dv3yjdxknccbqd";
+      sha256 = "16nszamr0bxg8aghyrg4wzxbp9158kjzhr957ljpbipz0rlixf31";
     };
     wmClass = "jetbrains-clion";
   };
@@ -240,36 +240,36 @@ in
 
   pycharm-community = buildPycharm rec {
     name = "pycharm-community-${version}";
-    version = "2016.2.3";
+    version = "2016.3";
     description = "PyCharm Community Edition";
     license = stdenv.lib.licenses.asl20;
     src = fetchurl {
       url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "0nph0dp0a2y6vrbc1a2d5iy1fzhm4wbkp6kpdk6mcfpnz5ppz84f";
+      sha256 = "1pi822ihzy58jszdy7y2pyni6pki9ih8s9xdbwlbwg9vck1iqprs";
     };
     wmClass = "jetbrains-pycharm-ce";
   };
 
   pycharm-professional = buildPycharm rec {
     name = "pycharm-professional-${version}";
-    version = "2016.2.3";
+    version = "2016.3";
     description = "PyCharm Professional Edition";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "0pjgdwpkbf6fgrhml97inmsjavz1n9l4ns1pnhv3mssnribg3vm1";
+      sha256 = "1b4ib77wzg0y12si8zqrfwbhv4kvmy9nm5dsrdr3k7f89dqg3279";
     };
     wmClass = "jetbrains-pycharm";
   };
 
   phpstorm = buildPhpStorm rec {
     name = "phpstorm-${version}";
-    version = "2016.2.2";
+    version = "2016.3";
     description = "Professional IDE for Web and PHP developers";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/webide/PhpStorm-${version}.tar.gz";
-      sha256 = "0np0ypqga1xx9zq0qwpxiw9xdkr7k0jcdv1w790aafjar7a5qbyz";
+      sha256 = "0hzjhwij2x3b5fqwyd69h24ld13bpc2bf9wdcd1jy758waf0d91y";
     };
     wmClass = "jetbrains-phpstorm";
   };
@@ -288,12 +288,12 @@ in
 
   webstorm = buildWebStorm rec {
     name = "webstorm-${version}";
-    version = "2016.3";
+    version = "2016.3.1";
     description = "Professional IDE for Web and JavaScript development";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/webstorm/WebStorm-${version}.tar.gz";
-      sha256 = "12jv8x7rq0cpvrbrb2l2x1p7is8511fx6ia79z5v3fnwxf17i3w5";
+      sha256 = "10za4d6w9yns7kclbviizslq2y7zas9rkmvs3xwrfw1rdw2b69af";
     };
     wmClass = "jetbrains-webstorm";
   };

pkgs/applications/graphics/graphicsmagick/default.nix

@@ -15,15 +15,15 @@ stdenv.mkDerivation {
   patches = [
     ./disable-popen.patch
     (fetchpatch {
-      url = "https://sources.debian.net/data/main/g/graphicsmagick/1.3.25-4/debian/patches/CVE-2016-7996_CVE-2016-7997.patch";
+      url = "https://sources.debian.net/data/main/g/graphicsmagick/1.3.25-5/debian/patches/CVE-2016-7996_CVE-2016-7997.patch";
       sha256 = "0xsby2z8n7cnnln7szjznq7iaabq323wymvdjra59yb41aix74r2";
     })
     (fetchpatch {
-      url = "https://sources.debian.net/data/main/g/graphicsmagick/1.3.25-4/debian/patches/CVE-2016-7800_part1.patch";
+      url = "https://sources.debian.net/data/main/g/graphicsmagick/1.3.25-5/debian/patches/CVE-2016-7800_part1.patch";
       sha256 = "02s0x9bkbnm5wrd0d2x9ld4d9z5xqpfk310lyylyr5zlnhqxmwgn";
     })
     (fetchpatch {
-      url = "https://sources.debian.net/data/main/g/graphicsmagick/1.3.25-4/debian/patches/CVE-2016-7800_part2.patch";
+      url = "https://sources.debian.net/data/main/g/graphicsmagick/1.3.25-5/debian/patches/CVE-2016-7800_part2.patch";
       sha256 = "1h4xv3i1aq5avsd584rwa5sa7ca8f7w9ggmh7j2llqq5kymwsv5f";
     })
     (fetchpatch {

pkgs/applications/graphics/krita/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchgit, cmake, extra-cmake-modules, makeQtWrapper
+{ stdenv, lib, fetchurl, cmake, extra-cmake-modules, makeQtWrapper
 , karchive, kconfig, kwidgetsaddons, kcompletion, kcoreaddons
 , kguiaddons, ki18n, kitemmodels, kitemviews, kwindowsystem
 , kio, kcrash
@@ -8,12 +8,11 @@
 
 stdenv.mkDerivation rec {
   name = "krita-${version}";
-  version = "3.0";
+  version = "3.0.1.1";
 
-  src = fetchgit {
+  src = fetchurl {
-    url = "http://phabricator.kde.org/diffusion/KRITA/krita.git";
+    url = "http://download.kde.org/stable/krita/${version}/${name}.tar.gz";
-    rev = "refs/tags/v${version}";
+    sha256 = "0v58p9am2gsrgn5nhynvdg1a7v8d9kcsswb1962r8ijszm3fav5k";
-    sha256 = "0aas86667ncp8jz00c8qk7bm26g76l65cysh06wxr8kxbvqynrdn";
   };
 
   nativeBuildInputs = [ cmake extra-cmake-modules makeQtWrapper ];

pkgs/applications/graphics/yed/default.nix

@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   name = "yEd-${version}";
-  version = "3.16.1";
+  version = "3.16.2.1";
 
   src = requireFile {
     name = "${name}.zip";
     url = "https://www.yworks.com/en/products/yfiles/yed/";
-    sha256 = "0h7ykcpvsikjfap51hpcz6z814riiwyps585j2i1yv9dmsbqdi7j";
+    sha256 = "019qfmdifqsrc9h4g3zbn7ivdc0dzlp3isa5ixdkgdhfsdm79b27";
   };
 
   nativeBuildInputs = [ unzip makeWrapper ];
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     license = licenses.unfree;
-    homepage = http://www.yworks.com/en/products/yfiles/yed/;
+    homepage = "http://www.yworks.com/en/products/yfiles/yed/";
     description = "A powerful desktop application that can be used to quickly and effectively generate high-quality diagrams";
     platforms = jre.meta.platforms;
     maintainers = with maintainers; [ abbradar ];

pkgs/applications/misc/gnuradio/default.nix

@@ -23,11 +23,11 @@
 
 stdenv.mkDerivation rec {
   name = "gnuradio-${version}";
-  version = "3.7.9.2";
+  version = "3.7.10.1";
 
   src = fetchurl {
     url = "http://gnuradio.org/releases/gnuradio/${name}.tar.gz";
-    sha256 = "0qdmakvgq3jxnnqpcn3k4q07vj8ycrbyzv32h76k71cv13w2yrki";
+    sha256 = "0ds9mcw8hgm03f82jvp3j4mm02ha6zvsl77lp13jzqmbqifbdmv3";
   };
 
   buildInputs = [

pkgs/applications/misc/octoprint/default.nix

@@ -16,11 +16,11 @@ let
 
   sockjs-tornado = pythonPackages.buildPythonPackage rec {
     name = "sockjs-tornado-${version}";
-    version = "1.0.2";
+    version = "1.0.3";
 
     src = fetchurl {
       url = "mirror://pypi/s/sockjs-tornado/${name}.tar.gz";
-      sha256 = "15lcy40h2cm0l8aknbrk48p2sni5wzybsqjx1hxwpk9lfa1xryyv";
+      sha256 = "16cff40nniqsyvda1pb2j3b4zwmrw7y2g1vqq78lp20xpmhnwwkd";
     };
 
     # This is needed for compatibility with OctoPrint
@@ -28,7 +28,7 @@ let
 
     meta = with stdenv.lib; {
       description = "SockJS python server implementation on top of Tornado framework";
-      homepage = http://github.com/mrjoes/sockjs-tornado/;
+      homepage = "http://github.com/mrjoes/sockjs-tornado/";
       license = licenses.mit;
       platforms = platforms.all;
       maintainers = with maintainers; [ abbradar ];
@@ -37,13 +37,13 @@ let
 
 in pythonPackages.buildPythonApplication rec {
   name = "OctoPrint-${version}";
-  version = "1.2.15";
+  version = "1.2.17";
 
   src = fetchFromGitHub {
     owner = "foosel";
     repo = "OctoPrint";
     rev = version;
-    sha256 = "0qfragp7n8m7l5l30s5fz1x7xzini2sdh2y3m1ahs7ay8zp4xk56";
+    sha256 = "1di2f5npwsfckx5p2fl23bl5zi75i0aksd9qy4sa3zmw672337fh";
   };
 
   # We need old Tornado
@@ -67,6 +67,7 @@ in pythonPackages.buildPythonApplication rec {
       -e 's,Flask-Principal>=[^"]*,Flask-Principal,g' \
       -e 's,markdown>=[^"]*,markdown,g' \
       -e 's,Flask-Assets>=[^"]*,Flask-Assets,g' \
+      -e 's,Flask-Login>=[^"]*,Flask-Login,g' \
       -e 's,rsa>=[^"]*,rsa,g' \
       -e 's,PyYAML>=[^"]*,PyYAML,g' \
       setup.py

pkgs/applications/misc/octoprint/m33-fio-one-library.patch

@@ -1,18 +1,18 @@
-From 62b4fabd1d4ee7a584a565d48c7eaec6e80fe0bd Mon Sep 17 00:00:00 2001
+From c84b2130dab0d26be35294d023ed8f4be404c3c1 Mon Sep 17 00:00:00 2001
 From: Nikolay Amiantov <ab@fmap.me>
-Date: Fri, 12 Aug 2016 23:41:22 +0300
+Date: Wed, 23 Nov 2016 00:40:48 +0300
 Subject: [PATCH] Build and use one version of preprocessor library
 
 ---
- octoprint_m33fio/__init__.py   | 66 +-----------------------------------------
+ octoprint_m33fio/__init__.py   | 67 ++----------------------------------------
- shared library source/Makefile | 59 +++----------------------------------
+ shared library source/Makefile | 62 +++-----------------------------------
- 2 files changed, 5 insertions(+), 120 deletions(-)
+ 2 files changed, 6 insertions(+), 123 deletions(-)
 
 diff --git a/octoprint_m33fio/__init__.py b/octoprint_m33fio/__init__.py
-index da539f5..b0a17ad 100755
+index f9f84c4..b365024 100755
 --- a/octoprint_m33fio/__init__.py
 +++ b/octoprint_m33fio/__init__.py
-@@ -979,71 +979,7 @@ class M33FioPlugin(
+@@ -1061,71 +1061,8 @@ class M33FioPlugin(
  		# Check if using shared library or checking if it is usable
  		if self._settings.get_boolean(["UseSharedLibrary"]) or isUsable :
  	
@@ -81,19 +81,20 @@ index da539f5..b0a17ad 100755
 -	
 -					# Set shared library
 -					self.sharedLibrary = ctypes.cdll.LoadLibrary(self._basefolder.replace('\\', '/') + "/static/libraries/preprocessor_x86-64.dylib")
-+			self.sharedLibrary = ctypes.cdll.LoadLibrary(self._basefolder.replace('\\', '/') + "/static/libraries/libpreprocessor.so")
++                        # Set shared library
++                        self.sharedLibrary = ctypes.cdll.LoadLibrary(self._basefolder.replace('\\', '/') + "/static/libraries/libpreprocessor.so")
  
  			# Check if shared library was set
  			if self.sharedLibrary :
 diff --git a/shared library source/Makefile b/shared library source/Makefile
-index a43d657..0b254aa 100755
+index 887899b..4c74f5c 100755
 --- a/shared library source/Makefile	
 +++ b/shared library source/Makefile	
-@@ -1,62 +1,11 @@
+@@ -1,68 +1,14 @@
- # Target platform options: LINUX32, LINUX64, WINDOWS32, WINDOWS64, PI, PI2, ARM7, OSX32, OSX64
+-# Target platform options: LINUX32, LINUX64, WINDOWS32, WINDOWS64, PI, PI2, ARM7, OSX32, OSX64
 -LIBRARY_NAME = preprocessor
+-TARGET_PLATFORM = LINUX64
 +LIBRARY_NAME = libpreprocessor
- TARGET_PLATFORM = LINUX64
  VER = .1
  
 -ifeq ($(TARGET_PLATFORM), LINUX32)
@@ -122,19 +123,19 @@ index a43d657..0b254aa 100755
 -
 -ifeq ($(TARGET_PLATFORM), PI)
 -	PROG = $(LIBRARY_NAME)_arm1176jzf-s.so
--	CC = ~/tools/arm-bcm2708/arm-rpi-4.9.3-linux-gnueabihf/bin/arm-linux-gnueabihf-g++
+-	CC = /opt/arm-toolchain/arm-bcm2708/arm-rpi-4.9.3-linux-gnueabihf/bin/arm-linux-gnueabihf-g++
 -	CFLAGS = -fPIC -mcpu=arm1176jzf-s -mfpu=vfp -mfloat-abi=hard -static-libgcc -O3 -Wl,-soname,$(PROG)$(VER) -static-libstdc++
 -endif
 -
 -ifeq ($(TARGET_PLATFORM), PI2)
 -	PROG = $(LIBRARY_NAME)_arm_cortex-a7.so
--	CC = ~/tools/arm-bcm2708/arm-rpi-4.9.3-linux-gnueabihf/bin/arm-linux-gnueabihf-g++
+-	CC = /opt/arm-toolchain/arm-bcm2708/arm-rpi-4.9.3-linux-gnueabihf/bin/arm-linux-gnueabihf-g++
 -	CFLAGS = -fPIC -mcpu=cortex-a7 -mfpu=neon-vfpv4 -mfloat-abi=hard -static-libgcc -O3 -Wl,-soname,$(PROG)$(VER) -static-libstdc++
 -endif
 -
 -ifeq ($(TARGET_PLATFORM), ARM7)
 -	PROG = $(LIBRARY_NAME)_arm7.so
--	CC = ~/tools/arm-bcm2708/gcc-linaro-arm-linux-gnueabihf-raspbian-x64/bin/arm-linux-gnueabihf-g++
+-	CC = /opt/arm-toolchain/arm-bcm2708/gcc-linaro-arm-linux-gnueabihf-raspbian-x64/bin/arm-linux-gnueabihf-g++
 -	CFLAGS = -fPIC -mcpu=generic-armv7-a -mfpu=vfp -mfloat-abi=hard -static-libgcc -O3 -Wl,-soname,$(PROG)$(VER) -static-libstdc++
 -endif
 -
@@ -151,11 +152,17 @@ index a43d657..0b254aa 100755
 -	CFLAGS = -fPIC -m64 -stdlib=libc++ -O3 -Wl,-install_name,$(PROG)$(VER)
 -endif
 +PROG = $(LIBRARY_NAME).so
-+CC = g++
 +CFLAGS = -fPIC -O3 -Wl,-soname,$(PROG)$(VER)
  
  SRCS = preprocessor.cpp gcode.cpp vector.cpp
  CFLAGS += -Wall -std=c++11 -fvisibility=hidden -shared
+ 
+ all:
+-	$(CC) $(CFLAGS) -o ../octoprint_m33fio/static/libraries/$(PROG) $(SRCS)
++	$(CXX) $(CFLAGS) -o ../octoprint_m33fio/static/libraries/$(PROG) $(SRCS)
+ 
+ clean:
+ 	rm -f ../octoprint_m33fio/static/libraries/$(PROG)
 -- 
-2.9.2
+2.10.2
 

pkgs/applications/misc/octoprint/plugins.nix

@@ -12,13 +12,13 @@ let
 
     m33-fio = buildPlugin rec {
       name = "M33-Fio-${version}";
-      version = "1.7";
+      version = "1.11";
 
       src = fetchFromGitHub {
         owner = "donovan6000";
         repo = "M33-Fio";
         rev = "V${version}";
-        sha256 = "14sqvgrpf3zvgycjj7f3m7m2flx06zq4h0yhq4g18av0zbsrv7yp";
+        sha256 = "11nbsi93clrqlnmaj73ak87hkqyghybccqz5jzhn2dhp0263adhl";
       };
 
       patches = [

pkgs/applications/misc/rxvt_unicode-plugins/urxvt-tabbedex/default.nix

@@ -1,13 +1,13 @@
 { stdenv, fetchFromGitHub, perl }:
 
 stdenv.mkDerivation {
-  name = "urxvt-tabbedex-2016-08-09";
+  name = "urxvt-tabbedex-2016-08-17";
 
   src = fetchFromGitHub {
     owner = "mina86";
     repo = "urxvt-tabbedex";
-    rev = "ac220eb3984e151ba14dce08f446bc7bc8ca29a2";
+    rev = "089d0cb724eeb62fa8a5dfcb00ced7761e794149";
-    sha256 = "1b5mff5137jb5ysklsmfp5ql3m4g1z3bdhk0nwhz2hgwz40ap6k8";
+    sha256 = "0a5jrb7ryafj55fgi8fhpy3gmb1xh5j7pbn8p5j5k6s2fnh0g0hq";
   };
 
   nativeBuildInputs = [ perl ];

pkgs/applications/networking/browsers/qutebrowser/default.nix

@@ -7,11 +7,11 @@
 let
   pdfjs = stdenv.mkDerivation rec {
     name = "pdfjs-${version}";
-    version = "1.4.20";
+    version = "1.5.188";
 
     src = fetchurl {
       url = "https://github.com/mozilla/pdf.js/releases/download/v${version}/${name}-dist.zip";
-      sha256 = "1ca1fzyc5qnan6gavcd8bnfqriqqvgdsf4m8ka4nayf50k64xxj9";
+      sha256 = "1y3yaqfgjj96qzvbm5200x68j5hy1qs7l2mqm3kbbj2b58z9f1qv";
     };
 
     nativeBuildInputs = [ unzip ];

pkgs/applications/networking/browsers/vivaldi/default.nix

@@ -10,16 +10,16 @@
 }:
 
 let
-  version = "1.4";
+  version = "1.5";
-  build = "589.38-1";
+  build = "658.44-1";
   fullVersion = "stable_${version}.${build}";
 
   info = if stdenv.is64bit then {
       arch = "amd64";
-      sha256 = "08qdpl5dkb2snpqlk3rsqlyl9rfas9v6bbcw2p4kzazhinak5hv3";
+      sha256 = "02zb9pw8h7gm0hlhk95bn8fz14x68ax2jz8g7bgzppyryq8xlg6l";
     } else {
       arch = "i386";
-      sha256 = "0wpaglc1aaam5bqxgvf5zwcbr0xll8yj63l19q792l51j1vkv56q";
+      sha256 = "1cwpmdsv4rrr13d1x017rms7cjp5zh3vpz3b44ar49ip6zj6j0a8";
     };
 
 in stdenv.mkDerivation rec {

pkgs/applications/networking/browsers/w3m/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchgit, fetchpatch
+{ stdenv, fetchFromGitHub, fetchpatch
 , ncurses, boehmgc, gettext, zlib
 , sslSupport ? true, openssl ? null
 , graphicsSupport ? true, imlib2 ? null
@@ -15,12 +15,13 @@ assert mouseSupport -> gpm-ncurses != null;
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
-  name = "w3m-0.5.3-2015-12-20";
+  name = "w3m-v0.5.3+git20161120";
 
-  src = fetchgit {
+  src = fetchFromGitHub {
-    url = "git://anonscm.debian.org/collab-maint/w3m.git";
+    owner = "tats";
-    rev = "e0b6e022810271bd0efcd655006389ee3879e94d";
+    repo = "w3m";
-    sha256 = "1vahm3719hb0m20nc8k88165z35f8b15qasa0whhk78r12bls1q6";
+    rev = "v0.5.3+git20161120";
+    sha256 = "06n5a9jdyihkd4xdjmyci32dpqp1k2l5awia5g9ng0bn256bacdc";
   };
 
   NIX_LDFLAGS = optionalString stdenv.isSunOS "-lsocket -lnsl";

pkgs/applications/networking/cluster/cni/default.nix

@@ -0,0 +1,36 @@
+{ stdenv, fetchFromGitHub, go }:
+
+stdenv.mkDerivation rec {
+  name = "cni-${version}";
+  version = "0.3.0";
+
+  src = fetchFromGitHub {
+    owner = "containernetworking";
+    repo = "cni";
+    rev = "v${version}";
+    sha256 = "1nvixvf5slnsdrfpfs2km64x680wf83jbyp7il12bcim37q2az7m";
+  };
+
+  buildInputs = [ go ];
+
+  outputs = ["out" "plugins"];
+
+  buildPhase = ''
+    patchShebangs build
+    ./build
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin $plugins
+    mv bin/cnitool $out/bin
+    mv bin/* $plugins/
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Container Network Interface - networking for Linux containers";
+    license = licenses.asl20;
+    homepage = https://github.com/containernetworking/cni;
+    maintainers = with maintainers; [offline];
+    platforms = [ "x86_64-linux" ];
+  };
+}

pkgs/applications/networking/cluster/kubernetes/default.nix

@@ -48,9 +48,6 @@ stdenv.mkDerivation rec {
   '';
 
   preFixup = ''
-    wrapProgram "$out/bin/kube-proxy" --prefix PATH : "${iptables}/bin"
-    wrapProgram "$out/bin/kubelet" --prefix PATH : "${coreutils}/bin"
-
     # Remove references to go compiler
     while read file; do
       cat $file | sed "s,${go},$(echo "${go}" | sed "s,$NIX_STORE/[^-]*,$NIX_STORE/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee,"),g" > $file.tmp

pkgs/applications/networking/cluster/mesos/default.nix

@@ -2,6 +2,7 @@
 , automake115x, libtool, unzip, gnutar, jdk, maven, python, wrapPython
 , setuptools, boto, pythonProtobuf, apr, subversion, gzip, systemd
 , leveldb, glog, perf, utillinux, libnl, iproute, openssl, libevent
+, ethtool, coreutils
 , bash
 }:
 
@@ -10,7 +11,7 @@ let
   soext = if stdenv.system == "x86_64-darwin" then "dylib" else "so";
 
 in stdenv.mkDerivation rec {
-  version = "0.28.2";
+  version = "1.0.1";
   name = "mesos-${version}";
 
   enableParallelBuilding = true;
@@ -18,7 +19,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://apache/mesos/${version}/${name}.tar.gz";
-    sha256 = "0wh4h11w5qvqa66fiz0qbm9q48d3jz48mw6mm22bcy9q9wmzrxcn";
+    sha256 = "1hdh2wh11ck98ycfrxfzgivgk2pjl3638vkyw14xj7faj9qxjlz0";
   };
 
   patches = [
@@ -29,7 +30,8 @@ in stdenv.mkDerivation rec {
     ./rb51324.patch
     ./rb51325.patch
 
-    ./maven_repo.patch
+    # see https://github.com/cstrahan/mesos/tree/nixos-${version}
+    ./nixos.patch
   ];
 
   buildInputs = [
@@ -45,59 +47,59 @@ in stdenv.mkDerivation rec {
   ];
 
   preConfigure = ''
-    substituteInPlace src/Makefile.am --subst-var-by mavenRepo ${mavenRepo}
+    substituteInPlace 3rdparty/stout/include/stout/os/posix/fork.hpp \
+      --subst-var-by sh ${bash}/bin/bash
 
-    substituteInPlace 3rdparty/libprocess/include/process/subprocess.hpp \
+    substituteInPlace 3rdparty/stout/include/stout/os/posix/shell.hpp \
-      --replace '"sh"' '"${bash}/bin/bash"'
+      --subst-var-by sh ${bash}/bin/bash
 
-    substituteInPlace 3rdparty/libprocess/3rdparty/stout/include/stout/posix/os.hpp \
+    substituteInPlace src/Makefile.am \
-      --replace '"sh"' '"${bash}/bin/bash"'
+      --subst-var-by mavenRepo ${mavenRepo}
 
-    substituteInPlace 3rdparty/libprocess/3rdparty/stout/include/stout/os/posix/shell.hpp \
+    substituteInPlace src/cli/mesos-scp \
-      --replace '"sh"' '"${bash}/bin/bash"'
+      --subst-var-by scp ${openssh}/bin/scp
-
-    substituteInPlace 3rdparty/libprocess/3rdparty/stout/include/stout/os/posix/fork.hpp \
-      --replace '"sh"' '"${bash}/bin/bash"'
-
-    substituteInPlace src/cli/mesos-scp        \
-      --replace "'scp " "'${openssh}/bin/scp "
-
-    substituteInPlace src/launcher/executor.cpp \
-      --replace '"sh"' '"${bash}/bin/bash"'
 
     substituteInPlace src/launcher/fetcher.cpp \
-      --replace '"gzip' '"${gzip}/bin/gzip'    \
+      --subst-var-by gzip  ${gzip}/bin/gzip \
-      --replace '"tar' '"${gnutar}/bin/tar'    \
+      --subst-var-by tar   ${gnutar}/bin/tar \
-      --replace '"unzip' '"${unzip}/bin/unzip'
+      --subst-var-by unzip ${unzip}/bin/unzip
 
     substituteInPlace src/python/cli/src/mesos/cli.py \
-     --replace "['mesos-resolve'" "['$out/bin/mesos-resolve'"
+      --subst-var-by mesos-resolve $out/bin/mesos-resolve
 
-    substituteInPlace src/slave/containerizer/mesos/launch.cpp \
+    substituteInPlace src/slave/containerizer/mesos/isolators/posix/disk.cpp \
-      --replace '"sh"' '"${bash}/bin/bash"'
+      --subst-var-by du ${coreutils}/bin/du \
+      --subst-var-by cp ${coreutils}/bin/cp
+
+    substituteInPlace src/slave/containerizer/mesos/provisioner/backends/copy.cpp \
+      --subst-var-by cp ${coreutils}/bin/cp
+
+    substituteInPlace src/uri/fetchers/copy.cpp \
+      --subst-var-by cp ${coreutils}/bin/cp
+
+    substituteInPlace src/uri/fetchers/curl.cpp \
+      --subst-var-by curl ${curl}/bin/curl
+
+    substituteInPlace src/uri/fetchers/docker.cpp \
+      --subst-var-by curl ${curl}/bin/curl
 
   '' + lib.optionalString stdenv.isLinux ''
 
-    substituteInPlace configure.ac             \
+    substituteInPlace src/linux/perf.cpp \
-      --replace /usr/include/libnl3 ${libnl.dev}/include/libnl3
+      --subst-var-by perf ${perf}/bin/perf
-
-    substituteInPlace src/linux/perf.cpp       \
-      --replace '"perf ' '"${perf}/bin/perf '
-
-    substituteInPlace src/linux/systemd.cpp \
-      --replace 'os::realpath("/sbin/init")' '"${systemd}/lib/systemd/systemd"'
 
     substituteInPlace src/slave/containerizer/mesos/isolators/filesystem/shared.cpp \
-      --replace '"mount ' '"${utillinux}/bin/mount ' \
+      --subst-var-by mount ${utillinux}/bin/mount
 
     substituteInPlace src/slave/containerizer/mesos/isolators/namespaces/pid.cpp \
-      --replace '"mount ' '"${utillinux}/bin/mount ' \
+      --subst-var-by mount ${utillinux}/bin/mount
 
     substituteInPlace src/slave/containerizer/mesos/isolators/network/port_mapping.cpp \
-      --replace '"tc ' '"${iproute}/bin/tc '   \
+      --subst-var-by tc      ${iproute}/bin/tc \
-      --replace '"ip ' '"${iproute}/bin/ip '   \
+      --subst-var-by ip      ${iproute}/bin/ip \
-      --replace '"mount ' '"${utillinux}/bin/mount ' \
+      --subst-var-by mount   ${utillinux}/bin/mount \
-      --replace '/bin/sh' "${stdenv.shell}"
+      --subst-var-by sh      ${stdenv.shell} \
+      --subst-var-by ethtool ${ethtool}/sbin/ethtool
   '';
 
   configureFlags = [
@@ -113,8 +115,11 @@ in stdenv.mkDerivation rec {
     "--with-ssl=${openssl.dev}"
     "--enable-libevent"
     "--with-libevent=${libevent.dev}"
+    "--with-protobuf=${pythonProtobuf.protobuf}"
+    "PROTOBUF_JAR=${mavenRepo}/com/google/protobuf/protobuf-java/2.6.1/protobuf-java-2.6.1.jar"
   ] ++ lib.optionals stdenv.isLinux [
     "--with-network-isolator"
+    "--with-nl=${libnl.dev}"
   ];
 
   postInstall = ''
@@ -180,8 +185,5 @@ in stdenv.mkDerivation rec {
     description = "A cluster manager that provides efficient resource isolation and sharing across distributed applications, or frameworks";
     maintainers = with maintainers; [ cstrahan kevincox offline rushmorem ];
     platforms   = platforms.linux;
-    # Marked as broken due to needing an update for security issues.
-    # See: https://github.com/NixOS/nixpkgs/issues/18856
-    broken = true;
   };
 }

pkgs/applications/networking/cluster/mesos/mesos-deps.nix

@@ -6,7 +6,7 @@ stdenv.mkDerivation {
 
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
-  outputHash = "12c6z5yvp60v57f6nijifp14i56bb5614hac1qg528s9liaf8vml";
+  outputHash = "066ikswavq3l37x1s3pfdncyj77pvpa0kj14ax5dqb9njmsg0s11";
 
   buildInputs = [ curl ];
 

pkgs/applications/networking/cluster/mesos/nixos.patch

@@ -0,0 +1,463 @@
+diff --git a/3rdparty/stout/include/stout/os/posix/fork.hpp b/3rdparty/stout/include/stout/os/posix/fork.hpp
+index a29967d..290b98b 100644
+--- a/3rdparty/stout/include/stout/os/posix/fork.hpp
++++ b/3rdparty/stout/include/stout/os/posix/fork.hpp
+@@ -369,7 +369,7 @@ private:
+     if (exec.isSome()) {
+       // Execute the command (via '/bin/sh -c command').
+       const char* command = exec.get().command.c_str();
+-      execlp("sh", "sh", "-c", command, (char*) nullptr);
++      execlp("@sh@", "sh", "-c", command, (char*) nullptr);
+       EXIT(EXIT_FAILURE)
+         << "Failed to execute '" << command << "': " << os::strerror(errno);
+     } else if (wait.isSome()) {
+diff --git a/3rdparty/stout/include/stout/os/posix/shell.hpp b/3rdparty/stout/include/stout/os/posix/shell.hpp
+index 1d73ae5..9bf89b5 100644
+--- a/3rdparty/stout/include/stout/os/posix/shell.hpp
++++ b/3rdparty/stout/include/stout/os/posix/shell.hpp
+@@ -37,7 +37,7 @@ namespace Shell {
+ // received by the callee, usually the command name and `arg1` is the
+ // second command argument received by the callee.
+ 
+-constexpr const char* name = "sh";
++constexpr const char* name = "@sh@";
+ constexpr const char* arg0 = "sh";
+ constexpr const char* arg1 = "-c";
+ 
+diff --git a/src/Makefile.am b/src/Makefile.am
+index 28dd151..36fc6ec 100644
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -1528,7 +1528,8 @@ if HAS_JAVA
+ 
+ $(MESOS_JAR): $(MESOS_JAR_SOURCE) $(MESOS_JAR_GENERATED) java/mesos.pom
+ 	@echo "Building mesos-$(PACKAGE_VERSION).jar ..."
+-	@cd $(abs_top_builddir)/src/java && $(MVN) -B -f mesos.pom clean package
++	@cd $(abs_top_builddir)/src/java && $(MVN) -B -f mesos.pom -Dmaven.repo.local=@mavenRepo@ clean package
++
+ 
+ # Convenience library for JNI bindings.
+ # TODO(Charles Reiss): We really should be building the Java library
+diff --git a/src/cli/mesos-scp b/src/cli/mesos-scp
+index a71ab07..feed8c4 100755
+--- a/src/cli/mesos-scp
++++ b/src/cli/mesos-scp
+@@ -19,7 +19,7 @@ if sys.version_info < (2,6,0):
+ 
+ 
+ def scp(host, src, dst):
+-    cmd = 'scp -pr %s %s' % (src, host + ':' + dst)
++    cmd = '@scp@ -pr %s %s' % (src, host + ':' + dst)
+     try:
+         process = subprocess.Popen(
+             cmd,
+diff --git a/src/launcher/fetcher.cpp b/src/launcher/fetcher.cpp
+index 4456c28..e22c8fc 100644
+--- a/src/launcher/fetcher.cpp
++++ b/src/launcher/fetcher.cpp
+@@ -68,13 +68,13 @@ static Try<bool> extract(
+       strings::endsWith(sourcePath, ".tar.bz2") ||
+       strings::endsWith(sourcePath, ".txz") ||
+       strings::endsWith(sourcePath, ".tar.xz")) {
+-    command = "tar -C '" + destinationDirectory + "' -xf";
++    command = "@tar@ -C '" + destinationDirectory + "' -xf";
+   } else if (strings::endsWith(sourcePath, ".gz")) {
+     string pathWithoutExtension = sourcePath.substr(0, sourcePath.length() - 3);
+     string filename = Path(pathWithoutExtension).basename();
+-    command = "gzip -dc > '" + destinationDirectory + "/" + filename + "' <";
++    command = "@gzip@ -dc > '" + destinationDirectory + "/" + filename + "' <";
+   } else if (strings::endsWith(sourcePath, ".zip")) {
+-    command = "unzip -o -d '" + destinationDirectory + "'";
++    command = "@unzip@ -o -d '" + destinationDirectory + "'";
+   } else {
+     return false;
+   }
+@@ -162,7 +162,7 @@ static Try<string> copyFile(
+     const string& sourcePath,
+     const string& destinationPath)
+ {
+-  const string command = "cp '" + sourcePath + "' '" + destinationPath + "'";
++  const string command = "@cp@ '" + sourcePath + "' '" + destinationPath + "'";
+ 
+   LOG(INFO) << "Copying resource with command:" << command;
+ 
+diff --git a/src/linux/perf.cpp b/src/linux/perf.cpp
+index ea823b3..170f54d 100644
+--- a/src/linux/perf.cpp
++++ b/src/linux/perf.cpp
+@@ -125,7 +125,7 @@ private:
+     // NOTE: The watchdog process places perf in its own process group
+     // and will kill the perf process when the parent dies.
+     Try<Subprocess> _perf = subprocess(
+-        "perf",
++        "@perf@",
+         argv,
+         Subprocess::PIPE(),
+         Subprocess::PIPE(),
+@@ -319,7 +319,7 @@ bool valid(const set<string>& events)
+   ostringstream command;
+ 
+   // Log everything to stderr which is then redirected to /dev/null.
+-  command << "perf stat --log-fd 2";
++  command << "@perf@ stat --log-fd 2";
+   foreach (const string& event, events) {
+     command << " --event " << event;
+   }
+diff --git a/src/linux/systemd.cpp b/src/linux/systemd.cpp
+index 619aa27..c1cbfe4 100644
+--- a/src/linux/systemd.cpp
++++ b/src/linux/systemd.cpp
+@@ -196,12 +196,19 @@ bool exists()
+   // This is static as the init system should not change while we are running.
+   static const bool exists = []() -> bool {
+     // (1) Test whether `/sbin/init` links to systemd.
+-    const Result<string> realpath = os::realpath("/sbin/init");
+-    if (realpath.isError() || realpath.isNone()) {
+-      LOG(WARNING) << "Failed to test /sbin/init for systemd environment: "
+-                   << realpath.error();
+-
+-      return false;
++    // cstrahan: first assume we're on NixOS, then try non-NixOS
++    Result<string> realpath = os::realpath("/run/current-system/systemd/lib/systemd/systemd");
++    Result<string> realpathNixOS = realpath;
++    if (realpathNixOS.isError() || realpathNixOS.isNone()) {
++      Result<string> realpathNonNixOS = realpath = os::realpath("/sbin/init");
++      if (realpathNonNixOS.isError() || realpathNonNixOS.isNone()) {
++        LOG(WARNING) << "Failed to test /run/current-system/systemd/lib/systemd/systemd for systemd environment: "
++                     << realpathNixOS.error();
++        LOG(WARNING) << "Failed to test /sbin/init for systemd environment: "
++                     << realpathNonNixOS.error();
++
++        return false;
++      }
+     }
+ 
+     CHECK_SOME(realpath);
+diff --git a/src/python/cli/src/mesos/cli.py b/src/python/cli/src/mesos/cli.py
+index f342992..354abf4 100644
+--- a/src/python/cli/src/mesos/cli.py
++++ b/src/python/cli/src/mesos/cli.py
+@@ -40,7 +40,7 @@ def resolve(master):
+     import subprocess
+ 
+     process = subprocess.Popen(
+-        ['mesos-resolve', master],
++        ['@mesos-resolve@', master],
+         stdin=None,
+         stdout=subprocess.PIPE,
+         stderr=subprocess.PIPE,
+diff --git a/src/slave/containerizer/mesos/isolators/filesystem/shared.cpp b/src/slave/containerizer/mesos/isolators/filesystem/shared.cpp
+index 51d1518..783adb5 100644
+--- a/src/slave/containerizer/mesos/isolators/filesystem/shared.cpp
++++ b/src/slave/containerizer/mesos/isolators/filesystem/shared.cpp
+@@ -204,7 +204,7 @@ Future<Option<ContainerLaunchInfo>> SharedFilesystemIsolatorProcess::prepare(
+     }
+ 
+     launchInfo.add_pre_exec_commands()->set_value(
+-        "mount -n --bind " + hostPath + " " + volume.container_path());
++        "@mount@ -n --bind " + hostPath + " " + volume.container_path());
+   }
+ 
+   return launchInfo;
+diff --git a/src/slave/containerizer/mesos/isolators/namespaces/pid.cpp b/src/slave/containerizer/mesos/isolators/namespaces/pid.cpp
+index b41e266..e07c163 100644
+--- a/src/slave/containerizer/mesos/isolators/namespaces/pid.cpp
++++ b/src/slave/containerizer/mesos/isolators/namespaces/pid.cpp
+@@ -163,7 +163,7 @@ Future<Option<ContainerLaunchInfo>> NamespacesPidIsolatorProcess::prepare(
+   // containers cannot see the namespace bind mount of other
+   // containers.
+   launchInfo.add_pre_exec_commands()->set_value(
+-      "mount -n --bind " + string(PID_NS_BIND_MOUNT_MASK_DIR) +
++      "@mount@ -n --bind " + string(PID_NS_BIND_MOUNT_MASK_DIR) +
+       " " + string(PID_NS_BIND_MOUNT_ROOT));
+ 
+   // Mount /proc for the container's pid namespace to show the
+@@ -176,9 +176,9 @@ Future<Option<ContainerLaunchInfo>> NamespacesPidIsolatorProcess::prepare(
+   // -n flag so the mount is not added to the mtab where it will not
+   // be correctly removed with the namespace terminates.
+   launchInfo.add_pre_exec_commands()->set_value(
+-      "mount none /proc --make-private -o rec");
++      "@mount@ none /proc --make-private -o rec");
+   launchInfo.add_pre_exec_commands()->set_value(
+-      "mount -n -t proc proc /proc -o nosuid,noexec,nodev");
++      "@mount@ -n -t proc proc /proc -o nosuid,noexec,nodev");
+ 
+   return launchInfo;
+ }
+diff --git a/src/slave/containerizer/mesos/isolators/network/port_mapping.cpp b/src/slave/containerizer/mesos/isolators/network/port_mapping.cpp
+index 79ee960..d55a353 100644
+--- a/src/slave/containerizer/mesos/isolators/network/port_mapping.cpp
++++ b/src/slave/containerizer/mesos/isolators/network/port_mapping.cpp
+@@ -1392,19 +1392,19 @@ Try<Isolator*> PortMappingIsolatorProcess::create(const Flags& flags)
+   // Check the availability of a few Linux commands that we will use.
+   // We use the blocking os::shell here because 'create' will only be
+   // invoked during initialization.
+-  Try<string> checkCommandTc = os::shell("tc filter show");
++  Try<string> checkCommandTc = os::shell("@tc@ filter show");
+   if (checkCommandTc.isError()) {
+     return Error("Check command 'tc' failed: " + checkCommandTc.error());
+   }
+ 
+   // NOTE: loopback device always exists.
+-  Try<string> checkCommandEthtool = os::shell("ethtool -k lo");
++  Try<string> checkCommandEthtool = os::shell("@ethtool@ -k lo");
+   if (checkCommandEthtool.isError()) {
+     return Error("Check command 'ethtool' failed: "
+                  + checkCommandEthtool.error());
+   }
+ 
+-  Try<string> checkCommandIp = os::shell("ip link show");
++  Try<string> checkCommandIp = os::shell("@ip@ link show");
+   if (checkCommandIp.isError()) {
+     return Error("Check command 'ip' failed: " + checkCommandIp.error());
+   }
+@@ -1924,9 +1924,9 @@ Try<Isolator*> PortMappingIsolatorProcess::create(const Flags& flags)
+     // visible. It's OK to use the blocking os::shell here because
+     // 'create' will only be invoked during initialization.
+     Try<string> mount = os::shell(
+-        "mount --bind %s %s && "
+-        "mount --make-slave %s && "
+-        "mount --make-shared %s",
++        "@mount@ --bind %s %s && "
++        "@mount@ --make-slave %s && "
++        "@mount@ --make-shared %s",
+         bindMountRoot->c_str(),
+         bindMountRoot->c_str(),
+         bindMountRoot->c_str(),
+@@ -1943,8 +1943,8 @@ Try<Isolator*> PortMappingIsolatorProcess::create(const Flags& flags)
+       // shared mount yet (possibly due to slave crash while preparing
+       // the work directory mount). It's safe to re-do the following.
+       Try<string> mount = os::shell(
+-          "mount --make-slave %s && "
+-          "mount --make-shared %s",
++          "@mount@ --make-slave %s && "
++          "@mount@ --make-shared %s",
+           bindMountRoot->c_str(),
+           bindMountRoot->c_str());
+ 
+@@ -1963,8 +1963,8 @@ Try<Isolator*> PortMappingIsolatorProcess::create(const Flags& flags)
+           // so that they are in different peer groups.
+           if (entry.shared() == bindMountEntry->shared()) {
+             Try<string> mount = os::shell(
+-                "mount --make-slave %s && "
+-                "mount --make-shared %s",
++                "@mount@ --make-slave %s && "
++                "@mount@ --make-shared %s",
+                 bindMountRoot->c_str(),
+                 bindMountRoot->c_str());
+ 
+@@ -3916,13 +3916,13 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+ {
+   ostringstream script;
+ 
+-  script << "#!/bin/sh\n";
++  script << "#!@sh@\n";
+   script << "set -xe\n";
+ 
+   // Mark the mount point PORT_MAPPING_BIND_MOUNT_ROOT() as slave
+   // mount so that changes in the container will not be propagated to
+   // the host.
+-  script << "mount --make-rslave " << bindMountRoot << "\n";
++  script << "@mount@ --make-rslave " << bindMountRoot << "\n";
+ 
+   // Disable IPv6 when IPv6 module is loaded as IPv6 packets won't be
+   // forwarded anyway.
+@@ -3930,7 +3930,7 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+          << " echo 1 > /proc/sys/net/ipv6/conf/all/disable_ipv6\n";
+ 
+   // Configure lo and eth0.
+-  script << "ip link set " << lo << " address " << hostMAC
++  script << "@ip@ link set " << lo << " address " << hostMAC
+          << " mtu " << hostEth0MTU << " up\n";
+ 
+   // NOTE: This is mostly a kernel issue: in veth_xmit() the kernel
+@@ -3939,12 +3939,12 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+   // when we receive a packet with a bad checksum. Disabling rx
+   // checksum offloading ensures the TCP layer will checksum and drop
+   // it.
+-  script << "ethtool -K " << eth0 << " rx off\n";
+-  script << "ip link set " << eth0 << " address " << hostMAC << " up\n";
+-  script << "ip addr add " << hostIPNetwork  << " dev " << eth0 << "\n";
++  script << "@ethtool@ -K " << eth0 << " rx off\n";
++  script << "@ip@ link set " << eth0 << " address " << hostMAC << " up\n";
++  script << "@ip@ addr add " << hostIPNetwork  << " dev " << eth0 << "\n";
+ 
+   // Set up the default gateway to match that of eth0.
+-  script << "ip route add default via " << hostDefaultGateway << "\n";
++  script << "@ip@ route add default via " << hostDefaultGateway << "\n";
+ 
+   // Restrict the ephemeral ports that can be used by the container.
+   script << "echo " << info->ephemeralPorts.lower() << " "
+@@ -3973,19 +3973,19 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+   }
+ 
+   // Set up filters on lo and eth0.
+-  script << "tc qdisc add dev " << lo << " ingress\n";
+-  script << "tc qdisc add dev " << eth0 << " ingress\n";
++  script << "@tc@ qdisc add dev " << lo << " ingress\n";
++  script << "@tc@ qdisc add dev " << eth0 << " ingress\n";
+ 
+   // Allow talking between containers and from container to host.
+   // TODO(chzhcn): Consider merging the following two filters.
+-  script << "tc filter add dev " << lo << " parent " << ingress::HANDLE
++  script << "@tc@ filter add dev " << lo << " parent " << ingress::HANDLE
+          << " protocol ip"
+          << " prio " << Priority(IP_FILTER_PRIORITY, NORMAL).get() << " u32"
+          << " flowid ffff:0"
+          << " match ip dst " << hostIPNetwork.address()
+          << " action mirred egress redirect dev " << eth0 << "\n";
+ 
+-  script << "tc filter add dev " << lo << " parent " << ingress::HANDLE
++  script << "@tc@ filter add dev " << lo << " parent " << ingress::HANDLE
+          << " protocol ip"
+          << " prio " << Priority(IP_FILTER_PRIORITY, NORMAL).get() << " u32"
+          << " flowid ffff:0"
+@@ -3996,7 +3996,7 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+   foreach (const PortRange& range,
+            getPortRanges(info->nonEphemeralPorts + info->ephemeralPorts)) {
+     // Local traffic inside a container will not be redirected to eth0.
+-    script << "tc filter add dev " << lo << " parent " << ingress::HANDLE
++    script << "@tc@ filter add dev " << lo << " parent " << ingress::HANDLE
+            << " protocol ip"
+            << " prio " << Priority(IP_FILTER_PRIORITY, HIGH).get() << " u32"
+            << " flowid ffff:0"
+@@ -4005,7 +4005,7 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+ 
+     // Traffic going to host loopback IP and ports assigned to this
+     // container will be redirected to lo.
+-    script << "tc filter add dev " << eth0 << " parent " << ingress::HANDLE
++    script << "@tc@ filter add dev " << eth0 << " parent " << ingress::HANDLE
+            << " protocol ip"
+            << " prio " << Priority(IP_FILTER_PRIORITY, NORMAL).get() << " u32"
+            << " flowid ffff:0"
+@@ -4017,14 +4017,14 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+   }
+ 
+   // Do not forward the ICMP packet if the destination IP is self.
+-  script << "tc filter add dev " << lo << " parent " << ingress::HANDLE
++  script << "@tc@ filter add dev " << lo << " parent " << ingress::HANDLE
+          << " protocol ip"
+          << " prio " << Priority(ICMP_FILTER_PRIORITY, NORMAL).get() << " u32"
+          << " flowid ffff:0"
+          << " match ip protocol 1 0xff"
+          << " match ip dst " << hostIPNetwork.address() << "\n";
+ 
+-  script << "tc filter add dev " << lo << " parent " << ingress::HANDLE
++  script << "@tc@ filter add dev " << lo << " parent " << ingress::HANDLE
+          << " protocol ip"
+          << " prio " << Priority(ICMP_FILTER_PRIORITY, NORMAL).get() << " u32"
+          << " flowid ffff:0"
+@@ -4033,9 +4033,9 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+          << net::IPNetwork::LOOPBACK_V4().address() << "\n";
+ 
+   // Display the filters created on eth0 and lo.
+-  script << "tc filter show dev " << eth0
++  script << "@tc@ filter show dev " << eth0
+          << " parent " << ingress::HANDLE << "\n";
+-  script << "tc filter show dev " << lo
++  script << "@tc@ filter show dev " << lo
+          << " parent " << ingress::HANDLE << "\n";
+ 
+   // If throughput limit for container egress traffic exists, use HTB
+@@ -4047,9 +4047,9 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+   // throughput. TBF requires other parameters such as 'burst' that
+   // HTB already has default values for.
+   if (egressRateLimitPerContainer.isSome()) {
+-    script << "tc qdisc add dev " << eth0 << " root handle "
++    script << "@tc@ qdisc add dev " << eth0 << " root handle "
+            << CONTAINER_TX_HTB_HANDLE << " htb default 1\n";
+-    script << "tc class add dev " << eth0 << " parent "
++    script << "@tc@ class add dev " << eth0 << " parent "
+            << CONTAINER_TX_HTB_HANDLE << " classid "
+            << CONTAINER_TX_HTB_CLASS_ID << " htb rate "
+            << egressRateLimitPerContainer.get().bytes() * 8 << "bit\n";
+@@ -4060,12 +4060,12 @@ string PortMappingIsolatorProcess::scripts(Info* info)
+     // fq_codel, which has a larger buffer and better control on
+     // buffer bloat.
+     // TODO(cwang): Verity that fq_codel qdisc is available.
+-    script << "tc qdisc add dev " << eth0
++    script << "@tC@ qdisc add dev " << eth0
+            << " parent " << CONTAINER_TX_HTB_CLASS_ID << " fq_codel\n";
+ 
+     // Display the htb qdisc and class created on eth0.
+-    script << "tc qdisc show dev " << eth0 << "\n";
+-    script << "tc class show dev " << eth0 << "\n";
++    script << "@tc@ qdisc show dev " << eth0 << "\n";
++    script << "@tc@ class show dev " << eth0 << "\n";
+   }
+ 
+   return script.str();
+diff --git a/src/slave/containerizer/mesos/isolators/posix/disk.cpp b/src/slave/containerizer/mesos/isolators/posix/disk.cpp
+index 3dfe7ad..4288666 100644
+--- a/src/slave/containerizer/mesos/isolators/posix/disk.cpp
++++ b/src/slave/containerizer/mesos/isolators/posix/disk.cpp
+@@ -492,7 +492,7 @@ private:
+     // NOTE: The monitor watchdog will watch the parent process and kill
+     // the 'du' process in case that the parent die.
+     Try<Subprocess> s = subprocess(
+-        "du",
++        "@du@",
+         command,
+         Subprocess::PATH("/dev/null"),
+         Subprocess::PIPE(),
+diff --git a/src/slave/containerizer/mesos/provisioner/backends/copy.cpp b/src/slave/containerizer/mesos/provisioner/backends/copy.cpp
+index b9f6d7a..0fcf455 100644
+--- a/src/slave/containerizer/mesos/provisioner/backends/copy.cpp
++++ b/src/slave/containerizer/mesos/provisioner/backends/copy.cpp
+@@ -141,7 +141,7 @@ Future<Nothing> CopyBackendProcess::_provision(
+ #endif // __APPLE__ || __FreeBSD__
+ 
+   Try<Subprocess> s = subprocess(
+-      "cp",
++      "@cp@",
+       args,
+       Subprocess::PATH("/dev/null"),
+       Subprocess::PATH("/dev/null"),
+diff --git a/src/uri/fetchers/copy.cpp b/src/uri/fetchers/copy.cpp
+index f095ad6..ee0c2a7 100644
+--- a/src/uri/fetchers/copy.cpp
++++ b/src/uri/fetchers/copy.cpp
+@@ -88,7 +88,7 @@ Future<Nothing> CopyFetcherPlugin::fetch(
+   const vector<string> argv = {"cp", "-a", uri.path(), directory};
+ 
+   Try<Subprocess> s = subprocess(
+-      "cp",
++      "@cp@",
+       argv,
+       Subprocess::PATH("/dev/null"),
+       Subprocess::PIPE(),
+diff --git a/src/uri/fetchers/curl.cpp b/src/uri/fetchers/curl.cpp
+index cc3f9ee..691d2d9 100644
+--- a/src/uri/fetchers/curl.cpp
++++ b/src/uri/fetchers/curl.cpp
+@@ -98,7 +98,7 @@ Future<Nothing> CurlFetcherPlugin::fetch(
+   };
+ 
+   Try<Subprocess> s = subprocess(
+-      "curl",
++      "@curl@",
+       argv,
+       Subprocess::PATH("/dev/null"),
+       Subprocess::PIPE(),
+diff --git a/src/uri/fetchers/docker.cpp b/src/uri/fetchers/docker.cpp
+index 211be6f..d7e3771 100644
+--- a/src/uri/fetchers/docker.cpp
++++ b/src/uri/fetchers/docker.cpp
+@@ -113,7 +113,7 @@ static Future<http::Response> curl(
+ 
+   // TODO(jieyu): Kill the process if discard is called.
+   Try<Subprocess> s = subprocess(
+-      "curl",
++      "@curl@",
+       argv,
+       Subprocess::PATH("/dev/null"),
+       Subprocess::PIPE(),
+@@ -212,7 +212,7 @@ static Future<int> download(
+ 
+   // TODO(jieyu): Kill the process if discard is called.
+   Try<Subprocess> s = subprocess(
+-      "curl",
++      "@curl@",
+       argv,
+       Subprocess::PATH("/dev/null"),
+       Subprocess::PIPE(),

pkgs/applications/networking/cluster/mesos/rb51324.patch

@@ -1,17 +1,16 @@
-diff --git a/3rdparty/libprocess/3rdparty/stout/include/stout/os/ls.hpp b/3rdparty/libprocess/3rdparty/stout/include/stout/os/ls.hpp
+diff --git a/3rdparty/stout/include/stout/os/ls.hpp b/3rdparty/stout/include/stout/os/ls.hpp
-index f8da9ef74a885cc39424b3e50cebca905d88ca44..25e2bec6415f2382291cf8da5c0a8c44cf882d27 100644
+index f8da9ef..6d549d3 100644
---- a/3rdparty/libprocess/3rdparty/stout/include/stout/os/ls.hpp
+--- a/3rdparty/stout/include/stout/os/ls.hpp
-+++ b/3rdparty/libprocess/3rdparty/stout/include/stout/os/ls.hpp
++++ b/3rdparty/stout/include/stout/os/ls.hpp
-@@ -18,6 +18,8 @@
+@@ -18,6 +18,7 @@
  #else
  #include <dirent.h>
  #endif // __WINDOWS__
 +
-+#include <errno.h>
  #include <stdlib.h>
  
  #include <list>
-@@ -26,8 +28,6 @@
+@@ -26,8 +27,6 @@
  #include <stout/error.hpp>
  #include <stout/try.hpp>
  
@@ -20,17 +19,17 @@ index f8da9ef74a885cc39424b3e50cebca905d88ca44..25e2bec6415f2382291cf8da5c0a8c44
  
  namespace os {
  
-@@ -36,36 +36,32 @@ inline Try<std::list<std::string>> ls(const std::string& directory)
+@@ -36,36 +35,32 @@ inline Try<std::list<std::string>> ls(const std::string& directory)
    DIR* dir = opendir(directory.c_str());
  
-   if (dir == NULL) {
+   if (dir == nullptr) {
 -    // Preserve `opendir` error.
      return ErrnoError("Failed to opendir '" + directory + "'");
    }
  
 -  dirent* temp = (dirent*) malloc(os::dirent_size(dir));
 -
--  if (temp == NULL) {
+-  if (temp == nullptr) {
 -    // Preserve `malloc` error.
 -    ErrnoError error("Failed to allocate directory entries");
 -    closedir(dir);
@@ -41,7 +40,7 @@ index f8da9ef74a885cc39424b3e50cebca905d88ca44..25e2bec6415f2382291cf8da5c0a8c44
    struct dirent* entry;
 -  int error;
  
--  while ((error = readdir_r(dir, temp, &entry)) == 0 && entry != NULL) {
+-  while ((error = readdir_r(dir, temp, &entry)) == 0 && entry != nullptr) {
 +  // Zero `errno` before starting to call `readdir`. This is necessary
 +  // to allow us to determine when `readdir` returns an error.
 +  errno = 0;

pkgs/applications/networking/cluster/mesos/rb51325.patch

@@ -1,34 +1,35 @@
-diff -Naur a/3rdparty/libprocess/3rdparty/stout/include/Makefile.am b/3rdparty/libprocess/3rdparty/stout/include/Makefile.am
+diff --git a/3rdparty/stout/include/Makefile.am b/3rdparty/stout/include/Makefile.am
---- a/3rdparty/libprocess/3rdparty/stout/include/Makefile.am	2016-09-02 15:20:04.834457344 +0200
+index 1f2ee85..b0b08d8 100644
-+++ b/3rdparty/libprocess/3rdparty/stout/include/Makefile.am	2016-09-02 15:21:00.190983981 +0200
+--- a/3rdparty/stout/include/Makefile.am
-@@ -62,7 +62,6 @@
++++ b/3rdparty/stout/include/Makefile.am
-   stout/os/chroot.hpp			\
+@@ -64,7 +64,6 @@ nobase_include_HEADERS =			\
-   stout/os/close.hpp			\
+   stout/os/chroot.hpp				\
-   stout/os/constants.hpp		\
+   stout/os/close.hpp				\
--  stout/os/direntsize.hpp		\
+   stout/os/constants.hpp			\
-   stout/os/environment.hpp		\
+-  stout/os/direntsize.hpp			\
-   stout/os/exists.hpp			\
+   stout/os/environment.hpp			\
-   stout/os/fcntl.hpp			\
+   stout/os/exists.hpp				\
-@@ -101,7 +100,6 @@
+   stout/os/fcntl.hpp				\
-   stout/os/posix/bootid.hpp		\
+@@ -108,7 +107,6 @@ nobase_include_HEADERS =			\
-   stout/os/posix/chown.hpp		\
+   stout/os/posix/chown.hpp			\
-   stout/os/posix/chroot.hpp		\
+   stout/os/posix/chroot.hpp			\
--  stout/os/posix/direntsize.hpp		\
+   stout/os/posix/close.hpp			\
-   stout/os/posix/exists.hpp		\
+-  stout/os/posix/direntsize.hpp			\
-   stout/os/posix/fcntl.hpp		\
+   stout/os/posix/exists.hpp			\
-   stout/os/posix/fork.hpp		\
+   stout/os/posix/fcntl.hpp			\
-@@ -118,7 +116,6 @@
+   stout/os/posix/fork.hpp			\
-   stout/os/raw/environment.hpp		\
+@@ -134,7 +132,6 @@ nobase_include_HEADERS =			\
-   stout/os/windows/bootid.hpp		\
+   stout/os/windows/bootid.hpp			\
-   stout/os/windows/chroot.hpp		\
+   stout/os/windows/chroot.hpp			\
--  stout/os/windows/direntsize.hpp	\
+   stout/os/windows/close.hpp			\
-   stout/os/windows/exists.hpp		\
+-  stout/os/windows/direntsize.hpp		\
-   stout/os/windows/fcntl.hpp		\
+   stout/os/windows/exists.hpp			\
-   stout/os/windows/fork.hpp		\
+   stout/os/windows/fcntl.hpp			\
-diff --git a/3rdparty/libprocess/3rdparty/stout/include/stout/os/direntsize.hpp b/3rdparty/libprocess/3rdparty/stout/include/stout/os/direntsize.hpp
+   stout/os/windows/fork.hpp			\
+diff --git a/3rdparty/stout/include/stout/os/direntsize.hpp b/3rdparty/stout/include/stout/os/direntsize.hpp
 deleted file mode 100644
-index 819f99a89862491e99873bdedc603317b91266b0..0000000000000000000000000000000000000000
+index 819f99a..0000000
---- a/3rdparty/libprocess/3rdparty/stout/include/stout/os/direntsize.hpp
+--- a/3rdparty/stout/include/stout/os/direntsize.hpp
 +++ /dev/null
 @@ -1,26 +0,0 @@
 -// Licensed under the Apache License, Version 2.0 (the "License");
@@ -57,10 +58,10 @@ index 819f99a89862491e99873bdedc603317b91266b0..00000000000000000000000000000000
 -
 -
 -#endif // __STOUT_OS_DIRENTSIZE_HPP__
-diff --git a/3rdparty/libprocess/3rdparty/stout/include/stout/os/posix/direntsize.hpp b/3rdparty/libprocess/3rdparty/stout/include/stout/os/posix/direntsize.hpp
+diff --git a/3rdparty/stout/include/stout/os/posix/direntsize.hpp b/3rdparty/stout/include/stout/os/posix/direntsize.hpp
 deleted file mode 100644
-index 9d8f72eb607a288e77f92b39b91542ff5eb2fa21..0000000000000000000000000000000000000000
+index 9d8f72e..0000000
---- a/3rdparty/libprocess/3rdparty/stout/include/stout/os/posix/direntsize.hpp
+--- a/3rdparty/stout/include/stout/os/posix/direntsize.hpp
 +++ /dev/null
 @@ -1,42 +0,0 @@
 -// Licensed under the Apache License, Version 2.0 (the "License");
@@ -105,10 +106,10 @@ index 9d8f72eb607a288e77f92b39b91542ff5eb2fa21..00000000000000000000000000000000
 -} // namespace os {
 -
 -#endif // __STOUT_OS_POSIX_DIRENTSIZE_HPP__
-diff --git a/3rdparty/libprocess/3rdparty/stout/include/stout/os/windows/direntsize.hpp b/3rdparty/libprocess/3rdparty/stout/include/stout/os/windows/direntsize.hpp
+diff --git a/3rdparty/stout/include/stout/os/windows/direntsize.hpp b/3rdparty/stout/include/stout/os/windows/direntsize.hpp
 deleted file mode 100644
-index 7c8c7a06f478b3a80341a874494cff21f71fc397..0000000000000000000000000000000000000000
+index 7c8c7a0..0000000
---- a/3rdparty/libprocess/3rdparty/stout/include/stout/os/windows/direntsize.hpp
+--- a/3rdparty/stout/include/stout/os/windows/direntsize.hpp
 +++ /dev/null
 @@ -1,43 +0,0 @@
 -// Licensed under the Apache License, Version 2.0 (the "License");

pkgs/applications/networking/instant-messengers/pidgin-plugins/pidgin-latex/default.nix

@@ -23,7 +23,7 @@ stdenv.mkDerivation {
   };
 
   meta = with stdenv.lib; {
-    homepage = http://sourceforge.net/projects/pidgin-latex/;
+    homepage = "http://sourceforge.net/projects/pidgin-latex/";
     description = "LaTeX rendering plugin for Pidgin IM";
     license = licenses.gpl2;
     platforms = platforms.linux;

pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix

@@ -1,60 +1,59 @@
-{ stdenv, lib, fetchFromGitHub, fetchgit, qtbase, qtimageformats
+{ stdenv, lib, fetchFromGitHub, fetchgit, pkgconfig, gyp, cmake
+, qtbase, qtimageformats, qtwayland
 , breakpad, ffmpeg, openalSoft, openssl, zlib, libexif, lzma, libopus
 , gtk2, glib, cairo, pango, gdk_pixbuf, atk, libappindicator-gtk2
-, libwebp, libunity, dee, libdbusmenu-glib, libva
+, libwebp, libunity, dee, libdbusmenu-glib, libva-full, wayland
+, xcbutilrenderutil, icu, libSM, libICE, libproxy
 
-, pkgconfig, libxcb, xcbutilwm, xcbutilimage, xcbutilkeysyms
+, libxcb, xcbutilwm, xcbutilimage, xcbutilkeysyms, libxkbcommon
-, libxkbcommon, libpng, libjpeg, freetype, harfbuzz, pcre16
+, libpng, libjpeg, freetype, harfbuzz, pcre16, xproto, libX11
-, xproto, libX11, inputproto, sqlite, dbus
+, inputproto, sqlite, dbus
 }:
 
 let
   system-x86_64 = lib.elem stdenv.system lib.platforms.x86_64;
-  packagedQt = "5.6.0";
+  packagedQt = "5.6.2";
   # Hacky: split "1.2.3-4" into "1.2.3" and "4"
   systemQt = (builtins.parseDrvName qtbase.version).name;
+  qtLibs = [ qtbase qtimageformats qtwayland ];
 
 in stdenv.mkDerivation rec {
   name = "telegram-desktop-${version}";
-  version = "0.10.1";
+  version = "0.10.19";
   qtVersion = lib.replaceStrings ["."] ["_"] packagedQt;
 
   src = fetchFromGitHub {
     owner = "telegramdesktop";
     repo = "tdesktop";
     rev = "v${version}";
-    sha256 = "08isxwif6zllglkpd9i7ypxm2s4bibzqris48607bafr88ylksdk";
+    sha256 = "1p07kxfmcd90sx9bq046x03h1h807vs0pn64lfghr6m6ln8z44s3";
   };
 
   tgaur = fetchgit {
     url = "https://aur.archlinux.org/telegram-desktop.git";
-    rev = "9ce7be9efed501f988bb099956fa63729f2c25ea";
+    rev = "99bb0519f14e23fafb6884fe296d34b6f8bed5c3";
-    sha256 = "1wp6lqscpm2byizchm0bj48dg9bga02r9r69ns10zxk0gk0qvvdn";
+    sha256 = "0z5m3binbl06kk34plmfblhqz6hlnkbnjb93sam0c6c995k3sz82";
   };
 
   buildInputs = [
     breakpad ffmpeg openalSoft openssl zlib libexif lzma libopus
     gtk2 glib libappindicator-gtk2 libunity cairo pango gdk_pixbuf atk
-    dee libdbusmenu-glib libva
+    dee libdbusmenu-glib libva-full xcbutilrenderutil icu libproxy
+    libSM libICE
     # Qt dependencies
     libxcb xcbutilwm xcbutilimage xcbutilkeysyms libxkbcommon
     libpng libjpeg freetype harfbuzz pcre16 xproto libX11
-    inputproto sqlite dbus libwebp
+    inputproto sqlite dbus libwebp wayland
   ];
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig gyp cmake ];
+
+  patches = [ "${tgaur}/aur-fixes.diff" ];
 
   enableParallelBuilding = true;
 
-  qmakeFlags = [
+  qtSrcs = builtins.map (x: x.src) qtLibs;
-    "CONFIG+=release"
+  qtNames = builtins.map (x: (builtins.parseDrvName x.name).name) (lib.tail qtLibs);
-    "DEFINES+=TDESKTOP_DISABLE_AUTOUPDATE"
-    "DEFINES+=TDESKTOP_DISABLE_REGISTER_CUSTOM_SCHEME"
-    "INCLUDEPATH+=${breakpad}/include/breakpad"
-    "QT_TDESKTOP_VERSION=${systemQt}"
-  ];
-
-  qtSrcs = [ qtbase.src qtimageformats.src ];
   qtPatches = qtbase.patches;
 
   buildCommand = ''
@@ -62,15 +61,23 @@ in stdenv.mkDerivation rec {
     cd "$sourceRoot"
 
     patchPhase
-    sed -i 'Telegram/Telegram.pro' \
-      -e 's,CUSTOM_API_ID,,g' \
-      -e 's,/usr,/does-not-exist,g' \
-      -e 's, -flto,,g' \
-      -e 's,LIBS += .*libbreakpad_client.a,LIBS += ${breakpad}/lib/libbreakpad_client.a,' \
-      -e 's, -static-libstdc++,,g' \
-      -e '/LIBS += .*libxkbcommon.a/d'
 
-    export qmakeFlags="$qmakeFlags QT_TDESKTOP_PATH=$PWD/../qt"
+    sed -i Telegram/gyp/Telegram.gyp \
+      -e 's,/usr/include/breakpad,${breakpad}/include/breakpad,g'
+
+    sed -i Telegram/gyp/telegram_linux.gypi \
+      -e 's,/usr,/does-not-exist,g' \
+      -e 's,-flto,,g'
+
+    sed -i Telegram/gyp/qt.gypi \
+      -e 's,${packagedQt},${systemQt},g'
+
+    gypFlagsArray=(
+      "-Dlinux_path_qt=$PWD/../qt"
+      "-Dlinux_lib_ssl=-lssl"
+      "-Dlinux_lib_crypto=-lcrypto"
+      "-Dlinux_lib_icu=-licuuc -licutu -licui18n"
+    )
 
     export QMAKE=$PWD/../qt/bin/qmake
     ( mkdir -p ../Libraries
@@ -79,7 +86,7 @@ in stdenv.mkDerivation rec {
         tar -xaf $i
       done
       cd qtbase-*
-      # This patch is outdated but the fixes doesn't feel very important
+      # This patch is often outdated but the fixes doesn't feel very important
       patch -p1 < ../../$sourceRoot/Telegram/Patches/qtbase_${qtVersion}.diff || true
       for i in $qtPatches; do
         patch -p1 < $i
@@ -89,8 +96,8 @@ in stdenv.mkDerivation rec {
 
       export configureFlags="-prefix "$PWD/../qt" -release -opensource -confirm-license -system-zlib \
         -system-libpng -system-libjpeg -system-freetype -system-harfbuzz -system-pcre -system-xcb \
-        -system-xkbcommon-x11 -no-opengl -static -nomake examples -nomake tests \
+        -system-xkbcommon-x11 -no-eglfs -no-gtkstyle -static -nomake examples -nomake tests \
-        -openssl-linked -dbus-linked -system-sqlite -verbose -no-gtkstyle \
+        -no-directfb -system-proxies -openssl-linked -dbus-linked -system-sqlite -verbose \
         ${lib.optionalString (!system-x86_64) "-no-sse2"} -no-sse3 -no-ssse3 \
         -no-sse4.1 -no-sse4.2 -no-avx -no-avx2 -no-mips_dsp -no-mips_dspr2"
       export dontAddPrefix=1
@@ -101,39 +108,29 @@ in stdenv.mkDerivation rec {
         buildPhase
         make install
       )
-
+      for i in $qtNames; do
-      ( cd qtimageformats-*
+        ( cd $i-*
-        $QMAKE
+          $QMAKE
-        buildPhase
+          buildPhase
-        make install
+          make install
-      )
+        )
+      done
     )
 
-    ( mkdir -p Linux/obj/codegen_style/Debug
+    ( cd Telegram/gyp
-      cd Linux/obj/codegen_style/Debug
+      gyp "''${gypFlagsArray[@]}" --depth=. --generator-output=../.. -Goutput_dir=out Telegram.gyp --format=cmake
-      $QMAKE $qmakeFlags ../../../../Telegram/build/qmake/codegen_style/codegen_style.pro
-      buildPhase
     )
-    ( mkdir -p Linux/obj/codegen_numbers/Debug
+
-      cd Linux/obj/codegen_numbers/Debug
+    ( cd out/Release
-      $QMAKE $qmakeFlags ../../../../Telegram/build/qmake/codegen_numbers/codegen_numbers.pro
+      export ASM=$(type -p gcc)
-      buildPhase
+      cmake .
-    )
+      # For some reason, it can't find stdafx.h -- we need to build dependencies till it fails and then retry.
-    ( mkdir -p Linux/DebugIntermediateLang
+      buildPhase || true
-      cd Linux/DebugIntermediateLang
+      export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -include stdafx.h"
-      $QMAKE $qmakeFlags ../../Telegram/MetaLang.pro
       buildPhase
     )
 
-    ( mkdir -p Linux/ReleaseIntermediate
+    install -Dm755 out/Release/Telegram $out/bin/telegram-desktop
-      cd Linux/ReleaseIntermediate
-      $QMAKE $qmakeFlags ../../Telegram/Telegram.pro
-      pattern="^PRE_TARGETDEPS +="
-      grep "$pattern" "../../Telegram/Telegram.pro" | sed "s/$pattern//g" | xargs make
-      buildPhase
-    )
-
-    install -Dm755 Linux/Release/Telegram $out/bin/telegram-desktop
     mkdir -p $out/share/applications $out/share/kde4/services
     sed "s,/usr/bin,$out/bin,g" $tgaur/telegramdesktop.desktop > $out/share/applications/telegramdesktop.desktop
     sed "s,/usr/bin,$out/bin,g" $tgaur/tg.protocol > $out/share/kde4/services/tg.protocol

pkgs/applications/networking/mailreaders/notmuch-addrlookup/default.nix

@@ -11,7 +11,6 @@ stdenv.mkDerivation rec {
     sha256 = "0mz0llf1ggl1k46brgrqj3i8qlg1ycmkc5a3a0kg8fg4s1c1m6xk";
   };
 
-
   buildInputs = [ pkgconfig glib notmuch ];
 
   installPhase = ''
@@ -19,12 +18,10 @@ stdenv.mkDerivation rec {
     cp notmuch-addrlookup "$out/bin"
   '';
 
-
-
   meta = with stdenv.lib; {
     description = "Address lookup tool for Notmuch in C";
     homepage = https://github.com/aperezdc/notmuch-addrlookup-c;
-    maintainers = with maintainers; [ mog ];
+    maintainers = with maintainers; [ mog garbas ];
     platforms = platforms.linux;
     license = licenses.mit;
   };

pkgs/applications/networking/mailreaders/notmuch/default.nix

@@ -1,11 +1,16 @@
-{ fetchurl, stdenv, bash, emacs, fixDarwinDylibNames
+{ fetchurl, stdenv, fixDarwinDylibNames, gdb
-, gdb, glib, gmime, gnupg
+, pkgconfig, gnupg
-, pkgconfig, talloc, xapian
+, xapian, gmime, talloc, zlib
-, sphinx, python
+, doxygen, perl
+, pythonPackages
+, bash-completion
+, emacs
+, ruby
+, which, dtach, openssl, bash
 }:
 
 stdenv.mkDerivation rec {
-  version = "0.22";
+  version = "0.23.2";
   name = "notmuch-${version}";
 
   passthru = {
@@ -15,17 +20,39 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "http://notmuchmail.org/releases/${name}.tar.gz";
-    sha256 = "16mrrw6xpsgip4dy8rfx0zncij5h41fsg2aah6x6z83bjbpihhfn";
+    sha256 = "1g4p5hsrqqbqk6s2w756als60wppvjgpyq104smy3w9vshl7bzgd";
   };
 
-  buildInputs = [ bash emacs glib gmime gnupg pkgconfig talloc xapian sphinx python ]
+  buildInputs = [
+    pkgconfig gnupg # undefined dependencies
+    xapian gmime talloc zlib  # dependencies described in INSTALL
+    doxygen perl  # (optional) api docs
+    pythonPackages.sphinx pythonPackages.python  # (optional) documentation -> doc/INSTALL
+    bash-completion  # (optional) dependency to install bash completion
+    emacs  # (optional) to byte compile emacs code
+    ruby  # (optional) ruby bindings
+    which dtach openssl bash  # test dependencies
+    ]
     ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames
     ++ stdenv.lib.optional (!stdenv.isDarwin) gdb;
 
+  doCheck = !stdenv.isDarwin;
+  checkTarget = "test";
+
   patchPhase = ''
+    # XXX: disabling few tests since i have no idea how to make them pass for now
+    rm -f test/T010-help-test.sh \
+          test/T350-crypto.sh \
+          test/T355-smime.sh
+
     find test -type f -exec \
       sed -i \
-        "1s_#!/usr/bin/env bash_#!${bash}/bin/bash_" \
+        -e "1s|#!/usr/bin/env bash|#!${bash}/bin/bash|" \
+        -e "s|gpg |${gnupg}/bin/gpg2 |" \
+        -e "s| gpg| ${gnupg}/bin/gpg2|" \
+        -e "s|gpgsm |${gnupg}/bin/gpgsm |" \
+        -e "s| gpgsm| ${gnupg}/bin/gpgsm|" \
+        -e "s|crypto.gpg_path=gpg|crypto.gpg_path=${gnupg}/bin/gpg2|" \
         "{}" ";"
 
     for src in \
@@ -38,44 +65,37 @@ stdenv.mkDerivation rec {
     done
   '';
 
+  preFixup = stdenv.lib.optionalString stdenv.isDarwin ''
+    set -e
+
+    die() {
+      >&2 echo "$@"
+      exit 1
+    }
+
+    prg="$out/bin/notmuch"
+    lib="$(find "$out/lib" -name 'libnotmuch.?.dylib')"
+
+    [[ -s "$prg" ]] || die "couldn't find notmuch binary"
+    [[ -s "$lib" ]] || die "couldn't find libnotmuch"
+
+    badname="$(otool -L "$prg" | awk '$1 ~ /libtalloc/ { print $1 }')"
+    goodname="$(find "${talloc}/lib" -name 'libtalloc.?.?.?.dylib')"
+
+    [[ -n "$badname" ]]  || die "couldn't find libtalloc reference in binary"
+    [[ -n "$goodname" ]] || die "couldn't find libtalloc in nix store"
+
+    echo "fixing libtalloc link in $lib"
+    install_name_tool -change "$badname" "$goodname" "$lib"
+
+    echo "fixing libtalloc link in $prg"
+    install_name_tool -change "$badname" "$goodname" "$prg"
+  '';
+
   postInstall = ''
     make install-man
   '';
 
-  preFixup = if stdenv.isDarwin then
-    ''
-      set -e
-
-      die() {
-        >&2 echo "$@"
-        exit 1
-      }
-
-      prg="$out/bin/notmuch"
-      lib="$(find "$out/lib" -name 'libnotmuch.?.dylib')"
-
-      [[ -s "$prg" ]] || die "couldn't find notmuch binary"
-      [[ -s "$lib" ]] || die "couldn't find libnotmuch"
-
-      badname="$(otool -L "$prg" | awk '$1 ~ /libtalloc/ { print $1 }')"
-      goodname="$(find "${talloc}/lib" -name 'libtalloc.?.?.?.dylib')"
-
-      [[ -n "$badname" ]]  || die "couldn't find libtalloc reference in binary"
-      [[ -n "$goodname" ]] || die "couldn't find libtalloc in nix store"
-
-      echo "fixing libtalloc link in $lib"
-      install_name_tool -change "$badname" "$goodname" "$lib"
-
-      echo "fixing libtalloc link in $prg"
-      install_name_tool -change "$badname" "$goodname" "$prg"
-    ''
-  else
-    "";
-
-  # XXX: emacs tests broken
-  doCheck = false;
-  checkTarget = "test";
-
   meta = {
     description = "Mail indexer";
     license = stdenv.lib.licenses.gpl3;

pkgs/applications/networking/syncthing/default.nix

@@ -1,14 +1,14 @@
 { stdenv, lib, fetchFromGitHub, go, pkgs }:
 
 stdenv.mkDerivation rec {
-  version = "0.14.11";
+  version = "0.14.12";
   name = "syncthing-${version}";
 
   src = fetchFromGitHub {
     owner  = "syncthing";
     repo   = "syncthing";
     rev    = "v${version}";
-    sha256 = "12b8284mya5z1q7ighbzk8rqxj0kcv5n0l39dygikfcbl1krr6sg";
+    sha256 = "09w0i9rmdi9fjsphib2x6gs6yn5d1a41nh1pm4k9ks31am9zdwsm";
   };
 
   buildInputs = [ go ];

pkgs/applications/science/math/mathematica/10.nix

@@ -0,0 +1,138 @@
+{ stdenv
+, coreutils
+, patchelf
+, requireFile
+, alsaLib
+, fontconfig
+, freetype
+, gcc
+, glib
+, libpng
+, ncurses
+, opencv
+, openssl
+, unixODBC
+, xorg
+, zlib
+, libxml2
+, libuuid
+}:
+
+let
+  platform =
+    if stdenv.system == "i686-linux" || stdenv.system == "x86_64-linux" then
+      "Linux"
+    else
+      throw "Mathematica requires i686-linux or x86_64 linux";
+in
+stdenv.mkDerivation rec {
+  version = "10.0.2";
+
+  name = "mathematica-${version}";
+
+  src = requireFile rec {
+    name = "Mathematica_${version}_LINUX.sh";
+    message = '' 
+      This nix expression requires that ${name} is
+      already part of the store. Find the file on your Mathematica CD
+      and add it to the nix store with nix-store --add-fixed sha256 <FILE>.
+    '';
+    sha256 = "1d2yaiaikzcacjamlw64g3xkk81m3pb4vz4an12cv8nb7kb20x9l";
+  };
+
+  buildInputs = [
+    coreutils
+    patchelf
+    alsaLib
+    coreutils
+    fontconfig
+    freetype
+    gcc.cc
+    gcc.libc
+    glib
+    ncurses
+    opencv
+    openssl
+    unixODBC
+    libxml2
+    libuuid
+  ] ++ (with xorg; [
+    libX11
+    libXext
+    libXtst
+    libXi
+    libXmu
+    libXrender
+    libxcb
+    libXcursor
+    libXfixes
+    libXrandr
+    libICE
+    libSM
+  ]);
+
+  ldpath = stdenv.lib.makeLibraryPath buildInputs
+    + stdenv.lib.optionalString (stdenv.system == "x86_64-linux")
+      (":" + stdenv.lib.makeSearchPathOutput "lib" "lib64" buildInputs);
+
+  phases = "unpackPhase installPhase fixupPhase";
+
+  unpackPhase = ''
+    echo "=== Extracting makeself archive ==="
+    # find offset from file
+    offset=$(${stdenv.shell} -c "$(grep -axm1 -e 'offset=.*' $src); echo \$offset" $src)
+    dd if="$src" ibs=$offset skip=1 | tar -xf -
+    cd Unix
+  '';
+
+  installPhase = ''
+    cd Installer
+    # don't restrict PATH, that has already been done
+    sed -i -e 's/^PATH=/# PATH=/' MathInstaller
+
+    echo "=== Running MathInstaller ==="
+    ./MathInstaller -auto -createdir=y -execdir=$out/bin -targetdir=$out/libexec/Mathematica -platforms=${platform} -silent
+  '';
+
+  preFixup = ''
+    echo "=== PatchElfing away ==="
+    # This code should be a bit forgiving of errors, unfortunately
+    set +e
+    find $out/libexec/Mathematica/SystemFiles -type f -perm -0100 | while read f; do
+      type=$(readelf -h "$f" 2>/dev/null | grep 'Type:' | sed -e 's/ *Type: *\([A-Z]*\) (.*/\1/')
+      if [ -z "$type" ]; then
+        :
+      elif [ "$type" == "EXEC" ]; then
+        echo "patching $f executable <<"
+        patchelf --shrink-rpath "$f"
+        patchelf \
+	  --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+          --set-rpath "$(patchelf --print-rpath "$f"):${ldpath}" \
+          "$f" \
+          && patchelf --shrink-rpath "$f" \
+          || echo unable to patch ... ignoring 1>&2
+      elif [ "$type" == "DYN" ]; then
+        echo "patching $f library <<"
+        patchelf \
+          --set-rpath "$(patchelf --print-rpath "$f"):${ldpath}" \
+          "$f" \
+          && patchelf --shrink-rpath "$f" \
+          || echo unable to patch ... ignoring 1>&2
+      else
+        echo "not patching $f <<: unknown elf type"
+      fi
+    done
+  '';
+
+  # all binaries are already stripped
+  dontStrip = true;
+
+  # we did this in prefixup already
+  dontPatchELF = true;
+
+  meta = {
+    description = "Wolfram Mathematica computational software system";
+    homepage = "http://www.wolfram.com/mathematica/";
+    license = stdenv.lib.licenses.unfree;
+  };
+}

pkgs/applications/science/math/mathematica/default.nix

@@ -26,7 +26,7 @@ let
       throw "Mathematica requires i686-linux or x86_64 linux";
 in
 stdenv.mkDerivation rec {
-  version = "10.0.2";
+  version = "11.0.1";
 
   name = "mathematica-${version}";
 
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
       already part of the store. Find the file on your Mathematica CD
       and add it to the nix store with nix-store --add-fixed sha256 <FILE>.
     '';
-    sha256 = "1d2yaiaikzcacjamlw64g3xkk81m3pb4vz4an12cv8nb7kb20x9l";
+    sha256 = "1qqwz8gbw74rnnyirpbdanwx3d25s4x0i4zc7bs6kp959x66cdkw";
   };
 
   buildInputs = [
@@ -89,9 +89,10 @@ stdenv.mkDerivation rec {
     cd Installer
     # don't restrict PATH, that has already been done
     sed -i -e 's/^PATH=/# PATH=/' MathInstaller
+    sed -i -e 's/\/bin\/bash/\/bin\/sh/' MathInstaller
 
     echo "=== Running MathInstaller ==="
-    ./MathInstaller -auto -createdir=y -execdir=$out/bin -targetdir=$out/libexec/Mathematica -platforms=${platform} -silent
+    ./MathInstaller -auto -createdir=y -execdir=$out/bin -targetdir=$out/libexec/Mathematica -silent
   '';
 
   preFixup = ''

pkgs/applications/version-management/git-and-tools/default.nix

@@ -45,6 +45,8 @@ rec {
 
   git-annex-remote-b2 = callPackage ./git-annex-remote-b2 { };
 
+  git-annex-remote-rclone = callPackage ./git-annex-remote-rclone { };
+
   # support for bugzilla
   git-bz = callPackage ./git-bz { };
 

pkgs/applications/version-management/git-and-tools/git-annex-remote-rclone/default.nix

@@ -0,0 +1,32 @@
+{ stdenv, fetchFromGitHub, rclone, makeWrapper }:
+
+stdenv.mkDerivation rec {
+  name = "git-annex-remote-rclone-${version}";
+  version = "0.4";
+  rev = "v${version}";
+
+  src = fetchFromGitHub {
+    inherit rev;
+    owner = "DanielDent";
+    repo = "git-annex-remote-rclone";
+    sha256 = "1myk307hqm8dlxhkmwr347rdd28niv5h0gyrxm30y77zlly30ddk";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  phases = [ "unpackPhase" "installPhase" "fixupPhase" ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp git-annex-remote-rclone $out/bin
+    wrapProgram "$out/bin/git-annex-remote-rclone" \
+      --prefix PATH ":" "${stdenv.lib.makeBinPath [ rclone ]}"
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/DanielDent/git-annex-remote-rclone;
+    description = "Use rclone supported cloud storage providers with git-annex";
+    license = licenses.gpl3;
+    maintainers = [ maintainers.montag451 ];
+  };
+}

pkgs/applications/video/avidemux/default.nix

@@ -14,11 +14,11 @@
 }:
 
 let
-  version = "2.6.12";
+  version = "2.6.15";
 
   src = fetchurl {
     url = "mirror://sourceforge/avidemux/avidemux/${version}/avidemux_${version}.tar.gz";
-    sha256 = "0nz52yih8sff53inndkh2dba759xjzsh4b8xjww419lcpk0qp6kn";
+    sha256 = "0mr2nll81ki9d1s68klhm19jmr15450wjaws1p0b0y2qqwyrprdh";
   };
 
   common = {
@@ -43,7 +43,7 @@ let
                   ;
 
     meta = {
-      homepage = http://fixounet.free.fr/avidemux/;
+      homepage = "http://fixounet.free.fr/avidemux/";
       description = "Free video editor designed for simple video editing tasks";
       maintainers = with stdenv.lib.maintainers; [ viric abbradar ];
       platforms = with stdenv.lib.platforms; linux;

pkgs/applications/video/avidemux/dynamic_install_dir.patch

@@ -1,12 +1,12 @@
-diff -ru3 avidemux_2.6.12.old/avidemux_core/ADM_core/src/ADM_fileio.cpp avidemux_2.6.12/avidemux_core/ADM_core/src/ADM_fileio.cpp
+diff -ru3 avidemux_2.6.15-old/avidemux_core/ADM_core/src/ADM_folder_linux.cpp avidemux_2.6.15/avidemux_core/ADM_core/src/ADM_folder_linux.cpp
---- avidemux_2.6.12.old/avidemux_core/ADM_core/src/ADM_fileio.cpp	2016-03-25 15:26:00.368213627 +0300
+--- avidemux_2.6.15-old/avidemux_core/ADM_core/src/ADM_folder_linux.cpp	2016-11-23 02:13:41.406566362 +0300
-+++ avidemux_2.6.12/avidemux_core/ADM_core/src/ADM_fileio.cpp	2016-03-26 02:32:56.163550537 +0300
++++ avidemux_2.6.15/avidemux_core/ADM_core/src/ADM_folder_linux.cpp	2016-11-23 02:14:33.433566147 +0300
-@@ -393,7 +393,7 @@
+@@ -92,7 +92,7 @@
- 
+ 
- 	return ADM_getRelativePath(buffer, base1, base2, base3);
+ char *ADM_getInstallRelativePath(const char *base1, const char *base2, const char *base3)
- #else
+ {
--	return ADM_getRelativePath(ADM_INSTALL_DIR, base1, base2, base3);
+-	return ADM_getRelativePath(ADM_INSTALL_DIR, base1, base2, base3);
-+	return ADM_getRelativePath(getenv("ADM_ROOT_DIR"), base1, base2, base3);
++	return ADM_getRelativePath(getenv("ADM_ROOT_DIR"), base1, base2, base3);
- #endif
+ }
- }
+ const std::string ADM_getI8NDir(const std::string &flavor)
- 
+ {

pkgs/applications/video/mpv/default.nix

@@ -79,13 +79,13 @@ let
   };
 in stdenv.mkDerivation rec {
   name = "mpv-${version}";
-  version = "0.21.0";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "mpv-player";
     repo  = "mpv";
     rev    = "v${version}";
-    sha256 = "1v1qfppysi0qn40q9z7cx9gs7pcrz2hn1g44iynygvgj29h1gify";
+    sha256 = "0mv8fs2zxp6pvpi5xdrpvvqcaa5f0c83jdfi0pfqnwbpkz1kb9s6";
   };
 
   patchPhase = ''
@@ -160,6 +160,11 @@ in stdenv.mkDerivation rec {
       --prefix PATH : "${youtube-dl}/bin" \
   '' + optionalString vapoursynthSupport ''
       --prefix PYTHONPATH : "$(toPythonPath ${vapoursynth}):$PYTHONPATH"
+  '' + ''
+
+    cp TOOLS/umpv $out/bin
+    wrapProgram $out/bin/umpv \
+      --set MPV "$out/bin/mpv"
   '';
 
   meta = with stdenv.lib; {

pkgs/applications/video/quvi/library.nix

@@ -1,4 +1,4 @@
-{stdenv, fetchurl, pkgconfig, lua5, curl, quvi_scripts, libproxy, libgcrypt}:
+{ stdenv, fetchurl, pkgconfig, lua5, curl, quvi_scripts, libproxy, libgcrypt, glib }:
 
 stdenv.mkDerivation rec {
   name = "libquvi-${version}";
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "1cl1kbgxl1jnx2nwx4z90l0lap09lnnj1fg7hxsxk3m6aj4y4grd";
   };
 
-  buildInputs = [ pkgconfig lua5 curl quvi_scripts libproxy libgcrypt ];
+  buildInputs = [ pkgconfig lua5 curl quvi_scripts libproxy libgcrypt glib ];
 
   meta = {
     description = "Web video downloader";

pkgs/applications/virtualization/qemu/default.nix

@@ -1,6 +1,6 @@
 { stdenv, fetchurl, fetchpatch, python2, zlib, pkgconfig, glib
 , ncurses, perl, pixman, vde2, alsaLib, texinfo, libuuid, flex
-, bison, lzo, snappy, libaio, gnutls, nettle
+, bison, lzo, snappy, libaio, gnutls, nettle, curl
 , makeWrapper
 , attr, libcap, libcap_ng
 , CoreServices, Cocoa, rez, setfile
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   buildInputs =
     [ python2 zlib pkgconfig glib ncurses perl pixman
       vde2 texinfo libuuid flex bison makeWrapper lzo snappy
-      gnutls nettle
+      gnutls nettle curl
     ]
     ++ optionals stdenv.isDarwin [ CoreServices Cocoa rez setfile ]
     ++ optionals seccompSupport [ libseccomp ]
@@ -123,6 +123,11 @@ stdenv.mkDerivation rec {
       url = "http://git.qemu.org/?p=qemu.git;a=patch;h=8caed3d564672e8bc6d2e4c6a35228afd01f4723";
       sha256 = "19sq6fh7nh8wrk52skky4vwm80029lhm093g11f539krmzjgipik";
     })
+    (fetchpatch {
+      name = "qemu-CVE-2016-7907.patch";
+      url = "http://git.qemu.org/?p=qemu.git;a=patch;h=070c4b92b8cd5390889716677a0b92444d6e087a";
+      sha256 = "0in89697r6kwkf302v3cg16390q7qs33n2b4kba26m4x65632dxm";
+    })
 
     # FIXME: Fix for CVE-2016-9101 not yet ready: https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg03024.html
 

pkgs/applications/window-managers/windowmaker/default.nix

@@ -4,16 +4,17 @@
 
 stdenv.mkDerivation rec {
   name = "windowmaker-${version}";
-  version = "0.95.6";
+  version = "0.95.7";
   srcName = "WindowMaker-${version}";
 
   src = fetchurl {
     url = "http://windowmaker.org/pub/source/release/${srcName}.tar.gz";
-    sha256 = "1i3dw1yagsa3rs9x2na2ynqlgmbahayws0kz4vl00fla6550nns3";
+    sha256 = "1acph0nq6fsb452sl7j7a7kcc87zqqaw7qms1p8ijar19dn4hbc4";
   };
 
-  buildInputs = [ pkgconfig
+  nativeBuildInputs = [ pkgconfig ];
-                  libX11 libXext libXft libXmu libXinerama libXrandr libXpm
+
+  buildInputs = [ libX11 libXext libXft libXmu libXinerama libXrandr libXpm
                   imagemagick libpng libjpeg libexif libtiff libungif libwebp ];
 
   configureFlags = [

pkgs/applications/window-managers/xmonad-log-applet/default.nix

@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
   patches = [ ./fix-paths.patch ];
 
   meta = with stdenv.lib; {
-    homepage = http://github.com/alexkay/xmonad-log-applet;
+    homepage = "http://github.com/alexkay/xmonad-log-applet";
     license = licenses.bsd3;
     description = "An applet that will display XMonad log information (${desktopSupport} version)";
     platforms = platforms.linux;

pkgs/build-support/docker/default.nix

@@ -247,7 +247,7 @@ rec {
         echo "Adding contents..."
         for item in $contents; do
           echo "Adding $item"
-          rsync -a $item/ layer/
+          rsync -ak $item/ layer/
         done
       else
         echo "No contents to add to layer."
@@ -310,7 +310,7 @@ rec {
         echo "Adding contents..."
         for item in ${toString contents}; do
           echo "Adding $item..."
-          rsync -a $item/ layer/
+          rsync -ak $item/ layer/
         done
       '';
 

pkgs/data/fonts/xits-math/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub }:
+{ stdenv, fetchFromGitHub, python2Packages, fontforge }:
 
 stdenv.mkDerivation rec {
   name = "xits-math-${version}";
@@ -11,7 +11,11 @@ stdenv.mkDerivation rec {
     sha256 = "08nn676c41a7gmmhrzi8mm0g74z8aiaafjk48pqcwxvjj9av7xjg";
   };
 
-  phases = [ "unpackPhase" "installPhase" ];
+  nativeBuildInputs = [ fontforge ] ++ (with python2Packages; [ python fonttools ]);
+
+  postPatch = ''
+    rm *.otf
+  '';
 
   installPhase = ''
     mkdir -p $out/share/fonts/opentype
@@ -19,7 +23,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    homepage = https://github.com/khaledhosny/xits-math;
+    homepage = "https://github.com/khaledhosny/xits-math";
     description = "OpenType implementation of STIX fonts with math support";
     license = licenses.ofl;
     platforms = platforms.all;

pkgs/desktops/gnome-3/3.20/core/gnome-calculator/default.nix

@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
     homepage = https://wiki.gnome.org/action/show/Apps/Calculator;
     description = "Application that solves mathematical equations and is suitable as a default application in a Desktop environment";
     maintainers = gnome3.maintainers;
-    license = licenses.gpl2;
+    license = licenses.gpl3;
     platforms = platforms.linux;
   };
 }

pkgs/desktops/gnome-3/3.22/core/gnome-calculator/default.nix

@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     homepage = https://wiki.gnome.org/action/show/Apps/Calculator;
     description = "Application that solves mathematical equations and is suitable as a default application in a Desktop environment";
     maintainers = gnome3.maintainers;
-    license = licenses.gpl2;
+    license = licenses.gpl3;
     platforms = platforms.linux;
   };
 }

pkgs/desktops/gnome-3/3.22/games/gnome-mines/default.nix

@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     homepage = https://wiki.gnome.org/Apps/Mines;
     description = "Clear hidden mines from a minefield";
     maintainers = gnome3.maintainers;
-    license = licenses.gpl2;
+    license = licenses.gpl3;
     platforms = platforms.linux;
   };
 }

pkgs/development/compilers/ats2/default.nix

@@ -3,11 +3,11 @@
 , withContrib ? true }:
 
 let
-  versionPkg = "0.2.11" ;
+  versionPkg = "0.2.12" ;
 
   contrib = fetchurl {
     url = "mirror://sourceforge/ats2-lang/ATS2-Postiats-contrib-${versionPkg}.tgz" ;
-    sha256 = "0kc4nx1904745c1rkj9yfbayidw7rks1mwq0lxmvsgghn98dxwjn" ;
+    sha256 = "16jzabmwq5yz72dzlkc2hmvf2lan83gayn21gbl65jgpwdsbh170" ;
   };
 
   postInstallContrib = stdenv.lib.optionalString withContrib
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://sourceforge/ats2-lang/ATS2-Postiats-${version}.tgz";
-    sha256 = "140xy129fr11bdf4bj6qya9mf0fhnv2x7ksb9j46pf2yzrsrks8g";
+    sha256 = "0m8gmm1pnklixxw76yjjqqqixm2cyp91rnq4sj1k29qp4k9zxpl4";
   };
 
   buildInputs = [ gmp ];

pkgs/development/compilers/ats2/installed-lib-directory-version.patch

@@ -1,13 +1,13 @@
 Change the name of the library directory to match the version of the package.
 
-diff -Naur ATS2-Postiats-0.2.11/configure postiats-new/configure
+diff -Naur ATS2-Postiats-0.2.12/configure postiats-new/configure
---- ATS2-Postiats-0.2.11/configure	2016-10-13 12:03:20.000000000 -0400
+--- ATS2-Postiats-0.2.12/configure	2016-10-13 12:03:20.000000000 -0400
 +++ postiats-new/configure	2016-10-23 20:17:29.912579618 -0400
 @@ -1,6 +1,6 @@
  #! /bin/sh
  # Guess values for system-dependent variables and create Makefiles.
 -# Generated by GNU Autoconf 2.69 for ATS2/Postiats 0.2.10.
-+# Generated by GNU Autoconf 2.69 for ATS2/Postiats 0.2.11.
++# Generated by GNU Autoconf 2.69 for ATS2/Postiats 0.2.12.
  #
  # Report bugs to <gmpostiats@gmail.com>.
  #
@@ -17,8 +17,8 @@ diff -Naur ATS2-Postiats-0.2.11/configure postiats-new/configure
  PACKAGE_TARNAME='ats2-postiats'
 -PACKAGE_VERSION='0.2.10'
 -PACKAGE_STRING='ATS2/Postiats 0.2.10'
-+PACKAGE_VERSION='0.2.11'
++PACKAGE_VERSION='0.2.12'
-+PACKAGE_STRING='ATS2/Postiats 0.2.11'
++PACKAGE_STRING='ATS2/Postiats 0.2.12'
  PACKAGE_BUGREPORT='gmpostiats@gmail.com'
  PACKAGE_URL=''
  
@@ -27,7 +27,7 @@ diff -Naur ATS2-Postiats-0.2.11/configure postiats-new/configure
    # This message is too long to be a string in the A/UX 3.1 sh.
    cat <<_ACEOF
 -\`configure' configures ATS2/Postiats 0.2.10 to adapt to many kinds of systems.
-+\`configure' configures ATS2/Postiats 0.2.11 to adapt to many kinds of systems.
++\`configure' configures ATS2/Postiats 0.2.12 to adapt to many kinds of systems.
  
  Usage: $0 [OPTION]... [VAR=VALUE]...
  
@@ -36,7 +36,7 @@ diff -Naur ATS2-Postiats-0.2.11/configure postiats-new/configure
  if test -n "$ac_init_help"; then
    case $ac_init_help in
 -     short | recursive ) echo "Configuration of ATS2/Postiats 0.2.10:";;
-+     short | recursive ) echo "Configuration of ATS2/Postiats 0.2.11:";;
++     short | recursive ) echo "Configuration of ATS2/Postiats 0.2.12:";;
     esac
    cat <<\_ACEOF
  
@@ -45,7 +45,7 @@ diff -Naur ATS2-Postiats-0.2.11/configure postiats-new/configure
  if $ac_init_version; then
    cat <<\_ACEOF
 -ATS2/Postiats configure 0.2.10
-+ATS2/Postiats configure 0.2.11
++ATS2/Postiats configure 0.2.12
  generated by GNU Autoconf 2.69
  
  Copyright (C) 2012 Free Software Foundation, Inc.
@@ -54,7 +54,7 @@ diff -Naur ATS2-Postiats-0.2.11/configure postiats-new/configure
  running configure, to aid debugging if configure makes a mistake.
  
 -It was created by ATS2/Postiats $as_me 0.2.10, which was
-+It was created by ATS2/Postiats $as_me 0.2.11, which was
++It was created by ATS2/Postiats $as_me 0.2.12, which was
  generated by GNU Autoconf 2.69.  Invocation command line was
  
    $ $0 $@
@@ -63,7 +63,7 @@ diff -Naur ATS2-Postiats-0.2.11/configure postiats-new/configure
  # values after options handling.
  ac_log="
 -This file was extended by ATS2/Postiats $as_me 0.2.10, which was
-+This file was extended by ATS2/Postiats $as_me 0.2.11, which was
++This file was extended by ATS2/Postiats $as_me 0.2.12, which was
  generated by GNU Autoconf 2.69.  Invocation command line was
  
    CONFIG_FILES    = $CONFIG_FILES
@@ -72,19 +72,19 @@ diff -Naur ATS2-Postiats-0.2.11/configure postiats-new/configure
  ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
  ac_cs_version="\\
 -ATS2/Postiats config.status 0.2.10
-+ATS2/Postiats config.status 0.2.11
++ATS2/Postiats config.status 0.2.12
  configured by $0, generated by GNU Autoconf 2.69,
    with options \\"\$ac_cs_config\\"
  
-diff -Naur ATS2-Postiats-0.2.11/src/CBOOT/config.h postiats-new/src/CBOOT/config.h
+diff -Naur ATS2-Postiats-0.2.12/src/CBOOT/config.h postiats-new/src/CBOOT/config.h
---- ATS2-Postiats-0.2.11/src/CBOOT/config.h	2016-10-13 12:03:20.000000000 -0400
+--- ATS2-Postiats-0.2.12/src/CBOOT/config.h	2016-10-13 12:03:20.000000000 -0400
 +++ postiats-new/src/CBOOT/config.h	2016-10-23 20:16:34.613836556 -0400
 @@ -44,7 +44,7 @@
  #define PACKAGE_NAME "ATS2/Postiats"
  
  /* Define to the full name and version of this package. */
 -#define PACKAGE_STRING "ATS2/Postiats 0.2.10"
-+#define PACKAGE_STRING "ATS2/Postiats 0.2.11"
++#define PACKAGE_STRING "ATS2/Postiats 0.2.12"
  
  /* Define to the one symbol short name of this package. */
  #define PACKAGE_TARNAME "ats2-postiats"
@@ -93,7 +93,7 @@ diff -Naur ATS2-Postiats-0.2.11/src/CBOOT/config.h postiats-new/src/CBOOT/config
  
  /* Define to the version of this package. */
 -#define PACKAGE_VERSION "0.2.10"
-+#define PACKAGE_VERSION "0.2.11"
++#define PACKAGE_VERSION "0.2.12"
  
  /* The size of `void*', as computed by sizeof. */
  #define SIZEOF_VOIDP 8

pkgs/development/compilers/yosys/default.nix

@@ -2,21 +2,21 @@
 
 stdenv.mkDerivation rec {
   name = "yosys-${version}";
-  version = "2016.08.18";
+  version = "2016.11.25";
 
   srcs = [
     (fetchFromGitHub {
       owner = "cliffordwolf";
       repo = "yosys";
-      rev = "9b8e06bee177f53c34a9dd6dd907a822f21659be";
+      rev = "5c2c78e2dd12a860f830dafd73fbed8edf1a3823";
-      sha256 = "0x5c1bcayahn7pbgycxkxr6lkv9m0jpwfdlmyp2m9yzm2lpyw7dg";
+      sha256 = "1cvfkg0hllp7k2g52mxczd8d0ad7inlpkg27rrbyani2kg0066bk";
       name = "yosys";
     })
     (fetchFromBitbucket {
       owner = "alanmi";
       repo = "abc";
-      rev = "a2e5bc66a68a";
+      rev = "238674cd44f2";
-      sha256 = "09yvhj53af91nc54gmy7cbp7yljfcyj68a87494r5xvdfnsj11gy";
+      sha256 = "18xk7lqai05am11zymixilgam4jvz5f2jwy9cgillz035man2yzw";
       name = "yosys-abc";
     })
   ];

pkgs/development/haskell-modules/configuration-common.nix

@@ -144,7 +144,6 @@ self: super: {
   groupoids = dontHaddock super.groupoids;
   hamlet = dontHaddock super.hamlet;
   HaXml = dontHaddock super.HaXml;
-  HDBC-odbc = dontHaddock super.HDBC-odbc;
   hoodle-core = dontHaddock super.hoodle-core;
   hsc3-db = dontHaddock super.hsc3-db;
   http-client-conduit = dontHaddock super.http-client-conduit;
@@ -1067,6 +1066,15 @@ self: super: {
   # https://github.com/roelvandijk/terminal-progress-bar/issues/13
   terminal-progress-bar = doJailbreak super.terminal-progress-bar;
 
+  # https://github.com/hdbc/hdbc-odbc/pull/29
+  HDBC-odbc = overrideCabal super.HDBC-odbc (old: {
+    postPatch = old.postPatch or "" + ''
+      sed -e '/data BoundValue =/ { s/$/{/ ; n; n ; s/{ bvVal/  bvVal/ }' \
+          -e 's/-- | This is rather/-- This is rather/' \
+          -i Database/HDBC/ODBC/Statement.hsc
+    '';
+  });
+
   # https://github.com/vshabanov/HsOpenSSL/issues/11
   HsOpenSSL = doJailbreak super.HsOpenSSL;
 

pkgs/development/haskell-modules/configuration-hackage2nix.yaml

@@ -37,7 +37,7 @@ core-packages:
   - ghcjs-base-0
 
 default-package-overrides:
-  # LTS Haskell 7.9
+  # LTS Haskell 7.10
   - abstract-deque ==0.3
   - abstract-par ==0.3.3
   - AC-Vector ==2.3.2
@@ -155,7 +155,7 @@ default-package-overrides:
   - asn1-encoding ==0.9.4
   - asn1-parse ==0.9.4
   - asn1-types ==0.3.2
-  - async ==2.1.0
+  - async ==2.1.1
   - async-dejafu ==0.1.3.0
   - atndapi ==0.1.1.0
   - atom-conduit ==0.3.1.2
@@ -286,7 +286,7 @@ default-package-overrides:
   - cereal-conduit ==0.7.3
   - cereal-text ==0.1.0.2
   - cereal-vector ==0.2.0.1
-  - cgi ==3001.3.0.1
+  - cgi ==3001.3.0.2
   - ChannelT ==0.0.0.2
   - charset ==0.3.7.1
   - charsetdetect-ae ==1.1.0.1
@@ -314,9 +314,9 @@ default-package-overrides:
   - clash-systemverilog ==0.6.10
   - clash-verilog ==0.6.10
   - clash-vhdl ==0.6.16
-  - classy-prelude ==1.0.0.2
+  - classy-prelude ==1.0.1
-  - classy-prelude-conduit ==1.0.0
+  - classy-prelude-conduit ==1.0.1
-  - classy-prelude-yesod ==1.0.0
+  - classy-prelude-yesod ==1.0.1
   - clay ==0.11
   - clckwrks ==0.23.19.2
   - clckwrks-cli ==0.2.16
@@ -330,7 +330,7 @@ default-package-overrides:
   - clumpiness ==0.17.0.0
   - ClustalParser ==1.1.4
   - clustering ==0.2.1
-  - cmark ==0.5.3.1
+  - cmark ==0.5.4
   - cmark-highlight ==0.2.0.0
   - cmark-lucid ==0.1.0.0
   - cmdargs ==0.10.14
@@ -351,7 +351,7 @@ default-package-overrides:
   - concurrent-output ==1.7.7
   - concurrent-supply ==0.1.8
   - conduit ==1.2.8
-  - conduit-combinators ==1.0.8.1
+  - conduit-combinators ==1.0.8.2
   - conduit-extra ==1.1.15
   - conduit-iconv ==0.1.1.1
   - conduit-parse ==0.1.2.0
@@ -853,7 +853,7 @@ default-package-overrides:
   - hjsonpointer ==1.0.0.2
   - hjsonschema ==1.1.0.1
   - hledger ==1.0.1
-  - hledger-interest ==1.5
+  - hledger-interest ==1.5.1
   - hledger-lib ==1.0.1
   - hlibgit2 ==0.18.0.15
   - hlibsass ==0.1.5.0
@@ -941,7 +941,7 @@ default-package-overrides:
   - http-common ==0.8.2.0
   - http-conduit ==2.1.11
   - http-date ==0.0.6.1
-  - http-link-header ==1.0.2
+  - http-link-header ==1.0.3
   - http-media ==0.6.4
   - http-reverse-proxy ==0.4.3.2
   - http-streams ==0.8.4.0
@@ -998,7 +998,7 @@ default-package-overrides:
   - intero ==0.1.19
   - interpolate ==0.1.0
   - interpolatedstring-perl6 ==1.0.0
-  - IntervalMap ==0.5.1.1
+  - IntervalMap ==0.5.2.0
   - intervals ==0.7.2
   - invariant ==0.4
   - io-choice ==0.0.6
@@ -1118,7 +1118,7 @@ default-package-overrides:
   - makefile ==0.1.0.5
   - managed ==1.0.5
   - mandrill ==0.5.2.3
-  - markdown ==0.1.15
+  - markdown ==0.1.16
   - markdown-unlit ==0.4.0
   - markup ==3.1.0
   - math-functions ==0.2.0.2
@@ -1152,7 +1152,7 @@ default-package-overrides:
   - missing-foreign ==0.1.1
   - MissingH ==1.4.0.1
   - mmap ==0.5.9
-  - mmorph ==1.0.6
+  - mmorph ==1.0.9
   - mockery ==0.3.4
   - modify-fasta ==0.8.2.1
   - moesocks ==1.0.0.41
@@ -1266,7 +1266,7 @@ default-package-overrides:
   - openpgp-asciiarmor ==0.1
   - opensource ==0.1.0.0
   - openssl-streams ==1.2.1.0
-  - operational ==0.2.3.4
+  - operational ==0.2.3.5
   - operational-class ==0.3.0.0
   - opml-conduit ==0.5.0.1
   - optional-args ==1.0.1
@@ -1508,6 +1508,7 @@ default-package-overrides:
   - sampling ==0.2.0
   - sandi ==0.4.0
   - sandman ==0.2.0.1
+  - say ==0.1.0.0
   - sbv ==5.12
   - scalpel ==0.3.1
   - scanner ==0.2
@@ -1558,7 +1559,7 @@ default-package-overrides:
   - SHA ==1.6.4.2
   - shake ==0.15.10
   - shake-language-c ==0.10.0
-  - shakespeare ==2.0.11.1
+  - shakespeare ==2.0.11.2
   - shell-conduit ==4.5.2
   - shelly ==1.6.8.1
   - shortcut-links ==0.4.2.0
@@ -1615,7 +1616,7 @@ default-package-overrides:
   - spool ==0.1
   - spoon ==0.3.1
   - sql-words ==0.1.4.1
-  - sqlite-simple ==0.4.9.0
+  - sqlite-simple ==0.4.10.0
   - srcloc ==0.5.1.0
   - stache ==0.1.8
   - stack-run-auto ==0.1.1.4
@@ -1710,13 +1711,13 @@ default-package-overrides:
   - terminal-progress-bar ==0.0.1.4
   - terminal-size ==0.3.2.1
   - terminfo ==0.4.0.2
-  - test-fixture ==0.4.1.0
+  - test-fixture ==0.4.2.0
   - test-framework ==0.8.1.1
   - test-framework-hunit ==0.3.0.2
   - test-framework-quickcheck2 ==0.3.0.3
   - test-framework-smallcheck ==0.2
   - test-framework-th ==0.2.4
-  - test-simple ==0.1.8
+  - test-simple ==0.1.9
   - testing-feat ==0.4.0.3
   - texmath ==0.8.6.7
   - text ==1.2.2.1
@@ -1743,6 +1744,7 @@ default-package-overrides:
   - th-printf ==0.3.1
   - th-reify-compat ==0.0.1.1
   - th-reify-many ==0.1.6
+  - th-to-exp ==0.0.1.0
   - th-utilities ==0.2.0.1
   - these ==0.7.2
   - threads ==0.5.1.4
@@ -1973,7 +1975,7 @@ default-package-overrides:
   - yesod-eventsource ==1.4.0.1
   - yesod-fay ==0.8.0
   - yesod-fb ==0.3.4
-  - yesod-form ==1.4.8
+  - yesod-form ==1.4.9
   - yesod-form-richtext ==0.1.0.0
   - yesod-gitrepo ==0.2.1.0
   - yesod-gitrev ==0.1.0.0

pkgs/development/haskell-modules/hoogle.nix

@@ -23,8 +23,8 @@
 # This will build mmorph and monadControl, and have the hoogle installation
 # refer to their documentation via symlink so they are not garbage collected.
 
-{ lib, stdenv, hoogle, writeText
+{ lib, stdenv, hoogle, writeText, ghc
-, ghc, packages ? [ ghc.ghc ]
+, packages
 }:
 
 let
@@ -51,6 +51,9 @@ let
     else writeText "ghcjs-prologue.txt" ''
       This index includes documentation for many Haskell modules.
     '';
+
+  docPackages = lib.closePropagation packages;
+
 in
 stdenv.mkDerivation {
   name = "hoogle-local-0.1";
@@ -58,14 +61,9 @@ stdenv.mkDerivation {
 
   phases = [ "buildPhase" ];
 
-  docPackages = (lib.closePropagation packages);
+  inherit docPackages;
 
   buildPhase = ''
-    if [ -z "$docPackages" ]; then
-        echo "ERROR: The packages attribute has not been set"
-        exit 1
-    fi
-
     mkdir -p $out/share/doc/hoogle
 
     echo importing builtin packages

pkgs/development/interpreters/luajit/default.nix

@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   name    = "luajit-${version}";
-  version = "2.1.0-beta1";
+  version = "2.1.0-beta2";
   luaversion = "5.1";
 
   src = fetchurl {
     url    = "http://luajit.org/download/LuaJIT-${version}.tar.gz";
-    sha256 = "06170d38387c59d1292001a166e7f5524f5c5deafa8705a49a46fa42905668dd";
+    sha256 = "0iyghj1xjlmd9ywa4flf9yszynf3jhbp0yqb9b49k7ab0g528fbi";
   };
 
   enableParallelBuilding = true;

pkgs/development/libraries/SDL_ttf/default.nix

@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     description = "SDL TrueType library";
     license = licenses.zlib;
     platforms = platforms.all;
-    homepage = https://www.libsdl.org/projects/SDL_ttf/release-1.2.html;
+    homepage = "https://www.libsdl.org/projects/SDL_ttf/release-1.2.html";
     maintainers = with maintainers; [ abbradar ];
   };
 }

pkgs/development/libraries/cppzmq/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "cppzmq-${version}";
-  version = "2016-07-18";
+  version = "2016-11-16";
 
   src = fetchFromGitHub {
     owner = "zeromq";
     repo = "cppzmq";
-    rev = "92d2af6def80a01b76d5e73f073c439ad00ab757";
+    rev = "8b52a6ffacce27bac9b81c852b81539a77b0a6e5";
-    sha256 = "0lnwh314hh5ifad2sa2nz1g1ld1jc4vplm7clyvx304sjjvbvl27";
+    sha256 = "12accjyjzfw1wqzbj1qn6q99bj5ba05flsvbanyzflr3b4971s4p";
   };
 
   installPhase = ''
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    homepage = https://github.com/zeromq/cppzmq;
+    homepage = "https://github.com/zeromq/cppzmq";
     license = licenses.bsd2;
     description = "C++ binding for 0MQ";
     maintainers = with maintainers; [ abbradar ];

pkgs/development/libraries/double-conversion/default.nix

@@ -1,8 +1,8 @@
 { stdenv, fetchFromGitHub, cmake }:
 
 stdenv.mkDerivation rec {
-  version = "2.0.1";
   name = "double-conversion-${version}";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "google";
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Binary-decimal and decimal-binary routines for IEEE doubles";
-    homepage = https://github.com/google/double-conversion;
+    homepage = "https://github.com/google/double-conversion";
     license = licenses.bsd3;
     platforms = platforms.unix;
     maintainers = with maintainers; [ abbradar ];

pkgs/development/libraries/folly/default.nix

@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   name = "folly-${version}";
-  version = "2016.08.08.00";
+  version = "2016.11.21.00";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "folly";
     rev = "v${version}";
-    sha256 = "0f9xdi8w2mbn6gxjfvpzh8i22ca8p11a2ss6qkw31yhdgd3s9087";
+    sha256 = "1f7j73avj00mmzz8wyh9rl1k9i0cvk77d0nf9c80vzr2zfk9f31x";
   };
 
   nativeBuildInputs = [ autoreconfHook python pkgconfig ];
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "An open-source C++ library developed and used at Facebook";
-    homepage = https://github.com/facebook/folly;
+    homepage = "https://github.com/facebook/folly";
     license = licenses.asl20;
     # 32bit is not supported: https://github.com/facebook/folly/issues/103
     platforms = [ "x86_64-linux" ];

pkgs/development/libraries/giblib/default.nix

@@ -2,16 +2,19 @@
 
 stdenv.mkDerivation rec {
   name = "giblib-1.2.4";
-  
+
   src = fetchurl {
     url = "http://linuxbrit.co.uk/downloads/${name}.tar.gz";
     sha256 = "1b4bmbmj52glq0s898lppkpzxlprq9aav49r06j2wx4dv3212rhp";
   };
-  
+
-  buildInputs = [xlibsWrapper imlib2];
+  buildInputs = [ xlibsWrapper ];
+  propagatedBuildInputs = [ imlib2 ];
 
   meta = {
     homepage = http://linuxbrit.co.uk/giblib/;
+    description = "wrapper library for imlib2, and other stuff";
     platforms = stdenv.lib.platforms.unix;
+    license = stdenv.lib.licenses.mit;
   };
 }

pkgs/development/libraries/imlib2/default.nix

@@ -1,4 +1,8 @@
-{ stdenv, fetchurl, xlibsWrapper, libjpeg, libtiff, giflib, libpng, bzip2, pkgconfig }:
+{ stdenv, fetchurl, libjpeg, libtiff, giflib, libpng, bzip2, pkgconfig
+, freetype
+, x11Support ? true, xlibsWrapper ? null }:
+
+with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "imlib2-1.4.9";
@@ -8,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "08809xxk2555yj6glixzw9a0x3x8cx55imd89kj3r0h152bn8a3x";
   };
 
-  buildInputs = [ xlibsWrapper libjpeg libtiff giflib libpng bzip2 ];
+  buildInputs = [ libjpeg libtiff giflib libpng bzip2 freetype ]
+    ++ optional x11Support xlibsWrapper;
 
   nativeBuildInputs = [ pkgconfig ];
 
@@ -21,7 +26,14 @@ stdenv.mkDerivation rec {
 
   # Do not build amd64 assembly code on Darwin, because it fails to compile
   # with unknow directive errors
-  configureFlags = if stdenv.isDarwin then [ "--enable-amd64=no" ] else null;
+  configureFlags = optional stdenv.isDarwin "--enable-amd64=no"
+    ++ optional (!x11Support) "--without-x";
+
+  outputs = [ "out" "bin" "dev" ];
+
+  postInstall = ''
+    moveToOutput bin/imlib2-config "$dev"
+  '';
 
   meta = {
     description = "Image manipulation library";
@@ -34,8 +46,8 @@ stdenv.mkDerivation rec {
       easily, without sacrificing speed.
     '';
 
-    license = stdenv.lib.licenses.free;
+    license = licenses.free;
-    platforms = stdenv.lib.platforms.unix;
+    platforms = platforms.unix;
-    maintainers = with stdenv.lib.maintainers; [ spwhitt ];
+    maintainers = with maintainers; [ spwhitt ];
   };
 }

pkgs/development/libraries/libaacs/default.nix

@@ -7,15 +7,12 @@
 # http://vlc-bluray.whoknowsmy.name/
 # https://wiki.archlinux.org/index.php/BluRay
 
-let baseName = "libaacs";
+stdenv.mkDerivation rec {
-    version  = "0.8.1";
+  name = "libaacs-${version}";
-in
+  version  = "0.8.1";
-
-stdenv.mkDerivation {
-  name = "${baseName}-${version}";
 
   src = fetchurl {
-    url = "http://get.videolan.org/${baseName}/${version}/${baseName}-${version}.tar.bz2";
+    url = "http://get.videolan.org/libaacs/${version}/${name}.tar.bz2";
     sha256 = "1s5v075hnbs57995r6lljm79wgrip3gnyf55a0y7bja75jh49hwm";
   };
 
@@ -24,7 +21,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ yacc flex ];
 
   meta = with stdenv.lib; {
-    homepage = https://www.videolan.org/developers/libaacs.html;
+    homepage = "https://www.videolan.org/developers/libaacs.html";
     description = "Library to access AACS protected Blu-Ray disks";
     license = licenses.lgpl21;
     maintainers = with maintainers; [ abbradar ];

pkgs/development/libraries/libarchive/default.nix

@@ -10,11 +10,11 @@ assert xarSupport -> libxml2 != null;
 
 stdenv.mkDerivation rec {
   name = "libarchive-${version}";
-  version = "3.2.1";
+  version = "3.2.2";
 
   src = fetchurl {
     url = "${meta.homepage}/downloads/${name}.tar.gz";
-    sha256 = "1lngng84k1kkljl74q0cdqc3s82vn2kimfm02dgm4d6m7x71mvkj";
+    sha256 = "03q6y428rg723c9fj1vidzjw46w1vf8z0h95lkvz1l9jw571j739";
   };
 
   outputs = [ "out" "lib" "dev" ];

pkgs/development/libraries/libbdplus/default.nix

@@ -7,16 +7,12 @@
 # http://vlc-bluray.whoknowsmy.name/
 # https://wiki.archlinux.org/index.php/BluRay
 
-
+stdenv.mkDerivation rec {
-let baseName = "libbdplus";
+  name = "libbdplus-${version}";
-    version  = "0.1.2";
+  version  = "0.1.2";
-in
-
-stdenv.mkDerivation {
-  name = "${baseName}-${version}";
 
   src = fetchurl {
-    url = "http://get.videolan.org/${baseName}/${version}/${baseName}-${version}.tar.bz2";
+    url = "http://get.videolan.org/libbdplus/${version}/${name}.tar.bz2";
     sha256 = "02n87lysqn4kg2qk7d1ffrp96c44zkdlxdj0n16hbgrlrpiwlcd6";
   };
 
@@ -25,7 +21,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ ];
 
   meta = with stdenv.lib; {
-    homepage = http://www.videolan.org/developers/libbdplus.html;
+    homepage = "http://www.videolan.org/developers/libbdplus.html";
     description = "Library to access BD+ protected Blu-Ray disks";
     license = licenses.lgpl21;
     maintainers = with maintainers; [ abbradar ];

pkgs/development/libraries/libbluray/default.nix

@@ -18,12 +18,11 @@ assert withFonts -> freetype != null;
 # https://wiki.archlinux.org/index.php/BluRay
 
 stdenv.mkDerivation rec {
-  baseName = "libbluray";
+  name = "libbluray-${version}";
   version  = "0.9.2";
-  name = "${baseName}-${version}";
 
   src = fetchurl {
-    url = "http://get.videolan.org/${baseName}/${version}/${name}.tar.bz2";
+    url = "http://get.videolan.org/libbluray/${version}/${name}.tar.bz2";
     sha256 = "1sp71j4agcsg17g6b85cqz78pn5vknl5pl39rvr6mkib5ps99jgg";
   };
 
@@ -55,7 +54,7 @@ stdenv.mkDerivation rec {
   patches = stdenv.lib.optional withJava ./BDJ-JARFILE-path.patch;
 
   meta = with stdenv.lib; {
-    homepage = http://www.videolan.org/developers/libbluray.html;
+    homepage = "http://www.videolan.org/developers/libbluray.html";
     description = "Library to access Blu-Ray disks for video playback";
     license = licenses.lgpl21;
     maintainers = [ maintainers.abbradar ];

pkgs/development/libraries/libburn/default.nix

@@ -2,15 +2,15 @@
 
 stdenv.mkDerivation rec {
   name = "libburn-${version}";
-  version = "1.4.4";
+  version = "1.4.6";
 
   src = fetchurl {
     url = "http://files.libburnia-project.org/releases/${name}.tar.gz";
-    sha256 = "053x1sj6r5pj5396g007v6l0s7942cy2mh5fd3caqx0jdw6h9xqv";
+    sha256 = "0wbh49s3az3sfpai09z1zdgynq7wnwrk31v5589033274nmzldlx";
   };
 
   meta = with stdenv.lib; {
-    homepage = http://libburnia-project.org/;
+    homepage = "http://libburnia-project.org/";
     description = "A library by which preformatted data get onto optical media: CD, DVD, BD (Blu-Ray)";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ abbradar vrthra ];

pkgs/development/libraries/libevent/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, autoreconfHook, openssl, findutils }:
+{ stdenv, fetchurl, openssl, findutils }:
 
 let version = "2.0.22"; in
 stdenv.mkDerivation {
@@ -12,7 +12,6 @@ stdenv.mkDerivation {
   outputs = [ "out" "dev" ];
   outputBin = "dev";
 
-  nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ openssl ] ++ stdenv.lib.optional stdenv.isCygwin findutils;
 
   meta = with stdenv.lib; {

pkgs/development/libraries/libisofs/default.nix

@@ -2,18 +2,18 @@
 
 stdenv.mkDerivation rec {
   name = "libisofs-${version}";
-  version = "1.4.4";
+  version = "1.4.6";
 
   src = fetchurl {
     url = "http://files.libburnia-project.org/releases/${name}.tar.gz";
-    sha256 = "1zdx56k847c80ds5yf40hh0a26lkqrc0v11r589dqlm6xvzg0614";
+    sha256 = "02m5g6lbmmkh2xc5xzq5zaf3ma6v31gls66aj886b3cq9qw0paql";
   };
 
   buildInputs = [ attr zlib ];
   propagatedBuildInputs = [ acl ];
 
   meta = with stdenv.lib; {
-    homepage = http://libburnia-project.org/;
+    homepage = "http://libburnia-project.org/";
     description = "A library to create an ISO-9660 filesystem with extensions like RockRidge or Joliet";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ abbradar vrthra ];

pkgs/development/libraries/libproxy/default.nix

@@ -1,4 +1,5 @@
-{ stdenv, fetchFromGitHub, pkgconfig, cmake, zlib, glib }:
+{ stdenv, lib, fetchFromGitHub, pkgconfig, cmake
+, dbus, networkmanager, spidermonkey_1_8_5 }:
 
 stdenv.mkDerivation rec {
   name = "libproxy-${version}";
@@ -14,9 +15,8 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev" ]; # to deal with propagatedBuildInputs
 
   nativeBuildInputs = [ pkgconfig cmake ];
-  propagatedBuildInputs = [ zlib ]
+
-    # now some optional deps, but many more are possible
+  buildInputs = [ dbus networkmanager spidermonkey_1_8_5 ];
-    ++ [ glib ];
 
   meta = with stdenv.lib; {
     platforms = platforms.linux;

pkgs/development/libraries/libtiff/default.nix

@@ -1,15 +1,14 @@
 { stdenv, fetchurl, fetchpatch, pkgconfig, zlib, libjpeg, xz }:
 
 let
-  version = "4.0.6";
+  version = "4.0.7";
-  debversion = "3";
 in
 stdenv.mkDerivation rec {
   name = "libtiff-${version}";
 
   src = fetchurl {
     url = "http://download.osgeo.org/libtiff/tiff-${version}.tar.gz";
-    sha256 = "136nf1rj9dp5jgv1p7z4dk0xy3wki1w0vfjbk82f645m0w4samsd";
+    sha256 = "06ghqhr4db1ssq0acyyz49gr8k41gzw6pqb6mbn5r7jqp77s4hwz";
   };
 
   outputs = [ "bin" "dev" "out" "doc" ];
@@ -20,54 +19,11 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  patches = let p = "https://sources.debian.net/data/main/t/tiff/${version}-${debversion}/debian/patches"; in [
-    (fetchurl {
-      url = "${p}/01-CVE-2015-8665_and_CVE-2015-8683.patch";
-      sha256 = "0qiiqpbbsf01b59x01z38cg14pmg1ggcsqm9n1gsld6rr5wm3ryz";
-    })
-    (fetchurl {
-      url = "${p}/02-fix_potential_out-of-bound_writes_in_decode_functions.patch";
-      sha256 = "1ph057w302i2s94rhdw6ksyvpsmg1nlanvc0251x01s23gkdbakv";
-    })
-    (fetchurl {
-      url = "${p}/03-fix_potential_out-of-bound_write_in_NeXTDecode.patch";
-      sha256 = "1nhjg2gdvyzi4wa2g7nwmzm7nssz9dpdfkwms1rp8i1034qdlgc6";
-    })
-    (fetchurl {
-      url = "${p}/04-CVE-2016-5314_CVE-2016-5316_CVE-2016-5320_CVE-2016-5875.patch";
-      sha256 = "0n47yk9wcvc9j72yvm5bhpaqq0yfz8jnq9zxbnzx5id9gdxmrkn3";
-    })
-    (fetchurl {
-      url = "${p}/05-CVE-2016-6223.patch";
-      sha256 = "0r80hil9k6scdjppgyljhm0s2z6c8cm259f0ic0xvxidfaim6g2r";
-    })
-    (fetchurl {
-      url = "${p}/06-CVE-2016-5321.patch";
-      sha256 = "1aacymlqv6cam8i4nbma9v05r3v3xjpagns7q0ii268h0mhzq6qg";
-    })
-    (fetchurl {
-      url = "${p}/07-CVE-2016-5323.patch";
-      sha256 = "1xr5hy2fxa71j3fcc1l998pxyblv207ygzyhibwb1lia5zjgblch";
-    })
-    (fetchurl {
-      url = "${p}/08-CVE-2016-3623_CVE-2016-3624.patch";
-      sha256 = "1xnvwjvgyxi387h1sdiyp4360a3176jmipb7ghm8vwiz7cisdn9z";
-    })
-    (fetchurl {
-      url = "${p}/09-CVE-2016-5652.patch";
-      sha256 = "1yqfq32gzh21ab2jfqkq13gaz0nin0492l06adzsyhr5brvdhnx8";
-    })
-    (fetchurl {
-      url = "${p}/10-CVE-2016-3658.patch";
-      sha256 = "01kb8rfk30fgjf1hy0m088yhjfld1yyh4bk3gkg8jx3dl9bd076d";
-    })
-  ];
-
   doCheck = true;
 
   meta = with stdenv.lib; {
     description = "Library and utilities for working with the TIFF image file format";
-    homepage = http://www.remotesensing.org/libtiff/;
+    homepage = http://download.osgeo.org/libtiff;
     license = licenses.libtiff;
     platforms = platforms.unix;
   };

pkgs/development/libraries/libvdpau-va-gl/default.nix

@@ -3,20 +3,20 @@
 
 stdenv.mkDerivation rec {
   name = "libvdpau-va-gl-${version}";
-  version = "0.4.0";
+  version = "0.4.2";
 
   src = fetchFromGitHub {
     owner = "i-rinat";
     repo = "libvdpau-va-gl";
     rev = "v${version}";
-    sha256 = "1y511jxs0df1fqzjcvb6zln7nbmchv1g6z3lw0z9nsf64ziycj8k";
+    sha256 = "0asndybfv8xb0fx73sjjw5kydqrahqkm6n04lh589pbf18s5qlld";
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
   buildInputs = [ libX11 libpthreadstubs libXau libXdmcp libXext libvdpau glib libva ffmpeg mesa_glu ];
 
   meta = with stdenv.lib; {
-    homepage = https://github.com/i-rinat/libvdpau-va-gl;
+    homepage = "https://github.com/i-rinat/libvdpau-va-gl";
     description = "VDPAU driver with OpenGL/VAAPI backend";
     license = licenses.lgpl3;
     platforms = platforms.linux;

pkgs/development/libraries/libxls/default.nix

@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Extract Cell Data From Excel xls files";
-    homepage = http://sourceforge.net/projects/libxls/;
+    homepage = "http://sourceforge.net/projects/libxls/";
     license = licenses.bsd2;
     platforms = platforms.unix;
     maintainers = with maintainers; [ abbradar ];

pkgs/development/libraries/opencv/3.x.nix

@@ -95,7 +95,7 @@ stdenv.mkDerivation rec {
     (opencvFlag "CUDA" enableCuda)
     (opencvFlag "CUBLAS" enableCuda)
   ] ++ lib.optionals enableContrib [ "-DOPENCV_EXTRA_MODULES_PATH=${contribSrc}/modules" ]
-  ++ lib.optionals enableCuda [ "-DCUDA_FAST_MATH=ON" ];
+    ++ lib.optionals enableCuda [ "-DCUDA_FAST_MATH=ON" ];
 
   enableParallelBuilding = true;
 

pkgs/development/libraries/opendkim/default.nix

@@ -2,7 +2,9 @@
 , perl, makeWrapper }:
 
 stdenv.mkDerivation rec {
-  name = "opendkim-2.10.3";
+  name = "opendkim-${version}";
+  version = "2.10.3";
+
   src = fetchurl {
     url = "mirror://sourceforge/opendkim/files/${name}.tar.gz";
     sha256 = "06v8bqhh604sz9rh5bvw278issrwjgc4h1wx2pz9a84lpxbvm823";
@@ -21,7 +23,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "C library for producing DKIM-aware applications and an open source milter for providing DKIM service";
-    homepage = http://www.opendkim.org/;
+    homepage = "http://www.opendkim.org/";
     maintainers = with maintainers; [ abbradar ];
     license = licenses.bsd3;
     platforms = platforms.unix;

pkgs/development/libraries/qpdf/default.nix

@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
-    homepage = http://qpdf.sourceforge.net/; 
+    homepage = "http://qpdf.sourceforge.net/";
     description = "A C++ library and set of programs that inspect and manipulate the structure of PDF files";
     license = licenses.artistic2;
     maintainers = with maintainers; [ abbradar ];

pkgs/development/libraries/qt-5/5.6/fetch.sh

@@ -1,3 +1,3 @@
-WGET_ARGS=( http://download.qt.io/official_releases/qt/5.6/5.6.1-1/submodules/ \
+WGET_ARGS=( http://download.qt.io/official_releases/qt/5.6/5.6.2/submodules/ \
-            http://download.qt.io/community_releases/5.6/5.6.1/ \
+            http://download.qt.io/community_releases/5.6/5.6.2/ \
             -A '*.tar.xz' )

pkgs/development/libraries/qt-5/5.6/qtbase/default.nix

@@ -115,7 +115,6 @@ stdenv.mkDerivation {
     -widgets
     -opengl desktop
     -qml-debug
-    -nis
     -iconv
     -icu
     -pch

pkgs/development/libraries/qt-5/5.6/srcs.nix

@@ -1,269 +1,261 @@
-# DO NOT EDIT! This file is generated automatically by manifest.sh
+# DO NOT EDIT! This file is generated automatically by fetch-kde-qt.sh
 { fetchurl, mirror }:
 
 {
-  qtwebkit = {
-    version = "5.6.1";
-    src = fetchurl {
-      url = "${mirror}/community_releases/5.6/5.6.1/qtwebkit-opensource-src-5.6.1.tar.xz";
-      sha256 = "1akjqvjavl0vn8a8hnmvqc26mf4ljvwjdm07x6dmmdnjzajvzkzm";
-      name = "qtwebkit-opensource-src-5.6.1.tar.xz";
-    };
-  };
   qt3d = {
-    version = "5.6.1-1";
+    version = "5.6.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.6/5.6.1-1/submodules/qt3d-opensource-src-5.6.1-1.tar.xz";
+      url = "${mirror}/official_releases/qt/5.6/5.6.2/submodules/qt3d-opensource-src-5.6.2.tar.xz";
-      sha256 = "1nxpcjsarcp40m4y18kyy9a5md56wnafll03j8c6q19rba9bcwbf";
+      sha256 = "0hg91j3brsbh75why6j0527z5myk1r9s7q9z45q6qp0gdvdqc5x2";
-      name = "qt3d-opensource-src-5.6.1-1.tar.xz";
+      name = "qt3d-opensource-src-5.6.2.tar.xz";
     };
   };
   qtactiveqt = {
-    version = "5.6.1-1";
+    version = "5.6.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.6/5.6.1-1/submodules/qtactiveqt-opensource-src-5.6.1-1.tar.xz";
+      url = "${mirror}/official_releases/qt/5.6/5.6.2/submodules/qtactiveqt-opensource-src-5.6.2.tar.xz";
-      sha256 = "00bj9c0x3ax34gpibaap3wpchkv4wapsydiz01fb0xzs1fy94nbf";
+      sha256 = "1a3mai3d0l2a8gyjkjng1r7y9y27yppxc5rdzxsgc4kq58rflghw";
-      name = "qtactiveqt-opensource-src-5.6.1-1.tar.xz";
+      name = "qtactiveqt-opensource-src-5.6.2.tar.xz";
     };
   };
   qtandroidextras = {
-    version = "5.6.1-1";
+    version = "5.6.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.6/5.6.1-1/submodules/qtandroidextras-opensource-src-5.6.1-1.tar.xz";
+      url = "${mirror}/official_releases/qt/5.6/5.6.2/submodules/qtandroidextras-opensource-src-5.6.2.tar.xz";
-      sha256 = "0xhm4053y9hqnz5y3y4rwycniq0mb1al1rds3jx636211y039xhk";
+      sha256 = "164mkmzswqwjzhs9cwdq361yb60bx6is37740jglrjxgss1phmhr";
-      name = "qtandroidextras-opensource-src-5.6.1-1.tar.xz";
+      name = "qtandroidextras-opensource-src-5.6.2.tar.xz";
     };
   };
   qtbase = {
-    version = "5.6.1-1";
+    version = "5.6.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.6/5.6.1-1/submodules/qtbase-opensource-src-5.6.1-1.tar.xz";
+      url = "${mirror}/official_releases/qt/5.6/5.6.2/submodules/qtbase-opensource-src-5.6.2.tar.xz";
-      sha256 = "0fbwprlhqmdyhh2wb9122fcpq7pbil530iak482b9sy5gqs7i5ij";
+      sha256 = "11z73qgzbyj1cwjdkng94cz46wam8frsw0bs705gx0nrqn9swvig";
-      name = "qtbase-opensource-src-5.6.1-1.tar.xz";
+      name = "qtbase-opensource-src-5.6.2.tar.xz";
     };
   };
   qtcanvas3d = {
-    version = "5.6.1-1";
+    version = "5.6.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.6/5.6.1-1/submodules/qtcanvas3d-opensource-src-5.6.1-1.tar.xz";
+      url = "${mirror}/official_releases/qt/5.6/5.6.2/submodules/qtcanvas3d-opensource-src-5.6.2.tar.xz";
-      sha256 = "13127xws6xfkkk1x617bgdzl96l66nd0v82dibdnxnpfa702rl44";
+      sha256 = "1bd01ag2p1445ffckyyi3sxi4vssflp95kmbrj99dy83dc04sn6p";
-      name = "qtcanvas3d-opensource-src-5.6.1-1.tar.xz";
+      name = "qtcanvas3d-opensource-src-5.6.2.tar.xz";
     };
   };
   qtconnectivity = {
-    version = "5.6.1-1";
+    version = "5.6.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.6/5.6.1-1/submodules/qtconnectivity-opensource-src-5.6.1-1.tar.xz";
+      url = "${mirror}/official_releases/qt/5.6/5.6.2/submodules/qtconnectivity-opensource-src-5.6.2.tar.xz";
-      sha256 = "0sr6sxp0q45pacs25knr28139xdrphcjgrwlksdhdpsryfw19mzi";
+      sha256 = "1ygdmd7fh2fhhyv58zxl1lglr85iajs9gv6c0pv64gbhw0ijjrqv";
-      name = "qtconnectivity-opensource-src-5.6.1-1.tar.xz";
+      name = "qtconnectivity-opensource-src-5.6.2.tar.xz";
     };
   };
   qtdeclarative = {
-    version = "5.6.1-1";
+    version = "5.6.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.6/5.6.1-1/submodules/qtdeclarative-opensource-src-5.6.1-1.tar.xz";
+      url = "${mirror}/official_releases/qt/5.6/5.6.2/submodules/qtdeclarative-opensource-src-5.6.2.tar.xz";
-      sha256 = "094gx5mzqzcga97y7ihf052b6i5iv512lh7m0702m5q94nsn1pqw";
+      sha256 = "1nh989jp2gdp5bxa62n3g1whs2pzrl44sh4ca6x9icrnpj3ak1h0";
-      name = "qtdeclarative-opensource-src-5.6.1-1.tar.xz";
+      name = "qtdeclarative-opensource-src-5.6.2.tar.xz";
-    };
-  };
-  qtdeclarative-render2d = {
-    version = "5.6.1-1";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.6/5.6.1-1/submodules/qtdeclarative-render2d-opensource-src-5.6.1-1.tar.xz";
-      sha256 = "0kqmb3792rg9fx12m64x87ahcrh0g9krg77mv0ssx3g4gvsgcibc";
-      name = "qtdeclarative-render2d-opensource-src-5.6.1-1.tar.xz";
     };
   };
   qtdoc = {
-    version = "5.6.1-1";
+    version = "5.6.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.6/5.6.1-1/submodules/qtdoc-opensource-src-5.6.1-1.tar.xz";
+      url = "${mirror}/official_releases/qt/5.6/5.6.2/submodules/qtdoc-opensource-src-5.6.2.tar.xz";
-      sha256 = "1yf3g3h72ndrp88h8g21mzgqdz2ixwkvpav03i3jnrgy2pf7nssp";
+      sha256 = "0s78c5bpj4lcx63x2y5a6scxv6sszvs4dlj4qy86jkwmm7m1wsgn";
-      name = "qtdoc-opensource-src-5.6.1-1.tar.xz";
+      name = "qtdoc-opensource-src-5.6.2.tar.xz";
     };
   };
   qtenginio = {
-    version = "1.6.1";
+    version = "1.6.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.6/5.6.1-1/submodules/qtenginio-opensource-src-1.6.1.tar.xz";
+      url = "${mirror}/official_releases/qt/5.6/5.6.2/submodules/qtenginio-opensource-src-1.6.2.tar.xz";
-      sha256 = "17hsrhzy9zdvpbzja45aac6jr7jzzjl206vma96b9w73rbgxa50f";
+      sha256 = "1hywpl1x9lbpqqjdw5wwwhx0gg0j7y260iqaz47anxaa466w7zwh";
-      name = "qtenginio-opensource-src-1.6.1.tar.xz";
+      name = "qtenginio-opensource-src-1.6.2.tar.xz";
     };
   };
   qtgraphicaleffects = {
-    version = "5.6.1-1";
+    version = "5.6.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.6/5.6.1-1/submodules/qtgraphicaleffects-opensource-src-5.6.1-1.tar.xz";
+      url = "${mirror}/official_releases/qt/5.6/5.6.2/submodules/qtgraphicaleffects-opensource-src-5.6.2.tar.xz";
-      sha256 = "0560800fa9sd6dw1vk0ia9vq8ywdrwch2cpsi1vmh4iyxgwfr71b";
+      sha256 = "0pp71gqfgbl5ra15jp8kr4p3sl9gs7cv4x6vjv9i5a3j5jn0z7qy";
-      name = "qtgraphicaleffects-opensource-src-5.6.1-1.tar.xz";
+      name = "qtgraphicaleffects-opensource-src-5.6.2.tar.xz";
     };
   };
   qtimageformats = {
-    version = "5.6.1-1";
+    version = "5.6.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.6/5.6.1-1/submodules/qtimageformats-opensource-src-5.6.1-1.tar.xz";
+      url = "${mirror}/official_releases/qt/5.6/5.6.2/submodules/qtimageformats-opensource-src-5.6.2.tar.xz";
-      sha256 = "1p98acvsm3azka2by1ph4gdb31qbnndrr5k5wns4xk2d760y8ifc";
+      sha256 = "1r27s5dy9c016ia5xgpbs7nfvmmrnd051dmsrv5r7hyscaz57cag";
-      name = "qtimageformats-opensource-src-5.6.1-1.tar.xz";
+      name = "qtimageformats-opensource-src-5.6.2.tar.xz";
     };
   };
   qtlocation = {
-    version = "5.6.1-1";
+    version = "5.6.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.6/5.6.1-1/submodules/qtlocation-opensource-src-5.6.1-1.tar.xz";
+      url = "${mirror}/official_releases/qt/5.6/5.6.2/submodules/qtlocation-opensource-src-5.6.2.tar.xz";
-      sha256 = "0my4pbcxa58yzvdh65l5qx99ln03chjr5c3ml5v37wfk7nx23k69";
+      sha256 = "0fnj51f6fll1z1xsfp3g73al70hsg993gh1k7aa0y8nhdqh9b2bs";
-      name = "qtlocation-opensource-src-5.6.1-1.tar.xz";
+      name = "qtlocation-opensource-src-5.6.2.tar.xz";
     };
   };
   qtmacextras = {
-    version = "5.6.1-1";
+    version = "5.6.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.6/5.6.1-1/submodules/qtmacextras-opensource-src-5.6.1-1.tar.xz";
+      url = "${mirror}/official_releases/qt/5.6/5.6.2/submodules/qtmacextras-opensource-src-5.6.2.tar.xz";
-      sha256 = "07j26d5g7av4c6alggg5hssqpvdh555zmn1cpr8xrhx1hpbdnaas";
+      sha256 = "05chq7dqgvlfzpqf1y9inxp0kx6hfzwbc5kswpp6gsnsyfln6ll5";
-      name = "qtmacextras-opensource-src-5.6.1-1.tar.xz";
+      name = "qtmacextras-opensource-src-5.6.2.tar.xz";
     };
   };
   qtmultimedia = {
-    version = "5.6.1-1";
+    version = "5.6.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.6/5.6.1-1/submodules/qtmultimedia-opensource-src-5.6.1-1.tar.xz";
+      url = "${mirror}/official_releases/qt/5.6/5.6.2/submodules/qtmultimedia-opensource-src-5.6.2.tar.xz";
-      sha256 = "0paffx0614ivjbf87lr9klpbqik6r1pzbc14l41np6d9jv3dqa2f";
+      sha256 = "1bwcpc1s6yjvgpqbn22k4mdfjy9lhs89bbzwlgj5psy0qskp16nb";
-      name = "qtmultimedia-opensource-src-5.6.1-1.tar.xz";
+      name = "qtmultimedia-opensource-src-5.6.2.tar.xz";
-    };
-  };
-  qtquickcontrols2 = {
-    version = "5.6.1-1";
-    src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.6/5.6.1-1/submodules/qtquickcontrols2-opensource-src-5.6.1-1.tar.xz";
-      sha256 = "0wfa2xcqsvx3zihd5nb9f9qhq0xn14c03sw1qdymzfsryqwmk4ac";
-      name = "qtquickcontrols2-opensource-src-5.6.1-1.tar.xz";
     };
   };
   qtquickcontrols = {
-    version = "5.6.1-1";
+    version = "5.6.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.6/5.6.1-1/submodules/qtquickcontrols-opensource-src-5.6.1-1.tar.xz";
+      url = "${mirror}/official_releases/qt/5.6/5.6.2/submodules/qtquickcontrols-opensource-src-5.6.2.tar.xz";
-      sha256 = "0cjzf844r7wi32ssc9vbw1a2m9hnr8c0i1p7yyljy962ifplf401";
+      sha256 = "0b0h8svlzvq23kcmam7ng697bzcq4x3haymmn7gj40p15clz5l2y";
-      name = "qtquickcontrols-opensource-src-5.6.1-1.tar.xz";
+      name = "qtquickcontrols-opensource-src-5.6.2.tar.xz";
+    };
+  };
+  qtquickcontrols2 = {
+    version = "5.6.2";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.6/5.6.2/submodules/qtquickcontrols2-opensource-src-5.6.2.tar.xz";
+      sha256 = "1hgydll95by0rvfpv3sprxq0hkdrpacynaaq2jzaw0a7m881gp09";
+      name = "qtquickcontrols2-opensource-src-5.6.2.tar.xz";
     };
   };
   qtscript = {
-    version = "5.6.1-1";
+    version = "5.6.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.6/5.6.1-1/submodules/qtscript-opensource-src-5.6.1-1.tar.xz";
+      url = "${mirror}/official_releases/qt/5.6/5.6.2/submodules/qtscript-opensource-src-5.6.2.tar.xz";
-      sha256 = "1gini9483flqa9q4a4bl81bh7g5s408bycqykqhgbklmfd29y5lx";
+      sha256 = "03hi2j64l0mgs8p0w1jaz53zsa4lfpbgskydaxxiiqnaf6rgcvp0";
-      name = "qtscript-opensource-src-5.6.1-1.tar.xz";
+      name = "qtscript-opensource-src-5.6.2.tar.xz";
     };
   };
   qtsensors = {
-    version = "5.6.1-1";
+    version = "5.6.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.6/5.6.1-1/submodules/qtsensors-opensource-src-5.6.1-1.tar.xz";
+      url = "${mirror}/official_releases/qt/5.6/5.6.2/submodules/qtsensors-opensource-src-5.6.2.tar.xz";
-      sha256 = "0kcrvf6vzn6g2v2m70f9r3raalzmfp48rwjlqhss3w84jfz3y04r";
+      sha256 = "09rl0njijl3cgh6l3pfij2rhnsg10axkl37llkbz1wmlma0r1057";
-      name = "qtsensors-opensource-src-5.6.1-1.tar.xz";
+      name = "qtsensors-opensource-src-5.6.2.tar.xz";
     };
   };
   qtserialbus = {
-    version = "5.6.1-1";
+    version = "5.6.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.6/5.6.1-1/submodules/qtserialbus-opensource-src-5.6.1-1.tar.xz";
+      url = "${mirror}/official_releases/qt/5.6/5.6.2/submodules/qtserialbus-opensource-src-5.6.2.tar.xz";
-      sha256 = "0li4g70s5vfb517ag0d6405ymsknvvny1c8x66w7qs8a8mnk1jq5";
+      sha256 = "09pqr9f6kl3wq4858vksbzxnrrnqxblivmayjf126lwi2q4n14mk";
-      name = "qtserialbus-opensource-src-5.6.1-1.tar.xz";
+      name = "qtserialbus-opensource-src-5.6.2.tar.xz";
     };
   };
   qtserialport = {
-    version = "5.6.1-1";
+    version = "5.6.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.6/5.6.1-1/submodules/qtserialport-opensource-src-5.6.1-1.tar.xz";
+      url = "${mirror}/official_releases/qt/5.6/5.6.2/submodules/qtserialport-opensource-src-5.6.2.tar.xz";
-      sha256 = "135cbgghxk0c6dblmyyrw6znfb9m8sac9hhyc2dm6vq7vzy8id52";
+      sha256 = "0xpkjkn6w0g3p7hmm12b2c96f7q98rmk2dcn321x4arcmldjhxmg";
-      name = "qtserialport-opensource-src-5.6.1-1.tar.xz";
+      name = "qtserialport-opensource-src-5.6.2.tar.xz";
     };
   };
   qtsvg = {
-    version = "5.6.1-1";
+    version = "5.6.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.6/5.6.1-1/submodules/qtsvg-opensource-src-5.6.1-1.tar.xz";
+      url = "${mirror}/official_releases/qt/5.6/5.6.2/submodules/qtsvg-opensource-src-5.6.2.tar.xz";
-      sha256 = "1w0jvhgaiddafcms2nv8wl1klg07lncmjwm1zhdw3l6rxi9071sw";
+      sha256 = "0kmwr3fphs7ddgxmqzy53f8p2hbp1gfmjdaig5vswc8vcszn38zp";
-      name = "qtsvg-opensource-src-5.6.1-1.tar.xz";
+      name = "qtsvg-opensource-src-5.6.2.tar.xz";
     };
   };
   qttools = {
-    version = "5.6.1-1";
+    version = "5.6.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.6/5.6.1-1/submodules/qttools-opensource-src-5.6.1-1.tar.xz";
+      url = "${mirror}/official_releases/qt/5.6/5.6.2/submodules/qttools-opensource-src-5.6.2.tar.xz";
-      sha256 = "0haic027a2d7p7k8xz83fbvci4a4dln34360rlwgy7hlyy5m4nip";
+      sha256 = "1dz1i5wwhgb9li095mnmc33mwpbd8nf7sdrc2x3pl9c6hwqv8ayv";
-      name = "qttools-opensource-src-5.6.1-1.tar.xz";
+      name = "qttools-opensource-src-5.6.2.tar.xz";
     };
   };
   qttranslations = {
-    version = "5.6.1-1";
+    version = "5.6.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.6/5.6.1-1/submodules/qttranslations-opensource-src-5.6.1-1.tar.xz";
+      url = "${mirror}/official_releases/qt/5.6/5.6.2/submodules/qttranslations-opensource-src-5.6.2.tar.xz";
-      sha256 = "03sdzci4pgq6lmxwn25v8x0z5x8g7zgpq2as56dqgj7vp6cvhn8m";
+      sha256 = "08d4xyk7njkdbd3m48dzmvdm8ma3s4x8h4jm1ip20wqngi23nybx";
-      name = "qttranslations-opensource-src-5.6.1-1.tar.xz";
+      name = "qttranslations-opensource-src-5.6.2.tar.xz";
     };
   };
   qtwayland = {
-    version = "5.6.1-1";
+    version = "5.6.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.6/5.6.1-1/submodules/qtwayland-opensource-src-5.6.1-1.tar.xz";
+      url = "${mirror}/official_releases/qt/5.6/5.6.2/submodules/qtwayland-opensource-src-5.6.2.tar.xz";
-      sha256 = "1fnvgpi49ilds3ah9iizxj9qhhb5rnwqd9h03bhkwf0ydywv52c4";
+      sha256 = "11kciqnqfyzjfnx1m666g35v98jdazsg083h9fv2g5kiyjck2p03";
-      name = "qtwayland-opensource-src-5.6.1-1.tar.xz";
+      name = "qtwayland-opensource-src-5.6.2.tar.xz";
     };
   };
   qtwebchannel = {
-    version = "5.6.1-1";
+    version = "5.6.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.6/5.6.1-1/submodules/qtwebchannel-opensource-src-5.6.1-1.tar.xz";
+      url = "${mirror}/official_releases/qt/5.6/5.6.2/submodules/qtwebchannel-opensource-src-5.6.2.tar.xz";
-      sha256 = "10kys3ppjkj60fs1s335fdcpdsbxsjn6ibvm6zph9gqbncabd2l7";
+      sha256 = "0lhskzqcijz9x6h8p80ff5dd6ni7zqm23nzljdqbggaibzpzs3kh";
-      name = "qtwebchannel-opensource-src-5.6.1-1.tar.xz";
+      name = "qtwebchannel-opensource-src-5.6.2.tar.xz";
     };
   };
   qtwebengine = {
-    version = "5.6.1-1";
+    version = "5.6.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.6/5.6.1-1/submodules/qtwebengine-opensource-src-5.6.1-1.tar.xz";
+      url = "${mirror}/official_releases/qt/5.6/5.6.2/submodules/qtwebengine-opensource-src-5.6.2.tar.xz";
-      sha256 = "0k708a34zwkj6hwx3vv5kdvnv3lfgb0iad44zaim5gdpgcir03n8";
+      sha256 = "0h4pyc7r2fx8qsiw3663jd1hg1fid5yv7wil06njpcm8w541c2ig";
-      name = "qtwebengine-opensource-src-5.6.1-1.tar.xz";
+      name = "qtwebengine-opensource-src-5.6.2.tar.xz";
+    };
+  };
+  qtwebkit = {
+    version = "5.6.2";
+    src = fetchurl {
+      url = "${mirror}/community_releases/5.6/5.6.2/qtwebkit-opensource-src-5.6.2.tar.xz";
+      sha256 = "0rirszy092pmdvy4vzqkk4p9wwxv8qx4zkp84rxkd5ah3j5np2jj";
+      name = "qtwebkit-opensource-src-5.6.2.tar.xz";
     };
   };
   qtwebsockets = {
-    version = "5.6.1-1";
+    version = "5.6.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.6/5.6.1-1/submodules/qtwebsockets-opensource-src-5.6.1-1.tar.xz";
+      url = "${mirror}/official_releases/qt/5.6/5.6.2/submodules/qtwebsockets-opensource-src-5.6.2.tar.xz";
-      sha256 = "1fz0x8570zxc00a22skd848svma3p2g3xyxj14jq10559jihqqil";
+      sha256 = "0ddsnnp3sn423ryqqa1060cqlbdcp7ncj3zhabifaswfzyxx9n9w";
-      name = "qtwebsockets-opensource-src-5.6.1-1.tar.xz";
+      name = "qtwebsockets-opensource-src-5.6.2.tar.xz";
     };
   };
   qtwebview = {
-    version = "5.6.1-1";
+    version = "5.6.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.6/5.6.1-1/submodules/qtwebview-opensource-src-5.6.1-1.tar.xz";
+      url = "${mirror}/official_releases/qt/5.6/5.6.2/submodules/qtwebview-opensource-src-5.6.2.tar.xz";
-      sha256 = "19954snfw073flxn0qk5ayxyzk5x6hwhpg4kn4nrl1zygsw3y49l";
+      sha256 = "1mjix4w71x1w86ykcdhsl7gg7xv9dn2pw6yiaxrp6pxvvk73cyjs";
-      name = "qtwebview-opensource-src-5.6.1-1.tar.xz";
+      name = "qtwebview-opensource-src-5.6.2.tar.xz";
     };
   };
   qtwinextras = {
-    version = "5.6.1-1";
+    version = "5.6.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.6/5.6.1-1/submodules/qtwinextras-opensource-src-5.6.1-1.tar.xz";
+      url = "${mirror}/official_releases/qt/5.6/5.6.2/submodules/qtwinextras-opensource-src-5.6.2.tar.xz";
-      sha256 = "03zkwqrix2nfqkwfn8lsrpgahzx1hv6p1qbvhkqymzakkzjjncgg";
+      sha256 = "1s375b1bf8cqs73mg8chwvj0npr01hpyrwv75srqnxkp61avi1gr";
-      name = "qtwinextras-opensource-src-5.6.1-1.tar.xz";
+      name = "qtwinextras-opensource-src-5.6.2.tar.xz";
     };
   };
   qtx11extras = {
-    version = "5.6.1-1";
+    version = "5.6.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.6/5.6.1-1/submodules/qtx11extras-opensource-src-5.6.1-1.tar.xz";
+      url = "${mirror}/official_releases/qt/5.6/5.6.2/submodules/qtx11extras-opensource-src-5.6.2.tar.xz";
-      sha256 = "0yj5yg2dqkrwbgbicmk2rpqsagmi8dsffkrprpsj0fmkx4awhv5y";
+      sha256 = "1v8cnhas3rynqz7b8wryry2qhblrnmnd3v39gdki1hzfz8fdxzvi";
-      name = "qtx11extras-opensource-src-5.6.1-1.tar.xz";
+      name = "qtx11extras-opensource-src-5.6.2.tar.xz";
     };
   };
   qtxmlpatterns = {
-    version = "5.6.1-1";
+    version = "5.6.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.6/5.6.1-1/submodules/qtxmlpatterns-opensource-src-5.6.1-1.tar.xz";
+      url = "${mirror}/official_releases/qt/5.6/5.6.2/submodules/qtxmlpatterns-opensource-src-5.6.2.tar.xz";
-      sha256 = "1966rrk7f6c55k57j33rffdjs77kk4mawrnnl8yv1ckcirxc3np1";
+      sha256 = "1k428wj8iffm6rrbvwbw0hksr99xqsxww8iahbk8r38qpzpg6vbw";
-      name = "qtxmlpatterns-opensource-src-5.6.1-1.tar.xz";
+      name = "qtxmlpatterns-opensource-src-5.6.2.tar.xz";
     };
   };
 }

pkgs/development/libraries/science/math/ipopt/default.nix

@@ -1,8 +1,8 @@
 { stdenv, fetchurl, unzip, openblas, gfortran }:
 
 stdenv.mkDerivation rec {
-  version = "3.12.6";
   name = "ipopt-${version}";
+  version = "3.12.6";
 
   src = fetchurl {
     url = "http://www.coin-or.org/download/source/Ipopt/Ipopt-${version}.zip";
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "A software package for large-scale nonlinear optimization";
-    homepage = https://projects.coin-or.org/Ipopt;
+    homepage = "https://projects.coin-or.org/Ipopt";
     license = licenses.epl10;
     platforms = platforms.unix;
     maintainers = with maintainers; [ abbradar ];

pkgs/development/libraries/vc/0.7.nix

@@ -1,8 +1,8 @@
 { stdenv, fetchFromGitHub, cmake }:
 
 stdenv.mkDerivation rec {
-  version = "0.7.5";
   name = "Vc-${version}";
+  version = "0.7.5";
 
   src = fetchFromGitHub {
     owner = "VcDevel";

pkgs/development/libraries/vc/default.nix

@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, cmake }:
 
 stdenv.mkDerivation rec {
-  version = "1.2.0";
   name = "Vc-${version}";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "VcDevel";
     repo = "Vc";
     rev = version;
-    sha256 = "0qlfvcxv3nmf5drz5bc9kynaljr513pbn7snwgvghm150skmkpfl";
+    sha256 = "18vi92xxg0ly0fw4v06fwls11rahmg5z8xf65jxxrbgf37vc1wxi";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/libraries/vcg/default.nix

@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    homepage = http://vcg.isti.cnr.it/vcglib/install.html;
+    homepage = "http://vcg.isti.cnr.it/vcglib/install.html";
     description = "C++ library for manipulation, processing and displaying with OpenGL of triangle and tetrahedral meshes";
     license = licenses.gpl3;
     platforms = platforms.linux;

pkgs/development/libraries/wolfssl/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "wolfssl-${version}";
-  version = "3.9.8";
+  version = "3.9.10b";
 
   src = fetchFromGitHub {
     owner = "wolfSSL";
     repo = "wolfssl";
     rev = "v${version}";
-    sha256 = "0b1a9rmzpzjblj0gsrzas2aljivd0gfimcsj8gjl80ng25zgmaxr";
+    sha256 = "1hx543kxi4fpxww0y2c05kaav99zmnxm81rq7v7d87qzmvw2g4gx";
   };
 
   outputs = [ "out" "dev" "doc" "lib" ];

pkgs/development/libraries/xlslib/default.nix

@@ -1,8 +1,8 @@
 { stdenv, fetchurl, autoreconfHook, unzip }:
 
 stdenv.mkDerivation rec {
-  version = "2.5.0";
   name = "xlslib-${version}";
+  version = "2.5.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/xlslib/xlslib-package-${version}.zip";
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "C++/C library to construct Excel .xls files in code";
-    homepage = http://sourceforge.net/projects/xlslib/;
+    homepage = "http://sourceforge.net/projects/xlslib/";
     license = licenses.bsd2;
     platforms = platforms.linux;
     maintainers = with maintainers; [ abbradar ];

pkgs/development/ocaml-modules/ocplib-simplex/default.nix

@@ -0,0 +1,29 @@
+{ stdenv, fetchFromGitHub, autoreconfHook, ocaml, findlib }:
+
+let
+  pname = "ocplib-simplex";
+  version = "0.3";
+in
+
+stdenv.mkDerivation {
+  name = "ocaml${ocaml.version}-${pname}-${version}";
+
+  src = fetchFromGitHub {
+    owner = "OCamlPro-Iguernlala";
+    repo = pname;
+    rev = version;
+    sha256 = "1fmz38w2cj9fny4adqqyil59dvndqkr59s7wk2gqs47r72b6sisa";
+  };
+
+  buildInputs = [ autoreconfHook ocaml findlib ];
+
+  createFindlibDestdir = true;
+
+  meta = {
+    description = "An OCaml library implementing a simplex algorithm, in a functional style, for solving systems of linear inequalities";
+    homepage = https://github.com/OCamlPro-Iguernlala/ocplib-simplex;
+    inherit (ocaml.meta) platforms;
+    license = stdenv.lib.licenses.lgpl21;
+    maintainers = [ stdenv.lib.maintainers.vbgl ];
+  };
+}

pkgs/development/python-modules/blivet/default.nix

@@ -28,7 +28,6 @@ in buildPythonPackage rec {
     }' blivet/formats/__init__.py
     sed -i -e 's|"lsof"|"${lsof}/bin/lsof"|' blivet/formats/fs.py
     sed -i -r -e 's|"(u?mount)"|"${utillinux}/bin/\1"|' blivet/util.py
-    sed -i -e '/pvscan/s/, *"--cache"//' blivet/devicelibs/lvm.py
   '';
 
   propagatedBuildInputs = [

pkgs/development/python-modules/magic-wormhole/default.nix

@@ -0,0 +1,36 @@
+{ stdenv, fetchurl, nettools, glibcLocales, pythonPackages }:
+
+pythonPackages.buildPythonApplication rec {
+  name = "magic-wormhole-${version}";
+  version = "0.8.1";
+
+  src = fetchurl {
+    url = "mirror://pypi/m/magic-wormhole/${name}.tar.gz";
+    sha256 = "1yh5nbhh9z1am2pqnb5qqyq1zjl1m7z6jnkmvry2q14qwspw9had";
+  };
+
+  buildInputs = [ nettools glibcLocales ];
+  propagatedBuildInputs = with pythonPackages; [ autobahn cffi click hkdf pynacl spake2 tqdm ];
+
+  patchPhase = ''
+    sed -i -e "s|'ifconfig'|'${nettools}/bin/ifconfig'|" src/wormhole/ipaddrs.py
+    sed -i -e "s|if (os.path.dirname(os.path.abspath(wormhole))|if not os.path.abspath(wormhole).startswith('/nix/store') and (os.path.dirname(os.path.abspath(wormhole))|" src/wormhole/test/test_scripts.py
+    # XXX: disable one test due to warning:
+    # setlocale: LC_ALL: cannot change locale (en_US.UTF-8)
+    sed -i -e "s|def test_text_subprocess|def skip_test_text_subprocess|" src/wormhole/test/test_scripts.py
+  '';
+
+  checkPhase = ''
+    export PATH="$PATH:$out/bin"
+    export LANG="en_US.UTF-8"
+    export LC_ALL="en_US.UTF-8"
+    ${pythonPackages.python.interpreter} -m wormhole.test.run_trial wormhole
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Securely transfer data between computers";
+    homepage = "https://github.com/warner/magic-wormhole";
+    license = licenses.mit;
+    maintainers = with maintainers; [ asymmetric ];
+  };
+}