Merge branch 'master' into add-missing-licenses

Conflicts:
	pkgs/applications/version-management/subversion/default.nix

doc/package-notes.xml

@@ -705,4 +705,52 @@ overrides = super: self: rec {
 </programlisting>
   </para>
  </section>
+ <section xml:id="sec-citrix">
+  <title>Citrix Receiver</title>
+
+  <para>
+   The <link xlink:href="https://www.citrix.com/products/receiver/">Citrix Receiver</link> is a remote
+   desktop viewer which provides access to
+   <link xlink:href="https://www.citrix.com/products/xenapp-xendesktop/">XenDesktop</link> installations.
+  </para>
+
+  <section xml:id="sec-citrix-base">
+   <title>Basic usage</title>
+   <para>
+    The tarball archive needs to be downloaded manually as the licenses agreements of the vendor
+    need to be accepted first. This is available at the
+    <link xlink:href="https://www.citrix.com/downloads/citrix-receiver/">download page at citrix.com</link>.
+    Then run <literal>nix-prefetch-url file://$PWD/linuxx64-$version.tar.gz</literal>.
+    With the archive available in the store the package can be built and installed with Nix.
+   </para>
+
+   <para>
+    <emphasis>Note: it's recommended to install <literal>Citrix Receiver</literal> using
+    <literal>nix-env -i</literal> or globally to ensure that the <literal>.desktop</literal> files
+    are installed properly into <literal>$XDG_CONFIG_DIRS</literal>. Otherwise it won't
+    be possible to open <literal>.ica</literal> files
+    automatically from the browser to start a Citrix connection.</emphasis>
+   </para>
+  </section>
+  <section xml:id="sec-citrix-custom-certs">
+   <title>Custom certificates</title>
+   <para>
+    The <literal>Citrix Receiver</literal> in <literal>nixpkgs</literal> trusts several certificates
+    <link xlink:href="https://curl.haxx.se/docs/caextract.html">from the Mozilla database</link> by default.
+    However several companies using Citrix might require their own corporate certificate. On distros with imperative
+    packaging these certs can be stored easily in
+    <link xlink:href="https://developer-docs.citrix.com/projects/receiver-for-linux-command-reference/en/13.7/"><literal>$ICAROOT</literal></link>,
+    however this directory is a store path in <literal>nixpkgs</literal>. In order to work around this issue the package provides a simple
+    mechanism to add custom certificates without rebuilding the entire package using <literal>symlinkJoin</literal>:
+
+<programlisting>
+<![CDATA[with import <nixpkgs> { config.allowUnfree = true; };
+let extraCerts = [ ./custom-cert-1.pem ./custom-cert-2.pem /* ... */ ]; in
+citrix_receiver.override {
+  inherit extraCerts;
+}]]>
+</programlisting>
+   </para>
+  </section>
+ </section>
 </chapter>

doc/stdenv.xml

@@ -836,9 +836,10 @@ passthru = {
         These can optionally be compressed using <command>gzip</command>
         (<filename>.tar.gz</filename>, <filename>.tgz</filename> or
         <filename>.tar.Z</filename>), <command>bzip2</command>
-        (<filename>.tar.bz2</filename> or <filename>.tbz2</filename>) or
+        (<filename>.tar.bz2</filename>, <filename>.tbz2</filename> or
-        <command>xz</command> (<filename>.tar.xz</filename> or
+        <filename>.tbz</filename>) or <command>xz</command>
-        <filename>.tar.lzma</filename>).
+        (<filename>.tar.xz</filename>, <filename>.tar.lzma</filename> or
+        <filename>.txz</filename>).
        </para>
       </listitem>
      </varlistentry>

maintainers/maintainer-list.nix

@@ -807,6 +807,11 @@
     github = "coroa";
     name = "Jonas Hörsch";
   };
+  costrouc = {
+    email = "chris.ostrouchov@gmail.com";
+    github = "costrouc";
+    name = "Chris Ostrouchov";
+  };
   couchemar = {
     email = "couchemar@yandex.ru";
     github = "couchemar";
@@ -1842,6 +1847,11 @@
     github = "jluttine";
     name = "Jaakko Luttinen";
   };
+  jmettes = {
+    email = "jonathan@jmettes.com";
+    github = "jmettes";
+    name = "Jonathan Mettes";
+  };
   Jo = {
     email = "0x4A6F@shackspace.de";
     name = "Joachim Ernst";
@@ -2190,7 +2200,7 @@
     name = "Nathaniel Baxter";
   };
   lightdiscord = {
-    email = "arnaud@lightdiscord.me";
+    email = "root@arnaud.sh";
     github = "lightdiscord";
     name = "Arnaud Pascal";
   };

nixos/doc/manual/release-notes/rl-1809.xml

@@ -73,6 +73,14 @@ $ nix-instantiate -E '(import <nixpkgsunstable> {}).gitFull'
   </para>
 
   <itemizedlist>
+   <listitem>
+    <para>
+     The <varname>services.cassandra</varname> module has been reworked and
+     was rewritten from scratch. The service has succeeding tests for
+     the versions 2.1, 2.2, 3.0 and 3.11 of <link
+     xlink:href="https://cassandra.apache.org/">Apache Cassandra</link>.
+    </para>
+   </listitem>
    <listitem>
     <para>
      There is a new <varname>services.foundationdb</varname> module for deploying
@@ -119,6 +127,12 @@ $ nix-instantiate -E '(import &lt;nixpkgsunstable&gt; {}).gitFull'
   </para>
 
   <itemizedlist>
+   <listitem>
+    <para>
+     The deprecated <varname>services.cassandra</varname> module has
+     seen a complete rewrite. (See above.)
+    </para>
+   </listitem>
    <listitem>
     <para>
      <literal>lib.strict</literal> is removed. Use
@@ -176,6 +190,16 @@ $ nix-instantiate -E '(import &lt;nixpkgsunstable&gt; {}).gitFull'
       which indicates that the nix output hash will be used as tag.
     </para>
    </listitem>
+   <listitem>
+    <para>
+      Options
+      <literal>boot.initrd.luks.devices.<replaceable>name</replaceable>.yubikey.ramfsMountPoint</literal>
+      <literal>boot.initrd.luks.devices.<replaceable>name</replaceable>.yubikey.storage.mountPoint</literal>
+      were removed. <literal>luksroot.nix</literal> module never supported more than one YubiKey at
+      a time anyway, hence those options never had any effect. You should be able to remove them
+      from your config without any issues.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 

nixos/modules/installer/cd-dvd/installation-cd-base.nix

@@ -29,8 +29,5 @@ with lib;
   # Add Memtest86+ to the CD.
   boot.loader.grub.memtest86.enable = true;
 
-  # Allow the user to log in as root without a password.
-  users.users.root.initialHashedPassword = "";
-
   system.stateVersion = mkDefault "18.03";
 }

nixos/modules/installer/cd-dvd/sd-image-aarch64.nix

@@ -33,9 +33,6 @@ in
   # Also increase the amount of CMA to ensure the virtual console on the RPi3 works.
   boot.kernelParams = ["cma=32M" "console=ttyS0,115200n8" "console=ttyAMA0,115200n8" "console=tty0"];
 
-  # FIXME: this probably should be in installation-device.nix
-  users.users.root.initialHashedPassword = "";
-
   sdImage = {
     populateBootCommands = let
       configTxt = pkgs.writeText "config.txt" ''

nixos/modules/installer/cd-dvd/sd-image-armv7l-multiplatform.nix

@@ -34,9 +34,6 @@ in
   # - ttySAC2: for Exynos (ODROID-XU3)
   boot.kernelParams = ["console=ttyS0,115200n8" "console=ttymxc0,115200n8" "console=ttyAMA0,115200n8" "console=ttyO0,115200n8" "console=ttySAC2,115200n8" "console=tty0"];
 
-  # FIXME: this probably should be in installation-device.nix
-  users.users.root.initialHashedPassword = "";
-
   sdImage = {
     populateBootCommands = let
       configTxt = pkgs.writeText "config.txt" ''

nixos/modules/installer/cd-dvd/sd-image-raspberrypi.nix

@@ -27,9 +27,6 @@ in
   boot.consoleLogLevel = lib.mkDefault 7;
   boot.kernelPackages = pkgs.linuxPackages_rpi;
 
-  # FIXME: this probably should be in installation-device.nix
-  users.users.root.initialHashedPassword = "";
-
   sdImage = {
     populateBootCommands = let
       configTxt = pkgs.writeText "config.txt" ''

nixos/modules/installer/netboot/netboot-base.nix

@@ -14,7 +14,4 @@ with lib;
       ../../profiles/base.nix
       ../../profiles/installation-device.nix
     ];
-
-  # Allow the user to log in as root without a password.
-  users.users.root.initialHashedPassword = "";
 }

nixos/modules/misc/ids.nix

@@ -324,6 +324,7 @@
       hadoop = 297;
       hydron = 298;
       cfssl = 299;
+      cassandra = 300;
 
       # When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!
 
@@ -608,6 +609,7 @@
       hadoop = 297;
       hydron = 298;
       cfssl = 299;
+      cassandra = 300;
 
       # When adding a gid, make sure it doesn't match an existing
       # uid. Users and groups with the same name should have equal

nixos/modules/module-list.nix

@@ -201,6 +201,7 @@
   ./services/databases/4store-endpoint.nix
   ./services/databases/4store.nix
   ./services/databases/aerospike.nix
+  ./services/databases/cassandra.nix
   ./services/databases/clickhouse.nix
   ./services/databases/couchdb.nix
   ./services/databases/firebird.nix

nixos/modules/profiles/installation-device.nix

@@ -86,5 +86,9 @@ with lib;
     networking.firewall.logRefusedConnections = mkDefault false;
 
     environment.systemPackages = [ pkgs.vim ];
+
+
+    # Allow the user to log in as root without a password.
+    users.users.root.initialHashedPassword = "";
   };
 }

nixos/modules/services/databases/cassandra.nix

@@ -4,445 +4,288 @@ with lib;
 
 let
   cfg = config.services.cassandra;
-  cassandraPackage = cfg.package.override {
+  defaultUser = "cassandra";
-    jre = cfg.jre;
+  cassandraConfig = flip recursiveUpdate cfg.extraConfig
-  };
+    ({ commitlog_sync = "batch";
-  cassandraUser = {
+       commitlog_sync_batch_window_in_ms = 2;
-    name = cfg.user;
+       partitioner = "org.apache.cassandra.dht.Murmur3Partitioner";
-    home = "/var/lib/cassandra";
+       endpoint_snitch = "SimpleSnitch";
-    description = "Cassandra role user";
+       seed_provider =
-  };
+         [{ class_name = "org.apache.cassandra.locator.SimpleSeedProvider";
-
+            parameters = [ { seeds = "127.0.0.1"; } ];
-  cassandraRackDcProperties = ''
+         }];
-    dc=${cfg.dc}
+       data_file_directories = [ "${cfg.homeDir}/data" ];
-    rack=${cfg.rack}
+       commitlog_directory = "${cfg.homeDir}/commitlog";
-  '';
+       saved_caches_directory = "${cfg.homeDir}/saved_caches";
-
+     } // (if builtins.compareVersions cfg.package.version "3" >= 0
-  cassandraConf = ''
+             then { hints_directory = "${cfg.homeDir}/hints"; }
-    cluster_name: ${cfg.clusterName}
+             else {})
-    num_tokens: 256
+    );
-    auto_bootstrap: ${boolToString cfg.autoBootstrap}
+  cassandraConfigWithAddresses = cassandraConfig //
-    hinted_handoff_enabled: ${boolToString cfg.hintedHandOff}
+    ( if isNull cfg.listenAddress
-    hinted_handoff_throttle_in_kb: ${builtins.toString cfg.hintedHandOffThrottle}
+        then { listen_interface = cfg.listenInterface; }
-    max_hints_delivery_threads: 2
+        else { listen_address = cfg.listenAddress; }
-    max_hint_window_in_ms: 10800000 # 3 hours
+    ) // (
-    authenticator: ${cfg.authenticator}
+      if isNull cfg.rpcAddress
-    authorizer: ${cfg.authorizer}
+        then { rpc_interface = cfg.rpcInterface; }
-    permissions_validity_in_ms: 2000
+        else { rpc_address = cfg.rpcAddress; }
-    partitioner: org.apache.cassandra.dht.Murmur3Partitioner
+    );
-    data_file_directories:
+  cassandraEtc = pkgs.stdenv.mkDerivation
-    ${builtins.concatStringsSep "\n" (map (v: "  - "+v) cfg.dataDirs)}
+    { name = "cassandra-etc";
-    commitlog_directory: ${cfg.commitLogDirectory}
+      cassandraYaml = builtins.toJSON cassandraConfigWithAddresses;
-    disk_failure_policy: stop
+      cassandraEnvPkg = "${cfg.package}/conf/cassandra-env.sh";
-    key_cache_size_in_mb:
+      buildCommand = ''
-    key_cache_save_period: 14400
+        mkdir -p "$out"
-    row_cache_size_in_mb: 0
-    row_cache_save_period: 0
-    saved_caches_directory: ${cfg.savedCachesDirectory}
-    commitlog_sync: ${cfg.commitLogSync}
-    commitlog_sync_period_in_ms: ${builtins.toString cfg.commitLogSyncPeriod}
-    commitlog_segment_size_in_mb: 32
-    seed_provider:
-      - class_name: org.apache.cassandra.locator.SimpleSeedProvider
-        parameters:
-          - seeds: "${builtins.concatStringsSep "," cfg.seeds}"
-    concurrent_reads: ${builtins.toString cfg.concurrentReads}
-    concurrent_writes: ${builtins.toString cfg.concurrentWrites}
-    memtable_flush_queue_size: 4
-    trickle_fsync: false
-    trickle_fsync_interval_in_kb: 10240
-    storage_port: 7000
-    ssl_storage_port: 7001
-    listen_address: ${cfg.listenAddress}
-    start_native_transport: true
-    native_transport_port: 9042
-    start_rpc: true
-    rpc_address: ${cfg.rpcAddress}
-    rpc_port: 9160
-    rpc_keepalive: true
-    rpc_server_type: sync
-    thrift_framed_transport_size_in_mb: 15
-    incremental_backups: ${boolToString cfg.incrementalBackups}
-    snapshot_before_compaction: false
-    auto_snapshot: true
-    column_index_size_in_kb: 64
-    in_memory_compaction_limit_in_mb: 64
-    multithreaded_compaction: false
-    compaction_throughput_mb_per_sec: 16
-    compaction_preheat_key_cache: true
-    read_request_timeout_in_ms: 10000
-    range_request_timeout_in_ms: 10000
-    write_request_timeout_in_ms: 10000
-    cas_contention_timeout_in_ms: 1000
-    truncate_request_timeout_in_ms: 60000
-    request_timeout_in_ms: 10000
-    cross_node_timeout: false
-    endpoint_snitch: ${cfg.snitch}
-    dynamic_snitch_update_interval_in_ms: 100
-    dynamic_snitch_reset_interval_in_ms: 600000
-    dynamic_snitch_badness_threshold: 0.1
-    request_scheduler: org.apache.cassandra.scheduler.NoScheduler
-    server_encryption_options:
-      internode_encryption: ${cfg.internodeEncryption}
-      keystore: ${cfg.keyStorePath}
-      keystore_password: ${cfg.keyStorePassword}
-      truststore: ${cfg.trustStorePath}
-      truststore_password: ${cfg.trustStorePassword}
-    client_encryption_options:
-      enabled: ${boolToString cfg.clientEncryption}
-      keystore: ${cfg.keyStorePath}
-      keystore_password: ${cfg.keyStorePassword}
-    internode_compression: all
-    inter_dc_tcp_nodelay: false
-    preheat_kernel_page_cache: false
-    streaming_socket_timeout_in_ms: ${toString cfg.streamingSocketTimoutInMS}
-  '';
-
-  cassandraLog = ''
-    log4j.rootLogger=${cfg.logLevel},stdout
-    log4j.appender.stdout=org.apache.log4j.ConsoleAppender
-    log4j.appender.stdout.layout=org.apache.log4j.PatternLayout
-    log4j.appender.stdout.layout.ConversionPattern=%5p [%t] %d{HH:mm:ss,SSS} %m%n
-  '';
-
-  cassandraConfFile = pkgs.writeText "cassandra.yaml" cassandraConf;
-  cassandraLogFile = pkgs.writeText "log4j-server.properties" cassandraLog;
-  cassandraRackFile = pkgs.writeText "cassandra-rackdc.properties" cassandraRackDcProperties;
-
-  cassandraEnvironment = {
-    CASSANDRA_HOME = cassandraPackage;
-    JAVA_HOME = cfg.jre;
-    CASSANDRA_CONF = "/etc/cassandra";
-  };
 
+        echo "$cassandraYaml" > "$out/cassandra.yaml"
+        ln -s "$cassandraEnvPkg" "$out/cassandra-env.sh"
+      '';
+    };
 in {
-
-  ###### interface
-
   options.services.cassandra = {
-    enable = mkOption {
+    enable = mkEnableOption ''
-      description = "Whether to enable cassandra.";
+      Apache Cassandra – Scalable and highly available database.
-      default = false;
+    '';
-      type = types.bool;
-    };
-    package = mkOption {
-      description = "Cassandra package to use.";
-      default = pkgs.cassandra;
-      defaultText = "pkgs.cassandra";
-      type = types.package;
-    };
-    jre = mkOption {
-      description = "JRE package to run cassandra service.";
-      default = pkgs.jre;
-      defaultText = "pkgs.jre";
-      type = types.package;
-    };
     user = mkOption {
-      description = "User that runs cassandra service.";
+      type = types.str;
-      default = "cassandra";
+      default = defaultUser;
-      type = types.string;
+      description = "Run Apache Cassandra under this user.";
     };
     group = mkOption {
-      description = "Group that runs cassandra service.";
-      default = "cassandra";
-      type = types.string;
-    };
-    envFile = mkOption {
-      description = "path to cassandra-env.sh";
-      default = "${cassandraPackage}/conf/cassandra-env.sh";
-      defaultText = "\${cassandraPackage}/conf/cassandra-env.sh";
-      type = types.path;
-    };
-    clusterName = mkOption {
-      description = "set cluster name";
-      default = "cassandra";
-      example = "prod-cluster0";
-      type = types.string;
-    };
-    commitLogDirectory = mkOption {
-      description = "directory for commit logs";
-      default = "/var/lib/cassandra/commit_log";
-      type = types.string;
-    };
-    savedCachesDirectory = mkOption {
-      description = "directory for saved caches";
-      default = "/var/lib/cassandra/saved_caches";
-      type = types.string;
-    };
-    hintedHandOff = mkOption {
-      description = "enable hinted handoff";
-      default = true;
-      type = types.bool;
-    };
-    hintedHandOffThrottle = mkOption {
-      description = "hinted hand off throttle rate in kb";
-      default = 1024;
-      type = types.int;
-    };
-    commitLogSync = mkOption {
-      description = "commitlog sync method";
-      default = "periodic";
       type = types.str;
-      example = "batch";
+      default = defaultUser;
+      description = "Run Apache Cassandra under this group.";
     };
-    commitLogSyncPeriod = mkOption {
+    homeDir = mkOption {
-      description = "commitlog sync period in ms ";
-      default = 10000;
-      type = types.int;
-    };
-    envScript = mkOption {
-      default = "${cassandraPackage}/conf/cassandra-env.sh";
-      defaultText = "\${cassandraPackage}/conf/cassandra-env.sh";
       type = types.path;
-      description = "Supply your own cassandra-env.sh rather than using the default";
+      default = "/var/lib/cassandra";
+      description = ''
+        Home directory for Apache Cassandra.
+      '';
     };
-    extraParams = mkOption {
+    package = mkOption {
-      description = "add additional lines to cassandra-env.sh";
+      type = types.package;
+      default = pkgs.cassandra;
+      defaultText = "pkgs.cassandra";
+      example = literalExample "pkgs.cassandra_3_11";
+      description = ''
+        The Apache Cassandra package to use.
+      '';
+    };
+    jvmOpts = mkOption {
+      type = types.listOf types.str;
       default = [];
-      example = [''JVM_OPTS="$JVM_OPTS -Dcassandra.available_processors=1"''];
+      description = ''
-      type = types.listOf types.str;
+        Populate the JVM_OPT environment variable.
-    };
+      '';
-    dataDirs = mkOption {
-      type = types.listOf types.path;
-      default = [ "/var/lib/cassandra/data" ];
-      description = "Data directories for cassandra";
-    };
-    logLevel = mkOption {
-      type = types.str;
-      default = "INFO";
-      description = "default logging level for log4j";
-    };
-    internodeEncryption = mkOption {
-      description = "enable internode encryption";
-      default = "none";
-      example = "all";
-      type = types.str;
-    };
-    clientEncryption = mkOption {
-      description = "enable client encryption";
-      default = false;
-      type = types.bool;
-    };
-    trustStorePath = mkOption {
-      description = "path to truststore";
-      default = ".conf/truststore";
-      type = types.str;
-    };
-    keyStorePath = mkOption {
-      description = "path to keystore";
-      default = ".conf/keystore";
-      type = types.str;
-    };
-    keyStorePassword = mkOption {
-      description = "password to keystore";
-      default = "cassandra";
-      type = types.str;
-    };
-    trustStorePassword = mkOption {
-      description = "password to truststore";
-      default = "cassandra";
-      type = types.str;
-    };
-    seeds = mkOption {
-      description = "password to truststore";
-      default = [ "127.0.0.1" ];
-      type = types.listOf types.str;
-    };
-    concurrentWrites = mkOption {
-      description = "number of concurrent writes allowed";
-      default = 32;
-      type = types.int;
-    };
-    concurrentReads = mkOption {
-      description = "number of concurrent reads allowed";
-      default = 32;
-      type = types.int;
     };
     listenAddress = mkOption {
-      description = "listen address";
+      type = types.nullOr types.str;
-      default = "localhost";
+      default = "127.0.0.1";
-      type = types.str;
+      example = literalExample "null";
+      description = ''
+        Address or interface to bind to and tell other Cassandra nodes
+        to connect to. You _must_ change this if you want multiple
+        nodes to be able to communicate!
+
+        Set listenAddress OR listenInterface, not both.
+
+        Leaving it blank leaves it up to
+        InetAddress.getLocalHost(). This will always do the Right
+        Thing _if_ the node is properly configured (hostname, name
+        resolution, etc), and the Right Thing is to use the address
+        associated with the hostname (it might not be).
+
+        Setting listen_address to 0.0.0.0 is always wrong.
+      '';
+    };
+    listenInterface = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      example = "eth1";
+      description = ''
+        Set listenAddress OR listenInterface, not both. Interfaces
+        must correspond to a single address, IP aliasing is not
+        supported.
+      '';
     };
     rpcAddress = mkOption {
-      description = "rpc listener address";
+      type = types.nullOr types.str;
-      default = "localhost";
+      default = "127.0.0.1";
-      type = types.str;
+      example = literalExample "null";
-    };
-    incrementalBackups = mkOption {
-      description = "enable incremental backups";
-      default = false;
-      type = types.bool;
-    };
-    snitch = mkOption {
-      description = "snitch to use for topology discovery";
-      default = "GossipingPropertyFileSnitch";
-      example = "Ec2Snitch";
-      type = types.str;
-    };
-    dc = mkOption {
-      description = "datacenter for use in topology configuration";
-      default = "DC1";
-      example = "DC1";
-      type = types.str;
-    };
-    rack = mkOption {
-      description = "rack for use in topology configuration";
-      default = "RAC1";
-      example = "RAC1";
-      type = types.str;
-    };
-    authorizer = mkOption {
-      description = "
-        Authorization backend, implementing IAuthorizer; used to limit access/provide permissions
-      ";
-      default = "AllowAllAuthorizer";
-      example = "CassandraAuthorizer";
-      type = types.str;
-    };
-    authenticator = mkOption {
-      description = "
-        Authentication backend, implementing IAuthenticator; used to identify users
-      ";
-      default = "AllowAllAuthenticator";
-      example = "PasswordAuthenticator";
-      type = types.str;
-    };
-    autoBootstrap = mkOption {
-      description = "It makes new (non-seed) nodes automatically migrate the right data to themselves.";
-      default = true;
-      type = types.bool;
-    };
-    streamingSocketTimoutInMS = mkOption {
-      description = "Enable or disable socket timeout for streaming operations";
-      default = 3600000; #CASSANDRA-8611
-      example = 120;
-      type = types.int;
-    };
-    repairStartAt = mkOption {
-      default = "Sun";
-      type = types.string;
       description = ''
-      Defines realtime (i.e. wallclock) timers with calendar event
+        The address or interface to bind the native transport server to.
-      expressions. For more details re: systemd OnCalendar at
+
-      https://www.freedesktop.org/software/systemd/man/systemd.time.html#Displaying%20Time%20Spans
+        Set rpcAddress OR rpcInterface, not both.
-      '';
+
-      example = ["weekly" "daily" "08:05:40" "mon,fri *-1/2-1,3 *:30:45"];
+        Leaving rpcAddress blank has the same effect as on
-    };
+        listenAddress (i.e. it will be based on the configured hostname
-    repairRandomizedDelayInSec = mkOption {
+        of the node).
-      default = 0;
+
-      type = types.int;
+        Note that unlike listenAddress, you can specify 0.0.0.0, but you
-      description = ''Delay the timer by a randomly selected, evenly distributed
+        must also set extraConfig.broadcast_rpc_address to a value other
-      amount of time between 0 and the specified time value. re: systemd timer
+        than 0.0.0.0.
-      RandomizedDelaySec for more details
+
+        For security reasons, you should not expose this port to the
+        internet. Firewall it if needed.
       '';
     };
-    repairPostStop = mkOption {
+    rpcInterface = mkOption {
+      type = types.nullOr types.str;
       default = null;
-      type = types.nullOr types.string;
+      example = "eth1";
       description = ''
-      Run a script when repair is over. One can use it to send statsd events, email, etc.
+        Set rpcAddress OR rpcInterface, not both. Interfaces must
+        correspond to a single address, IP aliasing is not supported.
       '';
     };
-    repairPostStart = mkOption {
+
-      default = null;
+    extraConfig = mkOption {
-      type = types.nullOr types.string;
+      type = types.attrs;
+      default = {};
+      example =
+        { commitlog_sync_batch_window_in_ms = 3;
+        };
       description = ''
-      Run a script when repair starts. One can use it to send statsd events, email, etc.
+        Extra options to be merged into cassandra.yaml as nix attribute set.
-      It has same semantics as systemd ExecStopPost; So, if it fails, unit is consisdered
-      failed.
       '';
     };
+    fullRepairInterval = mkOption {
+      type = types.nullOr types.str;
+      default = "3w";
+      example = literalExample "null";
+      description = ''
+          Set the interval how often full repairs are run, i.e.
+          `nodetool repair --full` is executed. See
+          https://cassandra.apache.org/doc/latest/operating/repair.html
+          for more information.
+
+          Set to `null` to disable full repairs.
+        '';
+    };
+    fullRepairOptions = mkOption {
+      type = types.listOf types.str;
+      default = [];
+      example = [ "--partitioner-range" ];
+      description = ''
+          Options passed through to the full repair command.
+        '';
+    };
+    incrementalRepairInterval = mkOption {
+      type = types.nullOr types.str;
+      default = "3d";
+      example = literalExample "null";
+      description = ''
+          Set the interval how often incremental repairs are run, i.e.
+          `nodetool repair` is executed. See
+          https://cassandra.apache.org/doc/latest/operating/repair.html
+          for more information.
+
+          Set to `null` to disable incremental repairs.
+        '';
+    };
+    incrementalRepairOptions = mkOption {
+      type = types.listOf types.string;
+      default = [];
+      example = [ "--partitioner-range" ];
+      description = ''
+          Options passed through to the incremental repair command.
+        '';
+    };
   };
 
-  ###### implementation
-
   config = mkIf cfg.enable {
-
+    assertions =
-    environment.etc."cassandra/cassandra-rackdc.properties" = {
+      [ { assertion =
-      source = cassandraRackFile;
+            ((isNull cfg.listenAddress)
-    };
+             || (isNull cfg.listenInterface)
-    environment.etc."cassandra/cassandra.yaml" = {
+            ) && !((isNull cfg.listenAddress)
-      source = cassandraConfFile;
+                   && (isNull cfg.listenInterface)
-    };
+                  );
-    environment.etc."cassandra/log4j-server.properties" = {
+          message = "You have to set either listenAddress or listenInterface";
-      source = cassandraLogFile;
+        }
-    };
+        { assertion =
-    environment.etc."cassandra/cassandra-env.sh" = {
+            ((isNull cfg.rpcAddress)
-      text = ''
+             || (isNull cfg.rpcInterface)
-        ${builtins.readFile cfg.envFile}
+            ) && !((isNull cfg.rpcAddress)
-        ${concatStringsSep "\n" cfg.extraParams}
+                   && (isNull cfg.rpcInterface)
-      '';
+                  );
-    };
+          message = "You have to set either rpcAddress or rpcInterface";
-    systemd.services.cassandra = {
+        }
-      description = "Cassandra Daemon";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
-      environment = cassandraEnvironment;
-      restartTriggers = [ cassandraConfFile cassandraLogFile cassandraRackFile ];
-      serviceConfig = {
-
-        User = cfg.user;
-        PermissionsStartOnly = true;
-        LimitAS = "infinity";
-        LimitNOFILE = "100000";
-        LimitNPROC = "32768";
-        LimitMEMLOCK = "infinity";
-
-      };
-      script = ''
-         ${cassandraPackage}/bin/cassandra -f
-        '';
-      path = [
-        cfg.jre
-        cassandraPackage
-        pkgs.coreutils
       ];
-      preStart = ''
+    users = mkIf (cfg.user == defaultUser) {
-        mkdir -m 0700 -p /etc/cassandra/triggers
+      extraUsers."${defaultUser}" =
-        mkdir -m 0700 -p /var/lib/cassandra /var/log/cassandra
+        {  group = cfg.group;
-        chown ${cfg.user} /var/lib/cassandra /var/log/cassandra /etc/cassandra/triggers
+           home = cfg.homeDir;
-      '';
+           createHome = true;
-      postStart = ''
+           uid = config.ids.uids.cassandra;
-        sleep 2
+           description = "Cassandra service user";
-        while ! nodetool status >/dev/null 2>&1; do
+        };
-          sleep 2
+      extraGroups."${defaultUser}".gid = config.ids.gids.cassandra;
-        done
-        nodetool status
-      '';
     };
 
-    environment.systemPackages = [ cassandraPackage ];
+    systemd.services.cassandra =
-
+      { description = "Apache Cassandra service";
-    networking.firewall.allowedTCPPorts = [
+        after = [ "network.target" ];
-      7000
+        environment =
-      7001
+          { CASSANDRA_CONF = "${cassandraEtc}";
-      9042
+            JVM_OPTS = builtins.concatStringsSep " " cfg.jvmOpts;
-      9160
+          };
-    ];
+        wantedBy = [ "multi-user.target" ];
-
+        serviceConfig =
-    users.users.cassandra =
+          { User = cfg.user;
-      if config.ids.uids ? "cassandra"
+            Group = cfg.group;
-      then { uid = config.ids.uids.cassandra; } // cassandraUser
+            ExecStart = "${cfg.package}/bin/cassandra -f";
-      else cassandraUser ;
+            SuccessExitStatus = 143;
-
+          };
-    boot.kernel.sysctl."vm.swappiness" = pkgs.lib.mkOptionDefault 0;
-
-    systemd.timers."cassandra-repair" = {
-      timerConfig = {
-        OnCalendar = "${toString cfg.repairStartAt}";
-        RandomizedDelaySec = cfg.repairRandomizedDelayInSec;
       };
-    };
 
-    systemd.services."cassandra-repair" = {
+    systemd.services.cassandra-full-repair =
-      description = "Cassandra repair daemon";
+      { description = "Perform a full repair on this Cassandra node";
-      environment = cassandraEnvironment;
+        after = [ "cassandra.service" ];
-      script = "${cassandraPackage}/bin/nodetool repair -pr";
+        requires = [ "cassandra.service" ];
-      postStop = mkIf (cfg.repairPostStop != null) cfg.repairPostStop;
+        serviceConfig =
-      postStart = mkIf (cfg.repairPostStart != null) cfg.repairPostStart;
+          { User = cfg.user;
-      serviceConfig = {
+            Group = cfg.group;
-        User = cfg.user;
+            ExecStart =
+              lib.concatStringsSep " "
+                ([ "${cfg.package}/bin/nodetool" "repair" "--full"
+                 ] ++ cfg.fullRepairOptions);
+          };
+      };
+    systemd.timers.cassandra-full-repair =
+      mkIf (!isNull cfg.fullRepairInterval) {
+        description = "Schedule full repairs on Cassandra";
+        wantedBy = [ "timers.target" ];
+        timerConfig =
+          { OnBootSec = cfg.fullRepairInterval;
+            OnUnitActiveSec = cfg.fullRepairInterval;
+            Persistent = true;
+          };
+      };
+
+    systemd.services.cassandra-incremental-repair =
+      { description = "Perform an incremental repair on this cassandra node.";
+        after = [ "cassandra.service" ];
+        requires = [ "cassandra.service" ];
+        serviceConfig =
+          { User = cfg.user;
+            Group = cfg.group;
+            ExecStart =
+              lib.concatStringsSep " "
+                ([ "${cfg.package}/bin/nodetool" "repair"
+                 ] ++ cfg.incrementalRepairOptions);
+          };
+      };
+    systemd.timers.cassandra-incremental-repair =
+      mkIf (!isNull cfg.incrementalRepairInterval) {
+        description = "Schedule incremental repairs on Cassandra";
+        wantedBy = [ "timers.target" ];
+        timerConfig =
+          { OnBootSec = cfg.incrementalRepairInterval;
+            OnUnitActiveSec = cfg.incrementalRepairInterval;
+            Persistent = true;
+          };
       };
-    };
   };
 }

nixos/modules/services/hardware/fwupd.nix

@@ -71,6 +71,13 @@ in {
           BlacklistPlugins=${lib.concatStringsSep ";" cfg.blacklistPlugins}
         '';
       };
+      "fwupd/uefi.conf" = {
+        source = pkgs.writeText "uefi.conf" ''
+          [uefi]
+          OverrideESPMountPoint=${config.boot.loader.efi.efiSysMountPoint}
+        '';
+      };
+
     } // originalEtc // extraTrustedKeys;
 
     services.dbus.packages = [ pkgs.fwupd ];

nixos/modules/services/misc/docker-registry.nix

@@ -5,6 +5,43 @@ with lib;
 let
   cfg = config.services.dockerRegistry;
 
+  blobCache = if cfg.enableRedisCache
+    then "redis"
+    else "inmemory";
+
+  registryConfig = {
+    version =  "0.1";
+    log.fields.service = "registry";
+    storage = {
+      cache.blobdescriptor = blobCache;
+      filesystem.rootdirectory = cfg.storagePath;
+      delete.enabled = cfg.enableDelete;
+    };
+    http = {
+      addr = ":${builtins.toString cfg.port}";
+      headers.X-Content-Type-Options = ["nosniff"];
+    };
+    health.storagedriver = {
+      enabled = true;
+      interval = "10s";
+      threshold = 3;
+    };
+  };
+
+  registryConfig.redis = mkIf cfg.enableRedisCache {
+    addr = "${cfg.redisUrl}";
+    password = "${cfg.redisPassword}";
+    db = 0;
+    dialtimeout = "10ms";
+    readtimeout = "10ms";
+    writetimeout = "10ms";
+    pool = {
+      maxidle = 16;
+      maxactive = 64;
+      idletimeout = "300s";
+    };
+  };
+
   configFile = pkgs.writeText "docker-registry-config.yml" (builtins.toJSON (recursiveUpdate registryConfig cfg.extraConfig));
 
 in {

nixos/modules/services/networking/zerotierone.nix

@@ -17,6 +17,15 @@ in
     '';
   };
 
+  options.services.zerotierone.port = mkOption {
+    default = 9993;
+    example = 9993;
+    type = types.int;
+    description = ''
+      Network port used by ZeroTier.
+    '';
+  };
+
   options.services.zerotierone.package = mkOption {
     default = pkgs.zerotierone;
     defaultText = "pkgs.zerotierone";
@@ -40,7 +49,7 @@ in
         touch "/var/lib/zerotier-one/networks.d/${netId}.conf"
       '') cfg.joinNetworks);
       serviceConfig = {
-        ExecStart = "${cfg.package}/bin/zerotier-one";
+        ExecStart = "${cfg.package}/bin/zerotier-one -p${toString cfg.port}";
         Restart = "always";
         KillMode = "process";
       };
@@ -49,8 +58,8 @@ in
     # ZeroTier does not issue DHCP leases, but some strangers might...
     networking.dhcpcd.denyInterfaces = [ "zt*" ];
 
-    # ZeroTier receives UDP transmissions on port 9993 by default
+    # ZeroTier receives UDP transmissions
-    networking.firewall.allowedUDPPorts = [ 9993 ];
+    networking.firewall.allowedUDPPorts = [ cfg.port ];
 
     environment.systemPackages = [ cfg.package ];
   };

nixos/modules/services/system/cloud-init.nix

@@ -104,8 +104,9 @@ in
     systemd.services.cloud-init =
       { description = "Initial cloud-init job (metadata service crawler)";
         wantedBy = [ "multi-user.target" ];
-        wants = [ "local-fs.target" "cloud-init-local.service" "sshd.service" "sshd-keygen.service" ];
+        wants = [ "local-fs.target" "network-online.target" "cloud-init-local.service"
-        after = [ "local-fs.target" "network.target" "cloud-init-local.service" ];
+                  "sshd.service" "sshd-keygen.service" ];
+        after = [ "local-fs.target" "network-online.target" "cloud-init-local.service" ];
         before = [ "sshd.service" "sshd-keygen.service" ];
         requires = [ "network.target "];
         path = path;
@@ -121,8 +122,8 @@ in
     systemd.services.cloud-config =
       { description = "Apply the settings specified in cloud-config";
         wantedBy = [ "multi-user.target" ];
-        wants = [ "network.target" ];
+        wants = [ "network-online.target" ];
-        after = [ "network.target" "syslog.target" "cloud-config.target" ];
+        after = [ "network-online.target" "syslog.target" "cloud-config.target" ];
 
         path = path;
         serviceConfig =
@@ -137,8 +138,8 @@ in
     systemd.services.cloud-final =
       { description = "Execute cloud user/final scripts";
         wantedBy = [ "multi-user.target" ];
-        wants = [ "network.target" ];
+        wants = [ "network-online.target" ];
-        after = [ "network.target" "syslog.target" "cloud-config.service" "rc-local.service" ];
+        after = [ "network-online.target" "syslog.target" "cloud-config.service" "rc-local.service" ];
         requires = [ "cloud-config.target" ];
         path = path;
         serviceConfig =

nixos/modules/services/x11/desktop-managers/plasma5.nix

@@ -224,7 +224,7 @@ in
       # Update the start menu for each user that has `isNormalUser` set.
       system.activationScripts.plasmaSetup = stringAfter [ "users" "groups" ]
         (concatStringsSep "\n"
-          (mapAttrsToList (name: value: "${pkgs.su}/bin/su ${name} -c kbuildsycoca5")
+          (mapAttrsToList (name: value: "${pkgs.su}/bin/su ${name} -c ${pkgs.libsForQt5.kservice}/bin/kbuildsycoca5")
             (filterAttrs (n: v: v.isNormalUser) config.users.users)));
     })
   ];

nixos/modules/system/boot/luksroot.nix

@@ -5,61 +5,171 @@ with lib;
 let
   luks = config.boot.initrd.luks;
 
-  openCommand = name': { name, device, header, keyFile, keyFileSize, allowDiscards, yubikey, fallbackToPassword, ... }: assert name' == name; ''
+  commonFunctions = ''
+    die() {
+      echo "$@" >&2
+      exit 1
+    }
 
-    # Wait for a target (e.g. device, keyFile, header, ...) to appear.
     wait_target() {
         local name="$1"
         local target="$2"
+        local secs="''${3:-10}"
+        local desc="''${4:-$name $target to appear}"
 
         if [ ! -e $target ]; then
-            echo -n "Waiting 10 seconds for $name $target to appear"
+            echo -n "Waiting $secs seconds for $desc..."
             local success=false;
-            for try in $(seq 10); do
+            for try in $(seq $secs); do
                 echo -n "."
                 sleep 1
-                if [ -e $target ]; then success=true break; fi
+                if [ -e $target ]; then
+                    success=true
+                    break
+                fi
             done
-            if [ $success = true ]; then
+            if [ $success == true ]; then
                 echo " - success";
+                return 0
             else
                 echo " - failure";
+                return 1
             fi
         fi
+        return 0
     }
 
+    wait_yubikey() {
+      local secs="''${1:-10}"
+
+      ykinfo -v 1>/dev/null 2>&1
+      if [ $? != 0 ]; then
+          echo -n "Waiting $secs seconds for Yubikey to appear..."
+          local success=false
+          for try in $(seq $secs); do
+              echo -n .
+              sleep 1
+              ykinfo -v 1>/dev/null 2>&1
+              if [ $? == 0 ]; then
+                  success=true
+                  break
+              fi
+          done
+          if [ $success == true ]; then
+              echo " - success";
+              return 0
+          else
+              echo " - failure";
+              return 1
+          fi
+      fi
+      return 0
+    }
+  '';
+
+  preCommands = ''
+    # A place to store crypto things
+
+    # A ramfs is used here to ensure that the file used to update
+    # the key slot with cryptsetup will never get swapped out.
+    # Warning: Do NOT replace with tmpfs!
+    mkdir -p /crypt-ramfs
+    mount -t ramfs none /crypt-ramfs
+
+    # For Yubikey salt storage
+    mkdir -p /crypt-storage
+
+    # Disable all input echo for the whole stage. We could use read -s
+    # instead but that would ocasionally leak characters between read
+    # invocations.
+    stty -echo
+  '';
+
+  postCommands = ''
+    stty echo
+    umount /crypt-storage 2>/dev/null
+    umount /crypt-ramfs 2>/dev/null
+  '';
+
+  openCommand = name': { name, device, header, keyFile, keyFileSize, keyFileOffset, allowDiscards, yubikey, fallbackToPassword, ... }: assert name' == name;
+  let
+    csopen   = "cryptsetup luksOpen ${device} ${name} ${optionalString allowDiscards "--allow-discards"} ${optionalString (header != null) "--header=${header}"}";
+    cschange = "cryptsetup luksChangeKey ${device} ${optionalString (header != null) "--header=${header}"}";
+  in ''
     # Wait for luksRoot (and optionally keyFile and/or header) to appear, e.g.
     # if on a USB drive.
-    wait_target "device" ${device}
+    wait_target "device" ${device} || die "${device} is unavailable"
-
-    ${optionalString (keyFile != null) ''
-      wait_target "key file" ${keyFile}
-    ''}
 
     ${optionalString (header != null) ''
-      wait_target "header" ${header}
+      wait_target "header" ${header} || die "${header} is unavailable"
     ''}
 
-    open_normally() {
+    do_open_passphrase() {
-        echo luksOpen ${device} ${name} ${optionalString allowDiscards "--allow-discards"} \
+        local passphrase
-          ${optionalString (header != null) "--header=${header}"} \
+
-          > /.luksopen_args
+        while true; do
-        ${optionalString (keyFile != null) ''
+            echo -n "Passphrase for ${device}: "
-        ${optionalString fallbackToPassword "if [ -e ${keyFile} ]; then"}
+            passphrase=
-            echo " --key-file=${keyFile} ${optionalString (keyFileSize != null) "--keyfile-size=${toString keyFileSize}"}" \
+            while true; do
-              >> /.luksopen_args
+                if [ -e /crypt-ramfs/passphrase ]; then
-        ${optionalString fallbackToPassword ''
+                    echo "reused"
-        else
+                    passphrase=$(cat /crypt-ramfs/passphrase)
-            echo "keyfile ${keyFile} not found -- fallback to interactive unlocking"
+                    break
-        fi
+                else
-        ''}
+                    # ask cryptsetup-askpass
-        ''}
+                    echo -n "${device}" > /crypt-ramfs/device
-        cryptsetup-askpass
+
-        rm /.luksopen_args
+                    # and try reading it from /dev/console with a timeout
+                    IFS= read -t 1 -r passphrase
+                    if [ -n "$passphrase" ]; then
+                       ${if luks.reusePassphrases then ''
+                         # remember it for the next device
+                         echo -n "$passphrase" > /crypt-ramfs/passphrase
+                       '' else ''
+                         # Don't save it to ramfs. We are very paranoid
+                       ''}
+                       echo
+                       break
+                    fi
+                fi
+            done
+            echo -n "Verifiying passphrase for ${device}..."
+            echo -n "$passphrase" | ${csopen} --key-file=-
+            if [ $? == 0 ]; then
+                echo " - success"
+                ${if luks.reusePassphrases then ''
+                  # we don't rm here because we might reuse it for the next device
+                '' else ''
+                  rm -f /crypt-ramfs/passphrase
+                ''}
+                break
+            else
+                echo " - failure"
+                # ask for a different one
+                rm -f /crypt-ramfs/passphrase
+            fi
+        done
     }
 
-    ${optionalString (luks.yubikeySupport && (yubikey != null)) ''
+    # LUKS
+    open_normally() {
+        ${if (keyFile != null) then ''
+        if wait_target "key file" ${keyFile}; then
+            ${csopen} --key-file=${keyFile} \
+              ${optionalString (keyFileSize != null) "--keyfile-size=${toString keyFileSize}"} \
+              ${optionalString (keyFileOffset != null) "--keyfile-offset=${toString keyFileOffset}"}
+        else
+            ${if fallbackToPassword then "echo" else "die"} "${keyFile} is unavailable"
+            echo " - failing back to interactive password prompt"
+            do_open_passphrase
+        fi
+        '' else ''
+        do_open_passphrase
+        ''}
+    }
 
+    ${if luks.yubikeySupport && (yubikey != null) then ''
+    # Yubikey
     rbtohex() {
         ( od -An -vtx1 | tr -d ' \n' )
     }
@@ -68,8 +178,7 @@ let
         ( tr '[:lower:]' '[:upper:]' | sed -e 's/\([0-9A-F]\{2\}\)/\\\\\\x\1/gI' | xargs printf )
     }
 
-    open_yubikey() {
+    do_open_yubikey() {
-
         # Make all of these local to this function
         # to prevent their values being leaked
         local salt
@@ -85,19 +194,18 @@ let
         local new_response
         local new_k_luks
 
-        mkdir -p ${yubikey.storage.mountPoint}
+        mount -t ${yubikey.storage.fsType} ${yubikey.storage.device} /crypt-storage || \
-        mount -t ${yubikey.storage.fsType} ${toString yubikey.storage.device} ${yubikey.storage.mountPoint}
+          die "Failed to mount Yubikey salt storage device"
 
-        salt="$(cat ${yubikey.storage.mountPoint}${yubikey.storage.path} | sed -n 1p | tr -d '\n')"
+        salt="$(cat /crypt-storage${yubikey.storage.path} | sed -n 1p | tr -d '\n')"
-        iterations="$(cat ${yubikey.storage.mountPoint}${yubikey.storage.path} | sed -n 2p | tr -d '\n')"
+        iterations="$(cat /crypt-storage${yubikey.storage.path} | sed -n 2p | tr -d '\n')"
         challenge="$(echo -n $salt | openssl-wrap dgst -binary -sha512 | rbtohex)"
         response="$(ykchalresp -${toString yubikey.slot} -x $challenge 2>/dev/null)"
 
         for try in $(seq 3); do
-
             ${optionalString yubikey.twoFactor ''
             echo -n "Enter two-factor passphrase: "
-            read -s k_user
+            read -r k_user
             echo
             ''}
 
@@ -107,9 +215,9 @@ let
                 k_luks="$(echo | pbkdf2-sha512 ${toString yubikey.keyLength} $iterations $response | rbtohex)"
             fi
 
-            echo -n "$k_luks" | hextorb | cryptsetup luksOpen ${device} ${name} ${optionalString allowDiscards "--allow-discards"} --key-file=-
+            echo -n "$k_luks" | hextorb | ${csopen} --key-file=-
 
-            if [ $? == "0" ]; then
+            if [ $? == 0 ]; then
                 opened=true
                 break
             else
@@ -118,11 +226,7 @@ let
             fi
         done
 
-        if [ "$opened" == false ]; then
+        [ "$opened" == false ] && die "Maximum authentication errors reached"
-            umount ${yubikey.storage.mountPoint}
-            echo "Maximum authentication errors reached"
-            exit 1
-        fi
 
         echo -n "Gathering entropy for new salt (please enter random keys to generate entropy if this blocks for long)..."
         for i in $(seq ${toString yubikey.saltLength}); do
@@ -147,69 +251,52 @@ let
             new_k_luks="$(echo | pbkdf2-sha512 ${toString yubikey.keyLength} $new_iterations $new_response | rbtohex)"
         fi
 
-        mkdir -p ${yubikey.ramfsMountPoint}
+        echo -n "$new_k_luks" | hextorb > /crypt-ramfs/new_key
-        # A ramfs is used here to ensure that the file used to update
+        echo -n "$k_luks" | hextorb | ${cschange} --key-file=- /crypt-ramfs/new_key
-        # the key slot with cryptsetup will never get swapped out.
-        # Warning: Do NOT replace with tmpfs!
-        mount -t ramfs none ${yubikey.ramfsMountPoint}
 
-        echo -n "$new_k_luks" | hextorb > ${yubikey.ramfsMountPoint}/new_key
+        if [ $? == 0 ]; then
-        echo -n "$k_luks" | hextorb | cryptsetup luksChangeKey ${device} --key-file=- ${yubikey.ramfsMountPoint}/new_key
+            echo -ne "$new_salt\n$new_iterations" > /crypt-storage${yubikey.storage.path}
-
-        if [ $? == "0" ]; then
-            echo -ne "$new_salt\n$new_iterations" > ${yubikey.storage.mountPoint}${yubikey.storage.path}
         else
             echo "Warning: Could not update LUKS key, current challenge persists!"
         fi
 
-        rm -f ${yubikey.ramfsMountPoint}/new_key
+        rm -f /crypt-ramfs/new_key
-        umount ${yubikey.ramfsMountPoint}
+        umount /crypt-storage
-        rm -rf ${yubikey.ramfsMountPoint}
-
-        umount ${yubikey.storage.mountPoint}
     }
 
-    ${optionalString (yubikey.gracePeriod > 0) ''
+    open_yubikey() {
-    echo -n "Waiting ${toString yubikey.gracePeriod} seconds as grace..."
+        if wait_yubikey ${toString yubikey.gracePeriod}; then
-    for i in $(seq ${toString yubikey.gracePeriod}); do
+            do_open_yubikey
-        sleep 1
+        else
-        echo -n .
+            echo "No yubikey found, falling back to non-yubikey open procedure"
-    done
+            open_normally
-    echo "ok"
+        fi
-    ''}
+    }
 
-    yubikey_missing=true
+    open_yubikey
-    ykinfo -v 1>/dev/null 2>&1
+    '' else ''
-    if [ $? != "0" ]; then
-        echo -n "waiting 10 seconds for yubikey to appear..."
-        for try in $(seq 10); do
-            sleep 1
-            ykinfo -v 1>/dev/null 2>&1
-            if [ $? == "0" ]; then
-                yubikey_missing=false
-                break
-            fi
-            echo -n .
-        done
-        echo "ok"
-    else
-        yubikey_missing=false
-    fi
-
-    if [ "$yubikey_missing" == true ]; then
-        echo "no yubikey found, falling back to non-yubikey open procedure"
-        open_normally
-    else
-        open_yubikey
-    fi
-    ''}
-
-    # open luksRoot and scan for logical volumes
-    ${optionalString ((!luks.yubikeySupport) || (yubikey == null)) ''
     open_normally
     ''}
   '';
 
+  askPass = pkgs.writeScriptBin "cryptsetup-askpass" ''
+    #!/bin/sh
+
+    ${commonFunctions}
+
+    while true; do
+        wait_target "luks" /crypt-ramfs/device 10 "LUKS to request a passphrase" || die "Passphrase is not requested now"
+        device=$(cat /crypt-ramfs/device)
+
+        echo -n "Passphrase for $device: "
+        IFS= read -rs passphrase
+        echo
+
+        rm /crypt-ramfs/device
+        echo -n "$passphrase" > /crypt-ramfs/passphrase
+    done
+  '';
+
   preLVM = filterAttrs (n: v: v.preLVM) luks.devices;
   postLVM = filterAttrs (n: v: !v.preLVM) luks.devices;
 
@@ -255,6 +342,22 @@ in
       '';
     };
 
+    boot.initrd.luks.reusePassphrases = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        When opening a new LUKS device try reusing last successful
+        passphrase.
+
+        Useful for mounting a number of devices that use the same
+        passphrase without retyping it several times.
+
+        Such setup can be useful if you use <command>cryptsetup
+        luksSuspend</command>. Different LUKS devices will still have
+        different master keys even when using the same passphrase.
+      '';
+    };
+
     boot.initrd.luks.devices = mkOption {
       default = { };
       example = { "luksroot".device = "/dev/disk/by-uuid/430e9eff-d852-4f68-aa3b-2fa3599ebe08"; };
@@ -316,6 +419,19 @@ in
             '';
           };
 
+          keyFileOffset = mkOption {
+            default = null;
+            example = 4096;
+            type = types.nullOr types.int;
+            description = ''
+              The offset of the key file. Use this in combination with
+              <literal>keyFileSize</literal> to use part of a file as key file
+              (often the case if a raw device or partition is used as a key file).
+              If not specified, the key begins at the first byte of
+              <literal>keyFile</literal>.
+            '';
+          };
+
           # FIXME: get rid of this option.
           preLVM = mkOption {
             default = true;
@@ -383,15 +499,9 @@ in
                 };
 
                 gracePeriod = mkOption {
-                  default = 2;
+                  default = 10;
                   type = types.int;
-                  description = "Time in seconds to wait before attempting to find the Yubikey.";
+                  description = "Time in seconds to wait for the Yubikey.";
-                };
-
-                ramfsMountPoint = mkOption {
-                  default = "/crypt-ramfs";
-                  type = types.str;
-                  description = "Path where the ramfs used to update the LUKS key will be mounted during early boot.";
                 };
 
                 /* TODO: Add to the documentation of the current module:
@@ -414,12 +524,6 @@ in
                     description = "The filesystem of the unencrypted device.";
                   };
 
-                  mountPoint = mkOption {
-                    default = "/crypt-storage";
-                    type = types.str;
-                    description = "Path where the unencrypted device will be mounted during early boot.";
-                  };
-
                   path = mkOption {
                     default = "/crypt-storage/default";
                     type = types.str;
@@ -432,8 +536,8 @@ in
               };
             });
           };
-
+        };
-        }; }));
+      }));
     };
 
     boot.initrd.luks.yubikeySupport = mkOption {
@@ -463,18 +567,8 @@ in
     # copy the cryptsetup binary and it's dependencies
     boot.initrd.extraUtilsCommands = ''
       copy_bin_and_libs ${pkgs.cryptsetup}/bin/cryptsetup
-
+      copy_bin_and_libs ${askPass}/bin/cryptsetup-askpass
-      cat > $out/bin/cryptsetup-askpass <<EOF
+      sed -i s,/bin/sh,$out/bin/sh, $out/bin/cryptsetup-askpass
-      #!$out/bin/sh -e
-      if [ -e /.luksopen_args ]; then
-        cryptsetup \$(cat /.luksopen_args)
-        killall -q cryptsetup
-      else
-        echo "Passphrase is not requested now"
-        exit 1
-      fi
-      EOF
-      chmod +x $out/bin/cryptsetup-askpass
 
       ${optionalString luks.yubikeySupport ''
         copy_bin_and_libs ${pkgs.yubikey-personalization}/bin/ykchalresp
@@ -506,8 +600,9 @@ in
       ''}
     '';
 
-    boot.initrd.preLVMCommands = concatStrings (mapAttrsToList openCommand preLVM);
+    boot.initrd.preFailCommands = postCommands;
-    boot.initrd.postDeviceCommands = concatStrings (mapAttrsToList openCommand postLVM);
+    boot.initrd.preLVMCommands = commonFunctions + preCommands + concatStrings (mapAttrsToList openCommand preLVM) + postCommands;
+    boot.initrd.postDeviceCommands = commonFunctions + preCommands + concatStrings (mapAttrsToList openCommand postLVM) + postCommands;
 
     environment.systemPackages = [ pkgs.cryptsetup ];
   };

nixos/modules/system/boot/stage-1.nix

@@ -248,6 +248,14 @@ let
 
     isExecutable = true;
 
+    postInstall = ''
+      echo checking syntax
+      # check both with bash
+      ${pkgs.bash}/bin/sh -n $target
+      # and with ash shell, just in case
+      ${extraUtils}/bin/ash -n $target
+    '';
+
     inherit udevRules extraUtils modulesClosure;
 
     inherit (config.boot) resumeDevice;

nixos/modules/system/boot/systemd.nix

@@ -189,9 +189,8 @@ let
     ];
 
   makeJobScript = name: text:
-    let mkScriptName =  s: (replaceChars [ "\\" ] [ "-" ] (shellEscape s) );
+    let mkScriptName =  s: "unit-script-" + (replaceChars [ "\\" "@" ] [ "-" "_" ] (shellEscape s) );
-        x = pkgs.writeTextFile { name = "unit-script"; executable = true; destination = "/bin/${mkScriptName name}"; inherit text; };
+    in  pkgs.writeTextFile { name = mkScriptName name; executable = true; inherit text; };
-    in "${x}/bin/${mkScriptName name}";
 
   unitConfig = { config, ... }: {
     config = {

nixos/release.nix

@@ -277,6 +277,7 @@ in rec {
   tests.docker-tools = callTestOnMatchingSystems ["x86_64-linux"] tests/docker-tools.nix {};
   tests.docker-tools-overlay = callTestOnMatchingSystems ["x86_64-linux"] tests/docker-tools-overlay.nix {};
   tests.docker-edge = callTestOnMatchingSystems ["x86_64-linux"] tests/docker-edge.nix {};
+  tests.docker-registry = callTest tests/docker-registry.nix {};
   tests.dovecot = callTest tests/dovecot.nix {};
   tests.dnscrypt-proxy = callTestOnMatchingSystems ["x86_64-linux"] tests/dnscrypt-proxy.nix {};
   tests.ecryptfs = callTest tests/ecryptfs.nix {};

nixos/tests/cassandra.nix

@@ -1,68 +1,71 @@
 import ./make-test.nix ({ pkgs, ...}:
 let
-  user = "cassandra";
+  # Change this to test a different version of Cassandra:
-  nodeCfg = nodes: selfIP: cassandraOpts:
+  testPackage = pkgs.cassandra;
-    {
+  cassandraCfg = 
-      services.cassandra = {
+    { enable = true;
-        enable = true;
+      listenAddress = null;
-        listenAddress = selfIP;
+      listenInterface = "eth1";
-        rpcAddress = "0.0.0.0";
+      rpcAddress = null;
-        seeds = [ "192.168.1.1" ];
+      rpcInterface = "eth1";
-        package = pkgs.cassandra_2_0;
+      extraConfig =
-        jre = pkgs.openjdk;
+        { start_native_transport = true;
-        clusterName = "ci ahoy";
+          seed_provider =
-        authenticator = "PasswordAuthenticator";
+            [{ class_name = "org.apache.cassandra.locator.SimpleSeedProvider";
-        authorizer = "CassandraAuthorizer";
+               parameters = [ { seeds = "cass0"; } ];
-        user = user;
+            }];
-      } // cassandraOpts;
+        };
-      nixpkgs.config.allowUnfree = true;
+      package = testPackage;
+    };
+  nodeCfg = extra: {pkgs, config, ...}:
+    { environment.systemPackages = [ testPackage ];
+      networking.firewall.enable = false;
+      services.cassandra = cassandraCfg // extra;
       virtualisation.memorySize = 1024;
     };
-
 in
 {
   name = "cassandra-ci";
 
   nodes = {
-    cass0 = { nodes, ... }: nodeCfg nodes "192.168.1.1" {};
+    cass0 = nodeCfg {};
-    cass1 = { nodes, ... }: nodeCfg nodes "192.168.1.2" {};
+    cass1 = nodeCfg {};
-    cass2 = { nodes, ... }: nodeCfg nodes "192.168.1.3" {
+    cass2 = nodeCfg { jvmOpts = [ "-Dcassandra.replace_address=cass1" ]; };
-      extraParams = [
-        ''JVM_OPTS="$JVM_OPTS -Dcassandra.replace_address=192.168.1.2"''
-      ];
-      listenAddress = "192.168.1.3";
-    };
   };
 
   testScript = ''
-    subtest "start seed", sub {
+    subtest "timers exist", sub {
+      $cass0->succeed("systemctl list-timers | grep cassandra-full-repair.timer");
+      $cass0->succeed("systemctl list-timers | grep cassandra-incremental-repair.timer");
+    };
+    subtest "can connect via cqlsh", sub {
       $cass0->waitForUnit("cassandra.service");
-      $cass0->waitForOpenPort(9160);
+      $cass0->waitUntilSucceeds("nc -z cass0 9042");
-      $cass0->execute("echo show version | cqlsh localhost -u cassandra -p cassandra");
+      $cass0->succeed("echo 'show version;' | cqlsh cass0");
-      sleep 2;
-      $cass0->succeed("echo show version | cqlsh localhost -u cassandra -p cassandra");
-      $cass1->start;
     };
-    subtest "cassandra user/group", sub {
+    subtest "nodetool is operational", sub {
-      $cass0->succeed("id \"${user}\" >/dev/null");
+      $cass0->waitForUnit("cassandra.service");
-      $cass1->succeed("id \"${user}\" >/dev/null");
+      $cass0->waitUntilSucceeds("nc -z localhost 7199");
+      $cass0->succeed("nodetool status --resolve-ip | egrep '^UN[[:space:]]+cass0'");
     };
-    subtest "bring up cassandra cluster", sub {
+    subtest "bring up cluster", sub {
       $cass1->waitForUnit("cassandra.service");
-      $cass0->waitUntilSucceeds("nodetool status | grep -c UN  | grep 2");
+      $cass1->waitUntilSucceeds("nodetool status | egrep -c '^UN' | grep 2");
+      $cass0->succeed("nodetool status --resolve-ip | egrep '^UN[[:space:]]+cass1'");
     };
     subtest "break and fix node", sub {
-      $cass0->block;
+      $cass1->block;
-      $cass0->waitUntilSucceeds("nodetool status | grep -c DN  | grep 1");
+      $cass0->waitUntilSucceeds("nodetool status --resolve-ip | egrep -c '^DN[[:space:]]+cass1'");
-      $cass0->unblock;
+      $cass0->succeed("nodetool status | egrep -c '^UN'  | grep 1");
-      $cass0->waitUntilSucceeds("nodetool status | grep -c UN  | grep 2");
+      $cass1->unblock;
+      $cass1->waitUntilSucceeds("nodetool status | egrep -c '^UN'  | grep 2");
+      $cass0->succeed("nodetool status | egrep -c '^UN'  | grep 2");
     };
     subtest "replace crashed node", sub {
       $cass1->crash;
-      $cass2->start;
       $cass2->waitForUnit("cassandra.service");
-      $cass0->waitUntilFails("nodetool status | grep UN  | grep 192.168.1.2");
+      $cass0->waitUntilFails("nodetool status --resolve-ip | egrep '^UN[[:space:]]+cass1'");
-      $cass0->waitUntilSucceeds("nodetool status | grep UN | grep 192.168.1.3");
+      $cass0->waitUntilSucceeds("nodetool status --resolve-ip | egrep '^UN[[:space:]]+cass2'");
     };
   '';
 })

pkgs/applications/altcoins/go-ethereum.nix

@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "go-ethereum-${version}";
-  version = "1.8.11";
+  version = "1.8.13";
   goPackagePath = "github.com/ethereum/go-ethereum";
 
   # Fix for usb-related segmentation faults on darwin
@@ -16,7 +16,7 @@ buildGoPackage rec {
     owner = "ethereum";
     repo = "go-ethereum";
     rev = "v${version}";
-    sha256 = "1b4za0hszb95jnj97g4xkrgcl0bydllznm0wj6rpi6cwmdr0h8na";
+    sha256 = "123jkyb293z7ww3sa9ji5rw7xd229isi03k4ayyh5p7rr0dg8al0";
   };
 
   meta = with stdenv.lib; {

pkgs/applications/audio/bitwig-studio/bitwig-studio2.nix

@@ -3,11 +3,11 @@
 
 bitwig-studio1.overrideAttrs (oldAttrs: rec {
   name = "bitwig-studio-${version}";
-  version = "2.3.2";
+  version = "2.3.5";
 
   src = fetchurl {
     url    = "https://downloads.bitwig.com/stable/${version}/bitwig-studio-${version}.deb";
-    sha256 = "10ji4jqnnlhv4bgvhqwysprax6jcjk4759jskr9imwj6qjnj3vzn";
+    sha256 = "1v62z08hqla8fz5m7hl9ynf2hpr0j0arm0nb5lpd99qrv36ibrsc";
   };
 
   buildInputs = bitwig-studio1.buildInputs ++ [ ffmpeg ];

pkgs/applications/audio/cantata/default.nix

@@ -28,7 +28,7 @@ assert withOnlineServices -> withTaglib;
 assert withReplaygain -> withTaglib;
 
 let
-  version = "2.2.0";
+  version = "2.3.2";
   pname = "cantata";
   fstat = x: fn: "-DENABLE_" + fn + "=" + (if x then "ON" else "OFF");
   fstats = x: map (fstat x);
@@ -42,18 +42,9 @@ in stdenv.mkDerivation rec {
     owner  = "CDrummond";
     repo   = "cantata";
     rev    = "v${version}";
-    sha256 = "1b633chgfs8rya78bzzck5zijna15d1y4nmrz4dcjp862ks5y5q6";
+    sha256 = "11hjday5vj0wzkc8yb5wbs05jwa8mvgxswd5qvhpci0zkl975yzn";
   };
 
-  patches = [
-    # patch is needed for 2.2.0 with qt 5.10 (doesn't harm earlier versions)
-    (fetchpatch {
-      url    = "https://github.com/CDrummond/cantata/commit/4da7a9128f2c5eaf23ae2a5006d300dc4f21fc6a.patch";
-      sha256 = "1z21ax3542z7hm628xv110lmplaspb407jzgfk16xkphww5qyphj";
-      name   = "fix_qt_510.patch";
-    })
-
-  ];
   buildInputs = [ vlc qtbase qtmultimedia qtsvg ]
     ++ stdenv.lib.optionals withTaglib [ taglib taglib_extras ]
     ++ stdenv.lib.optionals withReplaygain [ ffmpeg speex mpg123 ]

pkgs/applications/audio/paprefs/default.nix

@@ -1,21 +1,16 @@
-{ fetchurl, stdenv, pkgconfig, pulseaudioFull, gtkmm2, libglademm
+{ fetchurl, stdenv, meson, ninja, gettext, pkgconfig, pulseaudioFull, gtkmm3, dbus-glib, wrapGAppsHook }:
-, dbus-glib, GConf, gconfmm, intltool }:
 
 stdenv.mkDerivation rec {
-  name = "paprefs-0.9.10";
+  name = "paprefs-1.0";
 
   src = fetchurl {
     url = "https://freedesktop.org/software/pulseaudio/paprefs/${name}.tar.xz";
-    sha256 = "1c5b3sb881szavly220q31g7rvpn94wr7ywlk00hqb9zaikml716";
+    sha256 = "0y77i9gaaassvvjrpwb4xbgqcmr51zmj5rh4z8zm687i5izf84md";
   };
 
-  buildInputs = [ pulseaudioFull gtkmm2 libglademm dbus-glib gconfmm ];
+  nativeBuildInputs = [ meson ninja gettext pkgconfig wrapGAppsHook ];
 
-  nativeBuildInputs = [ pkgconfig intltool ];
+  buildInputs = [ pulseaudioFull gtkmm3 dbus-glib ];
-
-  propagatedUserEnvPkgs = [ GConf ];
-
-  configureFlags = [ "--disable-lynx" ];
 
   meta = with stdenv.lib; {
     description = "PulseAudio Preferences";

pkgs/applications/audio/pianobar/default.nix

@@ -23,6 +23,5 @@ stdenv.mkDerivation rec {
     homepage = http://6xq.net/projects/pianobar/;
     platforms = platforms.linux;
     license = licenses.mit; # expat version
-    maintainers = with maintainers; [ eduarrrd ];
   };
 }

pkgs/applications/audio/qjackctl/default.nix

@@ -1,14 +1,14 @@
 { stdenv, fetchurl, pkgconfig, alsaLib, libjack2, dbus, qtbase, qttools, qtx11extras }:
 
 stdenv.mkDerivation rec {
-  version = "0.5.2";
+  version = "0.5.3";
   name = "qjackctl-${version}";
 
   # some dependencies such as killall have to be installed additionally
 
   src = fetchurl {
     url = "mirror://sourceforge/qjackctl/${name}.tar.gz";
-    sha256 = "0nqr5f82lry3i4if8wdmrqsw84m45ijyj4psll30plxx5732zzaz";
+    sha256 = "0x08af8m5l8qy9av3dlldsg58ny9nc69h1s4i6hqkvj24jwy6fw1";
   };
 
   buildInputs = [

pkgs/applications/audio/qsampler/default.nix

@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   name = "qsampler-${version}";
-  version = "0.5.1";
+  version = "0.5.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/qsampler/${name}.tar.gz";
-    sha256 = "18j4cwmn7waih9x5b66cba2aa85spqqp507bf19ahsb5gl358yhh";
+    sha256 = "0xb0j57k03pkdl7yl5mcv1i21ljnxcq6b9h3zp6mris916lj45zq";
   };
 
   nativeBuildInputs = [ autoconf automake libtool pkgconfig qttools ];

pkgs/applications/audio/qsynth/default.nix

@@ -2,15 +2,15 @@
 
 stdenv.mkDerivation  rec {
   name = "qsynth-${version}";
-  version = "0.5.1";
+  version = "0.5.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/qsynth/${name}.tar.gz";
-    sha256 = "0kpk1rnhbifbvm4xvw8i0d4ksk78pf505qvg08k89kqkg32494ap";
+    sha256 = "1rfkaxq1pyc4hv3l0i6wicianbcbm1wp53kh9i5d4jsljgisd1dv";
   };
 
   # cmake is looking for qsynth.desktop.in and fails if it doesn't find it
-  # seems like a bug and can presumable go in the next version after 0.5.1
+  # seems like a bug and can presumable go in the next version after 0.5.2
   postPatch = ''
     mv src/qsynth.desktop src/qsynth.desktop.in
   '';

pkgs/applications/editors/android-studio/default.nix

@@ -8,9 +8,9 @@ let
     inherit (gnome2) GConf gnome_vfs;
   };
   stableVersion = {
-    version = "3.1.3.0"; # "Android Studio 3.1.3"
+    version = "3.1.4.0"; # "Android Studio 3.1.4"
-    build = "173.4819257";
+    build = "173.4907809";
-    sha256Hash = "196yaswbxh2nd83gimjxr8ggr5xkdxq7n3xlh6ax73v59pj4hryq";
+    sha256Hash = "0xx6yprylmcb32ipmwdcfkgddlm1nrxi1w68miclvgrbk015brf2";
   };
   betaVersion = {
     version = "3.2.0.22"; # "Android Studio 3.2 Beta 5"
@@ -18,9 +18,9 @@ let
     sha256Hash = "016nyn1pqviy089hg0dq7m4cqb39fdxdcy4zknkaq7dmgv1dj6x9";
   };
   latestVersion = { # canary & dev
-    version = "3.3.0.3"; # "Android Studio 3.3 Canary 4"
+    version = "3.3.0.4"; # "Android Studio 3.3 Canary 5"
-    build = "182.4924367";
+    build = "182.4928781";
-    sha256Hash = "03fxjxlsbrpklsss1nvlkb41skr5ymmq9vdns8iikcm1ng925vfd";
+    sha256Hash = "110gh5ylgf1p8z0rdnvc6clkq3v721v6pjvll66a8v4zgz9ay8b4";
   };
 in rec {
   # Old alias

pkgs/applications/editors/emacs-modes/melpa-packages.nix

@@ -52,19 +52,9 @@ self:
       # part of a larger package
       caml = dontConfigure super.caml;
 
-      # part of a larger package
-      # upstream issue: missing package version
-      cmake-mode = markBroken (dontConfigure super.cmake-mode);
-
       # Expects bash to be at /bin/bash
       company-rtags = markBroken super.company-rtags;
 
-      # upstream issue: missing file header
-      connection = markBroken super.connection;
-
-      # upstream issue: missing file header
-      dictionary = markBroken super.dictionary;
-
       easy-kill-extras = super.easy-kill-extras.override {
         inherit (self.melpaPackages) easy-kill;
       };
@@ -79,6 +69,17 @@ self:
         inherit (self.melpaPackages) ess ctable popup;
       };
 
+      evil-magit = super.evil-magit.overrideAttrs (attrs: {
+        # searches for Git at build time
+        nativeBuildInputs =
+          (attrs.nativeBuildInputs or []) ++ [ external.git ];
+      });
+
+      # missing dependencies
+      evil-search-highlight-persist = super.evil-search-highlight-persist.overrideAttrs (attrs: {
+        packageRequires = with self; [ evil highlight ];
+      });
+
       # missing OCaml
       flycheck-ocaml = markBroken super.flycheck-ocaml;
 
@@ -108,15 +109,17 @@ self:
       # upstream issue: missing file header
       initsplit = super.initsplit;
 
+      # tries to write a log file to $HOME
+      insert-shebang = super.insert-shebang.overrideAttrs (attrs: {
+        HOME = "/tmp";
+      });
+
       # Expects bash to be at /bin/bash
       ivy-rtags = markBroken super.ivy-rtags;
 
       # upstream issue: missing file header
       jsfmt = markBroken super.jsfmt;
 
-      # upstream issue: missing file header
-      link = markBroken super.link;
-
       # upstream issue: missing file header
       maxframe = markBroken super.maxframe;
 
@@ -131,6 +134,18 @@ self:
             (attrs.nativeBuildInputs or []) ++ [ external.git ];
         });
 
+      magit-annex = super.magit-annex.overrideAttrs (attrs: {
+        # searches for Git at build time
+        nativeBuildInputs =
+          (attrs.nativeBuildInputs or []) ++ [ external.git ];
+      });
+
+      magit-gitflow = super.magit-gitflow.overrideAttrs (attrs: {
+        # searches for Git at build time
+        nativeBuildInputs =
+          (attrs.nativeBuildInputs or []) ++ [ external.git ];
+      });
+
       # missing OCaml
       merlin = markBroken super.merlin;
 
@@ -154,8 +169,10 @@ self:
             (attrs.nativeBuildInputs or []) ++ [ external.git ];
          }));
 
-      # upstream issue: truncated file
+      # tries to write to $HOME
-      powershell = markBroken super.powershell;
+      php-auto-yasnippets = super.php-auto-yasnippets.overrideAttrs (attrs: {
+        HOME = "/tmp";
+      });
 
       # upstream issue: mismatched filename
       processing-snippets = markBroken super.processing-snippets;

pkgs/applications/editors/kakoune/default.nix

@@ -4,12 +4,12 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "kakoune-unstable-${version}";
-  version = "2018-05-21";
+  version = "2018-08-05";
   src = fetchFromGitHub {
     repo = "kakoune";
     owner = "mawww";
-    rev = "878d2a4bdb674a5e7703a66e530520f48efba641";
+    rev = "ae75032936ed9ffa2bf14589fef115d3d684a7c6";
-    sha256 = "0pwy6ilsb62s1792gjyvhvq8shj60l8lx26b58zvpfb54an4s6rk";
+    sha256 = "1qm6i8vzr4wjxxdvhr54pan0ysxq1sn880bz8p2w9y6qa91yd3m3";
   };
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ ncurses asciidoc docbook_xsl libxslt ];

pkgs/applications/editors/vim/configurable.nix

@@ -6,6 +6,7 @@ args@{ source ? "default", callPackage, fetchurl, stdenv, ncurses, pkgconfig, ge
 , libICE
 , vimPlugins
 , makeWrapper
+, wrapGAppsHook
 
 # apple frameworks
 , CoreServices, CoreData, Cocoa, Foundation, libobjc, cf-private
@@ -73,15 +74,6 @@ in stdenv.mkDerivation rec {
 
   src = builtins.getAttr source {
     "default" = common.src; # latest release
-
-    "vim-nox" =
-      {
-        # vim nox branch: client-server without X by uing sockets
-        # REGION AUTO UPDATE: { name="vim-nox"; type="hg"; url="https://code.google.com/r/yukihironakadaira-vim-cmdsrv-nox/"; branch="cmdsrv-nox"; }
-        src = (fetchurl { url = "http://mawercer.de/~nix/repos/vim-nox-hg-2082fc3.tar.bz2"; sha256 = "293164ca1df752b7f975fd3b44766f5a1db752de6c7385753f083499651bd13a"; });
-        name = "vim-nox-hg-2082fc3";
-        # END
-      }.src;
   };
 
   patches = [ ./cflags-prune.diff ] ++ stdenv.lib.optional ftNixSupport ./ft-nix-support.patch;
@@ -131,6 +123,7 @@ in stdenv.mkDerivation rec {
   ++ stdenv.lib.optional wrapPythonDrv makeWrapper
   ++ stdenv.lib.optional nlsSupport gettext
   ++ stdenv.lib.optional perlSupport perl
+  ++ stdenv.lib.optional (guiSupport == "gtk3") wrapGAppsHook
   ;
 
   buildInputs = [ ncurses libX11 libXext libSM libXpm libXt libXaw libXau

pkgs/applications/graphics/animbar/default.nix

@@ -0,0 +1,40 @@
+{ stdenv, lib, fetchurl, cmake, qt4, file, gcc }:
+
+stdenv.mkDerivation rec {
+  pname = "animbar";
+  version = "1.2";
+  name = "${pname}-${version}";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/${pname}/${name}.tar.bz2";
+    sha256 = "0836nwcpyfdrapyj3hbg3wh149ihc26pc78h01adpc7c0r7d9pr9";
+  };
+
+  nativeBuildInputs = [ cmake  ];
+
+  buildInputs = [ qt4 file ];
+
+  installPhase = ''
+    mkdir -p $out/bin $out/share/pixmaps
+    cp src/animbar $out/bin
+    cp ../icon/* $out/share/pixmaps
+  '';
+
+  meta = with lib; {
+    description = "Create your own animation on paper and transparancy";
+    longDescription = ''
+	Animbar lets you easily create your own animation on paper and
+	transparancy. From a set of input images two output images are
+	computed, that are printed one on paper and one on
+	transparency. By moving the transparency over the paper you
+	create a fascinating animation effect. This kind of animation
+	technique is hundreds of years old and known under several
+	names: picket fence animation, barrier grid animation, Moiré
+	animation, to name a few.
+    '';
+    homepage = http://animbar.mnim.org;
+    maintainers = with maintainers; [ leenaars ];
+    platforms = platforms.linux;
+    license = licenses.gpl3;
+  };
+}

pkgs/applications/graphics/photoqt/default.nix

@@ -31,6 +31,5 @@ stdenv.mkDerivation rec {
     description = "Simple, yet powerful and good looking image viewer";
     license = stdenv.lib.licenses.gpl2Plus;
     platforms = stdenv.lib.platforms.unix;
-    maintainers = [ stdenv.lib.maintainers.eduarrrd ];
   };
 }

pkgs/applications/graphics/processing3/default.nix

@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, fetchurl, xmlstarlet, makeWrapper, ant, jdk, rsync, javaPackages, libXxf86vm, gsettings-desktop-schemas }:
 
 stdenv.mkDerivation rec {
-  version = "3.3.7";
+  version = "3.4";
   name = "processing3-${version}";
 
   src = fetchFromGitHub {
     owner = "processing";
     repo = "processing";
-    rev = "processing-0264-3.3.7";
+    rev = "processing-0265-${version}";
-    sha256 = "0a20z19lmc4xarfnr7xshcmlv3xkc2dgjxknis0iv79gxnwlqhpq";
+    sha256 = "12wpxgn2wd5vbasx9584w5yb1s319smq1zh8m7dvp7gkqw9plwp4";
   };
 
   nativeBuildInputs = [ ant rsync makeWrapper ];
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     ${xmlstarlet}/bin/xmlstarlet ed --inplace -P -d '//get[@src="http://download.processing.org/reference.zip"]' build/build.xml
     install -D -m0444 ${fetchurl {
                           url    = http://download.processing.org/reference.zip;
-                          sha256 = "104zig026y8vbl4qksmscjq0bms8mi2jmri1ijdlbkxcqnv9bnlf";
+                          sha256 = "0dli1bdgw8hsx7g7b048ap81v2za9maa6pfcwdqm3qkfypr8q7pr";
                         }
                        } ./java/reference.zip
 

pkgs/applications/misc/dfilemanager/default.nix

@@ -20,6 +20,5 @@ stdenv.mkDerivation {
     description = "File manager written in Qt/C++";
     license = stdenv.lib.licenses.gpl2;
     platforms = stdenv.lib.platforms.unix;
-    maintainers = [ stdenv.lib.maintainers.eduarrrd ];
   };
 }

pkgs/applications/misc/overmind/default.nix

@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "overmind-${version}";
-  version = "1.1.1";
+  version = "2.0.0.beta1";
   goPackagePath = "github.com/DarthSim/overmind";
 
   nativeBuildInputs = [ makeWrapper ];
@@ -15,7 +15,7 @@ buildGoPackage rec {
     owner = "DarthSim";
     repo = "overmind";
     rev = "v${version}";
-    sha256 = "0gdsbm54ln07jv1kgg53fiavx18xxw4f21lfcdl74ijk6bx4jbzv";
+    sha256 = "15fch3qszdm8bj1m9hxky9zgk6f5gpbswwfslg84qdjf4iwr5drq";
   };
 
   meta = with stdenv.lib; {

pkgs/applications/misc/ranger/default.nix

@@ -1,11 +1,11 @@
-{ stdenv, fetchFromGitHub, pythonPackages, file, less
+{ stdenv, fetchFromGitHub, python3Packages, file, less
 , imagePreviewSupport ? true, w3m ? null}:
 
 with stdenv.lib;
 
 assert imagePreviewSupport -> w3m != null;
 
-pythonPackages.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   name = "ranger-${version}";
   version = "1.9.1";
 
@@ -16,7 +16,7 @@ pythonPackages.buildPythonApplication rec {
     sha256= "1zhds37j1scxa9b183qbrjwxqldrdk581c5xiy81vg17sndb1kqj";
   };
 
-  checkInputs = with pythonPackages; [ pytest ];
+  checkInputs = with python3Packages; [ pytest ];
   propagatedBuildInputs = [ file ];
 
   checkPhase = ''

pkgs/applications/misc/solaar/default.nix

@@ -1,11 +1,13 @@
-{fetchurl, stdenv, gtk3, python34Packages, gobjectIntrospection}:
+{fetchFromGitHub, stdenv, gtk3, python34Packages, gobjectIntrospection}:
 python34Packages.buildPythonApplication rec {
-  name = "solaar-${version}";
+  name = "solaar-unstable-${version}";
-  version = "0.9.2";
+  version = "2018-02-02";
   namePrefix = "";
-  src = fetchurl {
+  src = fetchFromGitHub {
-    sha256 = "0954grz2adggfzcj4df4mpr4d7qyl7w8rb4j2s0f9ymawl92i05j";
+    owner = "pwr";
-    url = "https://github.com/pwr/Solaar/archive/${version}.tar.gz";
+    repo = "Solaar";
+    rev = "59b7285fdfc875119f0c92cfd5f5909e8a8e578c";
+    sha256 = "0zy5vmjzdybnjf0mpp8rny11sc43gmm8172svsm9s51h7x0v83y3";
   };
 
   propagatedBuildInputs = [python34Packages.pygobject3 python34Packages.pyudev gobjectIntrospection gtk3];
@@ -35,6 +37,6 @@ python34Packages.buildPythonApplication rec {
     license = licenses.gpl2;
     homepage = https://pwr.github.io/Solaar/;
     platforms = platforms.linux;
-    maintainers = [maintainers.spinus];
+    maintainers = [maintainers.spinus maintainers.ysndr];
   };
 }

pkgs/applications/misc/toggldesktop/TogglDesktop.pro

@@ -0,0 +1,19 @@
+QT += core network widgets
+
+DEFINES += APP_ENVIRONMENT=\\\"production\\\"
+DEFINES += APP_VERSION=\\\"@version@\\\"
+
+TARGET = toggldesktop
+TEMPLATE = app
+
+SOURCES += *.cpp
+HEADERS += *.h
+FORMS += *.ui
+RESOURCES += *.qrc
+
+target.path = $$PREFIX
+
+INSTALLS += target
+
+CONFIG += link_pkgconfig
+PKGCONFIG += bugsnag-qt qxtglobalshortcut qt-oauth-lib toggl x11 xscrnsaver

pkgs/applications/misc/toggldesktop/default.nix

@@ -0,0 +1,148 @@
+{ stdenv, fetchzip, buildEnv, makeDesktopItem, runCommand, writeText, pkgconfig
+, cmake, qmake, cacert, jsoncpp, libX11, libXScrnSaver, lua, openssl, poco
+, qtbase, qtwebkit, qtx11extras, sqlite }:
+
+let
+  name = "toggldesktop-${version}";
+  version = "7.4.231";
+
+  src = fetchzip {
+    url = "https://github.com/toggl/toggldesktop/archive/v${version}.tar.gz";
+    sha256 = "01hqkx9dljnhwnyqi6mmzfp02hnbi2j50rsfiasniqrkbi99x9v1";
+  };
+
+  bugsnag-qt = stdenv.mkDerivation rec {
+    name = "bugsnag-qt-${version}";
+    version = "20180522.005732";
+
+    src = fetchzip {
+      url = "https://github.com/yegortimoshenko/bugsnag-qt/archive/${version}.tar.gz";
+      sha256 = "02s6mlggh0i4a856md46dipy6mh47isap82jlwmjr7hfsk2ykgnq";
+    };
+
+    nativeBuildInputs = [ qmake ];
+    buildInputs = [ qtbase ];
+  };
+
+  qxtglobalshortcut = stdenv.mkDerivation rec {
+    name = "qxtglobalshortcut-${version}";
+    version = "f584471dada2099ba06c574bdfdd8b078c2e3550";
+
+    src = fetchzip {
+      url = "https://github.com/hluk/qxtglobalshortcut/archive/${version}.tar.gz";
+      sha256 = "1iy17gypav10z8aa62s5jb6mq9y4kb9ms4l61ydmk3xwlap7igw1";
+    };
+
+    nativeBuildInputs = [ cmake ];
+    buildInputs = [ qtbase qtx11extras ];
+  };
+
+  qt-oauth-lib = stdenv.mkDerivation rec {
+    name = "qt-oauth-lib-${version}";
+    version = "20180521.233208";
+
+    src = fetchzip {
+      url = "https://github.com/yegortimoshenko/qt-oauth-lib/archive/${version}.tar.gz";
+      sha256 = "0f46d44slzvzaqx0lksvv14lsc1jp8vd2mragxd61r820hybf5z3";
+    };
+
+    nativeBuildInputs = [ qmake ];
+    buildInputs = [ qtbase qtwebkit ];
+  };
+
+  poco-pc = writeText "poco.pc" ''
+    Name: Poco
+    Description: ${poco.meta.description}
+    Version: ${poco.version}
+    Libs: -L${poco}/lib -lPocoDataSQLite -lPocoData -lPocoNet -lPocoNetSSL -lPocoCrypto -lPocoUtil -lPocoXML -lPocoFoundation
+    Cflags: -I${poco}/include/Poco
+  '';
+
+  poco-pc-wrapped = runCommand "poco-pc-wrapped" {} ''
+    mkdir -p $out/lib/pkgconfig && ln -s ${poco-pc} $_/poco.pc
+  '';
+
+  libtoggl = stdenv.mkDerivation {
+    name = "libtoggl-${version}";
+    inherit src version;
+
+    sourceRoot = "source/src";
+
+    nativeBuildInputs = [ qmake pkgconfig ];
+    buildInputs = [ jsoncpp lua openssl poco poco-pc-wrapped sqlite libX11 ];
+
+    postPatch = ''
+      cat ${./libtoggl.pro} > libtoggl.pro
+      rm get_focused_window_{mac,windows}.cc
+    '';
+  };
+
+  toggldesktop = stdenv.mkDerivation {
+    name = "${name}-unwrapped";
+    inherit src version;
+
+    sourceRoot = "source/src/ui/linux/TogglDesktop";
+
+    postPatch = ''
+      substituteAll ${./TogglDesktop.pro} TogglDesktop.pro
+      substituteInPlace toggl.cpp \
+        --replace ./../../../toggl_api.h toggl_api.h
+    '';
+
+    postInstall = ''
+      ln -s ${cacert}/etc/ssl/certs/ca-bundle.crt $out/cacert.pem
+    '';
+
+    nativeBuildInputs = [ qmake pkgconfig ];
+
+    buildInputs = [
+      bugsnag-qt
+      libtoggl
+      qxtglobalshortcut
+      qtbase
+      qtwebkit
+      qt-oauth-lib
+      qtx11extras
+      libX11
+      libXScrnSaver
+    ];
+  };
+
+  toggldesktop-icons = stdenv.mkDerivation {
+    name = "${name}-icons";
+    inherit (toggldesktop) src sourceRoot;
+
+    installPhase = ''
+      for f in icons/*; do
+        mkdir -p $out/share/icons/hicolor/$(basename $f)/apps
+        mv $f/toggldesktop.png $_
+      done
+    '';
+  };
+
+  toggldesktop-wrapped = runCommand "toggldesktop-wrapped" {} ''
+    mkdir -p $out/bin && ln -s ${toggldesktop}/toggldesktop $_
+  '';
+
+  desktopItem = makeDesktopItem rec {
+    categories = "Utility;";
+    desktopName = "Toggl";
+    genericName = desktopName;
+    name = "toggldesktop";
+    exec = "${toggldesktop-wrapped}/bin/toggldesktop";
+    icon = "toggldesktop";
+  };
+in
+
+buildEnv {
+  inherit name;
+  paths = [ desktopItem toggldesktop-icons toggldesktop-wrapped ];
+
+  meta = with stdenv.lib; {
+    description = "Client for Toggl time tracking service";
+    homepage = https://github.com/toggl/toggldesktop;
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ yegortimoshenko ];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/misc/toggldesktop/libtoggl.pro

@@ -0,0 +1,20 @@
+TARGET = toggl
+TEMPLATE = lib
+
+SOURCES += *.cc
+HEADERS += *.h
+
+headers.files = $$HEADERS
+headers.path = $$PREFIX/include
+target.path = $$PREFIX/lib
+
+INSTALLS += headers target
+
+CONFIG += create_prl create_pc link_pkgconfig
+PKGCONFIG += jsoncpp openssl lua poco sqlite3 x11
+
+QMAKE_PKGCONFIG_NAME = $$TARGET
+QMAKE_PKGCONFIG_PREFIX = $$PREFIX
+QMAKE_PKGCONFIG_LIBDIR = $$target.path
+QMAKE_PKGCONFIG_INCDIR = $$headers.path
+QMAKE_PKGCONFIG_DESTDIR = pkgconfig

pkgs/applications/networking/browsers/jumanji/default.nix

@@ -1,31 +0,0 @@
-{ stdenv, fetchgit, pkgconfig, girara, gtk, webkitgtk, glib-networking, makeWrapper
-, gsettings-desktop-schemas }:
-
-stdenv.mkDerivation rec {
-  name = "jumanji-${version}";
-  version = "20150107";
-
-  src = fetchgit {
-    url = https://git.pwmt.org/pwmt/jumanji.git;
-    rev = "f8e04e5b5a9fec47d49ca63a096e5d35be281151";
-    sha256 = "1dsbyz489fx7dp07i29q1rjkl7nhrfscc8ks8an2rdyhx3457asg";
-  };
-
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ girara gtk webkitgtk makeWrapper gsettings-desktop-schemas ];
-
-  makeFlags = [ "PREFIX=$(out)" ];
-
-  preFixup=''
-    wrapProgram "$out/bin/jumanji" \
-     --prefix GIO_EXTRA_MODULES : "${glib-networking.out}/lib/gio/modules" \
-     --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH"
-  '';
-
-  meta = with stdenv.lib; {
-    description = "Minimal web browser";
-    homepage = https://pwmt.org/projects/jumanji/;
-    platforms = platforms.all;
-    maintainers = [ maintainers.koral ];
-  };
-}

pkgs/applications/networking/browsers/palemoon/default.nix

@@ -10,14 +10,14 @@
 
 stdenv.mkDerivation rec {
   name = "palemoon-${version}";
-  version = "27.9.2";
+  version = "27.9.4";
 
   src = fetchFromGitHub {
     name   = "palemoon-src";
     owner  = "MoonchildProductions";
     repo   = "Pale-Moon";
     rev    = version + "_Release";
-    sha256 = "0v6vgkxac2s1hw1namvrjysj2k1kbkabwdxrpq6kyd8svr7n974r";
+    sha256 = "0ir5gzhw98gfn15x58g1fwi11jd7gysvacqxg1v0jdjhgdl4m5sx";
   };
 
   desktopItem = makeDesktopItem {
@@ -79,6 +79,8 @@ stdenv.mkDerivation rec {
     chmod u+w .
   '';
 
+  hardeningDisable = [ "format" ];
+  
   buildPhase = ''
     cd $builddir
     $src/mach build

pkgs/applications/networking/instant-messengers/pybitmessage/default.nix

@@ -1,18 +1,18 @@
-{ stdenv, fetchFromGitHub, pythonPackages, openssl }:
+{ stdenv, fetchFromGitHub, python2Packages, openssl }:
 
-pythonPackages.buildPythonApplication rec {
+python2Packages.buildPythonApplication rec {
-  name = "pybitmessage-${version}";
+  pname = "pybitmessage";
 
-  version = "0.6.2";
+  version = "0.6.3.2";
 
   src = fetchFromGitHub {
     owner = "bitmessage";
     repo = "PyBitmessage";
-    rev = "v${version}";
+    rev = version;
-    sha256 = "04sgns9qczzw2152gqdr6bjyy4fmgs26cz8n3qck94l0j51rxhz8";
+    sha256 = "1lmhbpwsqh1v93krlqqhafw2pc3y0qp8zby186yllbph6s8kdp35";
   };
 
-  propagatedBuildInputs = with pythonPackages; [ msgpack-python pyqt4 numpy pyopencl ] ++ [ openssl ];
+  propagatedBuildInputs = with python2Packages; [ msgpack-python pyqt4 numpy pyopencl ] ++ [ openssl ];
 
   preConfigure = ''
     # Remove interaction and misleading output

pkgs/applications/networking/instant-messengers/signal-desktop/default.nix

@@ -55,11 +55,11 @@ let
 
 in stdenv.mkDerivation rec {
   name = "signal-desktop-${version}";
-  version = "1.15.0";
+  version = "1.15.3";
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "1q73jx92h8zwk1dn103ymskz35q6kfiqc44886jr0p7mlpndqsa4";
+    sha256 = "009bcy90dvwiizya387fqrh3a8l0czgs4wnddxndy9gd477sn704";
   };
 
   phases = [ "unpackPhase" "installPhase" ];

pkgs/applications/networking/ipfs/default.nix

@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "ipfs-${version}";
-  version = "0.4.15";
+  version = "0.4.17";
   rev = "v${version}";
 
   goPackagePath = "github.com/ipfs/go-ipfs";
@@ -10,7 +10,7 @@ buildGoPackage rec {
   extraSrcPaths = [
     (fetchgx {
       inherit name src;
-      sha256 = "0bysfh2hd040i8lnyzhy96frflls4kdnlw748cl51ngqg3rwbhgz";
+      sha256 = "0grdgnr67r3qh0ppc3flrhcw8zlvx10mxypd8q2mhkil9w4dpcna";
     })
   ];
 
@@ -18,7 +18,7 @@ buildGoPackage rec {
     owner = "ipfs";
     repo = "go-ipfs";
     inherit rev;
-    sha256 = "1ry4a4pq26dbwy2b9cwi3xjaiyq6sng9lxnb1n30zxhp4w7rla2h";
+    sha256 = "18skmchdqd54wfqhibscqvc360l5ig6vmxd73ivf3bcpj3zvgq7q";
   };
 
   meta = with stdenv.lib; {

pkgs/applications/networking/p2p/deluge/default.nix

@@ -18,7 +18,8 @@ pythonPackages.buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = with pythonPackages; [
-    pyGtkGlade libtorrentRasterbar twisted Mako chardet pyxdg pyopenssl service-identity
+    pyGtkGlade twisted Mako chardet pyxdg pyopenssl service-identity
+    libtorrentRasterbar.dev libtorrentRasterbar.python
   ];
 
   nativeBuildInputs = [ intltool ];

pkgs/applications/networking/remote/citrix-receiver/default.nix

@@ -39,50 +39,6 @@ let
   });
 
   versionInfo = {
-    "13.4.0" = rec {
-      major     = "13";
-      minor     = "4";
-      patch     = "0";
-      x64hash   = "133brs0sq6d0mgr19rc6ig1n9ahm3ryi23v5nrgqfh0hgxqcrrjb";
-      x86hash   = "0r7jfl5yqv1s2npy8l9gsn0gbb82f6raa092ppkc8xy5pni5sh7l";
-      x64suffix = "10109380";
-      x86suffix = x64suffix;
-      homepage  = https://www.citrix.com/downloads/citrix-receiver/legacy-receiver-for-linux/receiver-for-linux-latest-13-4.html;
-    };
-
-    "13.5.0" = rec {
-      major     = "13";
-      minor     = "5";
-      patch     = "0";
-      x64hash   = "1r24mhkpcc0z95n597p07fz92pd1b8qqzp2z6w07rmb9wb8mpd4x";
-      x86hash   = "0pwxshlryzhkl86cj9ryybm54alhzjx0gpp67fnvdn5r64wy1nd1";
-      x64suffix = "10185126";
-      x86suffix = x64suffix;
-      homepage  = https://www.citrix.com/downloads/citrix-receiver/legacy-receiver-for-linux/receiver-for-linux-latest-13-5.html;
-    };
-
-    "13.6.0" = rec {
-      major     = "13";
-      minor     = "6";
-      patch     = "0";
-      x64hash   = "6e423be41d5bb8186bcca3fbb4ede54dc3f00b8d2aeb216ae4aabffef9310d34";
-      x86hash   = "0ba3eba208b37844904d540b3011075ed5cecf429a0ab6c6cd52f2d0fd841ad2";
-      x64suffix = "10243651";
-      x86suffix = x64suffix;
-      homepage  = https://www.citrix.com/downloads/citrix-receiver/legacy-receiver-for-linux/receiver-for-linux-136.html;
-    };
-
-    "13.7.0" = {
-      major     = "13";
-      minor     = "7";
-      patch     = "0";
-      x64hash   = "18fb374b9fb8e249b79178500dddca7a1f275411c6537e7695da5dcf19c5ba91";
-      x86hash   = "4c68723b0327cf6f12da824056fce2b7853c38e6163a48c9d222b93dd8da75b6";
-      x64suffix = "10276927";
-      x86suffix = "10276925";
-      homepage  = https://www.citrix.com/downloads/citrix-receiver/legacy-receiver-for-linux/receiver-for-linux-137.html;
-    };
-
     "13.8.0" = {
       major     = "13";
       minor     = "8";
@@ -156,7 +112,7 @@ let
         '';
       };
 
-      phases = [ "unpackPhase" "installPhase" ];
+      dontBuild = true;
 
       sourceRoot = ".";
 
@@ -203,6 +159,8 @@ let
       };
 
       installPhase = ''
+        runHook preInstall
+
         export ICAInstDir="$out/opt/citrix-icaclient"
 
         sed -i \
@@ -262,13 +220,15 @@ let
 
         # We introduce a dependency on the source file so that it need not be redownloaded everytime
         echo $src >> "$out/share/nix_dependencies.pin"
+
+        runHook postInstall
       '';
 
       meta = with stdenv.lib; {
         license     = stdenv.lib.licenses.unfree;
         inherit homepage;
         description = "Citrix Receiver";
-        maintainers = with maintainers; [ obadz a1russell ];
+        maintainers = with maintainers; [ obadz a1russell ma27 ];
         platforms   = platforms.linux;
       };
     };

pkgs/applications/networking/remote/citrix-receiver/wrapper.nix

@@ -0,0 +1,19 @@
+{ citrix_receiver, extraCerts ? [], symlinkJoin }:
+
+let
+
+  mkCertCopy = certPath:
+    "cp ${certPath} $out/opt/citrix-icaclient/keystore/cacerts/";
+
+in
+
+if builtins.length extraCerts == 0 then citrix_receiver else symlinkJoin {
+  name = "citrix-with-extra-certs-${citrix_receiver.version}";
+  paths = [ citrix_receiver ];
+
+  postBuild = ''
+    ${builtins.concatStringsSep "\n" (map mkCertCopy extraCerts)}
+
+    sed -i -E "s,-icaroot (.+citrix-icaclient),-icaroot $out/opt/citrix-icaclient," $out/bin/wfica
+  '';
+}

pkgs/applications/networking/remote/remmina/default.nix

@@ -10,7 +10,7 @@
 }:
 
 let
-  version = "1.2.30.1";
+  version = "1.2.31.2";
 
   desktopItem = makeDesktopItem {
     name = "remmina";
@@ -29,7 +29,7 @@ in stdenv.mkDerivation {
     owner  = "Remmina";
     repo   = "Remmina";
     rev    = "v${version}";
-    sha256 = "1jz20yv84a8m9gm9fsz0jii8ag90v1scmbkkx9gk38ax5il7ilvn";
+    sha256 = "09jdrs2hbr9wyd5yqw5bri41rnfnxxyh98mlv6ig2phlvs9cg73d";
   };
 
   nativeBuildInputs = [ pkgconfig ];

pkgs/applications/networking/sync/lsyncd/default.nix

@@ -1,18 +1,26 @@
-{ stdenv, fetchFromGitHub, cmake, lua, pkgconfig, rsync,
+{ stdenv, fetchFromGitHub, fetchpatch, cmake, lua, pkgconfig, rsync,
   asciidoc, libxml2, docbook_xml_dtd_45, docbook_xsl, libxslt }:
 
 stdenv.mkDerivation rec {
   name = "lsyncd-${version}";
-  version = "2.2.2";
+  version = "2.2.3";
 
   src = fetchFromGitHub {
     owner = "axkibe";
     repo = "lsyncd";
     rev = "release-${version}";
-    sha256 = "1q2ixp52r96ckghgmxdbms6xrq8dbziimp8gmgzqfq4lk1v1w80y";
+    sha256 = "1hbsih5hfq9lhgnxm0wb5mrj6xmlk2l0i9a79wzd5f6cnjil9l3x";
   };
 
-  patchPhase = ''
+  patches = [
+    (fetchpatch {
+      sha256 = "0b0h2qxh73l502p7phf6qgl8576nf6fvqqp2x5wy3nz7sc9qb1z8";
+      name = "fix-non-versioned-lua-not-search-in-cmake.patch";
+      url = "https://github.com/axkibe/lsyncd/pull/500/commits/0af99d8d5ba35118e8799684a2d4a8ea4b0c6957.patch";
+    })
+  ];
+
+  postPatch = ''
     substituteInPlace default-rsync.lua \
       --replace "/usr/bin/rsync" "${rsync}/bin/rsync"
   '';

pkgs/applications/office/tryton/default.nix

@@ -14,10 +14,10 @@ with stdenv.lib;
 
 python2Packages.buildPythonApplication rec {
   pname = "tryton";
-  version = "4.8.3";
+  version = "4.8.4";
   src = python2Packages.fetchPypi {
     inherit pname version;
-    sha256 = "1e2862bbe7c943afbbdf2232cdc55f75d2357640115c7f1483f0814b2c5a6882";
+    sha256 = "6cf3091424853e1270d61f3a9b15ad8e6b36a44c28becf216c324ca8dc1474b0";
   };
   nativeBuildInputs = [ pkgconfig gobjectIntrospection ];
   propagatedBuildInputs = with python2Packages; [

pkgs/applications/office/trytond/default.nix

@@ -5,10 +5,10 @@ with stdenv.lib;
 
 python2Packages.buildPythonApplication rec {
   pname = "trytond";
-  version = "4.8.2";
+  version = "4.8.3";
   src = python2Packages.fetchPypi {
     inherit pname version;
-    sha256 = "ec5c419418517bf9f7d2af08b2bfd3bcc7526f6d6f07d122abf1699c728ae2a9";
+    sha256 = "11d01dc984d9274229b5c80f883679d130a55e14e9124b051274fce9aea4ef77";
   };
 
   # Tells the tests which database to use

pkgs/applications/science/chemistry/gwyddion/default.nix

@@ -2,11 +2,11 @@
 
 with stdenv.lib;
 
+let version = "2.48"; in
 stdenv.mkDerivation {
   name = "gwyddion-${version}";
-  version = "2.48";
   src = fetchurl {
-    url = "http://sourceforge.net/projects/gwyddion/files/gwyddion/2.48/gwyddion-2.48.tar.xz";
+    url = "http://sourceforge.net/projects/gwyddion/files/gwyddion/${version}/gwyddion-${version}.tar.xz";
     sha256 = "119iw58ac2wn4cas6js8m7r1n4gmmkga6b1y711xzcyjp9hshgwx";
   };
   nativeBuildInputs = [ pkgconfig ];

pkgs/applications/science/logic/symbiyosys/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "symbiyosys-${version}";
-  version = "2018.05.03";
+  version = "2018.07.26";
 
   src = fetchFromGitHub {
     owner  = "yosyshq";
     repo   = "symbiyosys";
-    rev    = "35d956c7bb77c0602d198035b2d73a9c61cb4de4";
+    rev    = "2fef25f93dd1cb5137a08e71f507e3eee8100fb1";
-    sha256 = "02zg3nkwp3fdjwz1agvsn55k1xipwh2rradb0bgjrjpsmmw63gda";
+    sha256 = "103fga0n11h4n2q346xyz3k0615d9lgx2b8sqr1pwn2hx26kchav";
   };
 
   buildInputs = [ python3 yosys ];

pkgs/applications/science/math/ripser/default.nix

@@ -13,10 +13,10 @@ assert useGoogleHashmap -> sparsehash != null;
 
 let
   inherit (stdenv.lib) optional;
+  version = "1.0";
 in
 stdenv.mkDerivation {
   name = "ripser-${version}";
-  version = "1.0";
 
   src = fetchFromGitHub {
     owner = "Ripser";

pkgs/applications/science/math/sage/sage-src.nix

@@ -129,6 +129,13 @@ stdenv.mkDerivation rec {
       url = "https://git.sagemath.org/sage.git/patch/?id=2ab1546b3e21d1d0ab3b4fcd58576848b3a2d888";
       sha256 = "1c5gnasq7y9xxj762bn79bis0zi8d9bgg7jzlf64ifixsrc5cymb";
     })
+
+    # arb 2.13.0 -> 2.14.0
+    (fetchpatch {
+      name = "arb-2.14.0.patch";
+      url = "https://git.sagemath.org/sage.git/patch?id2=8.4.beta0&id=8bef4fd2876a61969b516fe4eb3b8ad7cc076c5e";
+      sha256 = "00p3hfsfn3w2vxgd9fjd23mz7xfxjfravf8ysjxkyd657jbkpjmk";
+    })
   ];
 
   patches = nixPatches ++ packageUpgradePatches ++ [

pkgs/applications/version-management/git-and-tools/cgit/default.nix

@@ -6,19 +6,19 @@
 
 stdenv.mkDerivation rec {
   name = "cgit-${version}";
-  version = "1.1";
+  version = "1.2.1";
 
   src = fetchurl {
     url = "https://git.zx2c4.com/cgit/snapshot/${name}.tar.xz";
-    sha256 = "142qcgs8dwnzhymn0a7xx47p9fc2z5wrb86ah4a9iz0mpqlsz288";
+    sha256 = "1gw2j5xc5qdx2hwiwkr8h6kgya7v9d9ff9j32ga1dys0cca7qm1w";
   };
 
   # cgit is tightly coupled with git and needs a git source tree to build.
   # IMPORTANT: Remember to check which git version cgit needs on every version
   # bump (look for "GIT_VER" in the top-level Makefile).
   gitSrc = fetchurl {
-    url    = "mirror://kernel/software/scm/git/git-2.10.2.tar.xz";
+    url    = "mirror://kernel/software/scm/git/git-2.18.0.tar.xz";
-    sha256 = "0wc64dzcxrzgi6kwcljz6y3cwm3ajdgf6aws7g58azbhvl1jk04l";
+    sha256 = "14hfwfkrci829a9316hnvkglnqqw1p03cw9k56p4fcb078wbwh4b";
   };
 
   nativeBuildInputs = [ pkgconfig ] ++ [ python wrapPython ];

pkgs/applications/version-management/subversion/default.nix

@@ -91,12 +91,12 @@ let
 
     doCheck = false; # fails 10 out of ~2300 tests
 
-    meta = {
+    meta = with stdenv.lib; {
       description = "A version control system intended to be a compelling replacement for CVS in the open source community";
+      license = licenses.asl20;
       homepage = http://subversion.apache.org/;
-      maintainers = with stdenv.lib.maintainers; [ eelco lovek323 ];
+      maintainers = with maintainers; [ eelco lovek323 ];
-      platforms = stdenv.lib.platforms.linux ++ stdenv.lib.platforms.darwin;
+      platforms = platforms.linux ++ platforms.darwin;
-      license = stdenv.lib.licenses.asl20;
     };
 
   } // stdenv.lib.optionalAttrs stdenv.isDarwin {

pkgs/applications/video/mpc-qt/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "mpc-qt-${version}";
-  version = "18.03";
+  version = "18.08";
 
   src = fetchFromGitHub {
     owner = "cmdrkotori";
     repo = "mpc-qt";
     rev = "v${version}";
-    sha256 = "0mhzdgjgv08cvnscbfndpr0s8ndbcf91b61zfqspa1qv4wlqd716";
+    sha256 = "1rxlkg3vsrapazdlb1i6c5a1vvf2114bsqwzcm3n2wc5c93yqsna";
   };
 
   nativeBuildInputs = [ pkgconfig qmake qttools ];

pkgs/applications/window-managers/dwm/dwm-status.nix

@@ -3,19 +3,19 @@
 
 rustPlatform.buildRustPackage rec {
   name = "dwm-status-${version}";
-  version = "1.1.1";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "Gerschtli";
     repo = "dwm-status";
     rev = version;
-    sha256 = "0k6r72qgns8i2y1ks0k9fwlabgndww5rssd13mis5bvkqla8j9i9";
+    sha256 = "1nyi0p9snx9hddb4hliihskj4gdp933xs0f8kydyiprckikwiyjk";
   };
 
   nativeBuildInputs = [ makeWrapper pkgconfig ];
   buildInputs = [ dbus gdk_pixbuf libnotify xorg.libX11 ];
 
-  cargoSha256 = "13ibcbk8shfajk200d8v2p6y3zfrz5dlvxqfw1zsm630s5dmy6qx";
+  cargoSha256 = "1ngdzzxnv4y6xprmkawf6s2696zgwiwgb6ykj5adb4knlx5c634d";
 
   postInstall = lib.optionalString enableAlsaUtils ''
     wrapProgram $out/bin/dwm-status \

pkgs/applications/window-managers/qtile/default.nix

@@ -7,13 +7,13 @@ in
 
 python27Packages.buildPythonApplication rec {
   name = "qtile-${version}";
-  version = "0.11.1";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "qtile";
     repo = "qtile";
     rev = "v${version}";
-    sha256 = "1jw6mh9m5yrijhm218lc51sc89lc2ihvyx30jhrkxy2mzllhjgrs";
+    sha256 = "0ynmmnh12mr3gwgz0j7l2hvm8c0y5gzsw80jszdkp4s5bh1q0nrj";
   };
 
   patches = [

pkgs/build-support/cc-wrapper/cc-wrapper.sh

@@ -126,7 +126,7 @@ fi
 
 if [[ "$isCpp" = 1 ]]; then
     if [[ "$cppInclude" = 1 ]]; then
-        NIX_@infixSalt@_CFLAGS_COMPILE+=" ${NIX_@infixSalt@_CXXSTDLIB_COMPILE-@default_cxx_stdlib_compile@}"
+        NIX_@infixSalt@_CFLAGS_COMPILE+=" ${NIX_@infixSalt@_CXXSTDLIB_COMPILE:-@default_cxx_stdlib_compile@}"
     fi
     NIX_@infixSalt@_CFLAGS_LINK+=" $NIX_@infixSalt@_CXXSTDLIB_LINK"
 fi

pkgs/build-support/release/functions.sh

@@ -1,7 +1,7 @@
 findTarball() {
     local suffix i
     if [ -d "$1/tarballs/" ]; then
-        for suffix in tar.gz tgz tar.bz2 tbz2 tar.xz tar.lzma; do
+        for suffix in tar.gz tgz tar.bz2 tbz2 tbz tar.xz txz tar.lzma; do
             for i in $1/tarballs/*.$suffix; do echo $i; break; done
         done | sort | head -1
         return

pkgs/data/misc/hackage/default.nix

@@ -1,6 +1,6 @@
 { fetchurl }:
 
 fetchurl {
-  url = "https://github.com/commercialhaskell/all-cabal-hashes/archive/92b4fe519b988dee70e2ef8f2f1d05edf610ba8a.tar.gz";
+  url = "https://github.com/commercialhaskell/all-cabal-hashes/archive/ed2029405786768b4c0f8bdbbd7aee8193394eb9.tar.gz";
-  sha256 = "15sh85v57k635q5ir8pwa605cchj12h4sflss8zd1xshy7ywi673";
+  sha256 = "0s6cbz7ylflpnqhxlpch48zb0l6xcp5501dj1qzvzldvwh46r8dc";
 }

pkgs/data/misc/iana-etc/default.nix

@@ -1,16 +1,16 @@
-{stdenv, fetchurl}:
+{ stdenv, fetchzip }:
 
-stdenv.mkDerivation rec {
+let
-  name = "iana-etc-${version}";
   version = "20180711";
+in fetchzip {
+  name = "iana-etc-${version}";
 
-  src = fetchurl {
+  url = "https://github.com/Mic92/iana-etc/releases/download/${version}/iana-etc-${version}.tar.gz";
-    url = "https://github.com/Mic92/iana-etc/releases/download/${version}/iana-etc-${version}.tar.gz";
+  sha256 = "0vbgk3paix2v4rlh90a8yh1l39s322awng06izqj44zcg704fjbj";
-    sha256 = "0xigkz6pcqx55px7fap7j6p3hz27agv056crbl5pgfcdix7y8z26";
-  };
 
-  installPhase = ''
+  postFetch = ''
-    install -D -t $out/etc services protocols
+    tar -xzvf $downloadedFile --strip-components=1
+    install -D -m0644 -t $out/etc services protocols
   '';
 
   meta = with stdenv.lib; {

pkgs/desktops/deepin/deepin-gtk-theme/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "deepin-gtk-theme-${version}";
-  version = "17.10.6";
+  version = "17.10.8";
 
   src = fetchFromGitHub {
     owner = "linuxdeepin";
     repo = "deepin-gtk-theme";
     rev = version;
-    sha256 = "01mfn3i234ynjvxl0yddsqqadwh6zmiibzrjm9xd1f78rj4xxkll";
+    sha256 = "1z5f5dnda18gixkjcxpvsavhv9m5l2kq61958fdfm1idi0cbr7fp";
   };
 
   propagatedUserEnvPkgs = [ gtk-engine-murrine ];

pkgs/desktops/gnome-3/core/gnome-software/default.nix

@@ -1,5 +1,5 @@
 { stdenv, fetchurl, substituteAll, pkgconfig, meson, ninja, gettext, gnome3, wrapGAppsHook, packagekit, ostree
-, glib, appstream-glib, libsoup, polkit, isocodes, gspell, libxslt, gobjectIntrospection, flatpak
+, glib, appstream-glib, libsoup, polkit, isocodes, gspell, libxslt, gobjectIntrospection, flatpak, fwupd
 , json-glib, libsecret, valgrind-light, docbook_xsl, docbook_xml_dtd_42, gtk-doc, desktop-file-utils }:
 
 stdenv.mkDerivation rec {
@@ -27,12 +27,11 @@ stdenv.mkDerivation rec {
     gnome3.gtk glib packagekit appstream-glib libsoup
     gnome3.gsettings-desktop-schemas gnome3.gnome-desktop
     gspell json-glib libsecret ostree
-    polkit flatpak
+    polkit flatpak fwupd
   ];
 
   mesonFlags = [
     "-Denable-rpm=false"
-    "-Denable-fwupd=false"
     "-Denable-oauth=false"
     "-Denable-ubuntu-reviews=false"
     "-Denable-gudev=false"

pkgs/desktops/mate/mate-screensaver/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "mate-screensaver-${version}";
-  version = "1.20.1";
+  version = "1.21.0";
 
   src = fetchurl {
     url = "http://pub.mate-desktop.org/releases/${mate.getRelease version}/${name}.tar.xz";
-    sha256 = "1mcr2915wymwjy55m2z0l6b9dszabbv0my0xxsa1fb8xkr4hk4qh";
+    sha256 = "1asfw2x0ha830ilkw97bjdqm2gnjbpb6dd7lb6h43aix7g3lgm7f";
   };
 
   nativeBuildInputs = [

pkgs/development/compilers/arachne-pnr/default.nix

@@ -4,13 +4,13 @@ with builtins;
 
 stdenv.mkDerivation rec {
   name = "arachne-pnr-${version}";
-  version = "2018.05.03";
+  version = "2018.05.13";
 
   src = fetchFromGitHub {
     owner  = "cseed";
     repo   = "arachne-pnr";
-    rev    = "ea2d04215bc0fd6072cda244caeb6670892033b3";
+    rev    = "5d830dd94ad956d17d77168fe7718f22f8b55b33";
-    sha256 = "0qhf5djyh0pzmgv33rjnnqq6asmmwxjdadvr18a83iy9pll6gg5k";
+    sha256 = "1i056m5zn21nml65q9x9mgks4ydl8lqya6a4szix01vn3k0g06vn";
   };
 
   enableParallelBuilding = true;

pkgs/development/compilers/graalvm/default.nix

@@ -49,7 +49,7 @@ let
     rec { sha1 = "396ce0c07ba2b481f25a70195c7c94922f0d1b0b"; name = "ASM_TREE5_${sha1}/asm-tree5.jar";                                                 url = mirror://maven/org/ow2/asm/asm-tree/5.0.4/asm-tree-5.0.4.jar; }
     rec { sha1 = "280c265b789e041c02e5c97815793dfc283fb1e6"; name = "LIBFFI_${sha1}/libffi.tar.gz";                                                    url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/libffi-3.2.1.tar.gz; }
     rec { sha1 = "8819cea8bfe22c9c63f55465e296b3855ea41786"; name = "TruffleJSON_${sha1}/trufflejson.jar";                                             url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/trufflejson-20180130.jar; }
-    rec { sha1 = "9712a8124c40298015f04a74f61b3d81a51513af"; name = "CHECKSTYLE_8.8_${sha1}/checkstyle-8.8.jar";                                       url = https://github.com/graalvm/mx/releases/download/checkstyle-8.8/checkstyle-8.8-all.jar; }
+    rec { sha1 = "9712a8124c40298015f04a74f61b3d81a51513af"; name = "CHECKSTYLE_8.8_${sha1}/checkstyle-8.8.jar";                                       url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/checkstyle-8.8-all.jar; }
   ];
 
   findbugs = fetchzip {

pkgs/development/compilers/kotlin/default.nix

@@ -1,14 +1,14 @@
 { stdenv, fetchurl, makeWrapper, jre, unzip }:
 
 let
-  version = "1.2.51";
+  version = "1.2.60";
 in stdenv.mkDerivation rec {
   inherit version;
   name = "kotlin-${version}";
 
   src = fetchurl {
     url = "https://github.com/JetBrains/kotlin/releases/download/v${version}/kotlin-compiler-${version}.zip";
-    sha256 = "0b7rlv4w3bqfxwp0sici8lraskavmx08qgf1jddjcgaxh0f72x4a";
+    sha256 = "0gb29a8ayj12g4g10dcasw3d3csphq5rv9jn9c6m02myr6azcygz";
   };
 
   propagatedBuildInputs = [ jre ] ;

pkgs/development/compilers/reason/default.nix

@@ -3,13 +3,13 @@
 
 buildOcaml rec {
   name = "reason";
-  version = "3.0.4";
+  version = "3.3.2";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "reason";
-    rev = version;
+    rev = "68a4124c772ee25c4729b005c8643851b1e17b92";
-    sha256 = "15qhx85him5rr4j0ygj3jh3qv9ijrn82ibr9scbn0qrnn43kj047";
+    sha256 = "01v17m94ds98qk727mwpyx0a362zdf9s8x1fh8gp9jd9v3n6bc2d";
   };
 
   propagatedBuildInputs = [ menhir merlin_extend ppx_tools_versioned ];
@@ -20,13 +20,11 @@ buildOcaml rec {
 
   createFindlibDestdir = true;
 
-  postPatch = ''
-    substituteInPlace src/reasonbuild/myocamlbuild.ml \
-      --replace "refmt --print binary" "$out/bin/refmt --print binary"
-  '';
-
   installPhase = ''
-    ${jbuilder.installPhase}
+    for p in reason rtop
+    do
+      ${jbuilder.installPhase} $p.install
+    done
 
     wrapProgram $out/bin/rtop \
       --prefix PATH : "${utop}/bin" \
@@ -36,7 +34,7 @@ buildOcaml rec {
   meta = with stdenv.lib; {
     homepage = https://reasonml.github.io/;
     description = "Facebook's friendly syntax to OCaml";
-    license = licenses.bsd3;
+    license = licenses.mit;
     maintainers = [ maintainers.volth ];
   };
 }

pkgs/development/compilers/yosys/default.nix

@@ -1,19 +1,21 @@
 { stdenv, fetchFromGitHub
-, pkgconfig, tcl, readline, libffi, python3, bison, flex
+, pkgconfig, bison, flex
+, tcl, readline, libffi, python3
+, protobuf
 }:
 
 with builtins;
 
 stdenv.mkDerivation rec {
   name = "yosys-${version}";
-  version = "2018.05.03";
+  version = "2018.08.08";
 
   srcs = [
     (fetchFromGitHub {
       owner  = "yosyshq";
       repo   = "yosys";
-      rev    = "a572b495387743a58111e7264917a497faa17ebf";
+      rev    = "93efbd5d158e374a0abe2afb06484ccc14aa2c88";
-      sha256 = "0q4xh4sy3n83c8il8lygzv0i6ca4qw36i2k6qz6giw0wd2pkibkb";
+      sha256 = "13y7rzpykihal789hyibg629gwj5bh1s0782y5xxj6jlg0bc9ly8";
       name   = "yosys";
     })
 
@@ -23,8 +25,8 @@ stdenv.mkDerivation rec {
     (fetchFromGitHub {
       owner  = "berkeley-abc";
       repo   = "abc";
-      rev    = "f23ea8e33f6d5cc54f58bec6d9200483e5d8c704";
+      rev    = "ae6716b064c842f45109a88e84dca71fe4cc311f";
-      sha256 = "1xwmq3k5hfavdrs7zbqjxh35kr2pis4i6hhzrq7qzyzs0az0hls9";
+      sha256 = "0g39k16dmrl6q73q39yr5yd9r4rcliz5zxzbnwzh29z9xwi6ipw8";
       name   = "yosys-abc";
     })
   ];
@@ -32,7 +34,9 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ tcl readline libffi python3 bison flex ];
+  buildInputs = [ tcl readline libffi python3 bison flex protobuf ];
+
+  makeFlags = [ "ENABLE_PROTOBUF=1" ];
 
   patchPhase = ''
     substituteInPlace ../yosys-abc/Makefile \
@@ -49,6 +53,9 @@ stdenv.mkDerivation rec {
     make config-${if stdenv.cc.isClang or false then "clang" else "gcc"}
     echo 'ABCREV := default' >> Makefile.conf
     makeFlags="PREFIX=$out $makeFlags"
+
+    # we have to do this ourselves for some reason...
+    (cd misc && ${protobuf}/bin/protoc --cpp_out ../backends/protobuf/ ./yosys.proto)
   '';
 
   meta = {

pkgs/development/haskell-modules/configuration-common.nix

@@ -601,19 +601,7 @@ self: super: {
   # Install icons, metadata and cli program.
   bustle = overrideCabal super.bustle (drv: {
     buildDepends = [ pkgs.libpcap ];
-    buildTools = with pkgs.buildPackages; [ gettext perl help2man intltool ];
+    buildTools = with pkgs.buildPackages; [ gettext perl help2man ];
-    patches = [
-      # Add missing gio-unix-2.0 dependency
-      (pkgs.fetchpatch {
-        url = https://github.com/wjt/bustle/commit/bcc3d56d367635c0dfdb4eab0d1265829aba6400.patch;
-        sha256 = "1ybviivfbs5janiyw01ww365vxckni6fk0j10609clxk4na2nvb9";
-      })
-      # No instance for (Semigroup Marquee)
-      (pkgs.fetchpatch {
-        url = https://github.com/wjt/bustle/commit/95393cb17c2fe5f0903470a449e36728471759eb.patch;
-        sha256 = "1n7h1rh62731kg9jjs2mn49nx033ds0l33mpgfl75hrjqblz44m1";
-      })
-    ];
     postInstall = ''
       make install PREFIX=$out
     '';
@@ -1072,9 +1060,6 @@ self: super: {
   # https://github.com/haskell-servant/servant-auth/issues/113
   servant-auth-client = dontCheck super.servant-auth-client;
 
-  # Over-specified constraint on X11 ==1.8.*.
-  xmonad = doJailbreak super.xmonad;
-
   # Test has either build errors or fails anyway, depending on the compiler.
   vector-algorithms = dontCheck super.vector-algorithms;
 

pkgs/development/haskell-modules/configuration-ghc-8.4.x.nix

@@ -42,19 +42,6 @@ self: super: {
   # https://github.com/jcristovao/enclosed-exceptions/issues/12
   enclosed-exceptions = dontCheck super.enclosed-exceptions;
 
-  # https://github.com/xmonad/xmonad/issues/155
-  xmonad = addBuildDepend (appendPatch super.xmonad (pkgs.fetchpatch {
-    url = https://github.com/xmonad/xmonad/pull/153/commits/c96a59fa0de2f674e60befd0f57e67b93ea7dcf6.patch;
-    sha256 = "1mj3k0w8aqyy71kmc71vzhgxmr4h6i5b3sykwflzays50grjm5jp";
-  })) self.semigroups;
-
-  # https://github.com/xmonad/xmonad-contrib/issues/235
-  xmonad-contrib = doJailbreak (appendPatch super.xmonad-contrib ./patches/xmonad-contrib-ghc-8.4.1-fix.patch);
-
-  # Our xmonad claims that it's version 0.14, which is outside of this
-  # package's version constraints.
-  xmonad-extras = doJailbreak super.xmonad-extras;
-
   # https://github.com/jaor/xmobar/issues/356
   xmobar = super.xmobar.overrideScope (self: super: { hinotify = self.hinotify_0_3_9; });
   hinotify_0_3_9 = dontCheck (doJailbreak super.hinotify_0_3_9); # allow async 2.2.x

pkgs/development/haskell-modules/generic-builder.nix

@@ -112,12 +112,10 @@ let
                      main = defaultMain
                    '';
 
-  hasActiveLibrary = isLibrary && (enableStaticLibraries || enableSharedLibraries || enableLibraryProfiling);
-
   # We cannot enable -j<n> parallelism for libraries because GHC is far more
   # likely to generate a non-determistic library ID in that case. Further
   # details are at <https://github.com/peti/ghc-library-id-bug>.
-  enableParallelBuilding = (versionOlder "7.8" ghc.version && !hasActiveLibrary) || versionOlder "8.0.1" ghc.version;
+  enableParallelBuilding = (versionOlder "7.8" ghc.version && !isLibrary) || versionOlder "8.0.1" ghc.version;
 
   crossCabalFlags = [
     "--with-ghc=${ghc.targetPrefix}ghc"
@@ -237,8 +235,8 @@ stdenv.mkDerivation ({
   inherit src;
 
   inherit depsBuildBuild nativeBuildInputs;
-  buildInputs = otherBuildInputs ++ optionals (!hasActiveLibrary) propagatedBuildInputs;
+  buildInputs = otherBuildInputs ++ optionals (!isLibrary) propagatedBuildInputs;
-  propagatedBuildInputs = optionals hasActiveLibrary propagatedBuildInputs;
+  propagatedBuildInputs = optionals isLibrary propagatedBuildInputs;
 
   LANG = "en_US.UTF-8";         # GHC needs the locale configured during the Haddock phase.
 
@@ -256,7 +254,7 @@ stdenv.mkDerivation ({
     runHook preSetupCompilerEnvironment
 
     echo "Build with ${ghc}."
-    ${optionalString (hasActiveLibrary && hyperlinkSource) "export PATH=${hscolour}/bin:$PATH"}
+    ${optionalString (isLibrary && hyperlinkSource) "export PATH=${hscolour}/bin:$PATH"}
 
     setupPackageConfDir="$TMPDIR/setup-package.conf.d"
     mkdir -p $setupPackageConfDir
@@ -369,10 +367,10 @@ stdenv.mkDerivation ({
 
   haddockPhase = ''
     runHook preHaddock
-    ${optionalString (doHaddock && hasActiveLibrary) ''
+    ${optionalString (doHaddock && isLibrary) ''
       ${setupCommand} haddock --html \
         ${optionalString doHoogle "--hoogle"} \
-        ${optionalString (hasActiveLibrary && hyperlinkSource) "--hyperlink-source"}
+        ${optionalString (isLibrary && hyperlinkSource) "--hyperlink-source"}
     ''}
     runHook postHaddock
   '';
@@ -380,7 +378,7 @@ stdenv.mkDerivation ({
   installPhase = ''
     runHook preInstall
 
-    ${if !hasActiveLibrary then "${setupCommand} install" else ''
+    ${if !isLibrary then "${setupCommand} install" else ''
       ${setupCommand} copy
       local packageConfDir="$out/lib/${ghc.name}/package.conf.d"
       local packageConfFile="$packageConfDir/${pname}-${version}.conf"
@@ -431,7 +429,7 @@ stdenv.mkDerivation ({
 
     compiler = ghc;
 
-    isHaskellLibrary = hasActiveLibrary;
+    isHaskellLibrary = isLibrary;
 
     # TODO: ask why the split outputs are configurable at all?
     # TODO: include tests for split if possible

pkgs/development/interpreters/duktape/default.nix

@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   name = "duktape-${version}";
-  version = "2.2.1";
+  version = "2.3.0";
   src = fetchurl {
     url = "http://duktape.org/duktape-${version}.tar.xz";
-    sha256 = "1wp7mpkhizknq72ivdbkzps4radi1daqzjcjp1i54c2k4pnjxgis";
+    sha256 = "1s5g8lg0dga6x3rcq328a6hsd2sk2vzwq9zfmskjh5h6n8x2yvpd";
   };
 
   buildPhase = ''

pkgs/development/interpreters/elixir/1.7.nix

@@ -1,7 +1,7 @@
 { mkDerivation }:
 
 mkDerivation rec {
-  version = "1.7.0";
+  version = "1.7.2";
-  sha256 = "082924fngc6ypbkn1ghdwf199radk00daf4q09mm04h81jy4nmxm";
+  sha256 = "0wnrx6wlpmr23ypm8za0c4dl952nj4rjylcsdzz0xrma92ylrqfq";
   minimumOTPVersion = "18";
 }

pkgs/development/interpreters/joker/default.nix

@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "joker-${version}";
-  version = "0.9.4";
+  version = "0.9.5";
 
   goPackagePath = "github.com/candid82/joker";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     rev = "v${version}";
     owner = "candid82";
     repo = "joker";
-    sha256 = "15q9w93yjc5zl9z45mkcfizgz5r3mzbkah0ng0hdxf0qqy6b09w8";
+    sha256 = "1sgxz0z6p92k1rhs5095l952a2db5w9yb2jy6cgglxw2arihxxb7";
   };
 
   preBuild = "go generate ./...";

pkgs/development/libraries/agda/agda-stdlib/default.nix

@@ -1,14 +1,14 @@
 { stdenv, agda, fetchFromGitHub, ghcWithPackages }:
 
 agda.mkDerivation (self: rec {
-  version = "0.15";
+  version = "0.16";
   name = "agda-stdlib-${version}";
 
   src = fetchFromGitHub {
     repo = "agda-stdlib";
     owner = "agda";
     rev = "v${version}";
-    sha256 = "0c2vfib4fmljy98c3s3s7jmpjlqxvsbv7wf6qxr38kamwzbryrjj";
+    sha256 = "0kqfx6742vbyyr8glqm5bkvj0z0y0dkaajlw10p3pzidrc17767r";
   };
 
   nativeBuildInputs = [ (ghcWithPackages (self : [ self.filemanip ])) ];

pkgs/development/libraries/arb/default.nix

@@ -2,12 +2,12 @@
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "arb";
-  version = "2.13.0";
+  version = "2.14.0";
   src = fetchFromGitHub {
     owner = "fredrik-johansson";
     repo = "${pname}";
     rev = "${version}";
-    sha256 = "1fl9gmxf6c1cphk5r8jbys5pywj2rfm705kv0055i0aqc6hrv303";
+    sha256 = "1ndxg7h4xvccjgp5l9z2f8b66dsff6fhf86bn5n7f75a1ksd7554";
   };
   buildInputs = [mpir gmp mpfr flint];
   configureFlags = [
@@ -17,19 +17,11 @@ stdenv.mkDerivation rec {
     "--with-flint=${flint}"
   ];
   doCheck = true;
-  patches = [
+  meta = with stdenv.lib; {
-    # https://github.com/fredrik-johansson/arb/pull/210, included in next release
-    (fetchpatch {
-      url = "https://patch-diff.githubusercontent.com/raw/fredrik-johansson/arb/pull/210.patch";
-      name = "return-exact-zero-where-possible.patch";
-      sha256 = "01j9npnpmwh4dla9i05qdn606hy34gy9bz7c9bbsqm7az3n7pxjg";
-    })
-  ];
-  meta = {
     inherit version;
     description = ''A library for arbitrary-precision interval arithmetic'';
     license = stdenv.lib.licenses.lgpl21Plus;
-    maintainers = [stdenv.lib.maintainers.raskin];
+    maintainers = with maintainers; [ raskin timokau ];
     platforms = stdenv.lib.platforms.linux;
   };
 }

pkgs/development/libraries/babl/default.nix

@@ -1,11 +1,11 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "babl-0.1.52";
+  name = "babl-0.1.54";
 
   src = fetchurl {
     url = "https://ftp.gtk.org/pub/babl/0.1/${name}.tar.bz2";
-    sha256 = "0v7pkr3qd5jnn0pra88d90ixkl5h9ngg6w660nn1cgh4zjh19xs0";
+    sha256 = "01rad0sf9bkg7124qz5zdn08nl1q00yy5lg6ca3v053jblsg2asd";
   };
 
   doCheck = true;

pkgs/development/libraries/cutelyst/default.nix

@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   name = "cutelyst-${version}";
-  version = "2.4.1";
+  version = "2.5.1";
 
   src = fetchFromGitHub {
     owner = "cutelyst";
     repo = "cutelyst";
     rev = "v${version}";
-    sha256 = "1kfapd5dkyw02g3j4gshxl16b90xdf5vgfhqrkdzix072f7hy5sl";
+    sha256 = "0iamavr5gj213c8knrh2mynhn8wcrv83x6s46jq93x93kc5127ks";
   };
 
   nativeBuildInputs = [ cmake pkgconfig makeWrapper ];

pkgs/development/libraries/fastjson/default.nix

@@ -1,13 +1,13 @@
 { stdenv, fetchFromGitHub, libtool, autoconf, automake }:
 
 stdenv.mkDerivation rec {
-  version = "0.99.4";
+  version = "0.99.8";
   name = "fastjson-${version}";
   src = fetchFromGitHub {
     repo = "libfastjson";
     owner = "rsyslog";
-    rev = "6e057a094cb225c9d80d8d6e6b1f36ca88a942dd";
+    rev = "v${version}";
-    sha256 = "1pn207p9zns0aqm6z5l5fdgb94wyyhaw83lyvyfdxmai74nbqs65";
+    sha256 = "0qhs0g9slj3p0v2z4s3cnsx44msrlb4k78ljg7714qiziqbrbwyl";
   };
 
   buildInputs = [ autoconf automake libtool ];

pkgs/development/libraries/gdal/default.nix

@@ -1,6 +1,6 @@
 { stdenv, fetchurl, fetchpatch, unzip, libjpeg, libtiff, zlib
 , postgresql, mysql, libgeotiff, pythonPackages, proj, geos, openssl
-, libpng, sqlite, libspatialite, poppler, hdf4
+, libpng, sqlite, libspatialite, poppler, hdf4, qhull, giflib
 , libiconv
 , netcdfSupport ? true, netcdf, hdf5 , curl
 }:
@@ -8,26 +8,16 @@
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
-  version = "2.3.0";
   name = "gdal-${version}";
+  version = "2.3.1";
 
   src = fetchurl {
     url = "https://download.osgeo.org/gdal/${version}/${name}.tar.xz";
-    sha256 = "18iaamzkn0lipizynvspf3bs5qzgcy36hn6bbi941q8dlfdf8xbg";
+    sha256 = "0nkjnznrp7dr41zsh8j923c9zpc3i5vj3wjfc2df9rrybb22ailw";
   };
 
-  patches = [
-    # fix build with recent Poppler
-    (fetchpatch {
-      url    = "https://github.com/OSGeo/gdal/commit/124f0343436d1267319ac627fc220530091b41ea.diff";
-      stripLen = 2;
-      extraPrefix = "";
-      sha256 = "1v6iiy4cgrdcfas3iva5swh9446pqfjh5p6bcab6y49hyjhpsgfy";
-    })
-  ];
-
   buildInputs = [ unzip libjpeg libtiff libpng proj openssl sqlite
-    libspatialite poppler hdf4 ]
+    libspatialite poppler hdf4 qhull giflib ]
   ++ (with pythonPackages; [ python numpy wrapPython ])
   ++ stdenv.lib.optional stdenv.isDarwin libiconv
   ++ stdenv.lib.optionals netcdfSupport [ netcdf hdf5 curl ];
@@ -44,7 +34,7 @@ stdenv.mkDerivation rec {
     "--with-sqlite3=${sqlite.dev}"
     "--with-spatialite=${libspatialite}"
     "--with-python"               # optional
-    "--with-static-proj4=${proj}" # optional
+    "--with-proj=${proj}" # optional
     "--with-geos=${geos}/bin/geos-config"# optional
     "--with-hdf4=${hdf4.dev}" # optional
     (if netcdfSupport then "--with-netcdf=${netcdf}" else "")

pkgs/development/libraries/gdal/gdal-1_11.nix

@@ -3,12 +3,12 @@
 , libpng }:
 
 stdenv.mkDerivation rec {
-  version = "1.11.3";
   name = "gdal-${version}";
+  version = "1.11.5";
 
   src = fetchurl {
-    url = "https://download.osgeo.org/gdal/${version}/${name}.tar.gz";
+    url = "https://download.osgeo.org/gdal/${version}/${name}.tar.xz";
-    sha256 = "561588bdfd9ca91919d4679a77a2b44214b158934ee8b425295ca5be33a1014d";
+    sha256 = "0hphxzvy23v3vqxx1y22hhhg4cypihrb8555y12nb4mrhzlw7zfl";
   };
 
   buildInputs = [ unzip libjpeg libtiff libpng python pythonPackages.numpy proj openssl ];
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     ./python.patch
   ];
 
-  hardeningDisable = [ "format" ];
+  hardeningDisable = [ "format" "fortify" ];
 
   # Don't use optimization for gcc >= 4.3. That's said to be causing segfaults.
   # Unset CC and CXX as they confuse libtool.
@@ -51,6 +51,8 @@ stdenv.mkDerivation rec {
     export PYTHONPATH=''${PYTHONPATH:+''${PYTHONPATH}:}$pythonInstallDir
   '';
 
+  enableParallelBuilding = true;
+
   meta = {
     description = "Translator library for raster geospatial data formats";
     homepage = http://www.gdal.org/;

pkgs/development/libraries/glib/default.nix

@@ -3,9 +3,10 @@
 # use utillinuxMinimal to avoid circular dependency (utillinux, systemd, glib)
 , utillinuxMinimal ? null
 
-# this is just for tests (not in closure of any regular package)
+# this is just for tests (not in the closure of any regular package)
-, coreutils, dbus, libxml2, tzdata, desktop-file-utils
+, doCheck ? stdenv.config.doCheckByDefault or false
-, shared-mime-info, doCheck ? false
+, coreutils, dbus, libxml2, tzdata
+, desktop-file-utils, shared-mime-info
 }:
 
 with stdenv.lib;
@@ -66,8 +67,7 @@ stdenv.mkDerivation rec {
   setupHook = ./setup-hook.sh;
 
   buildInputs = [ libelf setupHook pcre ]
-    ++ optionals stdenv.isLinux [ utillinuxMinimal ] # for libmount
+    ++ optionals stdenv.isLinux [ utillinuxMinimal ]; # for libmount
-    ++ optionals doCheck [ tzdata libxml2 desktop-file-utils shared-mime-info ];
 
   nativeBuildInputs = [ pkgconfig perl python gettext ];
 
@@ -114,7 +114,8 @@ stdenv.mkDerivation rec {
       -i "$dev"/include/glib-2.0/gobject/gobjectnotifyqueue.c
   '';
 
-  inherit doCheck;
+  checkInputs = [ tzdata libxml2 desktop-file-utils shared-mime-info ];
+
   preCheck = optionalString doCheck ''
     export LD_LIBRARY_PATH="$NIX_BUILD_TOP/${name}/glib/.libs:$LD_LIBRARY_PATH"
     export TZDIR="${tzdata}/share/zoneinfo"
@@ -139,6 +140,8 @@ stdenv.mkDerivation rec {
     sed -e '/g_subprocess_launcher_set_environ (launcher, envp);/a g_subprocess_launcher_setenv (launcher, "PATH", g_getenv("PATH"), TRUE);' -i gio/tests/gsubprocess.c
   '';
 
+  inherit doCheck;
+
   passthru = {
     gioModuleDir = "lib/gio/modules";
     inherit flattenInclude;

pkgs/development/libraries/keybinder/default.nix

@@ -1,9 +1,9 @@
 { stdenv, fetchurl, autoconf, automake, libtool, pkgconfig, gnome3
-, gtk-doc, gtk2, python2Packages, lua, libX11, libXext, libXrender, gobjectIntrospection
+, gtk-doc, gtk2, python2Packages, lua, gobjectIntrospection
 }:
 
 let
-  inherit (python2Packages) python pygobject3 pygtk;
+  inherit (python2Packages) python pygtk;
 in stdenv.mkDerivation rec {
   name = "keybinder-${version}";
   version = "0.3.0";
@@ -16,8 +16,8 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    autoconf automake libtool gnome3.gnome-common gtk-doc gnome3.gtk3
+    autoconf automake libtool gnome3.gnome-common gtk-doc gtk2
-    python pygobject3 pygtk lua libX11 libXext libXrender gobjectIntrospection gtk2
+    python pygtk lua gobjectIntrospection
   ];
 
   preConfigure = ''

pkgs/development/libraries/libbytesize/default.nix

@@ -4,7 +4,7 @@
 }:
 
 let
-  version = "1.3";
+  version = "1.4";
 in stdenv.mkDerivation rec {
   name = "libbytesize-${version}";
 
@@ -12,7 +12,7 @@ in stdenv.mkDerivation rec {
     owner = "storaged-project";
     repo = "libbytesize";
     rev = version;
-    sha256 = "1ys5d8rya8x4q34gn1hr96z7797s9gdzah0y0d7g84x5x6k50p30";
+    sha256 = "1yxlc0f960rhqmh3fs3p0hvw0y2cikplgc27zsz6rn4h5dlrfmi2";
   };
 
   outputs = [ "out" "dev" "devdoc" ];

pkgs/development/libraries/liblognorm/default.nix

@@ -1,16 +1,16 @@
-{ stdenv, fetchurl, pkgconfig, libestr, json_c, pcre }:
+{ stdenv, fetchurl, pkgconfig, libestr, json_c, pcre, fastJson }:
 
 stdenv.mkDerivation rec {
-  name = "liblognorm-1.1.2";
+  name = "liblognorm-2.0.5";
-  
+
   src = fetchurl {
     url = "http://www.liblognorm.com/files/download/${name}.tar.gz";
-    sha256 = "0v2k5awr6vsbp36gybrys3zfkl675sywhsh4lnm7f21inlpi2nlk";
+    sha256 = "145i1lrl2n145189i7l2a62yazjg9rkyma5jic41y0r17fl1s5f8";
   };
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ libestr json_c pcre ];
+  buildInputs = [ libestr json_c pcre fastJson ];
-  
+
   configureFlags = [ "--enable-regexp" ];
 
   meta = with stdenv.lib; {

pkgs/development/libraries/libressl/default.nix

@@ -43,4 +43,9 @@ in {
     version = "2.7.4";
     sha256 = "19kxa5i97q7p6rrps9qm0nd8zqhdjvzx02j72400c73cl2nryfhy";
   };
+
+  libressl_2_8 = generic {
+    version = "2.8.0";
+    sha256 = "1hwxg14d6a9wgk360dvi0wfzw7b327a95wf6xqc3a1h6bfbblaxg";
+  };
 }