Merge recent 'staging' into closure-size

Let's get rid of those merge conflicts.

COPYING

@@ -1,4 +1,4 @@
-Copyright (c) 2003-2015 Eelco Dolstra and the Nixpkgs/NixOS contributors
+Copyright (c) 2003-2016 Eelco Dolstra and the Nixpkgs/NixOS contributors
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

doc/erlang-users-guide.xml

@@ -3,6 +3,23 @@
          xml:id="users-guide-to-the-erlang-infrastructure">
 
 <title>User's Guide to the Erlang Infrastructure</title>
+<section xml:id="build-tools">
+  <title>Build Tools</title>
+  <para>
+    By default Rebar3 wants to manage it's own dependencies. In the
+    normal non-Nix, this is perfectly acceptable. In the Nix world it
+    is not. To support this we have created two versions of rebar3,
+    <literal>rebar3</literal> and <literal>rebar3-open</literal>. The
+    <literal>rebar3</literal> version has been patched to remove the
+    ability to download anything from it. If you are not running it a
+    nix-shell or a nix-build then its probably not going to work for
+    you. <literal>rebar3-open</literal> is the normal, un-modified
+    rebar3. It should work exactly as would any other version of
+    rebar3. Any Erlang package should rely on
+    <literal>rebar3</literal> and thats really what you should be
+    using too.
+  </para>
+</section>
 
 <section xml:id="how-to-install-erlang-packages">
   <title>How to install Erlang packages</title>

doc/functions.xml

@@ -489,7 +489,6 @@ c = lib.makeOverridable f { a = 1; b = 2; }</programlisting>
     sha256 = "1bhw5hkz6chrnrih0ymjbmn69hyfriza2lr550xyvpdrnbzr4gk2"; <co xml:id='ex-dockerTools-pullImage-4' />
 
     indexUrl = "https://index.docker.io"; <co xml:id='ex-dockerTools-pullImage-5' />
-    registryUrl = "https://registry-1.docker.io";
     registryVersion = "v1";
   }
   </programlisting>
@@ -534,8 +533,8 @@ c = lib.makeOverridable f { a = 1; b = 2; }</programlisting>
 
    <callout arearefs='ex-dockerTools-pullImage-5'>
     <para>
-     In the above example the default values are shown for the variables <varname>indexUrl</varname>,
+     In the above example the default values are shown for the variables
-     <varname>registryUrl</varname> and <varname>registryVersion</varname>.
+     <varname>indexUrl</varname> and <varname>registryVersion</varname>.
      Hence by default the Docker.io registry is used to pull the images.
     </para>
    </callout>

doc/languages-frameworks/ruby.xml

@@ -42,5 +42,37 @@ and scalable.";
 <para>Please check in the <filename>Gemfile</filename>, <filename>Gemfile.lock</filename> and the <filename>gemset.nix</filename> so future updates can be run easily.
 </para>
 
+<para>Resulting derivations also have two helpful items, <literal>env</literal> and <literal>wrapper</literal>. The first one allows one to quickly drop into
+<command>nix-shell</command> with the specified environment present. E.g. <command>nix-shell -A sensu.env</command> would give you an environment with Ruby preset
+so it has all the libraries necessary for <literal>sensu</literal> in its paths. The second one can be used to make derivations from custom Ruby scripts which have
+<filename>Gemfile</filename>s with their dependencies specified. It is a derivation with <command>ruby</command> wrapped so it can find all the needed dependencies.
+For example, to make a derivation <literal>my-script</literal> for a <filename>my-script.rb</filename> (which should be placed in <filename>bin</filename>) you should
+run <command>bundix</command> as specified above and then use <literal>bundlerEnv</literal> lile this:</para>
+
+<programlisting>
+<![CDATA[let env = bundlerEnv {
+  name = "my-script-env";
+
+  inherit ruby;
+  gemfile = ./Gemfile;
+  lockfile = ./Gemfile.lock;
+  gemset = ./gemset.nix;
+};
+
+in stdenv.mkDerivation {
+  name = "my-script";
+
+  buildInputs = [ env.wrapper ];
+
+  script = ./my-script.rb;
+
+  buildCommand = ''
+    mkdir -p $out/bin
+    install -D -m755 $script $out/bin/my-script
+    patchShebangs $out/bin/my-script
+  '';
+}]]>
+</programlisting>
+
 </section>
 

doc/stdenv.xml

@@ -224,6 +224,63 @@ genericBuild
 
 </variablelist>
 
+<variablelist>
+  <title>Variables affecting build properties</title>
+
+  <varlistentry>
+    <term><varname>enableParallelBuilding</varname></term>
+    <listitem><para>If set, <literal>stdenv</literal> will pass specific
+    flags to <literal>make</literal> and other build tools to enable
+    parallel building with up to <literal>build-cores</literal>
+    workers.</para></listitem>
+  </varlistentry>
+
+  <varlistentry>
+    <term><varname>preferLocalBuild</varname></term>
+    <listitem><para>If set, specifies that the package is so lightweight
+    in terms of build operations (e.g. write a text file from a Nix string
+    to the store) that there's no need to look for it in binary caches --
+    it's faster to just build it locally. It also tells Hydra and other
+    facilities that this package doesn't need to be exported in binary
+    caches (noone would use it, after all).</para></listitem>
+  </varlistentry>
+
+</variablelist>
+
+<variablelist>
+  <title>Special variables</title>
+
+  <varlistentry>
+    <term><varname>passthru</varname></term>
+    <listitem><para>This is an attribute set which can be filled with arbitrary
+    values. For example:
+
+<programlisting>
+passthru = {
+  foo = "bar";
+  baz = {
+    value1 = 4;
+    value2 = 5;
+  };
+}
+</programlisting>
+
+</para>
+
+    <para>Values inside it are not passed to the builder, so you can change
+    them without triggering a rebuild. However, they can be accessed outside of a
+    derivation directly, as if they were set inside a derivation itself, e.g.
+    <literal>hello.baz.value1</literal>. We don't specify any usage or
+    schema of <literal>passthru</literal> - it is meant for values that would be
+    useful outside the derivation in other parts of a Nix expression (e.g. in other
+    derivations). An example would be to convey some specific dependency of your
+    derivation which contains a program with plugins support.  Later, others who
+    make derivations with plugins can use passed-through dependency to ensure that
+    their plugin would be binary-compatible with built program.</para></listitem>
+  </varlistentry>
+
+</variablelist>
+
 </section>
 
 
@@ -1186,6 +1243,14 @@ echo @foo@
     environment variable.</para></listitem>
   </varlistentry>
 
+  <varlistentry>
+    <term>Autoconf</term>
+    <listitem><para>The <varname>autoreconfHook</varname> derivation adds
+    <varname>autoreconfPhase</varname>, which runs autoreconf, libtoolize and
+    automake, essentially preparing the configure script in autotools-based
+    builds.</para></listitem>
+  </varlistentry>
+
   <varlistentry>
     <term>libxml2</term>
     <listitem><para>Adds every file named

lib/maintainers.nix

@@ -7,6 +7,7 @@
      so it's easy to ping a package @maintainer.
   */
 
+  aaronschif = "Aaron Schif <aaronschif@gmail.com>";
   a1russell = "Adam Russell <adamlr6+pub@gmail.com>";
   abaldeau = "Andreas Baldeau <andreas@baldeau.net>";
   abbradar = "Nikolay Amiantov <ab@fmap.me>";
@@ -65,6 +66,7 @@
   chattered = "Phil Scott <me@philscotted.com>";
   christopherpoole = "Christopher Mark Poole <mail@christopherpoole.net>";
   coconnor = "Corey O'Connor <coreyoconnor@gmail.com>";
+  codsl = "codsl <codsl@riseup.net>";
   codyopel = "Cody Opel <codyopel@gmail.com>";
   copumpkin = "Dan Peebles <pumpkingod@gmail.com>";
   coroa = "Jonas Hörsch <jonas@chaoflow.net>";
@@ -288,6 +290,7 @@
   smironov = "Sergey Mironov <ierton@gmail.com>";
   spacefrogg = "Michael Raitza <spacefrogg-nixos@meterriblecrew.net>";
   spencerjanssen = "Spencer Janssen <spencerjanssen@gmail.com>";
+  spinus = "Tomasz Czyż <tomasz.czyz@gmail.com>";
   sprock = "Roger Mason <rmason@mun.ca>";
   spwhitt = "Spencer Whitt <sw@swhitt.me>";
   stephenmw = "Stephen Weinberg <stephen@q5comm.com>";
@@ -338,6 +341,7 @@
   zagy = "Christian Zagrodnick <cz@flyingcircus.io>";
   zef = "Zef Hemel <zef@zef.me>";
   zimbatm = "zimbatm <zimbatm@zimbatm.com>";
+  zohl = "Al Zohali <zohl@fmap.me>";
   zoomulator = "Kim Simmons <zoomulator@gmail.com>";
   Gonzih = "Max Gonzih <gonzih@gmail.com>";
 }

nixos/doc/manual/configuration/user-mgmt.xml

@@ -65,6 +65,14 @@ account named <literal>alice</literal>:
 <screen>
 $ useradd -m alice</screen>
 
+To make all nix tools available to this new user use `su - USER` which 
+opens a login shell (==shell that loads the profile) for given user. 
+This will create the ~/.nix-defexpr symlink. So run:
+
+<screen>
+$ su - alice -c "true"</screen>
+
+
 The flag <option>-m</option> causes the creation of a home directory
 for the new user, which is generally what you want.  The user does not
 have an initial password and therefore cannot log in.  A password can

nixos/doc/manual/default.nix

@@ -1,4 +1,4 @@
-{ pkgs, options, version, revision }:
+{ pkgs, options, version, revision, extraSources ? [] }:
 
 with pkgs;
 with pkgs.lib;
@@ -17,19 +17,27 @@ let
 
   # Clean up declaration sites to not refer to the NixOS source tree.
   optionsList' = flip map optionsList (opt: opt // {
-    declarations = map (fn: stripPrefix fn) opt.declarations;
+    declarations = map (fn: stripAnyPrefixes fn) opt.declarations;
   }
   // optionalAttrs (opt ? example) { example = substFunction opt.example; }
   // optionalAttrs (opt ? default) { default = substFunction opt.default; }
   // optionalAttrs (opt ? type) { type = substFunction opt.type; });
 
-  prefix = toString ../../..;
+  # We need to strip references to /nix/store/* from options,
+  # including any `extraSources` if some modules came from elsewhere,
+  # or else the build will fail.
+  #
+  # E.g. if some `options` came from modules in ${pkgs.customModules}/nix,
+  # you'd need to include `extraSources = [ "#{pkgs.customModules}" ]`
+  herePrefix = toString ../../..;
+  prefixesToStrip = [ herePrefix ] ++ extraSources;
 
-  stripPrefix = fn:
+  stripAnyPrefixes = fn:
-    if substring 0 (stringLength prefix) fn == prefix then
+    flip (flip fold fn) prefixesToStrip (fn: prefix:
-      substring (stringLength prefix + 1) 1000 fn
+      if substring 0 (stringLength prefix) fn == prefix then
-    else
+        substring (stringLength prefix + 1) 1000 fn
-      fn;
+      else
+        fn);
 
   # Convert the list of options into an XML file.
   optionsXML = builtins.toFile "options.xml" (builtins.toXML optionsList');

nixos/doc/manual/development/writing-modules.xml

@@ -107,12 +107,12 @@ the file system.  This module declares two options that can be defined
 by other modules (typically the user’s
 <filename>configuration.nix</filename>):
 <option>services.locate.enable</option> (whether the database should
-be updated) and <option>services.locate.period</option> (when the
+be updated) and <option>services.locate.interval</option> (when the
 update should be done).  It implements its functionality by defining
 two options declared by other modules:
 <option>systemd.services</option> (the set of all systemd services)
-and <option>services.cron.systemCronJobs</option> (the list of
+and <option>systemd.timers</option> (the list of commands to be
-commands to be executed periodically by <command>cron</command>).</para>
+executed periodically by <command>systemd</command>).</para>
 
 <example xml:id='locate-example'><title>NixOS Module for the “locate” Service</title>
 <programlisting>
@@ -120,53 +120,59 @@ commands to be executed periodically by <command>cron</command>).</para>
 
 with lib;
 
-let locatedb = "/var/cache/locatedb"; in
+let
-
+  cfg = config.services.locate;
-{
+in {
-  options = {
+  options.services.locate = {
-
+    enable = mkOption {
-    services.locate = {
+      type = types.bool;
-
+      default = false;
-      enable = mkOption {
+      description = ''
-        type = types.bool;
+        If enabled, NixOS will periodically update the database of
-        default = false;
+        files used by the <command>locate</command> command.
-        description = ''
+      '';
-          If enabled, NixOS will periodically update the database of
-          files used by the <command>locate</command> command.
-        '';
-      };
-
-      period = mkOption {
-        type = types.str;
-        default = "15 02 * * *";
-        description = ''
-          This option defines (in the format used by cron) when the
-          locate database is updated.  The default is to update at
-          02:15 at night every day.
-        '';
-      };
-
     };
 
+    interval = mkOption {
+      type = types.str;
+      default = "02:15";
+      example = "hourly";
+      description = ''
+        Update the locate database at this interval. Updates by
+        default at 2:15 AM every day.
+
+        The format is described in
+        <citerefentry><refentrytitle>systemd.time</refentrytitle>
+        <manvolnum>7</manvolnum></citerefentry>.
+      '';
+    };
+
+    # Other options omitted for documentation
   };
 
   config = {
-
     systemd.services.update-locatedb =
       { description = "Update Locate Database";
         path  = [ pkgs.su ];
         script =
           ''
-            mkdir -m 0755 -p $(dirname ${locatedb})
+            mkdir -m 0755 -p $(dirname ${toString cfg.output})
-            exec updatedb --localuser=nobody --output=${locatedb} --prunepaths='/tmp /var/tmp /run'
+            exec updatedb \
+              --localuser=${cfg.localuser} \
+              ${optionalString (!cfg.includeStore) "--prunepaths='/nix/store'"} \
+              --output=${toString cfg.output} ${concatStringsSep " " cfg.extraFlags}
           '';
       };
 
-    services.cron.systemCronJobs = optional config.services.locate.enable
+    systemd.timers.update-locatedb = mkIf cfg.enable
-      "${config.services.locate.period} root ${config.systemd.package}/bin/systemctl start update-locatedb.service";
+      { description = "Update timer for locate database";
-
+        partOf      = [ "update-locatedb.service" ];
+        wantedBy    = [ "timers.target" ];
+        timerConfig.OnCalendar = cfg.interval;
+      };
   };
-}</programlisting>
+}
+</programlisting>
 </example>
 
 <xi:include href="option-declarations.xml" />

nixos/doc/manual/release-notes/rl-unstable.xml

@@ -145,6 +145,41 @@ nginx.override {
     from the ELPA, MELPA, and MELPA Stable repositories.
     </para>
   </listitem>
+
+  <listitem>
+    <para>Data directory for Postfix MTA server is moved from
+    <filename>/var/postfix</filename> to <filename>/var/lib/postfix</filename>.
+    Old configurations are migrated automatically. <literal>service.postfix</literal>
+    module has also received many improvements, such as correct directories' access
+    rights, new <literal>aliasFiles</literal> and <literal>mapFiles</literal>
+    options and more.</para>
+  </listitem>
+
+  <listitem>
+    <para>CUPS, installed by <literal>services.printing</literal> module, now
+    has its data directory in <filename>/var/lib/cups</filename>. Old
+    configurations from <filename>/etc/cups</filename> are moved there
+    automatically, but there might be problems. Also configuration options
+    <literal>services.printing.cupsdConf</literal> and
+    <literal>services.printing.cupsdFilesConf</literal> were removed
+    because they had been allowing one to override configuration variables
+    required for CUPS to work at all on NixOS. For most use cases,
+    <literal>services.printing.extraConf</literal> and new option
+    <literal>services.printing.extraFilesConf</literal> should be enough;
+    if you encounter a situation when they are not, please file a bug.</para>
+
+    <para>There are also Gutenprint improvements; in particular, a new option
+    <literal>services.printing.gutenprint</literal> is added to enable automatic
+    updating of Gutenprint PPMs; it's greatly recommended to enable it instead
+    of adding <literal>gutenprint</literal> to the <literal>drivers</literal> list.
+    </para>
+  </listitem>
+
+  <listitem>
+    <para><literal>services.xserver.vaapiDrivers</literal> has been removed. Use
+    <literal>services.hardware.opengl.extraPackages{,32}</literal> instead. You can
+    also specify VDPAU drivers there.</para>
+  </listitem>
 </itemizedlist>
 
 
@@ -158,6 +193,11 @@ nginx.override {
     <command>nix-shell</command> (without installing anything). </para>
   </listitem>
 
+  <listitem>
+    <para><literal>ejabberd</literal> module is brought back and now works on
+    NixOS.</para>
+  </listitem>
+
 </itemizedlist></para>
 
 </section>

nixos/modules/config/fonts/fontconfig.nix

@@ -129,6 +129,14 @@ with lib;
 
         };
 
+        cache32Bit = mkOption {
+          default = false;
+          type = types.bool;
+          description = ''
+            Generate system fonts cache for 32-bit applications.
+          '';
+        };
+
       };
 
     };
@@ -231,12 +239,19 @@ with lib;
         "${pkgs.fontconfig.out}/etc/fonts/fonts.conf";
 
       environment.etc."fonts/${pkgs.fontconfig.configVersion}/conf.d/00-nixos.conf".text =
-        ''
+        let
+          cache = fontconfig: pkgs.makeFontsCache { inherit fontconfig; fontDirectories = config.fonts.fonts; };
+        in ''
           <?xml version='1.0'?>
           <!DOCTYPE fontconfig SYSTEM 'fonts.dtd'>
           <fontconfig>
             <!-- Font directories -->
             ${concatStringsSep "\n" (map (font: "<dir>${font}</dir>") config.fonts.fonts)}
+            <!-- Pre-generated font caches -->
+            <cachedir>${cache pkgs.fontconfig}</cachedir>
+            ${optionalString (pkgs.stdenv.isx86_64 && config.fonts.fontconfig.cache32Bit) ''
+              <cachedir>${cache pkgs.pkgsi686Linux.fontconfig}</cachedir>
+            ''}
           </fontconfig>
         '';
 

nixos/modules/config/networking.nix

@@ -39,6 +39,17 @@ in
       '';
     };
 
+    networking.dnsExtensionMechanism = lib.mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Enable the <code>edns0</code> option in <filename>resolv.conf</filename>. With
+        that option set, <code>glibc</code> supports use of the extension mechanisms for
+        DNS (EDNS) specified in RFC 2671. The most popular user of that feature is DNSSEC,
+        which does not work without it.
+      '';
+    };
+
     networking.extraResolvconfConf = lib.mkOption {
       type = types.lines;
       default = "";
@@ -162,7 +173,10 @@ in
               libc_restart='${pkgs.systemd}/bin/systemctl try-restart --no-block nscd.service 2> /dev/null'
             '' + optionalString cfg.dnsSingleRequest ''
               # only send one DNS request at a time
-              resolv_conf_options='single-request'
+              resolv_conf_options+=' single-request'
+            '' + optionalString cfg.dnsExtensionMechanism ''
+              # enable extension mechanisms for DNS
+              resolv_conf_options+=' edns0'
             '' + optionalString hasLocalResolver ''
               # This hosts runs a full-blown DNS resolver.
               name_servers='127.0.0.1'

nixos/modules/hardware/opengl.nix

@@ -10,7 +10,7 @@ let
 
   videoDrivers = config.services.xserver.videoDrivers;
 
-  makePackage = p: p.buildEnv {
+  makePackage = p: pkgs.buildEnv {
     name = "mesa-drivers+txc-${p.mesa_drivers.version}";
     paths =
       [ p.mesa_drivers
@@ -19,6 +19,16 @@ let
       ];
   };
 
+  package = pkgs.buildEnv {
+    name = "opengl-drivers";
+    paths = [ cfg.package ] ++ cfg.extraPackages;
+  };
+
+  package32 = pkgs.buildEnv {
+    name = "opengl-drivers-32bit";
+    paths = [ cfg.package32 ] ++ cfg.extraPackages32;
+  };
+
 in
 
 {
@@ -75,11 +85,32 @@ in
       internal = true;
       description = ''
         The package that provides the 32-bit OpenGL implementation on
-        64-bit systems.  Used when <option>driSupport32Bit</option> is
+        64-bit systems. Used when <option>driSupport32Bit</option> is
         set.
       '';
     };
 
+    hardware.opengl.extraPackages = mkOption {
+      type = types.listOf types.package;
+      default = [];
+      example = literalExample "with pkgs; [ vaapiIntel libvdpau-va-gl vaapiVdpau ]";
+      description = ''
+        Additional packages to add to OpenGL drivers. This can be used
+        to add additional VA-API/VDPAU drivers.
+      '';
+    };
+
+    hardware.opengl.extraPackages32 = mkOption {
+      type = types.listOf types.package;
+      default = [];
+      example = literalExample "with pkgs; [ vaapiIntel libvdpau-va-gl vaapiVdpau ]";
+      description = ''
+        Additional packages to add to 32-bit OpenGL drivers on
+        64-bit systems. Used when <option>driSupport32Bit</option> is
+        set. This can be used to add additional VA-API/VDPAU drivers.
+      '';
+    };
+
   };
 
   config = mkIf cfg.enable {
@@ -91,11 +122,11 @@ in
 
     system.activationScripts.setup-opengl =
       ''
-        ln -sfn ${cfg.package} /run/opengl-driver
+        ln -sfn ${package} /run/opengl-driver
         ${if pkgs.stdenv.isi686 then ''
           ln -sfn opengl-driver /run/opengl-driver-32
         '' else if cfg.driSupport32Bit then ''
-          ln -sfn ${cfg.package32} /run/opengl-driver-32
+          ln -sfn ${package32} /run/opengl-driver-32
         '' else ''
           rm -f /run/opengl-driver-32
         ''}

nixos/modules/installer/tools/nixos-generate-config.pl

@@ -148,7 +148,7 @@ sub pciCheck {
          $device eq "0x4331" || $device eq "0x43a0" || $device eq "0x43b1"
         ) )
      {
-        push @modulePackages, "\${config.boot.kernelPackages.broadcom_sta}";
+        push @modulePackages, "config.boot.kernelPackages.broadcom_sta";
         push @kernelModules, "wl";
      }
 
@@ -422,13 +422,20 @@ EOF
 
 # Generate the hardware configuration file.
 
-sub toNixExpr {
+sub toNixStringList {
     my $res = "";
     foreach my $s (@_) {
         $res .= " \"$s\"";
     }
     return $res;
 }
+sub toNixList {
+    my $res = "";
+    foreach my $s (@_) {
+        $res .= " $s";
+    }
+    return $res;
+}
 
 sub multiLineList {
     my $indent = shift;
@@ -444,9 +451,9 @@ sub multiLineList {
     return $res;
 }
 
-my $initrdAvailableKernelModules = toNixExpr(uniq @initrdAvailableKernelModules);
+my $initrdAvailableKernelModules = toNixStringList(uniq @initrdAvailableKernelModules);
-my $kernelModules = toNixExpr(uniq @kernelModules);
+my $kernelModules = toNixStringList(uniq @kernelModules);
-my $modulePackages = toNixExpr(uniq @modulePackages);
+my $modulePackages = toNixList(uniq @modulePackages);
 
 my $fsAndSwap = "";
 if (!$noFilesystems) {

nixos/modules/installer/tools/nixos-rebuild.sh

@@ -19,6 +19,8 @@ rollback=
 upgrade=
 repair=
 profile=/nix/var/nix/profiles/system
+buildHost=
+targetHost=
 
 while [ "$#" -gt 0 ]; do
     i="$1"; shift 1
@@ -73,6 +75,14 @@ while [ "$#" -gt 0 ]; do
         fi
         shift 1
         ;;
+      --build-host|h)
+        buildHost="$1"
+        shift 1
+        ;;
+      --target-host|t)
+        targetHost="$1"
+        shift 1
+        ;;
       *)
         echo "$0: unknown option \`$i'"
         exit 1
@@ -80,6 +90,90 @@ while [ "$#" -gt 0 ]; do
     esac
 done
 
+
+if [ -z "$buildHost" -a -n "$targetHost" ]; then
+    buildHost="$targetHost"
+fi
+if [ "$targetHost" = localhost ]; then
+    targetHost=
+fi
+if [ "$buildHost" = localhost ]; then
+    buildHost=
+fi
+
+buildHostCmd() {
+    if [ -z "$buildHost" ]; then
+        "$@"
+    elif [ -n "$remoteNix" ]; then
+        ssh $SSHOPTS "$buildHost" PATH="$remoteNix:$PATH" "$@"
+    else
+        ssh $SSHOPTS "$buildHost" "$@"
+    fi
+}
+
+targetHostCmd() {
+    if [ -z "$targetHost" ]; then
+        "$@"
+    else
+        ssh $SSHOPTS "$targetHost" "$@"
+    fi
+}
+
+copyToTarget() {
+    if ! [ "$targetHost" = "$buildHost" ]; then
+        if [ -z "$targetHost" ]; then
+            NIX_SSHOPTS=$SSH_OPTS nix-copy-closure --from "$buildHost" "$1"
+        elif [ -z "$buildHost" ]; then
+            NIX_SSHOPTS=$SSH_OPTS nix-copy-closure --to "$targetHost" "$1"
+        else
+            buildHostCmd nix-copy-closure --to "$targetHost" "$1"
+        fi
+    fi
+}
+
+nixBuild() {
+    if [ -z "$buildHost" ]; then
+        nix-build "$@"
+    else
+        local instArgs=()
+        local buildArgs=()
+
+        while [ "$#" -gt 0 ]; do
+            local i="$1"; shift 1
+            case "$i" in
+              -o)
+                local out="$1"; shift 1
+                buildArgs+=("--add-root" "$out" "--indirect")
+                ;;
+              -A)
+                local j="$1"; shift 1
+                instArgs+=("$i" "$j")
+                ;;
+              -I)
+                # We don't want this in buildArgs
+                shift 1
+                ;;
+              "<"*) # nix paths
+                instArgs+=("$i")
+                ;;
+              *)
+                buildArgs+=("$i")
+                ;;
+            esac
+        done
+
+        local drv="$(nix-instantiate "${instArgs[@]}" "${extraBuildFlags[@]}")"
+        if [ -a "$drv" ]; then
+            NIX_SSHOPTS=$SSH_OPTS nix-copy-closure --to "$buildHost" "$drv"
+            buildHostCmd nix-store -r "$drv" "${buildArgs[@]}"
+        else
+            echo "nix-instantiate failed"
+            exit 1
+        fi
+  fi
+}
+
+
 if [ -z "$action" ]; then showSyntax; fi
 
 # Only run shell scripts from the Nixpkgs tree if the action is
@@ -128,7 +222,16 @@ fi
 
 
 tmpDir=$(mktemp -t -d nixos-rebuild.XXXXXX)
-trap 'rm -rf "$tmpDir"' EXIT
+SSHOPTS="$NIX_SSHOPTS -o ControlMaster=auto -o ControlPath=$tmpDir/ssh-%n -o ControlPersist=60"
+
+cleanup() {
+    for ctrl in "$tmpDir"/ssh-*; do
+        ssh -o ControlPath="$ctrl" -O exit dummyhost 2>/dev/null || true
+    done
+    rm -rf "$tmpDir"
+}
+trap cleanup EXIT
+
 
 
 # If the Nix daemon is running, then use it.  This allows us to use
@@ -150,30 +253,56 @@ if [ -n "$rollback" -o "$action" = dry-build ]; then
     buildNix=
 fi
 
+prebuiltNix() {
+    machine="$1"
+    if [ "$machine" = x86_64 ]; then
+        return /nix/store/xryr9g56h8yjddp89d6dw12anyb4ch7c-nix-1.10
+    elif [[ "$machine" =~ i.86 ]]; then
+        return /nix/store/2w92k5wlpspf0q2k9mnf2z42prx3bwmv-nix-1.10
+    else
+        echo "$0: unsupported platform"
+        exit 1
+    fi
+}
+
+remotePATH=
+
 if [ -n "$buildNix" ]; then
     echo "building Nix..." >&2
-    if ! nix-build '<nixpkgs/nixos>' -A config.nix.package -o $tmpDir/nix "${extraBuildFlags[@]}" > /dev/null; then
+    nixDrv=
-        if ! nix-build '<nixpkgs/nixos>' -A nixFallback -o $tmpDir/nix "${extraBuildFlags[@]}" > /dev/null; then
+    if ! nixDrv="$(nix-instantiate '<nixpkgs/nixos>' --add-root $tmpDir/nix.drv --indirect -A config.nix.package "${extraBuildFlags[@]}")"; then
-            if ! nix-build '<nixpkgs>' -A nix -o $tmpDir/nix "${extraBuildFlags[@]}" > /dev/null; then
+        if ! nixDrv="$(nix-instantiate '<nixpkgs/nixos>' --add-root $tmpDir/nix.drv --indirect -A nixFallback "${extraBuildFlags[@]}")"; then
-                machine="$(uname -m)"
+            if ! nixDrv="$(nix-instantiate '<nixpkgs>' --add-root $tmpDir/nix.drv --indirect -A nix "${extraBuildFlags[@]}")"; then
-                if [ "$machine" = x86_64 ]; then
+                nixStorePath="$(prebuiltNix "$(uname -m)")"
-                    nixStorePath=/nix/store/xryr9g56h8yjddp89d6dw12anyb4ch7c-nix-1.10
-                elif [[ "$machine" =~ i.86 ]]; then
-                    nixStorePath=/nix/store/2w92k5wlpspf0q2k9mnf2z42prx3bwmv-nix-1.10
-                else
-                    echo "$0: unsupported platform"
-                    exit 1
-                fi
                 if ! nix-store -r $nixStorePath --add-root $tmpDir/nix --indirect \
                     --option extra-binary-caches https://cache.nixos.org/; then
                     echo "warning: don't know how to get latest Nix" >&2
                 fi
                 # Older version of nix-store -r don't support --add-root.
                 [ -e $tmpDir/nix ] || ln -sf $nixStorePath $tmpDir/nix
+                if [ -n "$buildHost" ]; then
+                    remoteNixStorePath="$(prebuiltNix "$(buildHostCmd uname -m)")"
+                    remoteNix="$remoteNixStorePath/bin"
+                    if ! buildHostCmd nix-store -r $remoteNixStorePath \
+                      --option extra-binary-caches https://cache.nixos.org/ >/dev/null; then
+                        remoteNix=
+                        echo "warning: don't know how to get latest Nix" >&2
+                    fi
+                fi
             fi
         fi
     fi
-    PATH=$tmpDir/nix/bin:$PATH
+    if [ -a "$nixDrv" ]; then
+        nix-store -r "$nixDrv"'!'"out" --add-root $tmpDir/nix --indirect >/dev/null
+        if [ -n "$buildHost" ]; then
+            nix-copy-closure --to "$buildHost" "$nixDrv"
+            # The nix build produces multiple outputs, we add them all to the remote path
+            for p in $(buildHostCmd nix-store -r "$(readlink "$nixDrv")" "${buildArgs[@]}"); do
+                remoteNix="$remoteNix${remoteNix:+:}$p/bin"
+            done
+        fi
+    fi
+    PATH="$tmpDir/nix/bin:$PATH"
 fi
 
 
@@ -200,31 +329,35 @@ fi
 if [ -z "$rollback" ]; then
     echo "building the system configuration..." >&2
     if [ "$action" = switch -o "$action" = boot ]; then
-        nix-env "${extraBuildFlags[@]}" -p "$profile" -f '<nixpkgs/nixos>' --set -A system
+        pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A system "${extraBuildFlags[@]}")"
-        pathToConfig="$profile"
+        copyToTarget "$pathToConfig"
+        targetHostCmd nix-env -p "$profile" --set "$pathToConfig"
     elif [ "$action" = test -o "$action" = build -o "$action" = dry-build -o "$action" = dry-activate ]; then
-        nix-build '<nixpkgs/nixos>' -A system -k "${extraBuildFlags[@]}" > /dev/null
+        pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A system -k "${extraBuildFlags[@]}")"
-        pathToConfig=./result
     elif [ "$action" = build-vm ]; then
-        nix-build '<nixpkgs/nixos>' -A vm -k "${extraBuildFlags[@]}" > /dev/null
+        pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A vm -k "${extraBuildFlags[@]}")"
-        pathToConfig=./result
     elif [ "$action" = build-vm-with-bootloader ]; then
-        nix-build '<nixpkgs/nixos>' -A vmWithBootLoader -k "${extraBuildFlags[@]}" > /dev/null
+        pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A vmWithBootLoader -k "${extraBuildFlags[@]}")"
-        pathToConfig=./result
     else
         showSyntax
     fi
+    # Copy build to target host if we haven't already done it
+    if ! [ "$action" = switch -o "$action" = boot ]; then
+        copyToTarget "$pathToConfig"
+    fi
 else # [ -n "$rollback" ]
     if [ "$action" = switch -o "$action" = boot ]; then
-        nix-env --rollback -p "$profile"
+        targetHostCmd nix-env --rollback -p "$profile"
         pathToConfig="$profile"
     elif [ "$action" = test -o "$action" = build ]; then
         systemNumber=$(
-            nix-env -p "$profile" --list-generations |
+            targetHostCmd nix-env -p "$profile" --list-generations |
             sed -n '/current/ {g; p;}; s/ *\([0-9]*\).*/\1/; h'
         )
-        ln -sT "$profile"-${systemNumber}-link ./result
+        pathToConfig="$profile"-${systemNumber}-link
-        pathToConfig=./result
+        if [ -z "$targetHost" ]; then
+            ln -sT "$pathToConfig" ./result
+        fi
     else
         showSyntax
     fi
@@ -234,7 +367,7 @@ fi
 # If we're not just building, then make the new configuration the boot
 # default and/or activate it now.
 if [ "$action" = switch -o "$action" = boot -o "$action" = test -o "$action" = dry-activate ]; then
-    if ! $pathToConfig/bin/switch-to-configuration "$action"; then
+    if ! targetHostCmd $pathToConfig/bin/switch-to-configuration "$action"; then
         echo "warning: error(s) occurred while switching to the new configuration" >&2
         exit 1
     fi

nixos/modules/misc/locate.nix

@@ -1,76 +1,74 @@
-{ config, lib, pkgs, ... }:
+{ config, options, lib, pkgs, ... }:
 
 with lib;
 
 let
   cfg = config.services.locate;
 in {
-
+  options.services.locate = {
-  ###### interface
+    enable = mkOption {
-
+      type = types.bool;
-  options = {
+      default = false;
-
+      description = ''
-    services.locate = {
+        If enabled, NixOS will periodically update the database of
-
+        files used by the <command>locate</command> command.
-      enable = mkOption {
+      '';
-        type = types.bool;
-        default = false;
-        description = ''
-          If enabled, NixOS will periodically update the database of
-          files used by the <command>locate</command> command.
-        '';
-      };
-
-      period = mkOption {
-        type = types.str;
-        default = "15 02 * * *";
-        description = ''
-          This option defines (in the format used by cron) when the
-          locate database is updated.
-          The default is to update at 02:15 at night every day.
-        '';
-      };
-
-      extraFlags = mkOption {
-        type = types.listOf types.str;
-        default = [ ];
-        description = ''
-          Extra flags to pass to <command>updatedb</command>.
-        '';
-      };
-
-      output = mkOption {
-        type = types.path;
-        default = "/var/cache/locatedb";
-        description = ''
-          The database file to build.
-        '';
-      };
-
-      localuser = mkOption {
-        type = types.str;
-        default = "nobody";
-        description = ''
-          The user to search non-network directories as, using
-          <command>su</command>.
-        '';
-      };
-
-      includeStore = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Whether to include <filename>/nix/store</filename> in the locate database.
-        '';
-      };
-
     };
 
+    interval = mkOption {
+      type = types.str;
+      default = "02:15";
+      example = "hourly";
+      description = ''
+        Update the locate database at this interval. Updates by
+        default at 2:15 AM every day.
+
+        The format is described in
+        <citerefentry><refentrytitle>systemd.time</refentrytitle>
+        <manvolnum>7</manvolnum></citerefentry>.
+      '';
+    };
+
+    # This is no longer supported, but we keep it to give a better warning below
+    period = mkOption { visible = false; };
+
+    extraFlags = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      description = ''
+        Extra flags to pass to <command>updatedb</command>.
+      '';
+    };
+
+    output = mkOption {
+      type = types.path;
+      default = "/var/cache/locatedb";
+      description = ''
+        The database file to build.
+      '';
+    };
+
+    localuser = mkOption {
+      type = types.str;
+      default = "nobody";
+      description = ''
+        The user to search non-network directories as, using
+        <command>su</command>.
+      '';
+    };
+
+    includeStore = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Whether to include <filename>/nix/store</filename> in the locate database.
+      '';
+    };
   };
 
-  ###### implementation
-
   config = {
+    warnings = let opt = options.services.locate.period; in optional opt.isDefined "The `period` definition in ${showFiles opt.files} has been removed; please replace it with `interval`, using the new systemd.time interval specifier.";
+
     systemd.services.update-locatedb =
       { description = "Update Locate Database";
         path  = [ pkgs.su ];
@@ -84,11 +82,18 @@ in {
           '';
         serviceConfig.Nice = 19;
         serviceConfig.IOSchedulingClass = "idle";
+        serviceConfig.PrivateTmp = "yes";
+        serviceConfig.PrivateNetwork = "yes";
+        serviceConfig.NoNewPrivileges = "yes";
+        serviceConfig.ReadOnlyDirectories = "/";
+        serviceConfig.ReadWriteDirectories = cfg.output;
       };
 
-    services.cron.systemCronJobs = optional config.services.locate.enable
+    systemd.timers.update-locatedb = mkIf cfg.enable
-      "${config.services.locate.period} root ${config.systemd.package}/bin/systemctl start update-locatedb.service";
+      { description = "Update timer for locate database";
-
+        partOf      = [ "update-locatedb.service" ];
+        wantedBy    = [ "timers.target" ];
+        timerConfig.OnCalendar = cfg.interval;
+      };
   };
-
 }

nixos/modules/programs/ssh.nix

@@ -221,10 +221,7 @@ in
         fi
       '';
 
-    environment.interactiveShellInit = optionalString config.services.xserver.enable
+    environment.variables.SSH_ASKPASS = optionalString config.services.xserver.enable askPassword;
-      ''
-        export SSH_ASKPASS=${askPassword}
-      '';
 
     programs.ssh.askPassword = mkDefault "${pkgs.x11_ssh_askpass}/libexec/x11-ssh-askpass";
 

nixos/modules/programs/venus.nix

@@ -165,7 +165,7 @@ in
         script = "exec venus-planet ${configFile}";
         serviceConfig.User = "${cfg.user}";
         serviceConfig.Group = "${cfg.group}";
-        environment.SSL_CERT_FILE = "/etc/ssl/certs/ca-bundle.crt";
+        environment.SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
         startAt = cfg.dates;
       };
 

nixos/modules/rename.nix

@@ -77,6 +77,7 @@ with lib;
     (mkRenamedOptionModule [ "services" "xserver" "driSupport32Bit" ] [ "hardware" "opengl" "driSupport32Bit" ])
     (mkRenamedOptionModule [ "services" "xserver" "s3tcSupport" ] [ "hardware" "opengl" "s3tcSupport" ])
     (mkRenamedOptionModule [ "hardware" "opengl" "videoDrivers" ] [ "services" "xserver" "videoDrivers" ])
+    (mkRenamedOptionModule [ "services" "xserver" "vaapiDrivers" ] [ "hardware" "opengl" "extraPackages" ])
 
     (mkRenamedOptionModule [ "services" "mysql55" ] [ "services" "mysql" ])
 
@@ -99,6 +100,8 @@ with lib;
     (mkRemovedOptionModule [ "services" "syslog-ng" "listenToJournal" ])
     (mkRemovedOptionModule [ "ec2" "metadata" ])
     (mkRemovedOptionModule [ "services" "openvpn" "enable" ])
+    (mkRemovedOptionModule [ "services" "printing" "cupsFilesConf" ])
+    (mkRemovedOptionModule [ "services" "printing" "cupsdConf" ])
 
   ];
 }

nixos/modules/security/audit.nix

@@ -93,9 +93,11 @@ in {
 
   config = mkIf (cfg.enable == "lock" || cfg.enable) {
     systemd.services.audit = {
-      description = "pseudo-service representing the kernel audit state";
+      description = "Kernel Auditing";
       wantedBy = [ "basic.target" ];
 
+      unitConfig.ConditionVirtualization = "!container";
+
       path = [ pkgs.audit ];
 
       serviceConfig = {

nixos/modules/security/ca.nix

@@ -4,7 +4,7 @@ with lib;
 
 let
 
-  caBundle = pkgs.runCommand "ca-bundle.crt"
+  caCertificates = pkgs.runCommand "ca-certificates.crt"
     { files =
         config.security.pki.certificateFiles ++
         [ (builtins.toFile "extra.crt" (concatStringsSep "\n" config.security.pki.certificates)) ];
@@ -26,7 +26,7 @@ in
       description = ''
         A list of files containing trusted root certificates in PEM
         format. These are concatenated to form
-        <filename>/etc/ssl/certs/ca-bundle.crt</filename>, which is
+        <filename>/etc/ssl/certs/ca-certificates.crt</filename>, which is
         used by many programs that use OpenSSL, such as
         <command>curl</command> and <command>git</command>.
       '';
@@ -56,13 +56,13 @@ in
     security.pki.certificateFiles = [ "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt" ];
 
     # NixOS canonical location + Debian/Ubuntu/Arch/Gentoo compatibility.
-    environment.etc."ssl/certs/ca-certificates.crt".source = caBundle;
+    environment.etc."ssl/certs/ca-certificates.crt".source = caCertificates;
 
     # Old NixOS compatibility.
-    environment.etc."ssl/certs/ca-bundle.crt".source = caBundle;
+    environment.etc."ssl/certs/ca-bundle.crt".source = caCertificates;
 
     # CentOS/Fedora compatibility.
-    environment.etc."pki/tls/certs/ca-bundle.crt".source = caBundle;
+    environment.etc."pki/tls/certs/ca-bundle.crt".source = caCertificates;
 
     environment.sessionVariables =
       { SSL_CERT_FILE          = "/etc/ssl/certs/ca-certificates.crt";

nixos/modules/services/mail/dovecot.nix

@@ -9,16 +9,10 @@ let
   baseDir = "/run/dovecot2";
   stateDir = "/var/lib/dovecot";
 
-  protocols = concatStrings [
-    (optionalString cfg.enableImap "imap")
-    (optionalString cfg.enablePop3 "pop3")
-    (optionalString cfg.enableLmtp "lmtp")
-  ];
-
   dovecotConf = concatStrings [
     ''
       base_dir = ${baseDir}
-      protocols = ${protocols}
+      protocols = ${concatStringsSep " " cfg.protocols}
     ''
 
     (if isNull cfg.sslServerCert then ''
@@ -33,6 +27,8 @@ let
 
     ''
       default_internal_user = ${cfg.user}
+      ${optionalString (cfg.mailUser != null) "mail_uid = ${cfg.mailUser}"}
+      ${optionalString (cfg.mailGroup != null) "mail_gid = ${cfg.mailGroup}"}
 
       mail_location = ${cfg.mailLocation}
 
@@ -57,11 +53,17 @@ let
       }
     '')
 
+    (optionalString (cfg.sieveScripts != {}) ''
+      plugin {
+        ${concatStringsSep "\n" (mapAttrsToList (to: from: "sieve_${to} = ${stateDir}/sieve/${to}") cfg.sieveScripts)}
+      }
+    '')
+
     cfg.extraConfig
   ];
 
   modulesDir = pkgs.symlinkJoin "dovecot-modules"
-    (map (module: "${module}/lib/dovecot") cfg.modules);
+    (map (pkg: "${pkg}/lib/dovecot") ([ dovecotPkg ] ++ map (module: module.override { dovecot = dovecotPkg; }) cfg.modules));
 
 in
 {
@@ -87,6 +89,12 @@ in
       description = "Start the LMTP listener (when Dovecot is enabled).";
     };
 
+    protocols = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      description = "Additional listeners to start when Dovecot is enabled.";
+    };
+
     package = mkOption {
       type = types.package;
       default = pkgs.dovecot22;
@@ -129,13 +137,25 @@ in
       '';
     };
 
+    mailUser = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = "Default user to store mail for virtual users.";
+    };
+
+    mailGroup = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = "Default group to store mail for virtual users.";
+    };
+
     modules = mkOption {
       type = types.listOf types.package;
       default = [];
       example = literalExample "[ pkgs.dovecot_pigeonhole ]";
       description = ''
         Symlinks the contents of lib/dovecot of every given package into
-        /var/lib/dovecot/modules. This will make the given modules available
+        /etc/dovecot/modules. This will make the given modules available
         if a dovecot package with the module_dir patch applied (like
         pkgs.dovecot22, the default) is being used.
       '';
@@ -162,7 +182,13 @@ in
     enablePAM = mkOption {
       type = types.bool;
       default = true;
-      description = "Wether to create a own Dovecot PAM service and configure PAM user logins.";
+      description = "Whether to create a own Dovecot PAM service and configure PAM user logins.";
+    };
+
+    sieveScripts = mkOption {
+      type = types.attrsOf types.path;
+      default = {};
+      description = "Sieve scripts to be executed. Key is a sequence, e.g. 'before2', 'after' etc.";
     };
 
     showPAMFailure = mkOption {
@@ -177,23 +203,31 @@ in
 
     security.pam.services.dovecot2 = mkIf cfg.enablePAM {};
 
+    services.dovecot2.protocols =
+     optional cfg.enableImap "imap"
+     ++ optional cfg.enablePop3 "pop3"
+     ++ optional cfg.enableLmtp "lmtp";
+
     users.extraUsers = [
-      { name = cfg.user;
-        uid = config.ids.uids.dovecot2;
-        description = "Dovecot user";
-        group = cfg.group;
-      }
       { name = "dovenull";
         uid = config.ids.uids.dovenull2;
         description = "Dovecot user for untrusted logins";
         group = cfg.group;
       }
-    ];
+    ] ++ optional (cfg.user == "dovecot2")
+         { name = "dovecot2";
+           uid = config.ids.uids.dovecot2;
+           description = "Dovecot user";
+           group = cfg.group;
+         };
 
-    users.extraGroups = singleton {
+    users.extraGroups = optional (cfg.group == "dovecot2")
-      name = cfg.group;
+      { name = "dovecot2";
-      gid = config.ids.gids.dovecot2;
+        gid = config.ids.gids.dovecot2;
-    };
+      };
+
+    environment.etc."dovecot/modules".source = modulesDir;
+    environment.etc."dovecot/dovecot.conf".source = cfg.configFile;
 
     systemd.services.dovecot2 = {
       description = "Dovecot IMAP/POP3 server";
@@ -201,26 +235,38 @@ in
       after = [ "keys.target" "network.target" ];
       wants = [ "keys.target" ];
       wantedBy = [ "multi-user.target" ];
-
+      restartTriggers = [ cfg.configFile ];
-      preStart = ''
-        mkdir -p "${baseDir}/login"
-        chown -R ${cfg.user}:${cfg.group} "${baseDir}"
-        rm -f "${stateDir}/modules"
-        ln -s "${modulesDir}" "${stateDir}/modules"
-      '';
 
       serviceConfig = {
-        ExecStart = "${dovecotPkg}/sbin/dovecot -F -c ${cfg.configFile}";
+        ExecStart = "${dovecotPkg}/sbin/dovecot -F";
+        ExecReload = "${dovecotPkg}/sbin/doveadm reload";
         Restart = "on-failure";
         RestartSec = "1s";
         StartLimitInterval = "1min";
+        RuntimeDirectory = [ "dovecot2" ];
       };
+
+      preStart = ''
+        rm -rf ${stateDir}/sieve
+      '' + optionalString (cfg.sieveScripts != {}) ''
+        mkdir -p ${stateDir}/sieve
+        ${concatStringsSep "\n" (mapAttrsToList (to: from: ''
+          if [ -d '${from}' ]; then
+            mkdir '${stateDir}/sieve/${to}'
+            cp ${from}/*.sieve '${stateDir}/sieve/${to}'
+          else
+            cp '${from}' '${stateDir}/sieve/${to}'
+          fi
+           ${pkgs.dovecot_pigeonhole}/bin/sievec '${stateDir}/sieve/${to}'
+        '') cfg.sieveScripts)}
+        chown -R '${cfg.mailUser}:${cfg.mailGroup}' '${stateDir}/sieve'
+      '';
     };
 
     environment.systemPackages = [ dovecotPkg ];
 
     assertions = [
-      { assertion = cfg.enablePop3 || cfg.enableImap;
+      { assertion = intersectLists cfg.protocols [ "pop3" "imap" ] != [];
         message = "dovecot needs at least one of the IMAP or POP3 listeners enabled";
       }
       { assertion = isNull cfg.sslServerCert == isNull cfg.sslServerKey

nixos/modules/services/mail/postfix.nix

@@ -20,6 +20,23 @@ let
       mail_owner = ${user}
       default_privs = nobody
 
+      # NixOS specific locations
+      data_directory = /var/lib/postfix/data
+      queue_directory = /var/lib/postfix/queue
+
+      # Default location of everything in package
+      meta_directory = ${pkgs.postfix}/etc/postfix
+      command_directory = ${pkgs.postfix}/bin
+      sample_directory = /etc/postfix
+      newaliases_path = ${pkgs.postfix}/bin/newaliases
+      mailq_path = ${pkgs.postfix}/bin/mailq
+      readme_directory = no
+      sendmail_path = ${pkgs.postfix}/bin/sendmail
+      daemon_directory = ${pkgs.postfix}/libexec/postfix
+      manpage_directory = ${pkgs.postfix}/share/man
+      html_directory = ${pkgs.postfix}/share/postfix/doc/html
+      shlib_directory = no
+
     ''
     + optionalString config.networking.enableIPv6 ''
       inet_protocols = all
@@ -435,31 +452,35 @@ in
               mkdir -p /var/lib
               mv /var/postfix /var/lib/postfix
             fi
-            mkdir -p /var/lib/postfix/data /var/lib/postfix/queue/{pid,public,maildrop}
 
-            chown -R ${user}:${group} /var/lib/postfix
+            # All permissions set according ${pkgs.postfix}/etc/postfix/postfix-files script
-            chown root /var/lib/postfix/queue
+            mkdir -p /var/lib/postfix /var/lib/postfix/queue/{pid,public,maildrop}
-            chown root /var/lib/postfix/queue/pid
+            chmod 0755 /var/lib/postfix
-            chgrp -R ${setgidGroup} /var/lib/postfix/queue/{public,maildrop}
+            chown root:root /var/lib/postfix
-            chmod 770 /var/lib/postfix/queue/{public,maildrop}
 
             rm -rf /var/lib/postfix/conf
             mkdir -p /var/lib/postfix/conf
+            chmod 0755 /var/lib/postfix/conf
+            ln -sf ${pkgs.postfix}/etc/postfix/postfix-files
             ln -sf ${mainCfFile} /var/lib/postfix/conf/main.cf
             ln -sf ${masterCfFile} /var/lib/postfix/conf/master.cf
+
             ${concatStringsSep "\n" (mapAttrsToList (to: from: ''
               ln -sf ${from} /var/lib/postfix/conf/${to}
-              postalias /var/lib/postfix/conf/${to}
+              ${pkgs.postfix}/bin/postalias /var/lib/postfix/conf/${to}
             '') cfg.aliasFiles)}
             ${concatStringsSep "\n" (mapAttrsToList (to: from: ''
               ln -sf ${from} /var/lib/postfix/conf/${to}
-              postmap /var/lib/postfix/conf/${to}
+              ${pkgs.postfix}/bin/postmap /var/lib/postfix/conf/${to}
             '') cfg.mapFiles)}
 
             mkdir -p /var/spool/mail
             chown root:root /var/spool/mail
             chmod a+rwxt /var/spool/mail
             ln -sf /var/spool/mail /var/
+
+            #Finally delegate to postfix checking remain directories in /var/lib/postfix and set permissions on them
+            ${pkgs.postfix}/bin/postfix set-permissions config_directory=/var/lib/postfix/conf
           '';
         };
     }

nixos/modules/services/misc/ihaskell.nix

@@ -6,7 +6,6 @@ let
 
   cfg = config.services.ihaskell;
   ihaskell = pkgs.ihaskell.override {
-    inherit (cfg.haskellPackages) ihaskell ghcWithPackages;
     packages = self: cfg.extraPackages self;
   };
 
@@ -22,7 +21,6 @@ in
       };
 
       haskellPackages = mkOption {
-        type = types.attrsOf types.package;
         default = pkgs.haskellPackages;
         defaultText = "pkgs.haskellPackages";
         example = literalExample "pkgs.haskell.packages.ghc784";

nixos/modules/services/misc/nix-daemon.nix

@@ -364,7 +364,7 @@ in
           ++ optionals cfg.distributedBuilds [ pkgs.gzip ];
 
         environment = cfg.envVars
-          // { CURL_CA_BUNDLE = "/etc/ssl/certs/ca-bundle.crt"; }
+          // { CURL_CA_BUNDLE = "/etc/ssl/certs/ca-certificates.crt"; }
           // config.networking.proxy.envVars;
 
         serviceConfig =

nixos/modules/services/monitoring/bosun.nix

@@ -129,17 +129,19 @@ in {
       description = "bosun metrics collector (part of Bosun)";
       wantedBy = [ "multi-user.target" ];
 
-      preStart =
+      preStart = ''
-        ''
+        mkdir -p "$(dirname "${cfg.stateFile}")";
-        mkdir -p `dirname ${cfg.stateFile}`;
+        touch "${cfg.stateFile}"
-        touch ${cfg.stateFile}
+        touch "${cfg.stateFile}.tmp"
-        touch ${cfg.stateFile}.tmp
+
+        mkdir -p "${cfg.ledisDir}";
 
         if [ "$(id -u)" = 0 ]; then
-          chown ${cfg.user}:${cfg.group} ${cfg.stateFile}
+          chown ${cfg.user}:${cfg.group} "${cfg.stateFile}"
-          chown ${cfg.user}:${cfg.group} ${cfg.stateFile}.tmp
+          chown ${cfg.user}:${cfg.group} "${cfg.stateFile}.tmp"
+          chown ${cfg.user}:${cfg.group} "${cfg.ledisDir}"
         fi
-        '';
+      '';
 
       serviceConfig = {
         PermissionsStartOnly = true;

nixos/modules/services/monitoring/dd-agent.nix

@@ -183,7 +183,7 @@ in {
         Restart = "always";
         RestartSec = 2;
       };
-      environment.SSL_CERT_FILE = "/etc/ssl/certs/ca-bundle.crt";
+      environment.SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
       restartTriggers = [ pkgs.dd-agent ddConf diskConfig networkConfig postgresqlConfig nginxConfig mongoConfig ];
     };
 

nixos/modules/services/networking/ddclient.nix

@@ -127,7 +127,7 @@ in
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
 
-      environment.SSL_CERT_FILE = "/etc/ssl/certs/ca-bundle.crt";
+      environment.SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
       serviceConfig = {
         # Uncomment this if too many problems occur:
         # Type = "forking";

nixos/modules/services/networking/gale.nix

@@ -76,7 +76,7 @@ in
 
        system.activationScripts.gale = mkIf cfg.enable (
          stringAfter [ "users" "groups" ] ''
-           chmod -R 755 ${home}
+           chmod 755 ${home}
            mkdir -m 0777 -p ${home}/auth/cache
            mkdir -m 1777 -p ${home}/auth/local # GALE_DOMAIN.gpub
            mkdir -m 0700 -p ${home}/auth/private # ROOT.gpub
@@ -86,7 +86,8 @@ in
            mkdir -m 0700 -p ${home}/.gale/auth/private # GALE_DOMAIN.gpri
 
            ln -sf ${pkgs.gale}/etc/gale/auth/trusted/ROOT "${home}/auth/trusted/ROOT"
-           chown -R ${cfg.user}:${cfg.group} ${home}
+           chown ${cfg.user}:${cfg.group} ${home} ${home}/auth ${home}/auth/*
+           chown ${cfg.user}:${cfg.group} ${home}/.gale ${home}/.gale/auth ${home}/.gale/auth/private
          ''
        );
 
@@ -149,10 +150,9 @@ in
          after = [ "network.target" ];
 
          preStart = ''
-           install -m 0640 ${keyPath}/${cfg.domain}.gpri "${home}/.gale/auth/private/"
+           install -m 0640 -o ${cfg.user} -g ${cfg.group} ${keyPath}/${cfg.domain}.gpri "${home}/.gale/auth/private/"
-           install -m 0644 ${gpubFile} "${home}/.gale/auth/private/${cfg.domain}.gpub"
+           install -m 0644 -o ${cfg.user} -g ${cfg.group} ${gpubFile} "${home}/.gale/auth/private/${cfg.domain}.gpub"
-           install -m 0644 ${gpubFile} "${home}/auth/local/${cfg.domain}.gpub"
+           install -m 0644 -o ${cfg.user} -g ${cfg.group} ${gpubFile} "${home}/auth/local/${cfg.domain}.gpub"
-           chown -R ${cfg.user}:${cfg.group} ${home}
          '';
 
          serviceConfig = {

nixos/modules/services/networking/gateone.nix

@@ -21,7 +21,7 @@ options = {
 };
 config = mkIf cfg.enable {
   environment.systemPackages = with pkgs.pythonPackages; [
-    gateone pkgs.openssh pkgs.procps pkgs.coreutils ];
+    gateone pkgs.openssh pkgs.procps pkgs.coreutils pkgs.cacert];
 
   users.extraUsers.gateone = {
     description = "GateOne privilege separation user";
@@ -49,8 +49,6 @@ config = mkIf cfg.enable {
       User = "gateone";
       Group = "gateone";
       WorkingDirectory = cfg.settingsDir;
-      PermissionsStartOnly = true;
-
     };
 
     wantedBy = [ "multi-user.target" ];

nixos/modules/services/networking/softether.nix

@@ -61,11 +61,14 @@ in
             dataDir = cfg.dataDir;
           }))
         ];
-      systemd.services.softether = {
+      systemd.services."softether-init" = {
-        description = "SoftEther VPN services initial job";
+        description = "SoftEther VPN services initial task";
-        after = [ "network-interfaces.target" ];
+        wantedBy = [ "network-interfaces.target" ];
-        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
-        preStart = ''
+          Type = "oneshot";
+          RemainAfterExit = false;
+        };
+        script = ''
             for d in vpnserver vpnbridge vpnclient vpncmd; do
                 if ! test -e ${cfg.dataDir}/$d; then
                     ${pkgs.coreutils}/bin/mkdir -m0700 -p ${cfg.dataDir}/$d
@@ -81,12 +84,12 @@ in
     (mkIf (cfg.vpnserver.enable) {
       systemd.services.vpnserver = {
         description = "SoftEther VPN Server";
-        after = [ "network-interfaces.target" ];
+        after = [ "softether-init.service" ];
-        wantedBy = [ "multi-user.target" ];
+        wantedBy = [ "network-interfaces.target" ];
         serviceConfig = {
+          Type = "forking";
           ExecStart = "${pkg}/bin/vpnserver start";
           ExecStop = "${pkg}/bin/vpnserver stop";
-          Type = "forking";
         };
         preStart = ''
             rm -rf ${cfg.dataDir}/vpnserver/vpnserver
@@ -101,12 +104,12 @@ in
     (mkIf (cfg.vpnbridge.enable) {
       systemd.services.vpnbridge = {
         description = "SoftEther VPN Bridge";
-        after = [ "network-interfaces.target" ];
+        after = [ "softether-init.service" ];
-        wantedBy = [ "multi-user.target" ];
+        wantedBy = [ "network-interfaces.target" ];
         serviceConfig = {
+          Type = "forking";
           ExecStart = "${pkg}/bin/vpnbridge start";
           ExecStop = "${pkg}/bin/vpnbridge stop";
-          Type = "forking";
         };
         preStart = ''
             rm -rf ${cfg.dataDir}/vpnbridge/vpnbridge
@@ -121,12 +124,12 @@ in
     (mkIf (cfg.vpnclient.enable) {
       systemd.services.vpnclient = {
         description = "SoftEther VPN Client";
-        after = [ "network-interfaces.target" ];
+        after = [ "softether-init.service" ];
-        wantedBy = [ "multi-user.target" ];
+        wantedBy = [ "network-interfaces.target" ];
         serviceConfig = {
+          Type = "forking";
           ExecStart = "${pkg}/bin/vpnclient start";
           ExecStop = "${pkg}/bin/vpnclient stop";
-          Type = "forking";
         };
         preStart = ''
             rm -rf ${cfg.dataDir}/vpnclient/vpnclient

nixos/modules/services/printing/cupsd.nix

@@ -4,10 +4,13 @@ with lib;
 
 let
 
-  inherit (pkgs) cups cups_filters;
+  inherit (pkgs) cups cups-pk-helper cups_filters gutenprint;
 
   cfg = config.services.printing;
 
+  avahiEnabled = config.services.avahi.enable;
+  polkitEnabled = config.security.polkit.enable;
+
   additionalBackends = pkgs.runCommand "additional-cups-backends" { }
     ''
       mkdir -p $out
@@ -30,12 +33,75 @@ let
   # cupsd.conf tells cupsd to use this tree.
   bindir = pkgs.buildEnv {
     name = "cups-progs";
-    paths = cfg.drivers;
+    paths =
-    pathsToLink = [ "/lib/cups" "/share/cups" "/bin" "/etc/cups" ];
+      [ cups additionalBackends cups_filters pkgs.ghostscript ]
+      ++ optional cfg.gutenprint gutenprint
+      ++ cfg.drivers;
+    pathsToLink = [ "/lib/cups" "/share/cups" "/bin" ];
     postBuild = cfg.bindirCmds;
     ignoreCollisions = true;
   };
 
+  writeConf = name: text: pkgs.writeTextFile {
+    inherit name text;
+    destination = "/etc/cups/${name}";
+  };
+
+  cupsFilesFile = writeConf "cups-files.conf" ''
+    SystemGroup root wheel
+
+    ServerBin ${bindir}/lib/cups
+    DataDir ${bindir}/share/cups
+
+    AccessLog syslog
+    ErrorLog syslog
+    PageLog syslog
+
+    TempDir ${cfg.tempDir}
+
+    # User and group used to run external programs, including
+    # those that actually send the job to the printer.  Note that
+    # Udev sets the group of printer devices to `lp', so we want
+    # these programs to run as `lp' as well.
+    User cups
+    Group lp
+
+    ${cfg.extraFilesConf}
+  '';
+
+  cupsdFile = writeConf "cupsd.conf" ''
+    ${concatMapStrings (addr: ''
+      Listen ${addr}
+    '') cfg.listenAddresses}
+    Listen /var/run/cups/cups.sock
+
+    SetEnv PATH ${bindir}/lib/cups/filter:${bindir}/bin
+
+    DefaultShared ${if cfg.defaultShared then "Yes" else "No"}
+
+    Browsing ${if cfg.browsing then "Yes" else "No"}
+
+    WebInterface ${if cfg.webInterface then "Yes" else "No"}
+
+    ${cfg.extraConf}
+  '';
+
+  browsedFile = writeConf "cups-browsed.conf" cfg.browsedConf;
+
+  rootdir = pkgs.buildEnv {
+    name = "cups-progs";
+    paths = [
+      cupsFilesFile
+      cupsdFile
+      (writeConf "client.conf" cfg.clientConf)
+      (writeConf "snmp.conf" cfg.snmpConf)
+    ] ++ optional avahiEnabled browsedFile
+      ++ optional cfg.gutenprint gutenprint
+      ++ cfg.drivers;
+    pathsToLink = [ "/etc/cups" ];
+    ignoreCollisions = true;
+  };
+
 in
 
 {
@@ -96,25 +162,11 @@ in
         '';
       };
 
-      cupsdConf = mkOption {
+      extraFilesConf = mkOption {
-        type = types.lines;
-        default = "";
-        example =
-          ''
-            BrowsePoll cups.example.com
-            LogLevel debug
-          '';
-        description = ''
-          The contents of the configuration file of the CUPS daemon
-          (<filename>cupsd.conf</filename>).
-        '';
-      };
-
-      cupsFilesConf = mkOption {
         type = types.lines;
         default = "";
         description = ''
-          The contents of the configuration file of the CUPS daemon
+          Extra contents of the configuration file of the CUPS daemon
           (<filename>cups-files.conf</filename>).
         '';
       };
@@ -171,8 +223,18 @@ in
         '';
       };
 
+      gutenprint = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to enable Gutenprint drivers for CUPS. This includes auto-updating
+          Gutenprint PPD files.
+        '';
+      };
+
       drivers = mkOption {
         type = types.listOf types.path;
+        default = [];
         example = literalExample "[ pkgs.splix ]";
         description = ''
           CUPS drivers to use. Drivers provided by CUPS, cups-filters, Ghostscript
@@ -204,15 +266,10 @@ in
         description = "CUPS printing services";
       };
 
-    environment.systemPackages = [ cups ];
+    environment.systemPackages = [ cups ] ++ optional polkitEnabled cups-pk-helper;
+    environment.etc."cups".source = "/var/lib/cups";
 
-    environment.etc."cups/client.conf".text = cfg.clientConf;
+    services.dbus.packages = [ cups ] ++ optional polkitEnabled cups-pk-helper;
-    environment.etc."cups/cups-files.conf".text = cfg.cupsFilesConf;
-    environment.etc."cups/cupsd.conf".text = cfg.cupsdConf;
-    environment.etc."cups/cups-browsed.conf".text = cfg.browsedConf;
-    environment.etc."cups/snmp.conf".text = cfg.snmpConf;
-
-    services.dbus.packages = [ cups ];
 
     # Cups uses libusb to talk to printers, and does not use the
     # linux kernel driver. If the driver is not in a black list, it
@@ -230,19 +287,35 @@ in
 
         preStart =
           ''
-            mkdir -m 0755 -p /etc/cups
             mkdir -m 0700 -p /var/cache/cups
             mkdir -m 0700 -p /var/spool/cups
             mkdir -m 0755 -p ${cfg.tempDir}
-          '';
 
-        restartTriggers =
+            mkdir -m 0755 -p /var/lib/cups
-          [ config.environment.etc."cups/cups-files.conf".source
+            # Backwards compatibility
-            config.environment.etc."cups/cupsd.conf".source
+            if [ ! -L /etc/cups ]; then
-          ];
+              mv /etc/cups/* /var/lib/cups
+              rmdir /etc/cups
+              ln -s /var/lib/cups /etc/cups
+            fi
+            # First, clean existing symlinks
+            if [ -n "$(ls /var/lib/cups)" ]; then
+              for i in /var/lib/cups/*; do
+                [ -L "$i" ] && rm "$i"
+              done
+            fi
+            # Then, populate it with static files
+            cd ${rootdir}/etc/cups
+            for i in *; do
+              [ ! -e "/var/lib/cups/$i" ] && ln -s "${rootdir}/etc/cups/$i" "/var/lib/cups/$i"
+            done
+            ${optionalString cfg.gutenprint ''
+              ${gutenprint}/bin/cups-genppdupdate
+            ''}
+          '';
       };
 
-    systemd.services.cups-browsed = mkIf config.services.avahi.enable
+    systemd.services.cups-browsed = mkIf avahiEnabled
       { description = "CUPS Remote Printer Discovery";
 
         wantedBy = [ "multi-user.target" ];
@@ -255,54 +328,13 @@ in
 
         serviceConfig.ExecStart = "${cups_filters}/bin/cups-browsed";
 
-        restartTriggers =
+        restartTriggers = [ browsedFile ];
-          [ config.environment.etc."cups/cups-browsed.conf".source
-          ];
       };
 
-    services.printing.drivers =
+    services.printing.extraConf =
-      [ cups pkgs.ghostscript pkgs.cups_filters additionalBackends
-        pkgs.perl pkgs.coreutils pkgs.gnused pkgs.bc pkgs.gawk pkgs.gnugrep
-      ];
-
-    services.printing.cupsFilesConf =
-      ''
-        SystemGroup root wheel
-
-        ServerBin ${bindir}/lib/cups
-        DataDir ${bindir}/share/cups
-
-        AccessLog syslog
-        ErrorLog syslog
-        PageLog syslog
-
-        TempDir ${cfg.tempDir}
-
-        # User and group used to run external programs, including
-        # those that actually send the job to the printer.  Note that
-        # Udev sets the group of printer devices to `lp', so we want
-        # these programs to run as `lp' as well.
-        User cups
-        Group lp
-      '';
-
-    services.printing.cupsdConf =
       ''
         LogLevel info
 
-        ${concatMapStrings (addr: ''
-          Listen ${addr}
-        '') cfg.listenAddresses}
-        Listen /var/run/cups/cups.sock
-
-        SetEnv PATH ${bindir}/lib/cups/filter:${bindir}/bin:${bindir}/sbin
-
-        DefaultShared ${if cfg.defaultShared then "Yes" else "No"}
-
-        Browsing ${if cfg.browsing then "Yes" else "No"}
-
-        WebInterface ${if cfg.webInterface then "Yes" else "No"}
-
         DefaultAuthType Basic
 
         <Location />
@@ -343,8 +375,6 @@ in
             Order deny,allow
           </Limit>
         </Policy>
-
-        ${cfg.extraConf}
       '';
 
     security.pam.services.cups = {};

nixos/modules/services/search/elasticsearch.nix

@@ -128,6 +128,7 @@ in {
       description = "Elasticsearch Daemon";
       wantedBy = [ "multi-user.target" ];
       after = [ "network-interfaces.target" ];
+      path = [ pkgs.inetutils ];
       environment = { ES_HOME = cfg.dataDir; };
       serviceConfig = {
         ExecStart = "${cfg.package}/bin/elasticsearch -Des.path.conf=${configDir} ${toString cfg.extraCmdLineOptions}";
@@ -139,8 +140,7 @@ in {
         if [ "$(id -u)" = 0 ]; then chown -R elasticsearch ${cfg.dataDir}; fi
 
         # Install plugins
-        rm ${cfg.dataDir}/plugins || true
+        ln -sfT ${esPlugins}/plugins ${cfg.dataDir}/plugins
-        ln -s ${esPlugins}/plugins ${cfg.dataDir}/plugins
       '';
       postStart = mkBefore ''
         until ${pkgs.curl.bin}/bin/curl -s -o /dev/null ${cfg.listenAddress}:${toString cfg.port}; do

nixos/modules/services/system/uptimed.nix

@@ -1,66 +1,55 @@
-{pkgs, config, lib, ...}:
+{ config, lib, pkgs, ... }:
+
+with lib;
 
 let
-
+  cfg = config.services.uptimed;
-  inherit (lib) mkOption mkIf singleton;
-
-  inherit (pkgs) uptimed;
-
   stateDir = "/var/spool/uptimed";
-
-  uptimedUser = "uptimed";
-
 in
-
 {
-
-  ###### interface
-
   options = {
-
     services.uptimed = {
-
       enable = mkOption {
         default = false;
         description = ''
-          Uptimed allows you to track your highest uptimes.
+          Enable <literal>uptimed</literal>, allowing you to track
+          your highest uptimes.
         '';
       };
-
     };
-
   };
 
-
+  config = mkIf cfg.enable {
-  ###### implementation
+    users.extraUsers.uptimed = {
-
+      description = "Uptimed daemon user";
-  config = mkIf config.services.uptimed.enable {
+      home        = stateDir;
-
+      createHome  = true;
-    environment.systemPackages = [ uptimed ];
+      uid         = config.ids.uids.uptimed;
-
+    };
-    users.extraUsers = singleton
-      { name = uptimedUser;
-        uid = config.ids.uids.uptimed;
-        description = "Uptimed daemon user";
-        home = stateDir;
-      };
 
     systemd.services.uptimed = {
-      description = "Uptimed daemon";
+      unitConfig.Documentation = "man:uptimed(8) man:uprecords(1)";
-      wantedBy = [ "multi-user.target" ];
+      description = "uptimed service";
+      wantedBy    = [ "multi-user.target" ];
+
+      serviceConfig = {
+        Restart                 = "on-failure";
+        User                    = "uptimed";
+        Nice                    = 19;
+        IOSchedulingClass       = "idle";
+        PrivateTmp              = "yes";
+        PrivateNetwork          = "yes";
+        NoNewPrivileges         = "yes";
+        ReadWriteDirectories    = stateDir;
+        InaccessibleDirectories = "/home";
+        ExecStart               = "${pkgs.uptimed}/sbin/uptimed -f -p ${stateDir}/pid";
+      };
 
       preStart = ''
-        mkdir -m 0755 -p ${stateDir}
-        chown ${uptimedUser} ${stateDir}
-
         if ! test -f ${stateDir}/bootid ; then
-          ${uptimed}/sbin/uptimed -b
+          ${pkgs.uptimed}/sbin/uptimed -b
         fi
       '';
-
-      script = "${uptimed}/sbin/uptimed";
     };
-
   };
-
 }

nixos/modules/services/x11/display-managers/default.nix

@@ -16,13 +16,6 @@ let
   cfg = config.services.xserver;
   xorg = pkgs.xorg;
 
-  vaapiDrivers = pkgs.buildEnv {
-    name = "vaapi-drivers";
-    paths = cfg.vaapiDrivers;
-    # We only want /lib/dri, but with a single input path, we need "/" for it to work
-    pathsToLink = [ "/" ];
-  };
-
   fontconfig = config.fonts.fontconfig;
   xresourcesXft = pkgs.writeText "Xresources-Xft" ''
     ${optionalString (fontconfig.dpi != 0) ''Xft.dpi: ${toString fontconfig.dpi}''}
@@ -107,8 +100,6 @@ let
           ${xorg.xrdb}/bin/xrdb -merge ~/.Xdefaults
       fi
 
-      export LIBVA_DRIVERS_PATH=${vaapiDrivers}/lib/dri
-
       # Speed up application start by 50-150ms according to
       # http://kdemonkey.blogspot.nl/2008/04/magic-trick.html
       rm -rf $HOME/.compose-cache

nixos/modules/services/x11/display-managers/sddm.nix

@@ -31,6 +31,9 @@ let
     [General]
     HaltCommand=${pkgs.systemd}/bin/systemctl poweroff
     RebootCommand=${pkgs.systemd}/bin/systemctl reboot
+    ${optionalString cfg.autoNumlock ''
+    Numlock=on
+    ''}
 
     [Theme]
     Current=${cfg.theme}
@@ -110,6 +113,14 @@ in
         '';
       };
 
+      autoNumlock = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Enable numlock at login.
+        '';
+      };
+
       setupScript = mkOption {
         type = types.str;
         default = "";

nixos/modules/services/x11/window-managers/i3.nix

@@ -34,6 +34,6 @@ in
         '';
       }];
     };
-    environment.systemPackages = [ pkgs.i3 ];
+    environment.systemPackages = with pkgs; [ i3 i3status dmenu ];
   };
 }

nixos/modules/services/x11/xserver.nix

@@ -216,15 +216,6 @@ in
         '';
       };
 
-      vaapiDrivers = mkOption {
-        type = types.listOf types.path;
-        default = [ ];
-        example = literalExample "[ pkgs.vaapiIntel pkgs.vaapiVdpau ]";
-        description = ''
-          Packages providing libva acceleration drivers.
-        '';
-      };
-
       startGnuPGAgent = mkOption {
         type = types.bool;
         default = false;

nixos/modules/system/activation/activation-script.nix

@@ -95,6 +95,18 @@ in
 
     };
 
+    environment.usrbinenv = mkOption {
+      default = "${pkgs.coreutils}/bin/env";
+      example = literalExample ''
+        "''${pkgs.busybox}/bin/env"
+      '';
+      type = types.nullOr types.path;
+      visible = false;
+      description = ''
+        The env(1) executable that is linked system-wide to
+        <literal>/usr/bin/env</literal>.
+      '';
+    };
   };
 
 
@@ -129,11 +141,15 @@ in
         mkdir -m 0555 -p /var/empty
       '';
 
-    system.activationScripts.usrbinenv =
+    system.activationScripts.usrbinenv = if config.environment.usrbinenv != null
-      ''
+      then ''
         mkdir -m 0755 -p /usr/bin
-        ln -sfn ${pkgs.coreutils}/bin/env /usr/bin/.env.tmp
+        ln -sfn ${config.environment.usrbinenv} /usr/bin/.env.tmp
         mv /usr/bin/.env.tmp /usr/bin/env # atomically replace /usr/bin/env
+      ''
+      else ''
+        rm -f /usr/bin/env
+        rmdir --ignore-fail-on-non-empty /usr/bin /usr
       '';
 
     system.activationScripts.tmpfs =

nixos/modules/system/boot/networkd.nix

@@ -93,11 +93,13 @@ let
 
   checkNetwork = checkUnitConfig "Network" [
     (assertOnlyFields [
-      "Description" "DHCP" "DHCPServer" "IPv4LL" "IPv4LLRoute"
+      "Description" "DHCP" "DHCPServer" "IPForward" "IPMasquerade" "IPv4LL" "IPv4LLRoute"
       "LLMNR" "Domains" "Bridge" "Bond"
     ])
     (assertValueOneOf "DHCP" ["both" "none" "v4" "v6"])
     (assertValueOneOf "DHCPServer" boolValues)
+    (assertValueOneOf "IPForward" ["yes" "no" "ipv4" "ipv6"])
+    (assertValueOneOf "IPMasquerade" boolValues)
     (assertValueOneOf "IPv4LL" boolValues)
     (assertValueOneOf "IPv4LLRoute" boolValues)
     (assertValueOneOf "LLMNR" boolValues)
@@ -129,6 +131,16 @@ let
     (assertValueOneOf "RequestBroadcast" boolValues)
   ];
 
+  checkDhcpServer = checkUnitConfig "DHCPServer" [
+    (assertOnlyFields [
+      "PoolOffset" "PoolSize" "DefaultLeaseTimeSec" "MaxLeaseTimeSec"
+      "EmitDNS" "DNS" "EmitNTP" "NTP" "EmitTimezone" "Timezone"
+    ])
+    (assertValueOneOf "EmitDNS" boolValues)
+    (assertValueOneOf "EmitNTP" boolValues)
+    (assertValueOneOf "EmitTimezone" boolValues)
+  ];
+
   commonNetworkOptions = {
 
     enable = mkOption {
@@ -341,6 +353,18 @@ let
       '';
     };
 
+    dhcpServerConfig = mkOption {
+      default = {};
+      example = { PoolOffset = 50; EmitDNS = false; };
+      type = types.addCheck (types.attrsOf unitOption) checkDhcpServer;
+      description = ''
+        Each attribute in this set specifies an option in the
+        <literal>[DHCPServer]</literal> section of the unit.  See
+        <citerefentry><refentrytitle>systemd.network</refentrytitle>
+        <manvolnum>5</manvolnum></citerefentry> for details.
+      '';
+    };
+
     name = mkOption {
       type = types.nullOr types.str;
       default = null;
@@ -565,6 +589,11 @@ let
             [DHCP]
             ${attrsToSection def.dhcpConfig}
 
+          ''}
+          ${optionalString (def.dhcpServerConfig != { }) ''
+            [DHCPServer]
+            ${attrsToSection def.dhcpServerConfig}
+
           ''}
           ${flip concatMapStrings def.addresses (x: ''
             [Address]

nixos/modules/system/boot/systemd.nix

@@ -61,6 +61,8 @@ let
       "systemd-user-sessions.service"
       "dbus-org.freedesktop.login1.service"
       "dbus-org.freedesktop.machine1.service"
+      "org.freedesktop.login1.busname"
+      "org.freedesktop.machine1.busname"
       "user@.service"
 
       # Journal.
@@ -147,10 +149,14 @@ let
       "systemd-tmpfiles-setup-dev.service"
 
       # Misc.
+      "org.freedesktop.systemd1.busname"
       "systemd-sysctl.service"
       "dbus-org.freedesktop.timedate1.service"
       "dbus-org.freedesktop.locale1.service"
       "dbus-org.freedesktop.hostname1.service"
+      "org.freedesktop.timedate1.busname"
+      "org.freedesktop.locale1.busname"
+      "org.freedesktop.hostname1.busname"
       "systemd-timedated.service"
       "systemd-localed.service"
       "systemd-hostnamed.service"

nixos/modules/virtualisation/container-config.nix

@@ -19,6 +19,9 @@ with lib;
     # Shut up warnings about not having a boot loader.
     system.build.installBootLoader = "${pkgs.coreutils}/bin/true";
 
+    # Not supported in systemd-nspawn containers.
+    security.audit.enable = false;
+
   };
 
 }

nixos/modules/virtualisation/nixos-container.pl

@@ -97,10 +97,10 @@ if ($action eq "create") {
     if ($ensureUniqueName) {
         my $base = $containerName;
         for (my $nr = 0; ; $nr++) {
-            $containerName = "$base-$nr";
             $confFile = "/etc/containers/$containerName.conf";
             $root = "/var/lib/containers/$containerName";
             last unless -e $confFile || -e $root;
+            $containerName = "$base-$nr";
         }
     }
 

nixos/modules/virtualisation/nova.nix

@@ -146,7 +146,7 @@ in
 
         path =
           [ pkgs.sudo pkgs.vlan pkgs.nettools pkgs.iptables pkgs.qemu_kvm
-            pkgs.e2fsprogs pkgs.utillinux pkgs.multipath_tools pkgs.iproute
+            pkgs.e2fsprogs pkgs.utillinux pkgs.multipath-tools pkgs.iproute
             pkgs.bridge-utils
           ];
 

nixos/modules/virtualisation/rkt.nix

@@ -58,5 +58,7 @@ in
         ExecStart = "${pkgs.rkt}/bin/rkt gc ${cfg.gc.options}";
       };
     };
+
+    users.extraGroups.rkt = {};
   };
 }

nixos/release.nix

@@ -230,6 +230,7 @@ in rec {
   #tests.gitlab = callTest tests/gitlab.nix {};
   tests.gnome3 = callTest tests/gnome3.nix {};
   tests.gnome3-gdm = callTest tests/gnome3-gdm.nix {};
+  tests.grsecurity = callTest tests/grsecurity.nix {};
   tests.i3wm = callTest tests/i3wm.nix {};
   tests.installer.grub1 = forAllSystems (system: hydraJob (import tests/installer.nix { inherit system; }).grub1.test);
   tests.installer.lvm = forAllSystems (system: hydraJob (import tests/installer.nix { inherit system; }).lvm.test);
@@ -287,6 +288,7 @@ in rec {
   tests.openssh = callTest tests/openssh.nix {};
   tests.panamax = hydraJob (import tests/panamax.nix { system = "x86_64-linux"; });
   tests.peerflix = callTest tests/peerflix.nix {};
+  tests.postgresql = callTest tests/postgresql.nix {};
   tests.printing = callTest tests/printing.nix {};
   tests.proxy = callTest tests/proxy.nix {};
   tests.pumpio = callTest tests/pump.io.nix {};

nixos/tests/grsecurity.nix

@@ -0,0 +1,19 @@
+# Basic test to make sure grsecurity works
+
+import ./make-test.nix ({ pkgs, ...} : {
+  name = "grsecurity";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ copumpkin ];
+  };
+
+  machine = { config, pkgs, ... }:
+    { boot.kernelPackages = pkgs.linuxPackages_grsec_testing_server; };
+
+  testScript =
+    ''
+      $machine->succeed("uname -a") =~ /grsec/;
+      # FIXME: this seems to hang the whole test. Unclear why, but let's fix it
+      # $machine->succeed("${pkgs.paxtest}/bin/paxtest blackhat");
+    '';
+})
+

nixos/tests/postgresql.nix

@@ -0,0 +1,26 @@
+import ./make-test.nix ({ pkgs, ...} : {
+  name = "postgresql";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ zagy ];
+  };
+
+  nodes = {
+    master =
+      { pkgs, config, ... }:
+
+      {
+        services.postgresql.enable = true;
+        services.postgresql.initialScript =  pkgs.writeText "postgresql-init.sql"
+          ''
+          CREATE ROLE postgres WITH superuser login createdb;
+          '';
+      };
+  };
+
+  testScript = ''
+    startAll;
+    $master->waitForUnit("postgresql");
+    $master->sleep(10); # Hopefully this is long enough!!
+    $master->succeed("echo 'select 1' | sudo -u postgres psql");
+  '';
+})

pkgs/applications/audio/abcde/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, libcdio, cddiscid, wget, bash, vorbisTools, id3v2, eyeD3
+{ stdenv, fetchurl, libcdio, cddiscid, wget, bash, vorbis-tools, id3v2, eyeD3
 , lame, flac, eject, mkcue
 , perl, DigestSHA, MusicBrainz, MusicBrainzDiscID
 , makeWrapper }:
@@ -50,7 +50,7 @@ in
          --replace '#!/usr/bin/perl' '#!${perl}/bin/perl'
 
       wrapProgram "$out/bin/abcde" --prefix PATH ":" \
-        "$out/bin:${libcdio}/bin:${cddiscid}/bin:${wget}/bin:${vorbisTools}/bin:${id3v2}/bin:${eyeD3}/bin:${lame}/bin"
+        "$out/bin:${libcdio}/bin:${cddiscid}/bin:${wget}/bin:${vorbis-tools}/bin:${id3v2}/bin:${eyeD3}/bin:${lame}/bin"
 
       wrapProgram "$out/bin/cddb-tool" --prefix PATH ":" \
         "${wget}/bin"

pkgs/applications/audio/dfasma/default.nix

@@ -2,10 +2,6 @@
 
 let
 
-  version = "1.2.5";
-  rev = "v${version}";
-  sha256 = "0mgy2bkmyp7lvaqsr7hkndwdgjf26mlpsj6smrmn1vp0cqyrw72d";
-
   reaperFork = {
     src = fetchFromGitHub {
       sha256 = "07m2wf2gqyya95b65gawrnr4pvc9jyzmg6h8sinzgxlpskz93wwc";
@@ -30,11 +26,13 @@ let
     };
   };
 
-in stdenv.mkDerivation {
+in stdenv.mkDerivation rec {
   name = "dfasma-${version}";
+  version = "1.2.5";
 
   src = fetchFromGitHub {
-    inherit sha256 rev;
+    sha256 = "0mgy2bkmyp7lvaqsr7hkndwdgjf26mlpsj6smrmn1vp0cqyrw72d";
+    rev = "v${version}";
     repo = "dfasma";
     owner = "gillesdegottex";
   };
@@ -60,7 +58,6 @@ in stdenv.mkDerivation {
   '';
 
   meta = with stdenv.lib; {
-    inherit version;
     description = "Analyse and compare audio files in time and frequency";
     longDescription = ''
       DFasma is free open-source software to compare audio files by time and

pkgs/applications/audio/fldigi/default.nix

@@ -2,13 +2,13 @@
   libsamplerate, libpulseaudio, libXinerama, gettext, pkgconfig, alsaLib }:
 
 stdenv.mkDerivation rec {
-  version = "3.22.02";
+  version = "3.23.07";
   pname = "fldigi";
   name = "${pname}-${version}";
 
   src = fetchurl {
-    url = "http://www.w1hkj.com/downloads/${pname}/${name}.tar.gz";
+    url = "mirror://sourceforge/${pname}/${name}.tar.gz";
-    sha256 = "1gry3r133j2x99h0ji56v6yjxzvbi0hb18p1lbkr9djzjvf591j3";
+    sha256 = "0v78sk9bllxw640wxd4q2qy0h8z2j1d077nxhmpkjpf6mn6vwcda";
   };
 
   buildInputs = [ libXinerama gettext hamlib fltk13 libjpeg libpng portaudio
@@ -16,9 +16,9 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Digital modem program";
-    homepage = http://www.w1hkj.com/Fldigi.html;
+    homepage = http://sourceforge.net/projects/fldigi/;
     license = stdenv.lib.licenses.gpl3Plus;
-    maintainers = with stdenv.lib.maintainers; [ relrod ];
+    maintainers = with stdenv.lib.maintainers; [ relrod ftrvxmtrx ];
     platforms = stdenv.lib.platforms.linux;
   };
 }

pkgs/applications/audio/fmit/default.nix

@@ -7,9 +7,9 @@ assert alsaSupport -> alsaLib != null;
 assert jackSupport -> libjack2 != null;
 assert portaudioSupport -> portaudio != null;
 
-let version = "1.0.8"; in
+stdenv.mkDerivation rec {
-stdenv.mkDerivation {
   name = "fmit-${version}";
+  version = "1.0.8";
 
   src = fetchFromGitHub {
     sha256 = "04s7xcgmi5g58lirr48vf203n1jwdxf981x1p6ysbax24qwhs2kd";
@@ -37,7 +37,6 @@ stdenv.mkDerivation {
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
-    inherit version;
     description = "Free Musical Instrument Tuner";
     longDescription = ''
       FMIT is a graphical utility for tuning musical instruments, with error

pkgs/applications/audio/id3v2/default.nix

@@ -1,8 +1,9 @@
 {stdenv, fetchurl, id3lib, groff, zlib}:
 
-let version = "0.1.12"; in
 stdenv.mkDerivation rec {
   name = "id3v2-${version}";
+  version = "0.1.12";
+
   src = fetchurl {
     url = "mirror://sourceforge/id3v2/${name}.tar.gz";
     sha256 = "1gr22w8gar7zh5pyyvdy7cy26i47l57jp1l1nd60xfwx339zl1c1";
@@ -19,7 +20,6 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    inherit version;
     description = "A command line editor for id3v2 tags";
     homepage = http://id3v2.sourceforge.net/;
     license = licenses.gpl2Plus;

pkgs/applications/audio/keyfinder-cli/default.nix

@@ -1,8 +1,8 @@
 { stdenv, fetchFromGitHub, libav, libkeyfinder }:
 
-let version = "2015-09-13"; in
 stdenv.mkDerivation rec {
   name = "keyfinder-cli-${version}";
+  version = "2015-09-13";
 
   src = fetchFromGitHub {
     repo = "keyfinder-cli";
@@ -18,7 +18,6 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
-    inherit version;
     inherit (src.meta) homepage;
     description = "Musical key detection for digital audio (command-line tool)";
     longDescription = ''

pkgs/applications/audio/keyfinder/default.nix

@@ -1,8 +1,8 @@
 { stdenv, fetchFromGitHub, libav_0_8, libkeyfinder, qtbase, qtxmlpatterns, taglib }:
 
-let version = "2.1"; in
+stdenv.mkDerivation rec {
-stdenv.mkDerivation {
   name = "keyfinder-${version}";
+  version = "2.1";
 
   src = fetchFromGitHub {
     sha256 = "0j9k90ll4cr8j8dywb6zf1bs9vijlx7m4zsh6w9hxwrr7ymz89hn";
@@ -11,24 +11,6 @@ stdenv.mkDerivation {
     owner = "ibsh";
   };
 
-  meta = with stdenv.lib; {
-    inherit version;
-    description = "Musical key detection for digital audio (graphical UI)";
-    longDescription = ''
-      KeyFinder is an open source key detection tool, for DJs interested in
-      harmonic and tonal mixing. Designed primarily for electronic and dance
-      music, it is highly configurable and can be applied to many genres. It
-      supports a huge range of codecs thanks to LibAV, and writes to metadata
-      tags using TagLib. It's intended to be very focused: no library
-      management, no track suggestions, no media player. Just a fast,
-      efficient workflow tool.
-    '';
-    homepage = http://www.ibrahimshaath.co.uk/keyfinder/;
-    license = licenses.gpl3Plus;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ nckx ];
-  };
-
   buildInputs = [ libav_0_8 libkeyfinder qtbase qtxmlpatterns taglib ];
 
   postPatch = ''
@@ -43,4 +25,21 @@ stdenv.mkDerivation {
   '';
 
   enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "Musical key detection for digital audio (graphical UI)";
+    longDescription = ''
+      KeyFinder is an open source key detection tool, for DJs interested in
+      harmonic and tonal mixing. Designed primarily for electronic and dance
+      music, it is highly configurable and can be applied to many genres. It
+      supports a huge range of codecs thanks to LibAV, and writes to metadata
+      tags using TagLib. It's intended to be very focused: no library
+      management, no track suggestions, no media player. Just a fast,
+      efficient workflow tool.
+    '';
+    homepage = http://www.ibrahimshaath.co.uk/keyfinder/;
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ nckx ];
+  };
 }

pkgs/applications/audio/mhwaveedit/default.nix

@@ -1,6 +1,6 @@
 { stdenv, fetchurl, makeWrapper, SDL , alsaLib, gtk, libjack2, ladspaH
 , ladspaPlugins, libsamplerate, libsndfile, pkgconfig, libpulseaudio, lame
-, vorbisTools }:
+, vorbis-tools }:
 
 stdenv.mkDerivation  rec {
   name = "mhwaveedit-${version}";
@@ -19,7 +19,7 @@ stdenv.mkDerivation  rec {
   postInstall = ''
     wrapProgram $out/bin/mhwaveedit \
       --prefix PATH : ${lame}/bin/ \
-      --prefix PATH : ${vorbisTools}/bin/
+      --prefix PATH : ${vorbis-tools}/bin/
   '';
 
   meta = with stdenv.lib; {

pkgs/applications/audio/mixxx/default.nix

@@ -1,20 +1,22 @@
-{ stdenv, fetchurl, scons, pkgconfig, qt4, portaudio, portmidi, libusb1
+{ stdenv, fetchurl, chromaprint, fftw, flac, libid3tag, libmad
-, libmad, protobuf, libvorbis, taglib, libid3tag, flac, libsndfile, libshout
+, libopus, libshout, libsndfile, libusb1, libvorbis, pkgconfig
-, fftw, vampSDK
+, portaudio, portmidi, protobuf, qt4, rubberband, scons, sqlite
+, taglib, vampSDK
 }:
 
 stdenv.mkDerivation rec {
   name = "mixxx-${version}";
-  version = "1.11.0";
+  version = "2.0.0";
 
   src = fetchurl {
     url = "http://downloads.mixxx.org/${name}/${name}-src.tar.gz";
-    sha256 = "0c833gf4169xvpfn7car9vzvwfwl9d3xwmbfsy36cv8ydifip5h0";
+    sha256 = "0vb71w1yq0xwwsclrn2jj9bk8w4n14rfv5c0aw46c11mp8xz7f71";
   };
 
   buildInputs = [
-    scons pkgconfig qt4 portaudio portmidi libusb1 libmad protobuf libvorbis
+    chromaprint fftw flac libid3tag libmad libopus libshout libsndfile
-    taglib libid3tag flac libsndfile libshout fftw vampSDK
+    libusb1 libvorbis pkgconfig portaudio portmidi protobuf qt4
+    rubberband scons sqlite taglib vampSDK
   ];
 
   sconsFlags = [
@@ -22,10 +24,6 @@ stdenv.mkDerivation rec {
     "qtdir=${qt4}"
   ];
 
-  postPatch = ''
-    sed -i -e 's/"which /"type -P /' build/depends.py
-  '';
-
   buildPhase = ''
     runHook preBuild
     mkdir -p "$out"
@@ -41,11 +39,11 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
-    homepage = "http://mixxx.org/";
+    homepage = http://mixxx.org;
     description = "Digital DJ mixing software";
-    license = stdenv.lib.licenses.gpl2Plus;
+    license = licenses.gpl2Plus;
-    maintainers = [ stdenv.lib.maintainers.aszlig ];
+    maintainers = [ maintainers.aszlig maintainers.goibhniu ];
-    platforms = stdenv.lib.platforms.linux;
+    platforms = platforms.linux;
   };
 }

pkgs/applications/audio/mopidy/default.nix

@@ -1,27 +1,30 @@
-{ stdenv, fetchurl, pythonPackages, pygobject, gst_python
+{ stdenv, fetchurl, pythonPackages, pygobject, gst_python, wrapGAppsHook
-, gst_plugins_good, gst_plugins_base, gst_plugins_ugly
+, glib_networking, gst_plugins_good, gst_plugins_base, gst_plugins_ugly
 }:
 
 pythonPackages.buildPythonPackage rec {
   name = "mopidy-${version}";
 
-  version = "1.1.1";
+  version = "1.1.2";
 
   src = fetchurl {
     url = "https://github.com/mopidy/mopidy/archive/v${version}.tar.gz";
-    sha256 = "1xfyg8xqgnrb98wx7a4fzr4vlzkffjhkc1s36ka63rwmx86vqhyw";
+    sha256 = "1vn4knpmnp3krmn627iv1r7xa50zl816ac6b24b8ph50cq2sqjfv";
   };
 
+  buildInputs = [
+    wrapGAppsHook gst_plugins_base gst_plugins_good gst_plugins_ugly glib_networking
+  ];
+
   propagatedBuildInputs = with pythonPackages; [
-    gst_python pygobject pykka tornado requests2 gst_plugins_base gst_plugins_good gst_plugins_ugly
+    gst_python pygobject pykka tornado requests2
   ];
 
   # There are no tests
   doCheck = false;
 
-  postInstall = ''
+  preFixup = ''
-    wrapProgram $out/bin/mopidy \
+    gappsWrapperArgs+=(--prefix GST_PLUGIN_SYSTEM_PATH : "$GST_PLUGIN_SYSTEM_PATH")
-      --prefix GST_PLUGIN_SYSTEM_PATH : "$GST_PLUGIN_SYSTEM_PATH"
   '';
 
   meta = with stdenv.lib; {
@@ -31,7 +34,7 @@ pythonPackages.buildPythonPackage rec {
       SoundCloud, Google Play Music, and more
     '';
     license = licenses.asl20;
-    maintainers = [ maintainers.rickynils ];
+    maintainers = with maintainers; [ rickynils fpletz ];
     hydraPlatforms = [];
   };
 }

pkgs/applications/audio/morituri/default.nix

@@ -48,5 +48,6 @@ stdenv.mkDerivation rec {
     description = "A CD ripper aiming for accuracy over speed";
     maintainers = with maintainers; [ rycee jgeerds ];
     license = licenses.gpl3Plus;
+    platforms = platforms.linux;
   };
 }

pkgs/applications/audio/ncmpcpp/default.nix

@@ -15,11 +15,11 @@ assert taglibSupport -> (taglib != null);
 with stdenv.lib;
 stdenv.mkDerivation rec {
   name = "ncmpcpp-${version}";
-  version = "0.7";
+  version = "0.7.2";
 
   src = fetchurl {
     url = "http://ncmpcpp.rybczak.net/stable/${name}.tar.bz2";
-    sha256 = "0xzz0g9whqjcjaaqmsw5ph1zvpi2j5v3i5k73g7916rca3q4z4jh";
+    sha256 = "0fq9nk796cp7gs0gwrabb6wp7f5h7pph10hrkrik1wf4k3mzb4k3";
   };
 
   configureFlags = [ "BOOST_LIB_SUFFIX=" ]

pkgs/applications/audio/pithos/default.nix

@@ -2,16 +2,17 @@
 , gst_all_1, wrapGAppsHook }:
 
 pythonPackages.buildPythonPackage rec {
-  name = "pithos-${version}";
+  pname = "pithos";
-  version = "1.1.1";
+  version = "1.1.2";
+  name = "${pname}-${version}";
 
   namePrefix = "";
 
   src = fetchFromGitHub {
-    owner = "pithos";
+    owner = pname;
-    repo  = "pithos";
+    repo  = pname;
     rev = version;
-    sha256 = "0373z7g1wd3g1xl8m4ipx5n2ka67a2wcn387nyk8yvgdikm14jm3";
+    sha256 = "0zk9clfawsnwmgjbk7y5d526ksxd1pkh09ln6sb06v4ygaiifcxp";
   };
 
   postPatch = ''

pkgs/applications/editors/eclipse/build-eclipse.nix

@@ -0,0 +1,54 @@
+{ stdenv, makeDesktopItem, freetype, fontconfig, libX11, libXrender, zlib, jre, glib, gtk, libXtst, webkitgtk2, makeWrapper, ... }:
+
+{ name, src ? builtins.getAttr stdenv.system sources, sources ? null, description }:
+
+stdenv.mkDerivation rec {
+  inherit name src;
+
+  desktopItem = makeDesktopItem {
+    name = "Eclipse";
+    exec = "eclipse";
+    icon = "eclipse";
+    comment = "Integrated Development Environment";
+    desktopName = "Eclipse IDE";
+    genericName = "Integrated Development Environment";
+    categories = "Application;Development;";
+  };
+
+  buildInputs = [ makeWrapper ];
+
+  buildCommand = ''
+    # Unpack tarball.
+    mkdir -p $out
+    tar xfvz $src -C $out
+
+    # Patch binaries.
+    interpreter=$(echo ${stdenv.glibc}/lib/ld-linux*.so.2)
+    libCairo=$out/eclipse/libcairo-swt.so
+    patchelf --set-interpreter $interpreter $out/eclipse/eclipse
+    [ -f $libCairo ] && patchelf --set-rpath ${freetype}/lib:${fontconfig}/lib:${libX11}/lib:${libXrender}/lib:${zlib}/lib $libCairo
+
+    # Create wrapper script.  Pass -configuration to store
+    # settings in ~/.eclipse/org.eclipse.platform_<version> rather
+    # than ~/.eclipse/org.eclipse.platform_<version>_<number>.
+    productId=$(sed 's/id=//; t; d' $out/eclipse/.eclipseproduct)
+    productVersion=$(sed 's/version=//; t; d' $out/eclipse/.eclipseproduct)
+
+    makeWrapper $out/eclipse/eclipse $out/bin/eclipse \
+      --prefix PATH : ${jre}/bin \
+      --prefix LD_LIBRARY_PATH : ${glib}/lib:${gtk}/lib:${libXtst}/lib${stdenv.lib.optionalString (webkitgtk2 != null) ":${webkitgtk2}/lib"} \
+      --add-flags "-configuration \$HOME/.eclipse/''${productId}_$productVersion/configuration"
+
+    # Create desktop item.
+    mkdir -p $out/share/applications
+    cp ${desktopItem}/share/applications/* $out/share/applications
+    mkdir -p $out/share/pixmaps
+    ln -s $out/eclipse/icon.xpm $out/share/pixmaps/eclipse.xpm
+  ''; # */
+
+  meta = {
+    homepage = http://www.eclipse.org/;
+    inherit description;
+  };
+
+}

pkgs/applications/editors/eclipse/default.nix

@@ -4,67 +4,13 @@
 , webkitgtk2 ? null  # for internal web browser
 , buildEnv, writeText, runCommand
 , callPackage
-}:
+} @ args:
 
 assert stdenv ? glibc;
 
-let
+rec {
 
-  buildEclipse =
+  buildEclipse = import ./build-eclipse.nix args;
-    { name, src ? builtins.getAttr stdenv.system sources, sources ? null, description }:
-
-    stdenv.mkDerivation rec {
-      inherit name src;
-
-      desktopItem = makeDesktopItem {
-        name = "Eclipse";
-        exec = "eclipse";
-        icon = "eclipse";
-        comment = "Integrated Development Environment";
-        desktopName = "Eclipse IDE";
-        genericName = "Integrated Development Environment";
-        categories = "Application;Development;";
-      };
-
-      buildInputs = [ makeWrapper ];
-
-      buildCommand = ''
-        # Unpack tarball.
-        mkdir -p $out
-        tar xfvz $src -C $out
-
-        # Patch binaries.
-        interpreter=$(echo ${stdenv.glibc.out}/lib/ld-linux*.so.2)
-        libCairo=$out/eclipse/libcairo-swt.so
-        patchelf --set-interpreter $interpreter $out/eclipse/eclipse
-        [ -f $libCairo ] && patchelf --set-rpath ${lib.makeLibraryPath [ freetype fontconfig libX11 libXrender zlib ]} "$libCairo"
-
-        # Create wrapper script.  Pass -configuration to store
-        # settings in ~/.eclipse/org.eclipse.platform_<version> rather
-        # than ~/.eclipse/org.eclipse.platform_<version>_<number>.
-        productId=$(sed 's/id=//; t; d' $out/eclipse/.eclipseproduct)
-        productVersion=$(sed 's/version=//; t; d' $out/eclipse/.eclipseproduct)
-        
-        makeWrapper $out/eclipse/eclipse $out/bin/eclipse \
-          --prefix PATH : ${jre}/bin \
-          --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath ([ glib gtk libXtst ] ++ lib.optional (webkitgtk2 != null) webkitgtk2)} \
-          --add-flags "-configuration \$HOME/.eclipse/''${productId}_$productVersion/configuration"
-
-        # Create desktop item.
-        mkdir -p $out/share/applications
-        cp ${desktopItem}/share/applications/* $out/share/applications
-        mkdir -p $out/share/pixmaps
-        ln -s $out/eclipse/icon.xpm $out/share/pixmaps/eclipse.xpm
-      ''; # */
-
-      meta = {
-        homepage = http://www.eclipse.org/;
-        inherit description;
-      };
-
-    };
-    
-in {
 
   eclipse_sdk_35 = buildEclipse {
     name = "eclipse-sdk-3.5.2";
@@ -312,7 +258,6 @@ in {
       "x86_64-linux" = fetchurl {
           url = http://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.4.2-201502041700/eclipse-SDK-4.4.2-linux-gtk-x86_64.tar.gz;
           sha256 = "0g00alsixfaakmn4khr0m9fxvkrbhbg6qqfa27xr6a9np6gzg98l";
-
         };
       "i686-linux" = fetchurl {
           url = http://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.4.2-201502041700/eclipse-SDK-4.4.2-linux-gtk.tar.gz;
@@ -328,7 +273,6 @@ in {
       "x86_64-linux" = fetchurl {
           url = http://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.5-201506032000/eclipse-SDK-4.5-linux-gtk-x86_64.tar.gz;
           sha256 = "0vfql4gh263ms8bg7sgn05gnjajplx304cn3nr03jlacgr3pkarf";
-
         };
       "i686-linux" = fetchurl {
           url = http://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.5-201506032000/eclipse-SDK-4.5-linux-gtk.tar.gz;
@@ -337,22 +281,53 @@ in {
     };
   };
 
-  eclipse-platform = buildEclipse {
+  eclipse_sdk_451 = buildEclipse {
+    name = "eclipse-sdk-4.5.1";
+    description = "Eclipse Mars Classic";
+    sources = {
+      "x86_64-linux" = fetchurl {
+          url = http://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.5.1-201509040015/eclipse-SDK-4.5.1-linux-gtk-x86_64.tar.gz;
+          sha256 = "b56503ab4b86f54e1cdc93084ef8c32fb1eaabc6f6dad9ef636153b14c928e02";
+        };
+      "i686-linux" = fetchurl {
+          url = http://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.5.1-201509040015/eclipse-SDK-4.5.1-linux-gtk.tar.gz;
+          sha256 = "f2e41da52e138276f8f121fd4d57c3f98839817836b56f8424e99b63c9b1b025";
+        };
+    };
+  };
+
+  eclipse-platform = eclipse-platform-451;
+
+  eclipse-platform-45 = buildEclipse {
     name = "eclipse-platform-4.5";
     description = "Eclipse platform";
     sources = {
       "x86_64-linux" = fetchurl {
-          url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.5-201506032000/eclipse-platform-4.5-linux-gtk-x86_64.tar.gz";
+          url = https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.5-201506032000/eclipse-platform-4.5-linux-gtk-x86_64.tar.gz;
           sha256 = "1510j41yr86pbzwf48kjjdd46nkpkh8zwn0hna0cqvsw1gk2vqcg";
-
         };
       "i686-linux" = fetchurl {
-          url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.5-201506032000/eclipse-platform-4.5-linux-gtk.tar.gz";
+          url = https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.5-201506032000/eclipse-platform-4.5-linux-gtk.tar.gz;
           sha256 = "1f97jd3qbi3830y3djk8bhwzd9whsq8gzfdk996chxc55prn0qbd";
         };
     };
   };
 
+  eclipse-platform-451 = buildEclipse {
+    name = "eclipse-platform-4.5.1";
+    description = "Eclipse platform";
+    sources = {
+      "x86_64-linux" = fetchurl {
+          url = https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.5.1-201509040015/eclipse-platform-4.5.1-linux-gtk-x86_64.tar.gz;
+          sha256 = "1m7bzyi20yss6cz74d7hvhxj1cddcpgzxjia5wcjycsvq33kkny0";
+        };
+      "i686-linux" = fetchurl {
+          url = https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.5.1-201509040015/eclipse-platform-4.5.1-linux-gtk.tar.gz;
+          sha256 = "17x8w4k0rba0c0v9ghxdl0zqfadla5c1aakfd5k0q9q3x3qi6rxp";
+        };
+    };
+  };
+
   eclipseWithPlugins = { eclipse, plugins ? [], jvmArgs ? [] }:
     let
       # Gather up the desired plugins.
@@ -369,21 +344,20 @@ in {
       dropinProp = "-D${dropinPropName}=${pluginEnv}/eclipse/dropins";
       jvmArgsText = stdenv.lib.concatStringsSep "\n" (jvmArgs ++ [dropinProp]);
 
-      # Prepare an eclipse.ini with the plugin directory.
-      origEclipseIni = builtins.readFile "${eclipse}/eclipse/eclipse.ini";
-      eclipseIniFile = writeText "eclipse.ini" ''
-        ${origEclipseIni}
-        ${jvmArgsText}
-      '';
-
       # Base the derivation name on the name of the underlying
       # Eclipse.
       name = (stdenv.lib.meta.appendToName "with-plugins" eclipse).name;
     in
       runCommand name { buildInputs = [ makeWrapper ]; } ''
-        mkdir -p $out/bin
+        mkdir -p $out/bin $out/etc
+
+        # Prepare an eclipse.ini with the plugin directory.
+        cat ${eclipse}/eclipse/eclipse.ini - > $out/etc/eclipse.ini <<EOF
+        ${jvmArgsText}
+        EOF
+
         makeWrapper ${eclipse}/bin/eclipse $out/bin/eclipse \
-          --add-flags "--launcher.ini ${eclipseIniFile}"
+          --add-flags "--launcher.ini $out/etc/eclipse.ini"
 
         ln -s ${eclipse}/share $out/
       '';

pkgs/applications/editors/eclipse/plugins.nix

@@ -152,12 +152,12 @@ rec {
 
   cdt = buildEclipseUpdateSite rec {
     name = "cdt-${version}";
-    version = "8.7.0";
+    version = "8.8.0";
 
     src = fetchzip {
       stripRoot = false;
-      url = "http://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/tools/cdt/releases/8.7/${name}.zip";
+      url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/tools/cdt/releases/8.8/${name}.zip";
-      sha256 = "0qpcjcl6n98x7ys4qz8p1x5hhk2ydrgh8w3r1kqk0zc7liqrx7vg";
+      sha256 = "1i1m7g5128q21njgrkiw71y4vi4aqzz8xdd4iv80j3nsvhbv6cnm";
     };
 
     meta = with stdenv.lib; {
@@ -212,6 +212,45 @@ rec {
     };
   };
 
+  cup = buildEclipsePluginBase rec {
+    name = "cup-${version}";
+    version = "1.0.0.201412081321";
+
+    srcFeature = fetchurl {
+      url = "http://www2.in.tum.de/projects/cup/eclipse/features/CupEclipsePluginFeature_${version}.jar";
+      sha256 = "353513445f77ed144687bafc20ab85dc31f2f95ffdc47f102ab773ab0b7afb8b";
+    };
+
+    srcPlugin1 = fetchurl {
+      url = "http://www2.in.tum.de/projects/cup/eclipse/plugins/CupReferencedLibraries_${version}.jar";
+      sha256 = "082b5ed8730ad065efaac6ea2812dae15669ae74a49778911125b171bea41187";
+    };
+
+    srcPlugin2 = fetchurl {
+      url = "http://www2.in.tum.de/projects/cup/eclipse/plugins/de.tum.in.www2.CupPlugin_${version}.jar";
+      sha256 = "6b67937fa11944b0330173a9d8564a19eccd705e76b96291d80077a1d7344939";
+    };
+
+    srcs = [ srcFeature srcPlugin1 srcPlugin2 ];
+
+    phases = [ "installPhase" ];
+
+    installPhase = ''
+      dropinDir="$out/eclipse/dropins/${name}"
+      mkdir -p $dropinDir/features
+      unzip ${srcFeature} -d $dropinDir/features/
+      mkdir -p $dropinDir/plugins
+      cp -v ${srcPlugin1} ${srcPlugin2} $dropinDir/plugins/
+    '';
+
+    meta = with stdenv.lib; {
+      homepage = http://www2.cs.tum.edu/projects/cup/eclipse.php;
+      description = "IDE for developing CUP based parsers";
+      platforms = platforms.all;
+      maintainers = [ maintainers.romildo ];
+    };
+  };
+
   eclemma = buildEclipseUpdateSite rec {
     name = "eclemma-${version}";
     version = "2.3.2.201409141915";
@@ -298,12 +337,12 @@ rec {
 
   jdt = buildEclipseUpdateSite rec {
     name = "jdt-${version}";
-    version = "4.5";
+    version = "4.5.1";
 
     src = fetchzip {
       stripRoot = false;
-      url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.5-201506032000/org.eclipse.jdt-4.5.zip";
+      url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.5.1-201509040015/org.eclipse.jdt-4.5.1.zip";
-      sha256 = "0zrdn26f7qsms2xfiyc049bhhh0czsbf989pgyq736b8hfmmh9iy";
+      sha256 = "0nxi552vvpjalnsqhc0zi6fgaj9p22amxsiczpv7za4kr7m47x73";
     };
 
     meta = with stdenv.lib; {
@@ -317,11 +356,11 @@ rec {
 
   scala = buildEclipseUpdateSite rec {
     name = "scala-${version}";
-    version = "4.1.1.20151201";
+    version = "4.3.0.201512011535";
 
     src = fetchzip {
       url = "http://download.scala-ide.org/sdk/lithium/e44/scala211/stable/update-site.zip";
-      sha256 = "19iqaha9c5n5hkyn83xj8znkvshm4823d65zigbj97fz8gzrr0la";
+      sha256 = "1j0qw4frkvvmyl64wdbznglgjjr9sfg8wb9npar0x7qv1hj4hw3x";
     };
 
     meta = with stdenv.lib; {

pkgs/applications/editors/emacs-modes/elpa-packages.nix

@@ -13,46 +13,17 @@ To update the list of packages from ELPA,
 
 { fetchurl, lib, stdenv, texinfo }:
 
-let
-
-  inherit (lib) makeScope mapAttrs;
-
-  json = builtins.readFile ./elpa-packages.json;
-  manifest = builtins.fromJSON json;
-
-  mkPackage = self: name: recipe:
-    let drv =
-          { elpaBuild, stdenv, fetchurl }:
-          let
-            unknownFetcher =
-              abort "emacs-${name}: unknown fetcher '${recipe.fetch.tag}'";
-            fetch =
-              { inherit fetchurl; }."${recipe.fetch.tag}"
-              or unknownFetcher;
-            args = builtins.removeAttrs recipe.fetch [ "tag" ];
-            src = fetch args;
-          in elpaBuild {
-            pname = name;
-            inherit (recipe) version;
-            inherit src;
-            packageRequires =
-              let lookupDep = d: self."${d}" or null;
-              in map lookupDep recipe.deps;
-            meta = {
-              homepage = "http://elpa.gnu.org/packages/${name}.html";
-              license = stdenv.lib.licenses.free;
-            };
-          };
-    in self.callPackage drv {};
-
-in
-
 self:
 
   let
-    super = removeAttrs (mapAttrs (mkPackage self) manifest) [ "dash" ];
 
-    elpaBuild = import ../../../build-support/emacs/melpa.nix {
+    imported = import ./elpa-generated.nix {
+      inherit (self) callPackage;
+    };
+
+    super = removeAttrs imported [ "dash" ];
+
+    elpaBuild = import ../../../build-support/emacs/elpa.nix {
       inherit fetchurl lib stdenv texinfo;
       inherit (self) emacs;
     };
@@ -63,11 +34,14 @@ self:
       });
     };
 
-    elpaPackages = super // {
+    overrides = {
       # These packages require emacs-25
       el-search = markBroken super.el-search;
       iterators = markBroken super.iterators;
       midi-kbd = markBroken super.midi-kbd;
       stream = markBroken super.stream;
     };
+
+    elpaPackages = super // overrides;
+
   in elpaPackages // { inherit elpaBuild elpaPackages; }

pkgs/applications/editors/emacs-modes/emms/default.nix

@@ -1,5 +1,5 @@
 { stdenv, fetchurl, emacs, texinfo
-, mpg321, vorbisTools, taglib, mp3info, alsaUtils }:
+, mpg321, vorbis-tools, taglib, mp3info, alsaUtils }:
 
 # XXX: EMMS also supports Xine, MPlayer, Jack, etc.
 
@@ -25,9 +25,9 @@ stdenv.mkDerivation rec {
     sed -i "emms-player-mpg321-remote.el" \
         -e 's|emms-player-mpg321-remote-command[[:blank:]]\+"mpg321"|emms-player-mpg321-remote-command "${mpg321}/bin/mpg321"|g'
     sed -i "emms-player-simple.el" \
-        -e 's|"ogg123"|"${vorbisTools}/bin/ogg123"|g'
+        -e 's|"ogg123"|"${vorbis-tools}/bin/ogg123"|g'
     sed -i "emms-info-ogginfo.el" \
-        -e 's|emms-info-ogginfo-program-name[[:blank:]]\+"ogginfo"|emms-info-ogginfo-program-name "${vorbisTools}/bin/ogginfo"|g'
+        -e 's|emms-info-ogginfo-program-name[[:blank:]]\+"ogginfo"|emms-info-ogginfo-program-name "${vorbis-tools}/bin/ogginfo"|g'
     sed -i "emms-info-libtag.el" \
         -e "s|\"emms-print-metadata\"|\"$out/bin/emms-print-metadata\"|g"
     sed -i "emms-volume-amixer.el" \

pkgs/applications/editors/emacs-modes/melpa-packages.nix

@@ -14,62 +14,174 @@ To update the list of packages from MELPA,
 
 { lib }:
 
-let
-
-  inherit (lib) makeScope mapAttrs;
-
-  json = builtins.readFile ./melpa-packages.json;
-  manifest = builtins.fromJSON json;
-
-  mkPackage = self: name: recipe:
-    let drv =
-          { melpaBuild, stdenv, fetchbzr, fetchcvs, fetchFromGitHub, fetchFromGitLab
-          , fetchgit, fetchhg, fetchsvn, fetchurl }:
-          let
-            unknownFetcher =
-              abort "emacs-${name}: unknown fetcher '${recipe.fetch.tag}'";
-            fetch =
-              {
-                inherit fetchbzr fetchcvs fetchFromGitHub fetchFromGitLab fetchgit fetchhg
-                        fetchsvn fetchurl;
-              }."${recipe.fetch.tag}"
-              or unknownFetcher;
-            args = builtins.removeAttrs recipe.fetch [ "tag" ];
-            src = fetch args;
-            recipeFile = fetchurl {
-              url = "https://raw.githubusercontent.com/milkypostman/melpa/${recipe.recipe.commit}/recipes/${name}";
-              inherit (recipe.recipe) sha256;
-            };
-          in melpaBuild {
-            pname = name;
-            inherit (recipe) version;
-            inherit recipeFile src;
-            packageRequires =
-              let lookupDep = d: self."${d}" or null;
-              in map lookupDep recipe.deps;
-            meta = {
-              homepage = "http://melpa.org/#/${name}";
-              license = stdenv.lib.licenses.free;
-            };
-          };
-    in self.callPackage drv {};
-
-in
-
 self:
 
   let
-    super = mapAttrs (mkPackage self) manifest;
+    imported = import ./melpa-generated.nix { inherit (self) callPackage; };
+    super = builtins.removeAttrs imported [
+      "swbuff-x" # required dependency swbuff is missing
+    ];
 
-    markBroken = pkg: pkg.override {
+    dontConfigure = pkg: pkg.override (args: {
-      melpaBuild = args: self.melpaBuild (args // {
+      melpaBuild = drv: args.melpaBuild (drv // {
-        meta = (args.meta or {}) // { broken = true; };
+        configureScript = "true";
       });
+    });
+
+    markBroken = pkg: pkg.override (args: {
+      melpaBuild = drv: args.melpaBuild (drv // {
+        meta = (drv.meta or {}) // { broken = true; };
+      });
+    });
+
+    overrides = {
+      ac-php = super.ac-php.override {
+        inherit (self.melpaPackages) company popup;
+      };
+
+      # upstream issue: mismatched filename
+      ack-menu = markBroken super.ack-menu;
+
+      airline-themes = super.airline-themes.override {
+        inherit (self.melpaPackages) powerline;
+      };
+
+      # upstream issue: missing file header
+      bufshow = markBroken super.bufshow;
+
+      # part of a larger package
+      # upstream issue: missing package version
+      cmake-mode = markBroken (dontConfigure super.cmake-mode);
+
+      # upstream issue: missing file header
+      cn-outline = markBroken super.cn-outline;
+
+      # upstream issue: missing file header
+      connection = markBroken super.connection;
+
+      # upstream issue: missing file header
+      crux = markBroken super.crux;
+
+      # upstream issue: missing file header
+      dictionary = markBroken super.dictionary;
+
+      easy-kill-extras = super.easy-kill-extras.override {
+        inherit (self.melpaPackages) easy-kill;
+      };
+
+      # missing git
+      egg = markBroken super.egg;
+
+      # upstream issue: missing file header
+      elmine = markBroken super.elmine;
+
+      ess-R-data-view = super.ess-R-data-view.override {
+        inherit (self.melpaPackages) ess ctable popup;
+      };
+
+      ess-R-object-popup = super.ess-R-object-popup.override {
+        inherit (self.melpaPackages) ess popup;
+      };
+
+      # missing OCaml
+      flycheck-ocaml = markBroken super.flycheck-ocaml;
+
+      # upstream issue: missing file header
+      fold-dwim = markBroken super.fold-dwim;
+
+      # build timeout
+      graphene = markBroken super.graphene;
+
+      # upstream issue: mismatched filename
+      helm-lobsters = markBroken super.helm-lobsters;
+
+      # upstream issue: missing file header
+      helm-words = markBroken super.helm-words;
+
+      # upstream issue: missing file header
+      ido-complete-space-or-hyphen = markBroken super.ido-complete-space-or-hyphen;
+
+      # upstream issue: missing file header
+      initsplit = markBroken super.initsplit;
+
+      # upstream issue: missing file header
+      jsfmt = markBroken super.jsfmt;
+
+      # upstream issue: missing file header
+      link = markBroken super.link;
+
+      # upstream issue: mismatched filename
+      link-hint = markBroken super.link-hint;
+
+      # part of a larger package
+      llvm-mode = dontConfigure super.llvm-mode;
+
+      # upstream issue: missing file header
+      maxframe = markBroken super.maxframe;
+
+      # missing OCaml
+      merlin = markBroken super.merlin;
+
+      mhc = super.mhc.override {
+        inherit (self.melpaPackages) calfw;
+      };
+
+      # missing .NET
+      nemerle = markBroken super.nemerle;
+
+      # part of a larger package
+      notmuch = dontConfigure super.notmuch;
+
+      # missing OCaml
+      ocp-indent = markBroken super.ocp-indent;
+
+      # upstream issue: missing file header
+      perl-completion = markBroken super.perl-completion;
+
+      # upstream issue: truncated file
+      powershell = markBroken super.powershell;
+
+      # upstream issue: mismatched filename
+      processing-snippets = markBroken super.processing-snippets;
+
+      # upstream issue: missing file header
+      qiita = markBroken super.qiita;
+
+      # upstream issue: missing package version
+      quack = markBroken super.quack;
+
+      # upstream issue: missing file header
+      railgun = markBroken super.railgun;
+
+      # upstream issue: missing file footer
+      seoul256-theme = markBroken super.seoul256-theme;
+
+      spaceline = super.spaceline.override {
+        inherit (self.melpaPackages) powerline;
+      };
+
+      # upstream issue: missing file header
+      speech-tagger = markBroken super.speech-tagger;
+
+      # upstream issue: missing file header
+      stgit = markBroken super.stgit;
+
+      # upstream issue: missing file header
+      textmate = markBroken super.textmate;
+
+      # missing OCaml
+      utop = markBroken super.utop;
+
+      # upstream issue: missing file header
+      voca-builder = markBroken super.voca-builder;
+
+      # upstream issue: missing file header
+      window-numbering = markBroken super.window-numbering;
+
+      # upstream issue: missing file header
+      zeitgeist = markBroken super.zeitgeist;
     };
 
-    melpaPackages = super // {
+    melpaPackages = super // overrides;
-      # broken upstream
-      ack-menu = markBroken super.ack-menu;
-    };
   in
     melpaPackages // { inherit melpaPackages; }

pkgs/applications/editors/emacs-modes/melpa-stable-packages.nix

@@ -16,62 +16,149 @@ To update the list of packages from MELPA Stable,
 
 { lib }:
 
-let
-
-  inherit (lib) makeScope mapAttrs;
-
-  json = builtins.readFile ./melpa-stable-packages.json;
-  manifest = builtins.fromJSON json;
-
-  mkPackage = self: name: recipe:
-    let drv =
-          { melpaBuild, stdenv, fetchbzr, fetchcvs, fetchFromGitHub, fetchFromGitLab
-          , fetchgit, fetchhg, fetchsvn, fetchurl }:
-          let
-            unknownFetcher =
-              abort "emacs-${name}: unknown fetcher '${recipe.fetch.tag}'";
-            fetch =
-              {
-                inherit fetchbzr fetchcvs fetchFromGitHub fetchFromGitLab fetchgit fetchhg
-                        fetchsvn fetchurl;
-              }."${recipe.fetch.tag}"
-              or unknownFetcher;
-            args = builtins.removeAttrs recipe.fetch [ "tag" ];
-            src = fetch args;
-            recipeFile = fetchurl {
-              url = "https://raw.githubusercontent.com/milkypostman/melpa/${recipe.recipe.commit}/recipes/${name}";
-              inherit (recipe.recipe) sha256;
-            };
-          in melpaBuild {
-            pname = name;
-            inherit (recipe) version;
-            inherit recipeFile src;
-            packageRequires =
-              let lookupDep = d: self."${d}" or null;
-              in map lookupDep recipe.deps;
-            meta = {
-              homepage = "http://stable.melpa.org/#/${name}";
-              license = stdenv.lib.licenses.free;
-            };
-          };
-    in self.callPackage drv {};
-
-in
-
 self:
 
   let
-    super = mapAttrs (mkPackage self) manifest;
+    imported = import ./melpa-stable-generated.nix { inherit (self) callPackage; };
 
-    markBroken = pkg: pkg.override {
+    super = imported;
-      melpaBuild = args: self.melpaBuild (args // {
+
-        meta = (args.meta or {}) // { broken = true; };
+    dontConfigure = pkg: pkg.override (args: {
+      melpaBuild = drv: args.melpaBuild (drv // {
+        configureScript = "true";
       });
+    });
+
+    markBroken = pkg: pkg.override (args: {
+      melpaBuild = drv: args.melpaBuild (drv // {
+        meta = (drv.meta or {}) // { broken = true; };
+      });
+    });
+
+    overrides = {
+      ac-php = super.ac-php.override {
+        inherit (self.melpaPackages) company popup;
+      };
+
+      # upstream issue: mismatched filename
+      ack-menu = markBroken super.ack-menu;
+
+      airline-themes = super.airline-themes.override {
+        inherit (self.melpaPackages) powerline;
+      };
+
+      # upstream issue: missing file header
+      bufshow = markBroken super.bufshow;
+
+      # part of a larger package
+      # upstream issue: missing package version
+      cmake-mode = markBroken (dontConfigure super.cmake-mode);
+
+      # upstream issue: missing file header
+      connection = markBroken super.connection;
+
+      # upstream issue: missing file header
+      crux = markBroken super.crux;
+
+      # upstream issue: missing file header
+      dictionary = markBroken super.dictionary;
+
+      easy-kill-extras = super.easy-kill-extras.override {
+        inherit (self.melpaPackages) easy-kill;
+      };
+
+      # missing git
+      egg = markBroken super.egg;
+
+      # upstream issue: missing file header
+      elmine = markBroken super.elmine;
+
+      ess-R-data-view = super.ess-R-data-view.override {
+        inherit (self.melpaPackages) ess ctable popup;
+      };
+
+      ess-R-object-popup = super.ess-R-object-popup.override {
+        inherit (self.melpaPackages) ess popup;
+      };
+
+      # missing OCaml
+      flycheck-ocaml = markBroken super.flycheck-ocaml;
+
+      # upstream issue: missing file header
+      fold-dwim = markBroken super.fold-dwim;
+
+      # build timeout
+      graphene = markBroken super.graphene;
+
+      # upstream issue: mismatched filename
+      helm-lobsters = markBroken super.helm-lobsters;
+
+      # upstream issue: missing file header
+      ido-complete-space-or-hyphen = markBroken super.ido-complete-space-or-hyphen;
+
+      # upstream issue: missing file header
+      initsplit = markBroken super.initsplit;
+
+      # upstream issue: missing file header
+      jsfmt = markBroken super.jsfmt;
+
+      # upstream issue: missing file header
+      link = markBroken super.link;
+
+      # upstream issue: mismatched filename
+      link-hint = markBroken super.link-hint;
+
+      # upstream issue: missing file header
+      maxframe = markBroken super.maxframe;
+
+      # missing OCaml
+      merlin = markBroken super.merlin;
+
+      mhc = super.mhc.override {
+        inherit (self.melpaPackages) calfw;
+      };
+
+      # missing .NET
+      nemerle = markBroken super.nemerle;
+
+      # part of a larger package
+      notmuch = dontConfigure super.notmuch;
+
+      # missing OCaml
+      ocp-indent = markBroken super.ocp-indent;
+
+      # upstream issue: truncated file
+      powershell = markBroken super.powershell;
+
+      # upstream issue: mismatched filename
+      processing-snippets = markBroken super.processing-snippets;
+
+      # upstream issue: missing file header
+      qiita = markBroken super.qiita;
+
+      spaceline = super.spaceline.override {
+        inherit (self.melpaPackages) powerline;
+      };
+
+      # upstream issue: missing file header
+      speech-tagger = markBroken super.speech-tagger;
+
+      # upstream issue: missing file header
+      stgit = markBroken super.stgit;
+
+      # upstream issue: missing file header
+      textmate = markBroken super.textmate;
+
+      # missing OCaml
+      utop = markBroken super.utop;
+
+      # upstream issue: missing file header
+      voca-builder = markBroken super.voca-builder;
+
+      # upstream issue: missing file header
+      window-numbering = markBroken super.window-numbering;
     };
 
-    melpaStablePackages = super // {
+    melpaStablePackages = super // overrides;
-      # broken upstream
-      ack-menu = markBroken super.ack-menu;
-    };
   in
     melpaStablePackages // { inherit melpaStablePackages; }

pkgs/applications/editors/idea/common.nix

@@ -1,7 +1,7 @@
 { stdenv, fetchurl, makeDesktopItem, makeWrapper, patchelf, p7zip
-, coreutils, gnugrep, which, git, python, unzip, androidsdk }:
+, coreutils, gnugrep, which, git, python, unzip, jdk }:
 
-{ name, product, version, build, src, meta, jdk } @ attrs:
+{ name, product, version, build, src, meta } @ attrs:
 
 with stdenv.lib;
 

pkgs/applications/editors/idea/default.nix

@@ -1,6 +1,6 @@
 { stdenv, callPackage, fetchurl, makeDesktopItem, makeWrapper, patchelf
 , coreutils, gnugrep, which, git, python, unzip, p7zip
-, androidsdk, jdk, oraclejdk8
+, androidsdk, jdk
 }:
 
 assert stdenv.isLinux;
@@ -8,12 +8,7 @@ assert stdenv.isLinux;
 let
 
   bnumber = with stdenv.lib; build: last (splitString "-" build);
-  mkIdeaProduct' = callPackage ./common.nix { };
+  mkIdeaProduct = callPackage ./common.nix { };
-  mkIdeaProduct = attrs: mkIdeaProduct' ({
-      # After IDEA 15 we can no longer use OpenJDK.
-      # https://youtrack.jetbrains.com/issue/IDEA-147272
-      jdk = if (bnumber attrs.build) < "143" then jdk else oraclejdk8;
-  } // attrs);
 
   buildAndroidStudio = { name, version, build, src, license, description }:
     let drv = (mkIdeaProduct rec {
@@ -166,13 +161,13 @@ in
 
   clion = buildClion rec {
     name = "clion-${version}";
-    version = "1.0.4";
+    version = "1.2.4";
-    build = "141.874";
+    build = "143.1186";
     description  = "C/C++ IDE. New. Intelligent. Cross-platform";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/cpp/${name}.tar.gz";
-      sha256 = "1cz59h2znzjy7zncc049f2w30kc89rvmk7l51a1y6ymf9s7cj4cm";
+      sha256 = "0asjgfshbximjk6i57fz3d2ykby5qw5x6nhw91cpzrzszc59dmm2";
     };
   };
 
@@ -190,25 +185,25 @@ in
 
   idea-community = buildIdea rec {
     name = "idea-community-${version}";
-    version = "15.0.2";
+    version = "15.0.3";
-    build = "IC-143.1184";
+    build = "IC-143.1821";
     description = "Integrated Development Environment (IDE) by Jetbrains, community edition";
     license = stdenv.lib.licenses.asl20;
     src = fetchurl {
       url = "https://download.jetbrains.com/idea/ideaIC-${version}.tar.gz";
-      sha256 = "0y8rrbsb87avn1dhw5r1xb4axpbm1qvgcd0aysir9bqzhx8qg64c";
+      sha256 = "15hj4kqlpg3b4xp2v4f4iidascrc8s97mq8022nvbcs879gpajqa";
     };
   };
 
   idea-ultimate = buildIdea rec {
     name = "idea-ultimate-${version}";
-    version = "15.0.2";
+    version = "15.0.3";
-    build = "IU-143.1184";
+    build = "IU-143.1821";
     description = "Integrated Development Environment (IDE) by Jetbrains, requires paid license";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/idea/ideaIU-${version}.tar.gz";
-      sha256 = "1r8gw7mv1b0k223k76ib08f4yrrgrw24qmhkbx88rknmls5nsgss";
+      sha256 = "02v8v2a7p620l4mlk7jqw9sl2455a1nya1dy84y23h9vq20aihlh";
     };
   };
 

pkgs/applications/editors/neovim/default.nix

@@ -15,11 +15,10 @@ with stdenv.lib;
 
 let
 
-  version = "0.1.1";
-
   # Note: this is NOT the libvterm already in nixpkgs, but some NIH silliness:
-  neovimLibvterm = let version = "2015-11-06"; in stdenv.mkDerivation {
+  neovimLibvterm = stdenv.mkDerivation rec {
     name = "neovim-libvterm-${version}";
+    version = "2015-11-06";
 
     src = fetchFromGitHub {
       sha256 = "0f9r0wnr9ajcdd6as24igmch0n8s1annycb9f4k0vg6fngwaypy9";
@@ -59,8 +58,9 @@ let
     ignoreCollisions = true;
   };
 
-  neovim = stdenv.mkDerivation {
+  neovim = stdenv.mkDerivation rec {
     name = "neovim-${version}";
+    version = "0.1.1";
 
     src = fetchFromGitHub {
       sha256 = "0crswjslp687yp1cpn7nmm0j2sccqhcxryzxv1s81cgpai0fzf60";
@@ -145,8 +145,11 @@ let
   };
 
 in if (vimAlias == false && configure == null) then neovim else stdenv.mkDerivation {
-  name = "neovim-${version}-configured";
+  name = "neovim-${neovim.version}-configured";
+  inherit (neovim) version;
+
   nativeBuildInputs = [ makeWrapper ];
+
   buildCommand = ''
     mkdir -p $out/bin
     for item in ${neovim}/bin/*; do

pkgs/applications/graphics/ImageMagick/default.nix

@@ -15,7 +15,11 @@ stdenv.mkDerivation rec {
   version = "6.9.2-0";
 
   src = fetchurl {
-    url = "mirror://imagemagick/releases/ImageMagick-${version}.tar.xz";
+    urls = [
+      "mirror://imagemagick/releases/ImageMagick-${version}.tar.xz"
+      # the original source above removes tarballs quickly
+      "http://distfiles.macports.org/ImageMagick/ImageMagick-${version}.tar.xz"
+    ];
     sha256 = "17ir8bw1j7g7srqmsz3rx780sgnc21zfn0kwyj78iazrywldx8h7";
   };
 

pkgs/applications/graphics/apitrace/default.nix

@@ -1,8 +1,8 @@
 { stdenv, fetchFromGitHub, cmake, libX11, procps, python, qtbase }:
 
-let version = "7.1"; in
+stdenv.mkDerivation rec {
-stdenv.mkDerivation {
   name = "apitrace-${version}";
+  version = "7.1";
 
   src = fetchFromGitHub {
     sha256 = "1n2gmsjnpyam7isg7n1ksggyh6y1l8drvx0a93bnvbcskr7jiz9a";
@@ -20,7 +20,6 @@ stdenv.mkDerivation {
   '';
 
   meta = with stdenv.lib; {
-    inherit version;
     homepage = https://apitrace.github.io;
     description = "Tools to trace OpenGL, OpenGL ES, Direct3D, and DirectDraw APIs";
     license = licenses.mit;

pkgs/applications/graphics/gimp/2.8.nix

@@ -27,6 +27,8 @@ stdenv.mkDerivation rec {
 
   #configureFlags = [ "--disable-print" ];
 
+  enableParallelBuilding = true;
+
   # "screenshot" needs this.
   NIX_LDFLAGS = "-rpath ${xorg.libX11.out}/lib"
     + stdenv.lib.optionalString stdenv.isDarwin " -lintl";

pkgs/applications/graphics/inkscape/configure-python-libs.patch

@@ -1,15 +0,0 @@
-Work around Python misdetection and set `PYTHON_LIBS' to
-"-L/nix/store/... -lpython2.4" instead of "/nix/store/.../libpython2.4.so".
-Changed to 2.5.
-
---- inkscape-0.45.1/configure	2007-03-20 14:56:43.000000000 +0100
-+++ inkscape-0.45.1/configure	2008-02-22 16:19:10.000000000 +0100
-@@ -10202,7 +10202,7 @@ if test "x$with_python" = "xyes"; then
-     if test "$?" -gt "0"; then
-         with_python="no"
-     else
--        checkPYTHON_LIBS=`python -c "import distutils.sysconfig ; print '%s/%s %s' % (distutils.sysconfig.get_config_var('LIBPL'),distutils.sysconfig.get_config_var('LDLIBRARY'),distutils.sysconfig.get_config_var('LIBS'))" 2>/dev/null`
-+        checkPYTHON_LIBS=`python -c "import distutils.sysconfig ; print '-L%s -lpython2.5 %s' % (distutils.sysconfig.get_config_var('LIBDIR'),distutils.sysconfig.get_config_var('LIBS'))" 2>/dev/null`
-         if test "$?" -gt "0"; then
-             with_python="no"
-         else

pkgs/applications/graphics/openimageio/default.nix

@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   name = "openimageio-${version}";
-  version = "1.4.16";
+  version = "1.6.9";
 
   src = fetchurl {
     url = "https://github.com/OpenImageIO/oiio/archive/Release-${version}.zip";
-    sha256 = "0f9gspsjhniz992c04dm4lvffzz7zjqn1n34nqn6c32r498kimcj";
+    sha256 = "0942xj877875f4dpfg7aqwyw015y82vkhaqap7yhybmvzsfj7wki";
   };
 
   buildInputs = [

pkgs/applications/graphics/photoqt/default.nix

@@ -17,7 +17,9 @@ stdenv.mkDerivation rec {
     sha256 = "0j2kvxfb5pd9abciv161nkcsyam6n8kfqs8ymwj2mxiqflwbmfl1";
   };
 
-  buildInputs = [ cmake makeWrapper qtbase qttools exiv2 graphicsmagick ];
+  buildInputs = [
+    cmake makeWrapper qtbase qtquickcontrols qttools exiv2 graphicsmagick
+  ];
 
   preConfigure = ''
     export MAGICK_LOCATION="${graphicsmagick}/include/GraphicsMagick"

pkgs/applications/graphics/sane/backends/generic.nix

@@ -1,5 +1,5 @@
 { stdenv, fetchurl
-, avahi, libusb1, libv4l, net_snmp
+, avahi, libjpeg, libusb1, libv4l, net_snmp
 , gettext, pkgconfig
 
 # List of { src name backend } attibute sets - see installFirmware below:
@@ -13,7 +13,7 @@
 }:
 
 stdenv.mkDerivation {
-  inherit src;
+  inherit src version;
 
   name = "sane-backends-${version}";
 
@@ -50,11 +50,12 @@ stdenv.mkDerivation {
     mkdir -p $out/etc/udev/rules.d/
     ./tools/sane-desc -m udev > $out/etc/udev/rules.d/49-libsane.rules || \
     cp tools/udev/libsane.rules $out/etc/udev/rules.d/49-libsane.rules
+
+    substituteInPlace $out/lib/libsane.la \
+      --replace "-ljpeg" "-L${libjpeg}/lib -ljpeg"
   '' + stdenv.lib.concatStrings (builtins.map installFirmware compatFirmware);
 
   meta = with stdenv.lib; {
-    inherit version;
-
     description = "SANE (Scanner Access Now Easy) backends";
     longDescription = ''
       Collection of open-source SANE backends (device drivers).

pkgs/applications/graphics/sane/backends/git.nix

@@ -1,10 +1,10 @@
 { callPackage, fetchgit, ... } @ args:
 
 callPackage ./generic.nix (args // {
-  version = "2016-01-09";
+  version = "2016-01-25";
   src = fetchgit {
-    sha256 = "440f88a4126841cfd139b17902ceb940bbf189defe21b208e93bfd474cfb16e8";
+    sha256 = "db1fecd671bd8b3a777138bb4815285b4364ee3ad01ab05424b4aa0c20ed9919";
-    rev = "f78e85cad666492fadd5612af77fa7c84e270a12";
+    rev = "056f590f2d147099554d97a89dd5e0ddfa8d6dda";
     url = "git://alioth.debian.org/git/sane/sane-backends.git";
   };
 })

pkgs/applications/graphics/simple-scan/default.nix

@@ -1,9 +1,9 @@
 { stdenv, fetchurl, cairo, colord, glib, gtk3, gusb, intltool, itstool
 , libusb1, libxml2, pkgconfig, sane-backends, vala, wrapGAppsHook }:
 
-let version = "3.19.4"; in
 stdenv.mkDerivation rec {
   name = "simple-scan-${version}";
+  version = "3.19.4";
 
   src = fetchurl {
     sha256 = "1v9sify1s38qd5sfg26m7sdg9bkrfmai2nijs4wzah7xa9p23c83";
@@ -26,7 +26,6 @@ stdenv.mkDerivation rec {
   doCheck = true;
 
   meta = with stdenv.lib; {
-    inherit version;
     description = "Simple scanning utility";
     longDescription = ''
       A really easy way to scan both documents and photos. You can crop out the

pkgs/applications/graphics/swingsane/default.nix

@@ -1,8 +1,8 @@
 { stdenv, fetchurl, makeDesktopItem, unzip, jre }:
 
-let version = "0.2"; in
 stdenv.mkDerivation rec {
   name = "swingsane-${version}";
+  version = "0.2";
 
   src = fetchurl {
     sha256 = "15pgqgyw46yd2i367ax9940pfyvinyw2m8apmwhrn0ix5nywa7ni";
@@ -44,7 +44,6 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    inherit version;
     description = "Java GUI for SANE scanner servers (saned)";
     longDescription = ''
       SwingSane is a powerful, cross platform, open source Java front-end for

pkgs/applications/kde-apps-15.12/kdelibs/polkit-install.patch

@@ -1,12 +0,0 @@
-diff -ru -x '*~' kdelibs-4.6.90-orig/kdecore/auth/ConfigureChecks.cmake kdelibs-4.6.90/kdecore/auth/ConfigureChecks.cmake
---- kdelibs-4.6.90-orig/kdecore/auth/ConfigureChecks.cmake	2011-05-20 22:24:54.000000000 +0200
-+++ kdelibs-4.6.90/kdecore/auth/ConfigureChecks.cmake	2011-07-12 14:03:00.000000000 +0200
-@@ -139,7 +139,7 @@
-         ${CMAKE_INSTALL_PREFIX} _KDE4_AUTH_POLICY_FILES_INSTALL_DIR
-         ${POLKITQT-1_POLICY_FILES_INSTALL_DIR})
- 
--    set(KDE4_AUTH_POLICY_FILES_INSTALL_DIR ${_KDE4_AUTH_POLICY_FILES_INSTALL_DIR} CACHE STRING 
-+    set(KDE4_AUTH_POLICY_FILES_INSTALL_DIR "\${CMAKE_INSTALL_PREFIX}/share/polkit-1/actions" CACHE STRING 
-         "Where policy files generated by KAuth will be installed" FORCE)
- elseif(KDE4_AUTH_BACKEND_NAME STREQUAL "FAKE")
-     set (KAUTH_COMPILING_FAKE_BACKEND TRUE)

pkgs/applications/misc/albert/default.nix

@@ -0,0 +1,26 @@
+{ stdenv, fetchFromGitHub, qtbase, qtx11extras, makeQtWrapper, muparser, cmake }:
+
+stdenv.mkDerivation rec {
+  name    = "albert-${version}";
+  version = "0.8.0";
+
+  src = fetchFromGitHub {
+    owner  = "manuelschneid3r";
+    repo   = "albert";
+    rev    = "v${version}";
+    sha256 = "0lzj1gbcc5sp2x1c0d3s21y55kcnnn4dmy8d205mrgnyavjrak7n";
+  };
+
+  buildInputs = [ cmake qtbase qtx11extras muparser makeQtWrapper ];
+
+  fixupPhase = ''
+    wrapQtProgram $out/bin/albert
+  '';
+
+  meta = {
+    homepage    = https://github.com/manuelSchneid3r/albert;
+    description = "Desktop agnostic launcher";
+    license     = stdenv.lib.licenses.gpl3Plus;
+    maintainers = [ stdenv.lib.maintainers.ericsagnes ];
+  };
+}

pkgs/applications/misc/direwolf/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, unzip, alsaLib }:
+{ stdenv, fetchFromGitHub, unzip, alsaLib }:
 let
   version = "1.2";
 in
@@ -6,9 +6,11 @@ stdenv.mkDerivation rec {
   name = "direwolf-${version}";
   inherit version;
 
-  src = fetchurl {
+  src = fetchFromGitHub {
-    url = "http://home.comcast.net/~wb2osz/Version%201.2/direwolf-${version}-src.zip";
+    owner = "wb2osz";
-    sha256 = "0csl6harx7gmjmamxy0ylzhbamppphffisk8j33dc6g08k6rc77f";
+    repo = "direwolf";
+    rev = "8b81a32";
+    sha256 = "0r4fgdxghh292bzhqshr7zl5cg2lfsvlgmy4d5vqcli7x6qa1gcs";
   };
 
   buildInputs = [

pkgs/applications/misc/get_iplayer/default.nix

@@ -1,23 +1,28 @@
 {stdenv, fetchurl, flvstreamer, ffmpeg, makeWrapper, perl, buildPerlPackage, perlPackages, vlc, rtmpdump}:
 buildPerlPackage {
-  name = "get_iplayer-2.86";
+  name = "get_iplayer-2.94";
 
   buildInputs = [makeWrapper perl];
-  propagatedBuildInputs = with perlPackages; [HTMLParser HTTPCookies LWP];
+  propagatedBuildInputs = with perlPackages; [HTMLParser HTTPCookies LWP XMLSimple];
 
   preConfigure = "touch Makefile.PL";
   doCheck = false;
 
+  patchPhase = ''
+    sed -e 's|^update_script|#update_script|' \
+        -e '/WARNING.*updater/d' \
+        -i get_iplayer
+  '';
+
   installPhase = '' 
     mkdir -p $out/bin
     cp get_iplayer $out/bin
-    sed -i 's|^update_script|#update_script|' $out/bin/get_iplayer
     wrapProgram $out/bin/get_iplayer --suffix PATH : ${ffmpeg.bin}/bin:${flvstreamer}/bin:${vlc}/bin:${rtmpdump}/bin --prefix PERL5LIB : $PERL5LIB
   '';  
   
   src = fetchurl {
-    url = ftp://ftp.infradead.org/pub/get_iplayer/get_iplayer-2.86.tar.gz;
+    url = ftp://ftp.infradead.org/pub/get_iplayer/get_iplayer-2.94.tar.gz;
-    sha256 = "0zhcw0ikxrrz1jayx7jjgxmdf7gzk4pmzfvpraxmv64xwzgc1sc1";
+    sha256 = "16p0bw879fl8cs6rp37g1hgrcai771z6rcqk2nvm49kk39dx1zi4";
   };
   
 }

pkgs/applications/misc/guake/default.nix

@@ -0,0 +1,77 @@
+/* Beware!
+After starting Guake it will give the error message "Guake can not init! Gconf Error. Have you installed guake.schemas properly?",
+which will have to be resolved manually, because I have not found a way to automate this, without being impure.
+
+If you have Guake installed, you can use `nix-build -A gnome3.guake` to get the path to the build directory in the nix store,
+which then can be used in the following command to install the schemas file of Guake:
+gconftool-2 --install-schema-file /path/returned/by/nix-build/share/gconf/schemas/guake.schemas
+
+It can be removed again by the following command:
+gconftool-2 --recursive-unset /apps/guake
+*/
+{ stdenv, fetchurl, lib
+, pkgconfig, libtool, intltool, makeWrapper
+, dbus, gtk2, gconf, python2, python2Packages, libutempter, vte, keybinder, gnome2, gnome3 }:
+
+with lib;
+
+let inputs = [ dbus gtk2 gconf python2 libutempter vte keybinder gnome3.gnome_common ];
+    pySubDir = "lib/${python2.libPrefix}/site-packages";
+    pyPath = makeSearchPath pySubDir (attrVals [ "dbus" "notify" "pyGtkGlade" "pyxdg" ] python2Packages ++ [ gnome2.gnome_python ]);
+ in stdenv.mkDerivation rec {
+  name = "guake-${version}";
+  version = "0.8.3";
+
+  src = fetchurl {
+    url = "https://github.com/Guake/guake/archive/${version}.tar.gz";
+    sha256 = "1lbmdz3i9a97840h8239s360hd37nmhy3hs6kancxbzl1512ak1y";
+  };
+
+  nativeBuildInputs = [ pkgconfig libtool intltool makeWrapper ];
+
+  buildInputs = inputs ++ (with python2Packages; [ pyGtkGlade pyxdg ]);
+
+  patchPhase = ''
+    patchShebangs .
+  '';
+
+  configureScript = "./autogen.sh";
+
+  configureFlags = [
+    "--sysconfdir=/etc"
+    "--localstatedir=/var"
+    "--disable-schemas-install"
+  ];
+
+  installFlags = [
+    # Configuring the installation to not install gconf schemas is not always supported,
+    # therefore gconftool-2 has this variable, which will make gconftool-2 not update any of the databases.
+    "GCONF_DISABLE_MAKEFILE_SCHEMA_INSTALL=1"
+    "sysconfdir=\${out}/etc"
+    "localstatedir=\${TMPDIR}"
+  ];
+
+  postInstall = ''
+    mkdir -p $out/share/gconf/schemas
+    cp data/guake.schemas $out/share/gconf/schemas
+  '';
+
+  postFixup = ''
+    for bin in $out/bin/{guake,guake-prefs}; do
+      substituteInPlace $bin \
+        --replace '/usr/bin/env python2' ${python2}/bin/python2
+      wrapProgram $bin \
+        --prefix XDG_DATA_DIRS : "$out/share:$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH" \
+        --prefix LD_LIBRARY_PATH : ${makeLibraryPath inputs} \
+        --prefix PYTHONPATH : "$out/${pySubDir}:${pyPath}:$PYTHONPATH"
+    done
+  '';
+
+  meta = {
+    description = "Drop-down terminal for GNOME";
+    homepage = http://guake-project.org;
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.msteen ];
+  };
+}

pkgs/applications/misc/ipmiview/default.nix

@@ -0,0 +1,34 @@
+{ stdenv, fetchurl, patchelf, makeWrapper, xorg, gcc }:
+
+assert stdenv.isLinux;
+
+stdenv.mkDerivation rec {
+   name = "IPMIView-${version}";
+   version = "20151223";
+
+   src = fetchurl {
+     url = "ftp://ftp.supermicro.com/utility/IPMIView/Linux/IPMIView_V2.11.0_bundleJRE_Linux_x64_${version}.tar.gz";
+     sha256 = "1rv9j0id7i2ipm25n60bpfdm1gj44xg2aj8rnx4s6id3ln90q121";
+   };
+
+   buildInputs = [ patchelf makeWrapper ];
+
+   buildPhase = with xorg; ''
+     patchelf --set-rpath "${libX11}/lib:${libXext}/lib:${libXrender}/lib:${libXtst}/lib:${libXi}/lib" ./jre/lib/amd64/xawt/libmawt.so
+     patchelf --set-rpath "${gcc.cc}/lib" ./libiKVM64.so
+     patchelf --set-rpath "${libXcursor}/lib:${libX11}/lib:${libXext}/lib:${libXrender}/lib:${libXtst}/lib:${libXi}/lib" --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" ./jre/bin/javaws
+     patchelf --set-rpath "${gcc.cc}/lib:$out/jre/lib/amd64/jli" --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" ./jre/bin/java
+   '';
+
+   installPhase = ''
+     mkdir -p $out/bin
+     cp -R . $out/
+     echo "$out/jre/bin/java -jar $out/IPMIView20.jar" > $out/bin/IPMIView
+     chmod +x $out/bin/IPMIView
+   '';
+
+   meta = with stdenv.lib; {
+    license = licenses.unfree;
+   };
+  }
+

pkgs/applications/misc/kdbplus/default.nix

@@ -8,17 +8,17 @@ let
 in
 stdenv.mkDerivation rec {
   name    = "kdbplus-${version}";
-  version = "3.2";
+  version = "3.3";
 
   src = requireFile {
     message = ''
       Nix can't download kdb+ for you automatically. Go to
       http://kx.com and download the free, 32-bit version for
       Linux. Then run "nix-prefetch-url file:///linux.zip" in the
-      directory where you saved it. Note you need version 3.2.
+      directory where you saved it. Note you need version 3.3.
     '';
     name   = "linux.zip";
-    sha256 = "0ah1kfvxnrck1kg8j7rpzgj6amji62zbm4ya6q55l54gm3qq6q0r";
+    sha256 = "5fd0837599e24f0f437a8314510888a86ab0787684120a8fcf592299800aa940";
   };
 
   dontStrip = true;

pkgs/applications/misc/ocropus/default.nix

@@ -2,11 +2,11 @@
 
 let
   getmodel = name: sha256: {
+    inherit name;
     src = fetchurl {
       url = "http://www.tmbdev.net/ocropy/${name}";
       inherit sha256;
     };
-    inherit name;
   };
 
   models = [
@@ -16,10 +16,10 @@ let
       "1wlwvxn91ilgmlri1hj81arl3mbzxc24ycdnkf5icq4hdi4c6y8b")
   ];
 
-  version = "20150316";
 in
-pythonPackages.buildPythonPackage {
+pythonPackages.buildPythonPackage rec {
   name = "ocropus-${version}";
+  version = "20150316";
 
   src = fetchFromGitHub {
     sha256 = "0m5bm2ah3p29c13vp7hz7rm058qnlm840zd8xv20byijhlz0447g";
@@ -49,7 +49,6 @@ pythonPackages.buildPythonPackage {
   '';
 
   meta = with stdenv.lib; {
-    inherit version;
     description = "Open source document analysis and OCR system";
     license = licenses.asl20;
     homepage = https://github.com/tmbdev/ocropy/;

pkgs/applications/misc/quicksynergy/default.nix

@@ -0,0 +1,35 @@
+{stdenv, fetchurl, pkgconfig, gtk2, synergy}:
+
+stdenv.mkDerivation rec {
+  name = "quicksynergy-${version}";
+  version = "0.9.0";
+  src = fetchurl {
+    url = "http://downloads.sourceforge.net/project/quicksynergy/Linux/${version}/quicksynergy-${version}.tar.gz";
+    sha256 = "1pi8503bg8q1psw50y6d780i33nnvfjqiy9vnr3v52pdcfip8pix";
+  };
+  buildInputs = [
+    pkgconfig
+    gtk2
+    synergy
+  ];
+  preBuild = "
+    sed -i 's@/usr/bin@${synergy.out}/bin@' src/synergy_config.c
+  ";
+  meta = {
+    description = "GUI application to share mouse and keyboard between computers";
+    longDescription = "
+      QuickSynergy is a graphical interface (GUI) for easily configuring
+      Synergy2, an application that allows the user to share his mouse and
+      keyboard between two or more computers.
+
+      Without the need for any external hardware, Synergy2 uses the TCP-IP
+      protocol to share the resources, even between machines with diferent
+      operating systems, such as Mac OS, Linux and Windows.
+
+      Remember to open port 24800 (used by synergys program) if you want to
+      host mouse and keyboard.";
+    homepage = https://code.google.com/p/quicksynergy/;
+    license = stdenv.lib.licenses.gpl2;
+    maintainers = [ stdenv.lib.maintainers.spinus ];
+  };
+}

pkgs/applications/misc/redshift/default.nix

@@ -7,13 +7,14 @@
 }:
 
 let
-  version = "1.11";
   mkFlag = flag: name: if flag
     then "--enable-${name}"
     else "--disable-${name}";
 in
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   name = "redshift-${version}";
+  version = "1.11";
+
   src = fetchurl {
     sha256 = "0ngkwj7rg8nfk806w0sg443w6wjr91xdc0zisqfm5h2i77wm1qqh";
     url = "https://github.com/jonls/redshift/releases/download/v${version}/redshift-${version}.tar.xz";
@@ -51,7 +52,6 @@ stdenv.mkDerivation {
   '';
 
   meta = with stdenv.lib; {
-    inherit version;
     description = "Gradually change screen color temperature";
     longDescription = ''
       The color temperature is set according to the position of the

pkgs/applications/misc/scim/default.nix

@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
   name = "scim-${version}";
 
   src = fetchurl {
-    url = "https://github.com/andmarti1424/scim/archive/v${version}.tar.gz";
+    url = "https://github.com/andmarti1424/sc-im/archive/v${version}.tar.gz";
     sha256 = "00rjz344acw0bxv78x1w9jz8snl9lb9qhr9z22phxinidnd3vaaz";
   };
 

pkgs/applications/misc/slic3r/fix-no-display.patch

@@ -1,59 +0,0 @@
-diff --git a/Build.PL b/Build.PL
-index 8b21c15..fd3aff0 100644
---- a/Build.PL
-+++ b/Build.PL
-@@ -33,9 +33,6 @@ my $sudo    = grep { $_ eq '--sudo' } @ARGV;
- my $gui     = grep { $_ eq '--gui' } @ARGV;
- my $xs_only = grep { $_ eq '--xs' }  @ARGV;
- if ($gui) {
--    %prereqs = qw(
--    Wx                              0.9918
--    );
-     %recommends = qw(
-     Growl::GNTP                     0.15
-     Wx::GLCanvas                    0
-diff --git a/lib/Slic3r/GUI.pm b/lib/Slic3r/GUI.pm
-index 842ff44..ea0af64 100644
---- a/lib/Slic3r/GUI.pm
-+++ b/lib/Slic3r/GUI.pm
-@@ -26,7 +26,7 @@ use Slic3r::GUI::OptionsGroup::Field;
- use Slic3r::GUI::SimpleTab;
- use Slic3r::GUI::Tab;
- 
--our $have_OpenGL = eval "use Slic3r::GUI::PreviewCanvas; 1";
-+our $have_OpenGL = 0;
- 
- use Wx 0.9901 qw(:bitmap :dialog :icon :id :misc :systemsettings :toplevelwindow
-     :filedialog);
-diff --git a/lib/Slic3r/GUI/Plater/2DToolpaths.pm b/lib/Slic3r/GUI/Plater/2DToolpaths.pm
-index 8e48a72..7bed973 100644
---- a/lib/Slic3r/GUI/Plater/2DToolpaths.pm
-+++ b/lib/Slic3r/GUI/Plater/2DToolpaths.pm
-@@ -90,18 +90,20 @@ sub set_z {
- package Slic3r::GUI::Plater::2DToolpaths::Canvas;
- 
- use Wx::Event qw(EVT_PAINT EVT_SIZE EVT_ERASE_BACKGROUND EVT_IDLE EVT_MOUSEWHEEL EVT_MOUSE_EVENTS);
--use OpenGL qw(:glconstants :glfunctions :glufunctions);
--use base qw(Wx::GLCanvas Class::Accessor);
--use Wx::GLCanvas qw(:all);
- use List::Util qw(min first);
- use Slic3r::Geometry qw(scale unscale epsilon);
- 
- __PACKAGE__->mk_accessors(qw(print z layers color init dirty bb));
- 
--# make OpenGL::Array thread-safe
--{
--    no warnings 'redefine';
--    *OpenGL::Array::CLONE_SKIP = sub { 1 };
-+if ($Slic3r::GUI::have_OpenGL) {
-+    use OpenGL qw(:glconstants :glfunctions :glufunctions);
-+    use Wx::GLCanvas qw(:all);
-+    use base qw(Wx::GLCanvas Class::Accessor);
-+    # make OpenGL::Array thread-safe
-+    {
-+        no warnings 'redefine';
-+        *OpenGL::Array::CLONE_SKIP = sub { 1 };
-+    }
- }
- 
- sub new {

pkgs/applications/misc/solaar/default.nix

@@ -0,0 +1,43 @@
+{fetchurl, stdenv, makeWrapper, gtk3, python3Packages}:
+let
+  version = "0.9.2";
+in
+stdenv.mkDerivation {
+  name = "solaar-${version}";
+  src = fetchurl {
+    sha256 = "0954grz2adggfzcj4df4mpr4d7qyl7w8rb4j2s0f9ymawl92i05j";
+    url = "https://github.com/pwr/Solaar/archive/${version}.tar.gz";
+  };
+
+  buildInputs = [gtk3 python3Packages.pygobject3 python3Packages.pyudev];
+  enableParallelBuilding = true;
+  installPhase = ''
+    mkdir -p "$out";
+  '';
+  postInstall = ''
+    wrapProgram "$out/bin/solaar" \
+      --prefix PYTHONPATH : "$PYTHONPATH" \
+      --prefix GI_TYPELIB_PATH : "$GI_TYPELIB_PATH"
+    wrapProgram "$out/bin/solaar-cli" \
+      --prefix PYTHONPATH : "$PYTHONPATH" \
+      --prefix GI_TYPELIB_PATH : "$GI_TYPELIB_PATH"
+  '';
+  meta = with stdenv.lib; {
+    description = "Linux devices manager for the Logitech Unifying Receiver";
+    longDescription = ''
+      Solaar is a Linux device manager for Logitech’s Unifying Receiver
+      peripherals. It is able to pair/unpair devices to the receiver, and for
+      most devices read battery status.
+
+      It comes in two flavors, command-line and GUI. Both are able to list the
+      devices paired to a Unifying Receiver, show detailed info for each
+      device, and also pair/unpair supported devices with the receiver.
+
+      To be able to use it, make sure you have access to /dev/hidraw* files.
+    '';
+    license = licenses.gpl2;
+    homepage = https://pwr.github.io/Solaar/;
+    platforms = platforms.linux;
+    maintainers = [maintainers.spinus];
+  };
+}