Merge branch 'master' into staging

2017-04-30 14:40:39 +02:00 · 2017-04-30 14:40:39 +02:00 · 9860e77f79
commit 9860e77f79
parent b8463e97b6 eb4792a03f
270 changed files with 11681 additions and 8120 deletions
--- a/lib/maintainers.nix
+++ b/lib/maintainers.nix
@ -215,6 +215,7 @@
  heel = "Sergii Paryzhskyi <parizhskiy@gmail.com>";
  henrytill = "Henry Till <henrytill@gmail.com>";
  hinton = "Tom Hinton <t@larkery.com>";
+  hodapp = "Chris Hodapp <hodapp87@gmail.com>";
  hrdinka = "Christoph Hrdinka <c.nix@hrdinka.at>";
  iand675 = "Ian Duncan <ian@iankduncan.com>";
  ianwookim = "Ian-Woo Kim <ianwookim@gmail.com>";
@ -388,6 +389,7 @@
  paholg = "Paho Lurie-Gregg <paho@paholg.com>";
  pakhfn = "Fedor Pakhomov <pakhfn@gmail.com>";
  palo = "Ingolf Wanger <palipalo9@googlemail.com>";
+  panaeon = "Vitalii Voloshyn <vitalii.voloshyn@gmail.com";
  paperdigits = "Mica Semrick <mica@silentumbrella.com>";
  pashev = "Igor Pashev <pashev.igor@gmail.com>";
  patternspandemic = "Brad Christensen <patternspandemic@live.com>";
--- a/lib/systems/doubles.nix
+++ b/lib/systems/doubles.nix
@ -30,7 +30,7 @@ in rec {
  mips = filterDoubles (matchAttrs { cpu = { family = "mips"; }; });
  x86_64 = filterDoubles parse.isx86_64;

-  cygwin = filterDoubles (matchAttrs { kernel = parse.kernels.cygwin; });
+  cygwin = filterDoubles parse.isCygwin;
  darwin = filterDoubles parse.isDarwin;
  freebsd = filterDoubles (matchAttrs { kernel = parse.kernels.freebsd; });
  gnu = filterDoubles (matchAttrs { kernel = parse.kernels.linux; abi = parse.abis.gnu; }); # Should be better
--- a/lib/systems/parse.nix
+++ b/lib/systems/parse.nix
@ -1,5 +1,9 @@
-# Define the list of system with their properties.  Only systems tested for
-# Nixpkgs are listed below
+# Define the list of system with their properties.
+#
+# See https://clang.llvm.org/docs/CrossCompilation.html and
+# http://llvm.org/docs/doxygen/html/Triple_8cpp_source.html especially
+# Triple::normalize. Parsing should essentially act as a more conservative
+# version of that last function.

 with import ../lists.nix;
 with import ../types.nix;
@ -9,7 +13,7 @@ let
  lib = import ../default.nix;
  setTypesAssert = type: pred:
    mapAttrs (name: value:
-      #assert pred value;
+      assert pred value;
      setType type ({ inherit name; } // value));
  setTypes = type: setTypesAssert type (_: true);

@ -23,7 +27,6 @@ rec {
    littleEndian = {};
  };

-
  isCpuType = isType "cpu-type";
  cpuTypes = with significantBytes; setTypesAssert "cpu-type"
    (x: elem x.bits [8 16 32 64 128]
@ -47,6 +50,7 @@ rec {
  vendors = setTypes "vendor" {
    apple = {};
    pc = {};
+
    unknown = {};
  };

@ -56,6 +60,7 @@ rec {
    elf = {};
    macho = {};
    pe = {};
+
    unknown = {};
  };

@ -63,15 +68,12 @@ rec {
  kernelFamilies = setTypes "kernel-family" {
    bsd = {};
    unix = {};
-    windows-nt = {};
-    dos = {};
  };

  isKernel = x: isType "kernel" x;
  kernels = with execFormats; with kernelFamilies; setTypesAssert "kernel"
    (x: isExecFormat x.execFormat && all isKernelFamily (attrValues x.families))
  {
-    cygwin  = { execFormat = pe;      families = { inherit /*unix*/ windows-nt; }; };
    darwin  = { execFormat = macho;   families = { inherit unix; }; };
    freebsd = { execFormat = elf;     families = { inherit unix bsd; }; };
    linux   = { execFormat = elf;     families = { inherit unix; }; };
@ -79,16 +81,21 @@ rec {
    none    = { execFormat = unknown; families = { inherit unix; }; };
    openbsd = { execFormat = elf;     families = { inherit unix bsd; }; };
    solaris = { execFormat = elf;     families = { inherit unix; }; };
-    win32   = { execFormat = pe;      families = { inherit dos; }; };
+    windows = { execFormat = pe;      families = { }; };
+  } // { # aliases
+    win32 = kernels.windows;
  };

-
  isAbi = isType "abi";
  abis = setTypes "abi" {
+    cygnus = {};
    gnu = {};
    msvc = {};
    eabi = {};
    androideabi = {};
+    gnueabi = {};
+    gnueabihf = {};
+
    unknown = {};
  };

@ -107,19 +114,25 @@ rec {
  isDarwin = matchAttrs { kernel = kernels.darwin; };
  isLinux = matchAttrs { kernel = kernels.linux; };
  isUnix = matchAttrs { kernel = { families = { inherit (kernelFamilies) unix; }; }; };
-  isWindows = s: matchAttrs { kernel = { families = { inherit (kernelFamilies) windows-nt; }; }; } s
-              || matchAttrs { kernel = { families = { inherit (kernelFamilies) dos; }; }; } s;
+  isWindows = matchAttrs { kernel = kernels.windows; };
+  isCygwin = matchAttrs { kernel = kernels.windows; abi = abis.cygnus; };
+  isMinGW = matchAttrs { kernel = kernels.windows; abi = abis.gnu; };


  mkSkeletonFromList = l: {
-    "2" =    { cpu = elemAt l 0;                      kernel = elemAt l 1;                   };
-    "4" =    { cpu = elemAt l 0; vendor = elemAt l 1; kernel = elemAt l 2; abi = elemAt l 3; };
+    "2" = # We only do 2-part hacks for things Nix already supports
+      if elemAt l 1 == "cygwin"
+        then { cpu = elemAt l 0;                      kernel = "windows"; abi = "cygnus";    }
+      else   { cpu = elemAt l 0;                      kernel = elemAt l 1;                   };
    "3" = # Awkwards hacks, beware!
      if elemAt l 1 == "apple"
        then { cpu = elemAt l 0; vendor = "apple";    kernel = elemAt l 2;                   }
      else if (elemAt l 1 == "linux") || (elemAt l 2 == "gnu")
        then { cpu = elemAt l 0;                      kernel = elemAt l 1; abi = elemAt l 2; }
+      else if (elemAt l 2 == "mingw32") # autotools breaks on -gnu for window
+        then { cpu = elemAt l 0; vendor = elemAt l 1; kernel = "windows";  abi = "gnu"; }
      else throw "Target specification with 3 components is ambiguous";
+    "4" =    { cpu = elemAt l 0; vendor = elemAt l 1; kernel = elemAt l 2; abi = elemAt l 3; };
  }.${toString (length l)}
    or (throw "system string has invalid number of hyphen-separated components");

@ -132,18 +145,10 @@ rec {
                         , # Also inferred below
                           abi    ? assert false; null
                         } @ args: let
-    getCpu = name:
-      attrByPath [name] (throw "Unknown CPU type: ${name}")
-        cpuTypes;
-    getVendor = name:
-      attrByPath [name] (throw "Unknown vendor: ${name}")
-        vendors;
-    getKernel = name:
-      attrByPath [name] (throw "Unknown kernel: ${name}")
-        kernels;
-    getAbi = name:
-      attrByPath [name] (throw "Unknown ABI: ${name}")
-        abis;
+    getCpu    = name: cpuTypes.${name} or (throw "Unknown CPU type: ${name}");
+    getVendor = name:  vendors.${name} or (throw "Unknown vendor: ${name}");
+    getKernel = name:  kernels.${name} or (throw "Unknown kernel: ${name}");
+    getAbi    = name:     abis.${name} or (throw "Unknown ABI: ${name}");

    system = rec {
      cpu = getCpu args.cpu;
@ -164,7 +169,10 @@ rec {

  mkSystemFromString = s: mkSystemFromSkeleton (mkSkeletonFromList (lib.splitString "-" s));

-  doubleFromSystem = { cpu, vendor, kernel, abi, ... }: "${cpu.name}-${kernel.name}";
+  doubleFromSystem = { cpu, vendor, kernel, abi, ... }:
+    if vendor == kernels.windows && abi == abis.cygnus
+    then "${cpu.name}-cygwin"
+    else "${cpu.name}-${kernel.name}";

  tripleFromSystem = { cpu, vendor, kernel, abi, ... } @ sys: assert isSystem sys; let
    optAbi = lib.optionalString (abi != abis.unknown) "-${abi.name}";
--- a/lib/trivial.nix
+++ b/lib/trivial.nix
@ -38,7 +38,7 @@ rec {
  /* Merge two attribute sets shallowly, right side trumps left

     Example:
-       mergeAttrs { a = 1; b = 2; } // { b = 3; c = 4; }
+       mergeAttrs { a = 1; b = 2; } { b = 3; c = 4; }
       => { a = 1; b = 3; c = 4; }
  */
  mergeAttrs = x: y: x // y;
--- a/nixos/doc/manual/administration/imperative-containers.xml
+++ b/nixos/doc/manual/administration/imperative-containers.xml
@ -29,8 +29,10 @@ line. For instance, to create a container that has
 <literal>root</literal>:

 <screen>
-# nixos-container create foo --config 'services.openssh.enable = true; \
-  users.extraUsers.root.openssh.authorizedKeys.keys = ["ssh-dss AAAAB3N…"];'
+# nixos-container create foo --config '
+  services.openssh.enable = true;
+  users.extraUsers.root.openssh.authorizedKeys.keys = ["ssh-dss AAAAB3N…"];
+'
 </screen>

 </para>
@ -97,8 +99,11 @@ This will build and activate the new configuration. You can also
 specify a new configuration on the command line:

 <screen>
-# nixos-container update foo --config 'services.httpd.enable = true; \
-  services.httpd.adminAddr = "foo@example.org";'
+# nixos-container update foo --config '
+  services.httpd.enable = true;
+  services.httpd.adminAddr = "foo@example.org";
+  networking.firewall.allowedTCPPorts = [ 80 ];
+'

 # curl http://$(nixos-container show-ip foo)/
 &lt;!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">…
--- a/nixos/doc/manual/configuration/file-systems.xml
+++ b/nixos/doc/manual/configuration/file-systems.xml
@ -35,6 +35,12 @@ or <literal>ext4</literal>, then it’s best to specify
 <option>fsType</option> to ensure that the kernel module is
 available.</para>

+<note><para>System startup will fail if any of the filesystems fails to mount,
+dropping you to the emergency shell.
+You can make a mount asynchronous and non-critical by adding
+<literal>options = [ "nofail" ];</literal>.
+</para></note>
+
 <xi:include href="luks-file-systems.xml" />

 </chapter>
--- a/nixos/doc/manual/installation/installing-usb.xml
+++ b/nixos/doc/manual/installation/installing-usb.xml
@ -34,6 +34,11 @@ ISO, copy its contents verbatim to your drive, then either:
    in <link xlink:href="https://www.kernel.org/doc/Documentation/kernel-parameters.txt">
    the kernel documentation</link> for more details).</para>
  </listitem>
+  <listitem>
+    <para>If you want to load the contents of the ISO to ram after bootin
+    (So you can remove the stick after bootup) you can append the parameter
+    <literal>copytoram</literal>to the <literal>options</literal> field.</para>
+  </listitem>
 </itemizedlist>
 </para>

--- a/nixos/modules/installer/tools/nix-fallback-paths.nix
+++ b/nixos/modules/installer/tools/nix-fallback-paths.nix
@ -1,5 +1,5 @@
 {
-  x86_64-linux = "/nix/store/j6q3pb75q1sbk0xsa5x6a629ph98ycdl-nix-1.11.8";
-  i686-linux = "/nix/store/4m6ps568l988bbr1p2k3w9raq3rblppi-nix-1.11.8";
-  x86_64-darwin = "/nix/store/cc5q944yn3j2hrs8k0kxx9r2mk9mni8a-nix-1.11.8";
+  x86_64-linux = "/nix/store/71im965h634iy99zsmlncw6qhx5jcclx-nix-1.11.9";
+  i686-linux = "/nix/store/cgvavixkayc36l6kl92i8mxr6k0p2yhy-nix-1.11.9";
+  x86_64-darwin = "/nix/store/w1c96v5yxvdmq4nvqlxjvg6kp7xa2lag-nix-1.11.9";
 }
--- a/nixos/modules/misc/extra-arguments.nix
+++ b/nixos/modules/misc/extra-arguments.nix
@ -2,16 +2,6 @@

 {
  _module.args = {
-    pkgs_i686 = import ../../.. {
-      system = "i686-linux";
-      # FIXME: we enable config.allowUnfree to make packages like
-      # nvidia-x11 available. This isn't a problem because if the user has
-      # ‘nixpkgs.config.allowUnfree = false’, then evaluation will fail on
-      # the 64-bit package anyway. However, it would be cleaner to respect
-      # nixpkgs.config here.
-      config.allowUnfree = true;
-    };
-
    utils = import ../../lib/utils.nix pkgs;
  };
 }
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@ -289,6 +289,10 @@
      rpc = 271;
      geoip = 272;
      fcron = 273;
+      sonarr = 274;
+      radarr = 275;
+      jackett = 276;
+      aria2 = 277;

      # When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!

@ -547,6 +551,10 @@
      #rpc = 271; # unused
      #geoip = 272; # unused
      fcron = 273;
+      sonarr = 274;
+      radarr = 275;
+      jackett = 276;
+      aria2 = 277;

      # When adding a gid, make sure it doesn't match an existing
      # uid. Users and groups with the same name should have equal
--- a/nixos/modules/misc/nixpkgs.nix
+++ b/nixos/modules/misc/nixpkgs.nix
@ -42,6 +42,8 @@ let
    merge = lib.mergeOneOption;
  };

+  _pkgs = import ../../.. config.nixpkgs;
+
 in

 {
@ -97,6 +99,9 @@ in
  };

  config = {
-    _module.args.pkgs = import ../../.. config.nixpkgs;
+    _module.args = {
+      pkgs = _pkgs;
+      pkgs_i686 = _pkgs.pkgsi686Linux;
+    };
  };
 }
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -116,6 +116,7 @@
  ./security/duosec.nix
  ./security/grsecurity.nix
  ./security/hidepid.nix
+  ./security/lock-kernel-modules.nix
  ./security/oath.nix
  ./security/pam.nix
  ./security/pam_usb.nix
--- a/nixos/modules/profiles/hardened.nix
+++ b/nixos/modules/profiles/hardened.nix
@ -6,10 +6,25 @@
 with lib;

 {
+  boot.kernelPackages = mkDefault pkgs.linuxPackages_hardened;
+
  security.hideProcessInformation = mkDefault true;

+  security.lockKernelModules = mkDefault true;
+
  security.apparmor.enable = mkDefault true;

+  boot.kernelParams = [
+    # Overwrite free'd memory
+    "page_poison=1"
+
+    # Disable legacy virtual syscalls
+    "vsyscall=none"
+
+    # Disable hibernation (allows replacing the running kernel)
+    "nohibernate"
+  ];
+
  # Restrict ptrace() usage to processes with a pre-defined relationship
  # (e.g., parent/child)
  boot.kernel.sysctl."kernel.yama.ptrace_scope" = mkOverride 500 1;
--- a/nixos/modules/programs/command-not-found/command-not-found.nix
+++ b/nixos/modules/programs/command-not-found/command-not-found.nix
@ -44,7 +44,7 @@ in
      ''
        # This function is called whenever a command is not found.
        command_not_found_handle() {
-          local p=${commandNotFound}
+          local p=${commandNotFound}/bin/command-not-found
          if [ -x $p -a -f ${cfg.dbPath} ]; then
            # Run the helper program.
            $p "$@"
@ -65,7 +65,7 @@ in
      ''
        # This function is called whenever a command is not found.
        command_not_found_handler() {
-          local p=${commandNotFound}
+          local p=${commandNotFound}/bin/command-not-found
          if [ -x $p -a -f ${cfg.dbPath} ]; then
            # Run the helper program.
            $p "$@"
--- a/nixos/modules/programs/zsh/zsh-syntax-highlighting.nix
+++ b/nixos/modules/programs/zsh/zsh-syntax-highlighting.nix
@ -18,7 +18,17 @@ in

        highlighters = mkOption {
          default = [ "main" ];
-          type = types.listOf(types.str);
+
+          # https://github.com/zsh-users/zsh-syntax-highlighting/blob/master/docs/highlighters.md
+          type = types.listOf(types.enum([
+            "main"
+            "brackets"
+            "pattern"
+            "cursor"
+            "root"
+            "line"
+          ]));
+
          description = ''
            Specifies the highlighters to be used by zsh-syntax-highlighting.

--- a/nixos/modules/security/grsecurity.nix
+++ b/nixos/modules/security/grsecurity.nix
@ -13,7 +13,7 @@ in

 {
  meta = {
-    maintainers = with maintainers; [ joachifm ];
+    maintainers = with maintainers; [ ];
    doc = ./grsecurity.xml;
  };

--- a/nixos/modules/security/grsecurity.xml
+++ b/nixos/modules/security/grsecurity.xml
@ -26,9 +26,11 @@
    <link xlink:href="https://wiki.archlinux.org/index.php/Grsecurity">Arch
    Linux wiki page on grsecurity</link>.

-    <note><para>grsecurity/PaX is only available for the latest linux -stable
-    kernel; patches against older kernels are available from upstream only for
-    a fee.</para></note>
+    <warning><para>Upstream has ceased free support for grsecurity/PaX.  See
+    <link xlink:href="https://grsecurity.net/passing_the_baton.php">
+    the announcement</link> for more information.  Consequently, NixOS
+    support for grsecurity/PaX also must cease.  Enabling this module will
+    result in a build error.</para></warning>
    <note><para>We standardise on a desktop oriented configuration primarily due
    to lack of resources.  The grsecurity/PaX configuration state space is huge
    and each configuration requires quite a bit of testing to ensure that the
--- a/nixos/modules/security/lock-kernel-modules.nix
+++ b/nixos/modules/security/lock-kernel-modules.nix
@ -0,0 +1,36 @@
+{ config, lib, ... }:
+
+with lib;
+
+{
+  options = {
+    security.lockKernelModules = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Disable kernel module loading once the system is fully initialised.
+        Module loading is disabled until the next reboot.  Problems caused
+        by delayed module loading can be fixed by adding the module(s) in
+        question to <option>boot.kernelModules</option>.
+      '';
+    };
+  };
+
+  config = mkIf config.security.lockKernelModules {
+    systemd.services.disable-kernel-module-loading = rec {
+      description = "Disable kernel module loading";
+
+      wantedBy = [ config.systemd.defaultUnit ];
+      after = [ "systemd-udev-settle.service" "firewall.service" "systemd-modules-load.service" ] ++ wantedBy;
+
+      script = "echo -n 1 > /proc/sys/kernel/modules_disabled";
+
+      unitConfig.ConditionPathIsWritable = "/proc/sys/kernel";
+
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+      };
+    };
+  };
+}
--- a/nixos/modules/services/continuous-integration/hydra/default.nix
+++ b/nixos/modules/services/continuous-integration/hydra/default.nix
@ -233,6 +233,7 @@ in
          hydra_logo ${cfg.logo}
        ''}
        gc_roots_dir ${cfg.gcRootsDir}
+        use-substitutes = ${if cfg.useSubstitutes then "1" else "0"}
      '';

    environment.systemPackages = [ cfg.package ];
--- a/nixos/modules/services/hardware/amd-hybrid-graphics.nix
+++ b/nixos/modules/services/hardware/amd-hybrid-graphics.nix
@ -25,15 +25,22 @@
      path = [ pkgs.bash ];
      description = "Disable AMD Card";
      after = [ "sys-kernel-debug.mount" ];
-      requires = [ "sys-kernel-debug.mount" ];
-      wantedBy = [ "multi-user.target" ];
+      before = [ "systemd-vconsole-setup.service" "display-manager.service" ];
+      requires = [ "sys-kernel-debug.mount" "vgaswitcheroo.path" ];
      serviceConfig = {
        Type = "oneshot";
        RemainAfterExit = true;
-        ExecStart = "${pkgs.bash}/bin/sh -c 'echo -e \"IGD\\nOFF\" > /sys/kernel/debug/vgaswitcheroo/switch; exit 0'";
-        ExecStop = "${pkgs.bash}/bin/sh -c 'echo ON >/sys/kernel/debug/vgaswitcheroo/switch; exit 0'";
+        ExecStart = "${pkgs.bash}/bin/sh -c 'echo -e \"IGD\\nOFF\" > /sys/kernel/debug/vgaswitcheroo/switch'";
+        ExecStop = "${pkgs.bash}/bin/sh -c 'echo ON >/sys/kernel/debug/vgaswitcheroo/switch'";
      };
    };
+    systemd.paths."vgaswitcheroo" = {
+      pathConfig = {
+        PathExists = "/sys/kernel/debug/vgaswitcheroo/switch";
+        Unit = "amd-hybrid-graphics.service";
+      };
+      wantedBy = ["multi-user.target"];
+    };
  };

 }
--- a/nixos/modules/services/misc/jackett.nix
+++ b/nixos/modules/services/misc/jackett.nix
@ -22,14 +22,14 @@ in
          echo "Creating jackett data directory in /var/lib/jackett/"
          mkdir -p /var/lib/jackett/
        }
-        chown -R jackett /var/lib/jackett/
+        chown -R jackett:jackett /var/lib/jackett/
        chmod 0700 /var/lib/jackett/
      '';

      serviceConfig = {
        Type = "simple";
        User = "jackett";
-        Group = "nogroup";
+        Group = "jackett";
        PermissionsStartOnly = "true";
        ExecStart = "${pkgs.jackett}/bin/Jackett";
        Restart = "on-failure";
@ -37,8 +37,11 @@ in
    };

    users.extraUsers.jackett = {
+      uid = config.ids.uids.jackett;
      home = "/var/lib/jackett";
+      group = "jackett";
    };
+    users.extraGroups.jackett.gid = config.ids.gids.jackett;

  };
 }
--- a/nixos/modules/services/misc/plex.nix
+++ b/nixos/modules/services/misc/plex.nix
@ -91,7 +91,7 @@ in
        # Copy the database skeleton files to /var/lib/plex/.skeleton
        # See the the Nix expression for Plex's package for more information on
        # why this is done.
-        test -d "${cfg.dataDir}/.skeleton" || mkdir "${cfg.dataDir}/.skeleton"
+        install --owner ${cfg.user} --group ${cfg.group} -d "${cfg.dataDir}/.skeleton"
        for db in "com.plexapp.plugins.library.db"; do
            if [ ! -e  "${cfg.dataDir}/.skeleton/$db" ]; then
              cp "${cfg.package}/usr/lib/plexmediaserver/Resources/base_$db" "${cfg.dataDir}/.skeleton/$db"
--- a/nixos/modules/services/misc/radarr.nix
+++ b/nixos/modules/services/misc/radarr.nix
@ -22,14 +22,14 @@ in
          echo "Creating radarr data directory in /var/lib/radarr/"
          mkdir -p /var/lib/radarr/
        }
-        chown -R radarr /var/lib/radarr/
+        chown -R radarr:radarr /var/lib/radarr/
        chmod 0700 /var/lib/radarr/
      '';

      serviceConfig = {
        Type = "simple";
        User = "radarr";
-        Group = "nogroup";
+        Group = "radarr";
        PermissionsStartOnly = "true";
        ExecStart = "${pkgs.radarr}/bin/Radarr";
        Restart = "on-failure";
@ -37,8 +37,11 @@ in
    };

    users.extraUsers.radarr = {
+      uid = config.ids.uids.radarr;
      home = "/var/lib/radarr";
+      group = "radarr";
    };
+    users.extraGroups.radarr.gid = config.ids.gids.radarr;

  };
 }
--- a/nixos/modules/services/misc/sonarr.nix
+++ b/nixos/modules/services/misc/sonarr.nix
@ -22,14 +22,14 @@ in
          echo "Creating sonarr data directory in /var/lib/sonarr/"
          mkdir -p /var/lib/sonarr/
        }
-        chown -R sonarr /var/lib/sonarr/
+        chown -R sonarr:sonarr /var/lib/sonarr/
        chmod 0700 /var/lib/sonarr/
      '';

      serviceConfig = {
        Type = "simple";
        User = "sonarr";
-        Group = "nogroup";
+        Group = "sonarr";
        PermissionsStartOnly = "true";
        ExecStart = "${pkgs.sonarr}/bin/NzbDrone --no-browser";
        Restart = "on-failure";
@ -37,8 +37,11 @@ in
    };

    users.extraUsers.sonarr = {
+      uid = config.ids.uids.sonarr;
      home = "/var/lib/sonarr";
+      group = "sonarr";
    };
+    users.extraGroups.sonarr.gid = config.ids.gids.sonarr;

  };
 }
--- a/nixos/modules/services/monitoring/graphite.nix
+++ b/nixos/modules/services/monitoring/graphite.nix
@ -400,7 +400,8 @@ in {

          mkdir -p ${cfg.dataDir}/whisper
          chmod 0700 ${cfg.dataDir}/whisper
-          chown -R graphite:graphite ${cfg.dataDir}
+          chown graphite:graphite ${cfg.dataDir}
+          chown graphite:graphite ${cfg.dataDir}/whisper
        '';
      };
    })
@ -487,9 +488,11 @@ in {
            # create index
            ${pkgs.python27Packages.graphite_web}/bin/build-index.sh

-            touch ${dataDir}/db-created
+            chown graphite:graphite ${cfg.dataDir}
+            chown graphite:graphite ${cfg.dataDir}/whisper
+            chown -R graphite:graphite ${cfg.dataDir}/log

-            chown -R graphite:graphite ${cfg.dataDir}
+            touch ${dataDir}/db-created
          fi
        '';
      };
@ -526,9 +529,10 @@ in {
            mkdir -p ${dataDir}/cache/
            chmod 0700 ${dataDir}/cache/

-            touch ${dataDir}/db-created
+            chown graphite:graphite ${cfg.dataDir}
+            chown -R graphite:graphite ${cfg.dataDir}/cache

-            chown -R graphite:graphite ${cfg.dataDir}
+            touch ${dataDir}/db-created
          fi
        '';
      };
@ -549,7 +553,7 @@ in {
        preStart = ''
          if ! test -e ${dataDir}/db-created; then
            mkdir -p ${dataDir}
-            chown -R graphite:graphite ${dataDir}
+            chown graphite:graphite ${dataDir}
          fi
        '';
      };
--- a/nixos/modules/services/networking/aria2.nix
+++ b/nixos/modules/services/networking/aria2.nix
@ -0,0 +1,135 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.aria2;
+
+  homeDir = "/var/lib/aria2";
+
+  settingsDir = "${homeDir}";
+  sessionFile = "${homeDir}/aria2.session";
+  downloadDir = "${homeDir}/Downloads";
+  
+  rangesToStringList = map (x: builtins.toString x.from +"-"+ builtins.toString x.to);
+  
+  settingsFile = pkgs.writeText "aria2.conf"
+  ''
+    dir=${cfg.downloadDir}
+    listen-port=${concatStringsSep "," (rangesToStringList cfg.listenPortRange)}
+    rpc-listen-port=${toString cfg.rpcListenPort}
+    rpc-secret=${cfg.rpcSecret}
+  '';
+
+in
+{
+  options = {
+    services.aria2 = {
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether or not to enable the headless Aria2 daemon service.
+
+          Aria2 daemon can be controlled via the RPC interface using
+          one of many WebUI (http://localhost:6800/ by default).
+
+          Targets are downloaded to ${downloadDir} by default and are
+          accessible to users in the "aria2" group.
+        '';
+      };
+      openPorts = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Open listen and RPC ports found in listenPortRange and rpcListenPort
+          options in the firewall.
+        '';
+      };
+      downloadDir = mkOption {
+        type = types.string;
+        default = "${downloadDir}";
+        description = ''
+          Directory to store downloaded files.
+        '';
+      };
+      listenPortRange = mkOption {
+        type = types.listOf types.attrs;
+        default = [ { from = 6881; to = 6999; } ];
+        description = ''
+          Set UDP listening port range used by DHT(IPv4, IPv6) and UDP tracker.
+        '';
+      };
+      rpcListenPort = mkOption {
+        type = types.int;
+        default = 6800;
+        description = "Specify a port number for JSON-RPC/XML-RPC server to listen to. Possible Values: 1024-65535";
+      };
+      rpcSecret = mkOption {
+        type = types.string;
+        default = "aria2rpc";
+        description = ''
+          Set RPC secret authorization token.
+          Read https://aria2.github.io/manual/en/html/aria2c.html#rpc-auth to know how this option value is used.
+        '';
+      };
+      extraArguments = mkOption {
+        type = types.string;
+        example = "--rpc-listen-all --remote-time=true";
+        default = "";
+        description = ''
+          Additional arguments to be passed to Aria2.
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    # Need to open ports for proper functioning
+    networking.firewall = mkIf cfg.openPorts {
+      allowedUDPPortRanges = config.services.aria2.listenPortRange;
+      allowedTCPPorts = [ config.services.aria2.rpcListenPort ];
+    };
+
+    users.extraUsers.aria2 = {
+      group = "aria2";
+      uid = config.ids.uids.aria2;
+      description = "aria2 user";
+      home = homeDir;
+      createHome = false;
+    };
+
+    users.extraGroups.aria2.gid = config.ids.gids.aria2;
+
+    systemd.services.aria2 = {
+      description = "aria2 Service";
+      after = [ "local-fs.target" "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      preStart = ''
+        mkdir -m 0770 -p "${homeDir}"
+        chown aria2:aria2 "${homeDir}"
+        if [[ ! -d "${config.services.aria2.downloadDir}" ]]
+        then 
+          mkdir -m 0770 -p "${config.services.aria2.downloadDir}"
+          chown aria2:aria2 "${config.services.aria2.downloadDir}"
+        fi
+        if [[ ! -e "${sessionFile}" ]]
+        then 
+          touch "${sessionFile}"
+          chown aria2:aria2 "${sessionFile}"
+        fi
+        cp -f "${settingsFile}" "${settingsDir}/aria2.conf"
+      '';
+
+      serviceConfig = {
+        Restart = "on-abort";
+        ExecStart = "${pkgs.aria2}/bin/aria2c --enable-rpc --conf-path=${settingsDir}/aria2.conf ${config.services.aria2.extraArguments} --save-session=${sessionFile}";
+        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+        User = "aria2";
+        Group = "aria2";
+        PermissionsStartOnly = true;
+      };
+    };
+  };
+}
--- a/nixos/modules/services/networking/avahi-daemon.nix
+++ b/nixos/modules/services/networking/avahi-daemon.nix
@ -33,6 +33,9 @@ let
    publish-hinfo=${yesNo publish.hinfo}
    publish-workstation=${yesNo publish.workstation}
    publish-domain=${yesNo publish.domain}
+
+    [reflector]
+    enable-reflector=${yesNo reflector}
  '';

 in
@ -113,6 +116,11 @@ in
        description = ''Whether to enable wide-area service discovery.'';
      };

+      reflector = mkOption {
+        default = false;
+        description = ''Reflect incoming mDNS requests to all allowed network interfaces.'';
+      };
+
      publish = {
        enable = mkOption {
          default = false;
--- a/nixos/modules/services/networking/i2pd.nix
+++ b/nixos/modules/services/networking/i2pd.nix
@ -8,8 +8,6 @@ let

  homeDir = "/var/lib/i2pd";

-  extip = "EXTIP=\$(${pkgs.curl.bin}/bin/curl -sLf \"http://jsonip.com\" | ${pkgs.gawk}/bin/awk -F'\"' '{print $4}')";
-
  mkEndpointOpt = name: addr: port: {
    enable = mkEnableOption name;
    name = mkOption {
@ -152,9 +150,8 @@ let

  i2pdSh = pkgs.writeScriptBin "i2pd" ''
    #!/bin/sh
-    ${if isNull cfg.extIp then extip else ""}
    ${pkgs.i2pd}/bin/i2pd \
-      --host=${if isNull cfg.extIp then "$EXTIP" else cfg.extIp} \
+      ${if isNull cfg.extIp then "" else "--host="+cfg.extIp} \
      --conf=${i2pdConf} \
      --tunconf=${i2pdTunnelConf}
  '';
--- a/nixos/modules/services/networking/networkmanager.nix
+++ b/nixos/modules/services/networking/networkmanager.nix
@ -12,6 +12,7 @@ let
  configFile = writeText "NetworkManager.conf" ''
    [main]
    plugins=keyfile
+    dns=${if cfg.useDnsmasq then "dnsmasq" else "default"}

    [keyfile]
    ${optionalString (config.networking.hostName != "")
@ -158,6 +159,17 @@ in {
      ethernet.macAddress = macAddressOpt;
      wifi.macAddress = macAddressOpt;

+      useDnsmasq = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Enable NetworkManager's dnsmasq integration. NetworkManager will run
+          dnsmasq as a local caching nameserver, using a "split DNS"
+          configuration if you are connected to a VPN, and then update
+          resolv.conf to point to the local nameserver.
+        '';
+      };
+
      dispatcherScripts = mkOption {
        type = types.listOf (types.submodule {
          options = {
--- a/nixos/modules/services/web-apps/atlassian/confluence.nix
+++ b/nixos/modules/services/web-apps/atlassian/confluence.nix
@ -103,7 +103,7 @@ in
      requires = [ "postgresql.service" ];
      after = [ "postgresql.service" ];

-      path = [ cfg.jrePackage ];
+      path = [ cfg.jrePackage pkgs.bash ];

      environment = {
        CONF_USER = cfg.user;
--- a/nixos/modules/services/x11/desktop-managers/default.nix
+++ b/nixos/modules/services/x11/desktop-managers/default.nix
@ -8,7 +8,7 @@ let
  cfg = xcfg.desktopManager;

  # If desktop manager `d' isn't capable of setting a background and
-  # the xserver is enabled, the `feh' program is used as a fallback.
+  # the xserver is enabled, `feh' or `xsetroot' are used as a fallback.
  needBGCond = d: ! (d ? bgSupport && d.bgSupport) && xcfg.enable;

 in
@ -44,8 +44,11 @@ in
            manage = "desktop";
            start = d.start
            + optionalString (needBGCond d) ''
-              if test -e $HOME/.background-image; then
+              if [ -e $HOME/.background-image ]; then
                ${pkgs.feh}/bin/feh --bg-scale $HOME/.background-image
+              else
+                # Use a solid black background as fallback
+                ${pkgs.xorg.xsetroot}/bin/xsetroot -solid black
              fi
            '';
          }) list;
@ -80,6 +83,6 @@ in
  config = {
    services.xserver.displayManager.session = cfg.session.list;
    environment.systemPackages =
-      mkIf cfg.session.needBGPackages [ pkgs.feh ];
+      mkIf cfg.session.needBGPackages [ pkgs.feh ]; # xsetroot via xserver.enable
  };
 }
--- a/nixos/modules/services/x11/display-managers/default.nix
+++ b/nixos/modules/services/x11/display-managers/default.nix
@ -32,8 +32,32 @@ let
    ''
      #! ${pkgs.bash}/bin/bash

-      # Handle being called by SDDM.
-      if test "''${1:0:1}" = / ; then eval exec $1 $2 ; fi
+      # Expected parameters:
+      #   $1 = <desktop-manager>+<window-manager>
+
+      # Actual parameters (FIXME):
+      # SDDM is calling this script like the following:
+      #   $1 = /nix/store/xxx-xsession (= $0)
+      #   $2 = <desktop-manager>+<window-manager>
+      # SLiM is using the following parameter:
+      #   $1 = /nix/store/xxx-xsession <desktop-manager>+<window-manager>
+      # LightDM keeps the double quotes:
+      #   $1 = /nix/store/xxx-xsession "<desktop-manager>+<window-manager>"
+      # The fake/auto display manager doesn't use any parameters and GDM is
+      # broken.
+      # If you want to "debug" this script don't print the parameters to stdout
+      # or stderr because this script will be executed multiple times and the
+      # output won't be visible in the log when the script is executed for the
+      # first time (e.g. append them to a file instead)!
+
+      # All of the above cases are handled by the following hack (FIXME).
+      # Since this line is *very important* for *all display managers* it is
+      # very important to test changes to the following line with all display
+      # managers:
+      if [ "''${1:0:1}" = "/" ]; then eval exec "$1" "$2" ; fi
+
+      # Now it should be safe to assume that the script was called with the
+      # expected parameters.

      ${optionalString cfg.displayManager.logToJournal ''
        if [ -z "$_DID_SYSTEMD_CAT" ]; then
@ -107,15 +131,16 @@ let
          fi
      fi

-      # The session type is "<desktop-manager> + <window-manager>", so
-      # extract those.
-      windowManager="''${sessionType##* + }"
+      # The session type is "<desktop-manager>+<window-manager>", so
+      # extract those (see:
+      # http://wiki.bash-hackers.org/syntax/pe#substring_removal).
+      windowManager="''${sessionType##*+}"
      : ''${windowManager:=${cfg.windowManager.default}}
-      desktopManager="''${sessionType% + *}"
+      desktopManager="''${sessionType%%+*}"
      : ''${desktopManager:=${cfg.desktopManager.default}}

      # Start the window manager.
-      case $windowManager in
+      case "$windowManager" in
        ${concatMapStrings (s: ''
          (${s.name})
            ${s.start}
@ -125,7 +150,7 @@ let
      esac

      # Start the desktop manager.
-      case $desktopManager in
+      case "$desktopManager" in
        ${concatMapStrings (s: ''
          (${s.name})
            ${s.start}
@ -142,6 +167,9 @@ let
      exit 0
    '';

+  # Desktop Entry Specification:
+  # - https://standards.freedesktop.org/desktop-entry-spec/latest/
+  # - https://standards.freedesktop.org/desktop-entry-spec/latest/ar01s06.html
  mkDesktops = names: pkgs.runCommand "desktops"
    { # trivial derivation
      preferLocalBuild = true;
@ -155,7 +183,7 @@ let
        Version=1.0
        Type=XSession
        TryExec=${cfg.displayManager.session.script}
-        Exec=${cfg.displayManager.session.script} '${n}'
+        Exec=${cfg.displayManager.session.script} "${n}"
        X-GDM-BypassXsession=true
        Name=${n}
        Comment=
@ -238,7 +266,7 @@ in
          wm = filter (s: s.manage == "window") list;
          dm = filter (s: s.manage == "desktop") list;
          names = flip concatMap dm
-            (d: map (w: d.name + optionalString (w.name != "none") (" + " + w.name))
+            (d: map (w: d.name + optionalString (w.name != "none") ("+" + w.name))
              (filter (w: d.name != "none" || w.name != "none") wm));
          desktops = mkDesktops names;
          script = xsession wm dm;
--- a/nixos/modules/services/x11/display-managers/lightdm.nix
+++ b/nixos/modules/services/x11/display-managers/lightdm.nix
@ -61,7 +61,7 @@ let
    let
      dm = xcfg.desktopManager.default;
      wm = xcfg.windowManager.default;
-    in dm + optionalString (wm != "none") (" + " + wm);
+    in dm + optionalString (wm != "none") ("+" + wm);
 in
 {
  # Note: the order in which lightdm greeter modules are imported
--- a/nixos/modules/services/x11/display-managers/sddm.nix
+++ b/nixos/modules/services/x11/display-managers/sddm.nix
@ -69,7 +69,7 @@ let
    let
      dm = xcfg.desktopManager.default;
      wm = xcfg.windowManager.default;
-    in dm + optionalString (wm != "none") (" + " + wm);
+    in dm + optionalString (wm != "none") ("+" + wm);

 in
 {
--- a/nixos/modules/system/boot/loader/grub/grub.nix
+++ b/nixos/modules/system/boot/loader/grub/grub.nix
@ -239,6 +239,12 @@ in
          menuentry "Windows 7" {
            chainloader (hd0,4)+1
          }
+
+          # GRUB 2 with UEFI example, chainloading another distro
+          menuentry "Fedora" {
+            set root=(hd1,1)
+            chainloader /efi/fedora/grubx64.efi
+          }
        '';
        description = ''
          Any additional entries you want added to the GRUB boot menu.
--- a/nixos/modules/system/boot/stage-1-init.sh
+++ b/nixos/modules/system/boot/stage-1-init.sh
@ -154,6 +154,9 @@ for o in $(cat /proc/cmdline); do
            fi
            ln -s "$root" /dev/root
            ;;
+        copytoram)
+            copytoram=1
+            ;;
    esac
 done

@ -474,6 +477,22 @@ while read -u 3 mountPoint; do
    # doing something with $device right now.
    udevadm settle

+    # If copytoram is enabled: skip mounting the ISO and copy its content to a tmpfs.
+    if [ -n "$copytoram" ] && [ "$device" = /dev/root ] && [ "$mountPoint" = /iso ]; then
+      fsType=$(blkid -o value -s TYPE "$device")
+      fsSize=$(blockdev --getsize64 "$device")
+
+      mkdir -p /tmp-iso
+      mount -t "$fsType" /dev/root /tmp-iso
+      mountFS tmpfs /iso size="$fsSize" tmpfs
+
+      cp -r /tmp-iso/* /mnt-root/iso/
+
+      umount /tmp-iso
+      rmdir /tmp-iso
+      continue
+    fi
+
    mountFS "$device" "$mountPoint" "$options" "$fsType"
 done

--- a/nixos/modules/tasks/trackpoint.nix
+++ b/nixos/modules/tasks/trackpoint.nix
@ -81,7 +81,7 @@ with lib;
      services.xserver.inputClassSections =
        [''
        Identifier "Trackpoint Wheel Emulation"
-          MatchProduct "${if cfg.fakeButtons then "PS/2 Generic Mouse" else "Elantech PS/2 TrackPoint|TPPS/2 IBM TrackPoint|DualPoint Stick|Synaptics Inc. Composite TouchPad / TrackPoint|ThinkPad USB Keyboard with TrackPoint|USB Trackpoint pointing device|Composite TouchPad / TrackPoint"}"
+          MatchProduct "${if cfg.fakeButtons then "PS/2 Generic Mouse" else "ETPS/2 Elantech TrackPoint|Elantech PS/2 TrackPoint|TPPS/2 IBM TrackPoint|DualPoint Stick|Synaptics Inc. Composite TouchPad / TrackPoint|ThinkPad USB Keyboard with TrackPoint|USB Trackpoint pointing device|Composite TouchPad / TrackPoint"}"
          MatchDevicePath "/dev/input/event*"
          Option "EmulateWheel" "true"
          Option "EmulateWheelButton" "2"
--- a/nixos/modules/virtualisation/azure-image.nix
+++ b/nixos/modules/virtualisation/azure-image.nix
@ -2,93 +2,19 @@

 with lib;
 let
-  diskSize = "30720";
+  diskSize = 30720;
 in
 {
-  system.build.azureImage =
-    pkgs.vmTools.runInLinuxVM (
-      pkgs.runCommand "azure-image"
-        { preVM =
-            ''
-              mkdir $out
-              diskImage=$out/$diskImageBase
-
-              cyl=$(((${diskSize}*1024*1024)/(512*63*255)))
-              size=$(($cyl*255*63*512))              
-              roundedsize=$((($size/(1024*1024)+1)*(1024*1024)))
-              ${pkgs.vmTools.qemu-220}/bin/qemu-img create -f raw $diskImage $roundedsize
-              mv closure xchg/
-            '';
-
-          postVM =
-            ''
-              mkdir -p $out
-              ${pkgs.vmTools.qemu-220}/bin/qemu-img convert -f raw -o subformat=fixed -O vpc $diskImage $out/disk.vhd
-              rm $diskImage
-            '';
-          diskImageBase = "nixos-image-${config.system.nixosLabel}-${pkgs.stdenv.system}.raw";
-          buildInputs = [ pkgs.utillinux pkgs.perl ];
-          exportReferencesGraph =
-            [ "closure" config.system.build.toplevel ];
-        }
-        ''
-          # Create partition table
-          ${pkgs.parted}/sbin/parted /dev/vda mklabel msdos
-          ${pkgs.parted}/sbin/parted /dev/vda mkpart primary ext4 1 ${diskSize}M
-          ${pkgs.parted}/sbin/parted /dev/vda print
-          . /sys/class/block/vda1/uevent
-          mknod /dev/vda1 b $MAJOR $MINOR
-
-          # Create an empty filesystem and mount it.
-          ${pkgs.e2fsprogs}/sbin/mkfs.ext4 -L nixos /dev/vda1
-          ${pkgs.e2fsprogs}/sbin/tune2fs -c 0 -i 0 /dev/vda1
-
-          mkdir /mnt
-          mount /dev/vda1 /mnt
-
-          # The initrd expects these directories to exist.
-          mkdir /mnt/dev /mnt/proc /mnt/sys
-
-          mount --bind /proc /mnt/proc
-          mount --bind /dev /mnt/dev
-          mount --bind /sys /mnt/sys
-
-          # Copy all paths in the closure to the filesystem.
-          storePaths=$(perl ${pkgs.pathsFromGraph} /tmp/xchg/closure)
-
-          mkdir -p /mnt/nix/store
-          echo "copying everything (will take a while)..."
-          cp -prd $storePaths /mnt/nix/store/
-
-          echo Register the paths in the Nix database.
-          printRegistration=1 perl ${pkgs.pathsFromGraph} /tmp/xchg/closure | \
-              chroot /mnt ${config.nix.package.out}/bin/nix-store --load-db --option build-users-group ""
-
-          echo Create the system profile to allow nixos-rebuild to work.
-          chroot /mnt ${config.nix.package.out}/bin/nix-env \
-              -p /nix/var/nix/profiles/system --set ${config.system.build.toplevel} --option build-users-group ""
-
-          echo nixos-rebuild requires an /etc/NIXOS.
-          mkdir -p /mnt/etc
-          touch /mnt/etc/NIXOS
-
-          echo switch-to-configuration requires a /bin/sh
-          mkdir -p /mnt/bin
-          ln -s ${config.system.build.binsh}/bin/sh /mnt/bin/sh
-
-          echo Install a configuration.nix.
-          mkdir -p /mnt/etc/nixos /mnt/boot/grub
-          cp ${./azure-config-user.nix} /mnt/etc/nixos/configuration.nix
-
-          echo Generate the GRUB menu.
-          ln -s vda /dev/sda
-          chroot /mnt ${config.system.build.toplevel}/bin/switch-to-configuration boot
-
-          echo Almost done
-          umount /mnt/proc /mnt/dev /mnt/sys
-          umount /mnt
-        ''
-    );
+  system.build.azureImage = import ../../lib/make-disk-image.nix {
+    name = "azure-image";
+    postVM = ''
+      ${pkgs.vmTools.qemu-220}/bin/qemu-img convert -f raw -o subformat=fixed -O vpc $diskImage $out/disk.vhd
+    '';
+    configFile = ./azure-config-user.nix;
+    format = "raw";
+    inherit diskSize;
+    inherit config lib pkgs;
+  };

  imports = [ ./azure-common.nix ];

--- a/nixos/modules/virtualisation/docker.nix
+++ b/nixos/modules/virtualisation/docker.nix
@ -7,8 +7,7 @@ with lib;
 let

  cfg = config.virtualisation.docker;
-  pro = config.networking.proxy.default;
-  proxy_env = optionalAttrs (pro != null) { Environment = "\"http_proxy=${pro}\""; };
+  proxy_env = config.networking.proxy.envVars;

 in

@ -106,6 +105,7 @@ in

      systemd.services.docker = {
        wantedBy = optional cfg.enableOnBoot "multi-user.target";
+        environment = proxy_env;
        serviceConfig = {
          ExecStart = [
            ""
@ -122,7 +122,7 @@ in
            ""
            "${pkgs.procps}/bin/kill -s HUP $MAINPID"
          ];
-        } // proxy_env;
+        };

        path = [ pkgs.kmod ] ++ (optional (cfg.storageDriver == "zfs") pkgs.zfs);
      };
--- a/nixos/modules/virtualisation/google-compute-image.nix
+++ b/nixos/modules/virtualisation/google-compute-image.nix
@ -2,7 +2,7 @@

 with lib;
 let
-  diskSize = "1G";
+  diskSize = 1024; # MB
 in
 {
  imports = [ ../profiles/headless.nix ../profiles/qemu-guest.nix ./grow-partition.nix ];
@ -10,89 +10,21 @@ in
  # https://cloud.google.com/compute/docs/tutorials/building-images
  networking.firewall.enable = mkDefault false;

-  system.build.googleComputeImage =
-    pkgs.vmTools.runInLinuxVM (
-      pkgs.runCommand "google-compute-image"
-        { preVM =
-            ''
-              mkdir $out
-              diskImage=$out/$diskImageBase
-              truncate $diskImage --size ${diskSize}
-              mv closure xchg/
-            '';
-
-          postVM =
-            ''
-              PATH=$PATH:${pkgs.stdenv.lib.makeBinPath [ pkgs.gnutar pkgs.gzip ]}
-              pushd $out
-              mv $diskImageBase disk.raw
-              tar -Szcf $diskImageBase.tar.gz disk.raw
-              rm $out/disk.raw
-              popd
-            '';
-          diskImageBase = "nixos-image-${config.system.nixosLabel}-${pkgs.stdenv.system}.raw";
-          buildInputs = [ pkgs.utillinux pkgs.perl ];
-          exportReferencesGraph =
-            [ "closure" config.system.build.toplevel ];
-        }
-        ''
-          # Create partition table
-          ${pkgs.parted}/sbin/parted /dev/vda mklabel msdos
-          ${pkgs.parted}/sbin/parted /dev/vda mkpart primary ext4 1 ${diskSize}
-          ${pkgs.parted}/sbin/parted /dev/vda print
-          . /sys/class/block/vda1/uevent
-          mknod /dev/vda1 b $MAJOR $MINOR
-
-          # Create an empty filesystem and mount it.
-          ${pkgs.e2fsprogs}/sbin/mkfs.ext4 -L nixos /dev/vda1
-          ${pkgs.e2fsprogs}/sbin/tune2fs -c 0 -i 0 /dev/vda1
-
-          mkdir /mnt
-          mount /dev/vda1 /mnt
-
-          # The initrd expects these directories to exist.
-          mkdir /mnt/dev /mnt/proc /mnt/sys
-
-          mount --bind /proc /mnt/proc
-          mount --bind /dev /mnt/dev
-          mount --bind /sys /mnt/sys
-
-          # Copy all paths in the closure to the filesystem.
-          storePaths=$(perl ${pkgs.pathsFromGraph} /tmp/xchg/closure)
-
-          mkdir -p /mnt/nix/store
-          echo "copying everything (will take a while)..."
-          ${pkgs.rsync}/bin/rsync -a $storePaths /mnt/nix/store/
-
-          # Register the paths in the Nix database.
-          printRegistration=1 perl ${pkgs.pathsFromGraph} /tmp/xchg/closure | \
-              chroot /mnt ${config.nix.package.out}/bin/nix-store --load-db --option build-users-group ""
-
-          # Create the system profile to allow nixos-rebuild to work.
-          chroot /mnt ${config.nix.package.out}/bin/nix-env \
-              -p /nix/var/nix/profiles/system --set ${config.system.build.toplevel} \
-              --option build-users-group ""
-
-          # `nixos-rebuild' requires an /etc/NIXOS.
-          mkdir -p /mnt/etc
-          touch /mnt/etc/NIXOS
-
-          # `switch-to-configuration' requires a /bin/sh
-          mkdir -p /mnt/bin
-          ln -s ${config.system.build.binsh}/bin/sh /mnt/bin/sh
-
-          # Install a configuration.nix.
-          mkdir -p /mnt/etc/nixos /mnt/boot/grub
-          cp ${./google-compute-config.nix} /mnt/etc/nixos/configuration.nix
-
-          # Generate the GRUB menu.
-          ln -s vda /dev/sda
-          chroot /mnt ${config.system.build.toplevel}/bin/switch-to-configuration boot
-
-          umount /mnt/proc /mnt/dev /mnt/sys
-          umount /mnt
-        ''
-    );
+  system.build.googleComputeImage = import ../../lib/make-disk-image.nix {
+    name = "google-compute-image";
+    postVM = ''
+      PATH=$PATH:${pkgs.stdenv.lib.makeBinPath [ pkgs.gnutar pkgs.gzip ]}
+      pushd $out
+      mv $diskImage disk.raw
+      tar -Szcf nixos-image-${config.system.nixosLabel}-${pkgs.stdenv.system}.raw.tar.gz disk.raw
+      rm $out/disk.raw
+      popd
+    '';
+    configFile = ./google-compute-config.nix;
+    format = "raw";
+    inherit diskSize;
+    inherit config lib pkgs;
+  };

  fileSystems."/" = {
    device = "/dev/disk/by-label/nixos";
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@ -75,6 +75,7 @@ let
      exec ${qemu}/bin/qemu-kvm \
          -name ${vmName} \
          -m ${toString config.virtualisation.memorySize} \
+          -smp ${toString config.virtualisation.cores} \
          ${optionalString (pkgs.stdenv.system == "x86_64-linux") "-cpu kvm64"} \
          ${concatStringsSep " " config.virtualisation.qemu.networkingOptions} \
          -virtfs local,path=/nix/store,security_model=none,mount_tag=store \
@ -244,6 +245,18 @@ in
          '';
      };

+    virtualisation.cores =
+      mkOption {
+        default = 1;
+        type = types.int;
+        description =
+          ''
+            Specify the number of cores the guest is permitted to use.
+            The number can be higher than the available cores on the
+            host system.
+          '';
+      };
+
    virtualisation.pathsInNixDB =
      mkOption {
        default = [];
--- a/nixos/release.nix
+++ b/nixos/release.nix
@ -248,7 +248,7 @@ in rec {
  tests.gocd-server = callTest tests/gocd-server.nix {};
  tests.gnome3 = callTest tests/gnome3.nix {};
  tests.gnome3-gdm = callTest tests/gnome3-gdm.nix {};
-  tests.grsecurity = callTest tests/grsecurity.nix {};
+  tests.hardened = callTest tests/hardened.nix { };
  tests.hibernate = callTest tests/hibernate.nix {};
  tests.hound = callTest tests/hound.nix {};
  tests.i3wm = callTest tests/i3wm.nix {};
--- a/nixos/tests/grsecurity.nix
+++ b/nixos/tests/grsecurity.nix
@ -1,46 +0,0 @@
-# Basic test to make sure grsecurity works
-
-import ./make-test.nix ({ pkgs, ...} : {
-  name = "grsecurity";
-  meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ copumpkin joachifm ];
-  };
-
-  machine = { config, pkgs, ... }:
-    { security.grsecurity.enable = true;
-      boot.kernel.sysctl."kernel.grsecurity.audit_mount" = 0;
-      boot.kernel.sysctl."kernel.grsecurity.deter_bruteforce" = 0;
-      networking.useDHCP = false;
-    };
-
-  testScript = ''
-    subtest "grsec-lock", sub {
-      $machine->succeed("systemctl is-active grsec-lock");
-      $machine->succeed("grep -Fq 1 /proc/sys/kernel/grsecurity/grsec_lock");
-      $machine->fail("echo -n 0 >/proc/sys/kernel/grsecurity/grsec_lock");
-    };
-
-    subtest "paxtest", sub {
-      # TODO: running paxtest blackhat hangs the vm
-      my @pax_mustkill = (
-        "anonmap", "execbss", "execdata", "execheap", "execstack",
-        "mprotanon", "mprotbss", "mprotdata", "mprotheap", "mprotstack",
-      );
-      foreach my $name (@pax_mustkill) {
-        my $paxtest = "${pkgs.paxtest}/lib/paxtest/" . $name;
-        $machine->succeed($paxtest) =~ /Killed/ or die
-      }
-    };
-
-    # tcc -run executes run-time generated code and so allows us to test whether
-    # paxmark actually works (otherwise, the process should be terminated)
-    subtest "tcc", sub {
-      $machine->execute("echo -e '#include <stdio.h>\nint main(void) { puts(\"hello\"); return 0; }' >main.c");
-      $machine->succeed("${pkgs.tinycc}/bin/tcc -run main.c");
-    };
-
-    subtest "RBAC", sub {
-      $machine->succeed("[ -c /dev/grsec ]");
-    };
-  '';
-})
--- a/nixos/tests/hardened.nix
+++ b/nixos/tests/hardened.nix
@ -0,0 +1,31 @@
+import ./make-test.nix ({ pkgs, ...} : {
+  name = "hardened";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ joachifm ];
+  };
+
+  machine =
+    { config, lib, pkgs, ... }:
+    with lib;
+    { users.users.alice = { isNormalUser = true; extraGroups = [ "proc" ]; };
+      users.users.sybil = { isNormalUser = true; group = "wheel"; };
+      imports = [ ../modules/profiles/hardened.nix ];
+    };
+
+  testScript =
+    ''
+      # Test hidepid
+      subtest "hidepid", sub {
+          $machine->succeed("grep -Fq hidepid=2 /proc/mounts");
+          $machine->succeed("[ `su - sybil -c 'pgrep -c -u root'` = 0 ]");
+          $machine->succeed("[ `su - alice -c 'pgrep -c -u root'` != 0 ]");
+      };
+
+      # Test kernel module hardening
+      subtest "lock-modules", sub {
+          $machine->waitForUnit("multi-user.target");
+          # note: this better a be module we normally wouldn't load ...
+          $machine->fail("modprobe dccp");
+      };
+    '';
+})
--- a/nixos/tests/misc.nix
+++ b/nixos/tests/misc.nix
@ -25,8 +25,6 @@ import ./make-test.nix ({ pkgs, ...} : {
        };
      users.users.sybil = { isNormalUser = true; group = "wheel"; };
      security.sudo = { enable = true; wheelNeedsPassword = false; };
-      security.hideProcessInformation = true;
-      users.users.alice = { isNormalUser = true; extraGroups = [ "proc" ]; };
    };

  testScript =
@ -119,12 +117,5 @@ import ./make-test.nix ({ pkgs, ...} : {
      subtest "sudo", sub {
          $machine->succeed("su - sybil -c 'sudo true'");
      };
-
-      # Test hidepid
-      subtest "hidepid", sub {
-          $machine->succeed("grep -Fq hidepid=2 /proc/mounts");
-          $machine->succeed("[ `su - sybil -c 'pgrep -c -u root'` = 0 ]");
-          $machine->succeed("[ `su - alice -c 'pgrep -c -u root'` != 0 ]");
-      };
    '';
 })
--- a/nixos/tests/mysql-replication.nix
+++ b/nixos/tests/mysql-replication.nix
@ -56,11 +56,19 @@ in
  testScript = ''
    $master->start;
    $master->waitForUnit("mysql");
+    $master->waitForOpenPort(3306);
    $slave1->start;
    $slave2->start;
    $slave1->waitForUnit("mysql");
+    $slave1->waitForOpenPort(3306);
    $slave2->waitForUnit("mysql");
-    $slave2->sleep(100); # Hopefully this is long enough!!
+    $slave2->waitForOpenPort(3306);
    $slave2->succeed("echo 'use testdb; select * from tests' | mysql -u root -N | grep 4");
+    $slave2->succeed("systemctl stop mysql");
+    $master->succeed("echo 'insert into testdb.tests values (123, 456);' | mysql -u root -N");
+    $slave2->succeed("systemctl start mysql");
+    $slave2->waitForUnit("mysql");
+    $slave2->waitForOpenPort(3306);
+    $slave2->succeed("echo 'select * from testdb.tests where Id = 123;' | mysql -u root -N | grep 456");
  '';
 })
--- a/pkgs/applications/altcoins/bitcoin-unlimited.nix
+++ b/pkgs/applications/altcoins/bitcoin-unlimited.nix
@ -7,13 +7,13 @@ with stdenv.lib;
 stdenv.mkDerivation rec {

  name = "bitcoin" + (toString (optional (!withGui) "d")) + "-unlimited-" + version;
-  version = "1.0.1.3";
+  version = "1.0.1.4";

  src = fetchFromGitHub {
    owner = "bitcoinunlimited";
    repo = "bitcoinunlimited";
-    rev = "${version}";
-    sha256 = "177l2jf2yqxh3sgf80dhgyk3wgjdnqszy3hb83clk8q1wyjkfz7y";
+    rev = "v${version}";
+    sha256 = "1awsgkgqvb57grrsq6k99009rzhpfaplh2lbf5sy36v3bh7p5mw5";
  };

  nativeBuildInputs = [ pkgconfig autoreconfHook ];
--- a/pkgs/applications/editors/emacs-modes/elpa-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/elpa-generated.nix
@ -175,10 +175,10 @@
      }) {};
    auctex = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
        pname = "auctex";
-        version = "11.90.1";
+        version = "11.90.2";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/auctex-11.90.1.tar";
-          sha256 = "0bn5pg6v7zgqxs080bzrsx6789nzdx4622m3020ymzl66017nf0r";
+          url = "https://elpa.gnu.org/packages/auctex-11.90.2.tar";
+          sha256 = "1hid8srj64nwbxcjvdma1xy07bh0v8ndhhsi3nmx9vdi3167khz6";
        };
        packageRequires = [];
        meta = {
@ -644,10 +644,10 @@
    el-search = callPackage ({ elpaBuild, emacs, fetchurl, lib, stream }:
    elpaBuild {
        pname = "el-search";
-        version = "1.3.1";
+        version = "1.3.2";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/el-search-1.3.1.tar";
-          sha256 = "01f5pyalw60dr36w007mvvxry548zrhixzmba1sad19531bry7fc";
+          url = "https://elpa.gnu.org/packages/el-search-1.3.2.tar";
+          sha256 = "0lf0hk2pvy9yrb02sa3bg0hipshbgl9m4hx7db46jvmz5bf15nfq";
        };
        packageRequires = [ emacs stream ];
        meta = {
@ -1769,10 +1769,10 @@
      }) {};
    stream = callPackage ({ elpaBuild, emacs, fetchurl, lib }: elpaBuild {
        pname = "stream";
-        version = "2.2.3";
+        version = "2.2.4";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/stream-2.2.3.el";
-          sha256 = "1y9nh5473p0dd149g675nybsdnzp8c4mq3wdql066nir7scz6rhy";
+          url = "https://elpa.gnu.org/packages/stream-2.2.4.tar";
+          sha256 = "1fdjjxfnpzfv5jsy0wmmnrsk821bg8d3magsng609fb2pkwvk1ij";
        };
        packageRequires = [ emacs ];
        meta = {
--- a/pkgs/applications/editors/emacs-modes/melpa-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/melpa-generated.nix
--- a/pkgs/applications/editors/emacs-modes/melpa-stable-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/melpa-stable-generated.nix
@ -1157,12 +1157,12 @@
    all-the-icons = callPackage ({ emacs, fetchFromGitHub, fetchurl, font-lock-plus, lib, melpaBuild }:
    melpaBuild {
        pname = "all-the-icons";
-        version = "2.4.0";
+        version = "2.5.0";
        src = fetchFromGitHub {
          owner = "domtronn";
          repo = "all-the-icons.el";
-          rev = "4f7c556167e42c02d2f840aec345b8f60b71c477";
-          sha256 = "0vhmw6z6q5a3abxphxxq5yd37hz5x9hs61vgx4wfyk2853701ks0";
+          rev = "2169d831731d206902114de3fc1b075b9e6b4ed4";
+          sha256 = "125qw96rzbkv39skxk5511jrcx9hxm0fqcmny6213wzswgdn37z3";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/604c01aa15927bd122260529ff0f4bb6a8168b7e/recipes/all-the-icons";
@ -1564,12 +1564,12 @@
    anything-tramp = callPackage ({ anything, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "anything-tramp";
-        version = "0.3.3";
+        version = "0.4.3";
        src = fetchFromGitHub {
          owner = "masasam";
          repo = "emacs-anything-tramp";
-          rev = "08bf0752e5b885a0492fbd0d7790668683c87797";
-          sha256 = "13026l259vbbgi7q0lb6jb7d54z6jgapv0d2qlprh9mlqjf32xic";
+          rev = "c4629201a63047f9094be0d9150f201dd5be18ad";
+          sha256 = "0fr4brysc7sk89jp1ggl68r3r6ikrhipb2h5kc1b2a8vz7i05bq9";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/855ea20024b606314f8590129259747cac0bcc97/recipes/anything-tramp";
@ -2680,6 +2680,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    binclock = callPackage ({ cl-lib ? null, fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    melpaBuild {
+        pname = "binclock";
+        version = "1.10";
+        src = fetchFromGitHub {
+          owner = "davep";
+          repo = "binclock.el";
+          rev = "2e529ace67a04e6872a2328769782ef33b0e463a";
+          sha256 = "0ldyx90lrhfn7qypxsmaf2yhpamjiqzvsk0b0jlgg09ars1fvhns";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/95dfa38d795172dca6a09cd02e21630747723949/recipes/binclock";
+          sha256 = "1s0072kcd1xp8355j8aph94gb3a1wqmzx1hhfp9d6bzqf6cij8gk";
+          name = "binclock";
+        };
+        packageRequires = [ cl-lib ];
+        meta = {
+          homepage = "https://melpa.org/#/binclock";
+          license = lib.licenses.free;
+        };
+      }) {};
    bind-key = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "bind-key";
@ -2893,12 +2914,12 @@
    boxquote = callPackage ({ cl-lib ? null, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "boxquote";
-        version = "2.0";
+        version = "2.1";
        src = fetchFromGitHub {
          owner = "davep";
          repo = "boxquote.el";
-          rev = "b0239fb7b7a9d75d4ac3c66f9b96abd911dbf4e0";
-          sha256 = "0agnsghxf35b6g49radxigw81bmvw1ggljzzmy771nmwl44q2dbb";
+          rev = "b6a4ad3ee5b327bd3b1bf65f8733bd301fe59883";
+          sha256 = "1f61k3sw9zvn6jq60ygi6p66blr52497fadimzcaspa79k9y1cfm";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/d2148f8f17b16154bfc337df69a5ad31e25a9b05/recipes/boxquote";
@ -5028,6 +5049,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    company-shell = callPackage ({ cl-lib ? null, company, dash, fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    melpaBuild {
+        pname = "company-shell";
+        version = "1.0";
+        src = fetchFromGitHub {
+          owner = "Alexander-Miller";
+          repo = "company-shell";
+          rev = "40599df46a7e4b7b1ef5ad6e23764dda8510bbf4";
+          sha256 = "1qnlqwifrlbzcsi1lf1s7c32v6szpi5n6ngmj2lmdyic2b3pv1id";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/bbaa05d158f3806b9f79a2c826763166dbee56ca/recipes/company-shell";
+          sha256 = "0my9jghf3s4idkgrpki8mj1lm5ichfvznb09lfwf07fjhg0q1apz";
+          name = "company-shell";
+        };
+        packageRequires = [ cl-lib company dash ];
+        meta = {
+          homepage = "https://melpa.org/#/company-shell";
+          license = lib.licenses.free;
+        };
+      }) {};
    company-sourcekit = callPackage ({ company, dash, dash-functional, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild, sourcekit }:
    melpaBuild {
        pname = "company-sourcekit";
@ -7890,11 +7932,11 @@
      }) {};
    eide = callPackage ({ fetchgit, fetchurl, lib, melpaBuild }: melpaBuild {
        pname = "eide";
-        version = "2.1.1";
+        version = "2.1.2";
        src = fetchgit {
          url = "git://git.tuxfamily.org/gitroot/eide/emacs-ide.git";
-          rev = "524494fd2b23217c6807b30b43bb95b5724f809e";
-          sha256 = "0w9j5q5pzw55nwsw5wic7dl7psvg75vk1cxhrz2isgra6gissh9z";
+          rev = "5f046ea74eee7af9afbd815c2bfd11fa9c72e6b3";
+          sha256 = "1bd9vqqzhbkpfr80r91r65gv6mqnjqfnyclylivg79sfkkahil9n";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/855ea20024b606314f8590129259747cac0bcc97/recipes/eide";
@ -8390,22 +8432,22 @@
          license = lib.licenses.free;
        };
      }) {};
-    elpa-clone = callPackage ({ cl-lib ? null, fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    elpa-clone = callPackage ({ cl-lib ? null, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "elpa-clone";
-        version = "0.0.4";
+        version = "0.0.5";
        src = fetchFromGitHub {
          owner = "dochang";
          repo = "elpa-clone";
-          rev = "8d0827b03b08eb4844e2b8465c27d5aa0e12101d";
-          sha256 = "1ik2k6ngzg3znfp4a36f7m5ca6p3iivfb7w280w3gm5x1ja8as2a";
+          rev = "144bee09445b30cbf4f60b371a289f0d75a387aa";
+          sha256 = "1k80y3wcqvhdbc0w5ybicn2hqjldp7b4jwraca2b99676c0yiq25";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/11861edd9c7f9deebd44fd1f8ef648e7a04caf2b/recipes/elpa-clone";
          sha256 = "172gpmpwf75y41n3v05l47w34x83vy63bqk97fd8a6b4dkj91lqa";
          name = "elpa-clone";
        };
-        packageRequires = [ cl-lib ];
+        packageRequires = [ cl-lib emacs ];
        meta = {
          homepage = "https://melpa.org/#/elpa-clone";
          license = lib.licenses.free;
@ -9014,22 +9056,22 @@
          license = lib.licenses.free;
        };
      }) {};
-    enh-ruby-mode = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    enh-ruby-mode = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "enh-ruby-mode";
-        version = "20150711";
+        version = "20170417";
        src = fetchFromGitHub {
          owner = "zenspider";
          repo = "enhanced-ruby-mode";
-          rev = "f945cff5e784e23e0028bf0a5221f4f47a822fac";
-          sha256 = "1f6zyz5jmbrvv37mbzsvwb3ycmq105p4ryz8p65b76jz3ps8yq5w";
+          rev = "2e483fe316ff993c80eafcf4ce4defd87d97776d";
+          sha256 = "1xzhgmbc9iplxmqm7gc4hqk6nfdhqcrxz8g9kkf5ww3dx1czhiv7";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/cd1ac1ce69b77b11f34c4175611a852e7ec0806c/recipes/enh-ruby-mode";
          sha256 = "0r486yajjf7vsaz92ypxpfmz2nsvw9giffpxb9szj7fcry3nfdns";
          name = "enh-ruby-mode";
        };
-        packageRequires = [];
+        packageRequires = [ emacs ];
        meta = {
          homepage = "https://melpa.org/#/enh-ruby-mode";
          license = lib.licenses.free;
@ -9381,12 +9423,12 @@
    erlang = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "erlang";
-        version = "19.3.1";
+        version = "19.3.2";
        src = fetchFromGitHub {
          owner = "erlang";
          repo = "otp";
-          rev = "d25ad84195ca42969fbfb017a52aab8c8effc246";
-          sha256 = "06jxpypw8i13gjiq006p0ahy0mlkxhmpq8fhn4pp7hi2n4ycnfj1";
+          rev = "6acb7d6fb8d23c0b0b78d30a618d2636ad463e6e";
+          sha256 = "1a3yk18sr3y524jl8icp8qh5j143ykxs51xdwz2bzxac2y78k0xk";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/d9cd526f43981e0826af59cdc4bb702f644781d9/recipes/erlang";
@ -9965,22 +10007,22 @@
          license = lib.licenses.free;
        };
      }) {};
-    evil-colemak-basics = callPackage ({ emacs, evil, fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    evil-colemak-basics = callPackage ({ emacs, evil, evil-snipe, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "evil-colemak-basics";
-        version = "2.0.0";
+        version = "2.1.0";
        src = fetchFromGitHub {
          owner = "wbolster";
          repo = "evil-colemak-basics";
-          rev = "f976bda20098c43be1418c36520a57467c8c6c13";
-          sha256 = "18f1k4z7lkh237sz4p1xz4sxzs41ywmvd6dj7k9b6d9dscv3yxws";
+          rev = "7844079b47f47bb1dc24c885b0ac2e67524fa960";
+          sha256 = "0phspmd31pcxana2lp6mqywmghhdpj6ydsrl1bjn4b1gcp1fqsy2";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/945417d19faf492fb678aee3ba692d14e7518d85/recipes/evil-colemak-basics";
          sha256 = "1sbbli0hdmpc23f3g5n95svqfdg3rlvf71plyvpv1a6va9jhi83k";
          name = "evil-colemak-basics";
        };
-        packageRequires = [ emacs evil ];
+        packageRequires = [ emacs evil evil-snipe ];
        meta = {
          homepage = "https://melpa.org/#/evil-colemak-basics";
          license = lib.licenses.free;
@ -10699,6 +10741,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    exsqlaim-mode = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild, s }:
+    melpaBuild {
+        pname = "exsqlaim-mode";
+        version = "0.0.1";
+        src = fetchFromGitHub {
+          owner = "ahmadnazir";
+          repo = "exsqlaim-mode";
+          rev = "e77d2a07addffd7df4393019d9c3dad1ab1925d9";
+          sha256 = "19v5sf3nf6dciakvs7ksbg66b5z1hybc4ivs24hm6k3fziblfzzs";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/7f660d7629bc27144c99ebcba45f1b06b14c5745/recipes/exsqlaim-mode";
+          sha256 = "0ssn48wcn3x066nsl8y78y57ndasqv5x6ifxbifdxl3f5vjhyvg7";
+          name = "exsqlaim-mode";
+        };
+        packageRequires = [ s ];
+        meta = {
+          homepage = "https://melpa.org/#/exsqlaim-mode";
+          license = lib.licenses.free;
+        };
+      }) {};
    extend-dnd = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "extend-dnd";
@ -10720,6 +10783,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    exwm-x = callPackage ({ cl-lib ? null, exwm, fetchFromGitHub, fetchurl, lib, melpaBuild, swiper, switch-window }:
+    melpaBuild {
+        pname = "exwm-x";
+        version = "0.6";
+        src = fetchFromGitHub {
+          owner = "tumashu";
+          repo = "exwm-x";
+          rev = "87715a6891b31bc19954ea9fe1c1a9bf57bdbbce";
+          sha256 = "0x9gg3fy5xw3vf8gyfa5j5k08gnnfpsyjh4dk80sbbnf0z7cwycw";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/a0e6e23bcffdcd1e17c70599c563609050e5de40/recipes/exwm-x";
+          sha256 = "1d9q57vz63sk3h1g5gvp9xnmqkpa73wppmiy2bv8mxk11whl6xa3";
+          name = "exwm-x";
+        };
+        packageRequires = [ cl-lib exwm swiper switch-window ];
+        meta = {
+          homepage = "https://melpa.org/#/exwm-x";
+          license = lib.licenses.free;
+        };
+      }) {};
    eyebrowse = callPackage ({ dash, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "eyebrowse";
@ -10993,22 +11077,22 @@
          license = lib.licenses.free;
        };
      }) {};
-    finalize = callPackage ({ cl-lib ? null, eieio ? null, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    finalize = callPackage ({ cl-generic, cl-lib ? null, eieio ? null, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "finalize";
-        version = "1.0.0";
+        version = "2.0.0";
        src = fetchFromGitHub {
          owner = "skeeto";
          repo = "elisp-finalize";
-          rev = "72c8eaab3deb150ee2cf7f1473114cecffb5204a";
-          sha256 = "1r9y9zschavi28c5ysrlh56vxszjfyhh5r36fhn74i0b5iiy15rx";
+          rev = "0f7d47c4d50f1c76fc3b43bfc2d4886dd3e8ca27";
+          sha256 = "1gvlm4i62af5jscwz0jccc8ra0grprxpg2rlq91d5nn8dn5lpy79";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/1b55869b5183644de02687d2e56f9b68854ccda3/recipes/finalize";
          sha256 = "1n0w4kdzc4hv4pprv13lr88gh46slpxdvsc162nqm5mrqp9giqqq";
          name = "finalize";
        };
-        packageRequires = [ cl-lib eieio emacs ];
+        packageRequires = [ cl-generic cl-lib eieio emacs ];
        meta = {
          homepage = "https://melpa.org/#/finalize";
          license = lib.licenses.free;
@ -11273,6 +11357,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    flatui-dark-theme = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    melpaBuild {
+        pname = "flatui-dark-theme";
+        version = "0.3.0";
+        src = fetchFromGitHub {
+          owner = "theasp";
+          repo = "flatui-dark-theme";
+          rev = "af5c84e2a2810748cc71a68ec7ba333097cc1f63";
+          sha256 = "0c0pm67d8w9jdraap0sswvx7ywly9ifimij2c5w9p4hiph8gisr9";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/5f9dc5abeb37422c63cac74f9a006d54c4a7c5a5/recipes/flatui-dark-theme";
+          sha256 = "1mswmkhi43fm0cmdgf0ywpy9lmapy0syl65kqh68sa3jqbznhm6y";
+          name = "flatui-dark-theme";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://melpa.org/#/flatui-dark-theme";
+          license = lib.licenses.free;
+        };
+      }) {};
    floobits = callPackage ({ fetchFromGitHub, fetchurl, highlight, json ? null, lib, melpaBuild }:
    melpaBuild {
        pname = "floobits";
@ -11294,24 +11399,24 @@
          license = lib.licenses.free;
        };
      }) {};
-    flow-mode = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild, web-mode }:
+    flow-minor-mode = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
-        pname = "flow-mode";
+        pname = "flow-minor-mode";
        version = "0.1";
        src = fetchFromGitHub {
          owner = "an-sh";
-          repo = "flow-mode";
+          repo = "flow-minor-mode";
          rev = "eb2372b0acf740ed3c5f9c048addbb8048e04458";
          sha256 = "0ajdzpjghm7iscv2c6nwwx4v1639map104ldsi978iw8hy7m1mmp";
        };
        recipeFile = fetchurl {
-          url = "https://raw.githubusercontent.com/milkypostman/melpa/3eca3f0c0a4dda79d00cbd0045eb0925bb3ce2e4/recipes/flow-mode";
-          sha256 = "0hq1lkn4mn6r8ih74d52hba1a6gb6pg4qcv60sfsiga4b737yla8";
-          name = "flow-mode";
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/66504f789069922ea56f268f4da90fac52b601ff/recipes/flow-minor-mode";
+          sha256 = "190dv225sb37jawzrasd7qkbznrmkrdnb90l44il63vrlmjv3r1s";
+          name = "flow-minor-mode";
        };
-        packageRequires = [ emacs web-mode ];
+        packageRequires = [];
        meta = {
-          homepage = "https://melpa.org/#/flow-mode";
+          homepage = "https://melpa.org/#/flow-minor-mode";
          license = lib.licenses.free;
        };
      }) {};
@ -11696,12 +11801,12 @@
    flycheck-objc-clang = callPackage ({ emacs, fetchFromGitHub, fetchurl, flycheck, lib, melpaBuild }:
    melpaBuild {
        pname = "flycheck-objc-clang";
-        version = "1.0.6";
+        version = "1.1.0";
        src = fetchFromGitHub {
          owner = "GyazSquare";
          repo = "flycheck-objc-clang";
-          rev = "11805f1d420e297db0346a6657f144b08e2ca556";
-          sha256 = "1s9bk3k7ys79m2iww4yf1abfy01d08z9x9pfq8l045q0snsh64il";
+          rev = "b16b77f95e4e53a8951ebee6209a5de311748447";
+          sha256 = "0lda99wscj89vhzg9wq7akm3dx1zlf90m91ifr627vcw2mzj4wkh";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/4ff4412f507371b93cfb85fc744e54110cd87338/recipes/flycheck-objc-clang";
@ -12725,12 +12830,12 @@
    fountain-mode = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "fountain-mode";
-        version = "2.2.2";
+        version = "2.3.0";
        src = fetchFromGitHub {
          owner = "rnkn";
          repo = "fountain-mode";
-          rev = "4e88b7525c2f39c3d25f689b394b0ece7c6eed6d";
-          sha256 = "1vcc8sdm0b3kss3g47wggc6mv28pr474559d3786fhncp5mxl1qq";
+          rev = "37289bb68f01dd49b1192032ade6b0741d024a54";
+          sha256 = "06bqnyx2h0ypyxy5vxrh3v75qqfcmfgx31xkip7w6sj6pbfc8dq5";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/913386ac8d5049d37154da3ab32bde408a226511/recipes/fountain-mode";
@ -12835,6 +12940,25 @@
          license = lib.licenses.free;
        };
      }) {};
+    fuel = callPackage ({ fetchgit, fetchurl, lib, melpaBuild }: melpaBuild {
+        pname = "fuel";
+        version = "0.96";
+        src = fetchgit {
+          url = "git://factorcode.org/git/factor.git";
+          rev = "905ec06d864537fb6be9c46ad98f1b6d101dfbf0";
+          sha256 = "0ip7azxi5nvp8vvi15ds46mgs0fmi7gq97f2iz1c7m67ml5wi2g7";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/0c3633c23baa472560a489fc663a0302f082bcef/recipes/fuel";
+          sha256 = "0m24p2788r4xzm56hm9kmpzcskwh82vgbs3hqfb9xygpl4isp756";
+          name = "fuel";
+        };
+        packageRequires = [];
+        meta = {
+          homepage = "https://melpa.org/#/fuel";
+          license = lib.licenses.free;
+        };
+      }) {};
    full-ack = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "full-ack";
@ -13423,6 +13547,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    git-commit-insert-issue = callPackage ({ bitbucket, fetchFromGitLab, fetchurl, github-issues, gitlab, helm, lib, melpaBuild, projectile, s }:
+    melpaBuild {
+        pname = "git-commit-insert-issue";
+        version = "0.3";
+        src = fetchFromGitLab {
+          owner = "emacs-stuff";
+          repo = "git-commit-insert-issue";
+          rev = "7ee9dc88acc1e766700a6170a2ba6b0b853220db";
+          sha256 = "1fi0gy0093dwdcsl7ikzdjxklqrf1p6f99bpxi4xzk2waca70klf";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/855ea20024b606314f8590129259747cac0bcc97/recipes/git-commit-insert-issue";
+          sha256 = "0xhlchr7dbm0hp4cjba3x1fdf7lnfc97id327i2fqgkdc4yn9fax";
+          name = "git-commit-insert-issue";
+        };
+        packageRequires = [ bitbucket github-issues gitlab helm projectile s ];
+        meta = {
+          homepage = "https://melpa.org/#/git-commit-insert-issue";
+          license = lib.licenses.free;
+        };
+      }) {};
    git-gutter = callPackage ({ cl-lib ? null, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "git-gutter";
@ -16311,12 +16456,12 @@
    helm-org-rifle = callPackage ({ dash, emacs, f, fetchFromGitHub, fetchurl, helm, lib, melpaBuild, s }:
    melpaBuild {
        pname = "helm-org-rifle";
-        version = "1.3.0";
+        version = "1.4.0";
        src = fetchFromGitHub {
          owner = "alphapapa";
          repo = "helm-org-rifle";
-          rev = "c8ad1d86dd375f1be433b95e2bc40876f663663f";
-          sha256 = "1ia960sqkbc5bqljjb0arw54q90x36lhp0230s75xcg6m47bxpw3";
+          rev = "6d467b82d8c7584b7ab839bbaaac701af393209b";
+          sha256 = "1mmwms4s52537sq17zhm8sakyq1mkf4nqcxgydsg4zlmvzzxpz8l";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/f39cc94dde5aaf0d6cfea5c98dd52cdb0bcb1615/recipes/helm-org-rifle";
@ -16773,12 +16918,12 @@
    helm-tramp = callPackage ({ emacs, fetchFromGitHub, fetchurl, helm, lib, melpaBuild }:
    melpaBuild {
        pname = "helm-tramp";
-        version = "0.3.3";
+        version = "0.4.3";
        src = fetchFromGitHub {
          owner = "masasam";
          repo = "emacs-helm-tramp";
-          rev = "68d4c614830970e9eaf929882e1d395a61872bea";
-          sha256 = "0zfhdlzpy6w7prdh60nd98cwgzfqfsn87xh2kb5hi40dh8gsccfb";
+          rev = "0885339369b65bc5d06829d82af734560dc45555";
+          sha256 = "088bpikbnsaxsjfq896fcg7y9qgvfbq7iwxsh391yc6h46zgarkk";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/855ea20024b606314f8590129259747cac0bcc97/recipes/helm-tramp";
@ -16941,12 +17086,12 @@
    hierarchy = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "hierarchy";
-        version = "0.2.0";
+        version = "0.4.0";
        src = fetchFromGitHub {
          owner = "DamienCassou";
          repo = "hierarchy";
-          rev = "d44d60d85cbeaf81d5e02ba154f4fcdca9faf7fd";
-          sha256 = "14zww0174vwf08fl9fv23faqn2byapb80rn72z4iv54p6pqykc2f";
+          rev = "ca919a4c71c187e1fbbad7e814aac1cf662ec51a";
+          sha256 = "0rrrj44ml2ymvxmg8igpn2irdhihv3djy5dfm6p6499cm64mawai";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/7aea238a2d14e9f58c0474251984b6c617b6854d/recipes/hierarchy";
@ -19539,6 +19684,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    kaolin-theme = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    melpaBuild {
+        pname = "kaolin-theme";
+        version = "0.6";
+        src = fetchFromGitHub {
+          owner = "0rdy";
+          repo = "kaolin-theme";
+          rev = "041cc6637a58a3a24086d1c2b8c3eb113434127e";
+          sha256 = "1qx6568s8wj6ha8wfy8hih1qwwcdiybdb83w3fr9lqwh0lyhjp0f";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/d2abf9d914cdc210bbd47ea92d0dac76683e21f0/recipes/kaolin-theme";
+          sha256 = "1316sn1xpli9aqbhn8sldyvsc2fwk1ql9aw4l0rgkfbivvcklp7c";
+          name = "kaolin-theme";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://melpa.org/#/kaolin-theme";
+          license = lib.licenses.free;
+        };
+      }) {};
    karma = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "karma";
@ -19899,12 +20065,12 @@
    kubernetes = callPackage ({ dash, emacs, fetchFromGitHub, fetchurl, lib, magit, melpaBuild }:
    melpaBuild {
        pname = "kubernetes";
-        version = "0.6.0";
+        version = "0.9.0";
        src = fetchFromGitHub {
          owner = "chrisbarrett";
          repo = "kubernetes-el";
-          rev = "494dae923b96a10853ba26f405059e8c04e72d22";
-          sha256 = "03lnflyyqags7im9gp7cq3q6fnfr9a65s62m333aydbg7dzk5pzh";
+          rev = "68dd3c2184e72b7a669e5706d1a3d95a220276d1";
+          sha256 = "163kx407jj08ifbpvvw1cp24qb4rm6l89ikgzqha01lc0bjglax5";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/16850227ea48f6f38102b9cdf80e0758766a24d2/recipes/kubernetes";
@ -19920,12 +20086,12 @@
    kubernetes-evil = callPackage ({ evil, fetchFromGitHub, fetchurl, kubernetes, lib, melpaBuild }:
    melpaBuild {
        pname = "kubernetes-evil";
-        version = "0.6.0";
+        version = "0.9.0";
        src = fetchFromGitHub {
          owner = "chrisbarrett";
          repo = "kubernetes-el";
-          rev = "494dae923b96a10853ba26f405059e8c04e72d22";
-          sha256 = "03lnflyyqags7im9gp7cq3q6fnfr9a65s62m333aydbg7dzk5pzh";
+          rev = "68dd3c2184e72b7a669e5706d1a3d95a220276d1";
+          sha256 = "163kx407jj08ifbpvvw1cp24qb4rm6l89ikgzqha01lc0bjglax5";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/16850227ea48f6f38102b9cdf80e0758766a24d2/recipes/kubernetes-evil";
@ -20096,8 +20262,8 @@
          sha256 = "12q6wblwnb6y5c1882jz14742fqbm6p5jpzlvz7p90ylqfl7h989";
        };
        recipeFile = fetchurl {
-          url = "https://raw.githubusercontent.com/milkypostman/melpa/851eca11911b337f809d030785dc2608c8a47424/recipes/ledger-mode";
-          sha256 = "19vljgprgfpb9bkbdvkqnwc5pjn1rl0rniwav08a2c6kd2g59xaf";
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/1549048b6f57fbe9d1f7fcda74b78a7294327b7b/recipes/ledger-mode";
+          sha256 = "10asbcb5syv3b75bngsab3c84dp2xmc0q7s29im6kf4mzv5zcfcf";
          name = "ledger-mode";
        };
        packageRequires = [];
@ -20494,12 +20660,12 @@
    live-py-mode = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "live-py-mode";
-        version = "2.14.0";
+        version = "2.15.0";
        src = fetchFromGitHub {
          owner = "donkirkby";
          repo = "live-py-plugin";
-          rev = "51b1e177f115ab527cc47baf98abe09d43d9a95f";
-          sha256 = "0rcxrq3r4vbr9zb844andy1zj246gs8s1ksqp1f092fiiyqpllnx";
+          rev = "f5603fb6bcfbae1e6950da7f91c3a15cf5250bb1";
+          sha256 = "1zzk3rc86xrkys3rcqiz61mnp00jkvb05f8p21av52h19axm4nn8";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/c7615237e80b46b5c50cb51a3ed5b07d92566fb7/recipes/live-py-mode";
@ -20921,12 +21087,12 @@
    magit-gitflow = callPackage ({ fetchFromGitHub, fetchurl, lib, magit, magit-popup, melpaBuild }:
    melpaBuild {
        pname = "magit-gitflow";
-        version = "2.2.1";
+        version = "2.2.2";
        src = fetchFromGitHub {
          owner = "jtatarik";
          repo = "magit-gitflow";
-          rev = "a2b7b85134784317445faee13d647fb62401ea23";
-          sha256 = "1m6hnds12gpj66hcpaxgncapvslh0dml99r1vhg0r8rlmnmf0b9p";
+          rev = "5bdcfe0a7bf4f5bb9a927baa4880233bf11a4a6b";
+          sha256 = "12pi6aw44lnzzcw0zgz5rxvcf4p700fkz4q2skbapwmds8gw3fg9";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/dfaeb33dec2c75d21733b6e51d063664c6544e4d/recipes/magit-gitflow";
@ -21324,6 +21490,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    markup = callPackage ({ cl-lib ? null, fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    melpaBuild {
+        pname = "markup";
+        version = "2.0.1";
+        src = fetchFromGitHub {
+          owner = "leoc";
+          repo = "markup.el";
+          rev = "876da2d3f23473475bb0fd0a1480ae11d2671291";
+          sha256 = "0rggadka5aqgrik3qky6s75s5yb5bfj6fcpxjz1iyrwi0fka0akd";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/a75c955ad6b2f68b8933329e545625d948f6f8f4/recipes/markup";
+          sha256 = "0yw4b42nc2n7nanqvj596hwjf0p4qc7x6g2d9g5cwi7975iak8pf";
+          name = "markup";
+        };
+        packageRequires = [ cl-lib ];
+        meta = {
+          homepage = "https://melpa.org/#/markup";
+          license = lib.licenses.free;
+        };
+      }) {};
    markup-faces = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "markup-faces";
@ -21366,6 +21553,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    mastodon = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    melpaBuild {
+        pname = "mastodon";
+        version = "0.6.0";
+        src = fetchFromGitHub {
+          owner = "jdenen";
+          repo = "mastodon.el";
+          rev = "9b9e0bb7c4d414ffc26a0547d1e76cd106cc58b6";
+          sha256 = "1cjx022zrn7jbcq1x7x61xayhlpik2bm6vs37hh382ad7bnqgcyb";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/809d963b69b154325faaf61e54ca87b94c1c9a90/recipes/mastodon";
+          sha256 = "1bsyf4j6zs9gin0k7p22yv5gaqd6m3vdc2fiagfbs7gxsmhb6p4i";
+          name = "mastodon";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://melpa.org/#/mastodon";
+          license = lib.licenses.free;
+        };
+      }) {};
    material-theme = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "material-theme";
@ -21600,12 +21808,12 @@
    merlin = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "merlin";
-        version = "2.5.3";
+        version = "2.5.4";
        src = fetchFromGitHub {
          owner = "the-lambda-church";
          repo = "merlin";
-          rev = "89f9643c08211a770454919551a7fd8605d1fca8";
-          sha256 = "13x0zjd297ssqmbvba32zk2p588kznd5ag4wh3nqb6fdgyzy4d63";
+          rev = "420416f182d2ea2a2285ab4bd22e5898dfb20a83";
+          sha256 = "101vk16c5wayd51s8w0mvy99bk7q3gm2gz8i8616wa1lmyszjknh";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/b1b9bfd3164e62758dc0a3362d85c6627ed7cbf8/recipes/merlin";
@ -23317,12 +23525,12 @@
    nyan-mode = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "nyan-mode";
-        version = "1.1.1";
+        version = "1.1.2";
        src = fetchFromGitHub {
          owner = "TeMPOraL";
          repo = "nyan-mode";
-          rev = "b5db3a612bba35c8f54f44c300ebc879db6b3288";
-          sha256 = "199ii1658k4sp5krha77n9l5jblyvnvvvr28g2nbc74lfybckjwq";
+          rev = "4195cd368aca8f05a71cbff4e60cfa9dde10319a";
+          sha256 = "1bnfxw6cnhsqill3n32j9bc6adl437ia9ivbwvwjpz1ay928yxm7";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/4d8c3000df5f2ee2493a54dee6f9b65008add753/recipes/nyan-mode";
@ -23653,12 +23861,12 @@
    omni-log = callPackage ({ dash, emacs, fetchFromGitHub, fetchurl, ht, lib, melpaBuild, s }:
    melpaBuild {
        pname = "omni-log";
-        version = "0.1.2";
+        version = "0.3.3";
        src = fetchFromGitHub {
          owner = "AdrieanKhisbe";
          repo = "omni-log.el";
-          rev = "7eb30e42cc89064abb7acbec63cb9644c2ad7c9b";
-          sha256 = "030f983n19n64f8irif102nncvam04xpx020vfgja9886wlj40pk";
+          rev = "e86c80065030306645e28badcb0c25c549560106";
+          sha256 = "10nsl45z3a1mvagffcsqj501x8wk3avmsncyn9laq3k4z1hjgdz5";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/47bb19bb7b4713c3fd82c1035a2fe66588c069e3/recipes/omni-log";
@ -23674,12 +23882,12 @@
    omni-quotes = callPackage ({ dash, f, fetchFromGitHub, fetchurl, ht, lib, melpaBuild, omni-log, s }:
    melpaBuild {
        pname = "omni-quotes";
-        version = "0.3.0";
+        version = "0.4.22";
        src = fetchFromGitHub {
          owner = "AdrieanKhisbe";
          repo = "omni-quotes.el";
-          rev = "be1e719c046ca468275ed844989320f48358f2cd";
-          sha256 = "0sc4mhvxj91rs4h1vg3x759fq77cmlzkqyn5wv456w3w3g2narxw";
+          rev = "a10eca089dd87389c99f5c5ef8e3f8779f2652d2";
+          sha256 = "0i2xnpa6jickpp2i47c5l7c6djxz2lli8lcx402sijzmn1lx44sj";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/3402524f79381c99fdeb81a6a5a9241c918811be/recipes/omni-quotes";
@ -24910,12 +25118,12 @@
    orgit = callPackage ({ dash, emacs, fetchFromGitHub, fetchurl, lib, magit, melpaBuild, org }:
    melpaBuild {
        pname = "orgit";
-        version = "1.3.0";
+        version = "1.4.0";
        src = fetchFromGitHub {
          owner = "magit";
          repo = "orgit";
-          rev = "cbce5871fe267fef725631b0b7365952c35ae401";
-          sha256 = "00iwp3bajr9hxs55rj3ka5bymhp5icsq8m44z514sb8h54fwapb7";
+          rev = "c91e662ace7e3ce992269cbf755f378bc6742511";
+          sha256 = "0x7d8wjfg61gzi6ghq4cfkizzjcpiz56j797h6kmbri73yb7xf16";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/73b5f7c44c90540e4cbdc003d9881f0ac22cc7bc/recipes/orgit";
@ -25330,12 +25538,12 @@
    package-lint = callPackage ({ cl-lib ? null, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "package-lint";
-        version = "0.4";
+        version = "0.5";
        src = fetchFromGitHub {
          owner = "purcell";
          repo = "package-lint";
-          rev = "de08b846b3a031838b79445bb7a254c9de4a80f6";
-          sha256 = "0mvs4afjp5ab89vdz3bd9pca55brn57lxvjqjjyc6cyqxpclh06j";
+          rev = "1cee5135bd9a12e1b28e515a28093a751b4f7dd1";
+          sha256 = "1qvvdr5wx37x5jrw4hkx5vl4jmi3l1bjn97nnvwlsmzi6sgkcwsr";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/9744d8521b4ac5aeb1f28229c0897af7260c6f78/recipes/package-lint";
@ -26397,12 +26605,12 @@
    pinyinlib = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "pinyinlib";
-        version = "0.1.0";
+        version = "0.1.1";
        src = fetchFromGitHub {
          owner = "cute-jumper";
          repo = "pinyinlib.el";
-          rev = "f1e6c86f47e16c2bd48436630286bae8d6f8cb8c";
-          sha256 = "13q95z0j1mpk2yrrq0amc2jjhajaz4884bfliy2h8adh109j4q1d";
+          rev = "39943d226c2a42a9013421a0b4b6d5d3696bf234";
+          sha256 = "1nwj4c3y0kdlkf3jqd2dnibaiazrq6qcj533xk2qw4wmx072yij0";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/f4aa27985dcfaf24f1863667b89e13df4710546f/recipes/pinyinlib";
@ -27297,12 +27505,12 @@
    protobuf-mode = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "protobuf-mode";
-        version = "3.2.1";
+        version = "3.3.0pre1";
        src = fetchFromGitHub {
          owner = "google";
          repo = "protobuf";
-          rev = "b50c9ec1223895973d0e2fa6b6cb74ec3c8f3ce8";
-          sha256 = "17drjxry365als0drs56gzdpdjhkhjwg9jwvrhmq5dp9ly0rb2f4";
+          rev = "fba2acd72e8cbf138912295df227ee2c914158c3";
+          sha256 = "1862lp6br6ngfd13gz8m1x2glkz02qxbp6vj261ricbvc7fgkyd7";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/b4e7f5f641251e17add561991d3bcf1fde23467b/recipes/protobuf-mode";
@ -28830,12 +29038,12 @@
    rjsx-mode = callPackage ({ emacs, fetchFromGitHub, fetchurl, js2-mode, lib, melpaBuild }:
    melpaBuild {
        pname = "rjsx-mode";
-        version = "0.1.0";
+        version = "0.1.2";
        src = fetchFromGitHub {
          owner = "felipeochoa";
          repo = "rjsx-mode";
-          rev = "20c7bd0e704dfc1c391edf78765c8b0ec4f5b3c0";
-          sha256 = "142zihjqgdq4bfy1hp0pz6k109ngii4kyc8xrdvd9yvzc0y5vp8a";
+          rev = "b41de6c1b2f6668b674f8e5bf880f697c9ffb749";
+          sha256 = "1irc26kg5f22x3g48pmb1mwchivwyn41khphpgwqfjnvasz1idw9";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/b83be7efdef2457e1320fe3dec46484fbd20263c/recipes/rjsx-mode";
@ -30529,12 +30737,12 @@
    smartparens = callPackage ({ cl-lib ? null, dash, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "smartparens";
-        version = "1.9.0";
+        version = "1.10.1";
        src = fetchFromGitHub {
          owner = "Fuco1";
          repo = "smartparens";
-          rev = "253afc49ff30a19ea1a7af10e1e8abdb46546ac1";
-          sha256 = "0ml0fdvgx60vqansh4j17ihkrnyjdndkijysqhqx1q78d97vnhi4";
+          rev = "7841b2f02a1a99e1cb166d595f24f16a514ccbb5";
+          sha256 = "062g6y8an4kvfym2w56qy2iqd4ngxdxba38136ph0ckkzl0yrl7l";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/bd98f85461ef7134502d4f2aa8ce1bc764f3bda3/recipes/smartparens";
@ -30967,6 +31175,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    spaceline-all-the-icons = callPackage ({ all-the-icons, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild, spaceline }:
+    melpaBuild {
+        pname = "spaceline-all-the-icons";
+        version = "1.0.5";
+        src = fetchFromGitHub {
+          owner = "domtronn";
+          repo = "spaceline-all-the-icons.el";
+          rev = "be53e5bde0e855c012bc99602830984a7008604a";
+          sha256 = "19xwy2dqlp585vi2ihr85rhf609lc57l133gc3bcz09aii24lfkb";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/d039e057c1d441592da8f54e6d524b395b030375/recipes/spaceline-all-the-icons";
+          sha256 = "1h6clkr2f29k2vw0jcrmnfbjpphaxm7s3zai6pn6qag32bgm3jq6";
+          name = "spaceline-all-the-icons";
+        };
+        packageRequires = [ all-the-icons emacs spaceline ];
+        meta = {
+          homepage = "https://melpa.org/#/spaceline-all-the-icons";
+          license = lib.licenses.free;
+        };
+      }) {};
    sparkline = callPackage ({ cl-lib ? null, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "sparkline";
@ -30991,12 +31220,12 @@
    sparql-mode = callPackage ({ cl-lib ? null, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "sparql-mode";
-        version = "2.0.0";
+        version = "2.0.1";
        src = fetchFromGitHub {
          owner = "ljos";
          repo = "sparql-mode";
-          rev = "33da09b3895e03e64959005678d448ab82e527b6";
-          sha256 = "17fpfc0hc39y9h12mj62fwfga4mhk0c9fm2qnbnzf4i3ajhp7r2w";
+          rev = "a51d4e57974e8d06f7d49ada0fdca656b7470642";
+          sha256 = "0ywhqk6n5k0l85zjwbnrivnvxjzqipqrggv06lify6yv18qmyl6s";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/c3d729130a41903bb01465d0f01c34fbc508b56e/recipes/sparql-mode";
@ -32664,15 +32893,36 @@
          license = lib.licenses.free;
        };
      }) {};
+    theme-looper = callPackage ({ cl-lib ? null, fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    melpaBuild {
+        pname = "theme-looper";
+        version = "1.0.0";
+        src = fetchFromGitHub {
+          owner = "myTerminal";
+          repo = "theme-looper";
+          rev = "5e3a3ea7ad31d4b38efa2cc08f0063b230736da9";
+          sha256 = "06khrrjlhnzckr2zisdbx4pj6r8kmv7dbdzvzh74qz79x337lvzn";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/855ea20024b606314f8590129259747cac0bcc97/recipes/theme-looper";
+          sha256 = "018bixcbzri3zsasy1pp2qfvgd679ylpi9gq26qv9iwlfhlrpwgf";
+          name = "theme-looper";
+        };
+        packageRequires = [ cl-lib ];
+        meta = {
+          homepage = "https://melpa.org/#/theme-looper";
+          license = lib.licenses.free;
+        };
+      }) {};
    thinks = callPackage ({ cl-lib ? null, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "thinks";
-        version = "1.10";
+        version = "1.11";
        src = fetchFromGitHub {
          owner = "davep";
          repo = "thinks.el";
-          rev = "370d399703d232010599d24a242b5f91e25a1b9d";
-          sha256 = "1kac32mgk2gcchh9lvnny81xq03h4656v05xyd3fpkpr30sisyrq";
+          rev = "f5a339b21cd5044f7b66beafab7c2d822c36f9e5";
+          sha256 = "1qjwzr9q98da25rf8hjgancb0k2kgr8xllhb4lhnqc8jsc4qnn5v";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/439957cabf379651dc243219a83c3c96bae6f8cf/recipes/thinks";
@ -33428,12 +33678,12 @@
    uptimes = callPackage ({ cl-lib ? null, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "uptimes";
-        version = "3.3";
+        version = "3.5";
        src = fetchFromGitHub {
          owner = "davep";
          repo = "uptimes.el";
-          rev = "2be31db3508513478d3f27f4eff2ff1094786b4e";
-          sha256 = "177d1h84w9rr6x3hsq9z7sbr8s8pippgy0l99gpdhycbff6a7cwg";
+          rev = "07bcd6517243c9c9f61172202d33718bd9b2a850";
+          sha256 = "0n416p47j4cl84lq8wcgmkagkws7a9n4g9307v1s91s2gqmfia3n";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/72099e35ce3e34ec6afc6a3f87a4da07ec91499a/recipes/uptimes";
@ -33659,12 +33909,12 @@
    vhdl-tools = callPackage ({ emacs, fetchFromGitHub, fetchurl, ggtags, helm, lib, melpaBuild, outshine }:
    melpaBuild {
        pname = "vhdl-tools";
-        version = "5.4";
+        version = "5.5";
        src = fetchFromGitHub {
          owner = "csantosb";
          repo = "vhdl-tools";
-          rev = "6f3f8ba58432dfdac59122164c732ccc0dfc475b";
-          sha256 = "076v5zafalv1r14ms90zs1p7yq11fzff4vywrda6dh63i0yk2vxs";
+          rev = "af4ff24ae4489e0a3bfbbddf6bc934f66b0af527";
+          sha256 = "1z88wy7m6rj028dqxzyyyf67gw4jqd72dgsvlr8inwimds2iplbv";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/69fe2f8fb98ac1af1d3185f62ae1c89e646cfebf/recipes/vhdl-tools";
@ -34121,12 +34371,12 @@
    webpaste = callPackage ({ cl-lib ? null, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild, request }:
    melpaBuild {
        pname = "webpaste";
-        version = "1.1.0";
+        version = "1.2.1";
        src = fetchFromGitHub {
          owner = "etu";
          repo = "webpaste.el";
-          rev = "f6583397a4f8c9cde6b556175a6e05303d6238de";
-          sha256 = "0z7pkqfli1lqvfjjaf8p1sbbwf0f7xgz87k3rqqav9xyc9iqh0ni";
+          rev = "69f94520035282c3eb838e6f240a6db93e54b99c";
+          sha256 = "0qxcx2pns77s4mgr1cfzvlhxmfvzckx52phq63b2wmxkijkbwpba";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/13847d91c1780783e516943adee8a3530c757e17/recipes/webpaste";
@ -34541,12 +34791,12 @@
    winum = callPackage ({ cl-lib ? null, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "winum";
-        version = "1.0.0";
+        version = "1.0.2";
        src = fetchFromGitHub {
          owner = "deb0ch";
          repo = "emacs-winum";
-          rev = "e89791b90e45f588f9e8c11884ea1daf3dc98518";
-          sha256 = "1gd0byijl5cyn6gkf5pkadzqvczshgizfrr3ddg6czvgblf1vgl9";
+          rev = "8e886302c7e1d8fd521a95e0f00d6efab295a883";
+          sha256 = "19rf806v3yv6qy6p8mf54g1whdrh7vc107z31kqaqdwq681fhi37";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/c1caa7a54a910a44322fdee300e8cce6ddcde071/recipes/winum";
--- a/pkgs/applications/editors/emacs/default.nix
+++ b/pkgs/applications/editors/emacs/default.nix
@ -26,35 +26,15 @@ let
 in
 stdenv.mkDerivation rec {
  name = "emacs-${version}${versionModifier}";
-  version = "25.1";
+  version = "25.2";
  versionModifier = "";

  src = fetchurl {
-    url = "mirror://gnu//emacs/${name}.tar.xz";
-    sha256 = "0cwgyiyymnx4xdg99dm2drfxcyhy2jmyf0rkr9fwj9mwwf77kwhr";
+    url = "mirror://gnu/emacs/${name}.tar.xz";
+    sha256 = "1ykkq0xl28ljdg61bm6gzy04ww86ajms98gix72qg6cpr6a53dar";
  };

-  patches = (lib.optional stdenv.isDarwin ./at-fdcwd.patch) ++ [
-    ## Fixes a segfault in emacs 25.1
-    ## http://lists.gnu.org/archive/html/emacs-devel/2016-10/msg00917.html
-    ## https://debbugs.gnu.org/cgi/bugreport.cgi?bug=24358
-    (fetchurl {
-      url = http://git.savannah.gnu.org/cgit/emacs.git/patch/?id=9afea93ed536fb9110ac62b413604cf4c4302199;
-      sha256 = "0pshhq8wlh98m9hm8xd3g7gy3ms0l44dq6vgzkg67ydlccziqz40"; })
-    (fetchurl {
-      url = http://git.savannah.gnu.org/cgit/emacs.git/patch/?id=71ca4f6a43bad06192cbc4bb8c7a2d69c179b7b0;
-      sha256 = "0h76wrrqyrky441immprskx5x7200zl7ajf7hyg4da22q7sr09qa"; })
-    (fetchurl {
-      url = http://git.savannah.gnu.org/cgit/emacs.git/patch/?id=1047496722a58ef5b736dae64d32adeb58c5055c;
-      sha256 = "0hk9pi3f2zj266qj8armzpl0z8rfjg0m9ss4k09mgg1hyz80wdvv"; })
-    (fetchurl {
-      url = http://git.savannah.gnu.org/cgit/emacs.git/patch/?id=96ac0c3ebce825e60595794f99e703ec8302e240;
-      sha256 = "1q2hqkjvj9z46b5ik56lv9wiibz09mvg2q3pn8fnpa04ki3zbh4x"; })
-    (fetchurl {
-      url = http://git.savannah.gnu.org/cgit/emacs.git/patch/?id=43986d16fb6ad78a627250e14570ea70bdb1f23a;
-      sha256 = "1wlyy04qahvls7bdrcxaazh9k27gksk7if1q58h83f7h6g9xxkzj";
-    })
-  ];
+  patches = (lib.optional stdenv.isDarwin ./at-fdcwd.patch);

  nativeBuildInputs = [ pkgconfig ]
    ++ lib.optionals srcRepo [ autoconf automake texinfo ]
--- a/pkgs/applications/editors/emacs/macport.nix
+++ b/pkgs/applications/editors/emacs/macport.nix
@ -4,21 +4,21 @@
 }:

 stdenv.mkDerivation rec {
-  emacsVersion = "25.1";
+  emacsVersion = "25.2";
  emacsName = "emacs-${emacsVersion}";
-  macportVersion = "6.1";
+  macportVersion = "6.3";
  name = "emacs-mac-${emacsVersion}-${macportVersion}";

  builder = ./builder.sh;

  src = fetchurl {
-    url = "ftp://ftp.gnu.org/gnu/emacs/${emacsName}.tar.xz";
-    sha256 = "19f2798ee3bc26c95dca3303e7ab141e7ad65d6ea2b6945eeba4dbea7df48f33";
+    url = "mirror:///gnu/emacs/${emacsName}.tar.xz";
+    sha256 = "1ykkq0xl28ljdg61bm6gzy04ww86ajms98gix72qg6cpr6a53dar";
  };

  macportSrc = fetchurl {
    url = "ftp://ftp.math.s.chiba-u.ac.jp/emacs/${emacsName}-mac-${macportVersion}.tar.gz";
-    sha256 = "1zwxh7zsvwcg221mpjh0dhpdas3j9mc5q92pprf8yljl7clqvg62";
+    sha256 = "1dz11frk3ya3842lb89ixzpns9bz5f9njxdkyvjy75gfymqfhhzv";
  };

  hiresSrc = fetchurl {
@ -28,7 +28,9 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

-  buildInputs = [ ncurses libxml2 gnutls pkgconfig texinfo gettext autoconf automake];
+  nativeBuildInputs = [ pkgconfig autoconf automake ];
+
+  buildInputs = [ ncurses libxml2 gnutls texinfo gettext ];

  propagatedBuildInputs = [
    AppKit Carbon Cocoa IOKit OSAKit Quartz QuartzCore WebKit
@ -58,6 +60,7 @@ stdenv.mkDerivation rec {
    "--with-xml2=yes"
    "--with-gnutls=yes"
    "--with-mac"
+    "--with-modules"
    "--enable-mac-app=$$out/Applications"
  ];

--- a/pkgs/applications/editors/kile/default.nix
+++ b/pkgs/applications/editors/kile/default.nix
@ -17,6 +17,7 @@
 , kparts
 , ktexteditor
 , kwindowsystem
+, okular
 , poppler
 }:

@ -48,6 +49,7 @@ let
        kparts
        ktexteditor
        kwindowsystem
+        okular.unwrapped
        poppler
        qtscript
      ];
@ -64,5 +66,5 @@ kdeWrapper
 {
  inherit unwrapped;
  targets = [ "bin/kile" ];
-  paths = [ konsole.unwrapped ];
+  paths = [ konsole.unwrapped okular.unwrapped ];
 }
--- a/pkgs/applications/editors/rstudio/default.nix
+++ b/pkgs/applications/editors/rstudio/default.nix
@ -1,5 +1,5 @@
-{ stdenv, fetchurl, makeDesktopItem, cmake, boost155, zlib, openssl,
-R, qt4, libuuid, hunspellDicts, unzip, ant, jdk, gnumake, makeWrapper,
+{ stdenv, fetchurl, makeDesktopItem, cmake, boost163, zlib, openssl,
+R, qt5, libuuid, hunspellDicts, unzip, ant, jdk, gnumake, makeWrapper, pandoc,
 # If you have set up an R wrapper with other packages by following
 # something like https://nixos.org/nixpkgs/manual/#r-packages, RStudio
 # by default not be able to access any of those R packages. In order
@ -11,18 +11,18 @@ useRPackages ? false
 }:

 let
-  version = "0.98.110";
+  version = "1.1.216";
  ginVer = "1.5";
-  gwtVer = "2.5.1";
+  gwtVer = "2.7.0";
 in
 stdenv.mkDerivation rec {
  name = "RStudio-${version}";

-  buildInputs = [ cmake boost155 zlib openssl R qt4 libuuid unzip ant jdk makeWrapper ];
+  buildInputs = [ cmake boost163 zlib openssl R qt5.full qt5.qtwebkit qt5.qmakeHook libuuid unzip ant jdk makeWrapper pandoc ];

  src = fetchurl {
    url = "https://github.com/rstudio/rstudio/archive/v${version}.tar.gz";
-    sha256 = "0wybbvl5libki8z2ywgcd0hg0py1az484r95lhwh3jbrwfx7ri2z";
+    sha256 = "07lp2ybvj7ippdrp7fv7j54dp0mm6k19j1vqdvjdk95acg3xgcjf";
  };

  # Hack RStudio to only use the input R.
@ -38,14 +38,34 @@ stdenv.mkDerivation rec {
  inherit gwtVer;
  gwtSrc = fetchurl {
    url = "https://s3.amazonaws.com/rstudio-buildtools/gwt-${gwtVer}.zip";
-    sha256 = "0fjr2rcr8lnywj54mzhg9i4xz1b6fh8yv12p5i2q5mgfld2xymy4";
+    sha256 = "1cs78z9a1jg698j2n35wsy07cy4fxcia9gi00x0r0qc3fcdhcrda";
  };

  hunspellDictionaries = builtins.attrValues hunspellDicts;

  mathJaxSrc = fetchurl {
-    url = https://s3.amazonaws.com/rstudio-buildtools/mathjax-20.zip;
-    sha256 = "1ikg3fhharsfrh2fv8c53fdawqajj24nif89400l3klw1hyq4zal";
+    url = https://s3.amazonaws.com/rstudio-buildtools/mathjax-26.zip;
+    sha256 = "0wbcqb9rbfqqvvhqr1pbqax75wp8ydqdyhp91fbqfqp26xzjv6lk";
+  };
+
+  rmarkdownSrc = fetchurl {
+    url = "https://github.com/rstudio/rmarkdown/archive/95b8b1fa64f78ca99f225a67fff9817103be56.zip";
+    sha256 = "12fa65qr04rwsprkmyl651mkaqcbn1znwsmcjg4qsk9n5nxg0fah";
+  };
+
+  rsconnectSrc = fetchurl {
+    url = "https://github.com/rstudio/rsconnect/archive/425f3767b3142bc6b81c9eb62c4722f1eedc9781.zip";
+    sha256 = "1sgf9dj9wfk4c6n5p1jc45386pf0nj2alg2j9qx09av3can1dy9p";
+  };
+
+  rstudiolibclang = fetchurl {
+    url = https://s3.amazonaws.com/rstudio-buildtools/libclang-3.5.zip;
+    sha256 = "1sl5vb8misipwbbbykdymw172w9qrh8xv3p29g0bf3nzbnv6zc7c";
+  };
+
+  rstudiolibclangheaders = fetchurl {
+    url = https://s3.amazonaws.com/rstudio-buildtools/libclang-builtin-headers.zip;
+    sha256 = "0x4ax186bm3kf098izwmsplckgx1kqzg9iiyzg95rpbqsb4593qb";
  };

  preConfigure =
@ -66,10 +86,19 @@ stdenv.mkDerivation rec {
 	  done
      done

-      unzip $mathJaxSrc -d dependencies/common/mathjax
+      unzip $mathJaxSrc -d dependencies/common/mathjax-26
+      unzip $rmarkdownSrc -d dependencies/common/rmarkdown
+      unzip $rsconnectSrc -d dependencies/common/rsconnect
+      mkdir -p dependencies/common/libclang/3.5
+      unzip $rstudiolibclang -d dependencies/common/libclang/3.5
+      mkdir -p dependencies/common/libclang/builtin-headers
+      unzip $rstudiolibclangheaders -d dependencies/common/libclang/builtin-headers
+
+      mkdir -p dependencies/common/pandoc
+      cp ${pandoc}/bin/pandoc dependencies/common/pandoc/
    '';

-  cmakeFlags = [ "-DRSTUDIO_TARGET=Desktop" ];
+  cmakeFlags = [ "-DRSTUDIO_TARGET=Desktop" "-DQT_QMAKE_EXECUTABLE=${qt5.qmakeHook}/bin/qmake" ];

  desktopItem = makeDesktopItem {
    name = name;
@ -100,7 +129,7 @@ stdenv.mkDerivation rec {
    { description = "Set of integrated tools for the R language";
      homepage = http://www.rstudio.com/;
      license = licenses.agpl3;
-      maintainers = [ maintainers.ehmry ];
+      maintainers = [ maintainers.ehmry maintainers.changlinli ];
      platforms = platforms.linux;
    };
 }
--- a/pkgs/applications/editors/rstudio/r-location.patch
+++ b/pkgs/applications/editors/rstudio/r-location.patch
@ -1,18 +1,19 @@
-diff -ur rstudio-0.98.110-old/src/cpp/core/CMakeLists.txt rstudio-0.98.110-new/src/cpp/core/CMakeLists.txt
--- rstudio-0.98.110-old/src/cpp/core/r_util/REnvironmentPosix.cpp	2013-04-28 10:02:14.000000000 -0400
-+++ rstudio-0.98.110-new/src/cpp/core/r_util/REnvironmentPosix.cpp	2015-03-23 15:06:35.533400807 -0400
-@@ -84,9 +84,7 @@
+diff -ur rstudio-1.1.216-old/src/cpp/core/CMakeLists.txt rstudio-1.1.216-new/src/cpp/core/CMakeLists.txt
+--- rstudio-1.1.216-old/src/cpp/core/r_util/REnvironmentPosix.cpp	2017-04-30 03:37:26.669418665 -0400
+++ rstudio-1.1.216-new/src/cpp/core/r_util/REnvironmentPosix.cpp	2017-04-30 03:36:33.590726185 -0400
+@@ -87,10 +87,7 @@
 {
    // define potential paths
    std::vector<std::string> rScriptPaths;
 -   rScriptPaths.push_back("/usr/bin/R");
 -   rScriptPaths.push_back("/usr/local/bin/R");
 -   rScriptPaths.push_back("/opt/local/bin/R");
+-   rScriptPaths.push_back("/Library/Frameworks/R.framework/Resources/bin/R");
 +   rScriptPaths.push_back("@R@/bin/R");
    return scanForRScript(rScriptPaths, pErrMsg);
 }
-
-@@ -220,8 +218,7 @@
+ 
+@@ -226,8 +223,7 @@
       // scan in standard locations as a fallback
       std::string scanErrMsg;
       std::vector<std::string> rScriptPaths;
--- a/pkgs/applications/graphics/apitrace/default.nix
+++ b/pkgs/applications/graphics/apitrace/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "apitrace-${version}";
-  version = "7.1";
+  version = "7.1-363-ge3509be1";

  src = fetchFromGitHub {
-    sha256 = "1n2gmsjnpyam7isg7n1ksggyh6y1l8drvx0a93bnvbcskr7jiz9a";
-    rev = version;
+    sha256 = "1xbz6gwl7kqjm7jjy5gxkdxzrg93vj1a3l19ara7rni6dii0q136";
+    rev = "e3509be175eda77749abffe051ed0d3eb5d14e72";
    repo = "apitrace";
    owner = "apitrace";
  };
--- a/pkgs/applications/graphics/gimp/plugins/default.nix
+++ b/pkgs/applications/graphics/gimp/plugins/default.nix
@ -105,7 +105,7 @@ rec {
      Filters/Enhance/Smart remove selection
    */
    name = "resynthesizer-0.16";
-    buildInputs = [ gimp pkgs.fftw ] ++ gimp.nativeBuildInputs;
+    buildInputs = [ gimp pkgs.fftw pkgs.pkgconfig pkgs.gtk2 ] ++ gimp.nativeBuildInputs;
    src = fetchurl {
      url = http://www.logarithmic.net/pfh-files/resynthesizer/resynthesizer-0.16.tar.gz;
      sha256 = "1k90a1jzswxmajn56rdxa4r60v9v34fmqsiwfdxqcvx3yf4yq96x";
@ -125,7 +125,9 @@ rec {
      Filters/Enhance/Smart remove selection
    */
    name = "resynthesizer-2.0.1";
-    buildInputs = [ gimp pkgs.fftw pkgs.autoreconfHook ]
+    buildInputs = [ gimp pkgs.fftw pkgs.autoreconfHook pkgs.pkgconfig pkgs.gtk2
+      pkgs.intltool
+    ]
      ++ gimp.nativeBuildInputs;
    makeFlags = "GIMP_LIBDIR=$out/lib/gimp/2.0/";
    src = fetchFromGitHub {
--- a/pkgs/applications/graphics/krita/default.nix
+++ b/pkgs/applications/graphics/krita/default.nix
@ -8,12 +8,12 @@

 stdenv.mkDerivation rec {
  name = "krita-${version}";
-  ver_min = "3.1.2";
-  version = "${ver_min}.1";
+  ver_min = "3.1.3";
+  version = "${ver_min}";

  src = fetchurl {
    url = "http://download.kde.org/stable/krita/${ver_min}/${name}.tar.gz";
-    sha256 = "934ed82c3f4e55e7819b327c838ea2f307d3bf3d040722501378b01d76a3992d";
+    sha256 = "125js6c8aw4bqhs28pwnl3rbgqx5yx4zsklw7bfdhy3vf6lrysw1";
  };

  nativeBuildInputs = [ cmake extra-cmake-modules makeQtWrapper ];
@ -40,6 +40,6 @@ stdenv.mkDerivation rec {
    homepage = "https://krita.org/";
    maintainers = with maintainers; [ abbradar ];
    platforms = platforms.linux;
-    licenses = licenses.gpl2;
+    license = licenses.gpl2;
  };
 }
--- a/pkgs/applications/kde/ark/default.nix
+++ b/pkgs/applications/kde/ark/default.nix
@ -4,7 +4,7 @@
  extra-cmake-modules, kdoctools, makeWrapper,

  karchive, kconfig, kcrash, kdbusaddons, ki18n, kiconthemes, khtml, kio,
-  kservice, kpty, kwidgetsaddons, libarchive,
+  kservice, kpty, kwidgetsaddons, libarchive, kitemmodels,

  # Archive tools
  p7zip, unzipNLS, zip,
@ -22,7 +22,7 @@ let
      ];
      propagatedBuildInputs = [
        khtml ki18n kio karchive kconfig kcrash kdbusaddons kiconthemes kservice
-        kpty kwidgetsaddons libarchive
+        kpty kwidgetsaddons libarchive kitemmodels
      ];
      postInstall =
        let
--- a/pkgs/applications/kde/fetch.sh
+++ b/pkgs/applications/kde/fetch.sh
@ -1 +1 @@
-WGET_ARGS=( http://download.kde.org/stable/applications/16.12.3/ -A '*.tar.xz' )
+WGET_ARGS=( http://download.kde.org/stable/applications/17.04.0/ -A '*.tar.xz' )
--- a/pkgs/applications/kde/kcachegrind.nix
+++ b/pkgs/applications/kde/kcachegrind.nix
@ -1,7 +1,8 @@
 {
  kdeApp, lib, kdeWrapper,
-  cmake, automoc4,
-  kdelibs, perl, python, php
+  extra-cmake-modules, kdoctools,
+  kio, ki18n,
+  perl, python, php
 }:

 kdeWrapper {
@ -11,8 +12,8 @@ kdeWrapper {
      license = with lib.licenses; [ gpl2 ];
      maintainers = with lib.maintainers; [ orivej ];
    };
-    nativeBuildInputs = [ cmake automoc4 ];
-    buildInputs = [ kdelibs perl python php ];
+    nativeBuildInputs = [ extra-cmake-modules kdoctools ];
+    buildInputs = [ perl python php kio ki18n ];
    enableParallelBuilding = true;
  };

--- a/pkgs/applications/kde/kdelibs/default.nix
+++ b/pkgs/applications/kde/kdelibs/default.nix
@ -43,7 +43,7 @@ kdeApp {
  meta = {
    platforms = lib.platforms.linux;
    homepage = "http://www.kde.org";
-    licenses = with lib.licenses; [ gpl2 fdl12 lgpl21 ];
+    license = with lib.licenses; [ gpl2 fdl12 lgpl21 ];
    maintainers = [ lib.maintainers.ttuegel ];
  };
 }
--- a/pkgs/applications/kde/marble.nix
+++ b/pkgs/applications/kde/marble.nix
@ -1,6 +1,8 @@
 { kdeApp, lib, kdeWrapper
-, extra-cmake-modules, qtscript, qtsvg, qtquickcontrols
-, gpsd
+, extra-cmake-modules, kdoctools
+, qtscript, qtsvg, qtquickcontrols, qtwebkit
+, krunner, shared_mime_info, kparts, knewstuff
+, gpsd, perl
 }:

 let
@ -9,9 +11,10 @@ let
      name = "marble";
      meta.license = with lib.licenses; [ lgpl21 gpl3 ];

-      nativeBuildInputs = [ extra-cmake-modules ];
+      nativeBuildInputs = [ extra-cmake-modules kdoctools perl ];
      propagatedBuildInputs = [
-        qtscript qtsvg qtquickcontrols
+        qtscript qtsvg qtquickcontrols qtwebkit shared_mime_info
+        krunner kparts knewstuff
        gpsd
      ];

@ -20,6 +23,6 @@ let
 in
 kdeWrapper {
  inherit unwrapped;
-  targets = [ "bin/marble-qt" ];
+  targets = [ "bin/marble-qt" "bin/marble" ];
  paths = [ unwrapped ];
 }
--- a/pkgs/applications/kde/srcs.nix
+++ b/pkgs/applications/kde/srcs.nix
--- a/pkgs/applications/misc/cortex/default.nix
+++ b/pkgs/applications/misc/cortex/default.nix
@ -1,32 +0,0 @@
-{ stdenv, fetchgit, python3 }:
-
-stdenv.mkDerivation {
-  name = "cortex-2015-08-23";
-
-  src = fetchgit {
-    url = "https://github.com/gglucas/cortex";
-    rev = "ff10ff860479fe2f50590c0f8fcfc6dc34446639";
-    sha256 = "0pa2kkkcnmf56d5d5kknv0gfahddym75xripd4kgszaj6hsib3zg";
-  };
-
-  buildInputs = [ stdenv python3 ];
-
-  prePatch = ''
-    substituteInPlace cortex --replace "/usr/bin/env python3" "${python3}/bin/python3"
-  '';
-
-  installPhase = ''
-    mkdir -p $out/bin
-    cp cortex $out/bin/
-    chmod +x $out/bin/cortex
-  '';
-
-  meta = with stdenv.lib; {
-    homepage = "http://cortex.glacicle.org";
-    description = "An ncurses reddit browser and monitor";
-    license = licenses.mit;
-    maintainers = with maintainers; [ matthiasbeyer ];
-    platforms = with platforms; unix;
-  };
-
-}
--- a/pkgs/applications/misc/dockbarx/default.nix
+++ b/pkgs/applications/misc/dockbarx/default.nix
@ -0,0 +1,38 @@
+{ stdenv, fetchFromGitHub, pythonPackages, gnome2, keybinder }:
+
+pythonPackages.buildPythonApplication rec {
+  ver = "0.92";
+  name = "dockbarx-${ver}";
+
+  src = fetchFromGitHub {
+    owner = "M7S";
+    repo = "dockbarx";
+    rev = ver;
+    sha256 = "17n7jc3bk3f2i0i1ddpp05bakifc8y5xppads7ihpkj3qw9g35vl";
+  };
+
+  postPatch = ''
+    substituteInPlace setup.py                                --replace /usr/                   ""
+    substituteInPlace setup.py                                --replace '"/", "usr", "share",'  '"share",'
+    substituteInPlace dockbarx/applets.py                     --replace /usr/share/             $out/share/
+    substituteInPlace dockbarx/dockbar.py                     --replace /usr/share/             $out/share/
+    substituteInPlace dockbarx/iconfactory.py                 --replace /usr/share/             $out/share/
+    substituteInPlace dockbarx/theme.py                       --replace /usr/share/             $out/share/
+    substituteInPlace dockx_applets/battery_status.py         --replace /usr/share/             $out/share/
+    substituteInPlace dockx_applets/namebar.py                --replace /usr/share/             $out/share/
+    substituteInPlace dockx_applets/namebar_window_buttons.py --replace /usr/share/             $out/share/
+    substituteInPlace dockx_applets/volume-control.py         --replace /usr/share/             $out/share/
+  '';
+
+  propagatedBuildInputs = (with pythonPackages; [ pygtk pyxdg dbus-python pillow xlib ])
+    ++ (with gnome2; [ gnome_python gnome_python_desktop ])
+    ++ [ keybinder ];
+
+  meta = with stdenv.lib; {
+    homepage = http://launchpad.net/dockbar/;
+    description = "DockBarX is a lightweight taskbar / panel replacement for Linux which works as a stand-alone dock";
+    license = licenses.gpl3;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.volth ];
+  };
+}
--- a/pkgs/applications/misc/haxor-news/default.nix
+++ b/pkgs/applications/misc/haxor-news/default.nix
@ -1,12 +1,12 @@
 { stdenv, fetchurl, pythonPackages }:

 pythonPackages.buildPythonApplication rec {
-  version = "0.4.1";
+  version = "0.4.2";
  name = "haxor-news-${version}";

  src = fetchurl {
    url = "https://github.com/donnemartin/haxor-news/archive/${version}.tar.gz";
-    sha256 = "0d3an7by33hjl8zg48y7ig6r258ghgbdkpp1psa9jr6n2nk2w9mr";
+    sha256 = "0543k5ys044f2a1q8k36djnnq2h2dffnwbkva9snjjy30nlwwdgs";
  };

  propagatedBuildInputs = with pythonPackages; [
@ -14,7 +14,7 @@ pythonPackages.buildPythonApplication rec {
    colorama
    requests2
    pygments
-    prompt_toolkit_52
+    prompt_toolkit
    six
  ];

--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@ -2,7 +2,7 @@

 buildGoPackage rec {
  name = "hugo-${version}";
-  version = "0.20.2";
+  version = "0.20.5";

  goPackagePath = "github.com/spf13/hugo";

@ -10,7 +10,7 @@ buildGoPackage rec {
    owner = "spf13";
    repo = "hugo";
    rev = "v${version}";
-    sha256 = "1dvd9kiqp87cbf027kvyqb282pxs8qm16r1dk74l5drranfvkszy";
+    sha256 = "0gsxsxri5jivvc862a1dapij667726vs55vjqas84lsg1066q5p2";
  };

  goDeps = ./deps.nix;
--- a/pkgs/applications/misc/khal/default.nix
+++ b/pkgs/applications/misc/khal/default.nix
@ -3,12 +3,12 @@
 with python3Packages;

 buildPythonApplication rec {
-  version = "0.9.2";
+  version = "0.9.5";
  name = "khal-${version}";

  src = fetchurl {
    url = "mirror://pypi/k/khal/khal-${version}.tar.gz";
-    sha256 = "1ryh5c7408w8gpql5s9mkxkvz1ngnds3xm43p7r96ynx8prr9swp";
+    sha256 = "0fvv0kjym9q8v20zbpr5m8ig65b8hva4p0c935qsdvgdni68jidr";
  };

  LC_ALL = "en_US.UTF-8";
--- a/pkgs/applications/misc/mwic/default.nix
+++ b/pkgs/applications/misc/mwic/default.nix
@ -1,12 +1,12 @@
 { stdenv, fetchurl, pythonPackages }:

 stdenv.mkDerivation rec {
-  version = "0.7.2";
+  version = "0.7.3";
  name = "mwic-${version}";

  src = fetchurl {
    url = "https://github.com/jwilk/mwic/releases/download/${version}/${name}.tar.gz";
-    sha256 = "1linpagf0i0ggicq02fcvz4rpx7xdpy80ys49wx7fnmz7f3jc6jy";
+    sha256 = "0baa2pnaba954k169p9rpzc66mhz9zqdd3lz9q95rp9dgygvchzn";
  };

  makeFlags=["PREFIX=\${out}"];
--- a/pkgs/applications/misc/qsyncthingtray/default.nix
+++ b/pkgs/applications/misc/qsyncthingtray/default.nix
@ -36,9 +36,14 @@ stdenv.mkDerivation rec {
  '';

  installPhase = let qst = "qsyncthingtray"; in ''
+    runHook preInstall
+
    mkdir -p $out/bin
    install -m755 QSyncthingTray $out/bin/${qst}
    ln -s $out/bin/${qst} $out/bin/QSyncthingTray
+    wrapQtProgram $out/bin/qsyncthingtray
+
+    runHook postInstall
  '';

  meta = with stdenv.lib; {
@ -52,6 +57,7 @@ stdenv.mkDerivation rec {
    license = licenses.lgpl3;
    maintainers = with maintainers; [ zraexy peterhoeg ];
    platforms = platforms.all;
-    broken = builtins.compareVersions qtbase.version "5.7.0" >= 0;
+    # 0.5.7 segfaults when opening the main panel with qt 5.7 but qt 5.8 is OK
+    broken = builtins.compareVersions qtbase.version "5.7.0" == 0;
  };
 }
--- a/pkgs/applications/misc/rtv/default.nix
+++ b/pkgs/applications/misc/rtv/default.nix
@ -1,28 +1,47 @@
-{ stdenv, fetchFromGitHub, pkgs, lib, python, pythonPackages }:
+{ stdenv, fetchFromGitHub, pkgs, pythonPackages }:

-pythonPackages.buildPythonApplication rec {
-  version = "1.14.1";
+with pythonPackages;
+buildPythonApplication rec {
+  version = "1.15.1";
  name = "rtv-${version}";

  src = fetchFromGitHub {
    owner = "michael-lazar";
    repo = "rtv";
    rev = "v${version}";
-    sha256 = "03106sdsvj4zjjaqqg7qvm3n959plvy08a6n28ir1yf67kwzsx8a";
+    sha256 = "037dhds1prxj7vsq15dr46wk3pfk3ixr0d60m3h796b6nbc1spya";
  };

-  propagatedBuildInputs = with pythonPackages; [
+  checkPhase = ''
+    py.test
+  '';
+
+  buildInputs = [
+    coverage
+    coveralls
+    docopt
+    mock
+    pylint
+    pytest
+    vcrpy
+  ];
+
+  propagatedBuildInputs = [
+    backports_functools_lru_cache
    beautifulsoup4
+    configparser
+    contextlib2
+    decorator
+    kitchen
    mailcap-fix
-    tornado
+    mccabe
    requests2
    six
-    praw
-    kitchen
-    praw
-  ] ++ lib.optional (!pythonPackages.isPy3k) futures;
+    tornado
+    pyyaml
+  ];

-  meta = with lib; {
+  meta = with stdenv.lib; {
    homepage = https://github.com/michael-lazar/rtv;
    description = "Browse Reddit from your Terminal";
    license = licenses.mit;
--- a/pkgs/applications/misc/sc-im/default.nix
+++ b/pkgs/applications/misc/sc-im/default.nix
@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, yacc, ncurses, libxml2, libzip, libxls, pkgconfig }:

 stdenv.mkDerivation rec {
-  version = "0.5.0";
+  version = "0.6.0";
  name = "sc-im-${version}";

  src = fetchFromGitHub {
    owner = "andmarti1424";
    repo = "sc-im";
    rev = "v${version}";
-    sha256 = "1vdn9p9srvdksxznrn65pfigwrd7brlq8bac3pjfqsvf8gjnzq61";
+    sha256 = "02ak3b0vv72mv38cwvy7qp0y6hgrzcgahkv1apgks3drpnz5w1sj";
  };

  buildInputs = [ yacc ncurses libxml2 libzip libxls pkgconfig ];
--- a/pkgs/applications/misc/udiskie/default.nix
+++ b/pkgs/applications/misc/udiskie/default.nix
@ -4,13 +4,13 @@

 pythonPackages.buildPythonApplication rec {
  name = "udiskie-${version}";
-  version = "1.5.1";
+  version = "1.7.0";

  src = fetchFromGitHub {
    owner = "coldfix";
    repo = "udiskie";
    rev = version;
-    sha256 = "01x5fvllb262x6r3547l23z7p6hr7ddz034bkhmj2cqmf83sxwxd";
+    sha256 = "1dvfhf0d79al0vnrwdknfiy2297m3f7fgn7syr85p29hd6260jnv";
  };

  buildInputs = [
--- a/pkgs/applications/misc/xca/default.nix
+++ b/pkgs/applications/misc/xca/default.nix
@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
    sha256 = "1r2w9gpahjv221j963bd4vn0gj4cxmb9j42f3cd9qdn890hizw84";
  };

-  enableParallelBuilding = false;
+  enableParallelBuilding = true;

  buildInputs = [ libtool openssl qtbase qttools ];

@ -37,6 +37,6 @@ stdenv.mkDerivation rec {
    platforms = platforms.all;
    license = licenses.bsd3;
    maintainers = with maintainers; [ offline peterhoeg ];
-    broken = builtins.compareVersions qtbase.version "5.7.0" >= 0;
+    broken = builtins.compareVersions qtbase.version "5.7.0" == 0;
  };
 }
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@ -0,0 +1,205 @@
+{ pname, version, updateScript ? null
+, src, patches ? [], overrides ? {}, meta
+, isTorBrowserLike ? false }:
+
+{ lib, stdenv, pkgconfig, pango, perl, python, zip, libIDL
+, libjpeg, zlib, dbus, dbus_glib, bzip2, xorg
+, freetype, fontconfig, file, nspr, nss, libnotify
+, yasm, mesa, sqlite, unzip, makeWrapper
+, hunspell, libevent, libstartup_notification, libvpx
+, cairo, icu, libpng, jemalloc
+, autoconf213, which, gnused, cargo, rustc
+
+, debugBuild ? false
+
+### optionals
+
+## optional libraries
+
+, alsaSupport ? true, alsaLib
+, pulseaudioSupport ? true, libpulseaudio
+, ffmpegSupport ? true, gstreamer, gst-plugins-base
+, gtk3Support ? true, gtk2, gtk3, wrapGAppsHook
+
+## privacy-related options
+
+, privacySupport ? isTorBrowserLike
+
+# WARNING: NEVER set any of the options below to `true` by default.
+# Set to `privacySupport` or `false`.
+
+, webrtcSupport ? !privacySupport
+, loopSupport ? !privacySupport || !isTorBrowserLike
+, geolocationSupport ? !privacySupport
+, googleAPISupport ? geolocationSupport
+, crashreporterSupport ? false
+
+, safeBrowsingSupport ? false
+, drmSupport ? false
+
+## other
+
+# If you want the resulting program to call itself
+# "Firefox"/"Torbrowser" instead of "Nightly" or whatever, enable this
+# option. However, in Firefox's case, those binaries may not be
+# distributed without permission from the Mozilla Foundation, see
+# http://www.mozilla.org/foundation/trademarks/.
+, enableOfficialBranding ? false
+}:
+
+assert stdenv.cc ? libc && stdenv.cc.libc != null;
+assert !isTorBrowserLike -> loopSupport; # can't be disabled on firefox :(
+
+let
+  flag = tf: x: [(if tf then "--enable-${x}" else "--disable-${x}")];
+in
+
+stdenv.mkDerivation (rec {
+  name = "${pname}-unwrapped-${version}";
+
+  inherit src patches meta;
+
+  buildInputs = [
+    gtk2 perl zip libIDL libjpeg zlib bzip2
+    dbus dbus_glib pango freetype fontconfig xorg.libXi
+    xorg.libX11 xorg.libXrender xorg.libXft xorg.libXt file
+    nspr libnotify xorg.pixman yasm mesa
+    xorg.libXScrnSaver xorg.scrnsaverproto
+    xorg.libXext xorg.xextproto sqlite unzip makeWrapper
+    hunspell libevent libstartup_notification libvpx /* cairo */
+    icu libpng jemalloc
+  ]
+  ++ lib.optionals (!isTorBrowserLike) [ nss ]
+
+  ++ lib.optional  alsaSupport alsaLib
+  ++ lib.optional  pulseaudioSupport libpulseaudio # only headers are needed
+  ++ lib.optionals ffmpegSupport [ gstreamer gst-plugins-base ]
+  ++ lib.optional  gtk3Support gtk3;
+
+  nativeBuildInputs =
+    [ autoconf213 which gnused pkgconfig perl python cargo rustc ]
+    ++ lib.optional gtk3Support wrapGAppsHook;
+
+  preConfigure = ''
+    # remove distributed configuration files
+    rm -f configure
+    rm -f js/src/configure
+    rm -f .mozconfig*
+
+    # this will run autoconf213
+    make -f client.mk configure-files
+
+    configureScript="$(realpath ./configure)"
+    cd obj-*
+  '' + lib.optionalString googleAPISupport ''
+    # Google API key used by Chromium and Firefox.
+    # Note: These are for NixOS/nixpkgs use ONLY. For your own distribution,
+    # please get your own set of keys.
+    echo "AIzaSyDGi15Zwl11UNe6Y-5XW_upsfyw31qwZPI" >ga
+  '';
+
+  configureFlags = [
+    "--enable-application=browser"
+    "--with-system-jpeg"
+    "--with-system-zlib"
+    "--with-system-bz2"
+    "--with-system-libevent"
+    "--with-system-libvpx"
+    "--with-system-png" # needs APNG support
+    "--with-system-icu"
+    "--enable-system-ffi"
+    "--enable-system-hunspell"
+    "--enable-system-pixman"
+    "--enable-system-sqlite"
+    #"--enable-system-cairo"
+    "--enable-startup-notification"
+    "--enable-content-sandbox" # available since 26.0, but not much info available
+    "--disable-tests"
+    "--disable-necko-wifi" # maybe we want to enable this at some point
+    "--disable-updater"
+    "--enable-jemalloc"
+    "--disable-maintenance-service"
+    "--disable-gconf"
+    "--enable-default-toolkit=cairo-gtk${if gtk3Support then "3" else "2"}"
+  ]
+
+  # TorBrowser patches these
+  ++ lib.optionals (!isTorBrowserLike) [
+    "--with-system-nss"
+    "--with-system-nspr"
+  ]
+
+  # and wants these
+  ++ lib.optionals isTorBrowserLike [
+    "--with-tor-browser-version=${version}"
+    "--enable-signmar"
+    "--enable-verify-mar"
+
+    # We opt out of TorBrowser's nspr because that patch is useless on
+    # anything but Windows and produces zero fingerprinting
+    # possibilities on other platforms.
+    # Lets save some space instead.
+    "--with-system-nspr"
+  ]
+
+  ++ flag alsaSupport "alsa"
+  ++ flag pulseaudioSupport "pulseaudio"
+  ++ flag ffmpegSupport "ffmpeg"
+  ++ lib.optional (!ffmpegSupport) "--disable-gstreamer"
+  ++ flag webrtcSupport "webrtc"
+  ++ lib.optionals isTorBrowserLike
+       (flag loopSupport "loop")
+  ++ flag geolocationSupport "mozril-geoloc"
+  ++ lib.optional googleAPISupport "--with-google-api-keyfile=ga"
+  ++ flag crashreporterSupport "crashreporter"
+  ++ flag safeBrowsingSupport "safe-browsing"
+  ++ flag drmSupport "eme"
+
+  ++ (if debugBuild then [ "--enable-debug" "--enable-profiling" ]
+                    else [ "--disable-debug" "--enable-release"
+                           "--enable-optimize"
+                           "--enable-strip" ])
+  ++ lib.optional enableOfficialBranding "--enable-official-branding";
+
+  enableParallelBuilding = true;
+
+  preInstall = ''
+    # The following is needed for startup cache creation on grsecurity kernels.
+    paxmark m dist/bin/xpcshell
+  '';
+
+  postInstall = ''
+    # For grsecurity kernels
+    paxmark m $out/lib/firefox-[0-9]*/{firefox,firefox-bin,plugin-container}
+
+    # Remove SDK cruft. FIXME: move to a separate output?
+    rm -rf $out/share/idl $out/include $out/lib/firefox-devel-*
+
+    # Needed to find Mozilla runtime
+    gappsWrapperArgs+=(--argv0 "$out/bin/.firefox-wrapped")
+  '';
+
+  postFixup = ''
+    # Fix notifications. LibXUL uses dlopen for this, unfortunately; see #18712.
+    patchelf --set-rpath "${lib.getLib libnotify
+      }/lib:$(patchelf --print-rpath "$out"/lib/firefox-*/libxul.so)" \
+        "$out"/lib/firefox-*/libxul.so
+  '';
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    # Some basic testing
+    "$out/bin/firefox" --version
+  '';
+
+  passthru = {
+    browserName = "firefox";
+    inherit version updateScript;
+    isFirefox3Like = true;
+    inherit isTorBrowserLike;
+    gtk = gtk2;
+    inherit nspr;
+    inherit ffmpegSupport;
+  };
+
+} // overrides)
--- a/pkgs/applications/networking/browsers/firefox/default.nix
+++ b/pkgs/applications/networking/browsers/firefox/default.nix
@ -1,175 +0,0 @@
-{ lib, stdenv, fetchurl, pkgconfig, gtk2, pango, perl, python, zip, libIDL
-, libjpeg, zlib, dbus, dbus_glib, bzip2, xorg
-, freetype, fontconfig, file, alsaLib, nspr, nss, libnotify
-, yasm, mesa, sqlite, unzip, makeWrapper
-, hunspell, libevent, libstartup_notification, libvpx
-, cairo, gstreamer, gst-plugins-base, icu, libpng, jemalloc, libpulseaudio
-, autoconf213, which, cargo, rustc
-, writeScript, xidel, common-updater-scripts, coreutils, gnused, gnugrep, curl
-, enableGTK3 ? false, gtk3, wrapGAppsHook
-, debugBuild ? false
-, # If you want the resulting program to call itself "Firefox" instead
-  # of "Nightly" or whatever, enable this option.  However, those
-  # binaries may not be distributed without permission from the
-  # Mozilla Foundation, see
-  # http://www.mozilla.org/foundation/trademarks/.
-  enableOfficialBranding ? false
-}:
-
-assert stdenv.cc ? libc && stdenv.cc.libc != null;
-
-let
-
-common = { pname, version, sha512, updateScript }: stdenv.mkDerivation rec {
-  name = "${pname}-unwrapped-${version}";
-
-  src = fetchurl {
-    url =
-      let ext = if lib.versionAtLeast version "41.0" then "xz" else "bz2";
-      in "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.${ext}";
-    inherit sha512;
-  };
-
-  # this patch should no longer be needed in 53
-  # from https://bugzilla.mozilla.org/show_bug.cgi?id=1013882
-  patches = lib.optional debugBuild ./fix-debug.patch;
-
-  buildInputs =
-    [ gtk2 zip libIDL libjpeg zlib bzip2
-      dbus dbus_glib pango freetype fontconfig xorg.libXi
-      xorg.libX11 xorg.libXrender xorg.libXft xorg.libXt file
-      alsaLib nspr nss libnotify xorg.pixman yasm mesa
-      xorg.libXScrnSaver xorg.scrnsaverproto
-      xorg.libXext xorg.xextproto sqlite unzip
-      hunspell libevent libstartup_notification libvpx /* cairo */
-      icu libpng jemalloc
-      libpulseaudio # only headers are needed
-    ]
-    ++ lib.optional enableGTK3 gtk3
-    ++ lib.optionals (!passthru.ffmpegSupport) [ gstreamer gst-plugins-base ];
-
-  nativeBuildInputs =
-    [ autoconf213 which gnused pkgconfig perl python cargo rustc ]
-    ++ lib.optional enableGTK3 wrapGAppsHook;
-
-  configureFlags =
-    [ "--enable-application=browser"
-      "--with-system-jpeg"
-      "--with-system-zlib"
-      "--with-system-bz2"
-      "--with-system-nspr"
-      "--with-system-nss"
-      "--with-system-libevent"
-      "--with-system-libvpx"
-      "--with-system-png" # needs APNG support
-      "--with-system-icu"
-      "--enable-alsa"
-      "--enable-system-ffi"
-      "--enable-system-hunspell"
-      "--enable-system-pixman"
-      "--enable-system-sqlite"
-      #"--enable-system-cairo"
-      "--enable-startup-notification"
-      "--enable-content-sandbox"            # available since 26.0, but not much info available
-      "--disable-crashreporter"
-      "--disable-tests"
-      "--disable-necko-wifi" # maybe we want to enable this at some point
-      "--disable-updater"
-      "--enable-jemalloc"
-      "--disable-gconf"
-      "--enable-default-toolkit=cairo-gtk${if enableGTK3 then "3" else "2"}"
-      "--with-google-api-keyfile=ga"
-    ]
-    ++ (if debugBuild then [ "--enable-debug" "--enable-profiling" ]
-                      else [ "--disable-debug" "--enable-release"
-                             "--enable-optimize"
-                             "--enable-strip" ])
-    ++ lib.optional enableOfficialBranding "--enable-official-branding";
-
-  enableParallelBuilding = true;
-
-  preConfigure =
-    ''
-      configureScript="$(realpath ./configure)"
-      mkdir ../objdir
-      cd ../objdir
-
-      # Google API key used by Chromium and Firefox.
-      # Note: These are for NixOS/nixpkgs use ONLY. For your own distribution,
-      # please get your own set of keys.
-      echo "AIzaSyDGi15Zwl11UNe6Y-5XW_upsfyw31qwZPI" >ga
-    '';
-
-  preInstall =
-    ''
-      # The following is needed for startup cache creation on grsecurity kernels.
-      paxmark m ../objdir/dist/bin/xpcshell
-    '';
-
-  postInstall =
-    ''
-      # For grsecurity kernels
-      paxmark m $out/lib/firefox-[0-9]*/{firefox,firefox-bin,plugin-container}
-
-      # Remove SDK cruft. FIXME: move to a separate output?
-      rm -rf $out/share/idl $out/include $out/lib/firefox-devel-*
-
-      # Needed to find Mozilla runtime
-      gappsWrapperArgs+=(--argv0 "$out/bin/.firefox-wrapped")
-    '';
-
-  postFixup =
-    # Fix notifications. LibXUL uses dlopen for this, unfortunately; see #18712.
-    ''
-      patchelf --set-rpath "${lib.getLib libnotify
-        }/lib:$(patchelf --print-rpath "$out"/lib/firefox-*/libxul.so)" \
-          "$out"/lib/firefox-*/libxul.so
-    '';
-
-  doInstallCheck = true;
-  installCheckPhase =
-    ''
-      # Some basic testing
-      "$out/bin/firefox" --version
-    '';
-
-  meta = {
-    description = "A web browser" + lib.optionalString (pname == "firefox-esr") " (Extended Support Release)";
-    homepage = http://www.mozilla.com/en-US/firefox/;
-    maintainers = with lib.maintainers; [ eelco ];
-    platforms = lib.platforms.linux;
-  };
-
-  passthru = {
-    inherit nspr version updateScript;
-    gtk = gtk2;
-    isFirefox3Like = true;
-    browserName = "firefox";
-    ffmpegSupport = lib.versionAtLeast version "46.0";
-  };
-};
-
-in {
-
-  firefox-unwrapped = common {
-    pname = "firefox";
-    version = "53.0";
-    sha512 = "36ec810bab58e3d99478455a38427a5efbc74d6dd7d4bb93b700fd7429b9b89250efd0abe4609091483991802090c6373c8434dfc9ba64c79a778e51fd2a2886";
-    updateScript = import ./update.nix {
-      attrPath = "firefox-unwrapped";
-      inherit writeScript lib common-updater-scripts xidel coreutils gnused gnugrep curl;
-    };
-  };
-
-  firefox-esr-unwrapped = common {
-    pname = "firefox-esr";
-    version = "52.1.0esr";
-    sha512 = "ba833904654eda347f83df77e04c8e81572772e8555f187b796ecc30e498b93fb729b6f60935731d9584169adc9d61329155364fddf635cbd11abebe4a600247";
-    updateScript = import ./update.nix {
-      attrPath = "firefox-esr-unwrapped";
-      versionSuffix = "esr";
-      inherit writeScript lib common-updater-scripts xidel coreutils gnused gnugrep curl;
-    };
-  };
-
-}
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@ -0,0 +1,103 @@
+{ lib, callPackage, fetchurl, fetchFromGitHub }:
+
+let common = opts: callPackage (import ./common.nix opts); in
+
+rec {
+
+  firefox = common rec {
+    pname = "firefox";
+    version = "53.0";
+    src = fetchurl {
+      url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
+      sha512 = "36ec810bab58e3d99478455a38427a5efbc74d6dd7d4bb93b700fd7429b9b89250efd0abe4609091483991802090c6373c8434dfc9ba64c79a778e51fd2a2886";
+    };
+
+    meta = {
+      description = "A web browser built from Firefox source tree";
+      homepage = http://www.mozilla.com/en-US/firefox/;
+      maintainers = with lib.maintainers; [ eelco ];
+      platforms = lib.platforms.linux;
+    };
+    updateScript = callPackage ./update.nix {
+      attrPath = "firefox-unwrapped";
+    };
+  } {};
+
+  firefox-esr = common rec {
+    pname = "firefox-esr";
+    version = "52.1.0esr";
+    src = fetchurl {
+      url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
+      sha512 = "ba833904654eda347f83df77e04c8e81572772e8555f187b796ecc30e498b93fb729b6f60935731d9584169adc9d61329155364fddf635cbd11abebe4a600247";
+    };
+
+    meta = firefox.meta // {
+      description = "A web browser built from Firefox Extended Support Release source tree";
+    };
+    updateScript = callPackage ./update.nix {
+      attrPath = "firefox-esr-unwrapped";
+      versionSuffix = "esr";
+    };
+  } {};
+
+  tor-browser = common rec {
+    pname = "tor-browser";
+    version = "6.5.2";
+    isTorBrowserLike = true;
+
+    # FIXME: fetchFromGitHub is not ideal, unpacked source is >900Mb
+    src = fetchFromGitHub {
+      owner = "SLNOS";
+      repo  = "tor-browser";
+      rev   = "tor-browser-45.8.0esr-6.5-2";
+      sha256 = "0vbcp1qlxjlph0dqibylsyvb8iah3lnzdxc56hllpvbn51vrp39j";
+    };
+
+    overrides = {
+      unpackPhase = ''
+        # fetchFromGitHub produces ro sources, root dir gets a name that
+        # is too long for shebangs. fixing
+        cp -a $src .
+        mv *-src tor-browser
+        chmod -R +w tor-browser
+        cd tor-browser
+
+        # set times for xpi archives
+        find . -exec touch -d'2010-01-01 00:00' {} \;
+      '';
+    };
+
+    meta = {
+      description = "A web browser built from TorBrowser source tree";
+      longDescription = ''
+        This is a version of TorBrowser with bundle-related patches
+        reverted.
+
+        I.e. it's a variant of Firefox with less fingerprinting and
+        some isolation features you can't get with any extensions.
+
+        Or, alternatively, a variant of TorBrowser that works like any
+        other UNIX program and doesn't expect you to run it from a
+        bundle.
+
+        It will use your default Firefox profile if you're not careful
+        even! Be careful!
+
+        It will clash with firefox binary if you install both. But its
+        not a problem since you should run browsers in separate
+        users/VMs anyway.
+
+        Create new profile by starting it as
+
+        $ firefox -ProfileManager
+
+        and then configure it to use your tor instance.
+      '';
+      homepage = https://www.torproject.org/projects/torbrowser.html;
+      platforms = lib.platforms.linux;
+    };
+  } {
+    ffmpegSupport = false;
+  };
+
+}
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@ -99,7 +99,7 @@ let
 in

 stdenv.mkDerivation rec {
-  name = "tor-browser-${version}";
+  name = "tor-browser-bundle-bin-${version}";
  inherit version;

  src = srcs."${stdenv.system}" or (throw "unsupported system: ${stdenv.system}");
--- a/pkgs/applications/networking/cluster/marathon/default.nix
+++ b/pkgs/applications/networking/cluster/marathon/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "marathon-${version}";
-  version = "1.4.1";
+  version = "1.4.2";

  src = fetchurl {
    url = "https://downloads.mesosphere.com/marathon/v${version}/marathon-${version}.tgz";
-    sha256 = "1wpzsvvmk19qrwzwj7k12rngry1qriiqnjzq2q2pbpv5w0zb1fz5";
+    sha256 = "6eab65a95c87a989e922aca2b49ba872b50a94e46a8fd4831d1ab41f319d6932";
  };

  buildInputs = [ makeWrapper jdk mesos ];
--- a/pkgs/applications/networking/cluster/mesos/default.nix
+++ b/pkgs/applications/networking/cluster/mesos/default.nix
@ -22,7 +22,7 @@ let
  });

 in stdenv.mkDerivation rec {
-  version = "1.1.0";
+  version = "1.1.1";
  name = "mesos-${version}";

  enableParallelBuilding = true;
@ -30,7 +30,7 @@ in stdenv.mkDerivation rec {

  src = fetchurl {
    url = "mirror://apache/mesos/${version}/${name}.tar.gz";
-    sha256 = "1hdjd4syyp88l0bnh88bhzvn9466ad2ysfp9pq3kwj3qzwg5jv8g";
+    sha256 = "0f46ebb130d2d4a9732f95d0a71d80c8c5967f3c172b110f2ece316e05922115";
  };

  patches = [
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@ -37,7 +37,6 @@ let
        maintainers = with maintainers; [ jgeerds zimbatm peterhoeg ];
      };
    } // attrs');
-
 in {
  terraform_0_8_5 = generic {
    version = "0.8.5";
@ -49,15 +48,13 @@ in {
    sha256 = "0ibgpcpvz0bmn3cw60nzsabsrxrbmmym1hv7fx6zmjxiwd68w5gb";
  };

-  terraform_0_9_3 = generic {
-    version = "0.9.3";
-    sha256 = "00z72lwv0cprz1jjy0cr8dicl00zwc1zwsxzjssqnq0187sswkxw";
-
+  terraform_0_9_4 = generic {
+    version   = "0.9.4";
+    sha256    = "07vcmjyl0y48hm5lqqzdd51hmrxapvywzbdkg5f3rcqd7dn9c2xs";
    postPatch = ''
      rm builtin/providers/dns/data_dns_cname_record_set_test.go
      rm builtin/providers/vsphere/resource_vsphere_file_test.go
    '';
-
-    doCheck = true;
+    doCheck   = true;
  };
 }
--- a/pkgs/applications/networking/dropbox/default.nix
+++ b/pkgs/applications/networking/dropbox/default.nix
@ -23,11 +23,11 @@
 let
  # NOTE: When updating, please also update in current stable,
  # as older versions stop working
-  version = "24.4.16";
+  version = "24.4.17";
  sha256 =
    {
-      "x86_64-linux" = "01hnx52ag7wfclxnqzs9m09pnmisz9lczxgg3wm47qmwhagnb8la";
-      "i686-linux"   = "1cr0vfjwn60xdv2kh6kmmgf6g0s2y9mqklbfah59pm7k2yr2pvnf";
+      "x86_64-linux" = "1wjr92vrbxyjbwyqf134h8fp1zi4d5wyyirii545wqadbgg9grh9";
+      "i686-linux"   = "1qsdidpy251irzkv0hx0ch0xnrwq6wq6b22g0n8b9d0a7xi08k7h";
    }."${stdenv.system}" or (throw "system ${stdenv.system} not supported");

  arch =
--- a/pkgs/applications/networking/instant-messengers/coyim/default.nix
+++ b/pkgs/applications/networking/instant-messengers/coyim/default.nix
@ -0,0 +1,24 @@
+{ stdenv, buildGoPackage, fetchFromGitHub, pkgconfig,
+  cairo, gdk_pixbuf, glib, gnome3, wrapGAppsHook  }:
+
+buildGoPackage rec {
+  name = "coyim-${version}";
+  version = "v0.3.7_1";
+
+  goPackagePath = "github.com/twstrike/coyim";
+
+  src = fetchFromGitHub {
+    owner = "twstrike";
+    repo = "coyim";
+    rev = "df2c52fe865d38fa27e8a7af1d87612e8c048805";
+    sha256 = "1sna1n9dz1crws6cb1yjhy2kznbngjlbiw2diycshvbfigf7y7xl";
+  };
+
+  nativeBuildInputs = [ pkgconfig wrapGAppsHook glib cairo gdk_pixbuf gnome3.gtk gnome3.defaultIconTheme ];
+
+  meta = {
+    description = "a safe and secure chat client";
+    homepage = https://coy.im/;
+    license = stdenv.lib.licenses.gpl3;
+  };
+}
--- a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
@ -0,0 +1,101 @@
+{ stdenv, fetchurl, dpkg, makeWrapper
+, alsaLib, atk, cairo, cups, curl, dbus, expat, fontconfig, freetype, glib, gnome2
+, libnotify, nspr, nss, systemd, xorg }:
+
+let
+
+  version = "5.1.0.1";
+
+  rpath = stdenv.lib.makeLibraryPath [
+    alsaLib
+    atk
+    cairo
+    cups
+    curl
+    dbus
+    expat
+    fontconfig
+    freetype
+    glib
+
+    gnome2.GConf
+    gnome2.gdk_pixbuf
+    gnome2.gtk
+    gnome2.pango
+
+    gnome2.gnome_keyring
+    
+    libnotify
+    nspr
+    nss
+    stdenv.cc.cc
+    systemd
+
+    xorg.libxkbfile
+    xorg.libX11
+    xorg.libXcomposite
+    xorg.libXcursor
+    xorg.libXdamage
+    xorg.libXext
+    xorg.libXfixes
+    xorg.libXi
+    xorg.libXrandr
+    xorg.libXrender
+    xorg.libXtst
+    xorg.libXScrnSaver
+    xorg.libxcb
+  ] + ":${stdenv.cc.cc.lib}/lib64";
+
+  src =
+    if stdenv.system == "x86_64-linux" then
+      fetchurl {
+        url = "https://repo.skype.com/latest/skypeforlinux-64.deb";
+        sha256 = "18v861x0n2q2jaglap8193sia476dwkwr0ccfzl29mi5ijma24ml";
+      }
+    else
+      throw "Skype for linux is not supported on ${stdenv.system}";
+
+in stdenv.mkDerivation {
+  name = "skypeforlinux-${version}";
+
+  system = "x86_64-linux";
+
+  inherit src;
+
+  buildInputs = [ dpkg makeWrapper ];
+
+  unpackPhase = "true";
+  installPhase = ''
+    mkdir -p $out
+    dpkg -x $src $out
+    cp -av $out/usr/* $out
+    rm -rf $out/opt $out/usr
+    rm $out/bin/skypeforlinux
+
+    # Otherwise it looks "suspicious"
+    chmod -R g-w $out
+  '';
+
+  postFixup = ''
+     patchelf \
+      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --set-rpath "$out/share/skypeforlinux:${rpath}" "$out/share/skypeforlinux/skypeforlinux"
+
+    ln -s "$out/share/skypeforlinux/skypeforlinux" "$out/bin/skypeforlinux"
+
+    # Fix the desktop link
+    substituteInPlace $out/share/applications/skypeforlinux.desktop \
+      --replace /usr/bin/ $out/bin/ \
+      --replace /usr/share/ $out/share/
+
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Linux client for skype";
+    homepage = "https://www.skype.com";
+    license = licenses.unfree;
+    maintainers = with stdenv.lib.maintainers; [ panaeon ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
+
--- a/pkgs/applications/networking/mailreaders/claws-mail/default.nix
+++ b/pkgs/applications/networking/mailreaders/claws-mail/default.nix
@ -2,7 +2,7 @@
 , curl, dbus, dbus_glib, enchant, gtk2, gnutls, gnupg, gpgme, hicolor_icon_theme
 , libarchive, libcanberra_gtk2, libetpan, libnotify, libsoup, libxml2, networkmanager
 , openldap , perl, pkgconfig, poppler, python, shared_mime_info, webkitgtk2
-, glib_networking, gsettings_desktop_schemas
+, glib_networking, gsettings_desktop_schemas, libSM, libytnef

 # Build options
 # TODO: A flag to build the manual.
@ -32,23 +32,27 @@ with stdenv.lib;

 stdenv.mkDerivation rec {
  name = "claws-mail-${version}";
-  version = "3.14.1";
+  version = "3.15.0";

  src = fetchurl {
    url = "http://www.claws-mail.org/download.php?file=releases/claws-mail-${version}.tar.xz";
-    sha256 = "0df34gj4r5cbb92834hph19gnh7ih9rgmmw47rliyg8b9z01v6mp";
+    sha256 = "0bnwd3l04y6j1nw3h861rdy6k6lyjzsi51j04d33vbpq8c6jskaf";
  };

  patches = [ ./mime.patch ];

+  hardeningDisable = [ "format" ];
+
  postPatch = ''
    substituteInPlace src/procmime.c \
        --subst-var-by MIMEROOTDIR ${shared_mime_info}/share
  '';

+  nativeBuildInputs = [ pkgconfig wrapGAppsHook ];
+
  buildInputs =
    [ curl dbus dbus_glib gtk2 gnutls gsettings_desktop_schemas hicolor_icon_theme
-      libetpan perl pkgconfig python wrapGAppsHook glib_networking
+      libetpan perl python glib_networking libSM libytnef
    ]
    ++ optional enableSpellcheck enchant
    ++ optionals (enablePgp || enablePluginSmime) [ gnupg gpgme ]
--- a/pkgs/applications/networking/p2p/transmission-remote-gtk/default.nix
+++ b/pkgs/applications/networking/p2p/transmission-remote-gtk/default.nix
@ -1,5 +1,6 @@
-{ stdenv, autoconf, automake, libtool, makeWrapper, fetchFromGitHub, pkgconfig
-, intltool, gtk3, json_glib, curl, glib, autoconf-archive, appstream-glib }:
+{ stdenv, autoconf, automake, libtool, wrapGAppsHook, fetchFromGitHub, pkgconfig
+, intltool, gtk3, json_glib, curl, glib, autoconf-archive, appstream-glib
+, hicolor_icon_theme }:


 stdenv.mkDerivation rec {
@ -15,18 +16,12 @@ stdenv.mkDerivation rec {

  preConfigure = "./autogen.sh";

-  nativeBuildInputs= [ 
-    autoconf automake libtool makeWrapper 
-    pkgconfig intltool autoconf-archive 
+  nativeBuildInputs= [
+    autoconf automake libtool wrapGAppsHook
+    pkgconfig intltool autoconf-archive
    appstream-glib
  ];
-  buildInputs = [ gtk3 json_glib curl glib ];
-
-  preFixup = ''
-    wrapProgram "$out/bin/transmission-remote-gtk" \
-      --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH"
-    rm $out/share/icons/hicolor/icon-theme.cache
-  '';
+  buildInputs = [ gtk3 json_glib curl glib hicolor_icon_theme ];

  meta = with stdenv.lib;
    { description = "GTK remote control for the Transmission BitTorrent client";
--- a/pkgs/applications/networking/remote/teamviewer/default.nix
+++ b/pkgs/applications/networking/remote/teamviewer/default.nix
@ -16,13 +16,13 @@ in

 stdenv.mkDerivation rec {
  name = "teamviewer-${version}";
-  version = "12.0.71510";
+  version = "12.0.76279";

  src = fetchurl {
    # There is a 64-bit package, but it has no differences apart from Debian dependencies.
    # Generic versioned packages (teamviewer_${version}_i386.tar.xz) are not available for some reason.
    url = "http://download.teamviewer.com/download/teamviewer_${version}_i386.deb";
-    sha256 = "0f2qc2rpxk7zsyfxlsfr5gwbs9vhnzc3z7ib677pnr99bz06hbqp";
+    sha256 = "15yhx66zxbjk0x3dpfg39gb1f2ajcp9kbp4zi58bfnvby277jl00";
  };

  unpackPhase = ''
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@ -1,14 +1,14 @@
 { stdenv, lib, fetchFromGitHub, go, pkgs, removeReferencesTo }:

 stdenv.mkDerivation rec {
-  version = "0.14.26";
+  version = "0.14.27";
  name = "syncthing-${version}";

  src = fetchFromGitHub {
    owner  = "syncthing";
    repo   = "syncthing";
    rev    = "v${version}";
-    sha256 = "1ny41fj8gg555awqcsyvsjs1zghjlwciwhyxjh5ly16hzaixn499";
+    sha256 = "0i82r2ygcz63pidn1glxz9szgkb7yql6lhwwcqh8b1xnkrvvkz71";
  };

  buildInputs = [ go removeReferencesTo ];
--- a/pkgs/applications/office/beancount/bean-add.nix
+++ b/pkgs/applications/office/beancount/bean-add.nix
@ -1,13 +1,13 @@
 { stdenv, fetchFromGitHub, python3Packages }:

 stdenv.mkDerivation rec {
-  name = "bean-add-2017-01-20";
+  name = "bean-add-2017-04-06";

  src = fetchFromGitHub {
    owner = "simon-v";
    repo = "bean-add";
-    rev = "752674259fb9512e076ef2048927fb791ad21507";
-    sha256 = "1ja26dgl2j25873s5nav57pjaqb9rr3mdbmkawajz2gdkk9r7n61";
+    rev = "67c3cd345dc370f8cd967a31549c1d0b86b07024";
+    sha256 = "0902lvwmf7k1h6gn3ilwzk20pxphbxsa3rn68jfhhfqpr6xpqf93";
  };

  propagatedBuildInputs = with python3Packages; [ python ];
--- a/pkgs/applications/science/logic/coq/HEAD.nix
+++ b/pkgs/applications/science/logic/coq/HEAD.nix
@ -1,31 +1,34 @@
-# - coqide compilation can be disabled by setting lablgtk to null;
+# - coqide compilation can be disabled by setting buildIde to false;
 # - The csdp program used for the Micromega tactic is statically referenced.
 #   However, coq can build without csdp by setting it to null.
 #   In this case some Micromega tactics will search the user's path for the csdp program and will fail if it is not found.

-{stdenv, fetchgit, writeText, pkgconfig, ocaml, findlib, camlp5, ncurses, lablgtk ? null, csdp ? null}:
+{stdenv, fetchgit, writeText, pkgconfig, ocamlPackages_4_02, ncurses, buildIde ? true, csdp ? null}:

 let
-  version = "8.6pre-0c999f02";
+  version = "2017-02-03";
  coq-version = "8.6";
-  buildIde = lablgtk != null;
-  ideFlags = if buildIde then "-lablgtkdir ${lablgtk}/lib/ocaml/*/site-lib/lablgtk2 -coqide opt" else "";
+  ideFlags = if buildIde then "-lablgtkdir ${ocamlPackages_4_02.lablgtk}/lib/ocaml/*/site-lib/lablgtk2 -coqide opt" else "";
  csdpPatch = if csdp != null then ''
    substituteInPlace plugins/micromega/sos.ml --replace "; csdp" "; ${csdp}/bin/csdp"
    substituteInPlace plugins/micromega/coq_micromega.ml --replace "System.is_in_system_path \"csdp\"" "true"
  '' else "";
+  ocaml = ocamlPackages_4_02.ocaml;
+  findlib = ocamlPackages_4_02.findlib;
+  lablgtk = ocamlPackages_4_02.lablgtk;
+  camlp5 = ocamlPackages_4_02.camlp5_transitional;
 in

 stdenv.mkDerivation {
-  name = "coq-${version}";
+  name = "coq-unstable-${version}";

  inherit coq-version;
-  inherit ocaml camlp5;
+  inherit ocaml camlp5 findlib;

  src = fetchgit {
    url = git://scm.gforge.inria.fr/coq/coq.git;
-    rev = "ad768e435a736ca51ac79a575967b388b34918c7";
-    sha256 = "05s7sk1l3mvdjag3idnhkpj707y4bv56da7kpffw862f2qgfr77j";
+    rev = "078598d029792a3d9a54fae9b9ac189b75bc3b06";
+    sha256 = "0sflrpp6x0ada0bjh67q1x65g88d179n3cawpwkp1pm4kw76g8x7";
  };

  buildInputs = [ pkgconfig ocaml findlib camlp5 ncurses lablgtk ];
--- a/pkgs/applications/science/math/R/default.nix
+++ b/pkgs/applications/science/math/R/default.nix
@ -7,11 +7,11 @@
 }:

 stdenv.mkDerivation rec {
-  name = "R-3.3.3";
+  name = "R-3.4.0";

  src = fetchurl {
    url = "http://cran.r-project.org/src/base/R-3/${name}.tar.gz";
-    sha256 = "0v7wpj89b0i3ad3fi1wak5c93hywmbxv8sdnixhq8l17782nidss";
+    sha256 = "14cb8bwi3akvdb6934kqic2862f2qgav6cq4g0h7gi2p4ka9x3i8";
  };

  buildInputs = [
@ -62,7 +62,7 @@ stdenv.mkDerivation rec {
  installTargets = [ "install" "install-info" "install-pdf" ];

  doCheck = true;
-  preCheck = "bin/Rscript -e 'sessionInfo()'";
+  preCheck = "export TZ=CET; bin/Rscript -e 'sessionInfo()'";

  enableParallelBuilding = true;

--- a/pkgs/applications/science/math/geogebra/default.nix
+++ b/pkgs/applications/science/math/geogebra/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  name = "geogebra-${version}";
-  version = "5-0-350-0";
+  version = "5-0-355-0";

  preferLocalBuild = true;

  src = fetchurl {
    url = "http://download.geogebra.org/installers/5.0/GeoGebra-Linux-Portable-${version}.tar.bz2";
-    sha256 = "0lr2calglad5d17p5sl1jbjdfsdsmn4dxgy8s89lyh0d4aihy54d";
+    sha256 = "0gm6jqlc3kgnbwnqlz6i9rahdy802jq7xc9gw1q5ynk63smm3ngk";
  };

  srcIcon = fetchurl {
--- a/pkgs/applications/science/math/speedcrunch/default.nix
+++ b/pkgs/applications/science/math/speedcrunch/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchgit, cmake, qtbase, qttools }:
+{ stdenv, fetchgit, cmake, makeQtWrapper, qtbase, qttools }:

 stdenv.mkDerivation rec {
  name = "speedcrunch-${version}";
@ -11,14 +11,20 @@ stdenv.mkDerivation rec {
    sha256 = "0vh7cd1915bjqzkdp3sk25ngy8cq624mkh8c53c5bnzk357kb0fk";
  };

+  enableParallelBuilding = true;
+
  buildInputs = [ qtbase qttools ];

-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake makeQtWrapper ];

  preConfigure = ''
    cd src
  '';

+  postFixup = ''
+    wrapQtProgram $out/bin/speedcrunch
+  '';
+
  meta = with stdenv.lib; {
    homepage    = http://speedcrunch.org;
    license     = licenses.gpl2Plus;
@ -30,7 +36,8 @@ stdenv.mkDerivation rec {
      full keyboard-friendly and more than 15 built-in math function.
    '';
    maintainers = with maintainers; [ gebner ];
-    platforms = platforms.all;
-    broken = builtins.compareVersions qtbase.version "5.8.0" >= 0;
+    inherit (qtbase.meta) platforms;
+    # works with qt 5.6 and qt 5.8
+    broken = builtins.compareVersions qtbase.version "5.7.0" == 0;
  };
 }
--- a/pkgs/applications/virtualization/xen/generic.nix
+++ b/pkgs/applications/virtualization/xen/generic.nix
@ -107,7 +107,8 @@ stdenv.mkDerivation (rec {
    # We want to do this before getting prefetched stuff to speed things up
    # (prefetched stuff has lots of files)
    find . -type f | xargs sed -i 's@/usr/bin/\(python\|perl\)@/usr/bin/env \1@g'
-    find . -type f | xargs sed -i 's@/bin/bash@/bin/sh@g'
+    find . -type f -not -path "./tools/hotplug/Linux/xendomains.in" \
+      | xargs sed -i 's@/bin/bash@/bin/sh@g'

    # Get prefetched stuff
    ${withXenfiles (name: x: ''
@ -171,6 +172,11 @@ stdenv.mkDerivation (rec {
    ${config.postPatch or ""}
  '';

+  postConfigure = ''
+    substituteInPlace tools/hotplug/Linux/xendomains \
+      --replace /bin/ls ls
+  '';
+
  # TODO: Flask needs more testing before enabling it by default.
  #makeFlags = "XSM_ENABLE=y FLASK_ENABLE=y PREFIX=$(out) CONFIG_DIR=/etc XEN_EXTFILES_URL=\\$(XEN_ROOT)/xen_ext_files ";
  makeFlags = [ "PREFIX=$(out) CONFIG_DIR=/etc" "XEN_SCRIPT_DIR=/etc/xen/scripts" ]
--- a/pkgs/build-support/fetchdarcs/default.nix
+++ b/pkgs/build-support/fetchdarcs/default.nix
@ -1,10 +1,13 @@
-{stdenv, darcs, nix}: {url, rev ? null, context ? null, md5 ? "", sha256 ? ""}:
+{stdenv, darcs, nix, cacert}:
+
+{url, rev ? null, context ? null, md5 ? "", sha256 ? ""}:

 if md5 != "" then
  throw "fetchdarcs does not support md5 anymore, please use sha256"
 else
 stdenv.mkDerivation {
  name = "fetchdarcs";
+  SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
  builder = ./builder.sh;
  buildInputs = [darcs];

--- a/pkgs/build-support/fetchs3/default.nix
+++ b/pkgs/build-support/fetchs3/default.nix
@ -0,0 +1,29 @@
+{ stdenv, runCommand, awscli }:
+
+{ s3url
+, sha256
+, region ? "us-east-1"
+, credentials ? null # Default to looking at local EC2 metadata service
+, executable ? false
+, recursiveHash ? false
+, postFetch ? null
+}:
+
+let
+  credentialAttrs = stdenv.lib.optionalAttrs (credentials != null) {
+    AWS_ACCESS_KEY_ID = credentials.access_key_id;
+    AWS_SECRET_ACCESS_KEY = credentials.secret_access_key;
+    AWS_SESSION_TOKEN = credentials.session_token ? null;
+  };
+in runCommand "foo" ({
+  buildInputs = [ awscli ];
+  outputHashAlgo = "sha256";
+  outputHash = sha256;
+  outputHashMode = if recursiveHash then "recursive" else "flat";
+} // credentialAttrs) (if postFetch != null then ''
+  downloadedFile="$(mktemp)"
+  aws s3 cp ${s3url} $downloadedFile
+  ${postFetch}
+'' else  ''
+  aws s3 cp ${s3url} $out
+'')
--- a/pkgs/build-support/grsecurity/default.nix
+++ b/pkgs/build-support/grsecurity/default.nix
@ -1,37 +0,0 @@
-{ stdenv
-, lib
-, overrideDerivation
-
-# required for gcc plugins
-, gmp, libmpc, mpfr
-
-# the base kernel
-, kernel
-
-, grsecPatch
-, kernelPatches ? []
-
-, localver ? "-grsec"
-, modDirVersion ? "${kernel.version}${localver}"
-, extraConfig ? ""
-, ...
-} @ args:
-
-assert (kernel.version == grsecPatch.kver);
-
-overrideDerivation (kernel.override {
-  inherit modDirVersion;
-  kernelPatches = lib.unique ([ grsecPatch ] ++ kernelPatches ++ (kernel.kernelPatches or []));
-  extraConfig = ''
-    GRKERNSEC y
-    PAX y
-    ${extraConfig}
-  '';
-  ignoreConfigErrors = true;
-}) (attrs: {
-  nativeBuildInputs = (lib.chooseDevOutputs [ gmp libmpc mpfr ]) ++ (attrs.nativeBuildInputs or []);
-  preConfigure = ''
-    echo ${localver} >localversion-grsec
-    ${attrs.preConfigure or ""}
-  '';
-})
--- a/pkgs/build-support/setup-hooks/wrap-gapps-hook.sh
+++ b/pkgs/build-support/setup-hooks/wrap-gapps-hook.sh
@ -35,10 +35,16 @@ wrapGAppsHook() {
    gappsWrapperArgs+=(--prefix $v : "$dummy")
  done

-  if [ -z "$dontWrapGApps" ]; then
-    for i in $prefix/bin/* $prefix/libexec/*; do
-      echo "Wrapping app $i"
-      wrapProgram "$i" "${gappsWrapperArgs[@]}"
+  if [[ -z "$dontWrapGApps" ]]; then
+    targetDirs=( "${prefix}/bin" "${prefix}/libexec" )
+    for targetDir in "${targetDirs[@]}"; do
+      if [[ -d "${targetDir}" ]]; then
+        find "${targetDir}" -type f -executable -print0 \
+          | while IFS= read -r -d '' file; do
+          echo "Wrapping program ${file}"
+          wrapProgram "${file}" "${gappsWrapperArgs[@]}"
+        done
+      fi
    done
  fi
 }
--- a/pkgs/desktops/enlightenment/efl.nix
+++ b/pkgs/desktops/enlightenment/efl.nix
@ -1,12 +1,18 @@
-{ stdenv, fetchurl, pkgconfig, openssl, libjpeg, zlib, lz4, freetype, fontconfig, fribidi, SDL2, SDL, mesa, giflib, libpng, libtiff, glib, gst_all_1, libpulseaudio, libsndfile, xorg, libdrm, libxkbcommon, udev, utillinux, dbus, bullet, luajit, python27Packages, openjpeg, doxygen, expat, harfbuzz, jbig2dec, librsvg, dbus_libs, alsaLib, poppler, ghostscript, libraw, libspectre, xineLib, libwebp, curl, libinput, systemd }:
+{ stdenv, fetchurl, pkgconfig, openssl, libjpeg, zlib, lz4, freetype, fontconfig
+, fribidi, SDL2, SDL, mesa, giflib, libpng, libtiff, glib, gst_all_1, libpulseaudio
+, libsndfile, xorg, libdrm, libxkbcommon, udev, utillinux, dbus, bullet, luajit
+, python27Packages, openjpeg, doxygen, expat, harfbuzz, jbig2dec, librsvg
+, dbus_libs, alsaLib, poppler, ghostscript, libraw, libspectre, xineLib, libwebp
+, curl, libinput, systemd, writeText
+}:

 stdenv.mkDerivation rec {
  name = "efl-${version}";
-  version = "1.18.4";
+  version = "1.19.0";

  src = fetchurl {
    url = "http://download.enlightenment.org/rel/libs/efl/${name}.tar.xz";
-    sha256 = "09c0ajszjarcs6d62zlgnf1aha2f921mfr0gxg6nwza36xzc1srr";
+    sha256 = "1pza8lacqh3bgsvcm4h2hyc577bvnzix932g87dhg03ph4839q54";
  };

  nativeBuildInputs = [ pkgconfig ];
@ -24,16 +30,35 @@ stdenv.mkDerivation rec {
    libinput ];

  # ac_ct_CXX must be set to random value, because then it skips some magic which does alternative searching for g++
-  configureFlags = [ "--enable-sdl" "--enable-drm" "--enable-elput" "--with-opengl=full"
-    "--enable-image-loader-jp2k" "--enable-xinput22" "--enable-multisense" "--enable-liblz4" "--enable-systemd"
-    "--enable-image-loader-webp" "--enable-harfbuzz" "--enable-xine" "--enable-fb"
-    "--disable-tslib" "--with-systemdunitdir=$out/systemd/user"
-    "ac_ct_CXX=foo" ];
+  configureFlags = [
+    "--enable-sdl"
+    "--enable-drm"
+    "--enable-elput"
+    "--with-opengl=full"
+    "--enable-image-loader-jp2k"
+    "--enable-xinput22"
+    "--enable-multisense"
+    "--enable-liblz4"
+    "--enable-systemd"
+    "--enable-image-loader-webp"
+    "--enable-harfbuzz"
+    "--enable-xine"
+    "--enable-fb"
+    "--disable-tslib"
+    "--with-systemdunitdir=$out/systemd/user"
+    "ac_ct_CXX=foo"
+  ];

  patches = [ ./efl-elua.patch ];

+  # bin/edje_cc creates $HOME/.run, which would break build of reverse dependencies.
+  setupHook = writeText "setupHook.sh" ''
+    export HOME="$TEMPDIR"
+  '';
+
  preConfigure = ''
    export LD_LIBRARY_PATH="$(pwd)/src/lib/eina/.libs:$LD_LIBRARY_PATH"
+    source "$setupHook"
  '';

  postInstall = ''
@ -48,8 +73,8 @@ stdenv.mkDerivation rec {
  meta = {
    description = "Enlightenment foundation libraries";
    homepage = http://enlightenment.org/;
-    maintainers = with stdenv.lib.maintainers; [ matejc tstrobel ftrvxmtrx ];
    platforms = stdenv.lib.platforms.linux;
    license = stdenv.lib.licenses.lgpl3;
+    maintainers = with stdenv.lib.maintainers; [ matejc tstrobel ftrvxmtrx ];
  };
 }
--- a/Show More
+++ b/Show More