Merge remote-tracking branch 'upstream/staging' into binutils-wrapper

2017-12-13 16:14:47 -05:00 · 2017-12-13 16:14:47 -05:00 · a0b1ebeee9
commit a0b1ebeee9
parent 84fb59e0be 105d9519c1
803 changed files with 17167 additions and 12293 deletions
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@ -84,3 +84,9 @@
 # https://github.com/NixOS/nixpkgs/issues/31401
 /lib/maintainers.nix @ghost
 /lib/licenses.nix @ghost
+
+# Qt / KDE
+/pkgs/applications/kde @ttuegel
+/pkgs/desktops/plasma-5 @ttuegel
+/pkgs/development/libraries/kde-frameworks @ttuegel
+/pkgs/development/libraries/qt-5 @ttuegel
--- a/doc/languages-frameworks/python.md
+++ b/doc/languages-frameworks/python.md
@ -134,7 +134,7 @@ with
 ```nix
 with import <nixpkgs> {};

-python35.withPackages (ps: [ps.numpy ps.toolz])
+(python35.withPackages (ps: [ps.numpy ps.toolz])).env
 ```
 Executing `nix-shell` gives you again a Nix shell from which you can run Python.

--- a/doc/languages-frameworks/rust.md
+++ b/doc/languages-frameworks/rust.md
@ -20,7 +20,7 @@ For daily builds (beta and nightly) use either rustup from
 nixpkgs or use the [Rust nightlies
 overlay](#using-the-rust-nightlies-overlay).

-## Packaging Rust applications
+## Compiling Rust applications with Cargo

 Rust applications are packaged by using the `buildRustPackage` helper from `rustPlatform`:

@ -56,6 +56,167 @@ checksum can be then take from the failed build.
 To install crates with nix there is also an experimental project called
 [nixcrates](https://github.com/fractalide/nixcrates).

+## Compiling Rust crates using Nix instead of Cargo
+
+When run, `cargo build` produces a file called `Cargo.lock`,
+containing pinned versions of all dependencies. Nixpkgs contains a
+tool called `carnix` (`nix-env -iA nixos.carnix`), which can be used
+to turn a `Cargo.lock` into a Nix expression.
+
+That Nix expression calls `rustc` directly (hence bypassing Cargo),
+and can be used to compile a crate and all its dependencies. Here is
+an example for a minimal `hello` crate:
+
+
+    $ cargo new hello
+    $ cd hello
+    $ cargo build
+     Compiling hello v0.1.0 (file:///tmp/hello)
+      Finished dev [unoptimized + debuginfo] target(s) in 0.20 secs
+    $ carnix -o hello.nix --src ./. Cargo.lock --standalone
+    $ nix-build hello.nix
+
+Now, the file produced by the call to `carnix`, called `hello.nix`, looks like:
+
+```
+with import <nixpkgs> {};
+let kernel = buildPlatform.parsed.kernel.name;
+    # ... (content skipped)
+    hello_0_1_0_ = { dependencies?[], buildDependencies?[], features?[] }: buildRustCrate {
+      crateName = "hello";
+      version = "0.1.0";
+      authors = [ "Authorname <user@example.com>" ];
+      src = ./.;
+      inherit dependencies buildDependencies features;
+    };
+in
+rec {
+  hello_0_1_0 = hello_0_1_0_ rec {};
+}
+```
+
+In particular, note that the argument given as `--src` is copied
+verbatim to the source. If we look at a more complicated
+dependencies, for instance by adding a single line `libc="*"` to our
+`Cargo.toml`, we first need to run `cargo build` to update the
+`Cargo.lock`. Then, `carnix` needs to be run again, and produces the
+following nix file:
+
+```
+with import <nixpkgs> {};
+let kernel = buildPlatform.parsed.kernel.name;
+    # ... (content skipped)
+    hello_0_1_0_ = { dependencies?[], buildDependencies?[], features?[] }: buildRustCrate {
+      crateName = "hello";
+      version = "0.1.0";
+      authors = [ "Jörg Thalheim <joerg@thalheim.io>" ];
+      src = ./.;
+      inherit dependencies buildDependencies features;
+    };
+    libc_0_2_34_ = { dependencies?[], buildDependencies?[], features?[] }: buildRustCrate {
+      crateName = "libc";
+      version = "0.2.34";
+      authors = [ "The Rust Project Developers" ];
+      sha256 = "11jmqdxmv0ka10ay0l8nzx0nl7s2lc3dbrnh1mgbr2grzwdyxi2s";
+      inherit dependencies buildDependencies features;
+    };
+in
+rec {
+  hello_0_1_0 = hello_0_1_0_ rec {
+    dependencies = [ libc_0_2_34 ];
+  };
+  libc_0_2_34_features."default".from_hello_0_1_0__default = true;
+  libc_0_2_34 = libc_0_2_34_ rec {
+    features = mkFeatures libc_0_2_34_features;
+  };
+  libc_0_2_34_features."use_std".self_default = hasDefault libc_0_2_34_features;
+}
+```
+
+Here, the `libc` crate has no `src` attribute, so `buildRustCrate`
+will fetch it from [crates.io](https://crates.io). A `sha256`
+attribute is still needed for Nix purity.
+
+Some crates require external libraries. For crates from
+[crates.io](https://crates.io), such libraries can be specified in
+`defaultCrateOverrides` package in nixpkgs itself.
+
+Starting from that file, one can add more overrides, to add features
+or build inputs by overriding the hello crate in a seperate file.
+
+```
+with import <nixpkgs> {};
+(import ./hello.nix).hello_0_1_0.override {
+  crateOverrides = defaultCrateOverrides // {
+    hello = attrs: { buildInputs = [ openssl ]; };
+  };
+}
+```
+
+Here, `crateOverrides` is expected to be a attribute set, where the
+key is the crate name without version number and the value a function.
+The function gets all attributes passed to `buildRustCrate` as first
+argument and returns a set that contains all attribute that should be
+overwritten.
+
+For more complicated cases, such as when parts of the crate's
+derivation depend on the the crate's version, the `attrs` argument of
+the override above can be read, as in the following example, which
+patches the derivation:
+
+```
+with import <nixpkgs> {};
+(import ./hello.nix).hello_0_1_0.override {
+  crateOverrides = defaultCrateOverrides // {
+    hello = attrs: lib.optionalAttrs (lib.versionAtLeast attrs.version "1.0")  {
+      postPatch = ''
+        substituteInPlace lib/zoneinfo.rs \
+          --replace "/usr/share/zoneinfo" "${tzdata}/share/zoneinfo"
+      '';
+    };
+  };
+}
+```
+
+Another situation is when we want to override a nested
+dependency. This actually works in the exact same way, since the
+`crateOverrides` parameter is forwarded to the crate's
+dependencies. For instance, to override the build inputs for crate
+`libc` in the example above, where `libc` is a dependency of the main
+crate, we could do:
+
+```
+with import <nixpkgs> {};
+(import hello.nix).hello_0_1_0.override {
+  crateOverrides = defaultCrateOverrides // {
+    libc = attrs: { buildInputs = []; };
+  };
+}
+```
+
+Three more parameters can be overridden:
+
+- The version of rustc used to compile the crate:
+
+  ```
+  hello_0_1_0.override { rust = pkgs.rust; };
+  ```
+
+- Whether to build in release mode or debug mode (release mode by
+  default):
+
+  ```
+  hello_0_1_0.override { release = false; };
+  ```
+
+- Whether to print the commands sent to rustc when building
+  (equivalent to `--verbose` in cargo:
+
+  ```
+  hello_0_1_0.override { verbose = false; };
+  ```
+
+
 ## Using the Rust nightlies overlay

 Mozilla provides an overlay for nixpkgs to bring a nightly version of Rust into scope.
--- a/doc/package-notes.xml
+++ b/doc/package-notes.xml
@ -667,11 +667,13 @@ cp ${myEmacsConfig} $out/share/emacs/site-lisp/default.el
 <section xml:id="sec-weechat">
 <title>Weechat</title>
 <para>
-Weechat can currently be configured to include your choice of plugins.
-To make use of this functionality, install an expression that overrides its configuration such as
+Weechat can be configured to include your choice of plugins, reducing its
+closure size from the default configuration which includes all available
+plugins.  To make use of this functionality, install an expression that
+overrides its configuration such as
 <programlisting>weechat.override {configure = {availablePlugins, ...}: {
-        plugins = with availablePlugins; [ python perl ];
-    }
+    plugins = with availablePlugins; [ python perl ];
+  }
 }</programlisting>
 </para>
 <para>
--- a/doc/stdenv.xml
+++ b/doc/stdenv.xml
@ -251,10 +251,17 @@ genericBuild

  <varlistentry>
    <term><varname>enableParallelBuilding</varname></term>
-    <listitem><para>If set, <literal>stdenv</literal> will pass specific
-    flags to <literal>make</literal> and other build tools to enable
-    parallel building with up to <literal>build-cores</literal>
-    workers.</para></listitem>
+    <listitem>
+      <para>If set to <literal>true</literal>, <literal>stdenv</literal> will
+      pass specific flags to <literal>make</literal> and other build tools to
+      enable parallel building with up to <literal>build-cores</literal>
+      workers.</para>
+
+      <para>Unless set to <literal>false</literal>, some build systems with good
+      support for parallel building including <literal>cmake</literal>,
+      <literal>meson</literal>, and <literal>qmake</literal> will set it to
+      <literal>true</literal>.</para>
+    </listitem>
  </varlistentry>

  <varlistentry>
--- a/lib/maintainers.nix
+++ b/lib/maintainers.nix
@ -80,6 +80,7 @@
  benley = "Benjamin Staffin <benley@gmail.com>";
  bennofs = "Benno Fünfstück <benno.fuenfstueck@gmail.com>";
  benwbooth = "Ben Booth <benwbooth@gmail.com>";
+  berce = "Bert Moens <bert.moens@gmail.com>";
  berdario = "Dario Bertini <berdario@gmail.com>";
  bergey = "Daniel Bergey <bergey@teallabs.org>";
  bhipple = "Benjamin Hipple <bhipple@protonmail.com>";
@ -204,6 +205,7 @@
  elijahcaine = "Elijah Caine <elijahcainemv@gmail.com>";
  elitak = "Eric Litak <elitak@gmail.com>";
  ellis = "Ellis Whitehead <nixos@ellisw.net>";
+  enzime = "Michael Hoang <enzime@users.noreply.github.com>";
  eperuffo = "Emanuele Peruffo <info@emanueleperuffo.com>";
  epitrochoid = "Mabry Cervin <mpcervin@uncg.edu>";
  eqyiel = "Ruben Maher <r@rkm.id.au>";
@ -288,6 +290,7 @@
  ironpinguin = "Michele Catalano <michele@catalano.de>";
  ivan-tkatchev = "Ivan Tkatchev <tkatchev@gmail.com>";
  ixmatus = "Parnell Springmeyer <parnell@digitalmentat.com>";
+  izorkin = "Yurii Izorkin <Izorkin@gmail.com>";
  j-keck = "Jürgen Keck <jhyphenkeck@gmail.com>";
  jagajaga = "Arseniy Seroka <ars.seroka@gmail.com>";
  jammerful = "jammerful <jammerful@gmail.com>";
@ -389,6 +392,7 @@
  manveru = "Michael Fellinger <m.fellinger@gmail.com>";
  marcweber = "Marc Weber <marco-oweber@gmx.de>";
  markus1189 = "Markus Hauck <markus1189@gmail.com>";
+  markuskowa = "Markus Kowalewski <markus.kowalewski@gmail.com>";
  markWot = "Markus Wotringer <markus@wotringer.de>";
  martijnvermaat = "Martijn Vermaat <martijn@vermaat.name>";
  martingms = "Martin Gammelsæter <martin@mg.am>";
@ -400,6 +404,7 @@
  mbakke = "Marius Bakke <mbakke@fastmail.com>";
  mbbx6spp = "Susan Potter <me@susanpotter.net>";
  mbe = "Brandon Edens <brandonedens@gmail.com>";
+  mbode = "Maximilian Bode <maxbode@gmail.com>";
  mboes = "Mathieu Boespflug <mboes@tweag.net>";
  mbrgm = "Marius Bergmann <marius@yeai.de>";
  mcmtroffaes = "Matthias C. M. Troffaes <matthias.troffaes@gmail.com>";
@ -414,6 +419,7 @@
  michaelpj = "Michael Peyton Jones <michaelpj@gmail.com>";
  michalrus = "Michal Rus <m@michalrus.com>";
  michelk = "Michel Kuhlmann <michel@kuhlmanns.info>";
+  mickours = "Michael Mercier <mickours@gmail.com<";
  midchildan = "midchildan <midchildan+nix@gmail.com>";
  mikefaille = "Michaël Faille <michael@faille.io>";
  mikoim = "Eshin Kunishima <ek@esh.ink>";
@ -428,6 +434,7 @@
  mog = "Matthew O'Gorman <mog-lists@rldn.net>";
  montag451 = "montag451 <montag451@laposte.net>";
  moosingin3space = "Nathan Moos <moosingin3space@gmail.com>";
+  moredread = "André-Patrick Bubel <code@apb.name>";
  moretea = "Maarten Hoogendoorn <maarten@moretea.nl>";
  mornfall = "Petr Ročkai <me@mornfall.net>";
  MostAwesomeDude = "Corbin Simpson <cds@corbinsimpson.com>";
@ -436,6 +443,7 @@
  mpcsh = "Mark Cohen <m@mpc.sh>";
  mpscholten = "Marc Scholten <marc@mpscholten.de>";
  mpsyco = "Francis St-Amour <fr.st-amour@gmail.com>";
+  mrVanDalo = "Ingolf Wanger <contact@ingolf-wagner.de>";
  msackman = "Matthew Sackman <matthew@wellquite.org>";
  mschristiansen = "Mikkel Christiansen <mikkel@rheosystems.com>";
  msteen = "Matthijs Steen <emailmatthijs@gmail.com>";
@ -483,7 +491,6 @@
  oxij = "Jan Malakhovski <oxij@oxij.org>";
  paholg = "Paho Lurie-Gregg <paho@paholg.com>";
  pakhfn = "Fedor Pakhomov <pakhfn@gmail.com>";
-  palo = "Ingolf Wanger <palipalo9@googlemail.com>";
  panaeon = "Vitalii Voloshyn <vitalii.voloshyn@gmail.com";
  paperdigits = "Mica Semrick <mica@silentumbrella.com>";
  pashev = "Igor Pashev <pashev.igor@gmail.com>";
@ -511,6 +518,7 @@
  plcplc = "Philip Lykke Carlsen <plcplc@gmail.com>";
  plumps = "Maksim Bronsky <maks.bronsky@web.de";
  pmahoney = "Patrick Mahoney <pat@polycrystal.org>";
+  pmeunier = "Pierre-Étienne Meunier <pierre-etienne.meunier@inria.fr>";
  pmiddend = "Philipp Middendorf <pmidden@secure.mailbox.org>";
  polyrod = "Maurizio Di Pietro <dc1mdp@gmail.com>";
  pradeepchhetri = "Pradeep Chhetri <pradeep.chhetri89@gmail.com>";
--- a/lib/strings.nix
+++ b/lib/strings.nix
@ -219,6 +219,14 @@ rec {
  */
  escapeShellArgs = concatMapStringsSep " " escapeShellArg;

+  /* Turn a string into a Nix expression representing that string
+
+     Example:
+       escapeNixString "hello\${}\n"
+       => "\"hello\\\${}\\n\""
+  */
+  escapeNixString = s: escape ["$"] (builtins.toJSON s);
+
  /* Obsolete - use replaceStrings instead. */
  replaceChars = builtins.replaceStrings or (
    del: new: s:
--- a/lib/types.nix
+++ b/lib/types.nix
@ -174,6 +174,13 @@ rec {
      merge = mergeOneOption;
    };

+    strMatching = pattern: mkOptionType {
+      name = "strMatching ${escapeNixString pattern}";
+      description = "string matching the pattern ${pattern}";
+      check = x: str.check x && builtins.match pattern x != null;
+      inherit (str) merge;
+    };
+
    # Merge multiple definitions by concatenating them (with the given
    # separator between the values).
    separatedString = sep: mkOptionType rec {
--- a/nixos/doc/manual/configuration/x-windows.xml
+++ b/nixos/doc/manual/configuration/x-windows.xml
@ -115,13 +115,14 @@ hardware.opengl.driSupport32Bit = true;
 <para>Support for Synaptics touchpads (found in many laptops such as
 the Dell Latitude series) can be enabled as follows:
 <programlisting>
-services.xserver.synaptics.enable = true;
+services.xserver.libinput.enable = true;
 </programlisting>
 The driver has many options (see <xref linkend="ch-options"/>).  For
-instance, the following enables two-finger scrolling:
+instance, the following disables tap-to-click behavior:
 <programlisting>
-services.xserver.synaptics.twoFingerScroll = true;
+services.xserver.libinput.tapping = false;
 </programlisting>
+Note: the use of <literal>services.xserver.synaptics</literal> is deprecated since NixOS 17.09.
 </para>

 </simplesect>
--- a/nixos/doc/manual/development/option-types.xml
+++ b/nixos/doc/manual/development/option-types.xml
@ -110,6 +110,12 @@
    <listitem><para>A string. Multiple definitions are concatenated with a 
        collon <literal>":"</literal>.</para></listitem>
  </varlistentry>
+  <varlistentry>
+    <term><varname>types.strMatching</varname></term>
+    <listitem><para>A string matching a specific regular expression. Multiple
+    definitions cannot be merged.  The regular expression is processed using
+    <literal>builtins.match</literal>.</para></listitem>
+  </varlistentry>
 </variablelist>

 </section>
--- a/nixos/doc/manual/release-notes/rl-1803.xml
+++ b/nixos/doc/manual/release-notes/rl-1803.xml
@ -131,6 +131,12 @@ following incompatible changes:</para>
      must be set to true.
    </para>
  </listitem>
+  <listitem>
+    <para>
+      The option <option>services.logstash.listenAddress</option> is now <literal>127.0.0.1</literal> by default.
+      Previously the default behaviour was to listen on all interfaces.
+    </para>
+  </listitem>
 </itemizedlist>

 </section>
--- a/nixos/lib/make-disk-image.nix
+++ b/nixos/lib/make-disk-image.nix
@ -150,8 +150,6 @@ in pkgs.vmTools.runInLinuxVM (
    }
    ''
      ${if partitioned then ''
-        . /sys/class/block/vda1/uevent
-        mknod /dev/vda1 b $MAJOR $MINOR
        rootDisk=/dev/vda1
      '' else ''
        rootDisk=/dev/vda
--- a/nixos/lib/make-squashfs.nix
+++ b/nixos/lib/make-squashfs.nix
@ -19,6 +19,33 @@ stdenv.mkDerivation {
      # Add the closures of the top-level store objects.
      storePaths=$(perl ${pathsFromGraph} closure-*)

+      # If a Hydra slave happens to have store paths with bad permissions/mtime,
+      # abort now so that they don't end up in ISO images in the channel.
+      # https://github.com/NixOS/nixpkgs/issues/32242
+      hasBadPaths=""
+      for path in $storePaths; do
+        if [ -h "$path" ]; then
+          continue
+        fi
+
+        mtime=$(stat -c %Y "$path")
+        mode=$(stat -c %a "$path")
+
+        if [ "$mtime" != 1 ]; then
+          echo "Store path '$path' has an invalid mtime."
+          hasBadPaths=1
+        fi
+        if [ "$mode" != 444 ] && [ "$mode" != 555 ]; then
+          echo "Store path '$path' has invalid permissions."
+          hasBadPaths=1
+        fi
+      done
+
+      if [ -n "$hasBadPaths" ]; then
+        echo "You have bad paths in your store, please fix them."
+        exit 1
+      fi
+
      # Also include a manifest of the closures in a format suitable
      # for nix-store --load-db.
      printRegistration=1 perl ${pathsFromGraph} closure-* > nix-path-registration
--- a/nixos/modules/config/networking.nix
+++ b/nixos/modules/config/networking.nix
@ -290,8 +290,8 @@ in
          ln -s /run/systemd/resolve/resolv.conf /run/resolvconf/interfaces/systemd
        ''}

-        # Make sure resolv.conf is up to date if not managed by systemd
-        ${optionalString (!config.services.resolved.enable) ''
+        # Make sure resolv.conf is up to date if not managed manually or by systemd
+        ${optionalString (!config.environment.etc?"resolv.conf") ''
          ${pkgs.openresolv}/bin/resolvconf -u
        ''}
      '';
--- a/nixos/modules/config/pulseaudio.nix
+++ b/nixos/modules/config/pulseaudio.nix
@ -101,7 +101,8 @@ in {
          each user that tries to use the sound system. The server runs
          with user privileges. This is the recommended and most secure
          way to use PulseAudio. If true, one system-wide PulseAudio
-          server is launched on boot, running as the user "pulse".
+          server is launched on boot, running as the user "pulse", and
+          only users in the "audio" group will have access to the server.
          Please read the PulseAudio documentation for more details.
        '';
      };
--- a/nixos/modules/installer/netboot/netboot.nix
+++ b/nixos/modules/installer/netboot/netboot.nix
@ -18,17 +18,17 @@ with lib;

  };

-  config = {
-
-    boot.loader.grub.version = 2;
-
+  config = rec {
    # Don't build the GRUB menu builder script, since we don't need it
    # here and it causes a cyclic dependency.
    boot.loader.grub.enable = false;

    # !!! Hack - attributes expected by other modules.
-    system.boot.loader.kernelFile = "bzImage";
-    environment.systemPackages = [ pkgs.grub2 pkgs.grub2_efi pkgs.syslinux ];
+    environment.systemPackages = [ pkgs.grub2_efi ]
+      ++ (if pkgs.stdenv.system == "aarch64-linux"
+          then []
+          else [ pkgs.grub2 pkgs.syslinux ]);
+    system.boot.loader.kernelFile = pkgs.stdenv.platform.kernelTarget;

    fileSystems."/" =
      { fsType = "tmpfs";
@ -84,7 +84,12 @@ with lib;
        ];
    };

-    system.build.netbootIpxeScript = pkgs.writeTextDir "netboot.ipxe" "#!ipxe\nkernel bzImage init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams}\ninitrd initrd\nboot";
+    system.build.netbootIpxeScript = pkgs.writeTextDir "netboot.ipxe" ''
+      #!ipxe
+      kernel ${pkgs.stdenv.platform.kernelTarget} init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams}
+      initrd initrd
+      boot
+    '';

    boot.loader.timeout = 10;

--- a/nixos/modules/installer/tools/nix-fallback-paths.nix
+++ b/nixos/modules/installer/tools/nix-fallback-paths.nix
@ -1,5 +1,6 @@
 {
-  x86_64-linux = "/nix/store/b4s1gxiis1ryvybnjhdjvgc5sr1nq0ys-nix-1.11.15";
-  i686-linux = "/nix/store/kgb5hs7qw13bvb6icramv1ry9dard3h9-nix-1.11.15";
-  x86_64-darwin = "/nix/store/dgwz3dxdzs2wwd7pg7cdhvl8rv0qpnbj-nix-1.11.15";
+  x86_64-linux = "/nix/store/gy4yv67gv3j6in0lalw37j353zdmfcwm-nix-1.11.16";
+  i686-linux = "/nix/store/ifmyq5ryfxhhrzh62hiq65xyz1fwffga-nix-1.11.16";
+  aarch64-linux = "/nix/store/y9mfv3sx75mbfibf1zna1kq9v98fk2nb-nix-1.11.16";
+  x86_64-darwin = "/nix/store/hwpp7kia2f0in5ns2hiw41q38k30jpj2-nix-1.11.16";
 }
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -239,6 +239,7 @@
  ./services/hardware/tlp.nix
  ./services/hardware/thinkfan.nix
  ./services/hardware/trezord.nix
+  ./services/hardware/u2f.nix
  ./services/hardware/udev.nix
  ./services/hardware/udisks2.nix
  ./services/hardware/upower.nix
@ -328,6 +329,7 @@
  ./services/misc/nix-ssh-serve.nix
  ./services/misc/nzbget.nix
  ./services/misc/octoprint.nix
+  ./services/misc/osrm.nix
  ./services/misc/packagekit.nix
  ./services/misc/parsoid.nix
  ./services/misc/phd.nix
@ -588,6 +590,7 @@
  ./services/system/cloud-init.nix
  ./services/system/dbus.nix
  ./services/system/earlyoom.nix
+  ./services/system/localtime.nix
  ./services/system/kerberos.nix
  ./services/system/nscd.nix
  ./services/system/saslauthd.nix
--- a/nixos/modules/programs/bash/bash.nix
+++ b/nixos/modules/programs/bash/bash.nix
@ -14,13 +14,16 @@ let
  bashCompletion = optionalString cfg.enableCompletion ''
    # Check whether we're running a version of Bash that has support for
    # programmable completion. If we do, enable all modules installed in
-    # the system (and user profile).
+    # the system and user profile in obsolete /etc/bash_completion.d/
+    # directories. Bash loads completions in all
+    # $XDG_DATA_DIRS/share/bash-completion/completions/
+    # on demand, so they do not need to be sourced here.
    if shopt -q progcomp &>/dev/null; then
      . "${pkgs.bash-completion}/etc/profile.d/bash_completion.sh"
      nullglobStatus=$(shopt -p nullglob)
      shopt -s nullglob
      for p in $NIX_PROFILES; do
-        for m in "$p/etc/bash_completion.d/"* "$p/share/bash-completion/completions/"*; do
+        for m in "$p/etc/bash_completion.d/"*; do
          . $m
        done
      done
--- a/nixos/modules/services/hardware/u2f.nix
+++ b/nixos/modules/services/hardware/u2f.nix
@ -0,0 +1,23 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+  cfg = config.hardware.u2f;
+in {
+  options = {
+    hardware.u2f = {
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Enable U2F hardware support.
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.udev.packages = [ pkgs.libu2f-host ];
+  };
+}
+
--- a/nixos/modules/services/logging/logstash.nix
+++ b/nixos/modules/services/logging/logstash.nix
@ -103,7 +103,7 @@ in

      listenAddress = mkOption {
        type = types.str;
-        default = "0.0.0.0";
+        default = "127.0.0.1";
        description = "Address on which to start webserver.";
      };

--- a/nixos/modules/services/misc/gollum.nix
+++ b/nixos/modules/services/misc/gollum.nix
@ -32,6 +32,24 @@ in
      description = "Content of the configuration file";
    };

+    mathjax = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Enable support for math rendering using MathJax";
+    };
+
+    allowUploads = mkOption {
+      type = types.nullOr (types.enum [ "dir" "page" ]);
+      default = null;
+      description = "Enable uploads of external files";
+    };
+
+    emoji = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Parse and interpret emoji tags";
+    };
+
    branch = mkOption {
      type = types.str;
      default = "master";
@ -84,6 +102,9 @@ in
            --host ${cfg.address} \
            --config ${builtins.toFile "gollum-config.rb" cfg.extraConfig} \
            --ref ${cfg.branch} \
+            ${optionalString cfg.mathjax "--mathjax"} \
+            ${optionalString cfg.emoji "--emoji"} \
+            ${optionalString (cfg.allowUploads != null) "--allow-uploads ${cfg.allowUploads}"} \
            ${cfg.stateDir}
        '';
      };
--- a/nixos/modules/services/misc/osrm.nix
+++ b/nixos/modules/services/misc/osrm.nix
@ -0,0 +1,85 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.osrm;
+in
+
+{
+  options.services.osrm = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Enable the OSRM service.";
+    };
+
+    address = mkOption {
+      type = types.str;
+      default = "0.0.0.0";
+      description = "IP address on which the web server will listen.";
+    };
+
+    port = mkOption {
+      type = types.int;
+      default = 5000;
+      description = "Port on which the web server will run.";
+    };
+
+    threads = mkOption {
+      type = types.int;
+      default = 4;
+      description = "Number of threads to use.";
+    };
+
+    algorithm = mkOption {
+      type = types.enum [ "CH" "CoreCH" "MLD" ];
+      default = "MLD";
+      description = "Algorithm to use for the data. Must be one of CH, CoreCH, MLD";
+    };
+
+    extraFlags = mkOption {
+      type = types.listOf types.str;
+      default = [];
+      example = [ "--max-table-size 1000" "--max-matching-size 1000" ];
+      description = "Extra command line arguments passed to osrm-routed";
+    };
+
+    dataFile = mkOption {
+      type = types.path;
+      example = "/var/lib/osrm/berlin-latest.osrm";
+      description = "Data file location";
+    };
+
+  };
+
+  config = mkIf cfg.enable {
+
+    users.users.osrm = {
+      group = config.users.users.osrm.name;
+      description = "OSRM user";
+      createHome = false;
+    };
+
+    users.groups.osrm = { };
+
+    systemd.services.osrm = {
+      description = "OSRM service";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        User = config.users.extraUsers.osrm.name;
+        ExecStart = ''
+          ${pkgs.osrm-backend}/bin/osrm-routed \
+            --ip ${cfg.address} \
+            --port ${toString cfg.port} \
+            --threads ${toString cfg.threads} \
+            --algorithm ${cfg.algorithm} \
+            ${toString cfg.extraFlags} \
+            ${cfg.dataFile}
+        '';
+      };
+    };
+  };
+}
--- a/nixos/modules/services/monitoring/statsd.nix
+++ b/nixos/modules/services/monitoring/statsd.nix
@ -9,6 +9,12 @@ let
  isBuiltinBackend = name:
    builtins.elem name [ "graphite" "console" "repeater" ];

+  backendsToPackages = let
+    mkMap = list: name:
+      if isBuiltinBackend name then list
+      else list ++ [ pkgs.nodePackages.${name} ];
+  in foldl mkMap [];
+
  configFile = pkgs.writeText "statsd.conf" ''
    {
      address: "${cfg.listenAddress}",
@ -27,13 +33,21 @@ let
        prettyprint: false
      },
      log: {
-        backend: "syslog"
+        backend: "stdout"
      },
      automaticConfigReload: false${optionalString (cfg.extraConfig != null) ","}
      ${cfg.extraConfig}
    }
  '';

+  deps = pkgs.buildEnv {
+    name = "statsd-runtime-deps";
+    pathsToLink = [ "/lib" ];
+    ignoreCollisions = true;
+
+    paths = backendsToPackages cfg.backends;
+  };
+
 in

 {
@ -42,11 +56,7 @@ in

  options.services.statsd = {

-    enable = mkOption {
-      description = "Whether to enable statsd stats aggregation service";
-      default = false;
-      type = types.bool;
-    };
+    enable = mkEnableOption "statsd";

    listenAddress = mkOption {
      description = "Address that statsd listens on over UDP";
@ -110,6 +120,11 @@ in

  config = mkIf cfg.enable {

+    assertions = map (backend: {
+      assertion = !isBuiltinBackend backend -> hasAttrByPath [ backend ] pkgs.nodePackages;
+      message = "Only builtin backends (graphite, console, repeater) or backends enumerated in `pkgs.nodePackages` are allowed!";
+    }) cfg.backends;
+
    users.extraUsers = singleton {
      name = "statsd";
      uid = config.ids.uids.statsd;
@ -120,9 +135,7 @@ in
      description = "Statsd Server";
      wantedBy = [ "multi-user.target" ];
      environment = {
-        NODE_PATH=concatMapStringsSep ":"
-          (pkg: "${builtins.getAttr pkg pkgs.statsd.nodePackages}/lib/node_modules")
-          (filter (name: !isBuiltinBackend name) cfg.backends);
+        NODE_PATH = "${deps}/lib/node_modules";
      };
      serviceConfig = {
        ExecStart = "${pkgs.statsd}/bin/statsd ${configFile}";
--- a/nixos/modules/services/networking/i2pd.nix
+++ b/nixos/modules/services/networking/i2pd.nix
@ -126,6 +126,7 @@ let
        [${tun.name}]
        type = client
        destination = ${tun.destination}
+        destinationport = ${toString tun.destinationPort}
        keys = ${tun.keys}
        address = ${tun.address}
        port = ${toString tun.port}
@ -137,15 +138,15 @@ let
      '')
    }
    ${flip concatMapStrings
-      (collect (tun: tun ? port && tun ? host) cfg.inTunnels)
-      (tun: let portStr = toString tun.port; in ''
+      (collect (tun: tun ? port && tun ? address) cfg.inTunnels)
+      (tun: ''
        [${tun.name}]
        type = server
        destination = ${tun.destination}
        keys = ${tun.keys}
        host = ${tun.address}
-        port = ${tun.port}
-        inport = ${tun.inPort}
+        port = ${toString tun.port}
+        inport = ${toString tun.inPort}
        accesslist = ${builtins.concatStringsSep "," tun.accessList}
      '')
    }
@ -405,7 +406,13 @@ in
        default = {};
        type = with types; loaOf (submodule (
          { name, config, ... }: {
-            options = commonTunOpts name;
+            options = {
+              destinationPort = mkOption {
+                type = types.int;
+                default = 0;
+                description = "Connect to particular port at destination.";
+              };
+            } // commonTunOpts name;
            config = {
              name = mkDefault name;
            };
--- a/nixos/modules/services/networking/nat.nix
+++ b/nixos/modules/services/networking/nat.nix
@ -53,6 +53,12 @@ let
        -j DNAT --to-destination ${fwd.destination}
    '') cfg.forwardPorts}

+    ${optionalString (cfg.dmzHost != null) ''
+      iptables -w -t nat -A nixos-nat-pre \
+        -i ${cfg.externalInterface} -j DNAT \
+	--to-destination ${cfg.dmzHost}
+    ''}
+
    # Append our chains to the nat tables
    iptables -w -t nat -A PREROUTING -j nixos-nat-pre
    iptables -w -t nat -A POSTROUTING -j nixos-nat-post
@ -125,15 +131,15 @@ in
      type = with types; listOf (submodule {
        options = {
          sourcePort = mkOption {
-            type = types.int;
+            type = types.either types.int (types.strMatching "[[:digit:]]+:[[:digit:]]+");
            example = 8080;
-            description = "Source port of the external interface";
+            description = "Source port of the external interface; to specify a port range, use a string with a colon (e.g. \"60000:61000\")";
          };

          destination = mkOption {
            type = types.str;
            example = "10.0.0.1:80";
-            description = "Forward connection to destination ip:port";
+            description = "Forward connection to destination ip:port; to specify a port range, use ip:start-end";
          };

          proto = mkOption {
@ -153,6 +159,17 @@ in
        '';
    };

+    networking.nat.dmzHost = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      example = "10.0.0.1";
+      description =
+        ''
+          The local IP address to which all traffic that does not match any
+          forwarding rule is forwarded.
+        '';
+    };
+
  };


--- a/nixos/modules/services/networking/networkmanager.nix
+++ b/nixos/modules/services/networking/networkmanager.nix
@ -241,6 +241,19 @@ in {
          A list of scripts which will be executed in response to  network  events.
        '';
      };
+
+      enableStrongSwan = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Enable the StrongSwan plugin.
+          </para><para>
+          If you enable this option the
+          <literal>networkmanager_strongswan</literal> plugin will be added to
+          the <option>networking.networkmanager.packages</option> option
+          so you don't need to to that yourself.
+        '';
+      };
    };
  };

@ -333,13 +346,13 @@ in {
      wireless.enable = lib.mkDefault false;
    };

-    powerManagement.resumeCommands = ''
-      ${config.systemd.package}/bin/systemctl restart network-manager
-    '';
-
    security.polkit.extraConfig = polkitConf;

-    services.dbus.packages = cfg.packages;
+    networking.networkmanager.packages =
+      mkIf cfg.enableStrongSwan [ pkgs.networkmanager_strongswan ];
+
+    services.dbus.packages =
+      optional cfg.enableStrongSwan pkgs.strongswanNM ++ cfg.packages;

    services.udev.packages = cfg.packages;
  };
--- a/nixos/modules/services/networking/prosody.nix
+++ b/nixos/modules/services/networking/prosody.nix
@ -10,98 +10,126 @@ let

    options = {

-      # TODO: require attribute
      key = mkOption {
-        type = types.str;
-        description = "Path to the key file";
+        type = types.path;
+        description = "Path to the key file.";
      };

-      # TODO: require attribute
      cert = mkOption {
-        type = types.str;
-        description = "Path to the certificate file";
+        type = types.path;
+        description = "Path to the certificate file.";
      };
+
+      extraOptions = mkOption {
+        type = types.attrs;
+        default = {};
+        description = "Extra SSL configuration options.";
+      };
+
    };
  };

  moduleOpts = {

    roster = mkOption {
+      type = types.bool;
      default = true;
      description = "Allow users to have a roster";
    };

    saslauth = mkOption {
+      type = types.bool;
      default = true;
      description = "Authentication for clients and servers. Recommended if you want to log in.";
    };

    tls = mkOption {
+      type = types.bool;
      default = true;
      description = "Add support for secure TLS on c2s/s2s connections";
    };

    dialback = mkOption {
+      type = types.bool;
      default = true;
      description = "s2s dialback support";
    };

    disco = mkOption {
+      type = types.bool;
      default = true;
      description = "Service discovery";
    };

    legacyauth = mkOption {
+      type = types.bool;
      default = true;
      description = "Legacy authentication. Only used by some old clients and bots";
    };

    version = mkOption {
+      type = types.bool;
      default = true;
      description = "Replies to server version requests";
    };

    uptime = mkOption {
+      type = types.bool;
      default = true;
      description = "Report how long server has been running";
    };

    time = mkOption {
+      type = types.bool;
      default = true;
      description = "Let others know the time here on this server";
    };

    ping = mkOption {
+      type = types.bool;
      default = true;
      description = "Replies to XMPP pings with pongs";
    };

    console = mkOption {
+      type = types.bool;
      default = false;
      description = "telnet to port 5582";
    };

    bosh = mkOption {
+      type = types.bool;
      default = false;
      description = "Enable BOSH clients, aka 'Jabber over HTTP'";
    };

    httpserver = mkOption {
+      type = types.bool;
      default = false;
      description = "Serve static files from a directory over HTTP";
    };

    websocket = mkOption {
+      type = types.bool;
      default = false;
      description = "Enable WebSocket support";
    };

  };

-  createSSLOptsStr = o:
-    if o ? key && o ? cert then
-      ''ssl = { key = "${o.key}"; certificate = "${o.cert}"; };''
-    else "";
+  toLua = x:
+    if builtins.isString x then ''"${x}"''
+    else if builtins.isBool x then toString x
+    else if builtins.isInt x then toString x
+    else throw "Invalid Lua value";
+
+  createSSLOptsStr = o: ''
+    ssl = {
+      key = "${o.key}";
+      certificate = "${o.cert}";
+      ${concatStringsSep "\n" (mapAttrsToList (name: value: "${name} = ${toLua value};") o.extraOptions)}
+    };
+  '';

  vHostOpts = { ... }: {

@ -114,18 +142,20 @@ let
      };

      enabled = mkOption {
+        type = types.bool;
        default = false;
        description = "Whether to enable the virtual host";
      };

      ssl = mkOption {
-        description = "Paths to SSL files";
+        type = types.nullOr (types.submodule sslOpts);
        default = null;
-        options = [ sslOpts ];
+        description = "Paths to SSL files";
      };

      extraConfig = mkOption {
-        default = '''';
+        type = types.lines;
+        default = "";
        description = "Additional virtual host specific configuration";
      };

@ -144,11 +174,13 @@ in
    services.prosody = {

      enable = mkOption {
+        type = types.bool;
        default = false;
        description = "Whether to enable the prosody server";
      };

      allowRegistration = mkOption {
+        type = types.bool;
        default = false;
        description = "Allow account creation";
      };
@ -156,8 +188,9 @@ in
      modules = moduleOpts;

      extraModules = mkOption {
-        description = "Enable custom modules";
+        type = types.listOf types.str;
        default = [];
+        description = "Enable custom modules";
      };

      virtualHosts = mkOption {
@ -183,20 +216,21 @@ in
      };

      ssl = mkOption {
-        description = "Paths to SSL files";
+        type = types.nullOr (types.submodule sslOpts);
        default = null;
-        options = [ sslOpts ];
+        description = "Paths to SSL files";
      };

      admins = mkOption {
-        description = "List of administrators of the current host";
-        example = [ "admin1@example.com" "admin2@example.com" ];
+        type = types.listOf types.str;
        default = [];
+        example = [ "admin1@example.com" "admin2@example.com" ];
+        description = "List of administrators of the current host";
      };

      extraConfig = mkOption {
        type = types.lines;
-        default = '''';
+        default = "";
        description = "Additional prosody configuration";
      };

@ -263,17 +297,17 @@ in
    };

    systemd.services.prosody = {
-
      description = "Prosody XMPP server";
      after = [ "network-online.target" ];
      wants = [ "network-online.target" ];
      wantedBy = [ "multi-user.target" ];
+      restartTriggers = [ config.environment.etc."prosody/prosody.cfg.lua".source ];
      serviceConfig = {
        User = "prosody";
+        Type = "forking";
        PIDFile = "/var/lib/prosody/prosody.pid";
        ExecStart = "${pkgs.prosody}/bin/prosodyctl start";
      };
-
    };

  };
--- a/nixos/modules/services/security/tor.nix
+++ b/nixos/modules/services/security/tor.nix
@ -9,6 +9,26 @@ let
  opt    = name: value: optionalString (value != null) "${name} ${value}";
  optint = name: value: optionalString (value != null && value != 0)    "${name} ${toString value}";

+  isolationOptions = {
+    type = types.listOf (types.enum [
+      "IsolateClientAddr"
+      "IsolateSOCKSAuth"
+      "IsolateClientProtocol"
+      "IsolateDestPort"
+      "IsolateDestAddr"
+    ]);
+    default = [];
+    example = [
+      "IsolateClientAddr"
+      "IsolateSOCKSAuth"
+      "IsolateClientProtocol"
+      "IsolateDestPort"
+      "IsolateDestAddr"
+    ];
+    description = "Tor isolation options";
+  };
+
+
  torRc = ''
    User tor
    DataDirectory ${torDirectory}
@ -20,10 +40,20 @@ let
    ${optint "ControlPort" cfg.controlPort}
  ''
  # Client connection config
-  + optionalString cfg.client.enable  ''
-    SOCKSPort ${cfg.client.socksListenAddress} IsolateDestAddr
+  + optionalString cfg.client.enable ''
+    SOCKSPort ${cfg.client.socksListenAddress} ${toString cfg.client.socksIsolationOptions}
    SOCKSPort ${cfg.client.socksListenAddressFaster}
    ${opt "SocksPolicy" cfg.client.socksPolicy}
+
+    ${optionalString cfg.client.transparentProxy.enable ''
+    TransPort ${cfg.client.transparentProxy.listenAddress} ${toString cfg.client.transparentProxy.isolationOptions}
+    ''}
+
+    ${optionalString cfg.client.dns.enable ''
+    DNSPort ${cfg.client.dns.listenAddress} ${toString cfg.client.dns.isolationOptions}
+    AutomapHostsOnResolve 1
+    AutomapHostsSuffixes ${concatStringsSep "," cfg.client.dns.automapHostsSuffixes}
+    ''}
  ''
  # Relay config
  + optionalString cfg.relay.enable ''
@ -154,6 +184,55 @@ in
          '';
        };

+        socksIsolationOptions = mkOption (isolationOptions // {
+          default = ["IsolateDestAddr"];
+        });
+
+        transparentProxy = {
+          enable = mkOption {
+            type = types.bool;
+            default = false;
+            description = "Whether to enable tor transaprent proxy";
+          };
+
+          listenAddress = mkOption {
+            type = types.str;
+            default = "127.0.0.1:9040";
+            example = "192.168.0.1:9040";
+            description = ''
+              Bind transparent proxy to this address.
+            '';
+          };
+
+          isolationOptions = mkOption isolationOptions;
+        };
+
+        dns = {
+          enable = mkOption {
+            type = types.bool;
+            default = false;
+            description = "Whether to enable tor dns resolver";
+          };
+
+          listenAddress = mkOption {
+            type = types.str;
+            default = "127.0.0.1:9053";
+            example = "192.168.0.1:9053";
+            description = ''
+              Bind tor dns to this address.
+            '';
+          };
+
+          isolationOptions = mkOption isolationOptions;
+
+          automapHostsSuffixes = mkOption {
+            type = types.listOf types.str;
+            default = [".onion" ".exit"];
+            example = [".onion"];
+            description = "List of suffixes to use with automapHostsOnResolve";
+          };
+        };
+
        privoxy.enable = mkOption {
          type = types.bool;
          default = true;
--- a/nixos/modules/services/system/localtime.nix
+++ b/nixos/modules/services/system/localtime.nix
@ -0,0 +1,60 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.localtime;
+in {
+  options = {
+    services.localtime = {
+      enable = mkOption {
+        default = false;
+        description = ''
+          Enable <literal>localtime</literal>, simple daemon for keeping the system
+          timezone up-to-date based on the current location. It uses geoclue2 to
+          determine the current location and systemd-timedated to actually set
+          the timezone.
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.geoclue2.enable = true;
+
+    security.polkit.extraConfig = ''
+     polkit.addRule(function(action, subject) {
+       if (action.id == "org.freedesktop.timedate1.set-timezone"
+           && subject.user == "localtimed") {
+         return polkit.Result.YES;
+       }
+     });
+    '';
+
+    users.users = [{
+      name = "localtimed";
+      description = "Taskserver user";
+    }];
+
+    systemd.services.localtime = {
+      description = "localtime service";
+      wantedBy = [ "multi-user.target" ];
+      partOf = [ "geoclue.service "];
+
+      serviceConfig = {
+        Restart                 = "on-failure";
+        # TODO: make it work with dbus
+        #DynamicUser             = true;
+        Nice                    = 10;
+        User                    = "localtimed";
+        PrivateTmp              = "yes";
+        PrivateDevices          = true;
+        PrivateNetwork          = "yes";
+        NoNewPrivileges         = "yes";
+        ProtectSystem           = "strict";
+        ProtectHome             = true;
+        ExecStart               = "${pkgs.localtime}/bin/localtimed";
+      };
+    };
+  };
+}
--- a/nixos/modules/services/web-apps/nexus.nix
+++ b/nixos/modules/services/web-apps/nexus.nix
@ -11,7 +11,7 @@ in
 {
  options = {
    services.nexus = {
-      enable = mkEnableOption "SonarType Nexus3 OSS service";
+      enable = mkEnableOption "Sonatype Nexus3 OSS service";

      user = mkOption {
        type = types.str;
@ -54,7 +54,7 @@ in
    users.extraGroups."${cfg.group}" = {};

    systemd.services.nexus = {
-      description = "SonarType Nexus3";
+      description = "Sonatype Nexus3";

      wantedBy = [ "multi-user.target" ];

--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@ -578,6 +578,22 @@ in
            target = "X11/xkb";
          }
        ])
+      # localectl looks into 00-keyboard.conf
+      ++ [
+        {
+          text = ''
+            Section "InputClass"
+              Identifier "Keyboard catchall"
+              MatchIsKeyboard "on"
+              Option "XkbModel" "${cfg.xkbModel}"
+              Option "XkbLayout" "${cfg.layout}"
+              Option "XkbOptions" "${cfg.xkbOptions}"
+              Option "XkbVariant" "${cfg.xkbVariant}"
+            EndSection
+          '';
+          target = "X11/xorg.conf.d/00-keyboard.conf";
+        }
+      ]
      # Needed since 1.18; see https://bugs.freedesktop.org/show_bug.cgi?id=89023#c5
      ++ (let cfgPath = "/X11/xorg.conf.d/10-evdev.conf"; in
        [{
@ -697,15 +713,6 @@ in
          ${cfg.monitorSection}
        EndSection

-        Section "InputClass"
-          Identifier "Keyboard catchall"
-          MatchIsKeyboard "on"
-          Option "XkbModel" "${cfg.xkbModel}"
-          Option "XkbLayout" "${cfg.layout}"
-          Option "XkbOptions" "${cfg.xkbOptions}"
-          Option "XkbVariant" "${cfg.xkbVariant}"
-        EndSection
-
        # Additional "InputClass" sections
        ${flip concatMapStrings cfg.inputClassSections (inputClassSection: ''
        Section "InputClass"
--- a/nixos/modules/testing/test-instrumentation.nix
+++ b/nixos/modules/testing/test-instrumentation.nix
@ -128,7 +128,7 @@ in
    # Make it easy to log in as root when running the test interactively.
    users.extraUsers.root.initialHashedPassword = mkOverride 150 "";

-    services.xserver.displayManager.logToJournal = true;
+    services.xserver.displayManager.job.logToJournal = true;
  };

 }
--- a/nixos/modules/virtualisation/amazon-image.nix
+++ b/nixos/modules/virtualisation/amazon-image.nix
@ -152,5 +152,8 @@ let cfg = config.ec2; in
    environment.systemPackages = [ pkgs.cryptsetup ];

    boot.initrd.supportedFilesystems = [ "unionfs-fuse" ];
+    
+    # EC2 has its own NTP server provided by the hypervisor
+    networking.timeServers = [ "169.254.169.123" ];
  };
 }
--- a/nixos/modules/virtualisation/containers.nix
+++ b/nixos/modules/virtualisation/containers.nix
@ -726,6 +726,11 @@ in

    networking.dhcpcd.denyInterfaces = [ "ve-*" "vb-*" ];

+    services.udev.extraRules = optionalString config.networking.networkmanager.enable ''
+      # Don't manage interfaces created by nixos-container.
+      ENV{INTERFACE}=="v[eb]-*", ENV{NM_UNMANAGED}="1"
+    '';
+
    environment.systemPackages = [ pkgs.nixos-container ];
  });
 }
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@ -18,7 +18,7 @@ let
    "i686-linux" = "${qemu}/bin/qemu-kvm";
    "x86_64-linux" = "${qemu}/bin/qemu-kvm -cpu kvm64";
    "armv7l-linux" = "${qemu}/bin/qemu-system-arm -enable-kvm -machine virt -cpu host";
-    "aarch64-linux" = "${qemu}/bin/qemu-system-aarch64 -enable-kvm -machine virt -cpu host";
+    "aarch64-linux" = "${qemu}/bin/qemu-system-aarch64 -enable-kvm -machine virt,gic-version=host -cpu host";
  }.${pkgs.stdenv.system};

  # FIXME: figure out a common place for this instead of copy pasting
--- a/nixos/release.nix
+++ b/nixos/release.nix
@ -1,6 +1,6 @@
 { nixpkgs ? { outPath = ./..; revCount = 56789; shortRev = "gfedcba"; }
 , stableBranch ? false
-, supportedSystems ? [ "x86_64-linux" ]
+, supportedSystems ? [ "x86_64-linux" "aarch64-linux" ]
 }:

 with import ../lib;
@ -89,6 +89,27 @@ let
      });
  }).config));

+  makeNetboot = config:
+    let
+      config_evaled = import lib/eval-config.nix config;
+      build = config_evaled.config.system.build;
+      kernelTarget = config_evaled.pkgs.stdenv.platform.kernelTarget;
+    in
+      pkgs.symlinkJoin {
+        name="netboot";
+        paths=[
+          build.netbootRamdisk
+          build.kernel
+          build.netbootIpxeScript
+        ];
+        postBuild = ''
+          mkdir -p $out/nix-support
+          echo "file ${kernelTarget} $out/${kernelTarget}" >> $out/nix-support/hydra-build-products
+          echo "file initrd $out/initrd" >> $out/nix-support/hydra-build-products
+          echo "file ipxe $out/netboot.ipxe" >> $out/nix-support/hydra-build-products
+        '';
+      };
+

 in rec {

@ -103,28 +124,22 @@ in rec {
  # Build the initial ramdisk so Hydra can keep track of its size over time.
  initialRamdisk = buildFromConfig ({ pkgs, ... }: { }) (config: config.system.build.initialRamdisk);

-  netboot.x86_64-linux = let build = (import lib/eval-config.nix {
+  netboot = {
+    x86_64-linux = makeNetboot {
      system = "x86_64-linux";
      modules = [
        ./modules/installer/netboot/netboot-minimal.nix
        versionModule
      ];
-    }).config.system.build;
-  in
-    pkgs.symlinkJoin {
-      name="netboot";
-      paths=[
-        build.netbootRamdisk
-        build.kernel
-        build.netbootIpxeScript
-      ];
-      postBuild = ''
-        mkdir -p $out/nix-support
-        echo "file bzImage $out/bzImage" >> $out/nix-support/hydra-build-products
-        echo "file initrd $out/initrd" >> $out/nix-support/hydra-build-products
-        echo "file ipxe $out/netboot.ipxe" >> $out/nix-support/hydra-build-products
-      '';
    };
+  } // (optionalAttrs (elem "aarch64-linux" supportedSystems) {
+    aarch64-linux = makeNetboot {
+      system = "aarch64-linux";
+      modules = [
+        ./modules/installer/netboot/netboot-minimal.nix
+        versionModule
+      ];
+    };});

  iso_minimal = forAllSystems (system: makeIso {
    module = ./modules/installer/cd-dvd/installation-cd-minimal.nix;
@ -332,10 +347,12 @@ in rec {
  tests.slim = callTest tests/slim.nix {};
  tests.smokeping = callTest tests/smokeping.nix {};
  tests.snapper = callTest tests/snapper.nix {};
+  tests.statsd = callTest tests/statsd.nix {};
  tests.switchTest = callTest tests/switch-test.nix {};
  tests.taskserver = callTest tests/taskserver.nix {};
  tests.tomcat = callTest tests/tomcat.nix {};
  tests.udisks2 = callTest tests/udisks2.nix {};
+  tests.vault = callTest tests/vault.nix {};
  tests.virtualbox = callSubTests tests/virtualbox.nix { system = "x86_64-linux"; };
  tests.wordpress = callTest tests/wordpress.nix {};
  tests.xfce = callTest tests/xfce.nix {};
--- a/nixos/tests/printing.nix
+++ b/nixos/tests/printing.nix
@ -39,7 +39,7 @@ import ./make-test.nix ({pkgs, ... }: {
      $client->waitForUnit("cups.service");
      $client->sleep(10); # wait until cups is fully initialized
      $client->succeed("lpstat -r") =~ /scheduler is running/ or die;
-      $client->succeed("lpstat -H") =~ "/var/run/cups/cups.sock" or die;
+      $client->succeed("lpstat -H") =~ "localhost:631" or die;
      $client->succeed("curl --fail http://localhost:631/");
      $client->succeed("curl --fail http://server:631/");
      $server->fail("curl --fail --connect-timeout 2  http://client:631/");
--- a/nixos/tests/radicale.nix
+++ b/nixos/tests/radicale.nix
@ -20,7 +20,7 @@ let
      '';
    };
    # WARNING: DON'T DO THIS IN PRODUCTION!
-    # This puts secrets (albeit hashed) directly into the Nix store for ease of testing.
+    # This puts unhashed secrets directly into the Nix store for ease of testing.
    environment.etc."radicale/htpasswd".source = pkgs.runCommand "htpasswd" {} ''
      ${pkgs.apacheHttpd}/bin/htpasswd -bcB "$out" ${user} ${password}
    '';
--- a/nixos/tests/statsd.nix
+++ b/nixos/tests/statsd.nix
@ -0,0 +1,40 @@
+import ./make-test.nix ({ pkgs, lib }:
+
+with lib;
+
+{
+  name = "statsd";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ ma27 ];
+  };
+
+  nodes.statsd1 = {
+    services.statsd.enable = true;
+    services.statsd.backends = [ "statsd-influxdb-backend" "console" ];
+    services.statsd.extraConfig = ''
+      influxdb: {
+        username: "root",
+        password: "root",
+        database: "statsd"
+      }
+    '';
+
+    services.influxdb.enable = true;
+
+    systemd.services.influx-init = {
+      description = "Setup Influx Test Base";
+      after = [ "influxdb.service" ];
+      before = [ "statsd.service" ];
+
+      script = ''
+        echo "CREATE DATABASE statsd" | ${pkgs.influxdb}/bin/influx
+      '';
+    };
+  };
+
+  testScript = ''
+    $statsd1->start();
+    $statsd1->waitForUnit("statsd.service");
+    $statsd1->succeed("nc -z 127.0.0.1 8126");
+  '';
+})
--- a/nixos/tests/vault.nix
+++ b/nixos/tests/vault.nix
@ -0,0 +1,23 @@
+import ./make-test.nix ({ pkgs, ... }:
+{
+  name = "vault";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ lnl7 ];
+  };
+  machine = { config, pkgs, ... }: {
+    environment.systemPackages = [ pkgs.vault ];
+    environment.variables.VAULT_ADDR = "http://127.0.0.1:8200";
+    services.vault.enable = true;
+  };
+
+  testScript =
+    ''
+      startAll;
+
+      $machine->waitForUnit('multi-user.target');
+      $machine->waitForUnit('vault.service');
+      $machine->waitForOpenPort(8200);
+      $machine->succeed('vault init');
+      $machine->succeed('vault status | grep "Sealed: true"');
+    '';
+})
--- a/pkgs/applications/altcoins/cryptop/default.nix
+++ b/pkgs/applications/altcoins/cryptop/default.nix
@ -1,16 +1,15 @@
-{ lib, python2}:
+{ lib, buildPythonApplication, fetchPypi, requests, requests-cache }:

-python2.pkgs.buildPythonApplication rec {
+buildPythonApplication rec {
  pname = "cryptop";
-  version = "0.1.0";
-  name = "${pname}-${version}";
+  version = "0.2.0";

-  src = python2.pkgs.fetchPypi {
+  src = fetchPypi {
    inherit pname version;
-    sha256 = "00glnlyig1aajh30knc5rnfbamwfxpg29js2db6mymjmfka8lbhh";
+    sha256 = "0akrrz735vjfrm78plwyg84vabj0x3qficq9xxmy9kr40fhdkzpb";
  };

-  propagatedBuildInputs = [ python2.pkgs.requests ];
+  propagatedBuildInputs = [ requests requests-cache ];

  # No tests in archive
  doCheck = false;
--- a/pkgs/applications/altcoins/default.nix
+++ b/pkgs/applications/altcoins/default.nix
@ -1,4 +1,4 @@
-{ callPackage, boost155, boost162, openssl_1_1_0, haskellPackages, darwin, libsForQt5, miniupnpc_2 }:
+{ callPackage, boost155, boost162, openssl_1_1_0, haskellPackages, darwin, libsForQt5, miniupnpc_2, python3 }:

 rec {

@ -20,6 +20,8 @@ rec {
  btc1 = callPackage ./btc1.nix { withGui = true; };
  btc1d = callPackage ./btc1.nix { withGui = false; };

+  cryptop = python3.pkgs.callPackage ./cryptop { };
+
  dashpay = callPackage ./dashpay.nix { };

  dogecoin  = callPackage ./dogecoin.nix { withGui = true; };
--- a/pkgs/applications/altcoins/memorycoin.nix
+++ b/pkgs/applications/altcoins/memorycoin.nix
@ -31,6 +31,10 @@ stdenv.mkDerivation rec{
    then "install -D bitcoin-qt $out/bin/memorycoin-qt"
    else "install -D bitcoind $out/bin/memorycoind";

+  # `make build/version.o`:
+  # make: *** No rule to make target 'build/build.h', needed by 'build/version.o'.  Stop.
+  enableParallelBuilding = false;
+
  meta = {
    description = "Peer-to-peer, CPU-based electronic cash system";
    longDescription= ''
--- a/pkgs/applications/altcoins/primecoin.nix
+++ b/pkgs/applications/altcoins/primecoin.nix
@ -31,6 +31,10 @@ stdenv.mkDerivation rec{
    then "install -D bitcoin-qt $out/bin/primecoin-qt"
    else "install -D bitcoind $out/bin/primecoind";

+  # `make build/version.o`:
+  # make: *** No rule to make target 'build/build.h', needed by 'build/version.o'.  Stop.
+  enableParallelBuilding = false;
+
  meta = {
    description = "A new type cryptocurrency which is proof-of-work based on searching for prime numbers";
    longDescription= ''
--- a/pkgs/applications/audio/MMA/default.nix
+++ b/pkgs/applications/audio/MMA/default.nix
@ -1,12 +1,12 @@
 { stdenv, fetchurl, makeWrapper, python, alsaUtils, timidity }:

  stdenv.mkDerivation rec {
-  version = "15.12";
+  version = "16.06";
  name = "mma-${version}";

  src = fetchurl {
    url = "http://www.mellowood.ca/mma/mma-bin-${version}.tar.gz";
-    sha256 = "0k37kcrfaxmwjb8xb1cbqinrkx3g50dbvwqbvwl3l762j4vr8jgx";
+    sha256 = "1g4gvc0nr0qjc0fyqrnx037zpaasgymgmrm5s7cdxqnld9wqw8ww";
  };

  buildInputs = [ makeWrapper python alsaUtils timidity ];
--- a/pkgs/applications/audio/airwave/default.nix
+++ b/pkgs/applications/audio/airwave/default.nix
@ -16,11 +16,11 @@ let
  stdenv_multi = overrideCC stdenv gcc_multi;

  vst-sdk = stdenv.mkDerivation rec {
-    name = "vstsdk366_27_06_2016_build_61";
+    name = "vstsdk368_08_11_2017_build_121";
    src = requireFile {
      name = "${name}.zip";
      url = "http://www.steinberg.net/en/company/developers.html";
-      sha256 = "05gsr13bpi2hhp34rvhllsvmn44rqvmjdpg9fsgfzgylfkz0kiki";
+      sha256 = "e0f235d8826d70f1ae0ae5929cd198acae1ecff74612fde5c60cbfb45c2f4a70";
    };
    nativeBuildInputs = [ unzip ];
    installPhase = "cp -r . $out";
@ -64,7 +64,7 @@ stdenv_multi.mkDerivation {
  # Cf. https://github.com/phantom-code/airwave/issues/57
  hardeningDisable = [ "format" ];

-  cmakeFlags = "-DVSTSDK_PATH=${vst-sdk}";
+  cmakeFlags = "-DVSTSDK_PATH=${vst-sdk}/VST2_SDK";

  postInstall = ''
    mv $out/bin $out/libexec
--- a/pkgs/applications/audio/aj-snapshot/default.nix
+++ b/pkgs/applications/audio/aj-snapshot/default.nix
@ -26,7 +26,7 @@ stdenv.mkDerivation rec {

    homepage = http://aj-snapshot.sourceforge.net/;
    license = licenses.gpl2;
-    maintainers = [ maintainers.palo ];
+    maintainers = [ maintainers.mrVanDalo ];
    platforms = platforms.all;
  };
 }
--- a/pkgs/applications/audio/calf/default.nix
+++ b/pkgs/applications/audio/calf/default.nix
@ -3,11 +3,11 @@

 stdenv.mkDerivation rec {
  name = "calf-${version}";
-  version = "0.0.60";
+  version = "0.90.0";

  src = fetchurl {
    url = "http://calf-studio-gear.org/files/${name}.tar.gz";
-    sha256 = "019fwg00jv217a5r767z7szh7vdrarybac0pr2sk26xp81kibrx9";
+    sha256 = "0dijv2j7vlp76l10s4v8gbav26ibaqk8s24ci74vrc398xy00cib";
  };

  buildInputs = [
--- a/pkgs/applications/audio/dfasma/default.nix
+++ b/pkgs/applications/audio/dfasma/default.nix
@ -6,7 +6,7 @@ let
    src = fetchFromGitHub {
      sha256 = "07m2wf2gqyya95b65gawrnr4pvc9jyzmg6h8sinzgxlpskz93wwc";
      rev = "39053e8896eedd7b3e8a9e9a9ffd80f1fc6ceb16";
-      repo = "reaper";
+      repo = "REAPER";
      owner = "gillesdegottex";
    };
    meta = with stdenv.lib; {
@ -16,8 +16,8 @@ let

  libqaudioextra = {
    src = fetchFromGitHub {
-      sha256 = "17pvlij8cc4lwzf6f1cnygj3m3ci6xfa3lv5bgcr5i1gzyjxqpq1";
-      rev = "b7d187cd9a1fd76ea94151e2e02453508d0151d3";
+      sha256 = "0m6x1qm7lbjplqasr2jhnd2ndi0y6z9ybbiiixnlwfm23sp15wci";
+      rev = "9ae051989a8fed0b2f8194b1501151909a821a89";
      repo = "libqaudioextra";
      owner = "gillesdegottex";
    };
@ -28,10 +28,10 @@ let

 in stdenv.mkDerivation rec {
  name = "dfasma-${version}";
-  version = "1.2.5";
+  version = "1.4.5";

  src = fetchFromGitHub {
-    sha256 = "0mgy2bkmyp7lvaqsr7hkndwdgjf26mlpsj6smrmn1vp0cqyrw72d";
+    sha256 = "09fcyjm0hg3y51fnjax88m93im39nbynxj79ffdknsazmqw9ac0h";
    rev = "v${version}";
    repo = "dfasma";
    owner = "gillesdegottex";
@ -42,13 +42,9 @@ in stdenv.mkDerivation rec {
  nativeBuildInputs = [ qmake ];

  postPatch = ''
-    substituteInPlace dfasma.pro --replace '$$DFASMAVERSIONGITPRO' '${version}'
    cp -Rv "${reaperFork.src}"/* external/REAPER
    cp -Rv "${libqaudioextra.src}"/* external/libqaudioextra
-  '';
-
-  preConfigure = ''
-    qmakeFlags="$qmakeFlags PREFIXSHORTCUT=$out"
+    substituteInPlace dfasma.pro --replace "CONFIG += file_sdif" "";
  '';

  enableParallelBuilding = true;
--- a/pkgs/applications/audio/distrho/default.nix
+++ b/pkgs/applications/audio/distrho/default.nix
@ -2,12 +2,12 @@
 , libxslt, lv2, pkgconfig, premake3, xorg, ladspa-sdk }:

 stdenv.mkDerivation rec {
-  name = "distrho-ports-unstable-2017-08-04";
+  name = "distrho-ports-unstable-2017-10-10";

  src = fetchgit {
    url = "https://github.com/DISTRHO/DISTRHO-Ports.git";
-    rev = "f591a1066cd3929536699bb516caa4b5efd9d025";
-    sha256 = "1qjnmpmwbq2zpwn8v1dmqn3bjp2ykj5p89fkjax7idgpx1cg7pp9";
+    rev = "e11e2b204c14b8e370a0bf5beafa5f162fedb8e9";
+    sha256 = "1nd542iian9kr2ldaf7fkkgf900ryzqigks999d1jhms6p0amvfv";
  };

  patchPhase = ''
@ -37,12 +37,12 @@ stdenv.mkDerivation rec {
    description = "A collection of cross-platform audio effects and plugins";
    longDescription = ''
      Includes:
-      Dexed  drowaudio-distortion drowaudio-distortionshaper drowaudio-flanger
-      drowaudio-reverb drowaudio-tremolo drumsynt EasySSP  eqinox
-      JuceDemoPlugin klangfalter LUFSMeter luftikus obxd pitchedDelay
-      stereosourceseparation TAL-Dub-3 TAL-Filter TAL-Filter-2 TAL-NoiseMaker
-      TAL-Reverb TAL-Reverb-2 TAL-Reverb-3 TAL-Vocoder-2 TheFunction
-      ThePilgrim Vex Wolpertinger
+      Dexed drowaudio-distortion drowaudio-distortionshaper drowaudio-flanger
+      drowaudio-reverb drowaudio-tremolo drumsynth EasySSP eqinox HiReSam
+      JuceDemoPlugin KlangFalter LUFSMeter LUFSMeterMulti Luftikus Obxd
+      PitchedDelay ReFine StereoSourceSeparation TAL-Dub-3 TAL-Filter
+      TAL-Filter-2 TAL-NoiseMaker TAL-Reverb TAL-Reverb-2 TAL-Reverb-3
+      TAL-Vocoder-2 TheFunction ThePilgrim Vex Wolpertinger
    '';
    maintainers = [ maintainers.goibhniu ];
    platforms = platforms.linux;
--- a/pkgs/applications/audio/drumkv1/default.nix
+++ b/pkgs/applications/audio/drumkv1/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "drumkv1-${version}";
-  version = "0.8.4";
+  version = "0.8.5";

  src = fetchurl {
    url = "mirror://sourceforge/drumkv1/${name}.tar.gz";
-    sha256 = "0qqpklzy4wgw9jy0v2810j06712q90bwc69fp7da82536ba058a9";
+    sha256 = "06xqqm1ylmpp2s7xk7xav325gc50kxlvh9vf1343b0n3i8xkgjfg";
  };

  buildInputs = [ libjack2 alsaLib libsndfile liblo lv2 qt5.qtbase qt5.qttools ];
--- a/pkgs/applications/audio/fluidsynth/default.nix
+++ b/pkgs/applications/audio/fluidsynth/default.nix
@ -1,34 +1,31 @@
-{ stdenv, fetchurl, alsaLib, glib, libjack2, libsndfile, pkgconfig
-, libpulseaudio, CoreServices, CoreAudio, AudioUnit }:
+{ stdenv, lib, fetchFromGitHub, pkgconfig, cmake
+, alsaLib, glib, libjack2, libsndfile, libpulseaudio
+, AudioUnit, CoreAudio, CoreMIDI, CoreServices
+}:

 stdenv.mkDerivation  rec {
  name = "fluidsynth-${version}";
-  version = "1.1.6";
+  version = "1.1.8";

-  src = fetchurl {
-    url = "mirror://sourceforge/fluidsynth/${name}.tar.bz2";
-    sha256 = "00gn93bx4cz9bfwf3a8xyj2by7w23nca4zxf09ll53kzpzglg2yj";
+  src = fetchFromGitHub {
+    owner = "FluidSynth";
+    repo = "fluidsynth";
+    rev = "v${version}";
+    sha256 = "12q7hv0zvgylsdj1ipssv5zr7ap2y410dxsd63dz22y05fa2hwwd";
  };

-  preBuild = stdenv.lib.optionalString stdenv.isDarwin ''
-    sed -i '40 i\
-    #include <CoreAudio/AudioHardware.h>\
-    #include <CoreAudio/AudioHardwareDeprecated.h>' \
-    src/drivers/fluid_coreaudio.c
-  '';
+  nativeBuildInputs = [ pkgconfig cmake ];

-  NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isDarwin
-    "-framework CoreAudio -framework CoreServices";
-
-  nativeBuildInputs = [ pkgconfig ];
  buildInputs = [ glib libsndfile ]
-    ++ stdenv.lib.optionals (!stdenv.isDarwin) [ alsaLib libpulseaudio libjack2 ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [ CoreServices CoreAudio AudioUnit ];
+    ++ lib.optionals (!stdenv.isDarwin) [ alsaLib libpulseaudio libjack2 ]
+    ++ lib.optionals stdenv.isDarwin [ AudioUnit CoreAudio CoreMIDI CoreServices ];

-  meta = with stdenv.lib; {
+  cmakeFlags = lib.optional stdenv.isDarwin "-Denable-framework=off";
+
+  meta = with lib; {
    description = "Real-time software synthesizer based on the SoundFont 2 specifications";
    homepage    = http://www.fluidsynth.org;
-    license     = licenses.lgpl2;
+    license     = licenses.lgpl21Plus;
    maintainers = with maintainers; [ goibhniu lovek323 ];
    platforms   = platforms.unix;
  };
--- a/pkgs/applications/audio/fmit/default.nix
+++ b/pkgs/applications/audio/fmit/default.nix
@ -11,10 +11,10 @@ with stdenv.lib;

 stdenv.mkDerivation rec {
  name = "fmit-${version}";
-  version = "1.1.11";
+  version = "1.1.13";

  src = fetchFromGitHub {
-    sha256 = "1w492lf8n2sjkr53z8cvkgywzn0w53cf78hz93zaw6dwwv36lwdp";
+    sha256 = "1p374gf7iksrlyvddm3w4qk3l0rxsiyymz5s8dmc447yvin8ykfq";
    rev = "v${version}";
    repo = "fmit";
    owner = "gillesdegottex";
--- a/pkgs/applications/audio/gigedit/default.nix
+++ b/pkgs/applications/audio/gigedit/default.nix
@ -1,25 +1,25 @@
-{ stdenv, fetchsvn, autoconf, automake, docbook_xml_dtd_45
-, docbook_xsl, gtkmm2, intltool, libgig, libsndfile, libtool, libxslt
-, pkgconfig }:
+{ stdenv, fetchurl, autoconf, automake, intltool, libtool, pkgconfig, which
+, docbook_xml_dtd_45, docbook_xsl, gtkmm2, libgig, libsndfile, libxslt
+}:

 stdenv.mkDerivation rec {
-  name = "gigedit-svn-${version}";
-  version = "2342";
+  name = "gigedit-${version}";
+  version = "1.1.0";

-  src = fetchsvn {
-    url = "https://svn.linuxsampler.org/svn/gigedit/trunk";
-    rev = "${version}";
-    sha256 = "0wi94gymj0ns5ck9lq1d970gb4gnzrq4b57j5j7k3d6185yg2gjs";
+  src = fetchurl {
+    url = "http://download.linuxsampler.org/packages/${name}.tar.bz2";
+    sha256 = "087pc919q28r1vw31c7w4m14bqnp4md1i2wbmk8w0vmwv2cbx2ni";
  };

-  patchPhase = "sed -e 's/which/type -P/g' -i Makefile.cvs";
+  patches = [ ./gigedit-1.1.0-pangomm-2.40.1.patch ];

-  preConfigure = "make -f Makefile.cvs";
+  preConfigure = "make -f Makefile.svn";

-  buildInputs = [ 
-    autoconf automake docbook_xml_dtd_45 docbook_xsl gtkmm2 intltool
-    libgig libsndfile libtool libxslt pkgconfig 
-  ];
+  nativeBuildInputs = [ autoconf automake intltool libtool pkgconfig which ];
+
+  buildInputs = [ docbook_xml_dtd_45 docbook_xsl gtkmm2 libgig libsndfile libxslt ];
+
+  enableParallelBuilding = true;

  meta = with stdenv.lib; {
    homepage = http://www.linuxsampler.org;
--- a/pkgs/applications/audio/gigedit/gigedit-1.1.0-pangomm-2.40.1.patch
+++ b/pkgs/applications/audio/gigedit/gigedit-1.1.0-pangomm-2.40.1.patch
@ -0,0 +1,15 @@
+--- a/src/gigedit/wrapLabel.cc
+++ b/src/gigedit/wrapLabel.cc
+@@ -64,12 +64,7 @@ WrapLabel::WrapLabel(const Glib::ustring &text) // IN: The label text
+    : mWrapWidth(0),
+      mWrapHeight(0)
+ {
+-   // pangomm >= 2.35.1
+-#if PANGOMM_MAJOR_VERSION > 2 || (PANGOMM_MAJOR_VERSION == 2 && (PANGOMM_MINOR_VERSION > 35 || (PANGOMM_MINOR_VERSION == 35 && PANGOMM_MICRO_VERSION >= 1)))
+-   get_layout()->set_wrap(Pango::WrapMode::WORD_CHAR);
+-#else
+    get_layout()->set_wrap(Pango::WRAP_WORD_CHAR);
+-#endif
+    set_alignment(0.0, 0.0);
+    set_text(text);
+ }
--- a/pkgs/applications/audio/google-play-music-desktop-player/default.nix
+++ b/pkgs/applications/audio/google-play-music-desktop-player/default.nix
@ -74,6 +74,6 @@ stdenv.mkDerivation {
    description = "A beautiful cross platform Desktop Player for Google Play Music";
    license = stdenv.lib.licenses.mit;
    platforms = [ "x86_64-linux" ];
-    maintainers = stdenv.lib.maintainers.SuprDewd;
+    maintainers = [ stdenv.lib.maintainers.SuprDewd ];
  };
 }
--- a/pkgs/applications/audio/guitarix/default.nix
+++ b/pkgs/applications/audio/guitarix/default.nix
@ -12,11 +12,11 @@ in

 stdenv.mkDerivation rec {
  name = "guitarix-${version}";
-  version = "0.35.6";
+  version = "0.36.1";

  src = fetchurl {
    url = "mirror://sourceforge/guitarix/guitarix2-${version}.tar.xz";
-    sha256 = "0ffvfnvhj6vz73zsrpi88hs69ys4zskm847zf825dl2r39n9nn41";
+    sha256 = "1g5949jwh2n755xjs3kcbdb8a1wxr5mn0m115wdnk27dxcdn93b0";
  };

  nativeBuildInputs = [ gettext intltool wrapGAppsHook pkgconfig python2 ];
--- a/pkgs/applications/audio/keyfinder/default.nix
+++ b/pkgs/applications/audio/keyfinder/default.nix
@ -2,10 +2,10 @@

 stdenv.mkDerivation rec {
  name = "keyfinder-${version}";
-  version = "2.1";
+  version = "2.2";

  src = fetchFromGitHub {
-    sha256 = "0j9k90ll4cr8j8dywb6zf1bs9vijlx7m4zsh6w9hxwrr7ymz89hn";
+    sha256 = "0vjszk1h8vj2qycgbffzy6k7amg75jlvlnzwaqhz9nll2pcvw0zl";
    rev = version;
    repo = "is_KeyFinder";
    owner = "ibsh";
@ -17,7 +17,8 @@ stdenv.mkDerivation rec {
  postPatch = ''
    substituteInPlace is_KeyFinder.pro \
       --replace "keyfinder.0" "keyfinder" \
-       --replace "-stdlib=libc++" ""
+       --replace "-stdlib=libc++" "" \
+       --replace "\$\$[QT_INSTALL_PREFIX]" "$out"
  '';

  enableParallelBuilding = true;
--- a/pkgs/applications/audio/ladspa-sdk/default.nix
+++ b/pkgs/applications/audio/ladspa-sdk/default.nix
@ -3,7 +3,7 @@ stdenv.mkDerivation rec {
  name = "ladspa-sdk-${version}";
  version = "1.13";
  src = fetchurl {
-    url = "http://http.debian.net/debian/pool/main/l/ladspa-sdk/ladspa-sdk_${version}.orig.tar.gz";
+    url = "http://www.ladspa.org/download/ladspa_sdk_${version}.tgz";
    sha256 = "0srh5n2l63354bc0srcrv58rzjkn4gv8qjqzg8dnq3rs4m7kzvdm";
  };

--- a/pkgs/applications/audio/ladspa-sdk/ladspah.nix
+++ b/pkgs/applications/audio/ladspa-sdk/ladspah.nix
@ -3,7 +3,7 @@ stdenv.mkDerivation rec {
  name = "ladspa.h-${version}";
  version = "1.13";
  src = fetchurl {
-    url = "http://http.debian.net/debian/pool/main/l/ladspa-sdk/ladspa-sdk_${version}.orig.tar.gz";
+    url = "http://www.ladspa.org/download/ladspa_sdk_${version}.tgz";
    sha256 = "0srh5n2l63354bc0srcrv58rzjkn4gv8qjqzg8dnq3rs4m7kzvdm";
  };

--- a/pkgs/applications/audio/linuxsampler/default.nix
+++ b/pkgs/applications/audio/linuxsampler/default.nix
@ -1,31 +1,24 @@
-{ stdenv, fetchsvn, alsaLib, asio, autoconf, automake, bison
-, libjack2, libgig, libsndfile, libtool, lv2, pkgconfig }:
+{ stdenv, fetchurl, autoconf, automake, bison, libtool, pkgconfig, which
+, alsaLib, asio, libjack2, libgig, libsndfile, lv2 }:

 stdenv.mkDerivation rec {
-  name = "linuxsampler-svn-${version}";
-  version = "2340";
+  name = "linuxsampler-${version}";
+  version = "2.1.0";

-  src = fetchsvn {
-    url = "https://svn.linuxsampler.org/svn/linuxsampler/trunk";
-    rev = "${version}";
-    sha256 = "0zsrvs9dwwhjx733m45vfi11yjkqv33z8qxn2i9qriq5zs1f0kd7";
+  src = fetchurl {
+    url = "http://download.linuxsampler.org/packages/${name}.tar.bz2";
+    sha256 = "0fdxpw7jjfi058l95131d6d8538h05z7n94l60i6mhp9xbplj2jf";
  };

-  patches = ./linuxsampler_lv2_sfz_fix.diff;
-
-  # It fails to compile without this option. I'm not sure what the bug
-  # is, but everything works OK for me (goibhniu).
-  configureFlags = [ "--disable-nptl-bug-check" ];
-
  preConfigure = ''
-    sed -e 's/which/type -P/g' -i scripts/generate_parser.sh
-    make -f Makefile.cvs
+    make -f Makefile.svn
  '';

-  buildInputs = [ 
-   alsaLib asio autoconf automake bison libjack2 libgig libsndfile
-   libtool lv2 pkgconfig
-  ];
+  nativeBuildInputs = [ autoconf automake bison libtool pkgconfig which ];
+
+  buildInputs = [ alsaLib asio libjack2 libgig libsndfile lv2 ];
+
+  enableParallelBuilding = true;

  meta = with stdenv.lib; {
    homepage = http://www.linuxsampler.org;
--- a/pkgs/applications/audio/linuxsampler/linuxsampler_lv2_sfz_fix.diff
+++ b/pkgs/applications/audio/linuxsampler/linuxsampler_lv2_sfz_fix.diff
@ -1,50 +0,0 @@
-Index: linuxsampler-r2359/src/hostplugins/lv2/PluginLv2.cpp
-===================================================================
--- linuxsampler-r2359/src/hostplugins/lv2/PluginLv2.cpp	(revision 2359)
-+++ linuxsampler-r2359/src/hostplugins/lv2/PluginLv2.cpp	(working copy)
-@@ -18,6 +18,8 @@
-  *   MA  02110-1301  USA                                                   *
-  ***************************************************************************/
- 
-+#define _BSD_SOURCE 1  /* for realpath() */
-+
- #include <algorithm>
- #include <cassert>
- #include <cstdio>
-@@ -118,6 +120,23 @@
-         dmsg(2, ("linuxsampler: Deactivate\n"));
-     }
- 
-+    static String RealPath(const String& path)
-+    {
-+        String out   = path;
-+        char*  cpath = NULL;
-+#ifdef _WIN32
-+        cpath = (char*)malloc(MAX_PATH);
-+        GetFullPathName(path.c_str(), MAX_PATH, cpath, NULL);
-+#else
-+        cpath = realpath(path.c_str(), NULL);
-+#endif
-+        if (cpath) {
-+            out = cpath;
-+            free(cpath);
-+        }
-+        return out;
-+    }
-+
-     String PluginLv2::PathToState(const String& path) {
-         if (MapPath) {
-             char* cstr = MapPath->abstract_path(MapPath->handle, path.c_str());
-@@ -131,9 +150,10 @@
-     String PluginLv2::PathFromState(const String& path) {
-         if (MapPath) {
-             char* cstr = MapPath->absolute_path(MapPath->handle, path.c_str());
-            const String abstract_path(cstr);
-+            // Resolve symbolic links so SFZ sample paths load correctly
-+            const String absolute_path(RealPath(cstr));
-             free(cstr);
-            return abstract_path;
-+            return absolute_path;
-         }
-         return path;
-     }
--- a/pkgs/applications/audio/mhwaveedit/default.nix
+++ b/pkgs/applications/audio/mhwaveedit/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, makeWrapper, SDL , alsaLib, gtk2, libjack2, ladspaH
+{ stdenv, fetchurl, makeWrapper, SDL, alsaLib, autoreconfHook, gtk2, libjack2, ladspaH
 , ladspaPlugins, libsamplerate, libsndfile, pkgconfig, libpulseaudio, lame
 , vorbis-tools }:

@ -7,12 +7,18 @@ stdenv.mkDerivation  rec {
  version = "1.4.23";

  src = fetchurl {
-    url = "http://download.gna.org/mhwaveedit/${name}.tar.bz2";
-    sha256 = "010rk4mr631s440q9cfgdxx2avgzysr9aq52diwdlbq9cddifli3";
+    url = "https://github.com/magnush/mhwaveedit/archive/v${version}.tar.gz";
+    sha256 = "1lvd54d8kpxwl4gihhznx1b5skhibz4vfxi9k2kwqg808jfgz37l";
  };

-  buildInputs = [ SDL alsaLib gtk2 libjack2 ladspaH libsamplerate libsndfile
-     pkgconfig libpulseaudio makeWrapper ];
+  nativeBuildInputs = [ autoreconfHook ];
+
+  preAutoreconf = "(cd docgen && sh gendocs.sh)";
+
+  buildInputs = [
+     SDL alsaLib gtk2 libjack2 ladspaH libsamplerate libsndfile
+     pkgconfig libpulseaudio makeWrapper
+  ];

  configureFlags = "--with-default-ladspa-path=${ladspaPlugins}/lib/ladspa";

--- a/pkgs/applications/audio/mod-distortion/default.nix
+++ b/pkgs/applications/audio/mod-distortion/default.nix
@ -1,19 +1,19 @@
 { stdenv, fetchFromGitHub, lv2 }:

 stdenv.mkDerivation rec {
-  name = "mod-distortion-${version}";
-  version = "git-2015-05-18";
+  name = "mod-distortion-git-${version}";
+  version = "2016-08-19";

  src = fetchFromGitHub {
    owner = "portalmod";
    repo = "mod-distortion";
-    rev = "0cdf186abc2a9275890b57057faf5c3f6d86d84a";
-    sha256 = "1wmxgpcdcy9m7j78yq85824if0wz49wv7mw13bj3sw2s87dcmw19";
+    rev = "e672d5feb9d631798e3d56eb96e8958c3d2c6821";
+    sha256 = "005wdkbhn9dgjqv019cwnziqg86yryc5vh7j5qayrzh9v446dw34";
  };

  buildInputs = [ lv2 ];

-  installFlags = [ "LV2_PATH=$(out)/lib/lv2"  ];
+  installFlags = [ "INSTALL_PATH=$(out)/lib/lv2" ];

  meta = with stdenv.lib; {
    homepage = https://github.com/portalmod/mod-distortion;
--- a/pkgs/applications/audio/padthv1/default.nix
+++ b/pkgs/applications/audio/padthv1/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "padthv1-${version}";
-  version = "0.8.4";
+  version = "0.8.5";

  src = fetchurl {
    url = "mirror://sourceforge/padthv1/${name}.tar.gz";
-    sha256 = "1p6wfgh90h7gj1j3hlvwik3zj07xamkxbya85va2lsj6fkkkk20r";
+    sha256 = "0dyrllxgd74nknixjcz6n7m4gw70v246s8z1qss7zfl5yllhb712";
  };

  buildInputs = [ libjack2 alsaLib libsndfile liblo lv2 qt5.qtbase qt5.qttools fftw ];
--- a/pkgs/applications/audio/puredata/default.nix
+++ b/pkgs/applications/audio/puredata/default.nix
@ -1,30 +1,31 @@
 { stdenv, fetchurl, autoreconfHook, gettext, makeWrapper
-, alsaLib, libjack2, tk
+, alsaLib, libjack2, tk, fftw
 }:

 stdenv.mkDerivation  rec {
  name = "puredata-${version}";
-  version = "0.47-1";
+  version = "0.48-0";

  src = fetchurl {
    url = "http://msp.ucsd.edu/Software/pd-${version}.src.tar.gz";
-    sha256 = "0k5s949kqd7yw97h3m8z81bjz32bis9m4ih8df1z0ymipnafca67";
+    sha256 = "0wy9kl2v00fl27x4mfzhbca415hpaisp6ls8a6mkl01qbw20krny";
  };

-  patchPhase = ''
-    rm portaudio/configure.in
-  '';
-
  nativeBuildInputs = [ autoreconfHook gettext makeWrapper ];

-  buildInputs = [ alsaLib libjack2 ];
+  buildInputs = [ alsaLib libjack2 fftw ];

  configureFlags = ''
    --enable-alsa
    --enable-jack
+    --enable-fftw
    --disable-portaudio
+
  '';

+  # https://github.com/pure-data/pure-data/issues/188
+  # --disable-oss
+
  postInstall = ''
    wrapProgram $out/bin/pd --prefix PATH : ${tk}/bin
  '';
--- a/pkgs/applications/audio/qsampler/default.nix
+++ b/pkgs/applications/audio/qsampler/default.nix
@ -1,21 +1,22 @@
-{ stdenv, fetchsvn, autoconf, automake, liblscp, libtool, pkgconfig
-, qt4 }:
+{ stdenv, fetchurl, autoconf, automake, libtool, pkgconfig, qttools
+, liblscp, libgig, qtbase }:

 stdenv.mkDerivation rec {
-  name = "qsampler-svn-${version}";
-  version = "2342";
+  name = "qsampler-${version}";
+  version = "0.4.3";

-  src = fetchsvn {
-    url = "https://svn.linuxsampler.org/svn/qsampler/trunk";
-    rev = "${version}";
-    sha256 = "17w3vgpgfmvl11wsd5ndk9zdggl3gbzv3wbd45dyf2al4i0miqnx";
+  src = fetchurl {
+    url = "mirror://sourceforge/qsampler/${name}.tar.gz";
+    sha256 = "1wg19022gyzy8rk9npfav9kz9z2qicqwwb2x5jz5hshzf3npx1fi";
  };

-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ autoconf automake liblscp libtool qt4 ];
+  nativeBuildInputs = [ autoconf automake libtool pkgconfig qttools ];
+  buildInputs = [ liblscp libgig qtbase ];

  preConfigure = "make -f Makefile.svn";

+  enableParallelBuilding = true;
+
  meta = with stdenv.lib; {
    homepage = http://www.linuxsampler.org;
    description = "Graphical frontend to LinuxSampler";
--- a/pkgs/applications/audio/qsynth/default.nix
+++ b/pkgs/applications/audio/qsynth/default.nix
@ -1,15 +1,17 @@
-{ stdenv, fetchurl, alsaLib, fluidsynth, libjack2, qt4 }:
+{ stdenv, fetchurl, alsaLib, fluidsynth, libjack2, qtbase, qttools, qtx11extras, cmake, pkgconfig }:

 stdenv.mkDerivation  rec {
  name = "qsynth-${version}";
-  version = "0.3.9";
+  version = "0.4.4";

  src = fetchurl {
    url = "mirror://sourceforge/qsynth/${name}.tar.gz";
-    sha256 = "08kyn6cl755l9i1grzjx8yi3f8mgiz4gx0hgqad1n0d8yz85087b";
+    sha256 = "0qhfnikx3xcllkvs60kj6vcf2rwwzh31y41qkk6kwfhzgd219y8f";
  };

-  buildInputs = [ alsaLib fluidsynth libjack2 qt4 ];
+  nativeBuildInputs = [ cmake pkgconfig ];
+
+  buildInputs = [ alsaLib fluidsynth libjack2 qtbase qttools qtx11extras ];

  meta = with stdenv.lib; {
    description = "Fluidsynth GUI";
--- a/pkgs/applications/audio/samplv1/default.nix
+++ b/pkgs/applications/audio/samplv1/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "samplv1-${version}";
-  version = "0.8.4";
+  version = "0.8.5";

  src = fetchurl {
    url = "mirror://sourceforge/samplv1/${name}.tar.gz";
-    sha256 = "107p2xsj066q2bil0xcgqrrn7lawp02wzf7qmlajcbnd79jhsi6i";
+    sha256 = "1gscwybsbaqbnylmgf2baf71cm2g7a0pd11rqmk3cz9hi3lyjric";
  };

  buildInputs = [ libjack2 alsaLib liblo libsndfile lv2 qt5.qtbase qt5.qttools];
--- a/pkgs/applications/audio/soundscape-renderer/default.nix
+++ b/pkgs/applications/audio/soundscape-renderer/default.nix
@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
    homepage = http://spatialaudio.net/ssr/;
    description = "The SoundScape Renderer (SSR) is a tool for real-time spatial audio reproduction";
    license = stdenv.lib.licenses.gpl3;
-    maintainer = stdenv.lib.maintainers.fridh;
+    maintainers = [ stdenv.lib.maintainers.fridh ];
  };

 }
--- a/pkgs/applications/audio/synthv1/default.nix
+++ b/pkgs/applications/audio/synthv1/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "synthv1-${version}";
-  version = "0.8.4";
+  version = "0.8.5";

  src = fetchurl {
    url = "mirror://sourceforge/synthv1/${name}.tar.gz";
-    sha256 = "0awk2zx0xa6vl6ah24zz0k2mwsx50hh5g1rh32mp790fp4x7l5s8";
+    sha256 = "0mvrqk6jy7h2wg442ixwm49w7x15rs4066c2ljrz4kvxlzp5z69i";
  };

  buildInputs = [ qt5.qtbase qt5.qttools libjack2 alsaLib liblo lv2 ];
--- a/pkgs/applications/audio/yoshimi/default.nix
+++ b/pkgs/applications/audio/yoshimi/default.nix
@ -6,11 +6,11 @@ assert stdenv ? glibc;

 stdenv.mkDerivation  rec {
  name = "yoshimi-${version}";
-  version = "1.5.3";
+  version = "1.5.4.1";

  src = fetchurl {
    url = "mirror://sourceforge/yoshimi/${name}.tar.bz2";
-    sha256 = "0sns35pyw2f74xrv1fxiyf9g9415kvh2rrbdjd60hsiv584nlari";
+    sha256 = "1r5mgjlxyabm3nd3vcnfwywk46531vy2j3k8pjbfwadjkvp52vj6";
  };

  buildInputs = [
--- a/pkgs/applications/display-managers/lightdm/default.nix
+++ b/pkgs/applications/display-managers/lightdm/default.nix
@ -1,5 +1,5 @@
 { stdenv, fetchurl, pam, pkgconfig, libxcb, glib, libXdmcp, itstool, libxml2
-, intltool, xlibsWrapper, libxklavier, libgcrypt, libaudit
+, intltool, xlibsWrapper, libxklavier, libgcrypt, libaudit, coreutils
 , qt4 ? null
 , withQt5 ? false, qtbase
 }:
@ -36,6 +36,11 @@ stdenv.mkDerivation rec {
    "localstatedir=\${TMPDIR}"
  ];

+  prePatch = ''
+    substituteInPlace src/shared-data-manager.c \
+      --replace /bin/rm ${coreutils}/bin/rm
+  '';
+
  meta = {
    homepage = https://launchpad.net/lightdm;
    platforms = platforms.linux;
--- a/pkgs/applications/display-managers/sddm/default.nix
+++ b/pkgs/applications/display-managers/sddm/default.nix
@ -4,8 +4,7 @@
 }:

 let
-
-  version = "0.16.0";
+  version = "0.17.0";

 in mkDerivation rec {
  name = "sddm-${version}";
@ -14,7 +13,7 @@ in mkDerivation rec {
    owner = "sddm";
    repo = "sddm";
    rev = "v${version}";
-    sha256 = "1j0rc8nk8bz7sxa0bc6lx9v7r3zlcfyicngfjqb894ni9k71kzsb";
+    sha256 = "1m35ly6miwy8ivsln3j1bfv0nxbc4gyqnj7f847zzp53jsqrm3mq";
  };

  patches = [ ./sddm-ignore-config-mtime.patch ];
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@ -27,9 +27,9 @@ in rec {

  preview = mkStudio {
    pname = "android-studio-preview";
-    version = "3.1.0.3"; # "Android Studio 3.1 Canary 4"
-    build = "171.4444016";
-    sha256Hash = "0qgd0hd3i3p1adv0xqa0409r5injw3ygs50lajzi99s33j6vdc6s";
+    version = "3.1.0.4"; # "Android Studio 3.1 Canary 5"
+    build = "171.4474551";
+    sha256Hash = "0rgz1p67ra4q0jjb343xqm7c3yrpk1mly8r80cvpqqqq4xgfwa20";

    meta = stable.meta // {
      description = "The Official IDE for Android (preview version)";
--- a/pkgs/applications/editors/ed/default.nix
+++ b/pkgs/applications/editors/ed/default.nix
@ -11,27 +11,9 @@ stdenv.mkDerivation rec {
    sha256 = "1nqhk3n1s1p77g2bjnj55acicsrlyb2yasqxqwpx0w0djfx64ygm";
  };

-  unpackCmd = "tar --lzip -xf";
-
  nativeBuildInputs = [ lzip ];

-  /* FIXME: Tests currently fail on Darwin:
-
-       building test scripts for ed-1.5...
-       testing ed-1.5...
-       *** Output e1.o of script e1.ed is incorrect ***
-       *** Output r3.o of script r3.ed is incorrect ***
-       make: *** [check] Error 127
-
-    */
-  doCheck = !(hostPlatform.isDarwin || hostPlatform != buildPlatform);
-
-  installFlags = [ "DESTDIR=$(out)" ];
-
-  configureFlags = [
-    "--exec-prefix=${stdenv.cc.targetPrefix}"
-    "CC=${stdenv.cc.targetPrefix}cc"
-  ];
+  doCheck = hostPlatform == buildPlatform;

  meta = {
    description = "An implementation of the standard Unix editor";
--- a/pkgs/applications/editors/emacs-modes/elpa-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/elpa-generated.nix
@ -175,10 +175,10 @@
      }) {};
    auctex = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
        pname = "auctex";
-        version = "11.91.0";
+        version = "11.92.0";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/auctex-11.91.0.tar";
-          sha256 = "1yh182mxgngjmwpkyv2n9km3vyq95bqfq8mnly3dbv78nwk7f2l3";
+          url = "https://elpa.gnu.org/packages/auctex-11.92.0.tar";
+          sha256 = "147xfb64jxpl4262xrn4cxm6h86ybgr3aa1qq6vs6isnqczh7491";
        };
        packageRequires = [];
        meta = {
@ -483,10 +483,10 @@
      }) {};
    csv-mode = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
        pname = "csv-mode";
-        version = "1.6";
+        version = "1.7";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/csv-mode-1.6.el";
-          sha256 = "1v86qna1ypnr55spf6kjiqybplfbb8ak5gnnifh9vghsgb5jkb6a";
+          url = "https://elpa.gnu.org/packages/csv-mode-1.7.el";
+          sha256 = "0r4bip0w3h55i8h6sxh06czf294mrhavybz0zypzrjw91m1bi7z6";
        };
        packageRequires = [];
        meta = {
@ -755,10 +755,10 @@
    el-search = callPackage ({ elpaBuild, emacs, fetchurl, lib, stream }:
    elpaBuild {
        pname = "el-search";
-        version = "1.4";
+        version = "1.4.0.8";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/el-search-1.4.tar";
-          sha256 = "0fzsq1wdkb94dk67ligdwc7kyl0x9bifgl2qvvf0hsj4zws4pgjg";
+          url = "https://elpa.gnu.org/packages/el-search-1.4.0.8.tar";
+          sha256 = "1gk42n04f1h2vc8sp86gvi795qgnvnh4cyyqfvy6sz1pfix76kfl";
        };
        packageRequires = [ emacs stream ];
        meta = {
@ -848,10 +848,10 @@
      }) {};
    exwm = callPackage ({ elpaBuild, fetchurl, lib, xelb }: elpaBuild {
        pname = "exwm";
-        version = "0.15";
+        version = "0.16";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/exwm-0.15.tar";
-          sha256 = "1y7nqry9y0a99bsdqkk9f554vczfw4sz6raadw3138835qy697jg";
+          url = "https://elpa.gnu.org/packages/exwm-0.16.tar";
+          sha256 = "0c4w5k9lzqj8yzhdqipdb4fs7ld2qklc6s137104jnfdvmrwcv2i";
        };
        packageRequires = [ xelb ];
        meta = {
@ -929,6 +929,20 @@
          license = lib.licenses.free;
        };
      }) {};
+    gle-mode = callPackage ({ cl-lib ? null, elpaBuild, fetchurl, lib }:
+    elpaBuild {
+        pname = "gle-mode";
+        version = "1.1";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/gle-mode-1.1.el";
+          sha256 = "0p9glalhkf8i4486pjwvrb9z4lqxl6jcqfk6jrjl6b1xi72xmdi0";
+        };
+        packageRequires = [ cl-lib ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/gle-mode.html";
+          license = lib.licenses.free;
+        };
+      }) {};
    gnome-c-style = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
        pname = "gnome-c-style";
        version = "0.1";
@ -945,10 +959,10 @@
    gnorb = callPackage ({ cl-lib ? null, elpaBuild, fetchurl, lib }:
    elpaBuild {
        pname = "gnorb";
-        version = "1.3.1";
+        version = "1.3.4";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/gnorb-1.3.1.tar";
-          sha256 = "1g6xldkc6l6zlzd1slqizbbd5b9k4pbr66nrf5svidgiy7mlifw5";
+          url = "https://elpa.gnu.org/packages/gnorb-1.3.4.tar";
+          sha256 = "0yw46bzv80awd2zirwqc28bl70q1x431lqan71lm6qwli0bha2w0";
        };
        packageRequires = [ cl-lib ];
        meta = {
@ -1053,10 +1067,10 @@
      }) {};
    hyperbole = callPackage ({ elpaBuild, emacs, fetchurl, lib }: elpaBuild {
        pname = "hyperbole";
-        version = "7.0.0";
+        version = "7.0.2";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/hyperbole-7.0.0.tar";
-          sha256 = "07cy40yfxwka1r6i01pgrf9a3n9ms5xw2x486jd803dhfkm3113b";
+          url = "https://elpa.gnu.org/packages/hyperbole-7.0.2.tar";
+          sha256 = "1hgwa740941a9s5wf1cqf76h3af8qbiiw9sc76biz6m3vx0hy1zs";
        };
        packageRequires = [ emacs ];
        meta = {
@ -1092,10 +1106,10 @@
      }) {};
    ivy = callPackage ({ elpaBuild, emacs, fetchurl, lib }: elpaBuild {
        pname = "ivy";
-        version = "0.9.1";
+        version = "0.10.0";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/ivy-0.9.1.tar";
-          sha256 = "1jfc3zf6ln7i8pp5j0fpsai2w847v5g77b5fzlxbgvj80g3v5887";
+          url = "https://elpa.gnu.org/packages/ivy-0.10.0.tar";
+          sha256 = "01m58inpd8jbfvzqsrwigzjfld9a66nf36cbya26dmdy7vwdm8xm";
        };
        packageRequires = [ emacs ];
        meta = {
@ -1570,10 +1584,10 @@
      }) {};
    org = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
        pname = "org";
-        version = "20171120";
+        version = "20171205";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/org-20171120.tar";
-          sha256 = "0hxy061g1qd77pvx8mq5rb9avx139x4z5nmjhdq518xhg7kxmq6a";
+          url = "https://elpa.gnu.org/packages/org-20171205.tar";
+          sha256 = "0a1rm94ci47jf5579sxscily680ysmy3hnxjcs073n45nk76za04";
        };
        packageRequires = [];
        meta = {
@ -1972,6 +1986,19 @@
          license = lib.licenses.free;
        };
      }) {};
+    sql-indent = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
+        pname = "sql-indent";
+        version = "1.0";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/sql-indent-1.0.tar";
+          sha256 = "02cmi96mqk3bfmdh0xv5s0qx310cirs6kq0jqwk1ga41rpp596vl";
+        };
+        packageRequires = [];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/sql-indent.html";
+          license = lib.licenses.free;
+        };
+      }) {};
    stream = callPackage ({ elpaBuild, emacs, fetchurl, lib }: elpaBuild {
        pname = "stream";
        version = "2.2.4";
--- a/pkgs/applications/editors/emacs-modes/elpa-packages.nix
+++ b/pkgs/applications/editors/emacs-modes/elpa-packages.nix
@ -36,6 +36,8 @@ self:
    };

    overrides = {
+      # upstream issue: missing footer
+      ebdb-i18n-chn = markBroken super.ebdb-i18n-chn;
      el-search = markBroken super.el-search; # requires emacs-25
      iterators = markBroken super.iterators; # requires emacs-25
      midi-kbd = markBroken super.midi-kbd; # requires emacs-25
--- a/pkgs/applications/editors/emacs-modes/melpa-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/melpa-generated.nix
--- a/pkgs/applications/editors/emacs-modes/melpa-packages.nix
+++ b/pkgs/applications/editors/emacs-modes/melpa-packages.nix
@ -66,6 +66,9 @@ self:
      # upstream issue: missing file header
      elmine = markBroken super.elmine;

+      # upstream issue: missing dependency redshank
+      emr = markBroken super.emr;
+
      ess-R-data-view = super.ess-R-data-view.override {
        inherit (self.melpaPackages) ess ctable popup;
      };
@ -74,6 +77,12 @@ self:
        inherit (self.melpaPackages) ess popup;
      };

+      # upstream issue: missing dependency highlight
+      evil-search-highlight-persist = markBroken super.evil-search-highlight-persist;
+
+      # upstream issue: missing dependency highlight
+      floobits  = markBroken super.floobits;
+
      # missing OCaml
      flycheck-ocaml = markBroken super.flycheck-ocaml;

@ -147,6 +156,9 @@ self:
      # upstream issue: missing file footer
      seoul256-theme = markBroken super.seoul256-theme;

+      # upstream issue: missing dependency highlight
+      sonic-pi  = markBroken super.sonic-pi;
+
      spaceline = super.spaceline.override {
        inherit (self.melpaPackages) powerline;
      };
--- a/pkgs/applications/editors/emacs-modes/melpa-stable-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/melpa-stable-generated.nix
--- a/pkgs/applications/editors/emacs-modes/melpa-stable-packages.nix
+++ b/pkgs/applications/editors/emacs-modes/melpa-stable-packages.nix
@ -65,6 +65,9 @@ self:
      # upstream issue: missing file header
      elmine = markBroken super.elmine;

+      # upstream issue: missing dependency redshank
+      emr = markBroken super.emr;
+
      ess-R-data-view = super.ess-R-data-view.override {
        inherit (self.melpaPackages) ess ctable popup;
      };
@ -73,6 +76,12 @@ self:
        inherit (self.melpaPackages) ess popup;
      };

+      # upstream issue: missing dependency highlight
+      evil-search-highlight-persist = markBroken super.evil-search-highlight-persist;
+
+      # upstream issue: missing dependency highlight
+      floobits  = markBroken super.floobits;
+
      # missing OCaml
      flycheck-ocaml = markBroken super.flycheck-ocaml;

--- a/pkgs/applications/editors/emacs-modes/org-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/org-generated.nix
@ -1,10 +1,10 @@
 { callPackage }: {
    org = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
        pname = "org";
-        version = "20171120";
+        version = "20171205";
        src = fetchurl {
-          url = "http://orgmode.org/elpa/org-20171120.tar";
-          sha256 = "1xpfs0bz5lb4jmzd0kk5mgl2yfk0hb6hk788x9rn7i1n1dnz4mdy";
+          url = "http://orgmode.org/elpa/org-20171205.tar";
+          sha256 = "0n8v5x50p8p52wwszzhf5y39ll2aaackvi64ldchnj06lqy3ni88";
        };
        packageRequires = [];
        meta = {
@ -14,10 +14,10 @@
      }) {};
    org-plus-contrib = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
        pname = "org-plus-contrib";
-        version = "20171120";
+        version = "20171205";
        src = fetchurl {
-          url = "http://orgmode.org/elpa/org-plus-contrib-20171120.tar";
-          sha256 = "1ivrdxfvxiqj3ydc9d9vmh8wcb4ydavrn9mprx74kg4g084v9y26";
+          url = "http://orgmode.org/elpa/org-plus-contrib-20171205.tar";
+          sha256 = "1y61csa284gy8l0fj0mv67mkm4fsi4lz401987qp6a6z260df4n5";
        };
        packageRequires = [];
        meta = {
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@ -1,6 +1,6 @@
 { lib, stdenv, callPackage, fetchurl, makeDesktopItem, makeWrapper, patchelf
 , coreutils, gnugrep, which, git, python, unzip, p7zip
-, androidsdk, jdk, cmake, libxml2, zlib, python2, ncurses
+, androidsdk, jdk, cmake, libxml2, zlib, python3, ncurses
 }:

 assert stdenv.isLinux;
@ -41,11 +41,19 @@ let
          patchelf --set-interpreter $interp \
            --set-rpath "${lib.makeLibraryPath [ libxml2 zlib stdenv.cc.cc.lib ]}:$lldbLibPath" \
            bin/lldb/bin/lldb-server
-          patchelf --set-interpreter $interp \
-            --set-rpath "${lib.makeLibraryPath [ stdenv.cc.cc.lib ]}:$lldbLibPath" \
-            bin/lldb/LLDBFrontend
+
+          for i in LLDBFrontend lldb lldb-argdumper; do
+            patchelf --set-interpreter $interp \
+              --set-rpath "${lib.makeLibraryPath [ stdenv.cc.cc.lib ]}:$lldbLibPath" \
+              "bin/lldb/bin/$i"
+          done
+
          patchelf \
-            --set-rpath "${lib.makeLibraryPath [ libxml2 zlib stdenv.cc.cc.lib python2 ]}:$lldbLibPath" \
+            --set-rpath "${lib.makeLibraryPath [ stdenv.cc.cc.lib ]}:$lldbLibPath" \
+            bin/lldb/lib/python3.*/lib-dynload/zlib.cpython-*m-x86_64-linux-gnu.so
+
+          patchelf \
+            --set-rpath "${lib.makeLibraryPath [ libxml2 zlib stdenv.cc.cc.lib python3 ]}:$lldbLibPath" \
            bin/lldb/lib/liblldb.so

          patchelf --set-interpreter $interp bin/gdb/bin/gdb
@ -226,12 +234,12 @@ in

  clion = buildClion rec {
    name = "clion-${version}";
-    version = "2017.2.3"; /* updated by script */
+    version = "2017.3"; /* updated by script */
    description  = "C/C++ IDE. New. Intelligent. Cross-platform";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/cpp/CLion-${version}.tar.gz";
-      sha256 = "02hyndyfcrvfbi4q8vmmj0xh2bggwc2azggm24g3m03iffa7j6fx"; /* updated by script */
+      sha256 = "0gv9krqy4bhijx5s005qhswxnc05l1jsjlxs0h15z23bmv7rlpnf"; /* updated by script */
    };
    wmClass = "jetbrains-clion";
    update-channel = "CLion_Release"; # channel's id as in http://www.jetbrains.com/updates/updates.xml
@ -252,25 +260,25 @@ in

  goland = buildGoland rec {
    name = "goland-${version}";
-    version = "173.3727.79"; /* updated by script */
+    version = "2017.3"; /* updated by script */
    description = "Up and Coming Go IDE";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/go/${name}.tar.gz";
-      sha256 = "0bmd7r3h76pg0s9m3i5qv7zfkcj3gannj0c12cw087b831ga7ccz"; /* updated by script */
+      sha256 = "0l4l0lsmq1g4fwfrxhbrnfsp8nk38ml48cryvdr241zsxz43fax0"; /* updated by script */
    };
    wmClass = "jetbrains-goland";
-    update-channel = "goland_1.0_EAP";
+    update-channel = "goland_release";
  };

  idea-community = buildIdea rec {
    name = "idea-community-${version}";
-    version = "2017.2.6"; /* updated by script */
+    version = "2017.3"; /* updated by script */
    description = "Integrated Development Environment (IDE) by Jetbrains, community edition";
    license = stdenv.lib.licenses.asl20;
    src = fetchurl {
      url = "https://download.jetbrains.com/idea/ideaIC-${version}.tar.gz";
-      sha256 = "150zq3wk7gsn1ibx5nkq9smfcf9n1lk347vj47yb1nwzcq0vmj2p"; /* updated by script */
+      sha256 = "04qp37pv4z6d9gw6j56m4zfxw4v2cydk8w7jzyzrcg52jr064kwi"; /* updated by script */
    };
    wmClass = "jetbrains-idea-ce";
    update-channel = "IDEA_Release";
@ -278,12 +286,12 @@ in

  idea-ultimate = buildIdea rec {
    name = "idea-ultimate-${version}";
-    version = "2017.2.6"; /* updated by script */
+    version = "2017.3"; /* updated by script */
    description = "Integrated Development Environment (IDE) by Jetbrains, requires paid license";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/idea/ideaIU-${version}-no-jdk.tar.gz";
-      sha256 = "1g0qcv14rn9kzf0yv17ca3w1ihl1274216n7niwkqwcjp5mvj030"; /* updated by script */
+      sha256 = "0w9ihi6vzgfiav2qia7d7vrn14k8v56npir0dyx7ii8an887s7ws"; /* updated by script */
    };
    wmClass = "jetbrains-idea";
    update-channel = "IDEA_Release";
@ -291,25 +299,25 @@ in

  phpstorm = buildPhpStorm rec {
    name = "phpstorm-${version}";
-    version = "2017.2.4"; /* updated by script */
+    version = "2017.3"; /* updated by script */
    description = "Professional IDE for Web and PHP developers";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/webide/PhpStorm-${version}.tar.gz";
-      sha256 = "0hn3x5wid2z7s2mhnxfqh2yhdkscccpbz7qgsxkjvmkxcynazrvy"; /* updated by script */
+      sha256 = "1byhlm5bnp6ic4n2xg17v4g34ipygy50i9xj4292b0xw7srxh910"; /* updated by script */
    };
    wmClass = "jetbrains-phpstorm";
-    update-channel = "PS2017.2";
+    update-channel = "PS2017.3";
  };

  pycharm-community = buildPycharm rec {
    name = "pycharm-community-${version}";
-    version = "2017.2.4"; /* updated by script */
+    version = "2017.3"; /* updated by script */
    description = "PyCharm Community Edition";
    license = stdenv.lib.licenses.asl20;
    src = fetchurl {
      url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "193f44s9vh5ksd7hs586h0j66lcqsh29wwxr5yhl05lq931la857"; /* updated by script */
+      sha256 = "1lca3g5h716l97pkqfb8i7apsnx445xzcc9j41d0y3yyncf5hwxr"; /* updated by script */
    };
    wmClass = "jetbrains-pycharm-ce";
    update-channel = "PyCharm_Release";
@ -317,12 +325,12 @@ in

  pycharm-professional = buildPycharm rec {
    name = "pycharm-professional-${version}";
-    version = "2017.2.4"; /* updated by script */
+    version = "2017.3"; /* updated by script */
    description = "PyCharm Professional Edition";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "0n1nps8jfk77i796yr90bvrx9j1vcdnl25sr4b5n4xznjrix4gki"; /* updated by script */
+      sha256 = "06lh0nxmzn0lsyd6isyb6gf01h4nbksi0f03hwwm6wdfvsfw92pb"; /* updated by script */
    };
    wmClass = "jetbrains-pycharm";
    update-channel = "PyCharm_Release";
@ -330,38 +338,38 @@ in

  rider = buildRider rec {
    name = "rider-${version}";
-    version = "2017.1.2"; /* updated by script */
+    version = "2017.2.1"; /* updated by script */
    description = "A cross-platform .NET IDE based on the IntelliJ platform and ReSharper";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/resharper/JetBrains.Rider-${version}.tar.gz";
-      sha256 = "0kphjxibrs4ss6hpxbssvs3n35xh9zzw7a1q09x79ibvvk73gwqh"; /* updated by script */
+      sha256 = "1zviknxamp1y7lrlg5qfj3ijp96z0dqvcr42ca0fbx1xb887wzww"; /* updated by script */
    };
    wmClass = "jetbrains-rider";
-    update-channel = "rider_2017_1";
+    update-channel = "rider_2017_2";
  };

  ruby-mine = buildRubyMine rec {
    name = "ruby-mine-${version}";
-    version = "2017.1.5"; /* updated by script */
+    version = "2017.3"; /* updated by script */
    description = "The Most Intelligent Ruby and Rails IDE";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/ruby/RubyMine-${version}.tar.gz";
-      sha256 = "198eb3d7914529ce3a6857e038167e194fb838c4b94242048ae45e8413458d66"; /* updated by script */
+      sha256 = "04h299mbzwrdgqxkff0vgpj2kbisb29l55mm6r45amgpqcnms6i5"; /* updated by script */
    };
    wmClass = "jetbrains-rubymine";
-    update-channel = "rm2017.1";
+    update-channel = "rm2017.3";
  };

  webstorm = buildWebStorm rec {
    name = "webstorm-${version}";
-    version = "2017.2.5"; /* updated by script */
+    version = "2017.3"; /* updated by script */
    description = "Professional IDE for Web and JavaScript development";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/webstorm/WebStorm-${version}.tar.gz";
-      sha256 = "0apsfwcj8qfjwya794848h5iqfg9fay3h8bxqwclkw7lid9qwv7n"; /* updated by script */
+      sha256 = "0whr5zygrbi044pl48ac2w7a4rxldbaqlf76dkfqj83g2wl4n990"; /* updated by script */
    };
    wmClass = "jetbrains-webstorm";
    update-channel = "WS_Release";
--- a/pkgs/applications/gis/qgis/default.nix
+++ b/pkgs/applications/gis/qgis/default.nix
@ -5,7 +5,7 @@
 }:

 stdenv.mkDerivation rec {
-  name = "qgis-2.18.14";
+  name = "qgis-2.18.15";

  buildInputs = [ gdal qt4 flex openssl bison proj geos xlibsWrapper sqlite gsl qwt qscintilla
    fcgi libspatialindex libspatialite postgresql qjson qca2 txt2tags ] ++
@ -14,8 +14,9 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ cmake makeWrapper ];

+  # `make -f src/providers/wms/CMakeFiles/wmsprovider_a.dir/build.make src/providers/wms/CMakeFiles/wmsprovider_a.dir/qgswmssourceselect.cpp.o`:
  # fatal error: ui_qgsdelimitedtextsourceselectbase.h: No such file or directory
-  #enableParallelBuilding = true;
+  enableParallelBuilding = false;

  # To handle the lack of 'local' RPATH; required, as they call one of
  # their built binaries requiring their libs, in the build process.
@ -25,7 +26,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "http://qgis.org/downloads/${name}.tar.bz2";
-    sha256 = "199nc539kd8fxbfny61s4sv8bvrhlxw59dmvw6m70gnff6mpc8fq";
+    sha256 = "1jpprkk91s2wwx0iiqlnsngxnn52zs32bad799fjai58nrsh8b7b";
  };

  cmakeFlags = stdenv.lib.optional withGrass "-DGRASS_PREFIX7=${grass}/${grass.name}";
--- a/pkgs/applications/graphics/ImageMagick/7.0.nix
+++ b/pkgs/applications/graphics/ImageMagick/7.0.nix
@ -14,8 +14,8 @@ let
    else throw "ImageMagick is not supported on this platform.";

  cfg = {
-    version = "7.0.7-9";
-    sha256 = "0p0879chcfrghcamwgxxcmaaj04xv0z91ris7hxi37qdw8c7836w";
+    version = "7.0.7-14";
+    sha256 = "04hpc9i6fp09iy0xkidlfhfqr7zg45izqqj5fx93n3dxalq65xqw";
    patches = [];
  };
 in
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@ -14,8 +14,8 @@ let
    else throw "ImageMagick is not supported on this platform.";

  cfg = {
-    version = "6.9.9-23";
-    sha256 = "0cd6zcbcfvznf0i3q4xz1c4wm4cfplg4zc466lvlb1w8qbn25948";
+    version = "6.9.9-26";
+    sha256 = "10rcq7b9hhz50m4yqnm4g3iai7lr9jkglb7sm49ycw59arrkmwnw";
    patches = [];
  }
    # Freeze version on mingw so we don't need to port the patch too often.
--- a/pkgs/applications/graphics/awesomebump/default.nix
+++ b/pkgs/applications/graphics/awesomebump/default.nix
@ -15,6 +15,7 @@ let
    name = "qtnproperty";
    inherit src;
    sourceRoot = "AwesomeBump/Sources/utils/QtnProperty";
+    patches = [ ./qtnproperty-parallel-building.patch ];
    buildInputs = [ qtscript qtbase qtdeclarative ];
    nativeBuildInputs = [ qmake flex bison ];
    postInstall = ''
@ -46,6 +47,10 @@ in stdenv.mkDerivation rec {
        --run "cd $d"
  '';

+  # $ cd Sources; qmake; make ../workdir/linux-g++-dgb-gl4/obj/glwidget.o
+  # fatal error: properties/ImageProperties.peg.h: No such file or directory
+  enableParallelBuilding = false;
+
  meta = {
    homepage = https://github.com/kmkolasinski/AwesomeBump;
    description = "A program to generate normal, height, specular or ambient occlusion textures from a single image";
--- a/pkgs/applications/graphics/awesomebump/qtnproperty-parallel-building.patch
+++ b/pkgs/applications/graphics/awesomebump/qtnproperty-parallel-building.patch
@ -0,0 +1,9 @@
+--- a/PEG/Flex.pri
+++ b/PEG/Flex.pri
+@@ -1,5 +1,6 @@
+ flex.name = Flex ${QMAKE_FILE_IN}
+ flex.input = FLEX_SOURCES
+flex.depends = ${QMAKE_FILE_PATH}/${QMAKE_FILE_BASE}.parser.cpp
+ flex.output = ${QMAKE_FILE_PATH}/${QMAKE_FILE_BASE}.lexer.cpp
+ 
+ win32:flex.commands = win_flex --wincompat -o ${QMAKE_FILE_PATH}/${QMAKE_FILE_BASE}.lexer.cpp ${QMAKE_FILE_IN}
--- a/pkgs/applications/graphics/digikam/default.nix
+++ b/pkgs/applications/graphics/digikam/default.nix
@ -1,4 +1,4 @@
-{ mkDerivation, lib, fetchurl, cmake, doxygen, extra-cmake-modules, wrapGAppsHook
+{ mkDerivation, lib, fetchurl, cmake, doxygen, extra-cmake-modules, wrapGAppsHook, fetchpatch

 # For `digitaglinktree`
 , perl, sqlite
@ -99,8 +99,6 @@ mkDerivation rec {
    threadweaver
  ];

-  enableParallelBuilding = true;
-
  cmakeFlags = [
    "-DENABLE_MYSQLSUPPORT=1"
    "-DENABLE_INTERNALMYSQL=1"
@ -114,6 +112,20 @@ mkDerivation rec {
      --replace "/usr/bin/sqlite3" "${sqlite}/bin/sqlite3"
  '';

+  patches = [
+    # fix Qt-5.9.3 empty album problem
+    (fetchpatch {
+      url = "https://cgit.kde.org/digikam.git/patch/?id=855ba5b7d4bc6337234720a72ea824ddd3b32e5b";
+      sha256 = "0zk8p182piy6xn9v0mhwawya9ciq596vql1qc3lgnx371a97mmni";
+    })
+  ];
+
+  patchFlags = "-d core -p1";
+
+  # `en make -f core/utilities/assistants/expoblending/CMakeFiles/expoblending_src.dir/build.make core/utilities/assistants/expoblending/CMakeFiles/expoblending_src.dir/manager/expoblendingthread.cpp.o`:
+  # digikam_version.h:37:24: fatal error: gitversion.h: No such file or directory
+  enableParallelBuilding = false;
+
  meta = with lib; {
    description = "Photo Management Program";
    license = licenses.gpl2;
--- a/pkgs/applications/graphics/graphicsmagick/default.nix
+++ b/pkgs/applications/graphics/graphicsmagick/default.nix
@ -2,14 +2,14 @@
 , libjpeg, libpng, libtiff, libxml2, zlib, libtool, xz, libX11
 , libwebp, quantumdepth ? 8, fixDarwinDylibNames }:

-let version = "1.3.26"; in
+let version = "1.3.27"; in

 stdenv.mkDerivation {
  name = "graphicsmagick-${version}";

  src = fetchurl {
    url = "mirror://sourceforge/graphicsmagick/GraphicsMagick-${version}.tar.xz";
-    sha256 = "122zgs96dqrys62mnh8x5yvfff6km4d3yrnvaxzg3mg5sprib87v";
+    sha256 = "0rq35p3rml10cxz2z4s7xcfsilhhk19mmy094g3ivz0fg797hcnh";
  };

  patches = [
--- a/pkgs/applications/graphics/ipe/default.nix
+++ b/pkgs/applications/graphics/ipe/default.nix
@ -3,11 +3,11 @@
 }:

 stdenv.mkDerivation rec {
-  name = "ipe-7.1.10";
+  name = "ipe-7.2.7";

  src = fetchurl {
-    url = "https://dl.bintray.com/otfried/generic/ipe/7.1/${name}-src.tar.gz";
-    sha256 = "0kwk8l2jasb4fdixaca08g661d0sdmx2jkk3ch7pxh0f4xkdxkkz";
+    url = "https://dl.bintray.com/otfried/generic/ipe/7.2/${name}-src.tar.gz";
+    sha256 = "08lzqhagvr8l69hxghyw9akf5dixbily7hj2gxhzzrp334k3yvfn";
  };

  # changes taken from Gentoo portage
@ -38,6 +38,8 @@ stdenv.mkDerivation rec {
    done
  '';

+  patches = [ ./xlocale.patch ];
+
  #TODO: make .desktop entry

  meta = {
--- a/pkgs/applications/graphics/ipe/xlocale.patch
+++ b/pkgs/applications/graphics/ipe/xlocale.patch
@ -0,0 +1,10 @@
+--- ipe-7.2.7/src/ipelib/ipeplatform.cpp     2016-12-09 15:09:04.000000000 +0100
+++ ipe-7.2.7/src/ipelib/ipeplatform.cpp     2017-11-23 17:13:11.152395834 +0100
+@@ -38,7 +38,6 @@
+ #include <gdiplus.h>
+ #else
+ #include <sys/wait.h>
+-#include <xlocale.h>
+ #include <dirent.h>
+ #endif
+ #ifdef __APPLE__
--- a/pkgs/applications/graphics/meshlab/default.nix
+++ b/pkgs/applications/graphics/meshlab/default.nix
@ -1,51 +1,65 @@
-{ stdenv, fetchurl, qt4, bzip2, lib3ds, levmar, muparser, unzip, vcg }:
+{ stdenv, fetchFromGitHub, mesa_glu, qtbase, qtscript, qtxmlpatterns }:

-stdenv.mkDerivation rec {
-  name = "meshlab-1.3.3";
+let
+  meshlabRev = "5700f5474c8f90696a8925e2a209a0a8ab506662";
+  vcglibRev = "a8e87662b63ee9f4ded5d4699b28d74183040803";
+in stdenv.mkDerivation {
+  name = "meshlab-2016.12";

-  src = fetchurl {
-    url = "mirror://sourceforge/meshlab/meshlab/MeshLab%20v1.3.3/MeshLabSrc_AllInc_v133.tgz";
-    sha256 = "03wqaibfbfag2w1zi1a5z6h546r9d7pg2sjl5pwg24w7yp8rr0n9";
-  };
+  srcs =
+    [
+      (fetchFromGitHub {
+        owner = "cnr-isti-vclab";
+        repo = "meshlab";
+        rev = meshlabRev;
+        sha256 = "0srrp7zhi86dsg4zsx1615gr26barz38zdl8s03zq6vm1dgzl3cc";
+        name = "meshlab-${meshlabRev}";
+      })
+      (fetchFromGitHub {
+        owner = "cnr-isti-vclab";
+        repo = "vcglib";
+        rev = vcglibRev;
+        sha256 = "0jh8jc8rn7rci8qr3q03q574fk2hsc3rllysck41j8xkr3rmxz2f";
+        name = "vcglib-${vcglibRev}";
+      })
+    ];

-  # I don't know why I need this; without this, the rpath set at the beginning of the
-  # buildPhase gets removed from the 'meshlab' binary
-  dontPatchELF = true;
+  sourceRoot = "meshlab-${meshlabRev}";

-  patches = [ ./include-unistd.diff ];
+  patches = [ ./fix-2016.02.patch ];

  hardeningDisable = [ "format" ];
+  enableParallelBuilding = true;

  buildPhase = ''
-    mkdir -p "$out/include"
+    # MeshLab has ../vcglib hardcoded everywhere, so move the source dir
+    mv ../vcglib-${vcglibRev} ../vcglib
+
+    cd src
    export NIX_LDFLAGS="-rpath $out/opt/meshlab $NIX_LDFLAGS"
-    cd meshlab/src
+
    pushd external
    qmake -recursive external.pro
-    make
+    buildPhase
    popd
    qmake -recursive meshlab_full.pro
-    make
+    buildPhase
  '';

  installPhase = ''
-    mkdir -p $out/opt/meshlab $out/bin $out/lib
-    pushd distrib
-    cp -R * $out/opt/meshlab
-    popd
+    mkdir -p $out/opt/meshlab $out/bin
+    cp -Rv distrib/* $out/opt/meshlab
    ln -s $out/opt/meshlab/meshlab $out/bin/meshlab
+    ln -s $out/opt/meshlab/meshlabserver $out/bin/meshlabserver
  '';

-  sourceRoot = ".";
-
-  buildInputs = [ qt4 unzip vcg ];
+  buildInputs = [ mesa_glu qtbase qtscript qtxmlpatterns ];

  meta = {
-    description = "System for the processing and editing of unstructured 3D triangular meshes";
-    homepage = http://meshlab.sourceforge.net/;
-    license = stdenv.lib.licenses.gpl2Plus;
+    description = "A system for processing and editing 3D triangular meshes.";
+    homepage = http://www.meshlab.net/;
+    license = stdenv.lib.licenses.gpl3;
    maintainers = with stdenv.lib.maintainers; [viric];
    platforms = with stdenv.lib.platforms; linux;
-    broken = true;
  };
 }
--- a/pkgs/applications/graphics/meshlab/fix-2016.02.patch
+++ b/pkgs/applications/graphics/meshlab/fix-2016.02.patch
@ -0,0 +1,88 @@
+From 0fd17cd2b6d57e8a2a981a70115c2565ee076d0f Mon Sep 17 00:00:00 2001
+From: Marco Callieri <callieri@isti.cnr.it>
+Date: Mon, 9 Jan 2017 16:06:14 +0100
+Subject: [PATCH 1/3] resolved ambiguity for abs overloads
+
+
+diff --git a/src/meshlabplugins/edit_quality/eqhandle.cpp b/src/meshlabplugins/edit_quality/eqhandle.cpp
+index 364d53bf..ef3d4a2d 100644
+--- a/src/meshlabplugins/edit_quality/eqhandle.cpp
+++ b/src/meshlabplugins/edit_quality/eqhandle.cpp
+@@ -83,7 +83,7 @@ void EqHandle::mouseMoveEvent(QGraphicsSceneMouseEvent *event)
+ 	setCursor(Qt::OpenHandCursor);
+ 
+ 	QPointF newPos = event->scenePos();
+-	qreal handleOffset = abs(newPos.x()-pos().x());
+	qreal handleOffset = std::fabs(newPos.x()-pos().x());
+ 
+ 	if (handleOffset >= std::numeric_limits<float>::epsilon())
+ 	{
+-- 
+2.15.0
+
+
+From 33cfd5801e59b6c9e34360c75112e6dcb88d807b Mon Sep 17 00:00:00 2001
+From: Marco Callieri <callieri@isti.cnr.it>
+Date: Tue, 10 Jan 2017 10:05:05 +0100
+Subject: [PATCH 2/3] again, fabs ambiguity
+
+
+diff --git a/src/meshlabplugins/edit_quality/eqhandle.cpp b/src/meshlabplugins/edit_quality/eqhandle.cpp
+index ef3d4a2d..d29f8c45 100644
+--- a/src/meshlabplugins/edit_quality/eqhandle.cpp
+++ b/src/meshlabplugins/edit_quality/eqhandle.cpp
+@@ -30,6 +30,7 @@ FIRST RELEASE
+ #include "eqhandle.h"
+ #include <QMouseEvent>
+ #include <QGraphicsSceneMouseEvent>
+#include <math.h>
+ 
+ EqHandle::EqHandle(CHART_INFO *environment_info, QColor color, QPointF position, 
+ 				   EQUALIZER_HANDLE_TYPE type, EqHandle** handles, qreal* midHandlePercentilePosition, QDoubleSpinBox* spinbox,
+@@ -83,7 +84,7 @@ void EqHandle::mouseMoveEvent(QGraphicsSceneMouseEvent *event)
+ 	setCursor(Qt::OpenHandCursor);
+ 
+ 	QPointF newPos = event->scenePos();
+-	qreal handleOffset = std::fabs(newPos.x()-pos().x());
+	qreal handleOffset = fabs(newPos.x()-pos().x());
+ 
+ 	if (handleOffset >= std::numeric_limits<float>::epsilon())
+ 	{
+-- 
+2.15.0
+
+
+From d717e44f4134ebee03322a6a2a56fce626084a3c Mon Sep 17 00:00:00 2001
+From: Patrick Chilton <chpatrick@gmail.com>
+Date: Mon, 4 Dec 2017 21:27:23 +0100
+Subject: [PATCH 3/3] io_TXT -> io_txt
+
+
+diff --git a/src/meshlab_full.pro b/src/meshlab_full.pro
+index 6ea7f1db..2a95c127 100644
+--- a/src/meshlab_full.pro
+++ b/src/meshlab_full.pro
+@@ -16,7 +16,7 @@ SUBDIRS       = common \
+                 meshlabplugins/io_x3d \
+                 meshlabplugins/io_expe \
+                 meshlabplugins/io_pdb \
+-                plugins_experimental/io_TXT \
+                plugins_experimental/io_txt \
+ # Filter plugins
+                 meshlabplugins/filter_aging \
+                 meshlabplugins/filter_ao \
+diff --git a/src/plugins_experimental/io_TXT/io_txt.cpp b/src/plugins_experimental/io_txt/io_txt.cpp
+similarity index 100%
+rename from src/plugins_experimental/io_TXT/io_txt.cpp
+rename to src/plugins_experimental/io_txt/io_txt.cpp
+diff --git a/src/plugins_experimental/io_TXT/io_txt.h b/src/plugins_experimental/io_txt/io_txt.h
+similarity index 100%
+rename from src/plugins_experimental/io_TXT/io_txt.h
+rename to src/plugins_experimental/io_txt/io_txt.h
+diff --git a/src/plugins_experimental/io_TXT/io_txt.pro b/src/plugins_experimental/io_txt/io_txt.pro
+similarity index 100%
+rename from src/plugins_experimental/io_TXT/io_txt.pro
+rename to src/plugins_experimental/io_txt/io_txt.pro
+-- 
+2.15.0
+
--- a/pkgs/applications/graphics/meshlab/include-unistd.diff
+++ b/pkgs/applications/graphics/meshlab/include-unistd.diff
@ -1,13 +0,0 @@
-*** old/vcglib/wrap/ply/plystuff.h	2013-02-09 00:00:04.110705851 -0500
--- new/vcglib/wrap/ply/plystuff.h	2013-02-09 15:20:53.482205183 -0500
-***************
-*** 75,80 ****
--- 75,81 ----
-  #define pb_close  _close
-  #define DIR_SEP "\\"
-  #else
-+ #include <unistd.h>
-  #define pb_mkdir(n)  mkdir(n,0755)
-  #define pb_access access
-  #define pb_stat   stat
-
--- a/pkgs/applications/graphics/paraview/default.nix
+++ b/pkgs/applications/graphics/paraview/default.nix
@ -1,9 +1,12 @@
-{stdenv, fetchFromGitHub, cmake
-,full, python, mesa, libXt }:
+{
+stdenv, fetchFromGitHub, cmake
+,qtbase, qttools, python, mesa
+,libXt, qtx11extras, qtxmlpatterns
+}:

 stdenv.mkDerivation rec {
  name = "paraview-${version}";
-  version = "5.4.0";
+  version = "5.4.1";

  # fetching from GitHub instead of taking an "official" source
  # tarball because of missing submodules there
@ -11,13 +14,14 @@ stdenv.mkDerivation rec {
    owner = "Kitware";
    repo = "ParaView";
    rev = "v${version}";
-    sha256 = "0h1vkgwm10mc5mnr3djp81lxr5pi0hyj776z77hiib6xm5596q9n";
+    sha256 = "1ma02sdkz2apxnwcsyvxb26ibwnjh60p71gicw6nlp042acs6v74";
    fetchSubmodules = true;
  };

   cmakeFlags = [
     "-DPARAVIEW_ENABLE_PYTHON=ON"
     "-DPARAVIEW_INSTALL_DEVELOPMENT_FILES=ON"
+     "-DPARAVIEW_ENABLE_EMBEDDED_DOCUMENTATION=OFF"
   ];

  # During build, binaries are called that rely on freshly built
@ -29,17 +33,19 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

-  buildInputs = [ cmake
-   python
-   mesa
-   libXt
+  nativeBuildInputs = [
+    cmake
+  ];

-   # theoretically the following should be fine, but there is an error
-   # due to missing libqminimal when not using qt5.full
-
-   # qtbase qtx11extras qttools
-   full
-   ];
+  buildInputs = [
+    python
+    mesa
+    libXt
+    qtbase
+    qtx11extras
+    qttools
+    qtxmlpatterns
+  ];


  meta = {
--- a/pkgs/applications/graphics/pinta/default.nix
+++ b/pkgs/applications/graphics/pinta/default.nix
@ -56,9 +56,9 @@ buildDotnetPackage rec {
    '';

  makeWrapperArgs = [
-    ''--prefix MONO_GAC_PREFIX ':' "${gtksharp}"''
-    ''--prefix LD_LIBRARY_PATH ':' "${gtksharp}/lib"''
-    ''--prefix LD_LIBRARY_PATH ':' "${gtksharp.gtk.out}/lib"''
+    ''--prefix MONO_GAC_PREFIX : ${gtksharp}''
+    ''--prefix LD_LIBRARY_PATH : ${gtksharp}/lib''
+    ''--prefix LD_LIBRARY_PATH : ${gtksharp.gtk.out}/lib''
  ];

  postInstall = ''
--- a/pkgs/applications/graphics/pqiv/default.nix
+++ b/pkgs/applications/graphics/pqiv/default.nix
@ -1,23 +1,23 @@
-{ stdenv, fetchFromGitHub, getopt, which, pkgconfig, gtk2 } :
+{ stdenv, fetchFromGitHub, getopt, which, pkgconfig, gtk3 } :

 stdenv.mkDerivation (rec {
  name = "pqiv-${version}";
-  version = "2.9";
+  version = "2.10.1";

  src = fetchFromGitHub {
    owner = "phillipberndt";
    repo = "pqiv";
    rev = version;
-    sha256 = "1xncf6aq52zpxpmz3ikmlkinz7y3nmbpgfxjb7q40sqs00n0mfsd";
+    sha256 = "06blqckj3bpbi2kl5ndv2d10r7nw62r386kfwrkic9amynlv9gki";
  };

  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ getopt which gtk2 ];
+  buildInputs = [ getopt which gtk3 ];

  prePatch = "patchShebangs .";

  meta = with stdenv.lib; {
-    description = "Rewrite of qiv (quick image viewer)";
+    description = "Powerful image viewer with minimal UI";
    homepage = http://www.pberndt.com/Programme/Linux/pqiv;
    license = licenses.gpl3;
    maintainers = [ maintainers.ndowens ];
--- a/Show More
+++ b/Show More