Merge branch 'master' into update-cryptsetup

2018-08-22 10:32:01 +03:00 · 2018-08-22 10:32:01 +03:00 · b691bf4629
commit b691bf4629
parent bf453ad4e5 61c0adfbc1
332 changed files with 11347 additions and 17865 deletions
--- a/lib/customisation.nix
+++ b/lib/customisation.nix
@ -195,9 +195,10 @@ rec {
    let self = f self // {
          newScope = scope: newScope (self // scope);
          callPackage = self.newScope {};
+          # TODO(@Ericson2314): Haromonize argument order of `g` with everything else
          overrideScope = g:
            makeScope newScope
-            (self_: let super = f self_; in super // g super self_);
+            (lib.fixedPoints.extends (lib.flip g) f);
          packages = f;
        };
    in self;
--- a/lib/default.nix
+++ b/lib/default.nix
@ -80,7 +80,7 @@ let
    inherit (strings) concatStrings concatMapStrings concatImapStrings
      intersperse concatStringsSep concatMapStringsSep
      concatImapStringsSep makeSearchPath makeSearchPathOutput
-      makeLibraryPath makeBinPath makePerlPath optionalString
+      makeLibraryPath makeBinPath makePerlPath makeFullPerlPath optionalString
      hasPrefix hasSuffix stringToCharacters stringAsChars escape
      escapeShellArg escapeShellArgs replaceChars lowerChars
      upperChars toLower toUpper addContextFrom splitString
--- a/lib/strings.nix
+++ b/lib/strings.nix
@ -126,6 +126,15 @@ rec {
  */
  makePerlPath = makeSearchPathOutput "lib" "lib/perl5/site_perl";

+  /* Construct a perl search path recursively including all dependencies (such as $PERL5LIB)
+
+     Example:
+       pkgs = import <nixpkgs> { }
+       makeFullPerlPath [ pkgs.perlPackages.CGI ]
+       => "/nix/store/fddivfrdc1xql02h9q500fpnqy12c74n-perl-CGI-4.38/lib/perl5/site_perl:/nix/store/8hsvdalmsxqkjg0c5ifigpf31vc4vsy2-perl-HTML-Parser-3.72/lib/perl5/site_perl:/nix/store/zhc7wh0xl8hz3y3f71nhlw1559iyvzld-perl-HTML-Tagset-3.20/lib/perl5/site_perl"
+  */
+  makeFullPerlPath = deps: makePerlPath (lib.misc.closePropagation deps);
+
  /* Depending on the boolean `cond', return either the given string
     or the empty string. Useful to concatenate against a bigger string.

--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -673,6 +673,11 @@
    github = "changlinli";
    name = "Changlin Li";
  };
+  CharlesHD = {
+    email = "charleshdespointes@gmail.com";
+    github = "CharlesHD";
+    name = "Charles Huyghues-Despointes";
+  };
  chaoflow = {
    email = "flo@chaoflow.net";
    github = "chaoflow";
--- a/nixos/doc/manual/installation/installing.xml
+++ b/nixos/doc/manual/installation/installing.xml
@ -326,10 +326,9 @@ Retype new UNIX password: ***
    </screen>
    <note>
     <para>
-      To prevent the password prompt, set
-      <code><xref linkend="opt-users.mutableUsers"/> = false;</code> in
-      <filename>configuration.nix</filename>, which allows unattended
-      installation necessary in automation.
+      For unattended installations, it is possible to use
+      <command>nixos-install --no-root-passwd</command>
+      in order to disable the password prompt entirely.
     </para>
    </note>
   </para>
--- a/nixos/lib/make-ext4-fs.nix
+++ b/nixos/lib/make-ext4-fs.nix
@ -6,16 +6,19 @@
 , storePaths
 , volumeLabel
 , uuid ? "44444444-4444-4444-8888-888888888888"
+, e2fsprogs
+, libfaketime
+, perl
 }:

 let
-  sdClosureInfo = pkgs.closureInfo { rootPaths = storePaths; };
+  sdClosureInfo = pkgs.buildPackages.closureInfo { rootPaths = storePaths; };
 in

 pkgs.stdenv.mkDerivation {
  name = "ext4-fs.img";

-  nativeBuildInputs = with pkgs; [e2fsprogs.bin libfaketime perl];
+  nativeBuildInputs = [e2fsprogs.bin libfaketime perl];

  buildCommand =
    ''
--- a/nixos/modules/installer/cd-dvd/sd-image.nix
+++ b/nixos/modules/installer/cd-dvd/sd-image.nix
@ -12,13 +12,12 @@
 with lib;

 let
-  rootfsImage = import ../../../lib/make-ext4-fs.nix {
-    inherit pkgs;
+  rootfsImage = pkgs.callPackage ../../../lib/make-ext4-fs.nix ({
    inherit (config.sdImage) storePaths;
    volumeLabel = "NIXOS_SD";
  } // optionalAttrs (config.sdImage.rootPartitionUUID != null) {
    uuid = config.sdImage.rootPartitionUUID;
-  };
+  });
 in
 {
  options.sdImage = {
@ -94,10 +93,10 @@ in

    sdImage.storePaths = [ config.system.build.toplevel ];

-    system.build.sdImage = pkgs.stdenv.mkDerivation {
+    system.build.sdImage = pkgs.callPackage ({ stdenv, dosfstools, e2fsprogs, mtools, libfaketime, utillinux }: stdenv.mkDerivation {
      name = config.sdImage.imageName;

-      buildInputs = with pkgs; [ dosfstools e2fsprogs mtools libfaketime utillinux ];
+      nativeBuildInputs = [ dosfstools e2fsprogs mtools libfaketime utillinux ];

      buildCommand = ''
        mkdir -p $out/nix-support $out/sd-image
@ -138,7 +137,7 @@ in
        (cd boot; mcopy -bpsvm -i ../bootpart.img ./* ::)
        dd conv=notrunc if=bootpart.img of=$img seek=$START count=$SECTORS
      '';
-    };
+    }) {};

    boot.postBootCommands = ''
      # On the first boot do some maintenance tasks
--- a/nixos/modules/installer/netboot/netboot.nix
+++ b/nixos/modules/installer/netboot/netboot.nix
@ -28,7 +28,6 @@ with lib;
      ++ (if pkgs.stdenv.system == "aarch64-linux"
          then []
          else [ pkgs.grub2 pkgs.syslinux ]);
-    system.boot.loader.kernelFile = pkgs.stdenv.platform.kernelTarget;

    fileSystems."/" =
      { fsType = "tmpfs";
@ -86,7 +85,7 @@ with lib;

    system.build.netbootIpxeScript = pkgs.writeTextDir "netboot.ipxe" ''
      #!ipxe
-      kernel ${pkgs.stdenv.platform.kernelTarget} init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams}
+      kernel ${pkgs.stdenv.hostPlatform.platform.kernelTarget} init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams}
      initrd initrd
      boot
    '';
--- a/nixos/modules/services/games/terraria.nix
+++ b/nixos/modules/services/games/terraria.nix
@ -18,6 +18,16 @@ let
    (boolFlag "secure" cfg.secure)
    (boolFlag "noupnp" cfg.noUPnP)
  ];
+  stopScript = pkgs.writeScript "terraria-stop" ''
+    #!${pkgs.runtimeShell}
+
+    if ! [ -d "/proc/$1" ]; then
+      exit 0
+    fi
+
+    ${getBin pkgs.tmux}/bin/tmux -S /var/lib/terraria/terraria.sock send-keys Enter exit Enter
+    ${getBin pkgs.coreutils}/bin/tail --pid="$1" -f /dev/null
+  '';
 in
 {
  options = {
@ -124,10 +134,10 @@ in

      serviceConfig = {
        User    = "terraria";
-        Type = "oneshot";
-        RemainAfterExit = true;
+        Type = "forking";
+        GuessMainPID = true;
        ExecStart = "${getBin pkgs.tmux}/bin/tmux -S /var/lib/terraria/terraria.sock new -d ${pkgs.terraria-server}/bin/TerrariaServer ${concatStringsSep " " flags}";
-        ExecStop = "${getBin pkgs.tmux}/bin/tmux -S /var/lib/terraria/terraria.sock send-keys Enter \"exit\" Enter";
+        ExecStop = "${stopScript} $MAINPID";
      };

      postStart = ''
--- a/nixos/modules/services/misc/redmine.nix
+++ b/nixos/modules/services/misc/redmine.nix
@ -1,121 +1,124 @@
 { config, lib, pkgs, ... }:

-# TODO: support non-postgresql
-
 with lib;

 let
  cfg = config.services.redmine;

-  ruby = pkgs.ruby;
+  bundle = "${pkgs.redmine}/share/redmine/bin/bundle";

-  databaseYml = ''
+  databaseYml = pkgs.writeText "database.yml" ''
    production:
-      adapter: postgresql
-      database: ${cfg.databaseName}
-      host: ${cfg.databaseHost}
-      password: ${cfg.databasePassword}
-      username: ${cfg.databaseUsername}
-      encoding: utf8
+      adapter: ${cfg.database.type}
+      database: ${cfg.database.name}
+      host: ${cfg.database.host}
+      port: ${toString cfg.database.port}
+      username: ${cfg.database.user}
+      password: #dbpass#
  '';

-  configurationYml = ''
+  configurationYml = pkgs.writeText "configuration.yml" ''
    default:
-      # Absolute path to the directory where attachments are stored.
-      # The default is the 'files' directory in your Redmine instance.
-      # Your Redmine instance needs to have write permission on this
-      # directory.
-      # Examples:
-      # attachments_storage_path: /var/redmine/files
-      # attachments_storage_path: D:/redmine/files
-      attachments_storage_path: ${cfg.stateDir}/files
+      scm_subversion_command: ${pkgs.subversion}/bin/svn
+      scm_mercurial_command: ${pkgs.mercurial}/bin/hg
+      scm_git_command: ${pkgs.gitAndTools.git}/bin/git
+      scm_cvs_command: ${pkgs.cvs}/bin/cvs
+      scm_bazaar_command: ${pkgs.bazaar}/bin/bzr
+      scm_darcs_command: ${pkgs.darcs}/bin/darcs

-      # Absolute path to the SCM commands errors (stderr) log file.
-      # The default is to log in the 'log' directory of your Redmine instance.
-      # Example:
-      # scm_stderr_log_file: /var/log/redmine_scm_stderr.log
-      scm_stderr_log_file: ${cfg.stateDir}/redmine_scm_stderr.log
-
-      ${cfg.extraConfig}
+    ${cfg.extraConfig}
  '';

-  unpackTheme = unpack "theme";
-  unpackPlugin = unpack "plugin";
-  unpack = id: (name: source:
-    pkgs.stdenv.mkDerivation {
-      name = "redmine-${id}-${name}";
-      buildInputs = [ pkgs.unzip ];
-      buildCommand = ''
-        mkdir -p $out
-        cd $out
-        unpackFile ${source}
-      '';
-    });
-
-in {
+in

+{
  options = {
    services.redmine = {
      enable = mkOption {
        type = types.bool;
        default = false;
-        description = ''
-          Enable the redmine service.
-        '';
+        description = "Enable the Redmine service.";
+      };
+
+      user = mkOption {
+        type = types.str;
+        default = "redmine";
+        description = "User under which Redmine is ran.";
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "redmine";
+        description = "Group under which Redmine is ran.";
      };

      stateDir = mkOption {
        type = types.str;
-        default = "/var/redmine";
-        description = "The state directory, logs and plugins are stored here";
+        default = "/var/lib/redmine";
+        description = "The state directory, logs and plugins are stored here.";
      };

      extraConfig = mkOption {
        type = types.lines;
        default = "";
-        description = "Extra configuration in configuration.yml";
+        description = ''
+          Extra configuration in configuration.yml.
+
+          See https://guides.rubyonrails.org/action_mailer_basics.html#action-mailer-configuration
+        '';
      };

-      themes = mkOption {
-        type = types.attrsOf types.path;
-        default = {};
-        description = "Set of themes";
-      };
+      database = {
+        type = mkOption {
+          type = types.enum [ "mysql2" "postgresql" ];
+          example = "postgresql";
+          default = "mysql2";
+          description = "Database engine to use.";
+        };

-      plugins = mkOption {
-        type = types.attrsOf types.path;
-        default = {};
-        description = "Set of plugins";
-      };
+        host = mkOption {
+          type = types.str;
+          default = "127.0.0.1";
+          description = "Database host address.";
+        };

-      #databaseType = mkOption {
-      #  type = types.str;
-      #  default = "postgresql";
-      #  description = "Type of database";
-      #};
+        port = mkOption {
+          type = types.int;
+          default = 3306;
+          description = "Database host port.";
+        };

-      databaseHost = mkOption {
-        type = types.str;
-        default = "127.0.0.1";
-        description = "Database hostname";
-      };
+        name = mkOption {
+          type = types.str;
+          default = "redmine";
+          description = "Database name.";
+        };

-      databasePassword = mkOption {
-        type = types.str;
-        default = "";
-        description = "Database user password";
-      };
+        user = mkOption {
+          type = types.str;
+          default = "redmine";
+          description = "Database user.";
+        };

-      databaseName = mkOption {
-        type = types.str;
-        default = "redmine";
-        description = "Database name";
-      };
+        password = mkOption {
+          type = types.str;
+          default = "";
+          description = ''
+            The password corresponding to <option>database.user</option>.
+            Warning: this is stored in cleartext in the Nix store!
+            Use <option>database.passwordFile</option> instead.
+          '';
+        };

-      databaseUsername = mkOption {
-        type = types.str;
-        default = "redmine";
-        description = "Database user";
+        passwordFile = mkOption {
+          type = types.nullOr types.path;
+          default = null;
+          example = "/run/keys/redmine-dbpassword";
+          description = ''
+            A file containing the password corresponding to
+            <option>database.user</option>.
+          '';
+        };
      };
    };
  };
@ -123,99 +126,106 @@ in {
  config = mkIf cfg.enable {

    assertions = [
-      { assertion = cfg.databasePassword != "";
-        message = "services.redmine.databasePassword must be set";
+      { assertion = cfg.database.passwordFile != null || cfg.database.password != "";
+        message = "either services.redmine.database.passwordFile or services.redmine.database.password must be set";
      }
    ];

-    users.users = [
-      { name = "redmine";
-        group = "redmine";
-        uid = config.ids.uids.redmine;
-      } ];
-
-    users.groups = [
-      { name = "redmine";
-        gid = config.ids.gids.redmine;
-      } ];
+    environment.systemPackages = [ pkgs.redmine ];

    systemd.services.redmine = {
-      after = [ "network.target" "postgresql.service" ];
+      after = [ "network.target" (if cfg.database.type == "mysql2" then "mysql.service" else "postgresql.service") ];
      wantedBy = [ "multi-user.target" ];
-      environment.RAILS_ENV = "production";
-      environment.RAILS_ETC = "${cfg.stateDir}/config";
-      environment.RAILS_LOG = "${cfg.stateDir}/log";
-      environment.RAILS_VAR = "${cfg.stateDir}/var";
-      environment.RAILS_CACHE = "${cfg.stateDir}/cache";
-      environment.RAILS_PLUGINS = "${cfg.stateDir}/plugins";
-      environment.RAILS_PUBLIC = "${cfg.stateDir}/public";
-      environment.RAILS_TMP = "${cfg.stateDir}/tmp";
-      environment.SCHEMA = "${cfg.stateDir}/cache/schema.db";
      environment.HOME = "${pkgs.redmine}/share/redmine";
+      environment.RAILS_ENV = "production";
+      environment.RAILS_CACHE = "${cfg.stateDir}/cache";
      environment.REDMINE_LANG = "en";
-      environment.GEM_HOME = "${pkgs.redmine}/share/redmine/vendor/bundle/ruby/1.9.1";
-      environment.GEM_PATH = "${pkgs.bundler}/${pkgs.bundler.ruby.gemPath}";
+      environment.SCHEMA = "${cfg.stateDir}/cache/schema.db";
      path = with pkgs; [
        imagemagickBig
-        subversion
-        mercurial
-        cvs
-        config.services.postgresql.package
        bazaar
+        cvs
+        darcs
        gitAndTools.git
-        # once we build binaries for darc enable it
-        #darcs
+        mercurial
+        subversion
      ];
      preStart = ''
-        # TODO: use env vars
-        for i in plugins public/plugin_assets db files log config cache var/files tmp; do
+        # start with a fresh config directory every time
+        rm -rf ${cfg.stateDir}/config
+        cp -r ${pkgs.redmine}/share/redmine/config.dist ${cfg.stateDir}/config
+
+        # create the basic state directory layout pkgs.redmine expects
+        mkdir -p /run/redmine
+
+        for i in config files log plugins tmp; do
          mkdir -p ${cfg.stateDir}/$i
+          ln -fs ${cfg.stateDir}/$i /run/redmine/$i
        done

-        chown -R redmine:redmine ${cfg.stateDir}
-        chmod -R 755 ${cfg.stateDir}
+        # ensure cache directory exists for db:migrate command
+        mkdir -p ${cfg.stateDir}/cache

-        rm -rf ${cfg.stateDir}/public/*
-        cp -R ${pkgs.redmine}/share/redmine/public/* ${cfg.stateDir}/public/
-        for theme in ${concatStringsSep " " (mapAttrsToList unpackTheme cfg.themes)}; do
-          ln -fs $theme/* ${cfg.stateDir}/public/themes/
-        done
+        # link in the application configuration
+        ln -fs ${configurationYml} ${cfg.stateDir}/config/configuration.yml

-        rm -rf ${cfg.stateDir}/plugins/*
-        for plugin in ${concatStringsSep " " (mapAttrsToList unpackPlugin cfg.plugins)}; do
-          ln -fs $plugin/* ${cfg.stateDir}/plugins/''${plugin##*-redmine-plugin-}
-        done
+        chmod -R ug+rwX,o-rwx+x ${cfg.stateDir}/

-        ln -fs ${pkgs.writeText "database.yml" databaseYml} ${cfg.stateDir}/config/database.yml
-        ln -fs ${pkgs.writeText "configuration.yml" configurationYml} ${cfg.stateDir}/config/configuration.yml
+        # handle database.passwordFile
+        DBPASS=$(head -n1 ${cfg.database.passwordFile})
+        cp -f ${databaseYml} ${cfg.stateDir}/config/database.yml
+        sed -e "s,#dbpass#,$DBPASS,g" -i ${cfg.stateDir}/config/database.yml
+        chmod 440 ${cfg.stateDir}/config/database.yml

-        if [ "${cfg.databaseHost}" = "127.0.0.1" ]; then
-          if ! test -e "${cfg.stateDir}/db-created"; then
-            psql postgres -c "CREATE ROLE redmine WITH LOGIN NOCREATEDB NOCREATEROLE ENCRYPTED PASSWORD '${cfg.databasePassword}'"
-            ${config.services.postgresql.package}/bin/createdb --owner redmine redmine || true
-            touch "${cfg.stateDir}/db-created"
-          fi
+        # generate a secret token if required
+        if ! test -e "${cfg.stateDir}/config/initializers/secret_token.rb"; then
+          ${bundle} exec rake generate_secret_token
+          chmod 440 ${cfg.stateDir}/config/initializers/secret_token.rb
        fi

-        cd ${pkgs.redmine}/share/redmine/
-        ${ruby}/bin/rake db:migrate
-        ${ruby}/bin/rake redmine:plugins:migrate
-        ${ruby}/bin/rake redmine:load_default_data
-        ${ruby}/bin/rake generate_secret_token
+        # ensure everything is owned by ${cfg.user}
+        chown -R ${cfg.user}:${cfg.group} ${cfg.stateDir}
+
+        ${bundle} exec rake db:migrate
+        ${bundle} exec rake redmine:load_default_data
      '';

      serviceConfig = {
        PermissionsStartOnly = true; # preStart must be run as root
        Type = "simple";
-        User = "redmine";
-        Group = "redmine";
+        User = cfg.user;
+        Group = cfg.group;
        TimeoutSec = "300";
        WorkingDirectory = "${pkgs.redmine}/share/redmine";
-        ExecStart="${ruby}/bin/ruby ${pkgs.redmine}/share/redmine/script/rails server webrick -e production -P ${cfg.stateDir}/redmine.pid";
+        ExecStart="${bundle} exec rails server webrick -e production -P ${cfg.stateDir}/redmine.pid";
      };

    };

+    users.extraUsers = optionalAttrs (cfg.user == "redmine") (singleton
+      { name = "redmine";
+        group = cfg.group;
+        home = cfg.stateDir;
+        createHome = true;
+        uid = config.ids.uids.redmine;
+      });
+
+    users.extraGroups = optionalAttrs (cfg.group == "redmine") (singleton
+      { name = "redmine";
+        gid = config.ids.gids.redmine;
+      });
+
+    warnings = optional (cfg.database.password != "")
+      ''config.services.redmine.database.password will be stored as plaintext
+      in the Nix store. Use database.passwordFile instead.'';
+
+    # Create database passwordFile default when password is configured.
+    services.redmine.database.passwordFile =
+      (mkDefault (toString (pkgs.writeTextFile {
+        name = "redmine-database-password";
+        text = cfg.database.password;
+      })));
+
  };

 }
--- a/nixos/modules/services/networking/dhcpcd.nix
+++ b/nixos/modules/services/networking/dhcpcd.nix
@ -161,8 +161,9 @@ in
      { description = "DHCP Client";

        wantedBy = [ "multi-user.target" ] ++ optional (!hasDefaultGatewaySet) "network-online.target";
-        wants = [ "network.target" ];
+        wants = [ "network.target" "systemd-udev-settle.service" ];
        before = [ "network.target" ];
+        after = [ "systemd-udev-settle.service" ];

        # Stopping dhcpcd during a reconfiguration is undesirable
        # because it brings down the network interfaces configured by
--- a/nixos/modules/services/security/cfssl.nix
+++ b/nixos/modules/services/security/cfssl.nix
@ -146,7 +146,7 @@ in {
    };
  };

-  config = {
+  config = mkIf cfg.enable {
    users.extraGroups.cfssl = {
      gid = config.ids.gids.cfssl;
    };
@ -159,7 +159,7 @@ in {
      uid = config.ids.uids.cfssl;
    };

-    systemd.services.cfssl = mkIf cfg.enable {
+    systemd.services.cfssl = {
      description = "CFSSL CA API server";
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];
--- a/nixos/modules/system/activation/top-level.nix
+++ b/nixos/modules/system/activation/top-level.nix
@ -46,7 +46,7 @@ let

        ln -s ${kernelPath} $out/kernel
        ln -s ${config.system.modulesTree} $out/kernel-modules
-        ${optionalString (pkgs.stdenv.platform.kernelDTB or false) ''
+        ${optionalString (pkgs.stdenv.hostPlatform.platform.kernelDTB or false) ''
          ln -s ${config.boot.kernelPackages.kernel}/dtbs $out/dtbs
        ''}

@ -74,7 +74,7 @@ let
      echo -n "$configurationName" > $out/configuration-name
      echo -n "systemd ${toString config.systemd.package.interfaceVersion}" > $out/init-interface-version
      echo -n "$nixosLabel" > $out/nixos-version
-      echo -n "$system" > $out/system
+      echo -n "${pkgs.stdenv.hostPlatform.system}" > $out/system

      mkdir $out/fine-tune
      childCount=0
@ -175,7 +175,7 @@ in

    system.boot.loader.kernelFile = mkOption {
      internal = true;
-      default = pkgs.stdenv.platform.kernelTarget;
+      default = pkgs.stdenv.hostPlatform.platform.kernelTarget;
      type = types.str;
      description = ''
        Name of the kernel file to be passed to the bootloader.
--- a/nixos/modules/system/boot/loader/generations-dir/generations-dir.nix
+++ b/nixos/modules/system/boot/loader/generations-dir/generations-dir.nix
@ -13,7 +13,7 @@ let
  };

  # Temporary check, for nixos to cope both with nixpkgs stdenv-updates and trunk
-  platform = pkgs.stdenv.platform;
+  inherit (pkgs.stdenv.hostPlatform) platform;

 in

--- a/nixos/modules/system/boot/loader/raspberrypi/raspberrypi.nix
+++ b/nixos/modules/system/boot/loader/raspberrypi/raspberrypi.nix
@ -15,7 +15,7 @@ let
    inherit configTxt;
  };

-  platform = pkgs.stdenv.platform;
+  inherit (pkgs.stdenv.hostPlatform) platform;

  builderUboot = import ./builder_uboot.nix { inherit config; inherit pkgs; inherit configTxt; };

--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@ -30,10 +30,10 @@ let
    (assertValueOneOf "UDPSegmentationOffload" boolValues)
    (assertValueOneOf "GenericReceiveOffload" boolValues)
    (assertValueOneOf "LargeReceiveOffload" boolValues)
-    (range "RxChannels" 1 4294967295)
-    (range "TxChannels" 1 4294967295)
-    (range "OtherChannels" 1 4294967295)
-    (range "CombinedChannels" 1 4294967295)
+    (assertRange "RxChannels" 1 4294967295)
+    (assertRange "TxChannels" 1 4294967295)
+    (assertRange "OtherChannels" 1 4294967295)
+    (assertRange "CombinedChannels" 1 4294967295)
  ];

  checkNetdev = checkUnitConfig "Netdev" [
--- a/nixos/release.nix
+++ b/nixos/release.nix
@ -83,7 +83,7 @@ let
    in
      tarball //
        { meta = {
-            description = "NixOS system tarball for ${system} - ${stdenv.platform.name}";
+            description = "NixOS system tarball for ${system} - ${stdenv.hostPlatform.platform.name}";
            maintainers = map (x: lib.maintainers.${x}) maintainers;
          };
          inherit config;
@ -106,7 +106,7 @@ let
    let
      configEvaled = import lib/eval-config.nix config;
      build = configEvaled.config.system.build;
-      kernelTarget = configEvaled.pkgs.stdenv.platform.kernelTarget;
+      kernelTarget = configEvaled.pkgs.stdenv.hostPlatform.platform.kernelTarget;
    in
      pkgs.symlinkJoin {
        name = "netboot";
--- a/nixos/tests/home-assistant.nix
+++ b/nixos/tests/home-assistant.nix
@ -2,7 +2,8 @@ import ./make-test.nix ({ pkgs, ... }:

 let
  configDir = "/var/lib/foobar";
-  apiPassword = "secret";
+  apiPassword = "some_secret";
+  mqttPassword = "another_secret";

 in {
  name = "home-assistant";
@ -33,7 +34,9 @@ in {
            };
            frontend = { };
            http.api_password = apiPassword;
-            mqtt = { }; # Use hbmqtt as broker
+            mqtt = { # Use hbmqtt as broker
+              password = mqttPassword;
+            };
            binary_sensor = [
              {
                platform = "mqtt";
@ -62,7 +65,7 @@ in {

    # Toggle a binary sensor using MQTT
    $hass->succeed("curl http://localhost:8123/api/states/binary_sensor.mqtt_binary_sensor -H 'x-ha-access: ${apiPassword}' | grep -qF '\"state\": \"off\"'");
-    $hass->waitUntilSucceeds("mosquitto_pub -V mqttv311 -t home-assistant/test -u homeassistant -P '${apiPassword}' -m let_there_be_light");
+    $hass->waitUntilSucceeds("mosquitto_pub -V mqttv311 -t home-assistant/test -u homeassistant -P '${mqttPassword}' -m let_there_be_light");
    $hass->succeed("curl http://localhost:8123/api/states/binary_sensor.mqtt_binary_sensor -H 'x-ha-access: ${apiPassword}' | grep -qF '\"state\": \"on\"'");

    # Print log to ease debugging
--- a/pkgs/applications/audio/chuck/default.nix
+++ b/pkgs/applications/audio/chuck/default.nix
@ -1,5 +1,6 @@
-{ stdenv, fetchurl, alsaLib, bison, flex, libsndfile, which
+{ stdenv, lib, fetchurl, alsaLib, bison, flex, libsndfile, which
 , AppKit, Carbon, CoreAudio, CoreMIDI, CoreServices, Kernel
+, xcbuild
 }:

 stdenv.mkDerivation rec {
@ -11,31 +12,28 @@ stdenv.mkDerivation rec {
    sha256 = "02z7sglax3j09grj5s1skmw8z6wz7b21hjrm95nrrdpwbxabh079";
  };

-  buildInputs = [ bison flex libsndfile which ]
-    ++ stdenv.lib.optional (!stdenv.isDarwin) alsaLib
-    ++ stdenv.lib.optional stdenv.isDarwin [ AppKit Carbon CoreAudio CoreMIDI CoreServices Kernel ];
+  nativeBuildInputs = [ flex bison which ];
+
+  buildInputs = [ libsndfile ]
+    ++ lib.optional (!stdenv.isDarwin) alsaLib
+    ++ lib.optional stdenv.isDarwin [ AppKit Carbon CoreAudio CoreMIDI CoreServices Kernel ];

  patches = [ ./clang.patch ./darwin-limits.patch ];

-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-Wno-missing-sysroot";
-  NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isDarwin "-framework MultitouchSupport";
+  NIX_CFLAGS_COMPILE = lib.optional stdenv.isDarwin "-Wno-missing-sysroot";
+  NIX_LDFLAGS = lib.optional stdenv.isDarwin "-framework MultitouchSupport";

  postPatch = ''
    substituteInPlace src/makefile --replace "/usr/bin" "$out/bin"
-    substituteInPlace src/makefile.osx --replace "xcodebuild" "/usr/bin/xcodebuild"
-    substituteInPlace src/makefile.osx --replace "weak_framework" "framework"
-    substituteInPlace src/makefile.osx --replace "MACOSX_DEPLOYMENT_TARGET=10.5" "MACOSX_DEPLOYMENT_TARGET=$MACOSX_DEPLOYMENT_TARGET"
+    substituteInPlace src/makefile.osx \
+      --replace "weak_framework" "framework" \
+      --replace "MACOSX_DEPLOYMENT_TARGET=10.5" "MACOSX_DEPLOYMENT_TARGET=$MACOSX_DEPLOYMENT_TARGET"
  '';

-  buildPhase = ''
-    make -C src ${if stdenv.isDarwin then "osx" else "linux-alsa"}
-  '';
+  makeFlags = [ "-C src" "DESTDIR=$(out)/bin" ];
+  buildFlags = [ (if stdenv.isDarwin then "osx" else "linux-alsa") ];

-  installPhase = ''
-    install -Dm755 ./src/chuck $out/bin/chuck
-  '';
-
-  meta = with stdenv.lib; {
+  meta = with lib; {
    description = "Programming language for real-time sound synthesis and music creation";
    homepage = http://chuck.cs.princeton.edu;
    license = licenses.gpl2;
--- a/pkgs/applications/audio/radiotray-ng/default.nix
+++ b/pkgs/applications/audio/radiotray-ng/default.nix
@ -23,7 +23,7 @@
 # rt2rtng
 , python2
 # Testing
-, gmock
+, gtest
 # Fixup
 , wrapGAppsHook
 , makeWrapper
@ -58,11 +58,10 @@ stdenv.mkDerivation rec {
    libxdg_basedir
    lsb-release
    wxGTK
-  ] ++ stdenv.lib.optional doCheck gmock
-    ++ gstInputs
+  ] ++ gstInputs
    ++ pythonInputs;

-  prePatch = ''
+  postPatch = ''
    for x in debian/CMakeLists.txt include/radiotray-ng/common.hpp data/*.desktop; do
      substituteInPlace $x --replace /usr $out
    done
@ -74,14 +73,16 @@ stdenv.mkDerivation rec {
      --replace radiotray-ng-notification radiotray-ng-on
  '';

-  cmakeFlags = stdenv.lib.optional doCheck "-DBUILD_TESTS=ON";
+  cmakeFlags = [
+    "-DBUILD_TESTS=${if doCheck then "ON" else "OFF"}"
+  ];

  enableParallelBuilding = true;

- # XXX: as of 0.2.2, tries to download gmock instead of checking for provided
-  doCheck = false;
-
+  checkInputs = [ gtest ];
  checkPhase = "ctest";
+  # doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
+  doCheck = false; # fails to pick up supplied gtest, tries to download it instead

  preFixup = ''
    gappsWrapperArgs+=(--suffix PATH : ${stdenv.lib.makeBinPath [ dbus ]})
--- a/pkgs/applications/editors/emacs-modes/melpa-packages.nix
+++ b/pkgs/applications/editors/emacs-modes/melpa-packages.nix
@ -202,6 +202,12 @@ self:
      # missing OCaml
      utop = markBroken super.utop;

+      vdiff-magit =
+        (super.vdiff-magit.overrideAttrs (attrs: {
+          nativeBuildInputs =
+            (attrs.nativeBuildInputs or []) ++ [ external.git ];
+        }));
+
      # upstream issue: missing file header
      voca-builder = markBroken super.voca-builder;

--- a/pkgs/applications/editors/emacs-modes/melpa-stable-packages.nix
+++ b/pkgs/applications/editors/emacs-modes/melpa-stable-packages.nix
@ -194,6 +194,12 @@ self:
      # missing OCaml
      utop = markBroken super.utop;

+      vdiff-magit =
+        (super.vdiff-magit.overrideAttrs (attrs: {
+          nativeBuildInputs =
+            (attrs.nativeBuildInputs or []) ++ [ external.git ];
+        }));
+
      # upstream issue: missing file header
      voca-builder = markBroken super.voca-builder;

--- a/pkgs/applications/editors/geany/default.nix
+++ b/pkgs/applications/editors/geany/default.nix
@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
      - Plugin interface
    '';
    homepage = https://www.geany.org/;
-    license = "GPL";
+    license = licenses.gpl2;
    maintainers = [];
    platforms = platforms.all;
  };
--- a/pkgs/applications/editors/geany/with-vte.nix
+++ b/pkgs/applications/editors/geany/with-vte.nix
@ -1,7 +1,7 @@
 { runCommand, makeWrapper, geany, gnome2 }:
 let name = builtins.replaceStrings ["geany-"] ["geany-with-vte-"] geany.name;
 in
-runCommand "${name}" { nativeBuildInputs = [ makeWrapper ]; } "
+runCommand "${name}" { nativeBuildInputs = [ makeWrapper ]; inherit (geany.meta); } "
   mkdir -p $out
   ln -s ${geany}/share $out
   makeWrapper ${geany}/bin/geany $out/bin/geany --prefix LD_LIBRARY_PATH : ${gnome2.vte}/lib
--- a/pkgs/applications/graphics/exrtools/default.nix
+++ b/pkgs/applications/graphics/exrtools/default.nix
@ -9,6 +9,11 @@ stdenv.mkDerivation rec {
    sha256 = "0jpkskqs1yjiighab4s91jy0c0qxcscwadfn94xy2mm2bx2qwp4z";
  };

+  preConfigure = ''
+    CC=${stdenv.cc.targetPrefix}cc
+    CXX=${stdenv.cc.targetPrefix}c++
+  '';
+
  nativeBuildInputs = [ pkgconfig ];
  buildInputs = [ stdenv openexr libpng12 libjpeg ];

--- a/pkgs/applications/graphics/feh/default.nix
+++ b/pkgs/applications/graphics/feh/default.nix
@ -15,8 +15,7 @@ stdenv.mkDerivation rec {

  outputs = [ "out" "man" "doc" ];

-  nativeBuildInputs = [ makeWrapper xorg.libXt ]
-    ++ optionals doCheck [ perlPackages.TestCommand perlPackages.TestHarness ];
+  nativeBuildInputs = [ makeWrapper xorg.libXt ];

  buildInputs = [ xorg.libX11 xorg.libXinerama imlib2 libjpeg libpng curl libexif ];

@ -36,8 +35,9 @@ stdenv.mkDerivation rec {
    install -D -m 644 man/*.1 $out/share/man/man1
  '';

-  checkPhase = ''
-    PERL5LIB="${perlPackages.TestCommand}/lib/perl5/site_perl" make test
+  checkInputs = [ perlPackages.TestCommand perlPackages.TestHarness ];
+  preCheck = ''
+    export PERL5LIB="${perlPackages.TestCommand}/lib/perl5/site_perl"
  '';

  doCheck = true;
--- a/pkgs/applications/misc/doomseeker/default.nix
+++ b/pkgs/applications/misc/doomseeker/default.nix
@ -1,4 +1,4 @@
-{ stdenv, cmake, fetchFromBitbucket, pkgconfig, qtbase, qttools, qtmultimedia, zlib, bzip2 }:
+{ stdenv, cmake, fetchFromBitbucket, pkgconfig, qtbase, qttools, qtmultimedia, zlib, bzip2, xxd }:

 stdenv.mkDerivation rec {
  name = "doomseeker-${version}";
@ -15,10 +15,12 @@ stdenv.mkDerivation rec {

  buildInputs = [ qtbase qtmultimedia zlib bzip2 ];

-  nativeBuildInputs = [ cmake qttools pkgconfig ];
+  nativeBuildInputs = [ cmake qttools pkgconfig xxd ];

  enableParallelBuilding = true;

+  NIX_CFLAGS_COMPILE = stdenv.lib.optional stdenv.cc.isClang "-Wno-error=format-security";
+
  meta = with stdenv.lib; {
    homepage = http://doomseeker.drdteam.org/;
    description = "Multiplayer server browser for many Doom source ports";
--- a/pkgs/applications/misc/dozenal/default.nix
+++ b/pkgs/applications/misc/dozenal/default.nix
@ -0,0 +1,61 @@
+{ stdenv, fetchFromGitHub, ncurses, hdate, lua5_2 }:
+
+stdenv.mkDerivation rec {
+  version = "12010904";
+  name = "dozenal-${version}";
+  src = fetchFromGitHub {
+    owner = "dgoodmaniii";
+    repo = "dozenal";
+    rev = "v${version}";
+    sha256 = "1ic63gpdda762x6ks3al71dwgmsy2isicqyr2935bd245jx8s209";
+  };
+  makeFlags = [
+              # author do not use configure and prefix directly using $prefix
+              "prefix=$(out)"
+              # graphical version of dozdc requires xforms, which is not i nixpkgs so I turned it down
+              "XFORMS_FLAGS=-UXFORMS"
+              "LUALIB=-llua"
+              "bindir=$(prefix)/bin/"
+            ];
+  # some include hardcodes the lua libraries path. This is a patch for that
+  patches = [ ./lua-header.patch ];
+  preBuild = "cd dozenal";
+  buildInputs = [ ncurses hdate lua5_2 ];
+  # I remove gdozdc, as I didn't figure all it's dependency yet.
+  postInstall = "rm $out/bin/gdozdc";
+
+  meta = {
+    description = "A complete suite of dozenal (base twelve) programs";
+    longDescription = ''
+      Programs
+
+      doz --- a converter; converts decimal numbers into dozenal. Accepts
+         input in standard or exponential notation (i.e., "1492.2" or "1.4922e3").
+      dec --- a converter; converts dozenal numbers into decimal. Accepts input
+         in standard or exponential notation (i.e., "X44;4" or "X;444e2").
+      dozword --- converts a dozenal number (integers only) into words,
+         according to the Pendlebury system.
+      dozdc --- a full-featured scientific calculator which works in the
+         dozenal base. RPN command line.
+      tgmconv --- a converter for all standard measurements; converts to and
+         from TGM, Imperial, customary, and SI metric.
+      dozpret --- a pretty-printer for dozenal numbers; inserts spacing (or
+         other characters) as desired, and can also transform transdecimal digits
+         from 'X' to 'E' into any character or sequence of characters desired.
+      dozdate --- a more-or-less drop-in replacement for GNU and BSD date, it
+         outputs the date and time in dozenal, as well as containing some TGM
+         extensions.
+      dozstring --- a simple byte converter; absorbs a string either from
+         standard input or a command line argument, leaving it identical but
+         for the numbers, which it converts into dozenal. Options for padding
+         and for not converting specific numbers.
+      doman --- a converter which takes a dozenal integer and
+         emits its equivalent in a non-place-value system, such as
+         Roman numerals.  Arbitrary ranks and symbols may be used.
+         Defaults to dozenal Roman numerals.
+    '';
+    homepage = https://github.com/dgoodmaniii/dozenal/;
+    maintainers = with stdenv.lib.maintainers; [ CharlesHD ];
+    license = stdenv.lib.licenses.gpl3;
+  };
+}
--- a/pkgs/applications/misc/dozenal/lua-header.patch
+++ b/pkgs/applications/misc/dozenal/lua-header.patch
@ -0,0 +1,16 @@
+diff -ruN dozenal-12010904/dozenal/dozcal/call_lua.c dozenal-patched/dozenal/dozcal/call_lua.c
+--- dozenal-12010904/dozenal/dozcal/call_lua.c	2017-09-04 19:25:01.000000000 +0200
+++ dozenal-patched/dozenal/dozcal/call_lua.c	2018-06-13 10:19:57.821950327 +0200
+@@ -38,9 +38,9 @@
+ #include"utility.h"
+ #include"conv.h"
+ #include"proc_date.h"
+-#include<lua5.2/lua.h>
+-#include<lua5.2/lauxlib.h>
+-#include<lua5.2/lualib.h>
+#include<lua.h>
+#include<lauxlib.h>
+#include<lualib.h>
+ 
+ void bail(lua_State *L, int err_code, char *filename);
+ int file_prefix(char **s, char *t);
--- a/pkgs/applications/misc/hdate/default.nix
+++ b/pkgs/applications/misc/hdate/default.nix
@ -0,0 +1,16 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  version = "1.6.02";
+  name = "hdate-${version}";
+  src = fetchurl {
+    url = "https://sourceforge.net/projects/libhdate/files/libhdate/libhdate-${version}/libhdate-${version}.tar.bz2";
+    sha256 = "3c930a8deb57c01896dc37f0d7804e5a330ee8e88c4ff610b71f9d2b02c17762";
+  };
+  meta = {
+    description = "Hebrew calendar and solar astronomical times library and utilities";
+    homepage = https://sourceforge.net/projects/libhdate/;
+    license = stdenv.lib.licenses.gpl3;
+    maintainers = with stdenv.lib.maintainers; [ CharlesHD ];
+  };
+}
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@ -2,7 +2,7 @@

 buildGoPackage rec {
  name = "hugo-${version}";
-  version = "0.47";
+  version = "0.47.1";

  goPackagePath = "github.com/gohugoio/hugo";

@ -10,7 +10,7 @@ buildGoPackage rec {
    owner  = "gohugoio";
    repo   = "hugo";
    rev    = "v${version}";
-    sha256 = "1h62ix285mx977mgawyanyvsqqic1xx0gmi1r5wn43w9yc29wr0z";
+    sha256 = "0n27vyg66jfx4lwswsmdlybly8c9gy5rk7yhy7wzs3rwzlqv1jzj";
  };

  goDeps = ./deps.nix;
--- a/pkgs/applications/misc/hugo/deps.nix
+++ b/pkgs/applications/misc/hugo/deps.nix
@ -104,8 +104,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/disintegration/imaging";
-      rev = "8021a62ea0dfe0ed2e6107f5ccd37e0d4a92a996";
-      sha256 = "1c32sqfz78g9wxvpng8n9r404lf2lgjn9b24mg8y3rxylx29gks7";
+      rev = "0bd5694c78c9c3d9a3cd06a706a8f3c59296a9ac";
+      sha256 = "1laxccmzi7q51zxn81ringmdwp8iaipivrl375yc3gq56d70sp0r";
    };
  }
  {
@ -140,8 +140,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/gobuffalo/envy";
-      rev = "2d0f467653f3d961ce9ada4d32a230bdcb3bfe11";
-      sha256 = "0p9raqrsqg2z1hq2kbvbq5qcwqihjqf28xnfh62214p7ak9b9x8n";
+      rev = "3c96536452167a705ca5a70b831d3810e1e10452";
+      sha256 = "0ixqpdmb7kjlarkv0qlbwnbr194sajx9flysnhcldzmciqgk5bqs";
    };
  }
  {
@ -347,8 +347,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/spf13/cobra";
-      rev = "7c4570c3ebeb8129a1f7456d0908a8b676b6f9f1";
-      sha256 = "16amh0prlzqrrbg5j629sg0f688nfzfgn9sair8jyybqampr3wc7";
+      rev = "ff0d02e8555041edecbd0ce27f32c6ea4b214483";
+      sha256 = "1ilw6b2nir1bg7hmx8hrn60za37qqm18xvamv90fx5vxq85fsml9";
    };
  }
  {
@ -446,8 +446,8 @@
    fetch = {
      type = "git";
      url = "https://go.googlesource.com/net";
-      rev = "aaf60122140d3fcf75376d319f0554393160eb50";
-      sha256 = "03i6ij7jcf5mp9dc8ps8b63g1k843z7c823qyzn5a276gpxvxlvv";
+      rev = "922f4815f713f213882e8ef45e0d315b164d705c";
+      sha256 = "1ci1rxk2d6hmfsjjc19n2sxhyn4jqr5ia3ykyah1h08p0pn7k52w";
    };
  }
  {
@ -464,8 +464,8 @@
    fetch = {
      type = "git";
      url = "https://go.googlesource.com/sys";
-      rev = "1c9583448a9c3aa0f9a6a5241bf73c0bd8aafded";
-      sha256 = "0g0nc549pmdmvja4mdqh0kgvznnw6wliqmx5wrnj02l3a23vizmi";
+      rev = "4ea2f632f6e912459fe60b26b1749377f0d889d5";
+      sha256 = "16pdi4mmjlcrjdcz7k559jqnsvkhdmff68bbqq7ii1lp8vrpqqmy";
    };
  }
  {
--- a/pkgs/applications/misc/kitty/default.nix
+++ b/pkgs/applications/misc/kitty/default.nix
@ -7,7 +7,7 @@

 with python3Packages;
 buildPythonApplication rec {
-  version = "0.11.2";
+  version = "0.11.3";
  name = "kitty-${version}";
  format = "other";

@ -15,7 +15,7 @@ buildPythonApplication rec {
    owner = "kovidgoyal";
    repo = "kitty";
    rev = "v${version}";
-    sha256 = "0vmxgyxrgaqijwd51ldd8pkz7jn9hdcfib1dqr0ai614286v69hw";
+    sha256 = "1fql8ayxvip8hgq9gy0dhqfvngv13gh5bf71vnc3agd80kzq1n73";
  };

  buildInputs = [
--- a/pkgs/applications/misc/kiwix/default.nix
+++ b/pkgs/applications/misc/kiwix/default.nix
@ -81,6 +81,11 @@ stdenv.mkDerivation rec {
    cd ../../..
  '';

+  preConfigure = ''
+    CC=${stdenv.cc.targetPrefix}cc
+    CXX=${stdenv.cc.targetPrefix}c++
+  '';
+
  configureFlags = [
    "--disable-static"
    "--disable-staticbins"
--- a/pkgs/applications/misc/ranger/default.nix
+++ b/pkgs/applications/misc/ranger/default.nix
@ -43,7 +43,7 @@ python3Packages.buildPythonApplication rec {

    # give image previews out of the box when building with w3m
    substituteInPlace ranger/config/rc.conf \
-      --replace "set preview_images false" "set preview_images true" \
+      --replace "set preview_images false" "set preview_images true"
  '';

  meta =  with stdenv.lib; {
--- a/pkgs/applications/misc/tilix/default.nix
+++ b/pkgs/applications/misc/tilix/default.nix
@ -1,23 +1,23 @@
 { stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, dmd, gnome3, dbus
-, gsettings-desktop-schemas, desktop-file-utils, gettext, gtkd
+, gsettings-desktop-schemas, desktop-file-utils, gettext, gtkd, libsecret
 , perlPackages, wrapGAppsHook, xdg_utils }:

 stdenv.mkDerivation rec {
  name = "tilix-${version}";
-  version = "1.8.1";
+  version = "1.8.3";

  src = fetchFromGitHub {
    owner = "gnunn1";
    repo = "tilix";
    rev = "${version}";
-    sha256 = "19dx3hlj40cqwph98pcifkm6axfszfr0v9k6sr3caw4ycml84ci1";
+    sha256 = "05x2nyyb5w3122j90g0f7lh9jl7xi1nk176sl01vl2ks7zar00dq";
  };

  nativeBuildInputs = [
    autoreconfHook dmd desktop-file-utils perlPackages.Po4a pkgconfig xdg_utils
    wrapGAppsHook
  ];
-  buildInputs = [ gnome3.dconf gettext gsettings-desktop-schemas gtkd dbus ];
+  buildInputs = [ gnome3.dconf gettext gsettings-desktop-schemas gtkd dbus libsecret ];

  preBuild = ''
    makeFlagsArray=(
@ -28,6 +28,9 @@ stdenv.mkDerivation rec {

  postInstall = with gnome3; ''
    ${glib.dev}/bin/glib-compile-schemas $out/share/glib-2.0/schemas
+
+    wrapProgram $out/bin/tilix \
+      --prefix LD_LIBRARY_PATH ":" "${libsecret}/lib"
  '';


--- a/pkgs/applications/misc/tootle/default.nix
+++ b/pkgs/applications/misc/tootle/default.nix
@ -0,0 +1,38 @@
+{ stdenv, fetchFromGitHub
+, meson, ninja, pkgconfig
+, gnome3, vala, gobjectIntrospection, wrapGAppsHook
+, gtk3, granite
+, json-glib, glib, glib-networking
+}:
+
+let
+  pname = "tootle";
+  version = "0.1.5";
+in stdenv.mkDerivation rec {
+  name = "${pname}-${version}";
+
+  src = fetchFromGitHub {
+    owner = "bleakgrey";
+    repo = pname;
+    rev = version;
+    sha256 = "022h1rh1jk3m1f9al0s1rylmnqnkydyc81idfc8jf1g0frnvn5i6";
+  };
+
+  nativeBuildInputs = [ meson ninja pkgconfig vala gobjectIntrospection wrapGAppsHook ];
+  buildInputs = [
+    gtk3 granite json-glib glib glib-networking
+    gnome3.libgee gnome3.libsoup gnome3.gsettings-desktop-schemas
+  ];
+
+  postPatch = ''
+    chmod +x ./meson/post_install.py
+    patchShebangs ./meson/post_install.py
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Simple Mastodon client designed for elementary OS";
+    homepage    = https://github.com/bleakgrey/tootle;
+    license     = licenses.gpl3;
+    maintainers = with maintainers; [ dtzWill ];
+  };
+}
--- a/pkgs/applications/networking/browsers/firefox-bin/default.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/default.nix
@ -174,6 +174,7 @@ stdenv.mkDerivation {
      gappsWrapperArgs+=(--argv0 "$out/bin/.firefox-wrapped")
    '';

+  passthru.execdir = "/bin";
  passthru.ffmpegSupport = true;
  passthru.gssSupport = true;
  # update with:
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@ -16,7 +16,7 @@

 ## optional libraries

-, alsaSupport ? true, alsaLib
+, alsaSupport ? stdenv.isLinux, alsaLib
 , pulseaudioSupport ? true, libpulseaudio
 , ffmpegSupport ? true, gstreamer, gst-plugins-base
 , gtk3Support ? !isTorBrowserLike, gtk2, gtk3, wrapGAppsHook
@ -39,6 +39,10 @@
 , safeBrowsingSupport ? false
 , drmSupport ? false

+# macOS dependencies
+, xcbuild, CoreMedia, ExceptionHandling, Kerberos, AVFoundation, MediaToolbox
+, CoreLocation, Foundation, AddressBook, libobjc, cups, rsync
+
 ## other

 # As stated by Sylvestre Ledru (@sylvestre) on Nov 22, 2017 at
@ -66,7 +70,14 @@ assert stdenv.cc.libc or null != null;

 let
  flag = tf: x: [(if tf then "--enable-${x}" else "--disable-${x}")];
-  gcc = if stdenv.cc.isGNU then stdenv.cc.cc else stdenv.cc.cc.gcc;
+
+  default-toolkit = if stdenv.isDarwin then "cairo-cocoa"
+                    else "cairo-gtk${if gtk3Support then "3" else "2"}";
+
+  execdir = if stdenv.isDarwin
+            then "/Applications/${browserName}.app/Contents/MacOS"
+            else "/bin";
+  browserName = if stdenv.isDarwin then "Firefox" else "firefox";
 in

 stdenv.mkDerivation (rec {
@ -90,13 +101,27 @@ stdenv.mkDerivation (rec {
  ++ lib.optional  pulseaudioSupport libpulseaudio # only headers are needed
  ++ lib.optionals ffmpegSupport [ gstreamer gst-plugins-base ]
  ++ lib.optional  gtk3Support gtk3
-  ++ lib.optional  gssSupport kerberos;
+  ++ lib.optional  gssSupport kerberos
+  ++ lib.optionals stdenv.isDarwin [ CoreMedia ExceptionHandling Kerberos
+                                     AVFoundation MediaToolbox CoreLocation
+                                     Foundation libobjc AddressBook cups ];

-  NIX_CFLAGS_COMPILE = "-I${nspr.dev}/include/nspr -I${nss.dev}/include/nss -I${glib.dev}/include/gio-unix-2.0";
+  NIX_CFLAGS_COMPILE = [ "-I${nspr.dev}/include/nspr"
+                         "-I${nss.dev}/include/nss"
+                         "-I${glib.dev}/include/gio-unix-2.0" ]
+                      ++ lib.optional stdenv.isDarwin [
+                         "-isystem ${llvmPackages.libcxx}/include/c++/v1"
+                         "-DMAC_OS_X_VERSION_MAX_ALLOWED=MAC_OS_X_VERSION_10_10" ];
+
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    substituteInPlace js/src/jsmath.cpp --replace 'defined(HAVE___SINCOS)' 0
+  '';

  nativeBuildInputs =
    [ autoconf213 which gnused pkgconfig perl python2 cargo rustc ]
-    ++ lib.optional gtk3Support wrapGAppsHook ++ extraNativeBuildInputs;
+    ++ lib.optional gtk3Support wrapGAppsHook
+    ++ lib.optionals stdenv.isDarwin [ xcbuild rsync ]
+    ++ extraNativeBuildInputs;

  preConfigure = ''
    # remove distributed configuration files
@ -110,11 +135,23 @@ stdenv.mkDerivation (rec {
  '' else ''
    make -f client.mk configure-files
    configureScript="$(realpath ./configure)"
-  '') + ''
-    cxxLib=$( echo -n ${gcc}/include/c++/* )
-    archLib=$cxxLib/$( ${gcc}/bin/gcc -dumpmachine )
+  '') + lib.optionalString (!isTorBrowserLike && lib.versionAtLeast version "53") ''
+    export MOZCONFIG=$(pwd)/mozconfig

-    test -f layout/style/ServoBindings.toml && sed -i -e '/"-DRUST_BINDGEN"/ a , "-cxx-isystem", "'$cxxLib'", "-isystem", "'$archLib'"' layout/style/ServoBindings.toml
+    # Set C flags for Rust's bindgen program. Unlike ordinary C
+    # compilation, bindgen does not invoke $CC directly. Instead it
+    # uses LLVM's libclang. To make sure all necessary flags are
+    # included we need to look in a few places.
+    # TODO: generalize this process for other use-cases.
+
+    BINDGEN_CFLAGS="$(< ${stdenv.cc}/nix-support/libc-cflags) \
+      $(< ${stdenv.cc}/nix-support/cc-cflags) \
+      ${stdenv.cc.default_cxx_stdlib_compile} \
+      ${lib.optionalString stdenv.cc.isClang "-idirafter ${stdenv.cc.cc}/lib/clang/${lib.getVersion stdenv.cc.cc}/include"} \
+      ${lib.optionalString stdenv.cc.isGNU "-isystem ${stdenv.cc.cc}/include/c++/${lib.getVersion stdenv.cc.cc} -isystem ${stdenv.cc.cc}/include/c++/${lib.getVersion stdenv.cc.cc}/$(cc -dumpmachine)"} \
+      $NIX_CFLAGS_COMPILE"
+
+    echo "ac_add_options BINDGEN_CFLAGS='$BINDGEN_CFLAGS'" >> $MOZCONFIG
  '' + lib.optionalString googleAPISupport ''
    # Google API key used by Chromium and Firefox.
    # Note: These are for NixOS/nixpkgs use ONLY. For your own distribution,
@ -146,8 +183,9 @@ stdenv.mkDerivation (rec {
    "--enable-jemalloc"
    "--disable-maintenance-service"
    "--disable-gconf"
-    "--enable-default-toolkit=cairo-gtk${if gtk3Support then "3" else "2"}"
+    "--enable-default-toolkit=${default-toolkit}"
  ]
+  ++ lib.optional stdenv.isDarwin "--disable-xcode-checks"
  ++ lib.optional (lib.versionOlder version "61") "--enable-system-hunspell"
  ++ lib.optionals (lib.versionAtLeast version "56" && !stdenv.hostPlatform.isi686) [
    # on i686-linux: --with-libclang-path is not available in this configuration
@ -223,7 +261,12 @@ stdenv.mkDerivation (rec {
    paxmark m dist/bin/xpcshell
  '';

-  postInstall = ''
+  installPhase = if stdenv.isDarwin then ''
+    mkdir -p $out/Applications
+    cp -LR dist/Firefox.app $out/Applications
+  '' else null;
+
+  postInstall = lib.optionalString stdenv.isLinux ''
    # For grsecurity kernels
    paxmark m $out/lib/firefox*/{firefox,firefox-bin,plugin-container}

@ -234,7 +277,7 @@ stdenv.mkDerivation (rec {
    gappsWrapperArgs+=(--argv0 "$out/bin/.firefox-wrapped")
  '';

-  postFixup = ''
+  postFixup = lib.optionalString stdenv.isLinux ''
    # Fix notifications. LibXUL uses dlopen for this, unfortunately; see #18712.
    patchelf --set-rpath "${lib.getLib libnotify
      }/lib:$(patchelf --print-rpath "$out"/lib/firefox*/libxul.so)" \
@ -244,11 +287,10 @@ stdenv.mkDerivation (rec {
  doInstallCheck = true;
  installCheckPhase = ''
    # Some basic testing
-    "$out/bin/firefox" --version
+    "$out${execdir}/${browserName}" --version
  '';

  passthru = {
-    browserName = "firefox";
    inherit version updateScript;
    isFirefox3Like = true;
    inherit isTorBrowserLike;
@ -256,6 +298,8 @@ stdenv.mkDerivation (rec {
    inherit nspr;
    inherit ffmpegSupport;
    inherit gssSupport;
+    inherit execdir;
+    inherit browserName;
  } // lib.optionalAttrs gtk3Support { inherit gtk3; };

 } // overrides)
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@ -36,7 +36,7 @@ rec {
      description = "A web browser built from Firefox source tree";
      homepage = http://www.mozilla.com/en-US/firefox/;
      maintainers = with lib.maintainers; [ eelco ];
-      platforms = lib.platforms.linux;
+      platforms = lib.platforms.unix;
      license = lib.licenses.mpl20;
    };
    updateScript = callPackage ./update.nix {
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@ -101,24 +101,28 @@ let
        ];
      };

-      buildInputs = [makeWrapper]
-        ++ lib.optional (browser ? gtk3) browser.gtk3;
+      nativeBuildInputs = [ makeWrapper lndir ];
+      buildInputs = lib.optional (browser ? gtk3) browser.gtk3;

-      buildCommand = ''
-        if [ ! -x "${browser}/bin/${browserName}" ]
+      buildCommand = lib.optionalString stdenv.isDarwin ''
+        mkdir -p $out/Applications
+        cp -R --no-preserve=mode,ownership ${browser}/Applications/${browserName}.app $out/Applications
+        rm -f $out${browser.execdir or "/bin"}/${browserName}
+      '' + ''
+        if [ ! -x "${browser}${browser.execdir or "/bin"}/${browserName}" ]
        then
-            echo "cannot find executable file \`${browser}/bin/${browserName}'"
+            echo "cannot find executable file \`${browser}${browser.execdir or "/bin"}/${browserName}'"
            exit 1
        fi

-        makeWrapper "$(readlink -v --canonicalize-existing "${browser}/bin/${browserName}")" \
-            "$out/bin/${browserName}${nameSuffix}" \
+        makeWrapper "$(readlink -v --canonicalize-existing "${browser}${browser.execdir or "/bin"}/${browserName}")" \
+          "$out${browser.execdir or "/bin"}/${browserName}${nameSuffix}" \
            --suffix-each MOZ_PLUGIN_PATH ':' "$plugins" \
            --suffix LD_LIBRARY_PATH ':' "$libs" \
            --suffix-each GTK_PATH ':' "$gtk_modules" \
            --suffix-each LD_PRELOAD ':' "$(cat $(filterExisting $(addSuffix /extra-ld-preload $plugins)))" \
            --prefix-contents PATH ':' "$(filterExisting $(addSuffix /extra-bin-path $plugins))" \
-            --suffix PATH ':' "$out/bin" \
+            --suffix PATH ':' "$out${browser.execdir or "/bin"}" \
            --set MOZ_APP_LAUNCHER "${browserName}${nameSuffix}" \
            --set MOZ_SYSTEM_DIR "$out/lib/mozilla" \
            ${lib.optionalString (browser ? gtk3)
@ -144,7 +148,7 @@ let

        mkdir -p $out/lib/mozilla
        for ext in ${toString nativeMessagingHosts}; do
-            ${lndir}/bin/lndir -silent $ext/lib/mozilla $out/lib/mozilla
+            lndir -silent $ext/lib/mozilla $out/lib/mozilla
        done

        # For manpages, in case the program supplies them
--- a/pkgs/applications/networking/browsers/tor-browser-bundle/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle/default.nix
@ -337,6 +337,7 @@ stdenv.mkDerivation rec {
    $out/bin/tor-browser -version >/dev/null
  '';

+  passthru.execdir = "/bin";
  meta = with stdenv.lib; {
    description = "An unofficial version of the tor browser bundle, built from source";
    homepage = https://torproject.org/;
--- a/pkgs/applications/networking/feedreaders/rsstail/default.nix
+++ b/pkgs/applications/networking/feedreaders/rsstail/default.nix
@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
    owner = "flok99";
  };

-  buildInputs = [ libmrss ]
-    ++ stdenv.lib.optional doCheck cppcheck;
+  buildInputs = [ libmrss ];
+  checkInputs = [ cppcheck ];

  postPatch = ''
    substituteInPlace Makefile --replace -liconv_hook ""
--- a/pkgs/applications/networking/instant-messengers/utox/default.nix
+++ b/pkgs/applications/networking/instant-messengers/utox/default.nix
@ -22,15 +22,16 @@ stdenv.mkDerivation rec {
  ];

  nativeBuildInputs = [
-    check cmake pkgconfig
+    cmake pkgconfig
  ];

  cmakeFlags = [
    "-DENABLE_AUTOUPDATE=OFF"
-  ] ++ lib.optional (doCheck) "-DENABLE_TESTS=ON";
-
-  doCheck = stdenv.isLinux;
+    "-DENABLE_TESTS=${if doCheck then "ON" else "OFF"}"
+  ];

+  doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
+  checkInputs = [ check ];
  checkPhase = ''
    runHook preCheck
    ctest -VV
--- a/pkgs/applications/networking/mailreaders/astroid/default.nix
+++ b/pkgs/applications/networking/mailreaders/astroid/default.nix
@ -1,22 +1,44 @@
-{ stdenv, fetchFromGitHub, cmake, pkgconfig, gnome3, gmime3, webkitgtk24x-gtk3
-, libsass, notmuch, boost, wrapGAppsHook, glib-networking }:
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, gnome3, gmime3, webkitgtk
+, libsass, notmuch, boost, wrapGAppsHook, glib-networking, protobuf, vim_configurable
+, makeWrapper, python3, python3Packages
+, vim ? vim_configurable.override {
+                    features = "normal";
+                    gui = "auto";
+                  }
+}:

 stdenv.mkDerivation rec {
  name = "astroid-${version}";
-  version = "0.11.1";
+  version = "0.13";

  src = fetchFromGitHub {
    owner = "astroidmail";
    repo = "astroid";
    rev = "v${version}";
-    sha256 = "1z48rvlzwi7bq7j55rnb0gg1a4k486yj910z2cxz1p46lxk332j1";
+    sha256 = "105x5g44hng3fi03h67j3an53088148jbq8726nmcp0zs0cy9gac";
  };

  nativeBuildInputs = [ cmake pkgconfig wrapGAppsHook ];

-  buildInputs = [ gnome3.gtkmm gmime3 webkitgtk24x-gtk3 libsass gnome3.libpeas
-                  notmuch boost gnome3.gsettings-desktop-schemas
-                  glib-networking ];
+  buildInputs = [ gnome3.gtkmm gmime3 webkitgtk libsass gnome3.libpeas
+                  python3 python3Packages.pygobject3
+                  notmuch boost gnome3.gsettings-desktop-schemas gnome3.defaultIconTheme
+                  glib-networking protobuf ] ++ (if vim == null then [] else [ vim ]);
+
+  patches = [
+    # TODO: remove when https://github.com/astroidmail/astroid/pull/531
+    #       is released
+    ./run_tests.diff
+  ];
+
+  postPatch = ''
+    sed -i "s~gvim ~${vim}/bin/vim -g ~g" src/config.cc
+    sed -i "s~ -geom 10x10~~g" src/config.cc
+  '';
+
+  postInstall = ''
+    wrapProgram "$out/bin/astroid" --set CHARSET=en_us.UTF-8
+  '';

  meta = with stdenv.lib; {
    homepage = https://astroidmail.github.io/;
--- a/pkgs/applications/networking/mailreaders/astroid/run_tests.diff
+++ b/pkgs/applications/networking/mailreaders/astroid/run_tests.diff
@ -0,0 +1,10 @@
+diff --git a/tests/run_test.sh b/tests/run_test.sh
+index f2ea7d7..927c61d 100755
+--- a/tests/run_test.sh
+++ b/tests/run_test.sh
+@@ -1,4 +1,4 @@
+-#! /bin/bash
+#! /usr/bin/env bash
+ #
+ # Set up environment and run test specified on command line
+ 
--- a/pkgs/applications/networking/seafile-client/default.nix
+++ b/pkgs/applications/networking/seafile-client/default.nix
@ -5,14 +5,14 @@
 with stdenv.lib;

 stdenv.mkDerivation rec {
-  version = "6.2.3";
+  version = "6.2.4";
  name = "seafile-client-${version}";

  src = fetchFromGitHub {
    owner = "haiwen";
    repo = "seafile-client";
    rev = "v${version}";
-    sha256 = "1wdpz7vxhn9mcc7kxhrz9c5dwd492akirz351wfi4xxy5np6p6kp";
+    sha256 = "0z5li1d7ipsm1mp0lk6mls220v4vlmsqm8ym8kxlkinqbmkky0hz";
  };

  nativeBuildInputs = [ pkgconfig cmake makeWrapper ];
--- a/pkgs/applications/networking/sniffers/wireshark/cmake.patch
+++ b/pkgs/applications/networking/sniffers/wireshark/cmake.patch
@ -1,19 +0,0 @@
--- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -19,6 +19,7 @@
- # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- #
- 
-+cmake_minimum_required(VERSION 3.7)
- project(Wireshark C CXX)
- 
- # Updated by make-version.pl
-@@ -40,7 +41,7 @@
- 	# Needed for GREATER_EQUAL operator
- 	cmake_minimum_required(VERSION 3.7)
- else()
-	cmake_minimum_required(VERSION 2.8.8)
-+	cmake_minimum_required(VERSION 3.7)
- endif()
- 
- # Needs to be set after cmake_minimum_required or cmake_policy(VERSION)
--- a/pkgs/applications/networking/sniffers/wireshark/default.nix
+++ b/pkgs/applications/networking/sniffers/wireshark/default.nix
@ -49,8 +49,11 @@ in stdenv.mkDerivation {
      name = "fix-timeout.patch";
      url = "https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commitdiff_plain;h=8b5b843fcbc3e03e0fc45f3caf8cf5fc477e8613;hp=94af9724d140fd132896b650d10c4d060788e4f0";
      sha256 = "1g2dm7lwsnanwp68b9xr9swspx7hfj4v3z44sz3yrfmynygk8zlv";
-    })
-    ++ stdenv.lib.optional stdenv.isDarwin ./cmake.patch;
+    });
+
+  postPatch = ''
+    sed -i -e '1i cmake_policy(SET CMP0025 NEW)' CMakeLists.txt
+  '';

  preBuild = ''
    export LD_LIBRARY_PATH="$PWD/run"
--- a/pkgs/applications/science/biology/bowtie2/default.nix
+++ b/pkgs/applications/science/biology/bowtie2/default.nix
@ -2,14 +2,14 @@

 stdenv.mkDerivation rec {
  pname = "bowtie2";
-  version = "2.3.4.1";
+  version = "2.3.4.2";
  name = "${pname}-${version}";

  src = fetchFromGitHub {
    owner = "BenLangmead";
    repo = pname;
    rev = "v${version}";
-    sha256 = "07cvcy6483araayj41arjzpxjmf4fmn4iqyl6gp6zmrbzw72wwzj";
+    sha256 = "1gsfaf7rjg4nwhs7vc1vf63xd5r5v1yq58w7x3barycplzbvixzz";
  };

  buildInputs = [ zlib tbb ];
@ -22,5 +22,6 @@ stdenv.mkDerivation rec {
    homepage = http://bowtie-bio.sf.net/bowtie2;
    maintainers = with maintainers; [ rybern ];
    platforms = platforms.all;
+    broken = stdenv.isAarch64;
  };
 }
--- a/pkgs/applications/science/electronics/eagle/eagle.nix
+++ b/pkgs/applications/science/electronics/eagle/eagle.nix
@ -0,0 +1,83 @@
+{ stdenv, fetchurl, makeDesktopItem, patchelf
+, libXrender, libXrandr, libXcursor, libX11, libXext, libXi, libxcb
+, cups , libGL, glib, nss, nspr, expat, alsaLib
+, qtbase, qtdeclarative, qtsvg, qtlocation, qtwebchannel, qtwebengine
+}:
+
+let
+  libPath = stdenv.lib.makeLibraryPath
+    [ libXrender libXrandr libXcursor libX11 libXext libXi libxcb
+      libGL glib nss nspr expat alsaLib
+      qtbase qtdeclarative qtsvg qtlocation qtwebchannel qtwebengine
+    ];
+  in
+  stdenv.mkDerivation rec {
+    name = "eagle-${version}";
+    version = "9.1.2";
+
+    src = fetchurl {
+      url = "https://eagle-updates.circuits.io/downloads/${builtins.replaceStrings ["."] ["_"] version}/Autodesk_EAGLE_${version}_English_Linux_64bit.tar.gz";
+      sha256 = "0y7ahl9z5a7l9cjk8hzmyv6ga8chlry5rr8v116q5mnsgs4i11an";
+    };
+
+    desktopItem = makeDesktopItem {
+      name = "eagle";
+      exec = "eagle";
+      icon = "eagle";
+      comment = "Schematic capture and PCB layout";
+      desktopName = "Eagle";
+      genericName = "Schematic editor";
+      categories = "Application;Development;";
+    };
+
+    buildInputs =
+      [ libXrender libXrandr libXcursor libX11 libXext libXi libxcb
+        libGL glib nss nspr expat alsaLib
+        qtbase qtdeclarative qtsvg qtlocation qtwebchannel qtwebengine
+      ];
+
+    doConfigure = false;
+    doBuild = false;
+
+    installPhase = ''
+      # Extract eagle tarball
+      mkdir "$out"
+      tar -xzf "$src" -C "$out"
+
+      # Install manpage
+      mkdir -p "$out"/share/man/man1
+      ln -s "$out"/eagle-${version}/doc/eagle.1 "$out"/share/man/man1/eagle.1
+
+      patchelf \
+        --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+        --set-rpath "${libPath}:$out/eagle-${version}/lib:${stdenv.cc.cc.lib}/lib" \
+        "$out"/eagle-${version}/eagle
+
+      mkdir -p "$out"/bin
+      ln -s "$out"/eagle-${version}/eagle "$out"/bin/eagle
+
+      # Remove bundled libraries that are available in nixpkgs
+      # TODO: There still may be unused bundled libraries
+      rm "$out"/eagle-${version}/lib/libQt5*.so.5
+      rm "$out"/eagle-${version}/lib/{libxcb-*.so.*,libX*.so.*,libxshmfence.so.1}
+      rm "$out"/eagle-${version}/lib/{libEGL.so.1,libglapi.so.0,libgbm.so.1}
+
+      # No longer needed (we don't use the bundled Qt libraries)
+      rm -r "$out"/eagle-${version}/libexec
+      rm -r "$out"/eagle-${version}/plugins
+
+      # Make desktop item
+      mkdir -p "$out"/share/applications
+      cp "$desktopItem"/share/applications/* "$out"/share/applications/
+      mkdir -p "$out"/share/icons
+      ln -s "$out/eagle-${version}/bin/eagle-logo.png" "$out"/share/icons/eagle.png
+    '';
+
+    meta = with stdenv.lib; {
+      description = "Schematic editor and PCB layout tool from Autodesk (formerly CadSoft)";
+      homepage = https://www.autodesk.com/products/eagle/overview;
+      license = licenses.unfree;
+      platforms = [ "x86_64-linux" ];
+      maintainers = [ maintainers.rittelle ];
+    };
+  }
--- a/pkgs/applications/science/electronics/eagle/default.nix
+++ b/pkgs/applications/science/electronics/eagle/default.nix
@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
    # Build LD_PRELOAD library that redirects license file access to the home
    # directory of the user
    mkdir -p "$out"/lib
-    gcc -shared -fPIC -DEAGLE_PATH=\"$out/eagle-${version}\" ${./eagle_fixer.c} -o "$out"/lib/eagle_fixer.so -ldl
+    gcc -shared -fPIC -DEAGLE_PATH=\"$out/eagle-${version}\" ${./eagle7_fixer.c} -o "$out"/lib/eagle_fixer.so -ldl

    # Make wrapper script
    dynlinker="$(cat $NIX_CC/nix-support/dynamic-linker)"
--- a/pkgs/applications/science/electronics/eagle/eagle7_fixer.c
+++ b/pkgs/applications/science/electronics/eagle/eagle7_fixer.c
--- a/pkgs/applications/science/logic/aiger/default.nix
+++ b/pkgs/applications/science/logic/aiger/default.nix
@ -12,6 +12,9 @@ stdenv.mkDerivation rec {
  enableParallelBuilding = true;

  configurePhase = ''
+    CC=${stdenv.cc.targetPrefix}cc
+    CXX=${stdenv.cc.targetPrefix}c++
+
    # Set up picosat, so we can build 'aigbmc'
    mkdir ../picosat
    ln -s ${picosat}/include/picosat/picosat.h ../picosat/picosat.h
--- a/pkgs/applications/science/logic/verit/default.nix
+++ b/pkgs/applications/science/logic/verit/default.nix
@ -15,6 +15,11 @@ stdenv.mkDerivation rec {
  # --disable-static actually enables static linking here...
  dontDisableStatic = true;

+  preConfigure = ''
+    CC=${stdenv.cc.targetPrefix}gcc
+    CXX=${stdenv.cc.targetPrefix}g++
+  '';
+
  makeFlags = [ "LEX=${flex}/bin/flex" ];

  preInstall = ''
--- a/pkgs/applications/science/math/ginac/default.nix
+++ b/pkgs/applications/science/math/ginac/default.nix
@ -22,6 +22,7 @@ stdenv.mkDerivation rec {
    description = "GiNaC is Not a CAS";
    homepage    = http://www.ginac.de/;
    maintainers = with maintainers; [ lovek323 ];
+    license = licenses.gpl2;
    platforms   = platforms.all;
  };
 }
--- a/pkgs/applications/science/math/glsurf/default.nix
+++ b/pkgs/applications/science/math/glsurf/default.nix
@ -26,5 +26,6 @@ stdenv.mkDerivation {
  meta = {
    homepage = http://www.lama.univ-savoie.fr/~raffalli/glsurf;
    description = "A program to draw implicit surfaces and curves";
+    license = stdenv.lib.licenses.lgpl21;
  };
 }
--- a/pkgs/applications/version-management/fossil/default.nix
+++ b/pkgs/applications/version-management/fossil/default.nix
@ -21,10 +21,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ tcl ];

  doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
-
-  checkTarget = "test";
-
-  preCheck = stdenv.lib.optional doCheck ''
+  preCheck = ''
    export TCLLIBPATH="${tcllib}/lib/tcllib${tcllib.version}"
  '';
  configureFlags = stdenv.lib.optional withJson "--json";
--- a/pkgs/applications/version-management/gitkraken/default.nix
+++ b/pkgs/applications/version-management/gitkraken/default.nix
@ -12,11 +12,11 @@ let
 in
 stdenv.mkDerivation rec {
  name = "gitkraken-${version}";
-  version = "4.0.1";
+  version = "4.0.2";

  src = fetchurl {
    url = "https://release.gitkraken.com/linux/v${version}.deb";
-    sha256 = "0y4r5d21mxwnwla9ggy9c4pm3zbz67yi9z06znkdz9x2chv1ci3n";
+    sha256 = "0dnckd75fcgc9wa4ivbnw2djmk4phzzr891snhxpsvb1dhlc7rgx";
  };

  libPath = makeLibraryPath [
--- a/pkgs/applications/version-management/gitlab/default.nix
+++ b/pkgs/applications/version-management/gitlab/default.nix
@ -104,4 +104,10 @@ stdenv.mkDerivation rec {
    inherit rubyEnv;
    ruby = rubyEnv.wrappedRuby;
  };
+
+  meta = with stdenv.lib; {
+    description = "Web-based Git-repository manager";
+    homepage = https://gitlab.com;
+    license = licenses.mit;
+  };
 }
--- a/pkgs/applications/version-management/mr/default.nix
+++ b/pkgs/applications/version-management/mr/default.nix
@ -10,6 +10,10 @@ stdenv.mkDerivation rec {
    sha256 = "15i9bs2i25l7ibv530ghy8280kklcgm5kr6j86s7iwcqqckd0czp";
  };

+  postPatch = ''
+    patchShebangs .
+  '';
+
  buildInputs = [ perl ];

  makeFlags = "PREFIX=$(out)";
--- a/pkgs/applications/version-management/redmine/2002_FHS_through_env_vars.patch
+++ b/pkgs/applications/version-management/redmine/2002_FHS_through_env_vars.patch
@ -1,100 +0,0 @@
-Description: FHS through env vars
-Forwarded: not-needed
-Author: Jérémy Lal <kapouer@melix.org>
-Last-Update: 2013-09-28
--- redmine.orig/app/models/attachment.rb
-+++ redmine/app/models/attachment.rb
-@@ -46,10 +46,10 @@ class Attachment < ActiveRecord::Base
-                                                         "LEFT JOIN #{Project.table_name} ON #{Document.table_name}.project_id = #{Project.table_name}.id"}
- 
-   cattr_accessor :storage_path
-  @@storage_path = Redmine::Configuration['attachments_storage_path'] || File.join(Rails.root, "files")
-+  @@storage_path = Redmine::Configuration['attachments_storage_path'] || ENV['RAILS_VAR'] ? File.join(ENV['RAILS_VAR'], "files") : File.join(Rails.root, "files")
- 
-   cattr_accessor :thumbnails_storage_path
-  @@thumbnails_storage_path = File.join(Rails.root, "tmp", "thumbnails")
-+  @@thumbnails_storage_path = ENV['RAILS_TMP'] ? File.join(ENV['RAILS_TMP'], "thumbnails") : File.join(Rails.root, "tmp", "thumbnails")
- 
-   before_save :files_to_final_location
-   after_destroy :delete_from_disk
--- redmine.orig/lib/redmine/configuration.rb
-+++ redmine/lib/redmine/configuration.rb
-@@ -32,7 +32,7 @@ module Redmine
-       # * <tt>:file</tt>: the configuration file to load (default: config/configuration.yml)
-       # * <tt>:env</tt>: the environment to load the configuration for (default: Rails.env)
-       def load(options={})
-        filename = options[:file] || File.join(Rails.root, 'config', 'configuration.yml')
-+        filename = options[:file] || ENV['RAILS_ETC'] ? File.join(ENV['RAILS_ETC'], 'configuration.yml') : File.join(Rails.root, 'config', 'configuration.yml')
-         env = options[:env] || Rails.env
- 
-         @config = @defaults.dup
-@@ -103,7 +103,7 @@ module Redmine
-       end
- 
-       def load_deprecated_email_configuration(env)
-        deprecated_email_conf = File.join(Rails.root, 'config', 'email.yml')
-+        deprecated_email_conf = ENV['RAILS_ETC'] ? File.join(ENV['RAILS_ETC'], 'email.yml') : File.join(Rails.root, 'config', 'email.yml')
-         if File.file?(deprecated_email_conf)
-           warn "Storing outgoing emails configuration in config/email.yml is deprecated. You should now store it in config/configuration.yml using the email_delivery setting."
-           @config.merge!({'email_delivery' => load_from_yaml(deprecated_email_conf, env)})
--- redmine.orig/lib/redmine/export/pdf.rb
-+++ redmine/lib/redmine/export/pdf.rb
-@@ -38,7 +38,7 @@ module Redmine
-         attr_accessor :footer_date
- 
-         def initialize(lang, orientation='P')
-          @@k_path_cache = Rails.root.join('tmp', 'pdf')
-+          @@k_path_cache = ENV['RAILS_TMP'] ? File.join(ENV['RAILS_TMP'], 'pdf') : Rails.root.join('tmp', 'pdf')
-           FileUtils.mkdir_p @@k_path_cache unless File::exist?(@@k_path_cache)
-           set_language_if_valid lang
-           pdf_encoding = l(:general_pdf_encoding).upcase
--- redmine.orig/config/application.rb
-+++ redmine/config/application.rb
-@@ -52,8 +63,21 @@ module RedmineApp
-     # Do not include all helpers
-     config.action_controller.include_all_helpers = false
- 
-+    # move tmp directory to RAILS_TMP
-+    config.paths['tmp'] = ENV['RAILS_TMP']
-+
-     config.session_store :cookie_store, :key => '_redmine_session'
- 
-+    # log path
-+    config.paths['log'] = File.join(ENV['RAILS_LOG'], "#{Rails.env}.log") unless !ENV['RAILS_LOG']
-+
-+    config.paths['public'] = ENV['RAILS_PUBLIC'] unless !ENV['RAILS_PUBLIC']
-+
-+    config.cache_store = :file_store, File.join(ENV['RAILS_TMP'], "cache")
-+
-+    # Set Active Record's database.yml path
-+    config.paths['config/database'] = File.join(ENV['RAILS_ETC'], 'database.yml') unless !ENV['RAILS_ETC']
-+
-     if File.exists?(File.join(File.dirname(__FILE__), 'additional_environment.rb'))
-       instance_eval File.read(File.join(File.dirname(__FILE__), 'additional_environment.rb'))
-     end
--- redmine.orig/lib/plugins/rfpdf/lib/tcpdf.rb
-+++ redmine/lib/plugins/rfpdf/lib/tcpdf.rb
-@@ -89,10 +89,10 @@ class TCPDF
-   @@k_small_ratio = 2/3.0
-   
-   cattr_accessor :k_path_cache
-  @@k_path_cache = Rails.root.join('tmp')
-+  @@k_path_cache = ENV['RAILS_TMP'] ? ENV['RAILS_TMP'] : Rails.root.join('tmp')
-   
-   cattr_accessor :k_path_url_cache
-  @@k_path_url_cache = Rails.root.join('tmp')
-+  @@k_path_url_cache = ENV['RAILS_TMP'] ? ENV['RAILS_TMP'] : Rails.root.join('tmp')
-   
- 	attr_accessor :barcode
- 	
--- redmine.orig/lib/redmine/scm/adapters/abstract_adapter.rb
-+++ redmine/lib/redmine/scm/adapters/abstract_adapter.rb
-@@ -222,7 +222,7 @@ module Redmine
-           if @stderr_log_file.nil?
-             writable = false
-             path = Redmine::Configuration['scm_stderr_log_file'].presence
-            path ||= Rails.root.join("log/#{Rails.env}.scm.stderr.log").to_s
-+            path ||= ENV['RAILS_LOG'] ? File.join(ENV['RAILS_LOG'], "#{Rails.env}.scm.stderr.log").to_s : Rails.root.join("log/#{Rails.env}.scm.stderr.log").to_s
-             if File.exists?(path)
-               if File.file?(path) && File.writable?(path) 
-                 writable = true
--- a/pkgs/applications/version-management/redmine/2003_externalize_session_config.patch
+++ b/pkgs/applications/version-management/redmine/2003_externalize_session_config.patch
@ -1,72 +0,0 @@
-Description: Externalize session config to yml in /etc
-Forwarded: not-needed
-Author: Jérémy Lal <kapouer@melix.org>
-Last-Update: 2010-01-10
--- redmine.orig/lib/tasks/initializers.rake
-+++ redmine/lib/tasks/initializers.rake
-@@ -1,11 +1,12 @@
- desc 'Generates a secret token for the application.'
-+task :generate_secret_token do
- 
-file 'config/initializers/secret_token.rb' do
-  path = File.join(Rails.root, 'config', 'initializers', 'secret_token.rb')
-  secret = SecureRandom.hex(40)
-  File.open(path, 'w') do |f|
-    f.write <<"EOF"
-# This file was generated by 'rake generate_secret_token', and should
-+filename = ENV['YML_SESSION_FILENAME'] ? ENV['YML_SESSION_FILENAME'] : 'session.yml'
-+path = File.join(ENV['RAILS_ETC'] ? ENV['RAILS_ETC'] : File.join(Rails.root, 'config'), filename)
-+secret = SecureRandom.hex(40)
-+File.open(path, 'w') do |f|
-+  f.write <<"EOF"
-+# This file was generated by 'rake generate_session_store',
- # not be made visible to public.
- # If you have a load-balancing Redmine cluster, you will need to use the
- # same version of this file on each machine. And be sure to restart your
-@@ -15,10 +18,18 @@ file 'config/initializers/secret_token.r
- # change this key, all old sessions will become invalid! Make sure the
- # secret is at least 30 characters and all random, no regular words or
- # you'll be exposed to dictionary attacks.
-RedmineApp::Application.config.secret_token = '#{secret}'
-+
-+production:
-+  key: _redmine_
-+  secret: #{secret}
-+
-+development:
-+  key: _redmine_
-+  secret: #{secret}
-+
-+test:
-+  key: _redmine_
-+  secret: #{secret}
- EOF
-   end
- end
-
-desc 'Generates a secret token for the application.'
-task :generate_secret_token => ['config/initializers/secret_token.rb']
--- redmine.orig/config/application.rb
-+++ redmine/config/application.rb
-@@ -66,7 +66,20 @@ module RedmineApp
-     # move tmp directory to RAILS_TMP
-     config.paths['tmp'] = ENV['RAILS_TMP']
- 
-    config.session_store :cookie_store, :key => '_redmine_session'
-+    # loads cookie based session session and secret keys
-+    # this is needed here because initializers are loaded after plugins,
-+    # and some plugins initialize ActionController which requires a secret to be set.
-+    # crash if file not found
-+    relativeUrlRoot = ENV['RAILS_RELATIVE_URL_ROOT']
-+    filename = ENV['RAILS_ETC'] ? File.join(ENV['RAILS_ETC'], 'session.yml') : File.join(File.dirname(__FILE__), '..', 'session.yml')
-+    if File.exists?(filename)
-+      sessionconfig = YAML::load_file(filename)
-+      config.session_store :cookie_store, :key => sessionconfig[Rails.env]['key'], :path => (relativeUrlRoot.blank?) ? '/' : relativeUrlRoot
-+      config.secret_token = sessionconfig[Rails.env]['secret']
-+    else
-+      # temporary settings before session.yml is created
-+      config.session_store :cookie_store, :key => '_redmine_session', :path => (relativeUrlRoot.blank?) ? '/' : relativeUrlRoot
-+    end
- 
-     # log path
-     config.paths['log'] = File.join(ENV['RAILS_LOG'], "#{Rails.env}.log") unless !ENV['RAILS_LOG']
--- a/pkgs/applications/version-management/redmine/2004_FHS_plugins_assets.patch
+++ b/pkgs/applications/version-management/redmine/2004_FHS_plugins_assets.patch
@ -1,11 +0,0 @@
--- redmine.orig/lib/redmine/plugin.rb
-+++ redmine/lib/redmine/plugin.rb
-@@ -47,7 +47,7 @@ module Redmine #:nodoc:
-     self.directory = File.join(Rails.root, 'plugins')
- 
-     cattr_accessor :public_directory
-    self.public_directory = File.join(Rails.root, 'public', 'plugin_assets')
-+    self.public_directory = ENV['RAILS_TMP'] ? File.join(ENV['RAILS_TMP'], 'plugin_assets') : File.join(Rails.root, 'public', 'plugin_assets')
- 
-     @registered_plugins = {}
-     class << self
--- a/pkgs/applications/version-management/redmine/Gemfile
+++ b/pkgs/applications/version-management/redmine/Gemfile
@ -0,0 +1,120 @@
+source 'https://rubygems.org'
+
+if Gem::Version.new(Bundler::VERSION) < Gem::Version.new('1.5.0')
+  abort "Redmine requires Bundler 1.5.0 or higher (you're using #{Bundler::VERSION}).\nPlease update with 'gem update bundler'."
+end
+
+gem "rails", "4.2.8"
+gem "addressable", "2.4.0" if RUBY_VERSION < "2.0"
+if RUBY_VERSION < "2.1"
+  gem "public_suffix", (RUBY_VERSION < "2.0" ? "~> 1.4" : "~> 2.0.5")
+end
+gem "jquery-rails", "~> 3.1.4"
+gem "coderay", "~> 1.1.1"
+gem "request_store", "1.0.5"
+gem "mime-types", (RUBY_VERSION >= "2.0" ? "~> 3.0" : "~> 2.99")
+gem "protected_attributes"
+gem "actionpack-xml_parser"
+gem "roadie-rails", "~> 1.1.1"
+gem "roadie", "~> 3.2.1"
+gem "mimemagic"
+gem "mail", "~> 2.6.4"
+
+gem "nokogiri", (RUBY_VERSION >= "2.1" ? "~> 1.8.1" : "~> 1.6.8")
+gem "i18n", "~> 0.7.0"
+gem "ffi", "1.9.14", :platforms => :mingw if RUBY_VERSION < "2.0"
+
+# Request at least rails-html-sanitizer 1.0.3 because of security advisories
+gem "rails-html-sanitizer", ">= 1.0.3"
+
+# Windows does not include zoneinfo files, so bundle the tzinfo-data gem
+gem 'tzinfo-data', platforms: [:mingw, :x64_mingw, :mswin]
+gem "rbpdf", "~> 1.19.3"
+
+# Optional gem for LDAP authentication
+group :ldap do
+  gem "net-ldap", "~> 0.12.0"
+end
+
+# Optional gem for OpenID authentication
+group :openid do
+  gem "ruby-openid", "~> 2.3.0", :require => "openid"
+  gem "rack-openid"
+end
+
+platforms :mri, :mingw, :x64_mingw do
+  # Optional gem for exporting the gantt to a PNG file, not supported with jruby
+  group :rmagick do
+    gem "rmagick", ">= 2.14.0"
+  end
+
+  # Optional Markdown support, not for JRuby
+  group :markdown do
+    gem "redcarpet", "~> 3.4.0"
+  end
+end
+
+# Include database gems for the adapters found in the database
+# configuration file
+require 'erb'
+require 'yaml'
+
+# NixOS - manually added to ensure mysql and postgres will always be include
+gem "mysql2", "~> 0.4.6", :platforms => [:mri, :mingw, :x64_mingw]
+gem "pg", "~> 0.18.1", :platforms => [:mri, :mingw, :x64_mingw]
+
+database_file = File.join(File.dirname(__FILE__), "config/database.yml")
+if File.exist?(database_file)
+  database_config = YAML::load(ERB.new(IO.read(database_file)).result)
+  adapters = database_config.values.map {|c| c['adapter']}.compact.uniq
+  if adapters.any?
+    adapters.each do |adapter|
+      case adapter
+      when 'mysql2'
+        gem "mysql2", "~> 0.4.6", :platforms => [:mri, :mingw, :x64_mingw]
+      when /postgresql/
+        gem "pg", "~> 0.18.1", :platforms => [:mri, :mingw, :x64_mingw]
+      when /sqlite3/
+        gem "sqlite3", (RUBY_VERSION < "2.0" && RUBY_PLATFORM =~ /mingw/ ? "1.3.12" : "~>1.3.12"),
+                       :platforms => [:mri, :mingw, :x64_mingw]
+      when /sqlserver/
+        gem "tiny_tds", (RUBY_VERSION >= "2.0" ? "~> 1.0.5" : "~> 0.7.0"), :platforms => [:mri, :mingw, :x64_mingw]
+        gem "activerecord-sqlserver-adapter", :platforms => [:mri, :mingw, :x64_mingw]
+      else
+        warn("Unknown database adapter `#{adapter}` found in config/database.yml, use Gemfile.local to load your own database gems")
+      end
+    end
+  else
+    warn("No adapter found in config/database.yml, please configure it first")
+  end
+else
+  warn("Please configure your config/database.yml first")
+end
+
+# NixOS - manually removed because I couldn't figure out how to get "bundle exec rails server webrick -e production" to ignore these groups
+#group :development do
+#  gem "rdoc", "~> 4.3"
+#  gem "yard"
+#end
+
+#group :test do
+#  gem "minitest"
+#  gem "rails-dom-testing"
+#  gem "mocha"
+#  gem "simplecov", "~> 0.9.1", :require => false
+#  # TODO: remove this after upgrading to Rails 5
+#  gem "test_after_commit", "~> 0.4.2"
+#  # For running UI tests
+#  gem "capybara"
+#  gem "selenium-webdriver", "~> 2.53.4"
+#end
+
+local_gemfile = File.join(File.dirname(__FILE__), "Gemfile.local")
+if File.exists?(local_gemfile)
+  eval_gemfile local_gemfile
+end
+
+# Load plugins' Gemfiles
+Dir.glob File.expand_path("../plugins/*/{Gemfile,PluginGemfile}", __FILE__) do |file|
+  eval_gemfile file
+end
--- a/pkgs/applications/version-management/redmine/Gemfile.lock
+++ b/pkgs/applications/version-management/redmine/Gemfile.lock
@ -1,152 +1,162 @@
 GEM
  remote: https://rubygems.org/
  specs:
-    actionmailer (3.2.19)
-      actionpack (= 3.2.19)
-      mail (~> 2.5.4)
-    actionpack (3.2.19)
-      activemodel (= 3.2.19)
-      activesupport (= 3.2.19)
-      builder (~> 3.0.0)
+    actionmailer (4.2.8)
+      actionpack (= 4.2.8)
+      actionview (= 4.2.8)
+      activejob (= 4.2.8)
+      mail (~> 2.5, >= 2.5.4)
+      rails-dom-testing (~> 1.0, >= 1.0.5)
+    actionpack (4.2.8)
+      actionview (= 4.2.8)
+      activesupport (= 4.2.8)
+      rack (~> 1.6)
+      rack-test (~> 0.6.2)
+      rails-dom-testing (~> 1.0, >= 1.0.5)
+      rails-html-sanitizer (~> 1.0, >= 1.0.2)
+    actionpack-xml_parser (1.0.2)
+      actionpack (>= 4.0.0, < 5)
+    actionview (4.2.8)
+      activesupport (= 4.2.8)
+      builder (~> 3.1)
      erubis (~> 2.7.0)
-      journey (~> 1.0.4)
-      rack (~> 1.4.5)
-      rack-cache (~> 1.2)
-      rack-test (~> 0.6.1)
-      sprockets (~> 2.2.1)
-    activemodel (3.2.19)
-      activesupport (= 3.2.19)
-      builder (~> 3.0.0)
-    activerecord (3.2.19)
-      activemodel (= 3.2.19)
-      activesupport (= 3.2.19)
-      arel (~> 3.0.2)
-      tzinfo (~> 0.3.29)
-    activeresource (3.2.19)
-      activemodel (= 3.2.19)
-      activesupport (= 3.2.19)
-    activesupport (3.2.19)
-      i18n (~> 0.6, >= 0.6.4)
-      multi_json (~> 1.0)
-    arel (3.0.3)
-    awesome_nested_set (2.1.6)
-      activerecord (>= 3.0.0)
-    builder (3.0.0)
-    capybara (2.1.0)
-      mime-types (>= 1.16)
-      nokogiri (>= 1.3.3)
-      rack (>= 1.0.0)
-      rack-test (>= 0.5.4)
-      xpath (~> 2.0)
-    childprocess (0.5.5)
-      ffi (~> 1.0, >= 1.0.11)
-    coderay (1.1.0)
+      rails-dom-testing (~> 1.0, >= 1.0.5)
+      rails-html-sanitizer (~> 1.0, >= 1.0.3)
+    activejob (4.2.8)
+      activesupport (= 4.2.8)
+      globalid (>= 0.3.0)
+    activemodel (4.2.8)
+      activesupport (= 4.2.8)
+      builder (~> 3.1)
+    activerecord (4.2.8)
+      activemodel (= 4.2.8)
+      activesupport (= 4.2.8)
+      arel (~> 6.0)
+    activesupport (4.2.8)
+      i18n (~> 0.7)
+      minitest (~> 5.1)
+      thread_safe (~> 0.3, >= 0.3.4)
+      tzinfo (~> 1.1)
+    addressable (2.5.2)
+      public_suffix (>= 2.0.2, < 4.0)
+    arel (6.0.4)
+    builder (3.2.3)
+    coderay (1.1.2)
+    concurrent-ruby (1.0.5)
+    crass (1.0.4)
+    css_parser (1.6.0)
+      addressable
    erubis (2.7.0)
-    fastercsv (1.5.5)
-    ffi (1.9.5)
-    hike (1.2.3)
-    i18n (0.6.11)
-    journey (1.0.4)
-    jquery-rails (2.0.3)
-      railties (>= 3.1.0, < 5.0)
-      thor (~> 0.14)
-    json (1.8.3)
-    mail (2.5.4)
-      mime-types (~> 1.16)
-      treetop (~> 1.4.8)
-    metaclass (0.0.4)
-    mime-types (1.25.1)
-    mini_portile (0.6.0)
-    mocha (1.0.0)
-      metaclass (~> 0.0.1)
-    multi_json (1.10.1)
-    net-ldap (0.3.1)
-    nokogiri (1.6.3.1)
-      mini_portile (= 0.6.0)
-    pg (0.17.1)
-    polyglot (0.3.5)
-    rack (1.4.5)
-    rack-cache (1.2)
-      rack (>= 0.4)
+    globalid (0.4.1)
+      activesupport (>= 4.2.0)
+    htmlentities (4.3.4)
+    i18n (0.7.0)
+    jquery-rails (3.1.5)
+      railties (>= 3.0, < 5.0)
+      thor (>= 0.14, < 2.0)
+    loofah (2.2.2)
+      crass (~> 1.0.2)
+      nokogiri (>= 1.5.9)
+    mail (2.6.6)
+      mime-types (>= 1.16, < 4)
+    mime-types (3.2.2)
+      mime-types-data (~> 3.2015)
+    mime-types-data (3.2018.0812)
+    mimemagic (0.3.2)
+    mini_portile2 (2.3.0)
+    minitest (5.11.3)
+    mysql2 (0.4.10)
+    net-ldap (0.12.1)
+    nokogiri (1.8.4)
+      mini_portile2 (~> 2.3.0)
+    pg (0.18.4)
+    protected_attributes (1.1.4)
+      activemodel (>= 4.0.1, < 5.0)
+    public_suffix (3.0.3)
+    rack (1.6.10)
    rack-openid (1.4.2)
      rack (>= 1.1.0)
      ruby-openid (>= 2.1.8)
-    rack-ssl (1.3.4)
-      rack
-    rack-test (0.6.2)
+    rack-test (0.6.3)
      rack (>= 1.0)
-    rails (3.2.19)
-      actionmailer (= 3.2.19)
-      actionpack (= 3.2.19)
-      activerecord (= 3.2.19)
-      activeresource (= 3.2.19)
-      activesupport (= 3.2.19)
-      bundler (~> 1.0)
-      railties (= 3.2.19)
-    railties (3.2.19)
-      actionpack (= 3.2.19)
-      activesupport (= 3.2.19)
-      rack-ssl (~> 1.3.2)
+    rails (4.2.8)
+      actionmailer (= 4.2.8)
+      actionpack (= 4.2.8)
+      actionview (= 4.2.8)
+      activejob (= 4.2.8)
+      activemodel (= 4.2.8)
+      activerecord (= 4.2.8)
+      activesupport (= 4.2.8)
+      bundler (>= 1.3.0, < 2.0)
+      railties (= 4.2.8)
+      sprockets-rails
+    rails-deprecated_sanitizer (1.0.3)
+      activesupport (>= 4.2.0.alpha)
+    rails-dom-testing (1.0.9)
+      activesupport (>= 4.2.0, < 5.0)
+      nokogiri (~> 1.6)
+      rails-deprecated_sanitizer (>= 1.0.1)
+    rails-html-sanitizer (1.0.4)
+      loofah (~> 2.2, >= 2.2.2)
+    railties (4.2.8)
+      actionpack (= 4.2.8)
+      activesupport (= 4.2.8)
      rake (>= 0.8.7)
-      rdoc (~> 3.4)
-      thor (>= 0.14.6, < 2.0)
-    rake (10.1.1)
-    rdoc (3.12.2)
-      json (~> 1.4)
-    redcarpet (2.3.0)
-    rmagick (2.13.3)
+      thor (>= 0.18.1, < 2.0)
+    rake (12.3.1)
+    rbpdf (1.19.5)
+      htmlentities
+      rbpdf-font (~> 1.19.0)
+    rbpdf-font (1.19.1)
+    redcarpet (3.4.0)
+    request_store (1.0.5)
+    rmagick (2.16.0)
+    roadie (3.2.2)
+      css_parser (~> 1.4)
+      nokogiri (~> 1.5)
+    roadie-rails (1.1.1)
+      railties (>= 3.0, < 5.1)
+      roadie (~> 3.1)
    ruby-openid (2.3.0)
-    rubyzip (1.1.6)
-    selenium-webdriver (2.43.0)
-      childprocess (~> 0.5)
-      multi_json (~> 1.0)
-      rubyzip (~> 1.0)
-      websocket (~> 1.0)
-    shoulda (3.3.2)
-      shoulda-context (~> 1.0.1)
-      shoulda-matchers (~> 1.4.1)
-    shoulda-context (1.0.2)
-    shoulda-matchers (1.4.1)
-      activesupport (>= 3.0.0)
-    sprockets (2.2.2)
-      hike (~> 1.2)
-      multi_json (~> 1.0)
-      rack (~> 1.0)
-      tilt (~> 1.1, != 1.3.0)
-    thor (0.19.1)
-    tilt (1.4.1)
-    treetop (1.4.15)
-      polyglot
-      polyglot (>= 0.3.1)
-    tzinfo (0.3.41)
-    websocket (1.2.1)
-    xpath (2.0.0)
-      nokogiri (~> 1.3)
-    yard (0.8.7.4)
+    sprockets (3.7.2)
+      concurrent-ruby (~> 1.0)
+      rack (> 1, < 3)
+    sprockets-rails (3.2.1)
+      actionpack (>= 4.0)
+      activesupport (>= 4.0)
+      sprockets (>= 3.0.0)
+    thor (0.20.0)
+    thread_safe (0.3.6)
+    tzinfo (1.2.5)
+      thread_safe (~> 0.1)

 PLATFORMS
  ruby

 DEPENDENCIES
-  activerecord-jdbc-adapter (~> 1.3.2)
-  activerecord-jdbcpostgresql-adapter
-  awesome_nested_set (= 2.1.6)
-  builder (= 3.0.0)
-  capybara (~> 2.1.0)
-  coderay (~> 1.1.0)
-  fastercsv (~> 1.5.0)
-  jquery-rails (~> 2.0.2)
-  mime-types
-  mocha (~> 1.0.0)
-  net-ldap (~> 0.3.1)
-  pg (>= 0.11.0)
+  actionpack-xml_parser
+  coderay (~> 1.1.1)
+  i18n (~> 0.7.0)
+  jquery-rails (~> 3.1.4)
+  mail (~> 2.6.4)
+  mime-types (~> 3.0)
+  mimemagic
+  mysql2 (~> 0.4.6)
+  net-ldap (~> 0.12.0)
+  nokogiri (~> 1.8.1)
+  pg (~> 0.18.1)
+  protected_attributes
  rack-openid
-  rails (= 3.2.19)
-  rake (~> 10.1.1)
-  rdoc (>= 2.4.2)
-  redcarpet (~> 2.3.0)
-  rmagick (>= 2.0.0)
+  rails (= 4.2.8)
+  rails-html-sanitizer (>= 1.0.3)
+  rbpdf (~> 1.19.3)
+  redcarpet (~> 3.4.0)
+  request_store (= 1.0.5)
+  rmagick (>= 2.14.0)
+  roadie (~> 3.2.1)
+  roadie-rails (~> 1.1.1)
  ruby-openid (~> 2.3.0)
-  selenium-webdriver
-  shoulda (~> 3.3.2)
-  yard
+  tzinfo-data
+
+BUNDLED WITH
+   1.16.1
--- a/pkgs/applications/version-management/redmine/Gemfile.nix
+++ b/pkgs/applications/version-management/redmine/Gemfile.nix
@ -1,332 +0,0 @@
-[
-{
-name = "actionmailer";
-hash = "cd9f0b22f755b0adeae13cf949adaf63fa1c068c72d0a100572c6a11aecd3ba7";
-url = "http://rubygems.org/downloads/actionmailer-3.2.19.gem";
-version = "3.2.19";
-}
-{
-name = "actionpack";
-hash = "c58ca2342aff2062f4f478551ce46d81918ac93200bc62d099764d2cd7499fcd";
-url = "http://rubygems.org/downloads/actionpack-3.2.19.gem";
-version = "3.2.19";
-}
-{
-name = "activemodel";
-hash = "4ea3abf790eca9ee8228e9e2a465350e258294270a639b63f0e1dfad236fe70e";
-url = "http://rubygems.org/downloads/activemodel-3.2.19.gem";
-version = "3.2.19";
-}
-{
-name = "activerecord";
-hash = "052945ad510744aaa3e35a817a6f515a2316e7dd96df6460f75b36067bb60372";
-url = "http://rubygems.org/downloads/activerecord-3.2.19.gem";
-version = "3.2.19";
-}
-{
-name = "activeresource";
-hash = "8617d24537ca937cc67aac46aaa29782510d66136605426d0a23a3585a839daf";
-url = "http://rubygems.org/downloads/activeresource-3.2.19.gem";
-version = "3.2.19";
-}
-{
-name = "activesupport";
-hash = "2c837a59250da14b12a6b0cfb6774f0afae90aa749fd96ad4347344d8417ad3d";
-url = "http://rubygems.org/downloads/activesupport-3.2.19.gem";
-version = "3.2.19";
-}
-{
-name = "arel";
-hash = "c0006e2169deee3b8cc2d258296388822eeb2db59832450b9b7316e1387d0da4";
-url = "http://rubygems.org/downloads/arel-3.0.3.gem";
-version = "3.0.3";
-}
-{
-name = "awesome_nested_set";
-hash = "0dcd801aea5048f5ab907b62b4174b6763b191eaa4e1e11bb83f996f01349af8";
-url = "http://rubygems.org/downloads/awesome_nested_set-2.1.6.gem";
-version = "2.1.6";
-}
-{
-name = "builder";
-hash = "fbd3e15e5de02245f7d649b3415b2c2875cdc9a14dccde89aa30fc14a314618e";
-url = "http://rubygems.org/downloads/builder-3.0.0.gem";
-version = "3.0.0";
-}
-{
-name = "capybara";
-hash = "a9a19f8d6bb2dfcb1f05ea3e1727cb556d1cba0d234d1712b481e8d4f7bbb91e";
-url = "http://rubygems.org/downloads/capybara-2.1.0.gem";
-version = "2.1.0";
-}
-{
-name = "childprocess";
-hash = "9b583295a11932d2eeffa1e8f5b8fb2fb0064a2f0111ad98c3b752b94f80bf33";
-url = "http://rubygems.org/downloads/childprocess-0.5.5.gem";
-version = "0.5.5";
-}
-{
-name = "coderay";
-hash = "5a943c59e36f7ef9dd2677855735656413af02e3f302431e9c548aabe89f3c15";
-url = "http://rubygems.org/downloads/coderay-1.1.0.gem";
-version = "1.1.0";
-}
-{
-name = "erubis";
-hash = "63653f5174a7997f6f1d6f465fbe1494dcc4bdab1fb8e635f6216989fb1148ba";
-url = "http://rubygems.org/downloads/erubis-2.7.0.gem";
-version = "2.7.0";
-}
-{
-name = "fastercsv";
-hash = "d098199e62e4e10eec436a9ea9b8c189dacd5c06f2825f00d1e0f1c29fdbc3b5";
-url = "http://rubygems.org/downloads/fastercsv-1.5.5.gem";
-version = "1.5.5";
-}
-{
-name = "ffi";
-hash = "0d2ef90163eef8545689e8dfc27fb1245a2d82e3500d587de1e38290629e662f";
-url = "http://rubygems.org/downloads/ffi-1.9.5.gem";
-version = "1.9.5";
-}
-{
-name = "hike";
-hash = "154e2f2593845e5bcd8ed2ba3092600c55c6ad8c630722857de3fdaf334ccc44";
-url = "http://rubygems.org/downloads/hike-1.2.3.gem";
-version = "1.2.3";
-}
-{
-name = "i18n";
-hash = "b37dda25b30484f2674a851e24ae098a38564a61c976fa91a34bf8fceaa3923b";
-url = "http://rubygems.org/downloads/i18n-0.6.11.gem";
-version = "0.6.11";
-}
-{
-name = "journey";
-hash = "7454b8612530784000fbb17ea2df749a71b70702a0ac8ebef4a1e7f05aecc10f";
-url = "http://rubygems.org/downloads/journey-1.0.4.gem";
-version = "1.0.4";
-}
-{
-name = "jquery-rails";
-hash = "cc4eab342fb3b1fcbb2fc1c9a61b09ecd86d795b1f74d607994b0bc6fd5ef444";
-url = "http://rubygems.org/downloads/jquery-rails-2.0.3.gem";
-version = "2.0.3";
-}
-{
-name = "json";
-hash = "1nsby6ry8l9xg3yw4adlhk2pnc7i0h0rznvcss4vk3v74qg0k8lc";
-url = "http://rubygems.org/downloads/json-1.8.3.gem";
-version = "1.8.3";
-}
-{
-name = "mail";
-hash = "446585c38b062121252688dcc9cc70af1f470822e30db021bb97d185969e257c";
-url = "http://rubygems.org/downloads/mail-2.5.4.gem";
-version = "2.5.4";
-}
-{
-name = "metaclass";
-hash = "8569685c902108b1845be4e5794d646f2a8adcb0280d7651b600dab0844fe942";
-url = "http://rubygems.org/downloads/metaclass-0.0.4.gem";
-version = "0.0.4";
-}
-{
-name = "mime-types";
-hash = "88ef3c596481678710ffd4018fa40f1999b02d97babea39682ba7d5badd21f56";
-url = "http://rubygems.org/downloads/mime-types-1.25.1.gem";
-version = "1.25.1";
-}
-{
-name = "mini_portile";
-hash = "762b3e241362de24b2eb2bb1b98638399b931e9e51bece5f8e2df7611eb16c26";
-url = "http://rubygems.org/downloads/mini_portile-0.6.0.gem";
-version = "0.6.0";
-}
-{
-name = "mocha";
-hash = "788fd93c8009a7e0eebd155509953e5987f4681902aad666a294283baa09899a";
-url = "http://rubygems.org/downloads/mocha-1.0.0.gem";
-version = "1.0.0";
-}
-{
-name = "multi_json";
-hash = "2c98979877e87df0b338ebf5c86091b390f53d62c11a8232bd51ca007e0b82d2";
-url = "http://rubygems.org/downloads/multi_json-1.10.1.gem";
-version = "1.10.1";
-}
-{
-name = "net-ldap";
-hash = "953551665fb0d398740a72a26314c6d34bd70fa35419c96dc58351f17d9a5081";
-url = "http://rubygems.org/downloads/net-ldap-0.3.1.gem";
-version = "0.3.1";
-}
-{
-name = "nokogiri";
-hash = "91761a654439406b5bed71adf6092d49829e26332b4c0e7c8a23a2e628442585";
-url = "http://rubygems.org/downloads/nokogiri-1.6.3.1.gem";
-version = "1.6.3.1";
-}
-{
-name = "pg";
-hash = "e7933e8f7f184c28e820ed85ddfb3ad8a13933b2b2ab8656aa8f81cb0aa610a6";
-url = "http://rubygems.org/downloads/pg-0.17.1.gem";
-version = "0.17.1";
-}
-{
-name = "polyglot";
-hash = "59d66ef5e3c166431c39cb8b7c1d02af419051352f27912f6a43981b3def16af";
-url = "http://rubygems.org/downloads/polyglot-0.3.5.gem";
-version = "0.3.5";
-}
-{
-name = "rack";
-hash = "f7bf3faa8e09a2ff26475372de36a724e7470d6bdc33d189a0ec34b49605f308";
-url = "http://rubygems.org/downloads/rack-1.4.5.gem";
-version = "1.4.5";
-}
-{
-name = "rack-cache";
-hash = "02bfed05f8b3266db804f2fa445801636ca2c6d211a3137ec796f88af5756e1c";
-url = "http://rubygems.org/downloads/rack-cache-1.2.gem";
-version = "1.2";
-}
-{
-name = "rack-openid";
-hash = "8cd2305e738463a7da98791f9ac4df4cf3f6ed27908d982350430694ac2fe869";
-url = "http://rubygems.org/downloads/rack-openid-1.4.2.gem";
-version = "1.4.2";
-}
-{
-name = "rack-ssl";
-hash = "d703764fa2a0d44a2163d6add65be89f5dba4477d1959b90d3727682a9c37dcf";
-url = "http://rubygems.org/downloads/rack-ssl-1.3.4.gem";
-version = "1.3.4";
-}
-{
-name = "rack-test";
-hash = "7e920b6aac888e4a3846e5997fb1cbf456bdb5846322b58dc31697a54a38b306";
-url = "http://rubygems.org/downloads/rack-test-0.6.2.gem";
-version = "0.6.2";
-}
-{
-name = "rails";
-hash = "33b64cf78dfcf3206d961ce03e8fe6d260081da696e60da39d0b2a4a160fe22b";
-url = "http://rubygems.org/downloads/rails-3.2.19.gem";
-version = "3.2.19";
-}
-{
-name = "railties";
-hash = "c569009ee5c005190d208ac228087fdc094b10c6f0cf209f1d12c552b447cc10";
-url = "http://rubygems.org/downloads/railties-3.2.19.gem";
-version = "3.2.19";
-}
-{
-name = "rake";
-hash = "85e446590871dd3469c80dfe70a0296c20b76a9006af6b728c1f47d0b460412d";
-url = "http://rubygems.org/downloads/rake-10.1.1.gem";
-version = "10.1.1";
-}
-{
-name = "rdoc";
-hash = "a8e2b78f7e5ec4cc4716cd863975645f2f2377dc6db267a15e427e5fae2633ed";
-url = "http://rubygems.org/downloads/rdoc-3.12.2.gem";
-version = "3.12.2";
-}
-{
-name = "redcarpet";
-hash = "5c9bcc307fba97ff5a25eec74f08365c17e929d2a5c707db32d6fc99ec81f0b9";
-url = "http://rubygems.org/downloads/redcarpet-2.3.0.gem";
-version = "2.3.0";
-}
-{
-name = "rmagick";
-hash = "109f3b8be90afdea9abbdd2a79a955cd808b5cad65d937ed12676da22870d3b4";
-url = "http://rubygems.org/downloads/rmagick-2.13.3.gem";
-version = "2.13.3";
-}
-{
-name = "ruby-openid";
-hash = "f69ed004e95f7094e23bfd8bc9ebfb1dc88a7b46637252ca2907a1189870ea7b";
-url = "http://rubygems.org/downloads/ruby-openid-2.3.0.gem";
-version = "2.3.0";
-}
-{
-name = "rubyzip";
-hash = "a996435ee9698be6a09d3748f4d23ee15aaf45cbfef1749def165af6ea3c0a9e";
-url = "http://rubygems.org/downloads/rubyzip-1.1.6.gem";
-version = "1.1.6";
-}
-{
-name = "selenium-webdriver";
-hash = "09fe4374d1541cb45403ad1238c2d88129f3afb985218635af087a06c99a521a";
-url = "http://rubygems.org/downloads/selenium-webdriver-2.43.0.gem";
-version = "2.43.0";
-}
-{
-name = "shoulda";
-hash = "52e70b71cbfb7c01dace14e268a62d86c21ddd1e5ec0116c8b1e632d8e04e412";
-url = "http://rubygems.org/downloads/shoulda-3.3.2.gem";
-version = "3.3.2";
-}
-{
-name = "shoulda-context";
-hash = "ee5559aa13248c70fdec6868a3c144adf7438c904c59d1a76b04a002e5151de5";
-url = "http://rubygems.org/downloads/shoulda-context-1.0.2.gem";
-version = "1.0.2";
-}
-{
-name = "shoulda-matchers";
-hash = "c35693cbfa84213212dffbc2c87487427ef364927340151329a842f0a06086b9";
-url = "http://rubygems.org/downloads/shoulda-matchers-1.4.1.gem";
-version = "1.4.1";
-}
-{
-name = "sprockets";
-hash = "fae893b7e86e83c1936f6f2a64db3550510f86eabdd5fa9f0f23fb25d7e0cf96";
-url = "http://rubygems.org/downloads/sprockets-2.2.2.gem";
-version = "2.2.2";
-}
-{
-name = "thor";
-hash = "9ff834f031b5550c743bb8a3139317fefdae9cdebd02d60de376658f427fe522";
-url = "http://rubygems.org/downloads/thor-0.19.1.gem";
-version = "0.19.1";
-}
-{
-name = "tilt";
-hash = "39820562c4f5db45fe18de87ccc30a0e77a998bf5334b1d8c10a2f7dbc1f5903";
-url = "http://rubygems.org/downloads/tilt-1.4.1.gem";
-version = "1.4.1";
-}
-{
-name = "treetop";
-hash = "ffa68f201c0f62c26b0a1d13233d73194400596964696843f87ebb5d812f12ff";
-url = "http://rubygems.org/downloads/treetop-1.4.15.gem";
-version = "1.4.15";
-}
-{
-name = "tzinfo";
-hash = "381b22fd1744a35d0a0239f563f505773681e626e6d900063b14cb9b1b68e98c";
-url = "http://rubygems.org/downloads/tzinfo-0.3.41.gem";
-version = "0.3.41";
-}
-{
-name = "websocket";
-hash = "e626c8c3e8593735d900265fb1fc3439fd06b394069860177d8f40733b12ae9e";
-url = "http://rubygems.org/downloads/websocket-1.2.1.gem";
-version = "1.2.1";
-}
-{
-name = "xpath";
-hash = "9ca4a1cc88d9ab16c591468cce7b5d00ee06a8a76b841f8438970c7a44c86c12";
-url = "http://rubygems.org/downloads/xpath-2.0.0.gem";
-version = "2.0.0";
-}
-{
-name = "yard";
-hash = "e65a26f9b9dc6e2aa9b1d1d2e1a45bee3edf540a6a7e6c30fa6aa1df7f7a29b4";
-url = "http://rubygems.org/downloads/yard-0.8.7.4.gem";
-version = "0.8.7.4";
-}
-]
--- a/pkgs/applications/version-management/redmine/README
+++ b/pkgs/applications/version-management/redmine/README
@ -1,6 +0,0 @@
-to regenerate Gemfile.nix and Gemfile.lock you need to
-
-  % nix-build bootstrap.nix
-  % cp result/Gemfile.nix ./
-  % cp result/Gemfile.lock ./
-
--- a/pkgs/applications/version-management/redmine/bootstrap.nix
+++ b/pkgs/applications/version-management/redmine/bootstrap.nix
@ -1,47 +0,0 @@
-{ pkgs ? import <nixpkgs> {}
-}:
-
-with pkgs;
-
-let
-
-in stdenv.mkDerivation rec {
-  version = "2.5.2";
-  name = "redmine-${version}";
-  __noChroot = true;
-  src = fetchurl {
-    url = "http://www.redmine.org/releases/${name}.tar.gz";
-    sha256 = "0x0zwxyj4dwbk7l64s3lgny10mjf0ba8jwrbafsm4d72sncmacv0";
-  };
-
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [
-    ruby bundler libiconv libxslt libxml2
-    libffi imagemagickBig postgresql which stdenv
-  ];
-  installPhase = ''
-    unset http_proxy
-    unset ftp_proxy
-
-    cp -R . $out
-    cp ${./generate_nix_requirements.rb} $out/generate_nix_requirements.rb
-    cd $out
-
-    cat > config/database.yml <<EOF
-    production:
-      adapter: postgresql
-    EOF
-
-    bundle config --local build.nokogiri --use-system-libraries \
-      --with-iconv-dir=${libiconv} \
-      --with-xslt-dir=${libxslt.out} \
-      --with-xml2-dir=${libxml2.out} \
-      --with-pkg-config \
-      --with-pg-config=${postgresql}/bin/pg_config
-
-    bundle install --verbose --without development test rmagick --path /tmp/redmine-${version}
-
-    HOME="/tmp/redmine-${version}" ruby generate_nix_requirements.rb
-    rm -R /tmp/gems
-  '';
-}
--- a/pkgs/applications/version-management/redmine/default.nix
+++ b/pkgs/applications/version-management/redmine/default.nix
@ -1,74 +1,42 @@
-{ stdenv, fetchurl, ruby, bundler, libiconv, libxslt, libxml2, pkgconfig, libffi, imagemagickBig, postgresql }:
+{ stdenv, fetchurl, bundlerEnv, ruby }:

 let
-  gemspec = map (gem: fetchurl { url=gem.url; sha256=gem.hash; }) (import ./Gemfile.nix);
-in stdenv.mkDerivation rec {
-  version = "2.5.2";
-  name = "redmine-${version}";
+  version = "3.4.6";
+  rubyEnv = bundlerEnv {
+    name = "redmine-env-${version}";

-  src = fetchurl {
-    url = "https://www.redmine.org/releases/${name}.tar.gz";
-    sha256 = "0x0zwxyj4dwbk7l64s3lgny10mjf0ba8jwrbafsm4d72sncmacv0";
+    inherit ruby;
+    gemdir = ./.;
  };
+in
+  stdenv.mkDerivation rec {
+    name = "redmine-${version}";

-  hardeningDisable = [ "format" ];
+    src = fetchurl {
+      url = "https://www.redmine.org/releases/${name}.tar.gz";
+      sha256 = "15akq6pn42w7cf7dg45xmvw06fixck1qznp7s8ix7nyxlmcyvcg3";
+    };

-  # taken from redmine (2.5.1-2~bpo70+3) in debian wheezy-backports
-  # needed to separate run-time and build-time directories
-  patches = [
-    ./2002_FHS_through_env_vars.patch
-    ./2004_FHS_plugins_assets.patch
-    ./2003_externalize_session_config.patch
-  ];
+    buildInputs = [ rubyEnv rubyEnv.wrappedRuby rubyEnv.bundler ];

-  postPatch = ''
-    substituteInPlace lib/redmine/plugin.rb --replace "File.join(Rails.root, 'plugins')" "ENV['RAILS_PLUGINS']"
-    substituteInPlace lib/redmine/plugin.rb --replace "File.join(Rails.root, 'plugins', id.to_s, 'db', 'migrate')" "File.join(ENV['RAILS_PLUGINS'], id.to_s, 'db', 'migrate')"
-    substituteInPlace config/routes.rb --replace '"plugins/*", Rails.root' 'ENV["RAILS_PLUGINS"] + "/*"'
-  '';
+    buildPhase = ''
+      mv config config.dist
+    '';

-  buildInputs = [
-    ruby bundler libiconv
-    libxslt libxml2 pkgconfig libffi
-    imagemagickBig postgresql
-  ];
+    installPhase = ''
+      mkdir -p $out/share
+      cp -r . $out/share/redmine

-  installPhase = ''
-    mkdir -p $out/share/redmine/
-    cp -R . $out/share/redmine/
-    cd $out/share/redmine
-    ln -s ${./Gemfile.lock} Gemfile.lock
-    export HOME=$(pwd)
+      for i in config files log plugins tmp; do
+        rm -rf $out/share/redmine/$i
+        ln -fs /run/redmine/$i $out/share/redmine/
+      done
+    '';

-    cat > config/database.yml <<EOF
-      production:
-        adapter: postgresql
-    EOF
-
-    mkdir -p vendor/cache
-    ${stdenv.lib.concatStrings (map (gem: "ln -s ${gem} vendor/cache/${gem.name};") gemspec)}
-
-    bundle config build.nokogiri --use-system-libraries --with-iconv-dir="${libiconv}" --with-xslt-dir="${libxslt.dev}" --with-xml2-dir="${libxml2.dev}"
-
-    bundle install --verbose --local --deployment
-
-    # make sure we always load pg package
-    echo "gem \"pg\"" >> Gemfile
-
-    # make rails server happy
-    mkdir -p tmp/pids
-
-    # cleanup
-    rm config/database.yml
-  '';
-
-  meta = with stdenv.lib; {
-    homepage = http://www.redmine.org/;
-    platforms = platforms.linux;
-    maintainers = [ maintainers.garbas ];
-    license = licenses.gpl2;
-    # Marked as broken due to needing an update for security issues.
-    # See: https://github.com/NixOS/nixpkgs/issues/18856
-    broken = true;
-  };
-}
+    meta = with stdenv.lib; {
+      homepage = http://www.redmine.org/;
+      platforms = platforms.linux;
+      maintainers = [ maintainers.garbas ];
+      license = licenses.gpl2;
+    };
+  }
--- a/pkgs/applications/version-management/redmine/gemset.nix
+++ b/pkgs/applications/version-management/redmine/gemset.nix
@ -0,0 +1,472 @@
+{
+  actionmailer = {
+    dependencies = ["actionpack" "actionview" "activejob" "mail" "rails-dom-testing"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0pr3cmr0bpgg5d0f6wy1z6r45n14r9yin8jnr4hi3ssf402xpc0q";
+      type = "gem";
+    };
+    version = "4.2.8";
+  };
+  actionpack = {
+    dependencies = ["actionview" "activesupport" "rack" "rack-test" "rails-dom-testing" "rails-html-sanitizer"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "09fbazl0ja80na2wadfp3fzmdmdy1lsb4wd2yg7anbj0zk0ap7a9";
+      type = "gem";
+    };
+    version = "4.2.8";
+  };
+  actionpack-xml_parser = {
+    dependencies = ["actionpack"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "17am4nd7x6g8x7f8i35rzzv2qrxlkc230rbgzg98af0yf50j8gka";
+      type = "gem";
+    };
+    version = "1.0.2";
+  };
+  actionview = {
+    dependencies = ["activesupport" "builder" "erubis" "rails-dom-testing" "rails-html-sanitizer"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1mg4a8143q2wjhjq4mngl69jkv249z5jvg0jkdribdv4zkg586rp";
+      type = "gem";
+    };
+    version = "4.2.8";
+  };
+  activejob = {
+    dependencies = ["activesupport" "globalid"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0kazbpfgzz6cdmwjnlb9m671ps4qgggwv2hy8y9xi4h96djyyfqz";
+      type = "gem";
+    };
+    version = "4.2.8";
+  };
+  activemodel = {
+    dependencies = ["activesupport" "builder"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "11vhh7zmp92880s5sx8r32v2p0b7xg039mfr92pjynpkz4q901ld";
+      type = "gem";
+    };
+    version = "4.2.8";
+  };
+  activerecord = {
+    dependencies = ["activemodel" "activesupport" "arel"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1kk4dhn8jfhqfsf1dmb3a183gix6k46xr6cjkxj0rp51w2za1ns0";
+      type = "gem";
+    };
+    version = "4.2.8";
+  };
+  activesupport = {
+    dependencies = ["i18n" "minitest" "thread_safe" "tzinfo"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0wibdzd2f5l5rlsw1a1y3j3fhw2imrrbkxggdraa6q9qbdnc66hi";
+      type = "gem";
+    };
+    version = "4.2.8";
+  };
+  addressable = {
+    dependencies = ["public_suffix"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0viqszpkggqi8hq87pqp0xykhvz60g99nwmkwsb0v45kc2liwxvk";
+      type = "gem";
+    };
+    version = "2.5.2";
+  };
+  arel = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0nfcrdiys6q6ylxiblky9jyssrw2xj96fmxmal7f4f0jj3417vj4";
+      type = "gem";
+    };
+    version = "6.0.4";
+  };
+  builder = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0qibi5s67lpdv1wgcj66wcymcr04q6j4mzws6a479n0mlrmh5wr1";
+      type = "gem";
+    };
+    version = "3.2.3";
+  };
+  coderay = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "15vav4bhcc2x3jmi3izb11l4d9f3xv8hp2fszb7iqmpsccv1pz4y";
+      type = "gem";
+    };
+    version = "1.1.2";
+  };
+  concurrent-ruby = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "183lszf5gx84kcpb779v6a2y0mx9sssy8dgppng1z9a505nj1qcf";
+      type = "gem";
+    };
+    version = "1.0.5";
+  };
+  crass = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0bpxzy6gjw9ggjynlxschbfsgmx8lv3zw1azkjvnb8b9i895dqfi";
+      type = "gem";
+    };
+    version = "1.0.4";
+  };
+  css_parser = {
+    dependencies = ["addressable"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0gwvf8mc8gnz4aizfijplv3594998h2j44ydakpzsdmkivs07v61";
+      type = "gem";
+    };
+    version = "1.6.0";
+  };
+  erubis = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1fj827xqjs91yqsydf0zmfyw9p4l2jz5yikg3mppz6d7fi8kyrb3";
+      type = "gem";
+    };
+    version = "2.7.0";
+  };
+  globalid = {
+    dependencies = ["activesupport"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "02smrgdi11kziqi9zhnsy9i6yr2fnxrqlv3lllsvdjki3cd4is38";
+      type = "gem";
+    };
+    version = "0.4.1";
+  };
+  htmlentities = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1nkklqsn8ir8wizzlakncfv42i32wc0w9hxp00hvdlgjr7376nhj";
+      type = "gem";
+    };
+    version = "4.3.4";
+  };
+  i18n = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1i5z1ykl8zhszsxcs8mzl8d0dxgs3ylz8qlzrw74jb0gplkx6758";
+      type = "gem";
+    };
+    version = "0.7.0";
+  };
+  jquery-rails = {
+    dependencies = ["railties" "thor"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1lk7xqmms45czylxs22kv5khlbm7a0yqcchqijxb9m10zsqc6lp5";
+      type = "gem";
+    };
+    version = "3.1.5";
+  };
+  loofah = {
+    dependencies = ["crass" "nokogiri"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0yjs6wbcj3n06d3xjqpy3qbpx0bfa12h3x2rbpc2k33ldjlkx6zy";
+      type = "gem";
+    };
+    version = "2.2.2";
+  };
+  mail = {
+    dependencies = ["mime-types"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0d7lhj2dw52ycls6xigkfz6zvfhc6qggply9iycjmcyj9760yvz9";
+      type = "gem";
+    };
+    version = "2.6.6";
+  };
+  mime-types = {
+    dependencies = ["mime-types-data"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0fjxy1jm52ixpnv3vg9ld9pr9f35gy0jp66i1njhqjvmnvq0iwwk";
+      type = "gem";
+    };
+    version = "3.2.2";
+  };
+  mime-types-data = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "07wvp0aw2gjm4njibb70as6rh5hi1zzri5vky1q6jx95h8l56idc";
+      type = "gem";
+    };
+    version = "3.2018.0812";
+  };
+  mimemagic = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "00ibc1mhvdfyfyl103xwb45621nwyqxf124cni5hyfhag0fn1c3q";
+      type = "gem";
+    };
+    version = "0.3.2";
+  };
+  mini_portile2 = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "13d32jjadpjj6d2wdhkfpsmy68zjx90p49bgf8f7nkpz86r1fr11";
+      type = "gem";
+    };
+    version = "2.3.0";
+  };
+  minitest = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0icglrhghgwdlnzzp4jf76b0mbc71s80njn5afyfjn4wqji8mqbq";
+      type = "gem";
+    };
+    version = "5.11.3";
+  };
+  mysql2 = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0qjd97w6a0w9aldsrhb2y6jrc4wnnlbj5j8kcl7pp7vviwa0r5iq";
+      type = "gem";
+    };
+    version = "0.4.10";
+  };
+  net-ldap = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0z1j0zklbbx3vi91zcd2v0fnkfgkvq3plisa6hxaid8sqndyak46";
+      type = "gem";
+    };
+    version = "0.12.1";
+  };
+  nokogiri = {
+    dependencies = ["mini_portile2"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1h9nml9h3m0mpvmh8jfnqvblnz5n5y3mmhgfc38avfmfzdrq9bgc";
+      type = "gem";
+    };
+    version = "1.8.4";
+  };
+  pg = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "07dv4ma9xd75xpsnnwwg1yrpwpji7ydy0q1d9dl0yfqbzpidrw32";
+      type = "gem";
+    };
+    version = "0.18.4";
+  };
+  protected_attributes = {
+    dependencies = ["activemodel"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "18lvrvmcwjvjr2mrn20vaf68a0q6mg4cy9f0m1i7x83p0ljhhyar";
+      type = "gem";
+    };
+    version = "1.1.4";
+  };
+  public_suffix = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "08q64b5br692dd3v0a9wq9q5dvycc6kmiqmjbdxkxbfizggsvx6l";
+      type = "gem";
+    };
+    version = "3.0.3";
+  };
+  rack = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0in0amn0kwvzmi8h5zg6ijrx5wpsf8h96zrfmnk1kwh2ql4sxs2q";
+      type = "gem";
+    };
+    version = "1.6.10";
+  };
+  rack-openid = {
+    dependencies = ["rack" "ruby-openid"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0sg85yn981j3a0iri3ch4znzdwscvz29l7vrk3dafqw4fdg31llc";
+      type = "gem";
+    };
+    version = "1.4.2";
+  };
+  rack-test = {
+    dependencies = ["rack"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0h6x5jq24makgv2fq5qqgjlrk74dxfy62jif9blk43llw8ib2q7z";
+      type = "gem";
+    };
+    version = "0.6.3";
+  };
+  rails = {
+    dependencies = ["actionmailer" "actionpack" "actionview" "activejob" "activemodel" "activerecord" "activesupport" "railties" "sprockets-rails"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0dpbf3ybzbhqqkwg5vi60121860cr8fybvchrxk5wy3f2jcj0mch";
+      type = "gem";
+    };
+    version = "4.2.8";
+  };
+  rails-deprecated_sanitizer = {
+    dependencies = ["activesupport"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0qxymchzdxww8bjsxj05kbf86hsmrjx40r41ksj0xsixr2gmhbbj";
+      type = "gem";
+    };
+    version = "1.0.3";
+  };
+  rails-dom-testing = {
+    dependencies = ["activesupport" "nokogiri" "rails-deprecated_sanitizer"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0wssfqpn00byhvp2372p99mphkcj8qx6pf6646avwr9ifvq0q1x6";
+      type = "gem";
+    };
+    version = "1.0.9";
+  };
+  rails-html-sanitizer = {
+    dependencies = ["loofah"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1gv7vr5d9g2xmgpjfq4nxsqr70r9pr042r9ycqqnfvw5cz9c7jwr";
+      type = "gem";
+    };
+    version = "1.0.4";
+  };
+  railties = {
+    dependencies = ["actionpack" "activesupport" "rake" "thor"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0bavl4hj7bnl3ryqi9rvykm410kflplgingkcxasfv1gdilddh4g";
+      type = "gem";
+    };
+    version = "4.2.8";
+  };
+  rake = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1idi53jay34ba9j68c3mfr9wwkg3cd9qh0fn9cg42hv72c6q8dyg";
+      type = "gem";
+    };
+    version = "12.3.1";
+  };
+  rbpdf = {
+    dependencies = ["htmlentities" "rbpdf-font"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "021fda3gcz9pyydxnn40vs1nrkycwslb9ip4q0yg3hlip41k1b49";
+      type = "gem";
+    };
+    version = "1.19.5";
+  };
+  rbpdf-font = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0pxlr0l4vf785qpy55m439dyii63a26l0sd0yyhbwwcy9zm9hd1v";
+      type = "gem";
+    };
+    version = "1.19.1";
+  };
+  redcarpet = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0h9qz2hik4s9knpmbwrzb3jcp3vc5vygp9ya8lcpl7f1l9khmcd7";
+      type = "gem";
+    };
+    version = "3.4.0";
+  };
+  request_store = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1ky19wb6mpq6dxb81a0h4hnzx7a4ka99n9ay2syi68djbr4bkbbh";
+      type = "gem";
+    };
+    version = "1.0.5";
+  };
+  rmagick = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0m9x15cdlkcb9826s3s2jd97hxf50hln22p94x8hcccxi1lwklq6";
+      type = "gem";
+    };
+    version = "2.16.0";
+  };
+  roadie = {
+    dependencies = ["css_parser" "nokogiri"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0frp5yb07ib9y1k43shd4xjkb9a6wavhqq892l8yi9y73qi2cqbc";
+      type = "gem";
+    };
+    version = "3.2.2";
+  };
+  roadie-rails = {
+    dependencies = ["railties" "roadie"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1hxgl5marq2hi6lcc73f7g6afd7dz4w893rrgrbh7m3k8zrwjyk1";
+      type = "gem";
+    };
+    version = "1.1.1";
+  };
+  ruby-openid = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0yzaf2c1i88757554wk38rxqmj0xzgmwk2zx7gi98w2zx42d17pn";
+      type = "gem";
+    };
+    version = "2.3.0";
+  };
+  sprockets = {
+    dependencies = ["concurrent-ruby" "rack"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "182jw5a0fbqah5w9jancvfmjbk88h8bxdbwnl4d3q809rpxdg8ay";
+      type = "gem";
+    };
+    version = "3.7.2";
+  };
+  sprockets-rails = {
+    dependencies = ["actionpack" "activesupport" "sprockets"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0ab42pm8p5zxpv3sfraq45b9lj39cz9mrpdirm30vywzrwwkm5p1";
+      type = "gem";
+    };
+    version = "3.2.1";
+  };
+  thor = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0nmqpyj642sk4g16nkbq6pj856adpv91lp4krwhqkh2iw63aszdl";
+      type = "gem";
+    };
+    version = "0.20.0";
+  };
+  thread_safe = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0nmhcgq6cgz44srylra07bmaw99f5271l0dpsvl5f75m44l0gmwy";
+      type = "gem";
+    };
+    version = "0.3.6";
+  };
+  tzinfo = {
+    dependencies = ["thread_safe"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1fjx9j327xpkkdlxwmkl3a8wqj7i4l4jwlrv3z13mg95z9wl253z";
+      type = "gem";
+    };
+    version = "1.2.5";
+  };
+}
--- a/pkgs/applications/version-management/redmine/generate_nix_requirements.rb
+++ b/pkgs/applications/version-management/redmine/generate_nix_requirements.rb
@ -1,56 +0,0 @@
-#!/usr/bin/env ruby
-
-require 'rubygems'
-require 'bundler'
-require 'fileutils'
-require 'net/http'
-require 'net/https'
-require 'uri'
-
-TMP_DIR = "/tmp/gems"
-
-FileUtils.rm_rf(TMP_DIR) if File.exists?(TMP_DIR)
-FileUtils.mkdir TMP_DIR
-
-GEMSERVER = "http://rubygems.org"
-
-# inspect Gemfile.lock
-lockfile = Bundler::LockfileParser.new(Bundler.read_file("Gemfile.lock"))
-
-to_mirror = {}
-
-uri = URI(GEMSERVER)
-http = Net::HTTP.new(uri.host, uri.port)
-http.use_ssl = uri.scheme == 'https'
-
-requirements = {}
-
-lockfile.specs.each do |s|
-  possible_gem_name = "#{s.name}-#{s.version.to_s}.gem"
-
-  Dir.chdir TMP_DIR do
-    filename = `gem fetch #{s.name} -v #{s.version.to_s}`.split()[1]
-    hash = `sha256sum #{filename}.gem`
-    url = "#{GEMSERVER}/downloads/#{filename}.gem"
-    puts url
-    requirements[s.name] = { :version => s.version.to_s, 
-                             :hash => hash.split().first,
-                             :url => url,}
-    
-  end
-end
-
-filename = 'Gemfile.nix'
-
-File.open(filename, 'w') do |file|
-  file.puts "["
-  requirements.each do |name, info|
-    file.puts "{"
-    file.puts ['name = ', '"', name, '";'].join('')
-    file.puts ['hash = ', '"', info[:hash], '";'].join('')
-    file.puts ['url = ', '"', info[:url], '";'].join('')
-    file.puts ['version = ', '"', info[:version], '";'].join('')
-    file.puts "}"
-  end
-  file.puts "]"
-end
--- a/pkgs/applications/version-management/smartgithg/default.nix
+++ b/pkgs/applications/version-management/smartgithg/default.nix
@ -7,11 +7,11 @@

 stdenv.mkDerivation rec {
  name = "smartgithg-${version}";
-  version = "17_1_4";
+  version = "18_1_4";

  src = fetchurl {
    url = "https://www.syntevo.com/downloads/smartgit/smartgit-linux-${version}.tar.gz";
-    sha256 = "1x8s1mdxg7m3fy3izgnb1smrn4ng3q31x0sqnjlchkb5vx7gp5rh";
+    sha256 = "18gyfcs5g7xq8fqnn1zjzx350jaynrniain0giay8sxych12p4cm";
  };

  nativeBuildInputs = [ makeWrapper ];
@ -37,6 +37,8 @@ stdenv.mkDerivation rec {
    mkdir -pv ${pkg_path}
    # unpacking should have produced a dir named 'smartgit'
    cp -a smartgit/* ${pkg_path}
+    # prevent using packaged jre
+    rm -r ${pkg_path}/jre
    mkdir -pv ${bin_path}
    jre=${jre.home}
    makeWrapper ${pkg_path}/bin/smartgit.sh ${bin_path}/smartgit \
@ -45,6 +47,7 @@ stdenv.mkDerivation rec {
      --prefix JRE_HOME : ${jre} \
      --prefix JAVA_HOME : ${jre} \
      --prefix SMARTGITHG_JAVA_HOME : ${jre}
+    sed -i '/ --login/d' ${pkg_path}/bin/smartgit.sh
    patchShebangs $out
    cp ${bin_path}/smartgit ${bin_path}/smartgithg

--- a/pkgs/applications/version-management/subversion/default.nix
+++ b/pkgs/applications/version-management/subversion/default.nix
@ -91,6 +91,7 @@ let

    enableParallelBuilding = true;

+    checkInputs = [ python ];
    doCheck = false; # fails 10 out of ~2300 tests

    meta = with stdenv.lib; {
--- a/pkgs/applications/virtualization/containerd/default.nix
+++ b/pkgs/applications/virtualization/containerd/default.nix
@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
    homepage = https://containerd.tools/;
    description = "A daemon to control runC";
    license = licenses.asl20;
-    maintainers = with maintainers; [ offline ];
+    maintainers = with maintainers; [ offline vdemeester ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/virtualization/open-vm-tools/default.nix
+++ b/pkgs/applications/virtualization/open-vm-tools/default.nix
@ -41,6 +41,11 @@ stdenv.mkDerivation rec {
     sed -i 's,/sbin/shutdown,shutdown,' lib/system/systemLinux.c
  '';

+  preConfigure = ''
+    CC=${stdenv.cc.targetPrefix}cc
+    CXX=${stdenv.cc.targetPrefix}c++
+  '';
+
  configureFlags = [ "--without-kernel-modules" "--without-xmlsecurity" ]
    ++ lib.optional (!withX) "--without-x";

--- a/pkgs/applications/virtualization/runc/default.nix
+++ b/pkgs/applications/virtualization/runc/default.nix
@ -63,7 +63,7 @@ stdenv.mkDerivation rec {
    homepage = https://runc.io/;
    description = "A CLI tool for spawning and running containers according to the OCI specification";
    license = licenses.asl20;
-    maintainers = with maintainers; [ offline ];
+    maintainers = with maintainers; [ offline vdemeester ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/window-managers/velox/default.nix
+++ b/pkgs/applications/window-managers/velox/default.nix
@ -47,7 +47,7 @@ in with self; stdenv.mkDerivation rec {
      --prefix PATH : "${stdenv.lib.makeBinPath [ dmenu-velox st-velox ]}"
  '';

-  enableParallelBuilding = true;
+  enableParallelBuilding = false; # https://hydra.nixos.org/build/79799608

  meta = {
    description = "velox window manager";
--- a/pkgs/build-support/bintools-wrapper/setup-hook.sh
+++ b/pkgs/build-support/bintools-wrapper/setup-hook.sh
@ -59,11 +59,11 @@ for cmd in \
    ar as ld nm objcopy objdump readelf ranlib strip strings size windres
 do
    if
-        PATH=$_PATH type -p "@targetPrefix@${cmd}" > /dev/null
+        cmd_path=$(PATH=$_PATH command -v "@targetPrefix@${cmd}")
    then
        upper_case="$(echo "$cmd" | tr "[:lower:]" "[:upper:]")"
-        export "${role_pre}${upper_case}=@targetPrefix@${cmd}";
-        export "${upper_case}${role_post}=@targetPrefix@${cmd}";
+        export "${role_pre}${upper_case}=${cmd_path}";
+        export "${upper_case}${role_post}=${cmd_path}";
    fi
 done

@ -72,5 +72,5 @@ done
 export NIX_HARDENING_ENABLE

 # No local scope in sourced file
-unset -v role_pre role_post cmd upper_case
+unset -v role_pre role_post cmd cmd_path upper_case
 set +u
--- a/pkgs/build-support/cc-wrapper/setup-hook.sh
+++ b/pkgs/build-support/cc-wrapper/setup-hook.sh
@ -109,10 +109,10 @@ fi

 export NIX_${role_pre}CC=@out@

-export ${role_pre}CC=@named_cc@
-export ${role_pre}CXX=@named_cxx@
-export CC${role_post}=@named_cc@
-export CXX${role_post}=@named_cxx@
+export ${role_pre}CC=@out@/bin/@named_cc@
+export ${role_pre}CXX=@out@/bin/@named_cxx@
+export CC${role_post}=@out@/bin/@named_cc@
+export CXX${role_post}=@out@/bin/@named_cxx@

 # If unset, assume the default hardening flags.
 : ${NIX_HARDENING_ENABLE="fortify stackprotector pic strictoverflow format relro bindnow"}
--- a/pkgs/build-support/fetchpatch/default.nix
+++ b/pkgs/build-support/fetchpatch/default.nix
@ -4,7 +4,7 @@
 # often change with updating of git or cgit.
 # stripLen acts as the -p parameter when applying a patch.

-{ lib, fetchurl, patchutils }:
+{ lib, fetchurl, buildPackages }:
 { stripLen ? 0, extraPrefix ? null, excludes ? [], includes ? [], revert ? false, ... }@args:

 fetchurl ({
@ -14,10 +14,10 @@ fetchurl ({
      echo "error: Fetched patch file '$out' is empty!" 1>&2
      exit 1
    fi
-    "${patchutils}/bin/lsdiff" "$out" \
+    "${buildPackages.patchutils}/bin/lsdiff" "$out" \
      | sort -u | sed -e 's/[*?]/\\&/g' \
      | xargs -I{} \
-        "${patchutils}/bin/filterdiff" \
+        "${buildPackages.patchutils}/bin/filterdiff" \
        --include={} \
        --strip=${toString stripLen} \
        ${lib.optionalString (extraPrefix != null) ''
@ -32,7 +32,7 @@ fetchurl ({
      cat "$out" 1>&2
      exit 1
    fi
-    ${patchutils}/bin/filterdiff \
+    ${buildPackages.patchutils}/bin/filterdiff \
      -p1 \
      ${builtins.toString (builtins.map (x: "-x ${lib.escapeShellArg x}") excludes)} \
      ${builtins.toString (builtins.map (x: "-i ${lib.escapeShellArg x}") includes)} \
@ -46,7 +46,7 @@ fetchurl ({
      exit 1
    fi
  '' + lib.optionalString revert ''
-    ${patchutils}/bin/interdiff "$out" /dev/null > "$tmpfile"
+    ${buildPackages.patchutils}/bin/interdiff "$out" /dev/null > "$tmpfile"
    mv "$tmpfile" "$out"
  '' + (args.postFetch or "");
  meta.broken = excludes != [] && includes != [];
--- a/pkgs/build-support/release/binary-tarball.nix
+++ b/pkgs/build-support/release/binary-tarball.nix
@ -27,11 +27,11 @@ stdenv.mkDerivation (
    postPhases = "finalPhase";
  }

-  // args // 
+  // args //

  {
    name = name + (if src ? version then "-" + src.version else "");
-  
+
    postHook = ''
      mkdir -p $out/nix-support
      echo "$system" > $out/nix-support/system
@ -43,7 +43,7 @@ stdenv.mkDerivation (
      if test -e $origSrc/nix-support/hydra-release-name; then
          releaseName=$(cat $origSrc/nix-support/hydra-release-name)
      fi
-      
+
      installFlagsArray=(DESTDIR=$TMPDIR/inst)

      # Prefix hackery because of a bug in stdenv (it tries to `mkdir
@ -62,18 +62,18 @@ stdenv.mkDerivation (
        tar cvfj $out/tarballs/''${releaseName:-binary-dist}.tar.bz2 -C $TMPDIR/inst .
      '';

-                
+
    finalPhase =
      ''
        for i in $out/tarballs/*; do
            echo "file binary-dist $i" >> $out/nix-support/hydra-build-products
        done
-        
+
        # Propagate the release name of the source tarball.  This is
        # to get nice package names in channels.
        test -n "$releaseName" && (echo "$releaseName" >> $out/nix-support/hydra-release-name)
      '';
-    
+

    meta = (if args ? meta then args.meta else {}) // {
      description = "Build of a generic binary distribution";
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@ -1,6 +1,6 @@
 { pkgs
 , kernel ? pkgs.linux
-, img ? pkgs.stdenv.platform.kernelTarget
+, img ? pkgs.stdenv.hostPlatform.platform.kernelTarget
 , storeDir ? builtins.storeDir
 , rootModules ?
    [ "virtio_pci" "virtio_mmio" "virtio_blk" "virtio_balloon" "virtio_rng" "ext4" "unix" "9p" "9pnet_virtio" "crc32c_generic" ]
--- a/pkgs/data/fonts/iosevka/bin.nix
+++ b/pkgs/data/fonts/iosevka/bin.nix
@ -1,18 +1,18 @@
 { stdenv, fetchzip }:

 let
-  version = "1.14.3";
+  version = "2.0.0";
 in fetchzip rec {
  name = "iosevka-bin-${version}";

-  url = "https://github.com/be5invis/Iosevka/releases/download/v${version}/iosevka-pack-${version}.zip";
+  url = "https://github.com/be5invis/Iosevka/releases/download/v${version}/ttc-iosevka-${version}.zip";

  postFetch = ''
    mkdir -p $out/share/fonts
    unzip -j $downloadedFile \*.ttc -d $out/share/fonts/iosevka
  '';

-  sha256 = "0qc5i6ijr25d2jwi5r4bcvbaw74y1p05a5fvlwss3l9rhmmxsfpl";
+  sha256 = "17ldxs8rn4y5mzpc6h5rms4khk9fp4d1ixz5bh0pglh1kdansz45";

  meta = with stdenv.lib; {
    homepage = https://be5invis.github.io/Iosevka/;
--- a/pkgs/data/icons/numix-icon-theme-circle/default.nix
+++ b/pkgs/data/icons/numix-icon-theme-circle/default.nix
@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub, gtk3, numix-icon-theme }:

 stdenv.mkDerivation rec {
-  version = "18-02-16";
+  version = "18.08.17";

  package-name = "numix-icon-theme-circle";

@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
    owner = "numixproject";
    repo = package-name;
    rev = version;
-    sha256 = "0q08q1czsk6h0dxqscbgryr12xaakp4zbch37z0jxpwh087gnq4f";
+    sha256 = "1nxgm5vf2rzbg8qh48iy0vdj12ffahlp9qhj8h0k1li03s3nf15h";
  };

  nativeBuildInputs = [ gtk3 numix-icon-theme ];
@ -31,7 +31,8 @@ stdenv.mkDerivation rec {
    description = "Numix icon theme (circle version)";
    homepage = https://numixproject.org;
    license = licenses.gpl3;
-    platforms = platforms.all;
+    # darwin cannot deal with file names differing only in case
+    platforms = platforms.linux;
    maintainers = with maintainers; [ jgeerds ];
  };
 }
--- a/pkgs/data/icons/numix-icon-theme-square/default.nix
+++ b/pkgs/data/icons/numix-icon-theme-square/default.nix
@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
  name = "${package-name}-${version}";
  package-name = "numix-icon-theme-square";
-  version = "18-02-16";
+  version = "18.08.17";

  src = fetchFromGitHub {
    owner = "numixproject";
    repo = package-name;
    rev = version;
-    sha256 = "1gjwc0s6a7q1jby5bcwxkcmbs470m81y8s0clsm0qhcmcn1c36xj";
+    sha256 = "0pn5m73zd240bk2kilcgv57xn7grhbcj5ay4w1jzzn1f4ifaa0w8";
  };

  nativeBuildInputs = [ gtk3 numix-icon-theme ];
@ -29,7 +29,8 @@ stdenv.mkDerivation rec {
    description = "Numix icon theme (square version)";
    homepage = https://numixproject.org;
    license = licenses.gpl3;
-    platforms = platforms.linux; # Maybe other non-darwin Unix
+    # darwin cannot deal with file names differing only in case
+    platforms = platforms.linux;
    maintainers = with maintainers; [ romildo ];
  };
 }
--- a/pkgs/data/icons/numix-icon-theme/default.nix
+++ b/pkgs/data/icons/numix-icon-theme/default.nix
@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
  name = "${pname}-${version}";
  pname = "numix-icon-theme";
-  version = "17-12-25";
+  version = "18.07.17";

  src = fetchFromGitHub {
    owner = "numixproject";
    repo = pname;
    rev = version;
-    sha256 = "0q3hpq2jc9iwnzzqpb12g1qzjsw4ckhdqkfqf6nirl87r5drkv6j";
+    sha256 = "0clh55kmhc52d33dfm2c6h3lg6ddfh8a088ir9lv1camn9kj55bd";
  };

  nativeBuildInputs = [ gtk3 hicolor-icon-theme ];
@ -29,7 +29,8 @@ stdenv.mkDerivation rec {
    description = "Numix icon theme";
    homepage = https://numixproject.org;
    license = licenses.gpl3;
-    platforms = platforms.all;
+    # darwin cannot deal with file names differing only in case
+    platforms = platforms.linux;
    maintainers = with maintainers; [ romildo jgeerds ];
  };
 }
--- a/pkgs/desktops/gnome-3/core/gcr/default.nix
+++ b/pkgs/desktops/gnome-3/core/gcr/default.nix
@ -1,6 +1,7 @@
 { stdenv, fetchurl, pkgconfig, intltool, gnupg, p11-kit, glib
 , libgcrypt, libtasn1, dbus-glib, gtk, pango, gdk_pixbuf, atk
-, gobjectIntrospection, makeWrapper, libxslt, vala, gnome3 }:
+, gobjectIntrospection, makeWrapper, libxslt, vala, gnome3
+, python2 }:

 stdenv.mkDerivation rec {
  name = "gcr-${version}";
@ -15,6 +16,10 @@ stdenv.mkDerivation rec {
    updateScript = gnome3.updateScript { packageName = "gcr"; attrPath = "gnome3.gcr"; };
  };

+  postPatch = ''
+    patchShebangs .
+  '';
+
  outputs = [ "out" "dev" ];

  nativeBuildInputs = [ pkgconfig intltool gobjectIntrospection libxslt makeWrapper vala ];
@ -27,7 +32,8 @@ stdenv.mkDerivation rec {

  propagatedBuildInputs = [ glib gtk p11-kit ];

-  #doCheck = true;
+  checkInputs = [ python2 ];
+  doCheck = false; # fails 21 out of 603 tests, needs dbus daemon

  #enableParallelBuilding = true; issues on hydra

--- a/pkgs/desktops/gnome-3/core/gnome-keyring/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-keyring/default.nix
@ -22,14 +22,11 @@ stdenv.mkDerivation rec {
    pango gcr gdk_pixbuf atk p11-kit
  ];

-  # In 3.20.1, tests do not support Python 3
-  checkInputs = [ dbus python2 ];
-
  propagatedBuildInputs = [ glib libtasn1 libxslt ];

  nativeBuildInputs = [
    pkgconfig intltool docbook_xsl docbook_xml_dtd_42 wrapGAppsHook
-  ] ++ stdenv.lib.optionals doCheck checkInputs;
+  ];

  configureFlags = [
    "--with-pkcs11-config=$$out/etc/pkcs11/" # installation directories
@ -41,6 +38,9 @@ stdenv.mkDerivation rec {
  '';

  doCheck = true;
+  # In 3.20.1, tests do not support Python 3
+  checkInputs = [ dbus python2 ];
+
  checkPhase = ''
    export HOME=$(mktemp -d)
    dbus-run-session \
--- a/pkgs/development/compilers/chez/default.nix
+++ b/pkgs/development/compilers/chez/default.nix
@ -61,7 +61,8 @@ stdenv.mkDerivation rec {
  **
  ** Ideally in the future this would be less of a hack and could be
  ** done by Chez itself. Alternatively, there could just be a big
-  ** case statement matching to the different stdenv.platform values...
+  ** case statement matching to the different stdenv.hostPlatform.platform
+  ** values...
  */
  postInstall = ''
    m="$(ls ./work/boot)"
--- a/pkgs/development/compilers/cmdstan/default.nix
+++ b/pkgs/development/compilers/cmdstan/default.nix
@ -10,10 +10,10 @@ stdenv.mkDerivation rec {

  buildFlags = "build";
  enableParallelBuilding = true;
-  nativeBuildInputs = stdenv.lib.optional doCheck python;

  doCheck = true;
-  checkPhase = "python ./runCmdStanTests.py src/test/interface";  # see #5368
+  checkInputs = [ python ];
+  checkPhase = "python ./runCmdStanTests.py src/test/interface"; # see #5368

  installPhase = ''
    mkdir -p $out/opt $out/bin
--- a/pkgs/development/compilers/ghc/8.0.2.nix
+++ b/pkgs/development/compilers/ghc/8.0.2.nix
@ -102,15 +102,16 @@ stdenv.mkDerivation rec {
    done
    # GHC is a bit confused on its cross terminology, as these would normally be
    # the *host* tools.
-    export CC="${targetCC}/bin/${targetCC.targetPrefix}cc"
-    export CXX="${targetCC}/bin/${targetCC.targetPrefix}cxx"
-    export LD="${targetCC.bintools}/bin/${targetCC.bintools.targetPrefix}ld"
-    export AS="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}as"
-    export AR="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}ar"
-    export NM="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}nm"
-    export RANLIB="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}ranlib"
-    export READELF="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}readelf"
-    export STRIP="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}strip"
+    export CC="$CC_FOR_TARGET"
+    export CXX="$CXX_FOR_TARGET"
+    # Use gold to work around https://sourceware.org/bugzilla/show_bug.cgi?id=16177
+    export LD="${targetCC.bintools}/bin/${targetCC.bintools.targetPrefix}ld${stdenv.lib.optionalString targetPlatform.isAarch32 ".gold"}"
+    export AS="$AS_FOR_TARGET"
+    export AR="$AR_FOR_TARGET"
+    export NM="$NM_FOR_TARGET"
+    export RANLIB="$RANLIB_FOR_TARGET"
+    export READELF="$READELF_FOR_TARGET"
+    export STRIP="$STRIP_FOR_TARGET"

    echo -n "${buildMK}" > mk/build.mk
    sed -i -e 's|-isysroot /Developer/SDKs/MacOSX10.5.sdk||' configure
--- a/pkgs/development/compilers/ghc/8.2.2.nix
+++ b/pkgs/development/compilers/ghc/8.2.2.nix
@ -134,16 +134,16 @@ stdenv.mkDerivation rec {
    done
    # GHC is a bit confused on its cross terminology, as these would normally be
    # the *host* tools.
-    export CC="${targetCC}/bin/${targetCC.targetPrefix}cc"
-    export CXX="${targetCC}/bin/${targetCC.targetPrefix}cxx"
+    export CC="$CC_FOR_TARGET"
+    export CXX="$CXX_FOR_TARGET"
    # Use gold to work around https://sourceware.org/bugzilla/show_bug.cgi?id=16177
    export LD="${targetCC.bintools}/bin/${targetCC.bintools.targetPrefix}ld${stdenv.lib.optionalString targetPlatform.isAarch32 ".gold"}"
-    export AS="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}as"
-    export AR="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}ar"
-    export NM="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}nm"
-    export RANLIB="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}ranlib"
-    export READELF="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}readelf"
-    export STRIP="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}strip"
+    export AS="$AS_FOR_TARGET"
+    export AR="$AR_FOR_TARGET"
+    export NM="$NM_FOR_TARGET"
+    export RANLIB="$RANLIB_FOR_TARGET"
+    export READELF="$READELF_FOR_TARGET"
+    export STRIP="$STRIP_FOR_TARGET"

    echo -n "${buildMK}" > mk/build.mk
    sed -i -e 's|-isysroot /Developer/SDKs/MacOSX10.5.sdk||' configure
--- a/pkgs/development/compilers/ghc/8.4.3.nix
+++ b/pkgs/development/compilers/ghc/8.4.3.nix
@ -99,8 +99,9 @@ stdenv.mkDerivation (rec {
    extraPrefix = "utils/hsc2hs/";
    stripLen = 1;
  })] ++ stdenv.lib.optional deterministicProfiling
-    (fetchpatch {
-      url = "https://phabricator-files.haskell.org/file/data/yd2fclrwulila2quki5q/PHID-FILE-lr2j63hkglwauprxycrt/D4388.diff";
+    (fetchpatch rec {
+      url = "http://tarballs.nixos.org/sha256/${sha256}";
+      name = "D4388.diff";
      sha256 = "0w6sdcvnqjlnlzpvnzw20b80v150ijjyjvs9548ildc1928j0w7s";
    })
    ++ stdenv.lib.optional stdenv.isDarwin ./backport-dylib-command-size-limit.patch;
@ -114,16 +115,16 @@ stdenv.mkDerivation (rec {
    done
    # GHC is a bit confused on its cross terminology, as these would normally be
    # the *host* tools.
-    export CC="${targetCC}/bin/${targetCC.targetPrefix}cc"
-    export CXX="${targetCC}/bin/${targetCC.targetPrefix}cxx"
+    export CC="$CC_FOR_TARGET"
+    export CXX="$CXX_FOR_TARGET"
    # Use gold to work around https://sourceware.org/bugzilla/show_bug.cgi?id=16177
    export LD="${targetCC.bintools}/bin/${targetCC.bintools.targetPrefix}ld${stdenv.lib.optionalString targetPlatform.isAarch32 ".gold"}"
-    export AS="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}as"
-    export AR="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}ar"
-    export NM="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}nm"
-    export RANLIB="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}ranlib"
-    export READELF="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}readelf"
-    export STRIP="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}strip"
+    export AS="$AS_FOR_TARGET"
+    export AR="$AR_FOR_TARGET"
+    export NM="$NM_FOR_TARGET"
+    export RANLIB="$RANLIB_FOR_TARGET"
+    export READELF="$READELF_FOR_TARGET"
+    export STRIP="$STRIP_FOR_TARGET"

    echo -n "${buildMK}" > mk/build.mk
    sed -i -e 's|-isysroot /Developer/SDKs/MacOSX10.5.sdk||' configure
--- a/pkgs/development/compilers/ghc/8.6.1.nix
+++ b/pkgs/development/compilers/ghc/8.6.1.nix
@ -98,16 +98,16 @@ stdenv.mkDerivation (rec {
    done
    # GHC is a bit confused on its cross terminology, as these would normally be
    # the *host* tools.
-    export CC="${targetCC}/bin/${targetCC.targetPrefix}cc"
-    export CXX="${targetCC}/bin/${targetCC.targetPrefix}cxx"
+    export CC="$CC_FOR_TARGET"
+    export CXX="$CXX_FOR_TARGET"
    # Use gold to work around https://sourceware.org/bugzilla/show_bug.cgi?id=16177
    export LD="${targetCC.bintools}/bin/${targetCC.bintools.targetPrefix}ld${stdenv.lib.optionalString targetPlatform.isAarch32 ".gold"}"
-    export AS="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}as"
-    export AR="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}ar"
-    export NM="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}nm"
-    export RANLIB="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}ranlib"
-    export READELF="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}readelf"
-    export STRIP="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}strip"
+    export AS="$AS_FOR_TARGET"
+    export AR="$AR_FOR_TARGET"
+    export NM="$NM_FOR_TARGET"
+    export RANLIB="$RANLIB_FOR_TARGET"
+    export READELF="$READELF_FOR_TARGET"
+    export STRIP="$STRIP_FOR_TARGET"

    echo -n "${buildMK}" > mk/build.mk
    sed -i -e 's|-isysroot /Developer/SDKs/MacOSX10.5.sdk||' configure
--- a/pkgs/development/compilers/ghc/head.nix
+++ b/pkgs/development/compilers/ghc/head.nix
@ -100,16 +100,16 @@ stdenv.mkDerivation rec {
    done
    # GHC is a bit confused on its cross terminology, as these would normally be
    # the *host* tools.
-    export CC="${targetCC}/bin/${targetCC.targetPrefix}cc"
-    export CXX="${targetCC}/bin/${targetCC.targetPrefix}cxx"
+    export CC="$CC_FOR_TARGET"
+    export CXX="$CXX_FOR_TARGET"
    # Use gold to work around https://sourceware.org/bugzilla/show_bug.cgi?id=16177
    export LD="${targetCC.bintools}/bin/${targetCC.bintools.targetPrefix}ld${stdenv.lib.optionalString targetPlatform.isAarch32 ".gold"}"
-    export AS="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}as"
-    export AR="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}ar"
-    export NM="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}nm"
-    export RANLIB="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}ranlib"
-    export READELF="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}readelf"
-    export STRIP="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}strip"
+    export AS="$AS_FOR_TARGET"
+    export AR="$AR_FOR_TARGET"
+    export NM="$NM_FOR_TARGET"
+    export RANLIB="$RANLIB_FOR_TARGET"
+    export READELF="$READELF_FOR_TARGET"
+    export STRIP="$STRIP_FOR_TARGET"

    echo -n "${buildMK}" > mk/build.mk
    echo ${version} >VERSION
--- a/pkgs/development/compilers/glslang/default.nix
+++ b/pkgs/development/compilers/glslang/default.nix
@ -28,6 +28,8 @@ stdenv.mkDerivation rec {
    fi
  '';

+  doCheck = false; # fails 3 out of 3 tests (ctest)
+
  meta = with stdenv.lib; {
    inherit (src.meta) homepage;
    description = "Khronos reference front-end for GLSL and ESSL";
--- a/pkgs/development/compilers/javacard-devkit/default.nix
+++ b/pkgs/development/compilers/javacard-devkit/default.nix
@ -35,6 +35,7 @@ stdenv.mkDerivation rec {
        *.so) install -vD "$i" "$out/libexec/$pname/$(basename "$i")";;
        *) target="$out/bin/$(basename "$i")"
           install -vD "$i" "$target"
+           sed -i -e 's|^$JAVA_HOME/bin/java|''${JAVA:-$JAVA_HOME/bin/java}|' "$target"
           wrapProgram "$target" \
             --set JAVA_HOME "$JAVA_HOME" \
             --prefix CLASSPATH : "$out/share/$pname/api_export_files"
@ -55,7 +56,9 @@ stdenv.mkDerivation rec {

      First, compile your '.java' (NixOS-specific: you should not need to set the class path -- if you need, it's a bug):
          javacardc -source 1.5 -target 1.5 [MyJavaFile].java
-      Then, convert the '.class' file into a '.cap':
+      Then, test with 'jcwde' (NixOS-specific: you can change the java version used to run jcwde with eg. JAVA=jdb):
+          CLASSPATH=. jcwde [MyJcwdeConfig].app & sleep 1 && apdutool [MyApdus].apdu
+      Finally, convert the '.class' file into a '.cap':
          converter -applet [AppletAID] [MyApplet] [myPackage] [PackageAID] [Version]
      For more details, please refer to the documentation by Oracle
    '';
--- a/pkgs/development/compilers/openjdk/8.nix
+++ b/pkgs/development/compilers/openjdk/8.nix
@ -106,6 +106,12 @@ let
    # https://github.com/JetBrains/jdk8u/commit/eaa5e0711a43d64874111254d74893fa299d5716
    + stdenv.lib.optionalString stdenv.cc.isGNU ''
      NIX_CFLAGS_COMPILE+=" -fno-lifetime-dse -fno-delete-null-pointer-checks -std=gnu++98 -Wno-error"
+    ''
+    # The configure script was confused by our passing these with full paths,
+    # so we explicitly override them to short variants.
+    + ''
+      CC=${stdenv.cc.targetPrefix}cc
+      CXX=${stdenv.cc.targetPrefix}c++
    '';

    configureFlags = [
--- a/pkgs/development/compilers/scala/dotty-bare.nix
+++ b/pkgs/development/compilers/scala/dotty-bare.nix
@ -1,12 +1,12 @@
 { stdenv, fetchurl, makeWrapper, jre }:

 stdenv.mkDerivation rec {
-  version = "0.8.0-RC1";
+  version = "0.9.0-RC1";
  name = "dotty-bare-${version}";

  src = fetchurl {
    url = "https://github.com/lampepfl/dotty/releases/download/${version}/dotty-${version}.tar.gz";
-    sha256 = "e5b7a9bb6f1007146a440ddfff871cc312075e5d69b9ab7e279ad7c3514f7065";
+    sha256 = "1c24692081231415cb560ff1288ede3f0d28c8b994ce8ca7c7b06edf7978bfb8";
  };

  propagatedBuildInputs = [ jre ] ;
--- a/Show More
+++ b/Show More