Merge master into staging-next

doc/coding-conventions.xml

@@ -56,25 +56,30 @@ foo { arg = ...; }
      or list elements should be aligned:
 <programlisting>
 # A long list.
-list =
+list = [
-  [ elem1
+  elem1
-    elem2
+  elem2
-    elem3
+  elem3
-  ];
+];
 
 # A long attribute set.
-attrs =
-  { attr1 = short_expr;
-    attr2 =
-      if true then big_expr else big_expr;
-  };
-
-# Alternatively:
 attrs = {
   attr1 = short_expr;
   attr2 =
     if true then big_expr else big_expr;
 };
+
+# Combined
+listOfAttrs = [
+  {
+    attr1 = 3;
+    attr2 = "fff";
+  }
+  {
+    attr1 = 5;
+    attr2 = "ggg";
+  }
+];
 </programlisting>
     </para>
    </listitem>

doc/cross-compilation.xml

@@ -385,7 +385,7 @@ nix-build <nixpkgs> --arg crossSystem '(import <nixpkgs/lib>).system
     Eventually we would like to make these platform examples an unnecessary
     convenience so that
 <programlisting>
-nix-build &lt;nixpkgs&gt; --arg crossSystem.config '&lt;arch&gt;-&lt;os&gt;-&lt;vendor&gt;-&lt;abi&gt;' -A whatever</programlisting>
+nix-build &lt;nixpkgs&gt; --arg crossSystem '{ config = "&lt;arch&gt;-&lt;os&gt;-&lt;vendor&gt;-&lt;abi&gt;"; }' -A whatever</programlisting>
     works in the vast majority of cases. The problem today is dependencies on
     other sorts of configuration which aren't given proper defaults. We rely on
     the examples to crudely to set those configuration parameters in some

doc/languages-frameworks/ruby.xml

@@ -50,6 +50,17 @@ bundlerEnv rec {
   future updates can be run easily.
  </para>
 
+ <para>
+  Updating Ruby packages can then be done like this:
+ </para>
+
+<screen>
+<![CDATA[$ cd pkgs/servers/monitoring/sensu
+$ nix-shell -p bundler --run 'bundle lock --update'
+$ nix-shell -p bundix --run 'bundix'
+]]>
+</screen>
+
  <para>
   For tools written in Ruby - i.e. where the desire is to install a package and
   then execute e.g. <command>rake</command> at the command line, there is an

doc/stdenv.xml

@@ -2428,12 +2428,31 @@ addEnvHooks "$hostOffset" myBashFunction
       <para>
        This is a special setup hook which helps in packaging proprietary
        software in that it automatically tries to find missing shared library
-       dependencies of ELF files. All packages within the
+       dependencies of ELF files based on the given
-       <envar>runtimeDependencies</envar> environment variable are
+       <varname>buildInputs</varname> and <varname>nativeBuildInputs</varname>.
-       unconditionally added to executables, which is useful for programs that
+      </para>
-       use <citerefentry>
+      <para>
-       <refentrytitle>dlopen</refentrytitle>
+       You can also specify a <envar>runtimeDependencies</envar> environment
-       <manvolnum>3</manvolnum> </citerefentry> to load libraries at runtime.
+       variable which lists dependencies that are unconditionally added to all
+       executables.
+      </para>
+      <para>
+       This is useful for programs that use <citerefentry>
+        <refentrytitle>dlopen</refentrytitle>
+        <manvolnum>3</manvolnum>
+       </citerefentry> to load libraries at runtime.
+      </para>
+      <para>
+        In certain situations you may want to run the main command
+        (<command>autoPatchelf</command>) of the setup hook on a file or a set
+        of directories instead of unconditionally patching all outputs. This
+        can be done by setting the <envar>dontAutoPatchelf</envar> environment
+        variable to a non-empty value.
+      </para>
+      <para>
+        The <command>autoPatchelf</command> command also recognizes a
+        <parameter class="command">--no-recurse</parameter> command line flag,
+        which prevents it from recursing into subdirectories.
       </para>
      </listitem>
     </varlistentry>
@@ -2455,7 +2474,17 @@ addEnvHooks "$hostOffset" myBashFunction
        use the cntr exec subcommand. Note that <command>cntr</command> also
        needs to be executed on the machine that is doing the build, which might
        be not the case when remote builders are enabled.
-       <command>cntr</command> is only supported on linux based platforms.
+       <command>cntr</command> is only supported on Linux-based platforms. To
+       use it first add <literal>cntr</literal> to your
+       <literal>environment.systemPackages</literal> on NixOS or alternatively to
+       the root user on non-NixOS systems. Then in the package that is supposed
+       to be inspected, add <literal>breakpointHook</literal> to
+       <literal>nativeBuildInputs</literal>.
+<programlisting>
+         nativeBuildInputs = [ breakpointHook ];
+       </programlisting>
+       When a build failure happens there will be an instruction printed that
+       shows how to attach with <literal>cntr</literal> to the build sandbox.
       </para>
      </listitem>
     </varlistentry>

nixos/doc/manual/configuration/modularity.xml

@@ -127,4 +127,23 @@ nix-repl> map (x: x.hostName) config.<xref linkend="opt-services.httpd.virtualHo
 [ "example.org" "example.gov" ]
 </screen>
  </para>
+
+ <para>
+   While abstracting your configuration, you may find it useful to generate
+   modules using code, instead of writing files. The example
+   below would have the same effect as importing a file which sets those
+   options.
+   <screen>
+     { config, pkgs, ... }:
+
+     let netConfig = { hostName }: {
+       networking.hostName = hostName;
+       networking.useDHCP = false;
+    };
+
+    in
+
+    { imports = [ (netConfig "nixos.localdomain") ]; }
+  </screen>
+</para>
 </section>

nixos/doc/manual/development/running-nixos-tests-interactively.xml

@@ -19,7 +19,7 @@ starting VDE switch for network 1
 > startAll
 > testScript
 > $machine->succeed("touch /tmp/foo")
-> print($machine->succeed("pwd"), "\n") # Show stdout of command
+> print($machine->succeed("pwd")) # Show stdout of command
 </screen>
   The function <command>testScript</command> executes the entire test script
   and drops you back into the test driver command line upon its completion.

nixos/doc/manual/development/writing-nixos-tests.xml

@@ -108,7 +108,7 @@ xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/virtualis
 <programlisting>
 $machine->start;
 $machine->waitForUnit("default.target");
-die unless $machine->succeed("uname") =~ /Linux/;
+$machine->succeed("uname") =~ /Linux/ or die;
 </programlisting>
   The first line is actually unnecessary; machines are implicitly started when
   you first execute an action on them (such as <literal>waitForUnit</literal>

nixos/doc/manual/release-notes/rl-1903.xml

@@ -111,6 +111,16 @@
       without Syncthing resetting the permission on every start.
     </para>
    </listitem>
+   <listitem>
+    <para>
+      The <literal>ntp</literal> module now has sane default restrictions.
+      If you're relying on the previous defaults, which permitted all queries
+      and commands from all firewall-permitted sources, you can set
+      <varname>services.ntp.restrictDefault</varname> and
+      <varname>services.ntp.restrictSource</varname> to
+      <literal>[]</literal>.
+    </para>
+   </listitem>
    <listitem>
     <para>
      Package <varname>rabbitmq_server</varname> is renamed to

nixos/lib/testing.nix

@@ -1,5 +1,5 @@
 { system
-, pkgs
+, pkgs ? import ../.. { inherit system config; }
   # Use a minimal kernel?
 , minimal ? false
   # Ignored

nixos/maintainers/scripts/gce/create-gce.sh

@@ -7,9 +7,9 @@ BUCKET_NAME="${BUCKET_NAME:-nixos-cloud-images}"
 TIMESTAMP="$(date +%Y%m%d%H%M)"
 export TIMESTAMP
 
-nix-build '<nixpkgs/nixos>' \
+nix-build '<nixpkgs/nixos/lib/eval-config.nix>' \
    -A config.system.build.googleComputeImage \
-   --arg configuration "{ imports = [ <nixpkgs/nixos/modules/virtualisation/google-compute-image.nix> ]; }" \
+   --arg modules "[ <nixpkgs/nixos/modules/virtualisation/google-compute-image.nix> ]" \
    --argstr system x86_64-linux \
    -o gce \
    -j 10

nixos/modules/installer/cd-dvd/sd-image.nix

@@ -134,7 +134,9 @@ in
         ${config.sdImage.populateBootCommands}
 
         # Copy the populated /boot into the SD image
-        (cd boot; mcopy -bpsvm -i ../bootpart.img ./* ::)
+        (cd boot; mcopy -psvm -i ../bootpart.img ./* ::)
+        # Verify the FAT partition before copying it.
+        fsck.vfat -vn bootpart.img
         dd conv=notrunc if=bootpart.img of=$img seek=$START count=$SECTORS
       '';
     }) {};

nixos/modules/programs/sway-beta.nix

@@ -8,7 +8,7 @@ let
 
   swayWrapped = pkgs.writeShellScriptBin "sway" ''
     ${cfg.extraSessionCommands}
-    exec ${pkgs.dbus.dbus-launch} --exit-with-session ${swayPackage}/bin/sway
+    exec ${pkgs.dbus.dbus-launch} --exit-with-session ${swayPackage}/bin/sway "$@"
   '';
   swayJoined = pkgs.symlinkJoin {
     name = "sway-joined";

nixos/modules/services/cluster/kubernetes/default.nix

@@ -784,7 +784,7 @@ in {
     clusterCidr = mkOption {
       description = "Kubernetes controller manager and proxy CIDR Range for Pods in cluster.";
       default = "10.1.0.0/16";
-      type = types.str;
+      type = types.nullOr types.str;
     };
 
     flannel.enable = mkOption {
@@ -1018,9 +1018,9 @@ in {
             ${if (cfg.controllerManager.rootCaFile!=null)
               then "--root-ca-file=${cfg.controllerManager.rootCaFile}"
               else "--root-ca-file=/var/run/kubernetes/apiserver.crt"} \
-            ${optionalString (cfg.clusterCidr!=null)
+            ${if (cfg.clusterCidr!=null)
-              "--cluster-cidr=${cfg.clusterCidr}"} \
+              then "--cluster-cidr=${cfg.clusterCidr} --allocate-node-cidrs=true"
-            --allocate-node-cidrs=true \
+              else "--allocate-node-cidrs=false"} \
             ${optionalString (cfg.controllerManager.featureGates != [])
               "--feature-gates=${concatMapStringsSep "," (feature: "${feature}=true") cfg.controllerManager.featureGates}"} \
             ${optionalString cfg.verbose "--v=6"} \

nixos/modules/services/databases/postgresql.nix

@@ -238,6 +238,9 @@ in
             User = "postgres";
             Group = "postgres";
             PermissionsStartOnly = true;
+            Type = if lib.versionAtLeast cfg.package.version "9.6"
+                   then "notify"
+                   else "simple";
 
             # Shut down Postgres using SIGINT ("Fast Shutdown mode").  See
             # http://www.postgresql.org/docs/current/static/server-shutdown.html

nixos/modules/services/networking/ntpd.nix

@@ -15,6 +15,10 @@ let
   configFile = pkgs.writeText "ntp.conf" ''
     driftfile ${stateDir}/ntp.drift
 
+    restrict default ${toString cfg.restrictDefault}
+    restrict -6 default ${toString cfg.restrictDefault}
+    restrict source ${toString cfg.restrictSource}
+
     restrict 127.0.0.1
     restrict -6 ::1
 
@@ -36,11 +40,40 @@ in
       enable = mkOption {
         default = false;
         description = ''
-          Whether to synchronise your machine's time using the NTP
+          Whether to synchronise your machine's time using ntpd, as a peer in
-          protocol.
+          the NTP network.
+          </para>
+          <para>
+          Disables <literal>systemd.timesyncd</literal> if enabled.
         '';
       };
 
+      restrictDefault = mkOption {
+        type = types.listOf types.str;
+        description = ''
+          The restriction flags to be set by default.
+          </para>
+          <para>
+          The default flags prevent external hosts from using ntpd as a DDoS
+          reflector, setting system time, and querying OS/ntpd version. As
+          recommended in section 6.5.1.1.3, answer "No" of
+          http://support.ntp.org/bin/view/Support/AccessRestrictions
+        '';
+        default = [ "limited" "kod" "nomodify" "notrap" "noquery" "nopeer" ];
+      };
+
+      restrictSource = mkOption {
+        type = types.listOf types.str;
+        description = ''
+          The restriction flags to be set on source.
+          </para>
+          <para>
+          The default flags allow peers to be added by ntpd from configured
+          pool(s), but not by other means.
+        '';
+        default = [ "limited" "kod" "nomodify" "notrap" "noquery" ];
+      };
+
       servers = mkOption {
         default = config.networking.timeServers;
         description = ''
@@ -51,6 +84,7 @@ in
       extraFlags = mkOption {
         type = types.listOf types.str;
         description = "Extra flags passed to the ntpd command.";
+        example = literalExample ''[ "--interface=eth0" ]'';
         default = [];
       };
 

nixos/modules/services/x11/urxvtd.nix

@@ -18,27 +18,17 @@ in {
   };
 
   config = mkIf cfg.enable {
-    systemd.user = {
+    systemd.user.services.urxvtd = {
-      sockets.urxvtd = {
+      description = "urxvt terminal daemon";
-        description = "socket for urxvtd, the urxvt terminal daemon";
+      wantedBy = [ "graphical-session.target" ];
-        wantedBy = [ "graphical-session.target" ];
+      partOf = [ "graphical-session.target" ];
-        partOf = [ "graphical-session.target" ];
+      path = [ pkgs.xsel ];
-        socketConfig = {
+      serviceConfig = {
-          ListenStream = "%t/urxvtd-socket";
+        ExecStart = "${pkgs.rxvt_unicode-with-plugins}/bin/urxvtd -o";
-        };
+        Environment = "RXVT_SOCKET=%t/urxvtd-socket";
+        Restart = "on-failure";
+        RestartSec = "5s";
       };
-
-      services.urxvtd = {
-        description = "urxvt terminal daemon";
-        path = [ pkgs.xsel ];
-        serviceConfig = {
-          ExecStart = "${pkgs.rxvt_unicode-with-plugins}/bin/urxvtd -o";
-          Environment = "RXVT_SOCKET=%t/urxvtd-socket";
-          Restart = "on-failure";
-          RestartSec = "5s";
-        };
-      };
-
     };
 
     environment.systemPackages = [ pkgs.rxvt_unicode-with-plugins ];

nixos/modules/system/boot/systemd-nspawn.nix

@@ -112,7 +112,7 @@ in {
 
       environment.etc."systemd/nspawn".source = generateUnits "nspawn" units [] [];
 
-      systemd.targets."multi-user".wants = [ "machines.target "];
+      systemd.targets."multi-user".wants = [ "machines.target" ];
   };
 
 }

nixos/modules/virtualisation/container-config.nix

@@ -22,12 +22,8 @@ with lib;
     # Not supported in systemd-nspawn containers.
     security.audit.enable = false;
 
-    # Make sure that root user in container will talk to host nix-daemon
+    # Use the host's nix-daemon.
-    environment.etc."profile".text = ''
+    environment.variables.NIX_REMOTE = "daemon";
-    export NIX_REMOTE=daemon
-    '';
-
-
 
   };
 

nixos/modules/virtualisation/google-compute-config.nix

@@ -1,5 +1,261 @@
-{ ... }:
+{ config, lib, pkgs, ... }:
-
+with lib;
+let
+  gce = pkgs.google-compute-engine;
+  cfg = config.virtualisation.googleComputeImage;
+in
 {
-  imports = [ <nixpkgs/nixos/modules/virtualisation/google-compute-image.nix> ];
+  imports = [
+    ../profiles/headless.nix
+    ../profiles/qemu-guest.nix
+  ];
+
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/nixos";
+    autoResize = true;
+  };
+
+  boot.growPartition = true;
+  boot.kernelParams = [ "console=ttyS0" "panic=1" "boot.panic_on_fail" ];
+  boot.initrd.kernelModules = [ "virtio_scsi" ];
+  boot.kernelModules = [ "virtio_pci" "virtio_net" ];
+
+  # Generate a GRUB menu.  Amazon's pv-grub uses this to boot our kernel/initrd.
+  boot.loader.grub.device = "/dev/sda";
+  boot.loader.timeout = 0;
+
+  # Don't put old configurations in the GRUB menu.  The user has no
+  # way to select them anyway.
+  boot.loader.grub.configurationLimit = 0;
+
+  # Allow root logins only using the SSH key that the user specified
+  # at instance creation time.
+  services.openssh.enable = true;
+  services.openssh.permitRootLogin = "prohibit-password";
+  services.openssh.passwordAuthentication = mkDefault false;
+
+  # Use GCE udev rules for dynamic disk volumes
+  services.udev.packages = [ gce ];
+
+  # Force getting the hostname from Google Compute.
+  networking.hostName = mkDefault "";
+
+  # Always include cryptsetup so that NixOps can use it.
+  environment.systemPackages = [ pkgs.cryptsetup ];
+
+  # Make sure GCE image does not replace host key that NixOps sets
+  environment.etc."default/instance_configs.cfg".text = lib.mkDefault ''
+    [InstanceSetup]
+    set_host_keys = false
+  '';
+
+  # Rely on GCP's firewall instead
+  networking.firewall.enable = mkDefault false;
+
+  # Configure default metadata hostnames
+  networking.extraHosts = ''
+    169.254.169.254 metadata.google.internal metadata
+  '';
+
+  networking.timeServers = [ "metadata.google.internal" ];
+
+  networking.usePredictableInterfaceNames = false;
+
+  # GC has 1460 MTU
+  networking.interfaces.eth0.mtu = 1460;
+
+  # allow the google-accounts-daemon to manage users
+  users.mutableUsers = true;
+  # and allow users to sudo without password
+  security.sudo.enable = true;
+  security.sudo.extraConfig = ''
+  %google-sudoers ALL=(ALL:ALL) NOPASSWD:ALL
+  '';
+
+  # NOTE: google-accounts tries to write to /etc/sudoers.d but the folder doesn't exist
+  # FIXME: not such file or directory on dynamic SSH provisioning
+  systemd.services.google-accounts-daemon = {
+    description = "Google Compute Engine Accounts Daemon";
+    # This daemon creates dynamic users
+    enable = config.users.mutableUsers;
+    after = [
+      "network.target"
+      "google-instance-setup.service"
+      "google-network-setup.service"
+    ];
+    requires = ["network.target"];
+    wantedBy = ["multi-user.target"];
+    path = with pkgs; [ shadow ];
+    serviceConfig = {
+      Type = "simple";
+      ExecStart = "${gce}/bin/google_accounts_daemon --debug";
+    };
+  };
+
+  systemd.services.google-clock-skew-daemon = {
+    description = "Google Compute Engine Clock Skew Daemon";
+    after = [
+      "network.target"
+      "google-instance-setup.service"
+      "google-network-setup.service"
+    ];
+    requires = ["network.target"];
+    wantedBy = ["multi-user.target"];
+    serviceConfig = {
+      Type = "simple";
+      ExecStart = "${gce}/bin/google_clock_skew_daemon --debug";
+    };
+  };
+
+  systemd.services.google-instance-setup = {
+    description = "Google Compute Engine Instance Setup";
+    after = ["local-fs.target" "network-online.target" "network.target" "rsyslog.service"];
+    before = ["sshd.service"];
+    wants = ["local-fs.target" "network-online.target" "network.target"];
+    wantedBy = [ "sshd.service" "multi-user.target" ];
+    path = with pkgs; [ ethtool openssh ];
+    serviceConfig = {
+      ExecStart = "${gce}/bin/google_instance_setup --debug";
+      Type = "oneshot";
+    };
+  };
+
+  systemd.services.google-network-daemon = {
+    description = "Google Compute Engine Network Daemon";
+    after = ["local-fs.target" "network-online.target" "network.target" "rsyslog.service" "google-instance-setup.service"];
+    wants = ["local-fs.target" "network-online.target" "network.target"];
+    requires = ["network.target"];
+    partOf = ["network.target"];
+    wantedBy = [ "multi-user.target" ];
+    path = with pkgs; [ iproute ];
+    serviceConfig = {
+      ExecStart = "${gce}/bin/google_network_daemon --debug";
+    };
+  };
+
+  systemd.services.google-shutdown-scripts = {
+    description = "Google Compute Engine Shutdown Scripts";
+    after = [
+      "local-fs.target"
+      "network-online.target"
+      "network.target"
+      "rsyslog.service"
+      "systemd-resolved.service"
+      "google-instance-setup.service"
+      "google-network-daemon.service"
+    ];
+    wants = [ "local-fs.target" "network-online.target" "network.target"];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      ExecStart = "${pkgs.coreutils}/bin/true";
+      ExecStop = "${gce}/bin/google_metadata_script_runner --debug --script-type shutdown";
+      Type = "oneshot";
+      RemainAfterExit = true;
+      TimeoutStopSec = "infinity";
+    };
+  };
+
+  systemd.services.google-startup-scripts = {
+    description = "Google Compute Engine Startup Scripts";
+    after = [
+      "local-fs.target"
+      "network-online.target"
+      "network.target"
+      "rsyslog.service"
+      "google-instance-setup.service"
+      "google-network-daemon.service"
+    ];
+    wants = ["local-fs.target" "network-online.target" "network.target"];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      ExecStart = "${gce}/bin/google_metadata_script_runner --debug --script-type startup";
+      KillMode = "process";
+      Type = "oneshot";
+    };
+  };
+
+
+  # Settings taken from https://github.com/GoogleCloudPlatform/compute-image-packages/blob/master/google_config/sysctl/11-gce-network-security.conf
+  boot.kernel.sysctl = {
+    # Turn on SYN-flood protections.  Starting with 2.6.26, there is no loss
+    # of TCP functionality/features under normal conditions.  When flood
+    # protections kick in under high unanswered-SYN load, the system
+    # should remain more stable, with a trade off of some loss of TCP
+    # functionality/features (e.g. TCP Window scaling).
+    "net.ipv4.tcp_syncookies" = mkDefault "1";
+
+    # ignores source-routed packets
+    "net.ipv4.conf.all.accept_source_route" = mkDefault "0";
+
+    # ignores source-routed packets
+    "net.ipv4.conf.default.accept_source_route" = mkDefault "0";
+
+    # ignores ICMP redirects
+    "net.ipv4.conf.all.accept_redirects" = mkDefault "0";
+
+    # ignores ICMP redirects
+    "net.ipv4.conf.default.accept_redirects" = mkDefault "0";
+
+    # ignores ICMP redirects from non-GW hosts
+    "net.ipv4.conf.all.secure_redirects" = mkDefault "1";
+
+    # ignores ICMP redirects from non-GW hosts
+    "net.ipv4.conf.default.secure_redirects" = mkDefault "1";
+
+    # don't allow traffic between networks or act as a router
+    "net.ipv4.ip_forward" = mkDefault "0";
+
+    # don't allow traffic between networks or act as a router
+    "net.ipv4.conf.all.send_redirects" = mkDefault "0";
+
+    # don't allow traffic between networks or act as a router
+    "net.ipv4.conf.default.send_redirects" = mkDefault "0";
+
+    # reverse path filtering - IP spoofing protection
+    "net.ipv4.conf.all.rp_filter" = mkDefault "1";
+
+    # reverse path filtering - IP spoofing protection
+    "net.ipv4.conf.default.rp_filter" = mkDefault "1";
+
+    # ignores ICMP broadcasts to avoid participating in Smurf attacks
+    "net.ipv4.icmp_echo_ignore_broadcasts" = mkDefault "1";
+
+    # ignores bad ICMP errors
+    "net.ipv4.icmp_ignore_bogus_error_responses" = mkDefault "1";
+
+    # logs spoofed, source-routed, and redirect packets
+    "net.ipv4.conf.all.log_martians" = mkDefault "1";
+
+    # log spoofed, source-routed, and redirect packets
+    "net.ipv4.conf.default.log_martians" = mkDefault "1";
+
+    # implements RFC 1337 fix
+    "net.ipv4.tcp_rfc1337" = mkDefault "1";
+
+    # randomizes addresses of mmap base, heap, stack and VDSO page
+    "kernel.randomize_va_space" = mkDefault "2";
+
+    # Reboot the machine soon after a kernel panic.
+    "kernel.panic" = mkDefault "10";
+
+    ## Not part of the original config
+
+    # provides protection from ToCToU races
+    "fs.protected_hardlinks" = mkDefault "1";
+
+    # provides protection from ToCToU races
+    "fs.protected_symlinks" = mkDefault "1";
+
+    # makes locating kernel addresses more difficult
+    "kernel.kptr_restrict" = mkDefault "1";
+
+    # set ptrace protections
+    "kernel.yama.ptrace_scope" = mkOverride 500 "1";
+
+    # set perf only available to root
+    "kernel.perf_event_paranoid" = mkDefault "2";
+
+  };
+
 }

nixos/modules/virtualisation/google-compute-image.nix

@@ -2,333 +2,59 @@
 
 with lib;
 let
-  diskSize = 1536; # MB
+  cfg = config.virtualisation.googleComputeImage;
-  gce = pkgs.google-compute-engine;
+  defaultConfigFile = pkgs.writeText "configuration.nix" ''
+    { ... }:
+    {
+      imports = [
+        <nixpkgs/nixos/modules/virtualisation/google-compute-image.nix>
+      ];
+    }
+  '';
 in
 {
-  imports = [ ../profiles/headless.nix ../profiles/qemu-guest.nix ];
 
-  system.build.googleComputeImage = import ../../lib/make-disk-image.nix {
+  imports = [ ./google-compute-config.nix ];
-    name = "google-compute-image";
-    postVM = ''
-      PATH=$PATH:${pkgs.stdenv.lib.makeBinPath [ pkgs.gnutar pkgs.gzip ]}
-      pushd $out
-      mv $diskImage disk.raw
-      tar -Szcf nixos-image-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}.raw.tar.gz disk.raw
-      rm $out/disk.raw
-      popd
-    '';
-    configFile = <nixpkgs/nixos/modules/virtualisation/google-compute-config.nix>;
-    format = "raw";
-    inherit diskSize;
-    inherit config lib pkgs;
-  };
 
-  fileSystems."/" = {
+  options = {
-    device = "/dev/disk/by-label/nixos";
+    virtualisation.googleComputeImage.diskSize = mkOption {
-    autoResize = true;
+      type = with types; int;
-  };
+      default = 1536;
+      description = ''
+        Size of disk image. Unit is MB.
+      '';
+    };
 
-  boot.growPartition = true;
+    virtualisation.googleComputeImage.configFile = mkOption {
-  boot.kernelParams = [ "console=ttyS0" "panic=1" "boot.panic_on_fail" ];
+      type = with types; nullOr str;
-  boot.initrd.kernelModules = [ "virtio_scsi" ];
+      default = null;
-  boot.kernelModules = [ "virtio_pci" "virtio_net" ];
+      description = ''
-
+        A path to a configuration file which will be placed at `/etc/nixos/configuration.nix`
-  # Generate a GRUB menu.  Amazon's pv-grub uses this to boot our kernel/initrd.
+        and be used when switching to a new configuration.
-  boot.loader.grub.device = "/dev/sda";
+        If set to `null`, a default configuration is used, where the only import is
-  boot.loader.timeout = 0;
+        `<nixpkgs/nixos/modules/virtualisation/google-compute-image.nix>`.
-
+      '';
-  # Don't put old configurations in the GRUB menu.  The user has no
-  # way to select them anyway.
-  boot.loader.grub.configurationLimit = 0;
-
-  # Allow root logins only using the SSH key that the user specified
-  # at instance creation time.
-  services.openssh.enable = true;
-  services.openssh.permitRootLogin = "prohibit-password";
-  services.openssh.passwordAuthentication = mkDefault false;
-
-  # Use GCE udev rules for dynamic disk volumes
-  services.udev.packages = [ gce ];
-
-  # Force getting the hostname from Google Compute.
-  networking.hostName = mkDefault "";
-
-  # Always include cryptsetup so that NixOps can use it.
-  environment.systemPackages = [ pkgs.cryptsetup ];
-
-  # Make sure GCE image does not replace host key that NixOps sets
-  environment.etc."default/instance_configs.cfg".text = lib.mkDefault ''
-    [InstanceSetup]
-    set_host_keys = false
-  '';
-
-  # Rely on GCP's firewall instead
-  networking.firewall.enable = mkDefault false;
-
-  # Configure default metadata hostnames
-  networking.extraHosts = ''
-    169.254.169.254 metadata.google.internal metadata
-  '';
-
-  networking.timeServers = [ "metadata.google.internal" ];
-
-  networking.usePredictableInterfaceNames = false;
-
-  # GC has 1460 MTU
-  networking.interfaces.eth0.mtu = 1460;
-
-  # allow the google-accounts-daemon to manage users
-  users.mutableUsers = true;
-  # and allow users to sudo without password
-  security.sudo.enable = true;
-  security.sudo.extraConfig = ''
-  %google-sudoers ALL=(ALL:ALL) NOPASSWD:ALL
-  '';
-
-  # NOTE: google-accounts tries to write to /etc/sudoers.d but the folder doesn't exist
-  # FIXME: not such file or directory on dynamic SSH provisioning
-  systemd.services.google-accounts-daemon = {
-    description = "Google Compute Engine Accounts Daemon";
-    # This daemon creates dynamic users
-    enable = config.users.mutableUsers;
-    after = [
-      "network.target"
-      "google-instance-setup.service"
-      "google-network-setup.service"
-    ];
-    requires = ["network.target"];
-    wantedBy = ["multi-user.target"];
-    path = with pkgs; [ shadow ];
-    serviceConfig = {
-      Type = "simple";
-      ExecStart = "${gce}/bin/google_accounts_daemon --debug";
     };
   };
 
-  systemd.services.google-clock-skew-daemon = {
+  #### implementation
-    description = "Google Compute Engine Clock Skew Daemon";
+  config = {
-    after = [
+
-      "network.target"
+    system.build.googleComputeImage = import ../../lib/make-disk-image.nix {
-      "google-instance-setup.service"
+      name = "google-compute-image";
-      "google-network-setup.service"
+      postVM = ''
-    ];
+        PATH=$PATH:${with pkgs; stdenv.lib.makeBinPath [ gnutar gzip ]}
-    requires = ["network.target"];
+        pushd $out
-    wantedBy = ["multi-user.target"];
+        mv $diskImage disk.raw
-    serviceConfig = {
+        tar -Szcf nixos-image-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}.raw.tar.gz disk.raw
-      Type = "simple";
+        rm $out/disk.raw
-      ExecStart = "${gce}/bin/google_clock_skew_daemon --debug";
+        popd
+      '';
+      format = "raw";
+      configFile = if isNull cfg.configFile then defaultConfigFile else cfg.configFile;
+      inherit (cfg) diskSize;
+      inherit config lib pkgs;
     };
-  };
-
-  systemd.services.google-instance-setup = {
-    description = "Google Compute Engine Instance Setup";
-    after = ["local-fs.target" "network-online.target" "network.target" "rsyslog.service"];
-    before = ["sshd.service"];
-    wants = ["local-fs.target" "network-online.target" "network.target"];
-    wantedBy = [ "sshd.service" "multi-user.target" ];
-    path = with pkgs; [ ethtool openssh ];
-    serviceConfig = {
-      ExecStart = "${gce}/bin/google_instance_setup --debug";
-      Type = "oneshot";
-    };
-  };
-
-  systemd.services.google-network-daemon = {
-    description = "Google Compute Engine Network Daemon";
-    after = ["local-fs.target" "network-online.target" "network.target" "rsyslog.service" "google-instance-setup.service"];
-    wants = ["local-fs.target" "network-online.target" "network.target"];
-    requires = ["network.target"];
-    partOf = ["network.target"];
-    wantedBy = [ "multi-user.target" ];
-    path = with pkgs; [ iproute ];
-    serviceConfig = {
-      ExecStart = "${gce}/bin/google_network_daemon --debug";
-    };
-  };
-
-  systemd.services.google-shutdown-scripts = {
-    description = "Google Compute Engine Shutdown Scripts";
-    after = [
-      "local-fs.target"
-      "network-online.target"
-      "network.target"
-      "rsyslog.service"
-      "systemd-resolved.service"
-      "google-instance-setup.service"
-      "google-network-daemon.service"
-    ];
-    wants = [ "local-fs.target" "network-online.target" "network.target"];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      ExecStart = "${pkgs.coreutils}/bin/true";
-      ExecStop = "${gce}/bin/google_metadata_script_runner --debug --script-type shutdown";
-      Type = "oneshot";
-      RemainAfterExit = true;
-      TimeoutStopSec = "infinity";
-    };
-  };
-
-  systemd.services.google-startup-scripts = {
-    description = "Google Compute Engine Startup Scripts";
-    after = [
-      "local-fs.target"
-      "network-online.target"
-      "network.target"
-      "rsyslog.service"
-      "google-instance-setup.service"
-      "google-network-daemon.service"
-    ];
-    wants = ["local-fs.target" "network-online.target" "network.target"];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      ExecStart = "${gce}/bin/google_metadata_script_runner --debug --script-type startup";
-      KillMode = "process";
-      Type = "oneshot";
-    };
-  };
-
-  # TODO: remove this
-  systemd.services.fetch-ssh-keys =
-    { description = "Fetch host keys and authorized_keys for root user";
-
-      wantedBy = [ "sshd.service" ];
-      before = [ "sshd.service" ];
-      after = [ "network-online.target" ];
-      wants = [ "network-online.target" ];
-
-      script = let wget = "${pkgs.wget}/bin/wget --retry-connrefused -t 15 --waitretry=10 --header='Metadata-Flavor: Google'";
-                   mktemp = "mktemp --tmpdir=/run"; in
-        ''
-          # When dealing with cryptographic keys, we want to keep things private.
-          umask 077
-          # Don't download the SSH key if it has already been downloaded
-          echo "Obtaining SSH keys..."
-          mkdir -m 0700 -p /root/.ssh
-          AUTH_KEYS=$(${mktemp})
-          ${wget} -O $AUTH_KEYS http://metadata.google.internal/computeMetadata/v1/instance/attributes/sshKeys
-          if [ -s $AUTH_KEYS ]; then
-
-            # Read in key one by one, split in case Google decided
-            # to append metadata (it does sometimes) and add to
-            # authorized_keys if not already present.
-            touch /root/.ssh/authorized_keys
-            NEW_KEYS=$(${mktemp})
-            # Yes this is a nix escape of two single quotes.
-            while IFS=''' read -r line || [[ -n "$line" ]]; do
-              keyLine=$(echo -n "$line" | cut -d ':' -f2)
-              IFS=' ' read -r -a array <<< "$keyLine"
-              if [ ''${#array[@]} -ge 3 ]; then
-                echo ''${array[@]:0:3} >> $NEW_KEYS
-                echo "Added ''${array[@]:2} to authorized_keys"
-              fi
-            done < $AUTH_KEYS
-            mv $NEW_KEYS /root/.ssh/authorized_keys
-            chmod 600 /root/.ssh/authorized_keys
-            rm -f $KEY_PUB
-          else
-            echo "Downloading http://metadata.google.internal/computeMetadata/v1/project/attributes/sshKeys failed."
-            false
-          fi
-          rm -f $AUTH_KEYS
-          SSH_HOST_KEYS_DIR=$(${mktemp} -d)
-          ${wget} -O $SSH_HOST_KEYS_DIR/ssh_host_ed25519_key http://metadata.google.internal/computeMetadata/v1/instance/attributes/ssh_host_ed25519_key
-          ${wget} -O $SSH_HOST_KEYS_DIR/ssh_host_ed25519_key.pub http://metadata.google.internal/computeMetadata/v1/instance/attributes/ssh_host_ed25519_key_pub
-          if [ -s $SSH_HOST_KEYS_DIR/ssh_host_ed25519_key -a -s $SSH_HOST_KEYS_DIR/ssh_host_ed25519_key.pub ]; then
-              mv -f $SSH_HOST_KEYS_DIR/ssh_host_ed25519_key* /etc/ssh/
-              chmod 600 /etc/ssh/ssh_host_ed25519_key
-              chmod 644 /etc/ssh/ssh_host_ed25519_key.pub
-          else
-              echo "Setup of ssh host keys from http://metadata.google.internal/computeMetadata/v1/instance/attributes/ failed."
-              false
-          fi
-          rm -rf $SSH_HOST_KEYS_DIR
-        '';
-      serviceConfig.Type = "oneshot";
-      serviceConfig.RemainAfterExit = true;
-      serviceConfig.StandardError = "journal+console";
-      serviceConfig.StandardOutput = "journal+console";
-    };
-
-  # Settings taken from https://github.com/GoogleCloudPlatform/compute-image-packages/blob/master/google_config/sysctl/11-gce-network-security.conf
-  boot.kernel.sysctl = {
-    # Turn on SYN-flood protections.  Starting with 2.6.26, there is no loss
-    # of TCP functionality/features under normal conditions.  When flood
-    # protections kick in under high unanswered-SYN load, the system
-    # should remain more stable, with a trade off of some loss of TCP
-    # functionality/features (e.g. TCP Window scaling).
-    "net.ipv4.tcp_syncookies" = mkDefault "1";
-
-    # ignores source-routed packets
-    "net.ipv4.conf.all.accept_source_route" = mkDefault "0";
-
-    # ignores source-routed packets
-    "net.ipv4.conf.default.accept_source_route" = mkDefault "0";
-
-    # ignores ICMP redirects
-    "net.ipv4.conf.all.accept_redirects" = mkDefault "0";
-
-    # ignores ICMP redirects
-    "net.ipv4.conf.default.accept_redirects" = mkDefault "0";
-
-    # ignores ICMP redirects from non-GW hosts
-    "net.ipv4.conf.all.secure_redirects" = mkDefault "1";
-
-    # ignores ICMP redirects from non-GW hosts
-    "net.ipv4.conf.default.secure_redirects" = mkDefault "1";
-
-    # don't allow traffic between networks or act as a router
-    "net.ipv4.ip_forward" = mkDefault "0";
-
-    # don't allow traffic between networks or act as a router
-    "net.ipv4.conf.all.send_redirects" = mkDefault "0";
-
-    # don't allow traffic between networks or act as a router
-    "net.ipv4.conf.default.send_redirects" = mkDefault "0";
-
-    # reverse path filtering - IP spoofing protection
-    "net.ipv4.conf.all.rp_filter" = mkDefault "1";
-
-    # reverse path filtering - IP spoofing protection
-    "net.ipv4.conf.default.rp_filter" = mkDefault "1";
-
-    # ignores ICMP broadcasts to avoid participating in Smurf attacks
-    "net.ipv4.icmp_echo_ignore_broadcasts" = mkDefault "1";
-
-    # ignores bad ICMP errors
-    "net.ipv4.icmp_ignore_bogus_error_responses" = mkDefault "1";
-
-    # logs spoofed, source-routed, and redirect packets
-    "net.ipv4.conf.all.log_martians" = mkDefault "1";
-
-    # log spoofed, source-routed, and redirect packets
-    "net.ipv4.conf.default.log_martians" = mkDefault "1";
-
-    # implements RFC 1337 fix
-    "net.ipv4.tcp_rfc1337" = mkDefault "1";
-
-    # randomizes addresses of mmap base, heap, stack and VDSO page
-    "kernel.randomize_va_space" = mkDefault "2";
-
-    # Reboot the machine soon after a kernel panic.
-    "kernel.panic" = mkDefault "10";
-
-    ## Not part of the original config
-
-    # provides protection from ToCToU races
-    "fs.protected_hardlinks" = mkDefault "1";
-
-    # provides protection from ToCToU races
-    "fs.protected_symlinks" = mkDefault "1";
-
-    # makes locating kernel addresses more difficult
-    "kernel.kptr_restrict" = mkDefault "1";
-
-    # set ptrace protections
-    "kernel.yama.ptrace_scope" = mkOverride 500 "1";
-
-    # set perf only available to root
-    "kernel.perf_event_paranoid" = mkDefault "2";
 
   };
 

nixos/tests/gitlab.nix

@@ -16,6 +16,7 @@ import ./make-test.nix ({ pkgs, lib, ...} : with lib; {
 
       services.nginx = {
         enable = true;
+        recommendedProxySettings = true;
         virtualHosts = {
           "localhost" = {
             locations."/".proxyPass = "http://unix:/run/gitlab/gitlab-workhorse.socket";
@@ -75,7 +76,8 @@ import ./make-test.nix ({ pkgs, lib, ...} : with lib; {
     $gitlab->waitForUnit("gitlab.service");
     $gitlab->waitForUnit("gitlab-sidekiq.service");
     $gitlab->waitForFile("/var/gitlab/state/tmp/sockets/gitlab.socket");
-    $gitlab->waitUntilSucceeds("curl -sSf http://localhost/users/sign_in");
+    $gitlab->waitUntilSucceeds("curl -sSf http://gitlab/users/sign_in");
+    $gitlab->succeed("curl -isSf http://gitlab  | grep -i location | grep -q http://gitlab/users/sign_in");
     $gitlab->succeed("${pkgs.sudo}/bin/sudo -u gitlab -H gitlab-rake gitlab:check 1>&2")
   '';
 })

pkgs/applications/audio/avldrums-lv2/default.nix

@@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "avldrums.lv2";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "x42";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0w51gdshq2i5bix2x5l3g3gnycy84nlzf5sj0jkrw0zrnbk6ghwg";
+    sha256 = "0yhq3n5bahhqpj40mvlkxcjsdsw63jsbz20pl77bx2qj30w25i2j";
     fetchSubmodules = true;
   };
 

pkgs/applications/audio/dragonfly-reverb/default.nix

@@ -6,8 +6,8 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "michaelwillis";
     repo = "dragonfly-reverb";
-    rev = "0.9.4";
+    rev = "1.0.0";
-    sha256 = "0lc45jybjwg4wrcz4s9lvzpvqawgj825rkqhz2xxvalfbvjazi53";
+    sha256 = "05m4hd8lg0a7iiia6cbiw5qmc4p8vbkxp2qh7ywaabawiwa9r24x";
     fetchSubmodules = true;
   };
 

pkgs/applications/audio/mopidy/iris.nix

@@ -2,11 +2,11 @@
 
 pythonPackages.buildPythonApplication rec {
   pname = "Mopidy-Iris";
-  version = "3.31.1";
+  version = "3.31.2";
 
   src = pythonPackages.fetchPypi {
     inherit pname version;
-    sha256 = "1djxkgjvfzijvlq3gill1p20l0q64dbv9wd55whbir1l7y8wdga5";
+    sha256 = "0639ib5nicrabckjd17wdmhl8n3822gc2p1bn0xv8mq70paspar6";
   };
 
   propagatedBuildInputs = [
@@ -17,7 +17,7 @@ pythonPackages.buildPythonApplication rec {
     pylast
     spotipy
     raven
-    tornado
+    tornado_4
   ]);
 
   postPatch = "sed -i /tornado/d setup.py";

pkgs/applications/audio/renoise/default.nix

@@ -1,5 +1,5 @@
-{ stdenv, fetchurl, libX11, libXext, libXcursor, libXrandr, libjack2, alsaLib,
+{ stdenv, fetchurl, libX11, libXext, libXcursor, libXrandr, libjack2, alsaLib
-  mpg123, makeWrapper, releasePath ? null }:
+, mpg123, releasePath ? null }:
 
 with stdenv.lib;
 
@@ -36,8 +36,7 @@ stdenv.mkDerivation rec {
         releasePath
     else throw "Platform is not supported by Renoise";
 
-  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ alsaLib libjack2 libX11 libXcursor libXext libXrandr ];
-  buildInputs = [ libX11 libXext libXcursor libXrandr alsaLib libjack2 ];
 
   installPhase = ''
     cp -r Resources $out
@@ -56,9 +55,13 @@ stdenv.mkDerivation rec {
 
     mkdir $out/bin
     ln -s $out/renoise $out/bin/renoise
+  '';
 
-    patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) --set-rpath $out/lib $out/renoise
+  postFixup = ''
-    wrapProgram "$out/renoise" --prefix LD_LIBRARY_PATH : "${mpg123}/lib"
+    patchelf \
+      --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
+      --set-rpath ${mpg123}/lib:$out/lib \
+      $out/renoise
   '';
 
   meta = {

pkgs/applications/audio/x42-plugins/default.nix

@@ -3,12 +3,12 @@
 , libGLU, lv2, gtk2, cairo, pango, fftwFloat, zita-convolver }:
 
 stdenv.mkDerivation rec {
-  version = "20180812";
+  version = "20181103";
   name = "x42-plugins-${version}";
 
   src = fetchurl {
     url = "https://gareus.org/misc/x42-plugins/${name}.tar.xz";
-    sha256 = "0gzwzxpa2k2w9c6j3pspwi9slfyd57wb192d6yqcg92pfmnxy9dz";
+    sha256 = "085d6qjj7nl22f0xamqdrnfxwi8zrfwgkwm1svm73bjkdv270438";
   };
 
   nativeBuildInputs = [ pkgconfig ];
@@ -34,6 +34,6 @@ stdenv.mkDerivation rec {
       homepage = https://github.com/x42/x42-plugins;
       maintainers = with maintainers; [ magnetophon ];
       license = licenses.gpl2;
-      platforms = platforms.linux;
+      platforms = [ "i686-linux" "x86_64-linux" ];
     };
 }

pkgs/applications/editors/android-studio/default.nix

@@ -13,14 +13,14 @@ let
     sha256Hash = "117skqjax1xz9plarhdnrw2rwprjpybdc7mx7wggxapyy920vv5r";
   };
   betaVersion = {
-    version = "3.3.0.16"; # "Android Studio 3.3 Beta 4"
+    version = "3.3.0.17"; # "Android Studio 3.3 RC 1"
-    build = "182.5114240";
+    build = "182.5138683";
-    sha256Hash = "12gzwnlvc1w5lywpdckdgwxy2yrhf0m0fvaljdsis2arw0x9qdh2";
+    sha256Hash = "0apc566l4gwkwvfgj50d4qxm2gw26rxdlyr8kj3kfcra9a33c2b7";
   };
   latestVersion = { # canary & dev
-    version = "3.4.0.3"; # "Android Studio 3.4 Canary 4"
+    version = "3.4.0.4"; # "Android Studio 3.4 Canary 5"
-    build = "183.5129585";
+    build = "183.5141831";
-    sha256Hash = "10y09sy0h4yp39dwpp8x7kjvw8r7hvk0qllbbaqj76j33xa85793";
+    sha256Hash = "0xfk5vyjk3pdb44jp43vb5394486z2qgzrdhjzbf1ncbhvaf0aji";
   };
 in rec {
   # Old alias

pkgs/applications/editors/eclipse/plugins.nix

@@ -555,12 +555,12 @@ rec {
 
   spotbugs = buildEclipseUpdateSite rec {
     name = "spotbugs-${version}";
-    version = "3.1.8";
+    version = "3.1.9";
 
     src = fetchzip {
       stripRoot = false;
       url = "https://github.com/spotbugs/spotbugs/releases/download/${version}/eclipsePlugin.zip";
-      sha256 = "0086shivxx745f69226f59xcv7l9xliwyr9kxm6zyn753c888js3";
+      sha256 = "0m68jbyaiz0rm4qq3nnwnvgndzv2c6ay6i29kh0p0vdbanggq3xz";
     };
 
     meta = with stdenv.lib; {

pkgs/applications/editors/jetbrains/default.nix

@@ -276,12 +276,12 @@ in
 
   goland = buildGoland rec {
     name = "goland-${version}";
-    version = "2018.2.4"; /* updated by script */
+    version = "2018.3"; /* updated by script */
     description = "Up and Coming Go IDE";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/go/${name}.tar.gz";
-      sha256 = "0aan23ggs314bvpsldsv9m4pdmnlgdcjac9x6hv1j145a1pp439i"; /* updated by script */
+      sha256 = "0hd44flxqnnxg390mkf4ppjs2nxv0nwdc7a2i65f69bp5h61x783"; /* updated by script */
     };
     wmClass = "jetbrains-goland";
     update-channel = "GoLand Release";
@@ -289,12 +289,12 @@ in
 
   idea-community = buildIdea rec {
     name = "idea-community-${version}";
-    version = "2018.2.6"; /* updated by script */
+    version = "2018.3"; /* updated by script */
     description = "Integrated Development Environment (IDE) by Jetbrains, community edition";
     license = stdenv.lib.licenses.asl20;
     src = fetchurl {
       url = "https://download.jetbrains.com/idea/ideaIC-${version}.tar.gz";
-      sha256 = "02hpbyivji9vnik7p04zrja1rhhl49r0365g0i6sa1rrwd1fhvwf"; /* updated by script */
+      sha256 = "01ccz5ksbv8xh8mnk3zxqpia8zgayy8bcgmbwqibrykz47y6r7yy"; /* updated by script */
     };
     wmClass = "jetbrains-idea-ce";
     update-channel = "IntelliJ IDEA Release";
@@ -302,12 +302,12 @@ in
 
   idea-ultimate = buildIdea rec {
     name = "idea-ultimate-${version}";
-    version = "2018.2.6"; /* updated by script */
+    version = "2018.3"; /* updated by script */
     description = "Integrated Development Environment (IDE) by Jetbrains, requires paid license";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/idea/ideaIU-${version}-no-jdk.tar.gz";
-      sha256 = "0x0ylcbj8spvzmwxrw3p4c64ad27iz58lwj4yb8a6vwh6p22gflk"; /* updated by script */
+      sha256 = "16z0pqmxjn5dl42rbz7mx8gi13xs3220pzkdsdkh1k1ny9caqzvj"; /* updated by script */
     };
     wmClass = "jetbrains-idea";
     update-channel = "IntelliJ IDEA Release";
@@ -328,12 +328,12 @@ in
 
   pycharm-community = buildPycharm rec {
     name = "pycharm-community-${version}";
-    version = "2018.2.5"; /* updated by script */
+    version = "2018.3"; /* updated by script */
     description = "PyCharm Community Edition";
     license = stdenv.lib.licenses.asl20;
     src = fetchurl {
       url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "0zfnhrkv4y90a3myq13406vzivg234l69x0c5d7vyv6ys7dmq5fm"; /* updated by script */
+      sha256 = "0kgrh3w4lpk7qkp5gss24in1nqahdfllvf97qz6r77zn9n5k1wq7"; /* updated by script */
     };
     wmClass = "jetbrains-pycharm-ce";
     update-channel = "PyCharm Release";
@@ -341,12 +341,12 @@ in
 
   pycharm-professional = buildPycharm rec {
     name = "pycharm-professional-${version}";
-    version = "2018.2.5"; /* updated by script */
+    version = "2018.3"; /* updated by script */
     description = "PyCharm Professional Edition";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "0yfq25kmzzd15x83zdbrq9j62c32maklzhsk1rzymabyb56blh5c"; /* updated by script */
+      sha256 = "0q4scwnqy0h725g9z5hd145c3n10iaj04z790s4lixg1c63h3y8q"; /* updated by script */
     };
     wmClass = "jetbrains-pycharm";
     update-channel = "PyCharm Release";
@@ -367,12 +367,12 @@ in
 
   ruby-mine = buildRubyMine rec {
     name = "ruby-mine-${version}";
-    version = "2018.2.4"; /* updated by script */
+    version = "2018.2.5"; /* updated by script */
     description = "The Most Intelligent Ruby and Rails IDE";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/ruby/RubyMine-${version}.tar.gz";
-      sha256 = "0dk3ch749ai5kyg9q8819ckrqw2jk4f656iqrkkpab9fjqfjylka"; /* updated by script */
+      sha256 = "0b01fnifk5iawyf2zi7r5ffz8dxlh18g2ilrkc5746vmnsp0jxq4"; /* updated by script */
     };
     wmClass = "jetbrains-rubymine";
     update-channel = "RubyMine 2018.2";
@@ -380,12 +380,12 @@ in
 
   webstorm = buildWebStorm rec {
     name = "webstorm-${version}";
-    version = "2018.2.6"; /* updated by script */
+    version = "2018.3"; /* updated by script */
     description = "Professional IDE for Web and JavaScript development";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/webstorm/WebStorm-${version}.tar.gz";
-      sha256 = "1snx59b6d0szd1a07agpqxlprhy2mc9jvbnxcck5hfwxl3ic7x5g"; /* updated by script */
+      sha256 = "0msvgdjbdipc4g8j705d1jya2mjmx4wwhb23nch3znh7grryr75s"; /* updated by script */
     };
     wmClass = "jetbrains-webstorm";
     update-channel = "WebStorm Release";

pkgs/applications/graphics/tesseract/4.x.nix

@@ -7,20 +7,20 @@
 
 stdenv.mkDerivation rec {
   name = "tesseract-${version}";
-  version = "4.00.00alpha-git-20170410";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "tesseract-ocr";
     repo = "tesseract";
-    rev = "36a995bdc92eb2dd8bc5a63205708944a3f990a1";
+    rev = version;
-    sha256 = "0xz3krvap8sdm27v1dyb34lcdmx11wzvxyszpppfsfmjgkvg19bq";
+    sha256 = "1b5fi2vibc4kk9b30kkk4ais4bw8fbbv24bzr5709194hb81cav8";
   };
 
   tessdata = fetchFromGitHub {
     owner = "tesseract-ocr";
     repo = "tessdata";
-    rev = "8bf2e7ad08db9ca174ae2b0b3a7498c9f1f71d40";
+    rev = version;
-    sha256 = "0idwkv4qsmmqhrxcgyhy32yldl3vk054m7dkv4fjswfnalgsx794";
+    sha256 = "1chw1ya5zf8aaj2ixr9x013x7vwwwjjmx6f2ag0d6i14lypygy28";
   };
 
   nativeBuildInputs = [ pkgconfig autoreconfHook autoconf-archive ];

pkgs/applications/kde/dolphin.nix

@@ -4,7 +4,8 @@
   baloo, baloo-widgets, kactivities, kbookmarks, kcmutils,
   kcompletion, kconfig, kcoreaddons, kdelibs4support, kdbusaddons,
   kfilemetadata, ki18n, kiconthemes, kinit, kio, knewstuff, knotifications,
-  kparts, ktexteditor, kwindowsystem, phonon, solid
+  kparts, ktexteditor, kwindowsystem, phonon, solid,
+  wayland, qtwayland
 }:
 
 mkDerivation {
@@ -19,6 +20,7 @@ mkDerivation {
     kcoreaddons kdelibs4support kdbusaddons kfilemetadata ki18n kiconthemes
     kinit kio knewstuff knotifications kparts ktexteditor kwindowsystem
     phonon solid
+    wayland qtwayland
   ];
   outputs = [ "out" "dev" ];
   # We need the RPATH for linking, because the `libkdeinit5_dolphin.so` links

pkgs/applications/misc/aminal/default.nix

@@ -0,0 +1,75 @@
+{ buildGoPackage
+, Carbon
+, Cocoa
+, Kernel
+, cf-private
+, fetchFromGitHub
+, lib
+, mesa_glu
+, stdenv
+, xorg
+}:
+
+buildGoPackage rec {
+  name = "aminal-${version}";
+  version = "0.7.4";
+
+  goPackagePath = "github.com/liamg/aminal";
+
+  buildInputs =
+    lib.optionals stdenv.isLinux [
+      mesa_glu
+      xorg.libX11
+      xorg.libXcursor
+      xorg.libXi
+      xorg.libXinerama
+      xorg.libXrandr
+      xorg.libXxf86vm
+    ] ++ lib.optionals stdenv.isDarwin [
+      Carbon
+      Cocoa
+      Kernel
+      cf-private  /* Needed for NSDefaultRunLoopMode */
+    ];
+
+  src = fetchFromGitHub {
+    owner = "liamg";
+    repo = "aminal";
+    rev = "v${version}";
+    sha256 = "0wnzxjlv98pi3gy4hp3d19pwpa4kf1h5rqy03s9bcqdbpb1v1b7v";
+  };
+
+  preBuild = ''
+    buildFlagsArray=("-ldflags=-X ${goPackagePath}/version.Version=${version}")
+  '';
+
+  meta = with lib; {
+    description = "Golang terminal emulator from scratch";
+    longDescription = ''
+      Aminal is a modern terminal emulator for Mac/Linux implemented in Golang
+      and utilising OpenGL.
+
+      The project is experimental at the moment, so you probably won't want to
+      rely on Aminal as your main terminal for a while.
+
+      Features:
+      - Unicode support
+      - OpenGL rendering
+      - Customisation options
+      - True colour support
+      - Support for common ANSI escape sequences a la xterm
+      - Scrollback buffer
+      - Clipboard access
+      - Clickable URLs
+      - Multi platform support (Windows coming soon...)
+      - Sixel support
+      - Hints/overlays
+      - Built-in patched fonts for powerline
+      - Retina display support
+    '';
+    homepage = https://github.com/liamg/aminal;
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ kalbasit ];
+    platforms = platforms.linux ++ platforms.darwin;
+  };
+}

pkgs/applications/misc/autospotting/default.nix

@@ -0,0 +1,30 @@
+{ stdenv, buildGoPackage, fetchFromGitHub }:
+
+buildGoPackage rec {
+  name = "autospotting-${version}";
+  version = "unstable-2018-11-17";
+  goPackagePath = "github.com/AutoSpotting/AutoSpotting";
+
+  src = fetchFromGitHub {
+    owner = "AutoSpotting";
+    repo = "AutoSpotting";
+    rev = "122ab8f292a2f718dd85e79ec22acd455122907e";
+    sha256 = "0p48lgig9kblxvgq1kggczkn4qdbx6ciq9c8x0179i80vl4jf7v6";
+  };
+
+  goDeps = ./deps.nix;
+
+  # patching path where repository used to exist
+  postPatch = ''
+    sed -i "s+github.com/cristim/autospotting/core+github.com/AutoSpotting/AutoSpotting/core+" autospotting.go
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/AutoSpotting/AutoSpotting;
+    description = "Automatically convert your existing AutoScaling groups to up to 90% cheaper spot instances with minimal configuration changes";
+    license = licenses.free;
+    maintainers = [ maintainers.costrouc ];
+    platforms = platforms.linux;
+  };
+
+}

pkgs/applications/misc/autospotting/deps.nix

@@ -0,0 +1,75 @@
+# file generated from Gopkg.lock using dep2nix (https://github.com/nixcloud/dep2nix)
+[
+  {
+    goPackagePath  = "github.com/aws/aws-lambda-go";
+    fetch = {
+      type = "git";
+      url = "https://github.com/aws/aws-lambda-go";
+      rev =  "2d482ef09017ae953b1e8d5a6ddac5b696663a3c";
+      sha256 = "06v2yfvn4sn116lds0526a8mfrsng4vafrdjf1dhpalqarrbdvmz";
+    };
+  }
+  {
+    goPackagePath  = "github.com/aws/aws-sdk-go";
+    fetch = {
+      type = "git";
+      url = "https://github.com/aws/aws-sdk-go";
+      rev =  "9333060a8d957db41bff1c80603a802aa674fad8";
+      sha256 = "0fnypw6zm6k70fzhm5a8g69ag64rxbrrpdk7l3rkfqd99slyg5kz";
+    };
+  }
+  {
+    goPackagePath  = "github.com/cristim/ec2-instances-info";
+    fetch = {
+      type = "git";
+      url = "https://github.com/cristim/ec2-instances-info";
+      rev =  "73c042a5558cd6d8b61fb82502d6f7aec334e9ed";
+      sha256 = "1xajrkxqqz5wlbi9w2wdhnk115rbmqxyga29f8v9psq8hzwgi0rg";
+    };
+  }
+  {
+    goPackagePath  = "github.com/davecgh/go-spew";
+    fetch = {
+      type = "git";
+      url = "https://github.com/davecgh/go-spew";
+      rev =  "d8f796af33cc11cb798c1aaeb27a4ebc5099927d";
+      sha256 = "19z27f306fpsrjdvkzd61w1bdazcdbczjyjck177g33iklinhpvx";
+    };
+  }
+  {
+    goPackagePath  = "github.com/go-ini/ini";
+    fetch = {
+      type = "git";
+      url = "https://github.com/go-ini/ini";
+      rev =  "5cf292cae48347c2490ac1a58fe36735fb78df7e";
+      sha256 = "0xbnw1nd22q6k863n5gs0nxld15w0p8qxbhfky85akcb5rk1vwi9";
+    };
+  }
+  {
+    goPackagePath  = "github.com/jmespath/go-jmespath";
+    fetch = {
+      type = "git";
+      url = "https://github.com/jmespath/go-jmespath";
+      rev =  "0b12d6b5";
+      sha256 = "1vv6hph8j6xgv7gwl9vvhlsaaqsm22sxxqmgmldi4v11783pc1ld";
+    };
+  }
+  {
+    goPackagePath  = "github.com/namsral/flag";
+    fetch = {
+      type = "git";
+      url = "https://github.com/namsral/flag";
+      rev =  "67f268f20922975c067ed799e4be6bacf152208c";
+      sha256 = "1lmxq3z276zrsggpfq9b7yklzzxdyib49zr8sznb1lcqlvxqsr47";
+    };
+  }
+  {
+    goPackagePath  = "github.com/pkg/errors";
+    fetch = {
+      type = "git";
+      url = "https://github.com/pkg/errors";
+      rev =  "645ef00459ed84a119197bfb8d8205042c6df63d";
+      sha256 = "001i6n71ghp2l6kdl3qq1v2vmghcz3kicv9a5wgcihrzigm75pp5";
+    };
+  }
+]

pkgs/applications/misc/slic3r/prusa3d.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, makeWrapper, which, cmake, perl, perlPackages,
+{ stdenv, lib, fetchFromGitHub, makeWrapper, which, cmake, perl, perlPackages,
   boost, tbb, wxGTK30, pkgconfig, gtk3, fetchurl, gtk2, libGLU,
   glew, eigen, curl, gtest, nlopt, pcre, xorg }:
 let
@@ -98,6 +98,10 @@ stdenv.mkDerivation rec {
     # seems to be the easiest way.
     sed -i "s|\''${PERL_VENDORARCH}|$out/lib/slic3r-prusa3d|g" xs/CMakeLists.txt
     sed -i "s|\''${PERL_VENDORLIB}|$out/lib/slic3r-prusa3d|g" xs/CMakeLists.txt
+  '' + lib.optionalString (lib.versionOlder "2.5" nlopt.version) ''
+    # Since version 2.5.0 of nlopt we need to link to libnlopt, as libnlopt_cxx
+    # now seems to be integrated into the main lib.
+    sed -i 's|nlopt_cxx|nlopt|g' xs/src/libnest2d/cmake_modules/FindNLopt.cmake
   '';
 
   postInstall = ''
@@ -114,7 +118,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "prusa3d";
     repo = "Slic3r";
-    sha256 = "0068wwsjwmnxql7653vy3labcyslzf17kr8xdr4lg2jplm022hvy";
+    sha256 = "0crjrll8cjpkllval6abrqzvzp8g3rnb4vmwi5vivw0jvdv3w5y7";
     rev = "version_${version}";
   };
 

pkgs/applications/networking/browsers/brave/default.nix

@@ -75,10 +75,11 @@ let rpath = lib.makeLibraryPath [
 in stdenv.mkDerivation rec {
     pname = "brave";
     version = "0.56.12";
+    version = "0.56.15";
 
     src = fetchurl {
         url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-        sha256 = "1pvablwchpsm1fdhfp9kr2912yv4812r8prv5fn799qpflzxvyai";
+        sha256 = "1d18fgnxcgl95bhkgfqjyv4p81q6fciqibd3ss4vwh1ljjy1fv76";
     };
 
     dontConfigure = true;

pkgs/applications/networking/browsers/lynx/default.nix

@@ -8,14 +8,14 @@ assert sslSupport -> openssl != null;
 
 stdenv.mkDerivation rec {
   name = "lynx-${version}";
-  version = "2.8.9dev.17";
+  version = "2.8.9rel.1";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.invisible-island.net/lynx/tarballs/lynx${version}.tar.bz2"
       "https://invisible-mirror.net/archives/lynx/tarballs/lynx${version}.tar.bz2"
     ];
-    sha256 = "1lvfsnrw5mmwrmn1m76q9mx287xwm3h5lg8sv7bcqilc0ywi2f54";
+    sha256 = "15cmyyma2kz1hfaa6mwjgli8zwdzq3jv0q2cl6nwzycjfwyijzrq";
   };
 
   enableParallelBuilding = true;

pkgs/applications/networking/browsers/vivaldi/default.nix

@@ -13,11 +13,11 @@
 stdenv.mkDerivation rec {
   name = "${product}-${version}";
   product = "vivaldi";
-  version = "2.1.1337.47-1";
+  version = "2.1.1337.51-1";
 
   src = fetchurl {
     url = "https://downloads.vivaldi.com/stable/${product}-stable_${version}_amd64.deb";
-    sha256 = "0i4dd5fgipplfq9jylm23jc9vn0qzf03ph1v85qh252hw5fgnyj2";
+    sha256 = "08x6abyz65vx4ycj8ys8sib9z1adb8ybmnrqjck69b30kbz78rj2";
   };
 
   unpackPhase = ''

pkgs/applications/networking/cluster/kubetail/default.nix

@@ -12,7 +12,10 @@ stdenv.mkDerivation rec {
   };
 
   installPhase = ''
-    install -Dm755 kubetail $out/bin/kubetail
+    install -Dm755 kubetail                 "$out/bin/kubetail"
+    install -Dm755 completion/kubetail.bash "$out/share/bash-completion/completions/kubetail"
+    install -Dm755 completion/kubetail.fish "$out/share/fish/vendor_completions.d/kubetail.fish"
+    install -Dm755 completion/kubetail.zsh  "$out/share/zsh/site-functions/_kubetail"
   '';
 
   meta = with lib; {

pkgs/applications/networking/cluster/stern/default.nix

@@ -1,4 +1,6 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ stdenv, lib, buildPackages, buildGoPackage, fetchFromGitHub }:
+
+let isCrossBuild = stdenv.hostPlatform != stdenv.buildPlatform; in
 
 buildGoPackage rec {
   name = "stern-${version}";
@@ -15,11 +17,20 @@ buildGoPackage rec {
 
   goDeps = ./deps.nix;
 
-   meta = with lib; {
+  postInstall =
-      description      = "Multi pod and container log tailing for Kubernetes";
+    let stern = if isCrossBuild then buildPackages.stern else "$bin"; in
-      homepage         = "https://github.com/wercker/stern";
+    ''
-      license          = licenses.asl20;
+      mkdir -p $bin/share/bash-completion/completions
-      maintainers      = with maintainers; [ mbode ];
+      ${stern}/bin/stern --completion bash > $bin/share/bash-completion/completions/stern
-      platforms        = platforms.unix;
+      mkdir -p $bin/share/zsh/site-functions
-    };
+      ${stern}/bin/stern --completion zsh > $bin/share/zsh/site-functions/_stern
+    '';
+
+  meta = with lib; {
+    description      = "Multi pod and container log tailing for Kubernetes";
+    homepage         = "https://github.com/wercker/stern";
+    license          = licenses.asl20;
+    maintainers      = with maintainers; [ mbode ];
+    platforms        = platforms.unix;
+  };
 }

pkgs/applications/networking/instant-messengers/dino/default.nix

@@ -10,16 +10,17 @@
 , dbus
 , gpgme
 , pcre
+, qrencode
  }:
 
 stdenv.mkDerivation rec {
-  name = "dino-unstable-2018-09-21";
+  name = "dino-unstable-2018-11-27";
 
   src = fetchFromGitHub {
     owner = "dino";
     repo = "dino";
-    rev = "6b7ef800f54e781a618425236ba8d4ed2f2fef9c";
+    rev = "141db9e40a3a81cfa3ad3587dc47f69c541d0fde";
-    sha256 = "1si815b6y06lridj88hws0dgq54w9jfam9sqbrq3cfcvmhc38ysk";
+    sha256 = "006r1x7drlz39jjxlfdnxgrnambw9amhl9jcgf6p1dx71h1x8221";
     fetchSubmodules = true;
   };
 
@@ -32,6 +33,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
+    qrencode
     gobjectIntrospection
     glib-networking
     glib

pkgs/applications/networking/instant-messengers/signal-desktop/default.nix

@@ -56,11 +56,11 @@ let
 
 in stdenv.mkDerivation rec {
   name = "signal-desktop-${version}";
-  version = "1.18.0";
+  version = "1.18.1";
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "0l5q55k5dp7hbvw3dnjsz39blbsahx6nh9ln4c69752zg473yv4v";
+    sha256 = "1gak6nhv5gk37iv1bfmjx6wf0p1vcln5y29i6fkzmvcrp3j2cmfh";
   };
 
   phases = [ "unpackPhase" "installPhase" ];

pkgs/applications/networking/mailreaders/mutt/default.nix

@@ -35,8 +35,8 @@ stdenv.mkDerivation rec {
   };
 
   patches = optional smimeSupport (fetchpatch {
-    url    = "https://sources.debian.net/src/mutt/1.7.2-1/debian/patches/misc/smime.rc.patch";
+    url = "https://salsa.debian.org/mutt-team/mutt/raw/debian/1.10.1-2/debian/patches/misc/smime.rc.patch";
-    sha256 = "0mdqa9w1p6cmli6976v4wi0sw9r4p5prkj7lzfd1877wk11c9c73";
+    sha256 = "1rl27qqwl4nw321ll5jcvfmkmz4fkvcsh5vihjcrhzzyf6vz8wmj";
   });
 
   buildInputs =

pkgs/applications/networking/mailreaders/neomutt/default.nix

@@ -1,6 +1,7 @@
 { stdenv, fetchFromGitHub, gettext, makeWrapper, tcl, which, writeScript
 , ncurses, perl , cyrus_sasl, gss, gpgme, kerberos, libidn, libxml2, notmuch, openssl
-, lmdb, libxslt, docbook_xsl, docbook_xml_dtd_42, mime-types }:
+, lmdb, libxslt, docbook_xsl, docbook_xml_dtd_42, mailcap
+}:
 
 let
   muttWrapper = writeScript "mutt" ''
@@ -28,7 +29,7 @@ in stdenv.mkDerivation rec {
   buildInputs = [
     cyrus_sasl gss gpgme kerberos libidn ncurses
     notmuch openssl perl lmdb
-    mime-types
+    mailcap
   ];
 
   nativeBuildInputs = [
@@ -47,10 +48,11 @@ in stdenv.mkDerivation rec {
         --replace http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd ${docbook_xml_dtd_42}/xml/dtd/docbook/docbookx.dtd
     done
 
+
     # allow neomutt to map attachments to their proper mime.types if specified wrongly
     # and use a far more comprehensive list than the one shipped with neomutt
     substituteInPlace sendlib.c \
-      --replace /etc/mime.types ${mime-types}/etc/mime.types
+      --replace /etc/mime.types ${mailcap}/etc/mime.types
 
     # The string conversion tests all fail with the first version of neomutt
     # that has tests (20180223) as well as 20180716 so we disable them for now.

pkgs/applications/networking/sync/rclone/default.nix

@@ -2,15 +2,16 @@
 
 buildGoPackage rec {
   name = "rclone-${version}";
-  version = "1.44";
+  version = "1.45";
 
   goPackagePath = "github.com/ncw/rclone";
+  subPackages = [ "." ];
 
   src = fetchFromGitHub {
     owner = "ncw";
     repo = "rclone";
     rev = "v${version}";
-    sha256 = "0kpx9r4kksscsvia7r79z9h8ghph25ay9dgpqrnp599fq1bqky61";
+    sha256 = "06xg0ibv9pnrnmabh1kblvxx1pk8h5rmkr9mjbymv497sx3zgz26";
   };
 
   outputs = [ "bin" "out" "man" ];

pkgs/applications/office/marp/default.nix

@@ -1,24 +1,29 @@
-{ stdenv, fetchurl, atomEnv, libXScrnSaver }:
+{ stdenv, fetchurl, atomEnv, libXScrnSaver, gtk2 }:
 
 stdenv.mkDerivation rec {
   name = "marp-${version}";
-  version = "0.0.13";
+  version = "0.0.14";
 
   src = fetchurl {
     url = "https://github.com/yhatt/marp/releases/download/v${version}/${version}-Marp-linux-x64.tar.gz";
-    sha256 = "1120mbw4mf7v4qfmss3121gkgp5pn31alk9cssxbrmdcsdkaq5ld";
+    sha256 = "0nklzxwdx5llzfwz1hl2jpp2kwz78w4y63h5l00fh6fv6zisw6j4";
   };
-  sourceRoot = ".";
+
+  unpackPhase = ''
+    mkdir {locales,resources}
+    tar --delay-directory-restore -xf $src
+    chmod u+x {locales,resources}
+  '';
 
   installPhase = ''
-      mkdir -p $out/lib/marp $out/bin
+    mkdir -p $out/lib/marp $out/bin
-      cp -r ./* $out/lib/marp
+    cp -r ./* $out/lib/marp
-      ln -s $out/lib/marp/Marp $out/bin
+    ln -s $out/lib/marp/Marp $out/bin
   '';
 
   postFixup = ''
     patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-      --set-rpath "${atomEnv.libPath}:${stdenv.lib.makeLibraryPath [ libXScrnSaver ]}:$out/lib/marp" \
+      --set-rpath "${atomEnv.libPath}:${stdenv.lib.makeLibraryPath [ libXScrnSaver gtk2 ]}:$out/lib/marp" \
       $out/bin/Marp
   '';
 

pkgs/applications/science/biology/picard-tools/default.nix

@@ -2,14 +2,15 @@
 
 stdenv.mkDerivation rec {
   name = "picard-tools-${version}";
-  version = "2.18.14";
+  version = "2.18.17";
 
   src = fetchurl {
     url = "https://github.com/broadinstitute/picard/releases/download/${version}/picard.jar";
-    sha256 = "0xc5mqifav2j4zbln04q07wjlzpwp3w0y5iv5bkp4v5486cp2ha9";
+    sha256 = "0ks7ymrjfya5h77hp0bqyipzdri0kf97c8wks32nvwkj821687zm";
   };
 
-  buildInputs = [ jre makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre ];
 
   phases = [ "installPhase" ];
 
@@ -21,7 +22,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    description = "Tools for high-throughput sequencing (HTS) data and formats such as SAM/BAM/CRAM and VCF.";
+    description = "Tools for high-throughput sequencing (HTS) data and formats such as SAM/BAM/CRAM and VCF";
     license = licenses.mit;
     homepage = https://broadinstitute.github.io/picard/;
     maintainers = with maintainers; [ jbedo ];

pkgs/applications/science/electronics/librepcb/default.nix

@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   name = "librepcb-${version}";
-  version = "20181031";
+  version = "0.1.0";
 
   src = fetchFromGitHub {
     owner = "LibrePCB";
     repo = "LibrePCB";
     fetchSubmodules = true;
-    rev = "3cf8dba9fa88e5b392d639c9fdbcf3a44664170a";
+    rev = "d7458d3b3e126499902e1a66a0ef889f516a7c97";
-    sha256 = "0kr4mii5w3kj3kqvhgq7zjxjrq44scx8ky0x77gyqmwvwfwk7nmx";
+    sha256 = "19wh0398fzzpd65nh4mmc4jllkrgcrwxvxdby0gb5wh1sqyaqac4";
   };
 
   enableParallelBuilding = true;

pkgs/applications/science/logic/z3/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "z3-${version}";
-  version = "4.8.1";
+  version = "4.8.3";
 
   src = fetchFromGitHub {
     owner  = "Z3Prover";
     repo   = "z3";
     rev    = name;
-    sha256 = "1vr57bwx40sd5riijyrhy70i2wnv9xrdihf6y5zdz56yq88rl48f";
+    sha256 = "0p5gdmhd32x6zwmx7j5cgwh4jyfxa9yapym95nlmyfaqzak92qar";
   };
 
   buildInputs = [ python fixDarwinDylibNames ];

pkgs/applications/science/math/sage/default.nix

@@ -129,6 +129,7 @@ let
     # https://trac.sagemath.org/ticket/25674
     R = pkgs.R.overrideAttrs (attrs: rec {
       name = "R-3.4.4";
+      doCheck = false;
       src = fetchurl {
         url = "http://cran.r-project.org/src/base/R-3/${name}.tar.gz";
         sha256 = "0dq3jsnwsb5j3fhl0wi3p5ycv8avf8s5j1y4ap3d2mkjmcppvsdk";

pkgs/applications/science/math/sage/sage-tests.nix

@@ -46,6 +46,6 @@ stdenv.mkDerivation rec {
     mkdir -p "$HOME"
 
     # "--long" tests are in the order of 1h, without "--long" its 1/2h
-    "sage" -t --nthreads "$NIX_BUILD_CORES" --optional=sage ${patienceSpecifier} ${testArgs}
+    "sage" -t --timeout=0 --nthreads "$NIX_BUILD_CORES" --optional=sage ${patienceSpecifier} ${testArgs}
   '';
 }

pkgs/applications/science/physics/quantomatic/default.nix

@@ -0,0 +1,31 @@
+{ stdenv, fetchurl, jre, makeWrapper }:
+
+stdenv.mkDerivation rec {
+  name = "quantomatic-${version}";
+  version = "0.7";
+
+  src = fetchurl {
+    url = "https://github.com/Quantomatic/quantomatic/releases/download/v${version}/Quantomatic-v${version}.jar";
+    sha256 = "04dd5p73a7plb4l4x2balam8j7mxs8df06rjkalxycrr1id52q4r";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre ];
+
+  phases = [ "installPhase" ];
+
+  installPhase = ''
+    mkdir -p $out/libexec/quantomatic
+    cp $src $out/libexec/quantomatic/quantomatic.jar
+    mkdir -p $out/bin
+    makeWrapper ${jre}/bin/java $out/bin/quantomatic --add-flags "-jar $out/libexec/quantomatic/quantomatic.jar"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A piece of software for reasoning about monoidal theories; in particular, quantum information processing";
+    license = licenses.gpl3;
+    homepage = https://quantomatic.github.io/;
+    maintainers = with maintainers; [ nickhu ];
+    platforms = platforms.all;
+  };
+}

pkgs/applications/version-management/git-and-tools/default.nix

@@ -94,6 +94,8 @@ let
 
   git-remote-hg = callPackage ./git-remote-hg { };
 
+  git-reparent = callPackage ./git-reparent { };
+
   git-secret = callPackage ./git-secret { };
 
   git-secrets = callPackage ./git-secrets { };

pkgs/applications/version-management/git-and-tools/git-reparent/default.nix

@@ -0,0 +1,33 @@
+{ stdenv, fetchFromGitHub, makeWrapper, git, gnused }:
+
+stdenv.mkDerivation rec {
+  name = "git-reparent-${version}";
+  version = "unstable-2017-09-03";
+
+  src = fetchFromGitHub {
+    owner  = "MarkLodato";
+    repo   = "git-reparent";
+    rev    = "a99554a32524a86421659d0f61af2a6c784b7715";
+    sha256 = "0v0yxydpw6r4awy0hb7sbnh520zsk86ibzh1xjf3983yhsvkfk5v";
+  };
+
+  buildInputs = [ makeWrapper ];
+
+  dontBuild = true;
+
+  installPhase = ''
+    install -m755 -Dt $out/bin git-reparent
+  '';
+
+  postFixup = ''
+    wrapProgram $out/bin/git-reparent --prefix PATH : "${stdenv.lib.makeBinPath [ git gnused ]}"
+  '';
+
+  meta = with stdenv.lib; {
+    inherit (src.meta) homepage;
+    description = "Git command to recommit HEAD with a new set of parents";
+    maintainers = [ maintainers.marsam ];
+    license = licenses.gpl2;
+    platforms = platforms.unix;
+  };
+}

pkgs/applications/version-management/gitlab-shell/remove-hardcoded-locations.patch

@@ -1,27 +0,0 @@
-diff --git a/go/internal/config/config.go b/go/internal/config/config.go
-index c57b4de..88cfc95 100644
---- a/go/internal/config/config.go
-+++ b/go/internal/config/config.go
-@@ -27,7 +27,7 @@ func New() (*Config, error) {
- 	}
- 	cfg.RootDir = dir
- 
--	configBytes, err := ioutil.ReadFile(path.Join(cfg.RootDir, configFile))
-+	configBytes, err := ioutil.ReadFile("/run/gitlab/shell-config.yml")
- 	if err != nil {
- 		return nil, err
- 	}
-diff --git a/lib/gitlab_shell.rb b/lib/gitlab_shell.rb
-index 1452f95..2b40327 100644
---- a/lib/gitlab_shell.rb
-+++ b/lib/gitlab_shell.rb
-@@ -180,7 +180,8 @@ class GitlabShell
-     end
- 
-     # We use 'chdir: ROOT_PATH' to let the next executable know where config.yml is.
--    Kernel.exec(env, *args, unsetenv_others: true, chdir: ROOT_PATH)
-+    # Except we don't, because we're already in the right directory on nixos!
-+    Kernel.exec(env, *args, unsetenv_others: true)
-   end
- 
-   def api

pkgs/applications/version-management/gitlab-workhorse/deterministic-build.patch

@@ -1,11 +0,0 @@
---- a/Makefile	2018-10-08 12:45:15.206269937 +0200
-+++ b/Makefile	2018-10-08 12:45:24.435366307 +0200
-@@ -6,7 +6,7 @@
- BIN_BUILD_DIR := $(TARGET_DIR)/bin
- PKG_BUILD_DIR := $(TARGET_DIR)/src/$(PKG)
- COVERAGE_DIR := $(TARGET_DIR)/cover
--VERSION := $(shell git describe)-$(shell date -u +%Y%m%d.%H%M%S)
-+VERSION := 6.1.1
- GOBUILD := go build -ldflags "-X main.Version=$(VERSION)"
- EXE_ALL := gitlab-zip-cat gitlab-zip-metadata gitlab-workhorse
- INSTALL := install

pkgs/applications/version-management/gitlab/data.json

@@ -0,0 +1,32 @@
+{
+  "ce": {
+    "version": "11.5.0",
+    "repo_hash": "0cjkkap3n9g9zahrxk99a330ahyb6cvx97dsnrxcdsn0cbrsxsrb",
+    "deb_hash": "0kn7mg1lk4gvc3x76z4rbh0j03b0wk6x1p5938wx8sc50k0bgrcp",
+    "deb_url": "https://packages.gitlab.com/gitlab/gitlab-ce/packages/debian/stretch/gitlab-ce_11.5.0-ce.0_amd64.deb/download.deb",
+    "owner": "gitlab-org",
+    "repo": "gitlab-ce",
+    "rev": "v11.5.0",
+    "passthru": {
+      "GITALY_SERVER_VERSION": "0.129.0",
+      "GITLAB_PAGES_VERSION": "1.3.0",
+      "GITLAB_SHELL_VERSION": "8.4.1",
+      "GITLAB_WORKHORSE_VERSION": "7.1.0"
+    }
+  },
+  "ee": {
+    "version": "11.5.0",
+    "repo_hash": "1s2jr7vhbpklpcfjxgxnmq0zq14hh2aa6akdsb7ld7fj5lmzp00z",
+    "deb_hash": "108mgmlf947h200qrwg71ilhq5ihr4awxns6lqs2wa90ph9yq25c",
+    "deb_url": "https://packages.gitlab.com/gitlab/gitlab-ee/packages/debian/stretch/gitlab-ee_11.5.0-ee.0_amd64.deb/download.deb",
+    "owner": "gitlab-org",
+    "repo": "gitlab-ee",
+    "rev": "v11.5.0-ee",
+    "passthru": {
+      "GITALY_SERVER_VERSION": "0.129.0",
+      "GITLAB_PAGES_VERSION": "1.3.0",
+      "GITLAB_SHELL_VERSION": "8.4.1",
+      "GITLAB_WORKHORSE_VERSION": "7.1.0"
+    }
+  }
+}

pkgs/applications/version-management/gitlab/default.nix

@@ -11,32 +11,22 @@ let
     groups = [ "default" "unicorn" "ed25519" "metrics" ];
   };
 
-  version = "11.4.4";
+  flavour = if gitlabEnterprise then "ee" else "ce";
+  data = (builtins.fromJSON (builtins.readFile ./data.json)).${flavour};
 
-  sources = if gitlabEnterprise then {
+  version = data.version;
-    gitlabDeb = fetchurl {
+  sources = {
-      url = "https://packages.gitlab.com/gitlab/gitlab-ee/packages/debian/stretch/gitlab-ee_${version}-ee.0_amd64.deb/download.deb";
-      sha256 = "15lpcdjcw6lpmzlhqnpd6pgaxh7wvx2mldjd1vqr414r4bcnhgy4";
-    };
     gitlab = fetchFromGitLab {
-      owner = "gitlab-org";
+      owner = data.owner;
-      repo = "gitlab-ee";
+      repo = data.repo;
-      rev = "v${version}-ee";
+      rev = data.rev;
-      sha256 = "046hchr7q4jnx3j4yxg3rdixfzlva35al3ci26pf9vxrbbl5y8cg";
+      sha256 = data.repo_hash;
     };
-  } else {
     gitlabDeb = fetchurl {
-      url = "https://packages.gitlab.com/gitlab/gitlab-ce/packages/debian/stretch/gitlab-ce_${version}-ce.0_amd64.deb/download.deb";
+      url = data.deb_url;
-      sha256 = "02p7azyjgb984bk491q6f4zk1mikbcd38rif08kl07bjjzzkir81";
+      sha256 = data.deb_hash;
-    };
-    gitlab = fetchFromGitLab {
-      owner = "gitlab-org";
-      repo = "gitlab-ce";
-      rev = "v${version}";
-      sha256 = "1hq9iyp0xrxwmncn61ja3pdj9h2hmdy1l63d1ic3r1dyacybaf2g";
     };
   };
-
 in
 
 stdenv.mkDerivation rec {
@@ -101,6 +91,10 @@ stdenv.mkDerivation rec {
   passthru = {
     inherit rubyEnv;
     ruby = rubyEnv.wrappedRuby;
+    GITALY_SERVER_VERSION = data.passthru.GITALY_SERVER_VERSION;
+    GITLAB_PAGES_VERSION = data.passthru.GITLAB_PAGES_VERSION;
+    GITLAB_SHELL_VERSION = data.passthru.GITLAB_SHELL_VERSION;
+    GITLAB_WORKHORSE_VERSION = data.passthru.GITLAB_WORKHORSE_VERSION;
   };
 
   meta = with lib; {

pkgs/applications/version-management/gitlab/gitaly/Gemfile

@@ -1,14 +1,17 @@
 source 'https://rubygems.org'
 
-gem 'rugged', '~> 0.27.4'
+# Require bundler >= 1.16.5 to avoid this bug: https://github.com/bundler/bundler/issues/6537
+gem 'bundler', '>= 1.16.5'
+
+gem 'rugged', '~> 0.27'
 gem 'github-linguist', '~> 6.1', require: 'linguist'
 gem 'gitlab-markup', '~> 1.6.4'
-gem 'gitaly-proto', '~> 0.116.0', require: 'gitaly'
+gem 'gitaly-proto', '~> 0.123.0', require: 'gitaly'
 gem 'activesupport', '~> 5.0.2'
 gem 'rdoc', '~> 4.2'
 gem 'gitlab-gollum-lib', '~> 4.2', require: false
 gem 'gitlab-gollum-rugged_adapter', '~> 0.4.4', require: false
-gem 'grpc', '~> 1.11.0'
+gem 'grpc', '~> 1.15.0'
 gem 'sentry-raven', '~> 2.7.2', require: false
 gem 'faraday', '~> 0.12'
 
@@ -16,10 +19,12 @@ gem 'faraday', '~> 0.12'
 # This version needs to be in sync with GitLab CE/EE
 gem 'licensee', '~> 8.9.0'
 
-# Locked until https://github.com/google/protobuf/issues/4210 is closed
+gem 'google-protobuf', '~> 3.6'
-gem 'google-protobuf', '= 3.5.1'
 
 group :development, :test do
-  gem 'gitlab-styles', '~> 2.0.0', require: false
+  gem 'rubocop', '~> 0.50', require: false
   gem 'rspec', require: false
+  gem 'rspec-parameterized', require: false
+  gem 'timecop', require: false
+  gem 'factory_bot', require: false
 end

pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock

@@ -1,26 +1,37 @@
 GEM
   remote: https://rubygems.org/
   specs:
+    abstract_type (0.0.7)
     activesupport (5.0.6)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (~> 0.7)
       minitest (~> 5.1)
       tzinfo (~> 1.1)
-    addressable (2.5.2)
+    adamantium (0.2.0)
-      public_suffix (>= 2.0.2, < 4.0)
+      ice_nine (~> 0.11.0)
-    ast (2.3.0)
+      memoizable (~> 0.4.0)
+    ast (2.4.0)
+    binding_of_caller (0.8.0)
+      debug_inspector (>= 0.0.1)
     charlock_holmes (0.7.6)
+    coderay (1.1.2)
+    concord (0.1.5)
+      adamantium (~> 0.2.0)
+      equalizer (~> 0.0.9)
     concurrent-ruby (1.0.5)
     crass (1.0.4)
+    debug_inspector (0.0.3)
     diff-lcs (1.3)
+    equalizer (0.0.11)
     escape_utils (1.2.1)
-    faraday (0.12.2)
+    factory_bot (4.11.1)
+      activesupport (>= 3.0.0)
+    faraday (0.15.3)
       multipart-post (>= 1.2, < 3)
     gemojione (3.3.0)
       json
-    gitaly-proto (0.116.0)
+    gitaly-proto (0.123.0)
-      google-protobuf (~> 3.1)
+      grpc (~> 1.0)
-      grpc (~> 1.10)
     github-linguist (6.2.0)
       charlock_holmes (~> 0.7.6)
       escape_utils (~> 1.2.0)
@@ -44,60 +55,44 @@ GEM
       mime-types (>= 1.16)
       posix-spawn (~> 0.3)
     gitlab-markup (1.6.4)
-    gitlab-styles (2.0.0)
-      rubocop (~> 0.49)
-      rubocop-gitlab-security (~> 0.1.0)
-      rubocop-rspec (~> 1.15)
     gollum-grit_adapter (1.0.1)
       gitlab-grit (~> 2.7, >= 2.7.1)
-    google-protobuf (3.5.1)
+    google-protobuf (3.6.1)
-    googleapis-common-protos-types (1.0.1)
+    googleapis-common-protos-types (1.0.2)
       google-protobuf (~> 3.0)
-    googleauth (0.6.2)
+    grpc (1.15.0)
-      faraday (~> 0.12)
-      jwt (>= 1.4, < 3.0)
-      logging (~> 2.0)
-      memoist (~> 0.12)
-      multi_json (~> 1.11)
-      os (~> 0.9)
-      signet (~> 0.7)
-    grpc (1.11.0)
       google-protobuf (~> 3.1)
       googleapis-common-protos-types (~> 1.0.0)
-      googleauth (>= 0.5.1, < 0.7)
     i18n (0.8.1)
+    ice_nine (0.11.2)
     json (2.1.0)
-    jwt (2.1.0)
     licensee (8.9.2)
       rugged (~> 0.24)
-    little-plugger (1.1.4)
+    memoizable (0.4.2)
-    logging (2.2.2)
+      thread_safe (~> 0.3, >= 0.3.1)
-      little-plugger (~> 1.1)
-      multi_json (~> 1.10)
-    memoist (0.16.0)
     mime-types (3.2.2)
       mime-types-data (~> 3.2015)
     mime-types-data (3.2018.0812)
     mini_portile2 (2.3.0)
     minitest (5.9.1)
-    multi_json (1.13.1)
     multipart-post (2.0.0)
     nokogiri (1.8.4)
       mini_portile2 (~> 2.3.0)
     nokogumbo (1.5.0)
       nokogiri
-    os (0.9.6)
+    parallel (1.12.1)
-    parallel (1.12.0)
+    parser (2.5.1.2)
-    parser (2.4.0.0)
+      ast (~> 2.4.0)
-      ast (~> 2.2)
     posix-spawn (0.3.13)
-    powerpack (0.1.1)
+    powerpack (0.1.2)
-    public_suffix (3.0.2)
+    proc_to_ast (0.1.0)
-    rainbow (2.2.2)
+      coderay
-      rake
+      parser
-    rake (12.1.0)
+      unparser
+    procto (0.0.3)
+    rainbow (3.0.0)
     rdoc (4.3.0)
-    rouge (3.2.1)
+    rouge (3.3.0)
     rspec (3.7.0)
       rspec-core (~> 3.7.0)
       rspec-expectations (~> 3.7.0)
@@ -110,56 +105,66 @@ GEM
     rspec-mocks (3.7.0)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.7.0)
+    rspec-parameterized (0.4.0)
+      binding_of_caller
+      parser
+      proc_to_ast
+      rspec (>= 2.13, < 4)
+      unparser
     rspec-support (3.7.1)
-    rubocop (0.50.0)
+    rubocop (0.54.0)
       parallel (~> 1.10)
-      parser (>= 2.3.3.1, < 3.0)
+      parser (>= 2.5)
       powerpack (~> 0.1)
-      rainbow (>= 2.2.2, < 3.0)
+      rainbow (>= 2.2.2, < 4.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (~> 1.0, >= 1.0.1)
-    rubocop-gitlab-security (0.1.0)
+    ruby-progressbar (1.10.0)
-      rubocop (>= 0.47.1)
+    rugged (0.27.5)
-    rubocop-rspec (1.17.0)
-      rubocop (>= 0.50.0)
-    ruby-progressbar (1.8.3)
-    rugged (0.27.4)
     sanitize (4.6.6)
       crass (~> 1.0.2)
       nokogiri (>= 1.4.4)
       nokogumbo (~> 1.4)
     sentry-raven (2.7.2)
       faraday (>= 0.7.6, < 1.0)
-    signet (0.8.1)
-      addressable (~> 2.3)
-      faraday (~> 0.9)
-      jwt (>= 1.5, < 3.0)
-      multi_json (~> 1.10)
     stringex (2.8.4)
     thread_safe (0.3.6)
+    timecop (0.9.1)
     tzinfo (1.2.2)
       thread_safe (~> 0.1)
-    unicode-display_width (1.3.0)
+    unicode-display_width (1.4.0)
+    unparser (0.2.8)
+      abstract_type (~> 0.0.7)
+      adamantium (~> 0.2.0)
+      concord (~> 0.1.5)
+      diff-lcs (~> 1.3)
+      equalizer (~> 0.0.9)
+      parser (>= 2.3.1.2, < 2.6)
+      procto (~> 0.0.2)
 
 PLATFORMS
   ruby
 
 DEPENDENCIES
   activesupport (~> 5.0.2)
+  bundler (>= 1.16.5)
+  factory_bot
   faraday (~> 0.12)
-  gitaly-proto (~> 0.116.0)
+  gitaly-proto (~> 0.123.0)
   github-linguist (~> 6.1)
   gitlab-gollum-lib (~> 4.2)
   gitlab-gollum-rugged_adapter (~> 0.4.4)
   gitlab-markup (~> 1.6.4)
-  gitlab-styles (~> 2.0.0)
+  google-protobuf (~> 3.6)
-  google-protobuf (= 3.5.1)
+  grpc (~> 1.15.0)
-  grpc (~> 1.11.0)
   licensee (~> 8.9.0)
   rdoc (~> 4.2)
   rspec
-  rugged (~> 0.27.4)
+  rspec-parameterized
+  rubocop (~> 0.50)
+  rugged (~> 0.27)
   sentry-raven (~> 2.7.2)
+  timecop
 
 BUNDLED WITH
-   1.16.4
+   1.17.1

pkgs/applications/version-management/gitlab/gitaly/default.nix

@@ -7,14 +7,14 @@ let
     gemdir = ./.;
   };
 in buildGoPackage rec {
-  version = "0.125.1";
+  version = "0.129.0";
   name = "gitaly-${version}";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitaly";
     rev = "v${version}";
-    sha256 = "0vbxjqjs1r5c350r67812andasby5zk25xlaqp201lmlvamiv0ni";
+    sha256 = "0lidqa0w0vy87p5xfmqrfvbyzvl9wj2p918qs2f5rc7shzm38rn6";
   };
 
   goPackagePath = "gitlab.com/gitlab-org/gitaly";

pkgs/applications/version-management/gitlab/gitaly/gemset.nix

@@ -1,4 +1,12 @@
 {
+  abstract_type = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "09330cmhrc2wmfhdj9zzg82sv6cdhm3qgdkva5ni5xfjril2pf14";
+      type = "gem";
+    };
+    version = "0.0.7";
+  };
   activesupport = {
     dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo"];
     source = {
@@ -8,22 +16,31 @@
     };
     version = "5.0.6";
   };
-  addressable = {
+  adamantium = {
-    dependencies = ["public_suffix"];
+    dependencies = ["ice_nine" "memoizable"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0viqszpkggqi8hq87pqp0xykhvz60g99nwmkwsb0v45kc2liwxvk";
+      sha256 = "0165r2ikgfwv2rm8dzyijkp74fvg0ni72hpdx8ay2v7cj08dqyak";
       type = "gem";
     };
-    version = "2.5.2";
+    version = "0.2.0";
   };
   ast = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0pp82blr5fakdk27d1d21xq9zchzb6vmyb1zcsl520s3ygvprn8m";
+      sha256 = "184ssy3w93nkajlz2c70ifm79jp3j737294kbc5fjw69v1w0n9x7";
       type = "gem";
     };
-    version = "2.3.0";
+    version = "2.4.0";
+  };
+  binding_of_caller = {
+    dependencies = ["debug_inspector"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "05syqlks7463zsy1jdfbbdravdhj9hpj5pv2m74blqpv8bq4vv5g";
+      type = "gem";
+    };
+    version = "0.8.0";
   };
   charlock_holmes = {
     source = {
@@ -33,6 +50,23 @@
     };
     version = "0.7.6";
   };
+  coderay = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "15vav4bhcc2x3jmi3izb11l4d9f3xv8hp2fszb7iqmpsccv1pz4y";
+      type = "gem";
+    };
+    version = "1.1.2";
+  };
+  concord = {
+    dependencies = ["adamantium" "equalizer"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1b6cdn0fg4n9gzbdr7zyf4jq40y6h0c0g9cra7wk9hhmsylk91bg";
+      type = "gem";
+    };
+    version = "0.1.5";
+  };
   concurrent-ruby = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -49,6 +83,14 @@
     };
     version = "1.0.4";
   };
+  debug_inspector = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0vxr0xa1mfbkfcrn71n7c4f2dj7la5hvphn904vh20j3x4j5lrx0";
+      type = "gem";
+    };
+    version = "0.0.3";
+  };
   diff-lcs = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -57,6 +99,14 @@
     };
     version = "1.3";
   };
+  equalizer = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1kjmx3fygx8njxfrwcmn7clfhjhb6bvv3scy2lyyi0wqyi3brra4";
+      type = "gem";
+    };
+    version = "0.0.11";
+  };
   escape_utils = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -65,14 +115,23 @@
     };
     version = "1.2.1";
   };
+  factory_bot = {
+    dependencies = ["activesupport"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "13q1b7imb591068plg4ashgsqgzarvfjz6xxn3jk6klzikz5zhg1";
+      type = "gem";
+    };
+    version = "4.11.1";
+  };
   faraday = {
     dependencies = ["multipart-post"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "157c4cmb5g1b3ny6k9qf9z57rfijl54fcq3hnqqf6g31g1m096b2";
+      sha256 = "16hwxc8v0z6gkanckjhx0ffgqmzpc4ywz4dfhxpjlz2mbz8d5m52";
       type = "gem";
     };
-    version = "0.12.2";
+    version = "0.15.3";
   };
   gemojione = {
     dependencies = ["json"];
@@ -84,13 +143,13 @@
     version = "3.3.0";
   };
   gitaly-proto = {
-    dependencies = ["google-protobuf" "grpc"];
+    dependencies = ["grpc"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "15946776v5v8c2jisknjm82s4q3b3q9x2xygjf4bkk4m45n766w1";
+      sha256 = "16b9sdaimhcda401z2s7apf0nz6y0lxs74xhkwlz4jzf6ms44mgg";
       type = "gem";
     };
-    version = "0.116.0";
+    version = "0.123.0";
   };
   github-linguist = {
     dependencies = ["charlock_holmes" "escape_utils" "mime-types" "rugged"];
@@ -144,15 +203,6 @@
     };
     version = "1.6.4";
   };
-  gitlab-styles = {
-    dependencies = ["rubocop" "rubocop-gitlab-security" "rubocop-rspec"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1k8xrkjx8rcny8p0gsp18wskvn1qbw4rfgdp1f6x0p4xp6dlhjf4";
-      type = "gem";
-    };
-    version = "2.0.0";
-  };
   gollum-grit_adapter = {
     dependencies = ["gitlab-grit"];
     source = {
@@ -165,37 +215,28 @@
   google-protobuf = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0s8ijd9wdrkqwsb6nasrsv7f9i5im2nyax7f7jlb5y9vh8nl98qi";
+      sha256 = "134d3ini9ymdwxpz445m28ss9x0m6vcpijcdkzvgk4n538wdmppf";
       type = "gem";
     };
-    version = "3.5.1";
+    version = "3.6.1";
   };
   googleapis-common-protos-types = {
     dependencies = ["google-protobuf"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0yf10s7w8wpa49hc86z7z2fkn9yz7j2njz0n8xmqb24ji090z4ck";
+      sha256 = "01ds7g01pxqm3mg283xjzy0lhhvvhvzw3m7gf7szd1r7la4wf0qq";
       type = "gem";
     };
-    version = "1.0.1";
+    version = "1.0.2";
-  };
-  googleauth = {
-    dependencies = ["faraday" "jwt" "logging" "memoist" "multi_json" "os" "signet"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "08z4zfj9cwry13y8c2w5p4xylyslxxjq4wahd95bk1ddl5pknd4f";
-      type = "gem";
-    };
-    version = "0.6.2";
   };
   grpc = {
-    dependencies = ["google-protobuf" "googleapis-common-protos-types" "googleauth"];
+    dependencies = ["google-protobuf" "googleapis-common-protos-types"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1is4czi3i7y6zyxzyrpsma1z91axmc0jz2ngr6ckixqd3629npkz";
+      sha256 = "0m2wspnm1cfkmhlbp7yqv5bb4vsfh246cm0aavxra67aw4l8plhb";
       type = "gem";
     };
-    version = "1.11.0";
+    version = "1.15.0";
   };
   i18n = {
     source = {
@@ -205,6 +246,14 @@
     };
     version = "0.8.1";
   };
+  ice_nine = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1nv35qg1rps9fsis28hz2cq2fx1i96795f91q4nmkm934xynll2x";
+      type = "gem";
+    };
+    version = "0.11.2";
+  };
   json = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -213,14 +262,6 @@
     };
     version = "2.1.0";
   };
-  jwt = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1w0kaqrbl71cq9sbnixc20x5lqah3hs2i93xmhlfdg2y3by7yzky";
-      type = "gem";
-    };
-    version = "2.1.0";
-  };
   licensee = {
     dependencies = ["rugged"];
     source = {
@@ -230,30 +271,14 @@
     };
     version = "8.9.2";
   };
-  little-plugger = {
+  memoizable = {
+    dependencies = ["thread_safe"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1frilv82dyxnlg8k1jhrvyd73l6k17mxc5vwxx080r4x1p04gwym";
+      sha256 = "0v42bvghsvfpzybfazl14qhkrjvx0xlmxz0wwqc960ga1wld5x5c";
       type = "gem";
     };
-    version = "1.1.4";
+    version = "0.4.2";
-  };
-  logging = {
-    dependencies = ["little-plugger" "multi_json"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "06j6iaj89h9jhkx1x3hlswqrfnqds8br05xb1qra69dpvbdmjcwn";
-      type = "gem";
-    };
-    version = "2.2.2";
-  };
-  memoist = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0pq8fhqh8w25qcw9v3vzfb0i6jp0k3949ahxc3wrwz2791dpbgbh";
-      type = "gem";
-    };
-    version = "0.16.0";
   };
   mime-types = {
     dependencies = ["mime-types-data"];
@@ -288,14 +313,6 @@
     };
     version = "5.9.1";
   };
-  multi_json = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1rl0qy4inf1mp8mybfk56dfga0mvx97zwpmq5xmiwl5r770171nv";
-      type = "gem";
-    };
-    version = "1.13.1";
-  };
   multipart-post = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -322,30 +339,22 @@
     };
     version = "1.5.0";
   };
-  os = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1llv8w3g2jwggdxr5a5cjkrnbbfnvai3vxacxxc0fy84xmz3hymz";
-      type = "gem";
-    };
-    version = "0.9.6";
-  };
   parallel = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0qv2yj4sxr36ga6xdxvbq9h05hn10bwcbkqv6j6q1fiixhsdnnzd";
+      sha256 = "01hj8v1qnyl5ndrs33g8ld8ibk0rbcqdpkpznr04gkbxd11pqn67";
       type = "gem";
     };
-    version = "1.12.0";
+    version = "1.12.1";
   };
   parser = {
     dependencies = ["ast"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "130rfk8a2ws2fyq52hmi1n0xakylw39wv4x1qhai4z17x2b0k9cq";
+      sha256 = "1zp89zg7iypncszxsjp8kiccrpbdf728jl449g6cnfkz990fyb5k";
       type = "gem";
     };
-    version = "2.4.0.0";
+    version = "2.5.1.2";
   };
   posix-spawn = {
     source = {
@@ -358,35 +367,35 @@
   powerpack = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1fnn3fli5wkzyjl4ryh0k90316shqjfnhydmc7f8lqpi0q21va43";
+      sha256 = "1r51d67wd467rpdfl6x43y84vwm8f5ql9l9m85ak1s2sp3nc5hyv";
       type = "gem";
     };
-    version = "0.1.1";
+    version = "0.1.2";
   };
-  public_suffix = {
+  proc_to_ast = {
+    dependencies = ["coderay" "parser" "unparser"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1x5h1dh1i3gwc01jbg01rly2g6a1qwhynb1s8a30ic507z1nh09s";
+      sha256 = "14c65w48bbzp5lh1cngqd1y25kqvfnq1iy49hlzshl12dsk3z9wj";
       type = "gem";
     };
-    version = "3.0.2";
+    version = "0.1.0";
+  };
+  procto = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "13imvg1x50rz3r0yyfbhxwv72lbf7q28qx9l9nfbb91h2n9ch58c";
+      type = "gem";
+    };
+    version = "0.0.3";
   };
   rainbow = {
-    dependencies = ["rake"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "08w2ghc5nv0kcq5b257h7dwjzjz1pqcavajfdx2xjyxqsvh2y34w";
+      sha256 = "0bb2fpjspydr6x0s8pn1pqkzmxszvkfapv0p4627mywl7ky4zkhk";
       type = "gem";
     };
-    version = "2.2.2";
+    version = "3.0.0";
-  };
-  rake = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0mfqgpp3m69s5v1rd51lfh5qpjwyia5p4rg337pw8c8wzm6pgfsw";
-      type = "gem";
-    };
-    version = "12.1.0";
   };
   rdoc = {
     source = {
@@ -399,10 +408,10 @@
   rouge = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0h79gn2wmn1wix2d27lgiaimccyj8gvizrllyym500pir408x62f";
+      sha256 = "1digsi2s8wyzx8vsqcxasw205lg6s7izx8jypl8rrpjwshmv83ql";
       type = "gem";
     };
-    version = "3.2.1";
+    version = "3.3.0";
   };
   rspec = {
     dependencies = ["rspec-core" "rspec-expectations" "rspec-mocks"];
@@ -440,6 +449,15 @@
     };
     version = "3.7.0";
   };
+  rspec-parameterized = {
+    dependencies = ["binding_of_caller" "parser" "proc_to_ast" "rspec" "unparser"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0arynbr6cfjhccwc8gy2xf87nybdnncsnmfwknnh8s7d4mj730p0";
+      type = "gem";
+    };
+    version = "0.4.0";
+  };
   rspec-support = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -452,44 +470,26 @@
     dependencies = ["parallel" "parser" "powerpack" "rainbow" "ruby-progressbar" "unicode-display_width"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1hpd7zcv4y9y750wj630abvmcjwv39dsrj1fjff60ik7gfri0xlz";
+      sha256 = "106y99lq0fg62k3vk1w5wwb4vq16pnh4l61skc82xck627z0h8is";
       type = "gem";
     };
-    version = "0.50.0";
+    version = "0.54.0";
-  };
-  rubocop-gitlab-security = {
-    dependencies = ["rubocop"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0aw9qmyc6xj6fi0jxp8m4apk358rd91z492ragn6jp4rghkqj5cy";
-      type = "gem";
-    };
-    version = "0.1.0";
-  };
-  rubocop-rspec = {
-    dependencies = ["rubocop"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1hf48ng67yswvshmv4cyysj1rs1z3fnvlycr50jdcgwlynpyxkhs";
-      type = "gem";
-    };
-    version = "1.17.0";
   };
   ruby-progressbar = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "029kv0q3kfq53rjyak4ypn7196l8z4hflfmv4p5787n78z7baiqf";
+      sha256 = "1cv2ym3rl09svw8940ny67bav7b2db4ms39i4raaqzkf59jmhglk";
       type = "gem";
     };
-    version = "1.8.3";
+    version = "1.10.0";
   };
   rugged = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1y6k5yrfmhc1v4albbpa3xzl28vk5lric3si8ada28sp9mmk2x72";
+      sha256 = "1jv4nw9hvlxp8hhhlllrfcznki82i50fp1sj65zsjllfl2bvz8x6";
       type = "gem";
     };
-    version = "0.27.4";
+    version = "0.27.5";
   };
   sanitize = {
     dependencies = ["crass" "nokogiri" "nokogumbo"];
@@ -509,15 +509,6 @@
     };
     version = "2.7.2";
   };
-  signet = {
-    dependencies = ["addressable" "faraday" "jwt" "multi_json"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0js81lxqirdza8gf2f6avh11fny49ygmxfi1qx7jp8l9wrhznbkv";
-      type = "gem";
-    };
-    version = "0.8.1";
-  };
   stringex = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -534,6 +525,14 @@
     };
     version = "0.3.6";
   };
+  timecop = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0d7mm786180v4kzvn1f77rhfppsg5n0sq2bdx63x9nv114zm8jrp";
+      type = "gem";
+    };
+    version = "0.9.1";
+  };
   tzinfo = {
     dependencies = ["thread_safe"];
     source = {
@@ -546,9 +545,18 @@
   unicode-display_width = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "12pi0gwqdnbx1lv5136v3vyr0img9wr0kxcn4wn54ipq4y41zxq8";
+      sha256 = "0040bsdpcmvp8w31lqi2s9s4p4h031zv52401qidmh25cgyh4a57";
       type = "gem";
     };
-    version = "1.3.0";
+    version = "1.4.0";
+  };
+  unparser = {
+    dependencies = ["abstract_type" "adamantium" "concord" "diff-lcs" "equalizer" "parser" "procto"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0rh1649846ac17av30x0b0v9l45v0x1j2y1i8m1a7xdd0v4sld0z";
+      type = "gem";
+    };
+    version = "0.2.8";
   };
 }

pkgs/applications/version-management/gitlab/gitlab-shell/default.nix

@@ -1,14 +1,14 @@
 { stdenv, ruby, bundler, fetchFromGitLab, go }:
 
 stdenv.mkDerivation rec {
-  version = "8.3.3";
+  version = "8.4.1";
   name = "gitlab-shell-${version}";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-shell";
     rev = "v${version}";
-    sha256 = "1qapw0yvlw1nxjik7jpbbbl3yx299sfvdx67zsd5ai7bhk1gd8xl";
+    sha256 = "00jzrpdfqgrba2qi5ngc0g07p7gmip7my563hw542gg8l88d27xq";
   };
 
   buildInputs = [ ruby bundler go ];

pkgs/applications/version-management/gitlab/gitlab-shell/remove-hardcoded-locations.patch

@@ -0,0 +1,45 @@
+diff --git a/go/internal/config/config.go b/go/internal/config/config.go
+index 435cb29..078c1df 100644
+--- a/go/internal/config/config.go
++++ b/go/internal/config/config.go
+@@ -2,7 +2,6 @@ package config
+ 
+ import (
+ 	"io/ioutil"
+-	"os"
+ 	"path"
+ 
+ 	yaml "gopkg.in/yaml.v2"
+@@ -26,16 +25,13 @@ type Config struct {
+ }
+ 
+ func New() (*Config, error) {
+-	dir, err := os.Getwd()
+-	if err != nil {
+-		return nil, err
+-	}
++	dir := "/run/gitlab"
+ 
+ 	return NewFromDir(dir)
+ }
+ 
+ func NewFromDir(dir string) (*Config, error) {
+-	return newFromFile(path.Join(dir, configFile))
++	return newFromFile(path.Join(dir, "shell-config.yml"))
+ }
+ 
+ func newFromFile(filename string) (*Config, error) {
+diff --git a/lib/gitlab_shell.rb b/lib/gitlab_shell.rb
+index 57c70f5..700569b 100644
+--- a/lib/gitlab_shell.rb
++++ b/lib/gitlab_shell.rb
+@@ -187,7 +187,8 @@ class GitlabShell # rubocop:disable Metrics/ClassLength
+ 
+     args = [executable, gitaly_address, json_args]
+     # We use 'chdir: ROOT_PATH' to let the next executable know where config.yml is.
+-    Kernel.exec(env, *args, unsetenv_others: true, chdir: ROOT_PATH)
++    # Except we don't, because we're already in the right directory on nixos!
++    Kernel.exec(env, *args, unsetenv_others: true)
+   end
+ 
+   def api

pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix

@@ -3,18 +3,18 @@
 stdenv.mkDerivation rec {
   name = "gitlab-workhorse-${version}";
 
-  version = "7.0.0";
+  version = "7.1.0";
 
-  srcs = fetchFromGitLab {
+  src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-workhorse";
     rev = "v${version}";
-    sha256 = "1mmfb7h5sbva2kv9h9cxfg7dyksxrwwikq7jwggfawqaadzwm677";
+    sha256 = "1jq28z2kf58wnbv8jkwfx2bm8ki22hpm9ssdy2ymza22gq0zx00g";
   };
 
   buildInputs = [ git go ];
 
-  patches = [ ./remove-hardcoded-paths.patch ./deterministic-build.patch ];
+  patches = [ ./remove-hardcoded-paths.patch ];
 
   makeFlags = [ "PREFIX=$(out)" "VERSION=${version}" ];
 

pkgs/applications/version-management/gitlab/update.py

@@ -0,0 +1,234 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i python3 -p bundix common-updater-scripts nix nix-prefetch-git python3 python3Packages.requests python3Packages.lxml python3Packages.click python3Packages.click-log
+
+import click
+import click_log
+import os
+import re
+import logging
+import subprocess
+import json
+import pathlib
+from typing import Iterable
+
+import requests
+from xml.etree import ElementTree
+
+logger = logging.getLogger(__name__)
+
+
+class GitLabRepo:
+    def __init__(self, owner: str, repo: str):
+        self.owner = owner
+        self.repo = repo
+
+    @property
+    def url(self):
+        return f"https://gitlab.com/{self.owner}/{self.repo}"
+
+    @property
+    def tags(self) -> Iterable[str]:
+        r = requests.get(self.url + "/tags?format=atom", stream=True)
+
+        tree = ElementTree.fromstring(r.content)
+        return sorted((e.text for e in tree.findall(
+            '{http://www.w3.org/2005/Atom}entry/{http://www.w3.org/2005/Atom}title')), reverse=True)
+
+    def get_git_hash(self, rev: str):
+        out = subprocess.check_output(['nix-prefetch-git', self.url, rev])
+        j = json.loads(out)
+        return j['sha256']
+
+    def get_deb_url(self, flavour: str, version: str, arch: str = 'amd64') -> str:
+        """
+        gitlab builds debian packages, which we currently need as we don't build the frontend on our own
+        this returns the url of a given flavour, version and arch
+        :param flavour: 'ce' or 'ee'
+        :param version: a version, without 'v' prefix and '-ee' suffix
+        :param arch: amd64
+        :return: url of the debian package
+        """
+        if self.owner != "gitlab-org" or self.repo not in ['gitlab-ce', 'gitlab-ee']:
+            raise Exception(f"don't know how to get deb_url for {self.url}")
+        return f"https://packages.gitlab.com/gitlab/gitlab-{flavour}/packages" + \
+               f"/debian/stretch/gitlab-{flavour}_{version}-{flavour}.0_{arch}.deb/download.deb"
+
+    def get_deb_hash(self, flavour: str, version: str) -> str:
+        out = subprocess.check_output(['nix-prefetch-url', self.get_deb_url(flavour, version)])
+        return out.decode('utf-8').strip()
+
+    @staticmethod
+    def rev2version(tag: str) -> str:
+        """
+        normalize a tag to a version number.
+        This obviously isn't very smart if we don't pass something that looks like a tag
+        :param tag: the tag to normalize
+        :return: a normalized version number
+        """
+        # strip v prefix
+        version = re.sub(r"^v", '', tag)
+        # strip -ee suffix
+        return re.sub(r"-ee$", '', version)
+
+    def get_file(self, filepath, rev):
+        """
+        returns file contents at a given rev
+        :param filepath: the path to the file, relative to the repo root
+        :param rev: the rev to fetch at
+        :return:
+        """
+        return requests.get(self.url + f"/raw/{rev}/{filepath}").text
+
+    def get_data(self, rev, flavour):
+        version = self.rev2version(rev)
+
+        passthru = {v: self.get_file(v, rev).strip() for v in ['GITALY_SERVER_VERSION', 'GITLAB_PAGES_VERSION',
+                                                               'GITLAB_SHELL_VERSION', 'GITLAB_WORKHORSE_VERSION']}
+        return dict(version=self.rev2version(rev),
+                    repo_hash=self.get_git_hash(rev),
+                    deb_hash=self.get_deb_hash(flavour, version),
+                    deb_url=self.get_deb_url(flavour, version),
+                    owner=self.owner,
+                    repo=self.repo,
+                    rev=rev,
+                    passthru=passthru)
+
+
+def _flavour2gitlabrepo(flavour: str):
+    if flavour not in ['ce', 'ee']:
+        raise Exception(f"unknown gitlab flavour: {flavour}, needs to be ce or ee")
+
+    owner = 'gitlab-org'
+    repo = 'gitlab-' + flavour
+
+    return GitLabRepo(owner, repo)
+
+
+def _update_data_json(filename: str, repo: GitLabRepo, rev: str, flavour: str):
+    flavour_data = repo.get_data(rev, flavour)
+
+    if not os.path.exists(filename):
+        with open(filename, 'w') as f:
+            json.dump({flavour: flavour_data}, f, indent=2)
+    else:
+        with open(filename, 'r+') as f:
+            data = json.load(f)
+            data[flavour] = flavour_data
+            f.seek(0)
+            json.dump(data, f, indent=2)
+
+
+def _get_data_json():
+    data_file_path = pathlib.Path(__file__).parent / 'data.json'
+    with open(data_file_path, 'r') as f:
+        return json.load(f)
+
+
+def _call_update_source_version(pkg, version):
+    """calls update-source-version from nixpkgs root dir"""
+    nixpkgs_path = pathlib.Path(__file__).parent / '../../../../'
+    return subprocess.check_output(['update-source-version', pkg, version], cwd=nixpkgs_path)
+
+
+@click_log.simple_verbosity_option(logger)
+@click.group()
+def cli():
+    pass
+
+
+@cli.command('update-data')
+@click.option('--rev', default='latest', help='The rev to use, \'latest\' points to the latest (stable) tag')
+@click.argument('flavour')
+def update_data(rev: str, flavour: str):
+    """Update data.nix for a selected flavour"""
+    r = _flavour2gitlabrepo(flavour)
+
+    if rev == 'latest':
+        # filter out pre and re releases
+        rev = next(filter(lambda x: not ('rc' in x or x.endswith('pre')), r.tags))
+    logger.debug(f"Using rev {rev}")
+
+    version = r.rev2version(rev)
+    logger.debug(f"Using version {version}")
+
+    data_file_path = pathlib.Path(__file__).parent / 'data.json'
+
+    _update_data_json(filename=data_file_path.as_posix(),
+                      repo=r,
+                      rev=rev,
+                      flavour=flavour)
+
+
+@cli.command('update-rubyenv')
+@click.argument('flavour')
+def update_rubyenv(flavour):
+    """Update rubyEnv-${flavour}"""
+    if flavour not in ['ce', 'ee']:
+        raise Exception(f"unknown gitlab flavour: {flavour}, needs to be ce or ee")
+
+    r = _flavour2gitlabrepo(flavour)
+    rubyenv_dir = pathlib.Path(__file__).parent / f"rubyEnv-{flavour}"
+
+    # load rev from data.json
+    data = _get_data_json()
+    rev = data[flavour]['rev']
+
+    for fn in ['Gemfile.lock', 'Gemfile']:
+        with open(rubyenv_dir / fn, 'w') as f:
+            f.write(r.get_file(fn, rev))
+
+    subprocess.check_output(['bundix'], cwd=rubyenv_dir)
+
+
+@cli.command('update-gitaly')
+def update_gitaly():
+    """Update gitaly"""
+    data = _get_data_json()
+    gitaly_server_version = data['ce']['passthru']['GITALY_SERVER_VERSION']
+    r = GitLabRepo('gitlab-org', 'gitaly')
+    rubyenv_dir = pathlib.Path(__file__).parent / 'gitaly'
+
+    for fn in ['Gemfile.lock', 'Gemfile']:
+        with open(rubyenv_dir / fn, 'w') as f:
+            f.write(r.get_file(f"ruby/{fn}", f"v{gitaly_server_version}"))
+
+    subprocess.check_output(['bundix'], cwd=rubyenv_dir)
+    # currently broken, as `gitaly.meta.position` returns
+    # pkgs/development/go-modules/generic/default.nix
+    # so update-source-version doesn't know where to update hashes
+    # _call_update_source_version('gitaly', gitaly_server_version)
+    gitaly_hash = r.get_git_hash(f"v{gitaly_server_version}")
+    click.echo(f"Please update gitaly/default.nix to version {gitaly_server_version} and hash {gitaly_hash}")
+
+
+
+@cli.command('update-gitlab-shell')
+def update_gitlab_shell():
+    """Update gitlab-shell"""
+    data = _get_data_json()
+    gitlab_shell_version = data['ce']['passthru']['GITLAB_SHELL_VERSION']
+    _call_update_source_version('gitlab-shell', gitlab_shell_version)
+
+
+@cli.command('update-gitlab-workhorse')
+def update_gitlab_workhorse():
+    """Update gitlab-shell"""
+    data = _get_data_json()
+    gitlab_workhorse_version = data['ce']['passthru']['GITLAB_WORKHORSE_VERSION']
+    _call_update_source_version('gitlab-workhorse', gitlab_workhorse_version)
+
+
+@cli.command('update-all')
+@click.pass_context
+def update_all(ctx):
+    """Update gitlab ce and ee data.nix and rubyenvs to the latest stable release"""
+    for flavour in ['ce', 'ee']:
+        ctx.invoke(update_data, rev='latest', flavour=flavour)
+        ctx.invoke(update_rubyenv, flavour=flavour)
+    ctx.invoke(update_gitaly)
+    ctx.invoke(update_gitlab_shell)
+    ctx.invoke(update_gitlab_workhorse)
+
+
+if __name__ == '__main__':
+    cli()

pkgs/applications/virtualization/open-vm-tools/default.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   name = "open-vm-tools-${version}";
-  version = "10.3.0";
+  version = "10.3.5";
 
   src = fetchFromGitHub {
     owner  = "vmware";
     repo   = "open-vm-tools";
     rev    = "stable-${version}";
-    sha256 = "0arx4yd8c5qszfgw8rqyi65j37r46dxibmzqqxb096isxhxjymw6";
+    sha256 = "10x24gkqcg9lnfxghq92nr76h40s5v3xrv0ymi9c7aqrqry404z7";
   };
 
   sourceRoot = "${src.name}/open-vm-tools";

pkgs/build-support/build-fhs-userenv/chrootenv/chrootenv.c

@@ -19,7 +19,7 @@
 #include <sys/types.h>
 #include <sys/wait.h>
 
-const gchar *bind_blacklist[] = {"bin", "etc", "host", "usr", NULL};
+const gchar *bind_blacklist[] = {"bin", "etc", "host", "usr", "lib", "lib64", "lib32", "sbin", NULL};
 
 void bind_mount(const gchar *source, const gchar *target) {
   fail_if(g_mkdir(target, 0755));

pkgs/build-support/emacs/melpa.nix

@@ -35,11 +35,11 @@ import ./generic.nix { inherit lib stdenv emacs texinfo; } ({
     then pname
     else ename;
 
-  melpa = fetchFromGitHub {
+  packageBuild = fetchFromGitHub {
     owner = "melpa";
-    repo = "melpa";
+    repo = "package-build";
-    rev = "7103313a7c31bb1ebb71419e365cd2e279ee4609";
+    rev = "0a22c3fbbf661822ec1791739953b937a12fa623";
-    sha256 = "0m10f83ix0mzjk0vjd4kkb1m1p4b8ha0ll2yjsgk9bqjd7fwapqb";
+    sha256 = "0dpy5p34il600sc8ic5jdgb3glya9si3lrvhxab0swks8fdydjgs";
   };
 
   elpa2nix = ./elpa2nix.el;
@@ -51,7 +51,7 @@ import ./generic.nix { inherit lib stdenv emacs texinfo; } ({
       cp "$recipe" "$NIX_BUILD_TOP/recipes/$ename"
     fi
 
-    ln -s "$melpa/package-build" "$NIX_BUILD_TOP/package-build"
+    ln -s "$packageBuild" "$NIX_BUILD_TOP/package-build"
 
     mkdir -p "$NIX_BUILD_TOP/packages"
   '';
@@ -61,19 +61,18 @@ import ./generic.nix { inherit lib stdenv emacs texinfo; } ({
     ln -s "$NIX_BUILD_TOP/$sourceRoot" "$NIX_BUILD_TOP/working/$ename"
   '';
 
-  buildPhase =
+  buildPhase = ''
-    ''
+    runHook preBuild
-      runHook preBuild
 
-      cd "$NIX_BUILD_TOP"
+    cd "$NIX_BUILD_TOP"
 
-      emacs --batch -Q \
+    emacs --batch -Q \
-          -L "$melpa/package-build" \
+        -L "$NIX_BUILD_TOP/package-build" \
-          -l "$melpa2nix" \
+        -l "$melpa2nix" \
-          -f melpa2nix-build-package \
+        -f melpa2nix-build-package \
-          $ename $version
+        $ename $version
 
-      runHook postBuild
+    runHook postBuild
     '';
 
   installPhase = ''

pkgs/build-support/emacs/trivial.nix

@@ -7,27 +7,22 @@ with lib;
 args:
 
 import ./generic.nix envargs ({
-  #preConfigure = ''
-  #  export LISPDIR=$out/share/emacs/site-lisp
-  #  export VERSION_SPECIFIC_LISPDIR=$out/share/emacs/site-lisp
-  #'';
-
   buildPhase = ''
-    eval "$preBuild"
+    runHook preBuild
 
     emacs -L . --batch -f batch-byte-compile *.el
 
-    eval "$postBuild"
+    runHook postBuild
   '';
 
   installPhase = ''
-    eval "$preInstall"
+    runHook preInstall
 
     LISPDIR=$out/share/emacs/site-lisp
     install -d $LISPDIR
     install *.el *.elc $LISPDIR
 
-    eval "$postInstall"
+    runHook postInstall
   '';
 }
 

pkgs/build-support/setup-hooks/auto-patchelf.sh

@@ -147,15 +147,56 @@ autoPatchelfFile() {
     fi
 }
 
+# Can be used to manually add additional directories with shared object files
+# to be included for the next autoPatchelf invocation.
+addAutoPatchelfSearchPath() {
+    local -a findOpts=()
+
+    # XXX: Somewhat similar to the one in the autoPatchelf function, maybe make
+    #      it DRY someday...
+    while [ $# -gt 0 ]; do
+        case "$1" in
+            --) shift; break;;
+            --no-recurse) shift; findOpts+=("-maxdepth" 1);;
+            --*)
+                echo "addAutoPatchelfSearchPath: ERROR: Invalid command line" \
+                     "argument: $1" >&2
+                return 1;;
+            *) break;;
+        esac
+    done
+
+    cachedDependencies+=(
+        $(find "$@" "${findOpts[@]}" \! -type d \
+               \( -name '*.so' -o -name '*.so.*' \))
+    )
+}
+
 autoPatchelf() {
+    local norecurse=
+
+    while [ $# -gt 0 ]; do
+        case "$1" in
+            --) shift; break;;
+            --no-recurse) shift; norecurse=1;;
+            --*)
+                echo "autoPatchelf: ERROR: Invalid command line" \
+                     "argument: $1" >&2
+                return 1;;
+            *) break;;
+        esac
+    done
+
+    if [ $# -eq 0 ]; then
+        echo "autoPatchelf: No paths to patch specified." >&2
+        return 1
+    fi
+
     echo "automatically fixing dependencies for ELF files" >&2
 
     # Add all shared objects of the current output path to the start of
     # cachedDependencies so that it's choosen first in findDependency.
-    cachedDependencies+=(
+    addAutoPatchelfSearchPath ${norecurse:+--no-recurse} -- "$@"
-        $(find "$prefix" \! -type d \( -name '*.so' -o -name '*.so.*' \))
-    )
-    local elffile
 
     # Here we actually have a subshell, which also means that
     # $cachedDependencies is final at this point, so whenever we want to run
@@ -164,12 +205,15 @@ autoPatchelf() {
     # outside of this function.
     while IFS= read -r -d $'\0' file; do
       isELF "$file" || continue
+      segmentHeaders="$(LANG=C readelf -l "$file")"
+      # Skip if the ELF file doesn't have segment headers (eg. object files).
+      echo "$segmentHeaders" | grep -q '^Program Headers:' || continue
       if isExecutable "$file"; then
           # Skip if the executable is statically linked.
-          LANG=C readelf -l "$file" | grep -q "^ *INTERP\\>" || continue
+          echo "$segmentHeaders" | grep -q "^ *INTERP\\>" || continue
       fi
       autoPatchelfFile "$file"
-    done < <(find "$prefix" -type f -print0)
+    done < <(find "$@" ${norecurse:+-maxdepth 1} -type f -print0)
 }
 
 # XXX: This should ultimately use fixupOutputHooks but we currently don't have
@@ -180,6 +224,11 @@ autoPatchelf() {
 # So what we do here is basically run in postFixup and emulate the same
 # behaviour as fixupOutputHooks because the setup hook for patchelf is run in
 # fixupOutput and the postFixup hook runs later.
-postFixupHooks+=(
+postFixupHooks+=('
-    'for output in $outputs; do prefix="${!output}" autoPatchelf; done'
+    if [ -z "$dontAutoPatchelf" ]; then
-)
+        autoPatchelf -- $(for output in $outputs; do
+            [ -e "${!output}" ] || continue
+            echo "${!output}"
+        done)
+    fi
+')

pkgs/build-support/writers/default.nix

@@ -0,0 +1,239 @@
+{ pkgs, lib }:
+
+with lib;
+rec {
+  # Base implementation for non-compiled executables.
+  # Takes an interpreter, for example `${pkgs.bash}/bin/bash`
+  #
+  # Examples:
+  #   writeBash = makeScriptWriter { interpreter = "${pkgs.bash}/bin/bash"; }
+  #   makeScriptWriter { interpreter = "${pkgs.dash}/bin/dash"; } "hello" "echo hello world"
+  makeScriptWriter = { interpreter, check ? "" }: name: text:
+    assert lib.or (types.path.check name) (builtins.match "([0-9A-Za-z._])[0-9A-Za-z._-]*" name != null);
+
+    pkgs.writeTextFile {
+      name = last (builtins.split "/" name);
+      executable = true;
+      destination = if types.path.check name then name else "";
+      text = ''
+        #! ${interpreter}
+        ${text}
+        '';
+      checkPhase = check;
+    };
+
+  # Like writeScript but the first line is a shebang to bash
+  #
+  # Example:
+  #   writeBash "example" ''
+  #     echo hello world
+  #   ''
+  writeBash = makeScriptWriter {
+    interpreter = "${pkgs.bash}/bin/bash";
+  };
+
+  # Like writeScriptBIn but the first line is a shebang to bash
+  writeBashBin = name:
+    writeBash "/bin/${name}";
+
+  # writeC writes an executable c package called `name` to `destination` using `libraries`.
+  #
+  #  Examples:
+  #    writeC "hello-world-ncurses" { libraries = [ pkgs.ncurses ]; } ''
+  #      #include <ncurses.h>
+  #      int main() {
+  #        initscr();
+  #        printw("Hello World !!!");
+  #        refresh(); endwin();
+  #        return 0;
+  #      }
+  #    ''
+  writeC = name: {
+    libraries ? [],
+  }: text: pkgs.runCommand name {
+    inherit text;
+    buildInputs = [ pkgs.pkgconfig ] ++ libraries;
+    passAsFile = [ "text" ];
+  } ''
+    PATH=${makeBinPath [
+      pkgs.binutils-unwrapped
+      pkgs.coreutils
+      pkgs.gcc
+      pkgs.pkgconfig
+    ]}
+    mkdir -p "$(dirname "$out")"
+    gcc \
+        ${optionalString (libraries != [])
+          "$(pkg-config --cflags --libs ${
+            concatMapStringsSep " " (lib: escapeShellArg (builtins.parseDrvName lib.name).name) (libraries)
+          })"
+        } \
+        -O \
+        -o "$out" \
+        -Wall \
+        -x c \
+        "$textPath"
+    strip --strip-unneeded "$out"
+  '';
+
+  # writeCBin takes the same arguments as writeC but outputs a directory (like writeScriptBin)
+  writeCBin = name: spec: text:
+    pkgs.runCommand name {
+    } ''
+      mkdir -p $out/bin
+      ln -s ${writeC name spec text} $out/bin/${name}
+    '';
+
+  # Like writeScript but the first line is a shebang to dash
+  #
+  # Example:
+  #   writeDash "example" ''
+  #     echo hello world
+  #   ''
+  writeDash = makeScriptWriter {
+    interpreter = "${pkgs.dash}/bin/dash";
+  };
+
+  # Like writeScriptBin but the first line is a shebang to dash
+  writeDashBin = name:
+    writeDash "/bin/${name}";
+
+  # writeHaskell takes a name, an attrset with libraries and haskell version (both optional)
+  # and some haskell source code and returns an executable.
+  #
+  # Example:
+  #   writeHaskell "missiles" { libraries = [ pkgs.haskellPackages.acme-missiles ]; } ''
+  #     Import Acme.Missiles
+  #
+  #     main = launchMissiles
+  #   '';
+  writeHaskell = name: {
+    libraries ? [],
+    ghc ? pkgs.ghc
+  }: text: pkgs.runCommand name {
+    inherit text;
+    passAsFile = [ "text" ];
+  } ''
+    cp $textPath ${name}.hs
+    ${ghc.withPackages (_: libraries )}/bin/ghc ${name}.hs
+    cp ${name} $out
+  '';
+
+  # writeHaskellBin takes the same arguments as writeHaskell but outputs a directory (like writeScriptBin)
+  writeHaskellBin = name: spec: text:
+    pkgs.runCommand name {
+    } ''
+      mkdir -p $out/bin
+      ln -s ${writeHaskell name spec text} $out/bin/${name}
+    '';
+
+  # writeJS takes a name an attributeset with libraries and some JavaScript sourcecode and
+  # returns an executable
+  #
+  # Example:
+  #   writeJS "example" { libraries = [ pkgs.nodePackages.uglify-js ]; } ''
+  #     var UglifyJS = require("uglify-js");
+  #     var code = "function add(first, second) { return first + second; }";
+  #     var result = UglifyJS.minify(code);
+  #     console.log(result.code);
+  #   ''
+  writeJS = name: { libraries ? [] }: text:
+  let
+    node-env = pkgs.buildEnv {
+      name = "node";
+      paths = libraries;
+      pathsToLink = [
+        "/lib/node_modules"
+      ];
+    };
+  in writeDash name ''
+    export NODE_PATH=${node-env}/lib/node_modules
+    exec ${pkgs.nodejs}/bin/node ${pkgs.writeText "js" text}
+  '';
+
+  # writeJSBin takes the same arguments as writeJS but outputs a directory (like writeScriptBin)
+  writeJSBin = name:
+    writeJS "/bin/${name}";
+
+  # writePerl takes a name an attributeset with libraries and some perl sourcecode and
+  # returns an executable
+  #
+  # Example:
+  #   writePerl "example" { libraries = [ pkgs.perlPackages.boolean ]; } ''
+  #     use boolean;
+  #     print "Howdy!\n" if true;
+  #   ''
+  writePerl = name: { libraries ? [] }:
+  let
+    perl-env = pkgs.buildEnv {
+      name = "perl-environment";
+      paths = libraries;
+      pathsToLink = [
+        "/lib/perl5/site_perl"
+      ];
+    };
+  in
+  makeScriptWriter {
+    interpreter = "${pkgs.perl}/bin/perl -I ${perl-env}/lib/perl5/site_perl";
+  } name;
+
+  # writePerlBin takes the same arguments as writePerl but outputs a directory (like writeScriptBin)
+  writePerlBin = name:
+    writePerl "/bin/${name}";
+
+  # writePython2 takes a name an attributeset with libraries and some python2 sourcecode and
+  # returns an executable
+  #
+  # Example:
+  # writePython2 "test_python2" { libraries = [ pkgs.python2Packages.enum ]; } ''
+  #   from enum import Enum
+  #
+  #   class Test(Enum):
+  #       a = "success"
+  #
+  #   print Test.a
+  # ''
+  writePython2 = name: { libraries ? [], flakeIgnore ? [] }:
+  let
+    py = pkgs.python2.withPackages (ps: libraries);
+    ignoreAttribute = optionalString (flakeIgnore != []) "--ignore ${concatMapStringsSep "," escapeShellArg flakeIgnore}";
+  in
+  makeScriptWriter {
+    interpreter = "${py}/bin/python";
+    check = writeDash "python2check.sh" ''
+      exec ${pkgs.python2Packages.flake8}/bin/flake8 --show-source ${ignoreAttribute} "$1"
+    '';
+  } name;
+
+  # writePython2Bin takes the same arguments as writePython2 but outputs a directory (like writeScriptBin)
+  writePython2Bin = name:
+    writePython2 "/bin/${name}";
+
+  # writePython3 takes a name an attributeset with libraries and some python3 sourcecode and
+  # returns an executable
+  #
+  # Example:
+  # writePython3 "test_python3" { libraries = [ pkgs.python3Packages.pyyaml ]; } ''
+  #   import yaml
+  #
+  #   y = yaml.load("""
+  #     - test: success
+  #   """)
+  #   print(y[0]['test'])
+  # ''
+  writePython3 = name: { libraries ? [], flakeIgnore ? [] }:
+  let
+    py = pkgs.python3.withPackages (ps: libraries);
+    ignoreAttribute = optionalString (flakeIgnore != []) "--ignore ${concatMapStringsSep "," escapeShellArg flakeIgnore}";
+  in
+  makeScriptWriter {
+    interpreter = "${py}/bin/python";
+    check = writeDash "python3check.sh" ''
+      exec ${pkgs.python3Packages.flake8}/bin/flake8 --show-source ${ignoreAttribute} "$1"
+    '';
+  } name;
+
+  # writePython3Bin takes the same arguments as writePython3 but outputs a directory (like writeScriptBin)
+  writePython3Bin = name:
+    writePython3 "/bin/${name}";
+}

pkgs/build-support/writers/test.nix

@@ -0,0 +1,149 @@
+{ stdenv, lib, runCommand, haskellPackages, nodePackages, perlPackages, python2Packages, python3Packages, writers}:
+with writers;
+let
+
+  bin = {
+    bash = writeBashBin "test_writers" ''
+     if [[ "test" == "test" ]]; then echo "success"; fi
+    '';
+
+    c = writeCBin "test_writers" { libraries = [ ]; } ''
+      #include <stdio.h>
+      int main() {
+        printf("success\n");
+        return 0;
+      }
+    '';
+
+    dash = writeDashBin "test_writers" ''
+     test '~' = '~' && echo 'success'
+    '';
+
+    haskell = writeHaskellBin "test_writers" { libraries = [ haskellPackages.acme-default ]; } ''
+      import Data.Default
+
+      int :: Int
+      int = def
+
+      main :: IO ()
+      main = case int of
+        18871 -> putStrLn $ id "success"
+        _ -> print "fail"
+    '';
+
+    js = writeJSBin "test_writers" { libraries = [ nodePackages.semver ]; } ''
+      var semver = require('semver');
+
+      if (semver.valid('1.2.3')) {
+        console.log('success')
+      } else {
+        console.log('fail')
+      }
+    '';
+
+    perl = writePerlBin "test_writers" { libraries = [ perlPackages.boolean ]; } ''
+      use boolean;
+      print "success\n" if true;
+    '';
+
+    python2 = writePython2Bin "test_writers" { libraries = [ python2Packages.enum ]; } ''
+      from enum import Enum
+
+      class Test(Enum):
+          a = "success"
+
+      print Test.a
+    '';
+
+    python3 = writePython3Bin "test_writers" { libraries = [ python3Packages.pyyaml ]; } ''
+      import yaml
+
+      y = yaml.load("""
+        - test: success
+      """)
+      print(y[0]['test'])
+    '';
+  };
+
+  simple = {
+    bash = writeBash "test_bash" ''
+     if [[ "test" == "test" ]]; then echo "success"; fi
+    '';
+
+    c = writeC "test_c" { libraries = [ ]; } ''
+      #include <stdio.h>
+      int main() {
+        printf("success\n");
+        return 0;
+      }
+    '';
+
+    dash = writeDash "test_dash" ''
+     test '~' = '~' && echo 'success'
+    '';
+
+    haskell = writeHaskell "test_haskell" { libraries = [ haskellPackages.acme-default ]; } ''
+      import Data.Default
+
+      int :: Int
+      int = def
+
+      main :: IO ()
+      main = case int of
+        18871 -> putStrLn $ id "success"
+        _ -> print "fail"
+    '';
+
+    js = writeJS "test_js" { libraries = [ nodePackages.semver ]; } ''
+      var semver = require('semver');
+
+      if (semver.valid('1.2.3')) {
+        console.log('success')
+      } else {
+        console.log('fail')
+      }
+    '';
+
+    perl = writePerl "test_perl" { libraries = [ perlPackages.boolean ]; } ''
+      use boolean;
+      print "success\n" if true;
+    '';
+
+    python2 = writePython2 "test_python2" { libraries = [ python2Packages.enum ]; } ''
+      from enum import Enum
+
+      class Test(Enum):
+          a = "success"
+
+      print Test.a
+    '';
+
+    python3 = writePython3 "test_python3" { libraries = [ python3Packages.pyyaml ]; } ''
+      import yaml
+
+      y = yaml.load("""
+        - test: success
+      """)
+      print(y[0]['test'])
+    '';
+  };
+
+  writeTest = expectedValue: test:
+    writeDash "test-writers" ''
+      if test "$(${test})" != "${expectedValue}"; then
+        echo 'test ${test} failed'
+        exit 1
+      fi
+    '';
+
+in runCommand "test-writers" {
+  passthru = { inherit writeTest bin simple; };
+  meta.platforms = stdenv.lib.platforms.all;
+} ''
+  ${lib.concatMapStringsSep "\n" (test: writeTest "success" "${test}/bin/test_writers") (lib.attrValues bin)}
+  ${lib.concatMapStringsSep "\n" (test: writeTest "success" "${test}") (lib.attrValues simple)}
+
+  echo 'nix-writers successfully tested' >&2
+  touch $out
+''
+

pkgs/desktops/gnome-3/core/gnome-keyring/default.nix

@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     patchShebangs build
   '';
 
-  doCheck = true;
+  doCheck = !stdenv.isi686; # https://github.com/NixOS/nixpkgs/issues/51121
   # In 3.20.1, tests do not support Python 3
   checkInputs = [ dbus python2 ];
 

pkgs/development/haskell-modules/configuration-common.nix

@@ -33,7 +33,7 @@ self: super: {
   unbuildable = throw "package depends on meta package 'unbuildable'";
 
   # Use the latest version of the Cabal library.
-  cabal-install = super.cabal-install.overrideScope (self: super: { Cabal = self.Cabal_2_4_0_1; });
+  cabal-install = super.cabal-install.overrideScope (self: super: { Cabal = self.Cabal_2_4_1_0; });
 
   # The test suite depends on old versions of tasty and QuickCheck.
   hackage-security = dontCheck super.hackage-security;
@@ -1185,4 +1185,7 @@ self: super: {
   # });
   libnix = dontCheck super.libnix;
 
+  # https://github.com/jmillikin/chell/issues/1
+  chell = super.chell.override { patience = self.patience_0_1_1; };
+
 } // import ./configuration-tensorflow.nix {inherit pkgs haskellLib;} self super

pkgs/development/haskell-modules/configuration-ghc-8.4.x.nix

@@ -62,10 +62,10 @@ self: super: {
   # that have it as an actual library dependency. The explicit overrides are
   # more verbose but friendlier for Hydra.
   stack = (doJailbreak super.stack).override {
-    Cabal = self.Cabal_2_4_0_1;
+    Cabal = self.Cabal_2_4_1_0;
-    hpack = self.hpack_0_31_1.override { Cabal = self.Cabal_2_4_0_1; };
+    hpack = self.hpack_0_31_1.override { Cabal = self.Cabal_2_4_1_0; };
     yaml = self.yaml_0_11_0_0;
-    hackage-security = self.hackage-security.override { Cabal = self.Cabal_2_4_0_1; };
+    hackage-security = self.hackage-security.override { Cabal = self.Cabal_2_4_1_0; };
   };
   hpack_0_31_1 = super.hpack_0_31_1.override {
     yaml = self.yaml_0_11_0_0;

pkgs/development/haskell-modules/configuration-ghc-8.6.x.nix

@@ -46,10 +46,11 @@ self: super: {
 
   # LTS-12.x versions do not compile.
   base-orphans = self.base-orphans_0_8;
-  brick = self.brick_0_41_4;
+  brick = self.brick_0_41_5;
   cassava-megaparsec = doJailbreak super.cassava-megaparsec;
   config-ini = doJailbreak super.config-ini;   # https://github.com/aisamanra/config-ini/issues/18
   contravariant = self.contravariant_1_5;
+  fgl = self.fgl_5_7_0_1;
   free = self.free_5_1;
   haddock-library = dontCheck super.haddock-library_1_7_0;
   HaTeX = doJailbreak super.HaTeX;
@@ -67,6 +68,9 @@ self: super: {
   JuicyPixels = self.JuicyPixels_3_3_2;
   lens = self.lens_4_17;
   megaparsec = dontCheck (doJailbreak super.megaparsec);
+  pandoc = self.pandoc_2_5;
+  pandoc-citeproc = self.pandoc-citeproc_0_15;
+  pandoc-citeproc_0_15 = doJailbreak super.pandoc-citeproc_0_15;
   patience = markBrokenVersion "0.1.1" super.patience;
   polyparse = self.polyparse_1_12_1;
   primitive = self.primitive_0_6_4_0;
@@ -81,10 +85,6 @@ self: super: {
   # https://github.com/tibbe/unordered-containers/issues/214
   unordered-containers = dontCheck super.unordered-containers;
 
-  # https://github.com/haskell/fgl/issues/79
-  # https://github.com/haskell/fgl/issues/81
-  fgl = appendPatch (overrideCabal super.fgl (drv: { editedCabalFile = null; })) ./patches/fgl-monad-fail.patch;
-
   # Test suite does not compile.
   cereal = dontCheck super.cereal;
   data-clist = doJailbreak super.data-clist;  # won't cope with QuickCheck 2.12.x
@@ -99,9 +99,6 @@ self: super: {
   # https://github.com/jgm/skylighting/issues/55
   skylighting-core = dontCheck super.skylighting-core;
 
-  # https://github.com/jgm/pandoc/issues/4974
-  pandoc = doJailbreak super.pandoc_2_4;
-
   # Break out of "yaml >=0.10.4.0 && <0.11".
   stack = doJailbreak super.stack;
 

pkgs/development/haskell-modules/configuration-hackage2nix.yaml

@@ -45,7 +45,7 @@ default-package-overrides:
   - base-compat-batteries ==0.10.1
   # Newer versions don't work in LTS-12.x
   - cassava-megaparsec < 2
-  # LTS Haskell 12.19
+  # LTS Haskell 12.20
   - abstract-deque ==0.3
   - abstract-deque-tests ==0.3
   - abstract-par ==0.3.3
@@ -56,7 +56,7 @@ default-package-overrides:
   - ad ==4.3.5
   - adjunctions ==4.4
   - adler32 ==0.1.2.0
-  - aern2-mp ==0.1.2.0
+  - aern2-mp ==0.1.3.1
   - aern2-real ==0.1.1.0
   - aeson ==1.3.1.1
   - aeson-attoparsec ==0.0.0
@@ -419,7 +419,7 @@ default-package-overrides:
   - colour ==2.3.4
   - combinatorial ==0.1.0.1
   - comfort-graph ==0.0.3.1
-  - commutative ==0.0.1.4
+  - commutative ==0.0.2
   - comonad ==5.0.4
   - compactmap ==0.1.4.2.1
   - compensated ==0.7.2
@@ -435,7 +435,7 @@ default-package-overrides:
   - concise ==0.1.0.1
   - concurrency ==1.6.1.0
   - concurrent-extra ==0.7.0.12
-  - concurrent-output ==1.10.7
+  - concurrent-output ==1.10.9
   - concurrent-split ==0.0.1.1
   - concurrent-supply ==0.1.8
   - cond ==0.4.1.1
@@ -476,6 +476,7 @@ default-package-overrides:
   - cpuinfo ==0.1.0.1
   - cql ==4.0.1
   - cql-io ==1.0.1.1
+  - crackNum ==2.3
   - credential-store ==0.1.2
   - criterion ==1.4.1.0
   - criterion-measurement ==0.1.1.0
@@ -486,7 +487,7 @@ default-package-overrides:
   - crypto-cipher-tests ==0.0.11
   - crypto-cipher-types ==0.0.9
   - cryptocompare ==0.1.1
-  - crypto-enigma ==0.0.2.14
+  - crypto-enigma ==0.0.3.1
   - cryptohash ==0.11.9
   - cryptohash-cryptoapi ==0.1.4
   - cryptohash-md5 ==0.11.100.1
@@ -554,7 +555,7 @@ default-package-overrides:
   - data-textual ==0.3.0.2
   - data-tree-print ==0.1.0.2
   - dataurl ==0.1.0.0
-  - DAV ==1.3.2
+  - DAV ==1.3.3
   - dawg-ord ==0.5.1.0
   - dbcleaner ==0.1.3
   - dbus ==1.0.1
@@ -576,7 +577,7 @@ default-package-overrides:
   - dhall ==1.15.1
   - dhall-bash ==1.0.15
   - dhall-json ==1.2.3
-  - dhall-text ==1.0.13
+  - dhall-text ==1.0.14
   - di ==1.0.1
   - diagrams ==1.4
   - diagrams-builder ==0.8.0.3
@@ -650,7 +651,7 @@ default-package-overrides:
   - either ==5.0.1
   - either-unwrap ==1.1
   - ekg ==0.4.0.15
-  - ekg-core ==0.1.1.4
+  - ekg-core ==0.1.1.6
   - ekg-json ==0.1.0.6
   - ekg-statsd ==0.2.4.0
   - ekg-wai ==0.1.0.3
@@ -722,7 +723,7 @@ default-package-overrides:
   - FenwickTree ==0.1.2.1
   - fft ==0.1.8.6
   - fgl ==5.6.0.0
-  - filecache ==0.4.0
+  - filecache ==0.4.1
   - file-embed ==0.0.10.1
   - file-embed-lzma ==0
   - filelock ==0.1.1.2
@@ -747,6 +748,7 @@ default-package-overrides:
   - flat-mcmc ==1.5.0
   - flay ==0.4
   - flexible-defaults ==0.0.2
+  - FloatingHex ==0.4
   - floatshow ==0.2.4
   - flow ==1.0.17
   - fmlist ==0.9.2
@@ -878,7 +880,7 @@ default-package-overrides:
   - graph-wrapper ==0.2.5.1
   - gravatar ==0.8.0
   - graylog ==0.1.0.1
-  - greskell ==0.2.1.1
+  - greskell ==0.2.2.0
   - greskell-core ==0.1.2.4
   - greskell-websocket ==0.1.1.2
   - groom ==0.1.2.1
@@ -926,7 +928,7 @@ default-package-overrides:
   - haskell-src ==1.0.3.0
   - haskell-src-exts ==1.20.3
   - haskell-src-exts-simple ==1.20.0.0
-  - haskell-src-exts-util ==0.2.3
+  - haskell-src-exts-util ==0.2.4
   - haskell-src-meta ==0.8.0.3
   - haskell-tools-ast ==1.1.0.2
   - haskell-tools-backend-ghc ==1.1.0.2
@@ -958,7 +960,7 @@ default-package-overrides:
   - hebrew-time ==0.1.1
   - hedgehog ==0.6.1
   - hedgehog-corpus ==0.1.0
-  - hedis ==0.10.4
+  - hedis ==0.10.8
   - here ==1.2.13
   - heredoc ==0.2.0.0
   - heterocephalus ==1.0.5.2
@@ -968,6 +970,7 @@ default-package-overrides:
   - hexpat ==0.20.13
   - hexstring ==0.11.1
   - hfsevents ==0.1.6
+  - hgmp ==0.1.1
   - hidapi ==0.1.5
   - hidden-char ==0.1.0.2
   - hierarchical-clustering ==0.4.6
@@ -1002,7 +1005,8 @@ default-package-overrides:
   - HPDF ==1.4.10
   - hpqtypes ==1.5.3.0
   - hprotoc ==2.4.11
-  - hquantlib ==0.0.4.0
+  - hquantlib ==0.0.5.0
+  - hquantlib-time ==0.0.4.1
   - hreader ==1.1.0
   - hreader-lens ==0.1.3.0
   - hruby ==0.3.6
@@ -1012,8 +1016,8 @@ default-package-overrides:
   - hsdns ==1.7.1
   - hsebaysdk ==0.4.0.0
   - hsemail ==2
-  - hset ==2.2.0
   - HSet ==0.0.1
+  - hset ==2.2.0
   - hsexif ==0.6.1.6
   - hs-functors ==0.1.3.0
   - hs-GeoIP ==0.3
@@ -1048,7 +1052,7 @@ default-package-overrides:
   - HSvm ==0.1.0.3.22
   - hsx-jmacro ==7.3.8.1
   - hsyslog ==5.0.1
-  - hsyslog-udp ==0.2.3
+  - hsyslog-udp ==0.2.4
   - htaglib ==1.2.0
   - HTF ==0.13.2.5
   - html ==1.0.1.2
@@ -1060,7 +1064,7 @@ default-package-overrides:
   - HTTP ==4000.3.12
   - http2 ==1.6.4
   - http-api-data ==0.3.8.1
-  - http-client ==0.5.13.1
+  - http-client ==0.5.14
   - http-client-openssl ==0.2.2.0
   - http-client-tls ==0.3.5.3
   - http-common ==0.8.2.0
@@ -1079,7 +1083,7 @@ default-package-overrides:
   - hvect ==0.4.0.0
   - hvega ==0.1.0.3
   - hw-balancedparens ==0.2.0.2
-  - hw-bits ==0.7.0.3
+  - hw-bits ==0.7.0.4
   - hw-conduit ==0.2.0.5
   - hw-diagnostics ==0.0.0.5
   - hweblib ==0.6.3
@@ -1093,7 +1097,7 @@ default-package-overrides:
   - hw-mquery ==0.1.0.1
   - hworker ==0.1.0.1
   - hw-parser ==0.0.0.3
-  - hw-prim ==0.6.2.19
+  - hw-prim ==0.6.2.20
   - hw-rankselect ==0.10.0.3
   - hw-rankselect-base ==0.3.2.1
   - hw-string-parse ==0.0.0.4
@@ -1132,7 +1136,7 @@ default-package-overrides:
   - indents ==0.5.0.0
   - indexed-list-literals ==0.2.1.2
   - inflections ==0.4.0.3
-  - influxdb ==1.6.0.9
+  - influxdb ==1.6.1
   - ini ==0.3.6
   - inline-c ==0.6.1.0
   - inline-java ==0.8.4
@@ -1188,7 +1192,7 @@ default-package-overrides:
   - js-flot ==0.8.3
   - js-jquery ==3.3.1
   - json ==0.9.2
-  - json-feed ==1.0.4
+  - json-feed ==1.0.5
   - json-rpc-client ==0.2.5.0
   - json-rpc-generic ==0.2.1.5
   - json-rpc-server ==0.2.6.0
@@ -1215,7 +1219,7 @@ default-package-overrides:
   - kraken ==0.1.0
   - l10n ==0.1.0.1
   - labels ==0.3.3
-  - lackey ==1.0.6
+  - lackey ==1.0.7
   - LambdaHack ==0.8.3.0
   - lame ==0.1.1
   - language-c ==0.8.2
@@ -1288,6 +1292,7 @@ default-package-overrides:
   - logging-facade-syslog ==1
   - logict ==0.6.0.2
   - log-postgres ==0.7.0.2
+  - long-double ==0.1
   - loop ==0.3.0
   - lrucache ==1.2.0.0
   - lrucaching ==0.3.3
@@ -1311,7 +1316,7 @@ default-package-overrides:
   - markdown-unlit ==0.5.0
   - markov-chain ==0.0.3.4
   - marvin-interpolate ==1.1.2
-  - massiv ==0.2.3.0
+  - massiv ==0.2.4.0
   - massiv-io ==0.1.4.0
   - mathexpr ==0.3.0.0
   - math-functions ==0.2.1.0
@@ -1423,7 +1428,7 @@ default-package-overrides:
   - mwc-probability ==2.0.4
   - mwc-probability-transition ==0.4
   - mwc-random ==0.13.6.0
-  - mysql ==0.1.5
+  - mysql ==0.1.6
   - mysql-haskell ==0.8.3.0
   - mysql-haskell-nem ==0.1.0.0
   - mysql-haskell-openssl ==0.8.3.0
@@ -1577,9 +1582,9 @@ default-package-overrides:
   - pgp-wordlist ==0.1.0.2
   - pg-transact ==0.1.0.1
   - phantom-state ==0.2.1.2
-  - picosat ==0.1.4
+  - picosat ==0.1.5
   - pid1 ==0.1.2.0
-  - pinboard ==0.9.12.10
+  - pinboard ==0.9.12.11
   - pipes ==4.3.9
   - pipes-aeson ==0.4.1.8
   - pipes-attoparsec ==0.5.1.5
@@ -1613,11 +1618,11 @@ default-package-overrides:
   - polyparse ==1.12
   - pooled-io ==0.0.2.2
   - portable-lines ==0.1
-  - postgresql-binary ==0.12.1.1
+  - postgresql-binary ==0.12.1.2
   - postgresql-libpq ==0.9.4.2
   - postgresql-schema ==0.1.14
   - postgresql-simple ==0.5.4.0
-  - postgresql-simple-migration ==0.1.12.0
+  - postgresql-simple-migration ==0.1.13.0
   - postgresql-simple-queue ==1.0.1
   - postgresql-simple-url ==0.2.1.0
   - postgresql-transactional ==1.1.1
@@ -1678,7 +1683,7 @@ default-package-overrides:
   - pure-zlib ==0.6.4
   - pushbullet-types ==0.4.1.0
   - qm-interpolated-string ==0.3.0.0
-  - qnap-decrypt ==0.3.2
+  - qnap-decrypt ==0.3.3
   - QuasiText ==0.1.2.6
   - quickbench ==1.0
   - QuickCheck ==2.11.3
@@ -1706,7 +1711,7 @@ default-package-overrides:
   - rank2classes ==1.1.0.1
   - Rasterific ==0.7.4
   - rasterific-svg ==0.3.3.2
-  - ratel ==1.0.6
+  - ratel ==1.0.7
   - ratel-wai ==1.0.4
   - ratio-int ==0.1.2
   - rattletrap ==4.1.2
@@ -1771,7 +1776,9 @@ default-package-overrides:
   - rio-orphans ==0.1.1.0
   - rng-utils ==0.3.0
   - roles ==0.2.0.0
+  - rosezipper ==0.2
   - rot13 ==0.2.0.1
+  - rounded ==0.1.0.1
   - RSA ==2.3.0
   - rss-conduit ==0.4.2.2
   - runmemo ==1.0.0.1
@@ -1794,6 +1801,7 @@ default-package-overrides:
   - sandman ==0.2.0.1
   - say ==0.1.0.1
   - sbp ==2.3.17
+  - sbv ==7.12
   - SCalendar ==1.1.0
   - scalendar ==1.2.0
   - scalpel ==0.5.1
@@ -1867,7 +1875,7 @@ default-package-overrides:
   - sexp-grammar ==2.0.1
   - SHA ==1.6.4.4
   - shake-language-c ==0.12.0
-  - shakespeare ==2.0.19
+  - shakespeare ==2.0.20
   - shell-conduit ==4.7.0
   - shell-escape ==0.2.0
   - shelltestrunner ==1.9
@@ -2147,8 +2155,8 @@ default-package-overrides:
   - type-operators ==0.1.0.4
   - type-spec ==0.3.0.1
   - typography-geometry ==1.0.0.1
-  - tz ==0.1.3.1
+  - tz ==0.1.3.2
-  - tzdata ==0.1.20180501.0
+  - tzdata ==0.1.20181026.0
   - uglymemo ==0.1.0.1
   - unbounded-delays ==0.1.1.0
   - unbound-generics ==0.3.4
@@ -2347,7 +2355,7 @@ default-package-overrides:
   - yesod-alerts ==0.1.2.0
   - yesod-auth ==1.6.5
   - yesod-auth-fb ==1.9.1
-  - yesod-auth-hashdb ==1.7
+  - yesod-auth-hashdb ==1.7.1
   - yesod-bin ==1.6.0.3
   - yesod-core ==1.6.8.1
   - yesod-csp ==0.2.4.0
@@ -2455,6 +2463,7 @@ extra-packages:
   - yesod-persistent < 1.5              # pre-lts-11.x versions neeed by git-annex 6.20180227
   - yesod-static ^>= 1.5                # pre-lts-11.x versions neeed by git-annex 6.20180227
   - yesod-test ^>= 1.5                  # pre-lts-11.x versions neeed by git-annex 6.20180227
+  - patience ^>= 0.1                    # required by chell-0.4.x
 
 package-maintainers:
   peti:
@@ -3008,6 +3017,7 @@ dont-distribute-packages:
   azure-servicebus:                             [ i686-linux, x86_64-linux, x86_64-darwin ]
   azurify:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
   b-tree:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
+  b9:                                             [ i686-linux, x86_64-linux, x86_64-darwin ]
   babylon:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
   backdropper:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
   backtracking-exceptions:                      [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -3070,6 +3080,7 @@ dont-distribute-packages:
   bench-show:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   BenchmarkHistory:                             [ i686-linux, x86_64-linux, x86_64-darwin ]
   benchpress:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
+  bencodex:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
   bencoding:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
   berkeleydb:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   BerkeleyDBXML:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -3492,6 +3503,7 @@ dont-distribute-packages:
   chuchu:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
   chunks:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
   chunky:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
+  church:                                         [ i686-linux, x86_64-linux, x86_64-darwin ]
   cielo:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
   cil:                                          [ i686-linux, x86_64-linux, x86_64-darwin ]
   cinvoke:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -3582,6 +3594,7 @@ dont-distribute-packages:
   CMQ:                                          [ i686-linux, x86_64-linux, x86_64-darwin ]
   cmv:                                          [ i686-linux, x86_64-linux, x86_64-darwin ]
   cnc-spec-compiler:                            [ i686-linux, x86_64-linux, x86_64-darwin ]
+  co-log-sys:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   co-log:                                         [ i686-linux, x86_64-linux, x86_64-darwin ]
   Coadjute:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   coalpit:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -3784,6 +3797,7 @@ dont-distribute-packages:
   cplusplus-th:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
   cprng-aes-effect:                             [ i686-linux, x86_64-linux, x86_64-darwin ]
   cpuperf:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
+  cpython:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
   cql-io:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
   cqrs-core:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
   cqrs-example:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -4146,6 +4160,9 @@ dont-distribute-packages:
   doctest-discover-configurator:                [ i686-linux, x86_64-linux, x86_64-darwin ]
   doctest-driver-gen:                           [ i686-linux, x86_64-linux, x86_64-darwin ]
   DocTest:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
+  docusign-base:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
+  docusign-client:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
+  docusign-example:                               [ i686-linux, x86_64-linux, x86_64-darwin ]
   docvim:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
   doi:                                          [ i686-linux, x86_64-linux, x86_64-darwin ]
   DOM:                                          [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -4253,6 +4270,7 @@ dont-distribute-packages:
   effects:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
   effin:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
   egison-quote:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
+  egison-tutorial:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
   ehaskell:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   ehs:                                          [ i686-linux, x86_64-linux, x86_64-darwin ]
   eibd-client-simple:                           [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -4408,6 +4426,7 @@ dont-distribute-packages:
   extemp:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
   extended-categories:                          [ i686-linux, x86_64-linux, x86_64-darwin ]
   extensible-data:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
+  extensible-effects-concurrent:                  [ i686-linux, x86_64-linux, x86_64-darwin ]
   Extra:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
   extract-dependencies:                         [ i686-linux, x86_64-linux, x86_64-darwin ]
   extractelf:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -4561,6 +4580,7 @@ dont-distribute-packages:
   flower:                                         [ i686-linux, x86_64-linux, x86_64-darwin ]
   flowlocks-framework:                            [ i686-linux, x86_64-linux, x86_64-darwin ]
   flowsim:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
+  fltkhs-fluid-examples:                          [ i686-linux, x86_64-linux, x86_64-darwin ]
   fluent-logger-conduit:                          [ i686-linux, x86_64-linux, x86_64-darwin ]
   fluent-logger:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
   fluidsynth:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -4679,6 +4699,7 @@ dont-distribute-packages:
   functor-infix:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
   functor:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
   functorm:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
+  funflow-nix:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
   funflow:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
   Fungi:                                          [ i686-linux, x86_64-linux, x86_64-darwin ]
   funion:                                         [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -4735,6 +4756,7 @@ dont-distribute-packages:
   generic-accessors:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
   generic-binary:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
   generic-church:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
+  generic-data-surgery:                           [ i686-linux, x86_64-linux, x86_64-darwin ]
   generic-data:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   generic-enum:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   generic-lens-labels:                            [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -4760,6 +4782,7 @@ dont-distribute-packages:
   GenSmsPdu:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
   gentlemark:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   GenussFold:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
+  genvalidity-hspec-optics:                       [ i686-linux, x86_64-linux, x86_64-darwin ]
   geo-resolver:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   GeocoderOpenCage:                               [ i686-linux, x86_64-linux, x86_64-darwin ]
   geodetic:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -4882,6 +4905,7 @@ dont-distribute-packages:
   gloss-banana:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   gloss-devil:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
   gloss-examples:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
+  gloss-export:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   gloss-game:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   gloss-juicy:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
   gloss-sodium:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -5134,6 +5158,7 @@ dont-distribute-packages:
   grpc-etcd-client:                               [ i686-linux, x86_64-linux, x86_64-darwin ]
   gruff-examples:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
   gruff:                                          [ i686-linux, x86_64-linux, x86_64-darwin ]
+  gscholar-rss:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   gsl-random-fu:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
   gsl-random:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   gstorable:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -5400,6 +5425,8 @@ dont-distribute-packages:
   haskell-tools-ast-fromghc:                      [ i686-linux, x86_64-linux, x86_64-darwin ]
   haskell-tools-ast-gen:                          [ i686-linux, x86_64-linux, x86_64-darwin ]
   haskell-tools-ast-trf:                          [ i686-linux, x86_64-linux, x86_64-darwin ]
+  haskell-tools-cli:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
+  haskell-tools-daemon:                           [ i686-linux, x86_64-linux, x86_64-darwin ]
   haskell-tor:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
   haskell-type-exts:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
   haskell-typescript:                             [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -5471,6 +5498,7 @@ dont-distribute-packages:
   hasktorch:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
   haskus-binary:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
   haskus-system-build:                            [ i686-linux, x86_64-linux, x86_64-darwin ]
+  haskus-utils-variant:                           [ i686-linux, x86_64-linux, x86_64-darwin ]
   haskus-utils:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   haslo:                                          [ i686-linux, x86_64-linux, x86_64-darwin ]
   hasloGUI:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -6258,6 +6286,7 @@ dont-distribute-packages:
   imperative-edsl-vhdl:                           [ i686-linux, x86_64-linux, x86_64-darwin ]
   imperative-edsl:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
   ImperativeHaskell:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
+  impl:                                           [ i686-linux, x86_64-linux, x86_64-darwin ]
   implicit-logging:                               [ i686-linux, x86_64-linux, x86_64-darwin ]
   implicit-params:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
   importify:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -6380,6 +6409,7 @@ dont-distribute-packages:
   JackMiniMix:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
   jackminimix:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
   jacobi-roots:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
+  jaeger-flamegraph:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
   jail:                                           [ i686-linux, x86_64-linux, x86_64-darwin ]
   jalaali:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
   jalla:                                          [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -6566,6 +6596,7 @@ dont-distribute-packages:
   lambda2js:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
   lambdaBase:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   lambdabot-utils:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
+  lambdabot-zulip:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
   lambdacms-core:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
   lambdacms-media:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
   lambdacube-bullet:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -7228,6 +7259,7 @@ dont-distribute-packages:
   multipass:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
   multipath:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
   multiplate-simplified:                          [ i686-linux, x86_64-linux, x86_64-darwin ]
+  multipool-persistent-postgresql:                [ i686-linux, x86_64-linux, x86_64-darwin ]
   multirec-alt-deriver:                           [ i686-linux, x86_64-linux, x86_64-darwin ]
   multirec-binary:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
   multirec:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -7296,6 +7328,7 @@ dont-distribute-packages:
   nanomsg:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
   nanoparsec:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   NanoProlog:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
+  nanovg-simple:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
   nanovg:                                         [ i686-linux, x86_64-linux, x86_64-darwin ]
   nanq:                                           [ i686-linux, x86_64-linux, x86_64-darwin ]
   Naperian:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -7454,6 +7487,7 @@ dont-distribute-packages:
   nymphaea:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
   o-clock:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
   oanda-rest-api:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
+  oauth2-jwt-bearer:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
   oauthenticated:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
   obd:                                            [ i686-linux, x86_64-linux, x86_64-darwin ]
   obdd:                                           [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -7501,6 +7535,7 @@ dont-distribute-packages:
   open-typerep:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   OpenAFP-Utils:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
   OpenAFP:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
+  openapi-petstore:                               [ i686-linux, x86_64-linux, x86_64-darwin ]
   opench-meteo:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   OpenCL:                                         [ i686-linux, x86_64-linux, x86_64-darwin ]
   OpenCLRaw:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -7744,6 +7779,7 @@ dont-distribute-packages:
   picoparsec:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   picosat:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
   pictikz:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
+  pier-core:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
   pier:                                           [ i686-linux, x86_64-linux, x86_64-darwin ]
   piet:                                           [ i686-linux, x86_64-linux, x86_64-darwin ]
   pinchot:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -7818,6 +7854,7 @@ dont-distribute-packages:
   pointless-lenses:                               [ i686-linux, x86_64-linux, x86_64-darwin ]
   pointless-rewrite:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
   pokemon-go-protobuf-types:                      [ i686-linux, x86_64-linux, x86_64-darwin ]
+  poker-eval:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   pokitdok:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
   polar-configfile:                               [ i686-linux, x86_64-linux, x86_64-darwin ]
   polar-shader:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -8571,6 +8608,7 @@ dont-distribute-packages:
   servant-auth-token:                             [ i686-linux, x86_64-linux, x86_64-darwin ]
   servant-checked-exceptions:                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   servant-client:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
+  servant-conduit:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
   servant-csharp:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
   servant-db-postgresql:                          [ i686-linux, x86_64-linux, x86_64-darwin ]
   servant-db:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -8584,8 +8622,11 @@ dont-distribute-packages:
   servant-iCalendar:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
   servant-jquery:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
   servant-js:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
+  servant-machines:                               [ i686-linux, x86_64-linux, x86_64-darwin ]
   servant-matrix-param:                           [ i686-linux, x86_64-linux, x86_64-darwin ]
+  servant-multipart:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
   servant-nix:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
+  servant-pipes:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
   servant-pool:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   servant-postgresql:                             [ i686-linux, x86_64-linux, x86_64-darwin ]
   servant-proto-lens:                             [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -8646,6 +8687,7 @@ dont-distribute-packages:
   shake-extras:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   shake-minify:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   shake-pack:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
+  shake-path:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   shake-persist:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
   shaker:                                         [ i686-linux, x86_64-linux, x86_64-darwin ]
   shakespeare-babel:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -9099,6 +9141,7 @@ dont-distribute-packages:
   supermonad:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   supero:                                         [ i686-linux, x86_64-linux, x86_64-darwin ]
   supervisor:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
+  supervisors:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
   supplemented:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   surjective:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   sv-cassava:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -9276,6 +9319,7 @@ dont-distribute-packages:
   texbuilder:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   text-all:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
   text-and-plots:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
+  text-ansi:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
   text-builder:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   text-containers:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
   text-format-heavy:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -9793,6 +9837,7 @@ dont-distribute-packages:
   wai-request-spec:                               [ i686-linux, x86_64-linux, x86_64-darwin ]
   wai-responsible:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
   wai-router:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
+  wai-routing:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
   wai-secure-cookies:                             [ i686-linux, x86_64-linux, x86_64-darwin ]
   wai-session-alt:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
   wai-session-mysql:                              [ i686-linux, x86_64-linux, x86_64-darwin ]

pkgs/development/haskell-modules/patches/fgl-monad-fail.patch

@@ -1,61 +0,0 @@
-From 344a7e452630ace0f5c647e525e0299d99de5902 Mon Sep 17 00:00:00 2001
-From: Alex Washburn <github@recursion.ninja>
-Date: Mon, 20 Aug 2018 23:46:32 -0400
-Subject: [PATCH] Fixing issue with MonadFailDesugaring.
-
----
- .travis.yml                   |  9 +++++++++
- Data/Graph/Inductive/Monad.hs | 14 ++++++++++++--
- fgl.cabal                     |  3 ++-
- 3 files changed, 23 insertions(+), 3 deletions(-)
-
-diff --git a/.travis.yml b/.travis.yml
-index db5eeb1..f026dd1 100644
---- a/Data/Graph/Inductive/Monad.hs
-+++ b/Data/Graph/Inductive/Monad.hs
-@@ -1,4 +1,4 @@
--{-# LANGUAGE MultiParamTypeClasses #-}
-+{-# LANGUAGE CPP, MultiParamTypeClasses #-}
- 
- -- (c) 2002 by Martin Erwig [see file COPYRIGHT]
- -- | Monadic Graphs
-@@ -19,6 +19,10 @@ module Data.Graph.Inductive.Monad(
- 
- 
- import Data.Graph.Inductive.Graph
-+#if MIN_VERSION_base(4,12,0)
-+import Control.Monad.Fail
-+import Prelude hiding (fail)
-+#endif
- 
- {-# ANN module "HLint: ignore Redundant lambda" #-}
- 
-@@ -39,7 +43,13 @@ import Data.Graph.Inductive.Graph
- 
- -- Monadic Graph
- --
--class (Monad m) => GraphM m gr where
-+class
-+#if MIN_VERSION_base(4,12,0)
-+ (MonadFail m)
-+#else
-+ (Monad m)
-+#endif
-+  => GraphM m gr where
-   {-# MINIMAL emptyM, isEmptyM, matchM, mkGraphM, labNodesM #-}
- 
-   emptyM     :: m (gr a b)
-diff --git a/fgl.cabal b/fgl.cabal
-index 4251a21..4b2a039 100644
---- a/fgl.cabal
-+++ b/fgl.cabal
-@@ -18,7 +18,8 @@ extra-source-files:
-                ChangeLog
- 
- tested-with:   GHC == 7.0.4, GHC == 7.2.2, GHC == 7.4.2, GHC == 7.6.3,
--               GHC == 7.8.4, GHC == 7.10.2, GHC == 8.0.1, GHC == 8.1.*
-+               GHC == 7.8.4, GHC == 7.10.2, GHC == 8.0.1, GHC == 8.2.2,
-+               GHC == 8.4.3, GHC == 8.6.1
- 
- source-repository head
-     type:         git

pkgs/development/interpreters/php/default.nix

@@ -1,5 +1,5 @@
 # pcre functionality is tested in nixos/tests/php-pcre.nix
-{ lib, stdenv, fetchurl, flex, bison
+{ lib, stdenv, fetchurl, flex, bison, autoconf
 , mysql, libxml2, readline, zlib, curl, postgresql, gettext
 , openssl, pcre, pkgconfig, sqlite, config, libjpeg, libpng, freetype
 , libxslt, libmcrypt, bzip2, icu, openldap, cyrus_sasl, libmhash, freetds
@@ -12,6 +12,7 @@ let
   generic =
   { version
   , sha256
+  , extraPatches ? []
   , imapSupport ? config.php.imap or (!stdenv.isDarwin)
   , ldapSupport ? config.php.ldap or true
   , mhashSupport ? config.php.mhash or true
@@ -65,7 +66,7 @@ let
 
       enableParallelBuilding = true;
 
-      nativeBuildInputs = [ pkgconfig ];
+      nativeBuildInputs = [ pkgconfig autoconf ];
       buildInputs = [ flex bison pcre ]
         ++ optional stdenv.isLinux systemd
         ++ optionals imapSupport [ uwimap openssl pam ]
@@ -182,6 +183,8 @@ let
 
         configureFlags+=(--with-config-file-path=$out/etc \
           --includedir=$dev/include)
+
+        ./buildconf --force
       '';
 
       postInstall = ''
@@ -210,7 +213,7 @@ let
         outputsToInstall = [ "out" "dev" ];
       };
 
-      patches = [ ./fix-paths-php7.patch ];
+      patches = [ ./fix-paths-php7.patch ] ++ extraPatches;
 
       postPatch = optional stdenv.isDarwin ''
         substituteInPlace configure --replace "-lstdc++" "-lc++"
@@ -223,35 +226,19 @@ let
     };
 
 in {
-  # Because of an upstream bug: https://bugs.php.net/bug.php?id=76826
+  php71 = generic {
-  # We can't update the darwin versions because they simply don't compile at
+    version = "7.1.24";
-  # all due to a bug in the intl extensions.
+    sha256 = "02qy76krbdhlbkzs9k1sa5mgmj0qnbb8gcf1j3q0cq3z7kkj9pk6";
-  #
-  # The bug so far is present in 7.1.21, 7.1.22, 7.1.23, 7.2.9, 7.2.10, 7.2.11.
 
-  php71 = generic (
+    # https://bugs.php.net/bug.php?id=76826
-    if stdenv.isDarwin then
+    extraPatches = optional stdenv.isDarwin ./php71-darwin-isfinite.patch;
-      {
+  };
-        version = "7.1.20";
-        sha256 = "0i8xd6p4zdg8fl6f0j430raanlshsshr3s3jlm72b0gvi1n4f6rs";
-      }
-    else
-      {
-        version = "7.1.23";
-        sha256 = "0jyc5q666xh808sgy78cfylkhy5ma2zdg88jlxhagyphv23aly9d";
-      }
-  );
 
-  php72 = generic (
+  php72 = generic {
-    if stdenv.isDarwin then
+    version = "7.2.12";
-      {
+    sha256 = "1dpnbsv4bdlc5v40ddddi971f456jp1qrn89w5di1dj70g1c895p";
-        version = "7.2.8";
+
-        sha256 = "1rky321gcvjm0npbfd4bznh36an0y14viqcvn4yzy3x643sni00z";
+    # https://bugs.php.net/bug.php?id=76826
-      }
+    extraPatches = optional stdenv.isDarwin ./php72-darwin-isfinite.patch;
-    else
+  };
-      {
-        version = "7.2.11";
-        sha256 = "1idlv04j1l2d0bn5nvfrapcpjh6ayj1n4y80lqvnp5h75m07y3aa";
-      }
-  );
 }

pkgs/development/interpreters/php/fix-paths-php7.patch

@@ -1,16 +1,8 @@
---- php-7.0.0beta1/configure	    2015-07-10 12:11:41.810045613 +0000
+diff -ru a/ext/gettext/config.m4 b/ext/gettext/config.m4
-+++ php-7.0.0beta1-new/configure	2015-07-17 16:10:21.775528267 +0000
+--- a/ext/gettext/config.m4	2018-11-07 15:35:26.000000000 +0000
-@@ -6172,7 +6172,7 @@
++++ b/ext/gettext/config.m4	2018-11-27 00:33:07.000000000 +0000
-     as_fn_error $? "Please note that Apache version >= 2.0.44 is required" "$LINENO" 5
+@@ -6,9 +6,7 @@
-   fi
+ [  --with-gettext[=DIR]      Include GNU gettext support])
- 
--  APXS_LIBEXECDIR='$(INSTALL_ROOT)'`$APXS -q LIBEXECDIR`
-+  APXS_LIBEXECDIR="$prefix/modules"
-   if test -z `$APXS -q SYSCONFDIR`; then
-     INSTALL_IT="\$(mkinstalldirs) '$APXS_LIBEXECDIR' && \
-                  $APXS -S LIBEXECDIR='$APXS_LIBEXECDIR' \
-@@ -37303,9 +37303,7 @@
- 
  
  if test "$PHP_GETTEXT" != "no"; then
 -  for i in $PHP_GETTEXT /usr/local /usr; do
@@ -19,5 +11,16 @@
 +  GETTEXT_DIR=$PHP_GETTEXT
  
    if test -z "$GETTEXT_DIR"; then
-     as_fn_error $? "Cannot locate header file libintl.h" "$LINENO" 5
+     AC_MSG_ERROR(Cannot locate header file libintl.h)
-
+diff -ru a/sapi/apache2handler/config.m4 b/sapi/apache2handler/config.m4
+--- a/sapi/apache2handler/config.m4	2018-11-07 15:35:23.000000000 +0000
++++ b/sapi/apache2handler/config.m4	2018-11-27 00:32:28.000000000 +0000
+@@ -66,7 +66,7 @@
+     AC_MSG_ERROR([Please note that Apache version >= 2.0.44 is required])
+   fi
+ 
+-  APXS_LIBEXECDIR='$(INSTALL_ROOT)'`$APXS -q LIBEXECDIR`
++  APXS_LIBEXECDIR="$prefix/modules"
+   if test -z `$APXS -q SYSCONFDIR`; then
+     INSTALL_IT="\$(mkinstalldirs) '$APXS_LIBEXECDIR' && \
+                  $APXS -S LIBEXECDIR='$APXS_LIBEXECDIR' \

pkgs/development/interpreters/php/php71-darwin-isfinite.patch

@@ -0,0 +1,60 @@
+diff -ru a/Zend/configure.in b/Zend/configure.in
+--- a/Zend/configure.in	2018-11-07 15:35:26.000000000 +0000
++++ b/Zend/configure.in	2018-11-27 00:28:48.000000000 +0000
+@@ -70,7 +70,7 @@
+ #endif
+ 
+ #ifndef zend_isnan
+-#if HAVE_DECL_ISNAN && (!defined(__cplusplus) || __cplusplus < 201103L)
++#if HAVE_DECL_ISNAN && (defined(__APPLE__) || defined(__APPLE_CC__) || !defined(__cplusplus) || __cplusplus < 201103L)
+ #define zend_isnan(a) isnan(a)
+ #elif defined(HAVE_FPCLASS)
+ #define zend_isnan(a) ((fpclass(a) == FP_SNAN) || (fpclass(a) == FP_QNAN))
+@@ -79,7 +79,7 @@
+ #endif
+ #endif
+ 
+-#if HAVE_DECL_ISINF && (!defined(__cplusplus) || __cplusplus < 201103L)
++#if HAVE_DECL_ISINF && (defined(__APPLE__) || defined(__APPLE_CC__) || !defined(__cplusplus) || __cplusplus < 201103L)
+ #define zend_isinf(a) isinf(a)
+ #elif defined(INFINITY)
+ /* Might not work, but is required by ISO C99 */
+@@ -90,7 +90,7 @@
+ #define zend_isinf(a) 0
+ #endif
+ 
+-#if HAVE_DECL_ISFINITE && (!defined(__cplusplus) || __cplusplus < 201103L)
++#if HAVE_DECL_ISFINITE && (defined(__APPLE__) || defined(__APPLE_CC__) || !defined(__cplusplus) || __cplusplus < 201103L)
+ #define zend_finite(a) isfinite(a)
+ #elif defined(HAVE_FINITE)
+ #define zend_finite(a) finite(a)
+diff -ru a/configure.in b/configure.in
+--- a/configure.in	2018-11-07 15:35:26.000000000 +0000
++++ b/configure.in	2018-11-27 00:28:48.000000000 +0000
+@@ -75,7 +75,7 @@
+ #endif
+ 
+ #ifndef zend_isnan
+-#if HAVE_DECL_ISNAN && (!defined(__cplusplus) || __cplusplus < 201103L)
++#if HAVE_DECL_ISNAN && (defined(__APPLE__) || defined(__APPLE_CC__) || !defined(__cplusplus) || __cplusplus < 201103L)
+ #define zend_isnan(a) isnan(a)
+ #elif defined(HAVE_FPCLASS)
+ #define zend_isnan(a) ((fpclass(a) == FP_SNAN) || (fpclass(a) == FP_QNAN))
+@@ -84,7 +84,7 @@
+ #endif
+ #endif
+ 
+-#if HAVE_DECL_ISINF && (!defined(__cplusplus) || __cplusplus < 201103L)
++#if HAVE_DECL_ISINF && (defined(__APPLE__) || defined(__APPLE_CC__) || !defined(__cplusplus) || __cplusplus < 201103L)
+ #define zend_isinf(a) isinf(a)
+ #elif defined(INFINITY)
+ /* Might not work, but is required by ISO C99 */
+@@ -95,7 +95,7 @@
+ #define zend_isinf(a) 0
+ #endif
+ 
+-#if HAVE_DECL_ISFINITE && (!defined(__cplusplus) || __cplusplus < 201103L)
++#if HAVE_DECL_ISFINITE && (defined(__APPLE__) || defined(__APPLE_CC__) || !defined(__cplusplus) || __cplusplus < 201103L)
+ #define zend_finite(a) isfinite(a)
+ #elif defined(HAVE_FINITE)
+ #define zend_finite(a) finite(a)

pkgs/development/interpreters/php/php72-darwin-isfinite.patch

@@ -0,0 +1,62 @@
+diff --git a/Zend/configure.ac b/Zend/configure.ac
+index b95c1360b8..fe16c86007 100644
+--- a/Zend/configure.ac
++++ b/Zend/configure.ac
+@@ -60,7 +60,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
+ #include <math.h>
+ 
+ #ifndef zend_isnan
+-#if HAVE_DECL_ISNAN && (!defined(__cplusplus) || __cplusplus < 201103L)
++#if HAVE_DECL_ISNAN && (defined(__APPLE__) || defined(__APPLE_CC__) || !defined(__cplusplus) || __cplusplus < 201103L)
+ #define zend_isnan(a) isnan(a)
+ #elif defined(HAVE_FPCLASS)
+ #define zend_isnan(a) ((fpclass(a) == FP_SNAN) || (fpclass(a) == FP_QNAN))
+@@ -69,7 +69,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
+ #endif
+ #endif
+ 
+-#if HAVE_DECL_ISINF && (!defined(__cplusplus) || __cplusplus < 201103L)
++#if HAVE_DECL_ISINF && (defined(__APPLE__) || defined(__APPLE_CC__) || !defined(__cplusplus) || __cplusplus < 201103L)
+ #define zend_isinf(a) isinf(a)
+ #elif defined(INFINITY)
+ /* Might not work, but is required by ISO C99 */
+@@ -80,7 +80,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
+ #define zend_isinf(a) 0
+ #endif
+ 
+-#if HAVE_DECL_ISFINITE && (!defined(__cplusplus) || __cplusplus < 201103L)
++#if HAVE_DECL_ISFINITE && (defined(__APPLE__) || defined(__APPLE_CC__) || !defined(__cplusplus) || __cplusplus < 201103L)
+ #define zend_finite(a) isfinite(a)
+ #elif defined(HAVE_FINITE)
+ #define zend_finite(a) finite(a)
+diff --git a/configure.ac b/configure.ac
+index d3f3cacd07..ddbf712ba2 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -68,7 +68,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
+ #include <math.h>
+ 
+ #ifndef zend_isnan
+-#if HAVE_DECL_ISNAN && (!defined(__cplusplus) || __cplusplus < 201103L)
++#if HAVE_DECL_ISNAN && (defined(__APPLE__) || defined(__APPLE_CC__) || !defined(__cplusplus) || __cplusplus < 201103L)
+ #define zend_isnan(a) isnan(a)
+ #elif defined(HAVE_FPCLASS)
+ #define zend_isnan(a) ((fpclass(a) == FP_SNAN) || (fpclass(a) == FP_QNAN))
+@@ -77,7 +77,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
+ #endif
+ #endif
+ 
+-#if HAVE_DECL_ISINF && (!defined(__cplusplus) || __cplusplus < 201103L)
++#if HAVE_DECL_ISINF && (defined(__APPLE__) || defined(__APPLE_CC__) || !defined(__cplusplus) || __cplusplus < 201103L)
+ #define zend_isinf(a) isinf(a)
+ #elif defined(INFINITY)
+ /* Might not work, but is required by ISO C99 */
+@@ -88,7 +88,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
+ #define zend_isinf(a) 0
+ #endif
+ 
+-#if HAVE_DECL_ISFINITE && (!defined(__cplusplus) || __cplusplus < 201103L)
++#if HAVE_DECL_ISFINITE && (defined(__APPLE__) || defined(__APPLE_CC__) || !defined(__cplusplus) || __cplusplus < 201103L)
+ #define zend_finite(a) isfinite(a)
+ #elif defined(HAVE_FINITE)
+ #define zend_finite(a) finite(a)

pkgs/development/libraries/aravis/default.nix

@@ -0,0 +1,89 @@
+{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, gtk-doc, intltool
+, audit, glib, libusb, libxml2
+, wrapGAppsHook
+, gstreamer ? null
+, gst-plugins-base ? null
+, gst-plugins-good ? null
+, gst-plugins-bad ? null
+, libnotify ? null
+, gnome3 ? null
+, enableUsb ? true
+, enablePacketSocket ? true
+, enableViewer ? true
+, enableGstPlugin ? true
+, enableCppTest ? false
+, enableFastHeartbeat ? false
+, enableAsan ? false
+}:
+
+let
+  gstreamerAtLeastVersion1 =
+    stdenv.lib.all
+      (pkg: pkg != null && stdenv.lib.versionAtLeast (stdenv.lib.getVersion pkg) "1.0")
+      [ gstreamer gst-plugins-base gst-plugins-good gst-plugins-bad ];
+in
+  assert enableGstPlugin -> stdenv.lib.all (pkg: pkg != null) [ gstreamer gst-plugins-base gst-plugins-good gst-plugins-bad ];
+  assert enableViewer -> enableGstPlugin;
+  assert enableViewer -> libnotify != null;
+  assert enableViewer -> gnome3 != null;
+  assert enableViewer -> gstreamerAtLeastVersion1;
+
+  stdenv.mkDerivation rec {
+
+    pname = "aravis";
+    version = "0.5.13";
+    name = "${pname}-${version}";
+
+    src = fetchFromGitHub {
+      owner = "AravisProject";
+      repo = "aravis";
+      rev= "c56e530b8ef53b84e17618ea2f334d2cbae04f48";
+      sha256 = "1dj24dir239zmiscfhyy1m8z5rcbw0m1vx9lipx0r7c39bzzj5gy";
+    };
+
+    outputs = [ "bin" "dev" "out" "lib" ];
+
+    nativeBuildInputs = [
+      autoreconfHook
+      pkgconfig
+      intltool
+      gtk-doc
+    ] ++ stdenv.lib.optional enableViewer wrapGAppsHook;
+
+    buildInputs =
+      [ glib libxml2 ]
+      ++ stdenv.lib.optional enableUsb libusb
+      ++ stdenv.lib.optional enablePacketSocket audit
+      ++ stdenv.lib.optionals (enableViewer || enableGstPlugin) [ gstreamer gst-plugins-base gst-plugins-good gst-plugins-bad ]
+      ++ stdenv.lib.optionals (enableViewer) [ libnotify gnome3.gtk3 gnome3.defaultIconTheme ];
+
+    preAutoreconf = ''./autogen.sh'';
+
+    configureFlags =
+      stdenv.lib.optional enableUsb "--enable-usb"
+        ++ stdenv.lib.optional enablePacketSocket "--enable-packet-socket"
+        ++ stdenv.lib.optional enableViewer "--enable-viewer"
+        ++ stdenv.lib.optional enableGstPlugin
+        (if gstreamerAtLeastVersion1 then "--enable-gst-plugin" else "--enable-gst-0.10-plugin")
+        ++ stdenv.lib.optional enableCppTest "--enable-cpp-test"
+        ++ stdenv.lib.optional enableFastHeartbeat "--enable-fast-heartbeat"
+        ++ stdenv.lib.optional enableAsan "--enable-asan";
+
+    postPatch = ''
+        ln -s ${gtk-doc}/share/gtk-doc/data/gtk-doc.make .
+      '';
+
+    doCheck = true;
+
+    meta = {
+      description = "Library for video acquisition using GenICam cameras";
+      longDescription = ''
+        Implements the gigabit ethernet and USB3 protocols used by industrial cameras.
+      '';
+      homepage = https://aravisproject.github.io/docs/aravis-0.5;
+      license = stdenv.lib.licenses.lgpl2;
+      maintainers = [];
+      platforms = stdenv.lib.platforms.unix;
+    };
+  }
+

pkgs/development/libraries/gmime/3.nix

@@ -1,12 +1,12 @@
 { stdenv, fetchurl, pkgconfig, glib, zlib, gnupg, gpgme, libidn2, libunistring, gobjectIntrospection }:
 
 stdenv.mkDerivation rec {
-  version = "3.2.1";
+  version = "3.2.3";
   name = "gmime-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gmime/3.2/${name}.tar.xz";
-    sha256 = "0q65nalxzpyjg37gdlpj9v6028wp0qx47z96q0ff6znw217nzzjn";
+    sha256 = "04bk7rqs5slpvlvqf11i6s37s8b2xn6acls8smyl9asjnpp7a23a";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/libraries/grpc/default.nix

@@ -1,13 +1,13 @@
 { stdenv, fetchFromGitHub, cmake, zlib, c-ares, pkgconfig, openssl, protobuf, gflags }:
 
 stdenv.mkDerivation rec {
-  version = "1.15.0";
+  version = "1.16.1";
   name = "grpc-${version}";
   src = fetchFromGitHub {
     owner = "grpc";
     repo = "grpc";
-    rev= "d2c7d4dea492b9a86a53555aabdbfa90c2b01730";
+    rev = "v${version}";
-    sha256 = "1dpnhc5kw7znivrnjx1gva57v6b548am4v5nvh3dkwwzsa1k6vkv";
+    sha256 = "1jimqz3115f9pli5w6ik9wi7mjc7ix6y7yrq4a1ab9fc3dalj7p2";
   };
   nativeBuildInputs = [ cmake pkgconfig ];
   buildInputs = [ zlib c-ares c-ares.cmake-config openssl protobuf gflags ];

pkgs/development/libraries/nlopt/default.nix

@@ -1,13 +1,8 @@
 { fetchurl, stdenv, octave ? null, cmake }:
 
-let
+stdenv.mkDerivation rec {
-
-  version = "2.5.0";
-
-in
-
-stdenv.mkDerivation {
   name = "nlopt-${version}";
+  version = "2.5.0";
 
   src = fetchurl {
     url = "https://github.com/stevengj/nlopt/archive/v${version}.tar.gz";

pkgs/development/libraries/spdlog/default.nix

@@ -15,7 +15,7 @@ let
 
       nativeBuildInputs = [ cmake ];
 
-      # cmakeFlags = [ "-DSPDLOG_BUILD_EXAMPLES=ON" ];
+      cmakeFlags = [ "-DSPDLOG_BUILD_EXAMPLES=OFF" ];
 
       outputs = [ "out" "doc" ];
 
@@ -35,12 +35,12 @@ let
 in
 {
   spdlog_1 = generic {
-    version = "1.1.0";
+    version = "1.2.1";
-    sha256 = "0yckz5w02v8193jhxihk9v4i8f6jafyg2a33amql0iclhk17da8f";
+    sha256 = "0gdj8arfz4r9419zbcxk9y9nv47qr7kyjjzw9m3ijgmn2pmxk88n";
   };
 
   spdlog_0 = generic {
-    version = "0.14.0";
+    version = "0.17.0";
-    sha256 = "13730429gwlabi432ilpnja3sfvy0nn2719vnhhmii34xcdyc57q";
+    sha256 = "112kfh4fbpm5cvrmgbgz4d8s802db91mhyjpg7cwhlywffnzkwr9";
   };
 }

pkgs/development/perl-modules/catalyst-fix-chunked-encoding.patch

@@ -1,23 +0,0 @@
-diff -rc Catalyst-Engine-HTTP-Prefork-0.50-orig/lib/Catalyst/Engine/HTTP/Prefork/Handler.pm Catalyst-Engine-HTTP-Prefork-0.50/lib/Catalyst/Engine/HTTP/Prefork/Handler.pm
-*** Catalyst-Engine-HTTP-Prefork-0.50-orig/lib/Catalyst/Engine/HTTP/Prefork/Handler.pm	2008-03-14 18:23:47.000000000 +0100
---- Catalyst-Engine-HTTP-Prefork-0.50/lib/Catalyst/Engine/HTTP/Prefork/Handler.pm	2009-03-11 14:18:40.000000000 +0100
-***************
-*** 199,206 ****
-      
-      if ( $self->{_chunked_res} ) {
-          if ( !$self->{_chunked_done} ) {
-!             # Write the final '0' chunk
-!             syswrite STDOUT, "0$CRLF";
-          }
-          
-          delete $self->{_chunked_res};
---- 199,207 ----
-      
-      if ( $self->{_chunked_res} ) {
-          if ( !$self->{_chunked_done} ) {
-!             # Write the final '0' chunk and the CRLF that terminates
-!             # the chunked body.
-!             syswrite STDOUT, "0$CRLF$CRLF";
-          }
-          
-          delete $self->{_chunked_res};

pkgs/development/python-modules/affine/default.nix

@@ -0,0 +1,22 @@
+{ buildPythonPackage, pytest, lib, fetchPypi }:
+
+buildPythonPackage rec {
+  pname = "affine";
+  version = "2.2.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0j3mvcnmgjvvm0znqyf7xylq7i89zjf4dq0g8280xs6bwbl5cvih";
+  };
+
+  checkInputs = [ pytest ];
+  checkPhase = "py.test";
+
+  meta = with lib; {
+    description = "Matrices describing affine transformation of the plane";
+    license = licenses.bsd3;
+    homepage = https://github.com/sgillies/affine;
+    maintainers = with maintainers; [ mredaelli ];
+  };
+
+}

pkgs/development/python-modules/astunparse/default.nix

@@ -1,16 +1,27 @@
-{ stdenv, fetchPypi, buildPythonPackage, six }:
+{ stdenv
+, fetchPypi
+, buildPythonPackage
+, six
+, wheel
+ }:
 
 buildPythonPackage rec {
   pname = "astunparse";
-  version =  "1.5.0";
+  version =  "1.6.1";
+
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1kc9lm2jvfcip3z8snj04dar5a9jh857a704m6lvcv4xclm3rpsm";
+    sha256 = "d27b16fb33dea0778c5a2c01801554eae0d3f8a8d6f604f15627589c3d6f11ca";
   };
-  propagatedBuildInputs = [ six ];
+
-  doCheck = false; # no tests
+  propagatedBuildInputs = [ six wheel ];
+
+  # tests not included with pypi release
+  doCheck = false;
+
   meta = with stdenv.lib; {
     description = "This is a factored out version of unparse found in the Python source distribution";
+    homepage = https://github.com/simonpercivall/astunparse;
     license = licenses.bsd3;
     maintainers = with maintainers; [ jyp ];
   };

pkgs/development/python-modules/async_generator/default.nix

@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi, pythonOlder, pytest, pytest-asyncio }:
+{ lib, buildPythonPackage, fetchPypi, pythonOlder, isPy35, pytest, pytest-asyncio }:
 
 buildPythonPackage rec {
   pname = "async_generator";
@@ -17,6 +17,9 @@ buildPythonPackage rec {
     pytest -W error -ra -v --pyargs async_generator
   '';
 
+  # disable tests on python3.5 to avoid circular dependency with pytest-asyncio
+  doCheck = !isPy35;
+
   meta = with lib; {
     description = "Async generators and context managers for Python 3.5+";
     homepage = https://github.com/python-trio/async_generator;

pkgs/development/python-modules/bugzilla/default.nix

@@ -3,7 +3,7 @@
 
 buildPythonPackage rec {
   pname = "bugzilla";
-  version = "1.1.0";
+  version = "2.2.0";
 
   src = fetchPypi {
     inherit pname version;

pkgs/development/python-modules/cartopy/default.nix

@@ -0,0 +1,46 @@
+{ buildPythonPackage, lib, fetchPypi
+, pytest, filelock, mock, pep8
+, cython, isPy37, glibcLocales
+, six, pyshp, shapely, geos, proj, numpy
+, gdal, pillow, matplotlib, pyepsg, pykdtree, scipy, owslib, fiona
+}:
+
+buildPythonPackage rec {
+  pname = "cartopy";
+  version = "0.17.0";
+
+  src = fetchPypi {
+    inherit version;
+    pname = "Cartopy";
+    sha256 = "0q9ckfi37cxj7jwnqnzij62vwcf4krccx576vv5lhvpgvplxjjs2";
+  };
+
+  checkInputs = [ filelock mock pytest pep8 ];
+
+  # several tests require network connectivity: we disable them
+  checkPhase = ''
+    export HOME=$(mktemp -d)
+    pytest --pyargs cartopy \
+      -m "not network and not natural_earth" \
+      -k "not test_nightshade_image"
+  '';
+
+  buildInputs = [ cython glibcLocales ];
+  LC_ALL = "en_US.UTF-8";
+
+  propagatedBuildInputs = [
+    # required
+    six pyshp shapely geos proj numpy
+
+    # optional
+    gdal pillow matplotlib pyepsg pykdtree scipy fiona owslib
+  ];
+
+  meta = with lib; {
+    description = "Process geospatial data to create maps and perform analyses";
+    license = licenses.lgpl3;
+    homepage = https://scitools.org.uk/cartopy/docs/latest/;
+    maintainers = with maintainers; [ mredaelli ];
+  };
+
+}

pkgs/development/python-modules/configshell/default.nix

@@ -0,0 +1,21 @@
+{ stdenv, fetchFromGitHub, buildPythonPackage, pyparsing, six }:
+
+buildPythonPackage rec {
+  pname = "configshell";
+  version = "1.1.fb25";
+
+  src = fetchFromGitHub {
+    owner = "open-iscsi";
+    repo ="${pname}-fb";
+    rev = "v${version}";
+    sha256 = "0zpr2n4105qqsklyfyr9lzl1rhxjcv0mnsl57hgk0m763w6na90h";
+  };
+
+  propagatedBuildInputs = [ pyparsing six ];
+
+  meta = with stdenv.lib; {
+    description = "A Python library for building configuration shells";
+    homepage = https://github.com/open-iscsi/configshell-fb;
+    license = licenses.asl20;
+  };
+}

pkgs/development/python-modules/fs-s3fs/default.nix

@@ -0,0 +1,23 @@
+{ buildPythonPackage, fetchPypi, lib, fs, six, boto3 }:
+
+buildPythonPackage rec {
+  pname = "fs-s3fs";
+  version = "1.0.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1czv67zs4sl5l3rv9l3hzn22zzzqm372lq1wlhihigir4cfyslak";
+  };
+
+  propagatedBuildInputs = [ fs six boto3 ];
+
+  # tests try to integrate an s3 bucket which can't be tested properly in an isolated environment.
+  doCheck = false;
+
+  meta = with lib; {
+    homepage = https://pypi.org/project/fs-s3fs/;
+    license = licenses.mit;
+    description = "Amazon S3 filesystem for PyFilesystem2";
+    maintainers = with maintainers; [ ma27 ];
+  };
+}

pkgs/development/python-modules/gentools/default.nix

@@ -0,0 +1,31 @@
+{ buildPythonPackage, lib, fetchFromGitHub, pytest
+, typing, funcsigs, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "gentools";
+  version = "1.1.0";
+
+  # Pypi doesn't ship the tests, so we fetch directly from GitHub
+  src = fetchFromGitHub {
+    owner = "ariebovenberg";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1sm6cqi7fv2k3pc68r7wvvjjz8y6cjmz8bvxgqfa4v4wxibwnwrl";
+  };
+
+  propagatedBuildInputs =
+    lib.optionals (pythonOlder "3.5") [ typing ] ++
+    lib.optionals (pythonOlder "3.4") [ funcsigs ];
+
+  checkInputs = [ pytest ];
+  checkPhase = "pytest";
+
+  meta = with lib; {
+    description = "Tools for generators, generator functions, and generator-based coroutines";
+    license = licenses.mit;
+    homepage = http://gentools.readthedocs.io/;
+    maintainers = with maintainers; [ mredaelli ];
+  };
+
+}

pkgs/development/python-modules/grpcio-tools/default.nix

@@ -2,16 +2,16 @@
 
 buildPythonPackage rec {
   pname = "grpcio-tools";
-  version = "1.14.2";
+  version = "1.16.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b3fd64a5b8c1d981f6d68a331449109633710a346051c44e0f0cca1812e2b4b0";
+    sha256 = "0h0w7jlggm8nc250wwqai7lihw8mymx9jjpkl0cdmqmwbypj72vd";
   };
 
   enableParallelBuilding = true;
 
-  propagatedBuildInputs = [ grpc grpcio ];
+  propagatedBuildInputs = [ grpcio ];
 
   # no tests in the package
   doCheck = false;