Merge commit '3ed545ab31146e607c57649936c75869d6aa9ba2' into ericson2314-cross-master

2018-01-09 17:19:27 -05:00 · 2018-01-09 17:19:27 -05:00 · c3052295fa
commit c3052295fa
parent c0ab4d5ff0 3ed545ab31
535 changed files with 10031 additions and 6356 deletions
--- a/2
+++ b/2
@ -1,4 +1,4 @@
-Copyright (c) 2003-2017 Eelco Dolstra and the Nixpkgs/NixOS contributors
+Copyright (c) 2003-2018 Eelco Dolstra and the Nixpkgs/NixOS contributors

 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
--- a/lib/generators.nix
+++ b/lib/generators.nix
@ -130,6 +130,6 @@ rec {
              (name: value:
                "${toPretty args name} = ${toPretty args value};") v)
        + " }"
-    else "toPretty: should never happen (v = ${v})";
+    else abort "toPretty: should never happen (v = ${v})";

 }
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@ -309,6 +309,12 @@ lib.mapAttrs (n: v: v // { shortName = n; }) rec {
    free      = false;
  };

+  inria-icesl = {
+    fullName = "INRIA Non-Commercial License Agreement for IceSL";
+    url      = "http://shapeforge.loria.fr/icesl/EULA_IceSL_binary.pdf";
+    free     = false;
+  };
+
  ipa = spdx {
    spdxId = "IPA";
    fullName = "IPA Font License";
--- a/lib/maintainers.nix
+++ b/lib/maintainers.nix
@ -29,6 +29,7 @@
  aherrmann = "Andreas Herrmann <andreash87@gmx.ch>";
  ahmedtd = "Taahir Ahmed <ahmed.taahir@gmail.com>";
  aij = "Ivan Jager <aij+git@mrph.org>";
+  ajgrf = "Alex Griffin <a@ajgrf.com>";
  ak = "Alexander Kjeldaas <ak@formalprivacy.com>";
  akaWolf = "Artjom Vejsel <akawolf0@gmail.com>";
  akc = "Anders Claesson <akc@akc.is>";
@ -190,6 +191,7 @@
  dtzWill = "Will Dietz <nix@wdtz.org>";
  dupgit = "Olivier Delhomme <olivier.delhomme@free.fr>";
  dywedir = "Vladyslav M. <dywedir@protonmail.ch>";
+  dzabraev = "Maksim Dzabraev <dzabraew@gmail.com>";
  e-user = "Alexander Kahl <nixos@sodosopa.io>";
  earldouglas = "James Earl Douglas <james@earldouglas.com>";
  ebzzry = "Rommel Martinez <ebzzry@ebzzry.io>";
@ -421,6 +423,7 @@
  meisternu = "Matt Miemiec <meister@krutt.org>";
  metabar = "Celine Mercier <softs@metabarcoding.org>";
  mgdelacroix = "Miguel de la Cruz <mgdelacroix@gmail.com>";
+  mgttlinger = "Merlin Göttlinger <megoettlinger@gmail.com";
  mguentner = "Maximilian Güntner <code@klandest.in>";
  mic92 = "Jörg Thalheim <joerg@thalheim.io>";
  michaelpj = "Michael Peyton Jones <michaelpj@gmail.com>";
@ -579,10 +582,11 @@
  rushmorem = "Rushmore Mushambi <rushmore@webenchanter.com>";
  rvl = "Rodney Lorrimar <dev+nix@rodney.id.au>";
  rvlander = "Gaëtan André <rvlander@gaetanandre.eu>";
-  rvolosatovs = "Roman Volosatovs <rvolosatovs@riseup.net";
+  rvolosatovs = "Roman Volosatovs <rvolosatovs@riseup.net>";
  ryanartecona = "Ryan Artecona <ryanartecona@gmail.com>";
  ryansydnor = "Ryan Sydnor <ryan.t.sydnor@gmail.com>";
  ryantm = "Ryan Mulligan <ryan@ryantm.com>";
+  ryantrinkle = "Ryan Trinkle <ryan.trinkle@gmail.com>";
  rybern = "Ryan Bernstein <ryan.bernstein@columbia.edu>";
  rycee = "Robert Helgesson <robert@rycee.net>";
  ryneeverett = "Ryne Everett <ryneeverett@gmail.com>";
--- a/maintainers/scripts/copy-tarballs.pl
+++ b/maintainers/scripts/copy-tarballs.pl
@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i perl -p perl perlPackages.NetAmazonS3 perlPackages.FileSlurp nixUnstable
+#! nix-shell -i perl -p perl perlPackages.NetAmazonS3 perlPackages.FileSlurp nixUnstable nixUnstable.perl-bindings

 # This command uploads tarballs to tarballs.nixos.org, the
 # content-addressed cache used by fetchurl as a fallback for when
@ -59,6 +59,7 @@ my $s3 = Net::Amazon::S3->new(
    { aws_access_key_id     => $aws_access_key_id,
      aws_secret_access_key => $aws_secret_access_key,
      retry                 => 1,
+      host                  => "s3-eu-west-1.amazonaws.com",
    });

 my $bucket = $s3->bucket("nixpkgs-tarballs") or die;
--- a/nixos/doc/manual/development/writing-nixos-tests.xml
+++ b/nixos/doc/manual/development/writing-nixos-tests.xml
@ -272,8 +272,37 @@ startAll;
    </listitem>
  </varlistentry>

+  <varlistentry>
+    <term><methodname>systemctl</methodname></term>
+    <listitem>
+      <para>Runs <literal>systemctl</literal> commands with optional support for
+      <literal>systemctl --user</literal></para>
+    <para>
+      <programlisting>
+        $machine->systemctl("list-jobs --no-pager"); // runs `systemctl list-jobs --no-pager`
+        $machine->systemctl("list-jobs --no-pager", "any-user"); // spawns a shell for `any-user` and runs `systemctl --user list-jobs --no-pager`
+      </programlisting>
+    </para>
+    </listitem>
+  </varlistentry>
+
 </variablelist>

 </para>

+<para>
+  To test user units declared by <literal>systemd.user.services</literal> the optional <literal>$user</literal>
+  argument can be used:
+
+  <programlisting>
+    $machine->start;
+    $machine->waitForX;
+    $machine->waitForUnit("xautolock.service", "x-session-user");
+  </programlisting>
+
+  This applies to <literal>systemctl</literal>, <literal>getUnitInfo</literal>,
+  <literal>waitForUnit</literal>, <literal>startJob</literal>
+  and <literal>stopJob</literal>.
+</para>
+
 </section>
--- a/nixos/doc/manual/installation/installing-usb.xml
+++ b/nixos/doc/manual/installation/installing-usb.xml
@ -11,9 +11,23 @@ a USB stick. You can use the <command>dd</command> utility to write the image:
 <command>dd if=<replaceable>path-to-image</replaceable>
 of=<replaceable>/dev/sdb</replaceable></command>. Be careful about specifying the
 correct drive; you can use the <command>lsblk</command> command to get a list of
-block devices. If you're on macOS you can run <command>diskutil list</command>
-to see the list of devices; the device you'll use for the USB must be ejected
-before writing the image.</para>
+block devices.</para>
+
+<para>On macOS:
+<programlisting>
+$ diskutil list
+[..]
+/dev/diskN (external, physical):
+   #:                       TYPE NAME                    SIZE       IDENTIFIER
+[..]
+$ diskutil unmountDisk diskN
+Unmount of all volumes on diskN was successful
+$ sudo dd bs=1m if=nix.iso of=/dev/rdiskN
+</programlisting>
+Using the 'raw' <command>rdiskN</command> device instead of <command>diskN</command>
+completes in minutes instead of hours. After <command>dd</command> completes, a GUI
+dialog "The disk you inserted was not readable by this computer" will pop up, which
+can be ignored.</para>
         
 <para>The <command>dd</command> utility will write the image verbatim to the drive,
 making it the recommended option for both UEFI and non-UEFI installations. For
--- a/nixos/doc/manual/installation/obtaining.xml
+++ b/nixos/doc/manual/installation/obtaining.xml
@ -12,11 +12,10 @@ download page</link>.  There are a number of installation options.  If
 you happen to have an optical drive and a spare CD, burning the
 image to CD and booting from that is probably the easiest option.
 Most people will need to prepare a USB stick to boot from.
-Unetbootin is recommended and the process is described in brief below.
-Note that systems which use UEFI require some additional manual steps.
-If you run into difficulty a number of alternative methods are presented
-in the <link
-xlink:href="https://nixos.org/wiki/Installing_NixOS_from_a_USB_stick">NixOS
+<xref linkend="sec-booting-from-usb"/> describes the preferred method
+to prepare a USB stick.
+A number of alternative methods are presented in the <link
+xlink:href="https://nixos.wiki/wiki/NixOS_Installation_Guide#Making_the_installation_media">NixOS
 Wiki</link>.</para>

 <para>As an alternative to installing NixOS yourself, you can get a
--- a/nixos/doc/manual/release-notes/rl-1803.xml
+++ b/nixos/doc/manual/release-notes/rl-1803.xml
@ -131,6 +131,20 @@ following incompatible changes:</para>
      Other types dependencies should be unaffected.
    </para>
  </listitem>
+  <listitem>
+    <para>
+      The <literal>memcached</literal> service no longer accept dynamic socket
+      paths via <option>services.memcached.socket</option>. Unix sockets can be
+      still enabled by <option>services.memcached.enableUnixSocket</option> and
+      will be accessible at <literal>/run/memcached/memcached.sock</literal>.
+    </para>
+  </listitem>
+  <listitem>
+    <para>
+      The DNSCrypt proxy module has been removed, the upstream project
+      is no longer maintained.
+    </para>
+  </listitem>
 </itemizedlist>

 </section>
@ -181,6 +195,58 @@ following incompatible changes:</para>
      corrupted blocks.
    </para>
  </listitem>
+  <listitem>
+    <para>
+      <literal>displayManager.lightdm.greeters.gtk.clock-format.</literal>
+      has been added, the clock format string (as expected by
+      strftime, e.g. <literal>%H:%M</literal>) to use with the lightdm
+      gtk greeter panel.
+    </para>
+    <para>
+      If set to null the default clock format is used.
+    </para>
+  </listitem>
+  <listitem>
+    <para>
+      <literal>displayManager.lightdm.greeters.gtk.indicators</literal>
+      has been added, a list of allowed indicator modules to use with
+      the lightdm gtk greeter panel.
+    </para>
+    <para>
+      Built-in indicators include <literal>~a11y</literal>,
+      <literal>~language</literal>, <literal>~session</literal>,
+      <literal>~power</literal>, <literal>~clock</literal>,
+      <literal>~host</literal>, <literal>~spacer</literal>. Unity
+      indicators can be represented by short name
+      (e.g. <literal>sound</literal>, <literal>power</literal>),
+      service file name, or absolute path.
+    </para>
+    <para>
+      If set to <literal>null</literal> the default indicators are
+      used.
+    </para>
+    <para>
+      In order to have the previous default configuration add
+<programlisting>
+  services.xserver.displayManager.lightdm.greeters.gtk.indicators = [
+    "~host" "~spacer"
+    "~clock" "~spacer"
+    "~session"
+    "~language"
+    "~a11y"
+    "~power"
+  ];
+</programlisting>
+      to your <literal>configuration.nix</literal>.
+    </para>
+  </listitem>
+  <listitem>
+    <para>
+      The NixOS test driver supports user services declared by <literal>systemd.user.services</literal>.
+      The methods <literal>waitForUnit</literal>, <literal>getUnitInfo</literal>, <literal>startJob</literal>
+      and <literal>stopJob</literal> provide an optional <literal>$user</literal> argument for that purpose.
+    </para>
+  </listitem>
 </itemizedlist>

 </section>
--- a/nixos/lib/test-driver/Machine.pm
+++ b/nixos/lib/test-driver/Machine.pm
@ -362,8 +362,8 @@ sub mustFail {


 sub getUnitInfo {
-    my ($self, $unit) = @_;
-    my ($status, $lines) = $self->execute("systemctl --no-pager show '$unit'");
+    my ($self, $unit, $user) = @_;
+    my ($status, $lines) = $self->systemctl("--no-pager show \"$unit\"", $user);
    return undef if $status != 0;
    my $info = {};
    foreach my $line (split '\n', $lines) {
@ -373,6 +373,16 @@ sub getUnitInfo {
    return $info;
 }

+sub systemctl {
+    my ($self, $q, $user) = @_;
+    if ($user) {
+        $q =~ s/'/\\'/g;
+        return $self->execute("su -l $user -c \$'XDG_RUNTIME_DIR=/run/user/`id -u` systemctl --user $q'");
+    }
+
+    return $self->execute("systemctl $q");
+}
+
 # Fail if the given systemd unit is not in the "active" state.
 sub requireActiveUnit {
    my ($self, $unit) = @_;
@ -387,16 +397,16 @@ sub requireActiveUnit {

 # Wait for a systemd unit to reach the "active" state.
 sub waitForUnit {
-    my ($self, $unit) = @_;
+    my ($self, $unit, $user) = @_;
    $self->nest("waiting for unit ‘$unit’", sub {
        retry sub {
-            my $info = $self->getUnitInfo($unit);
+            my $info = $self->getUnitInfo($unit, $user);
            my $state = $info->{ActiveState};
            die "unit ‘$unit’ reached state ‘$state’\n" if $state eq "failed";
            if ($state eq "inactive") {
                # If there are no pending jobs, then assume this unit
                # will never reach active state.
-                my ($status, $jobs) = $self->execute("systemctl list-jobs --full 2>&1");
+                my ($status, $jobs) = $self->systemctl("list-jobs --full 2>&1", $user);
                if ($jobs =~ /No jobs/) {  # FIXME: fragile
                    # Handle the case where the unit may have started
                    # between the previous getUnitInfo() and
@ -430,14 +440,14 @@ sub waitForFile {
 }

 sub startJob {
-    my ($self, $jobName) = @_;
-    $self->execute("systemctl start $jobName");
+    my ($self, $jobName, $user) = @_;
+    $self->systemctl("start $jobName", $user);
    # FIXME: check result
 }

 sub stopJob {
-    my ($self, $jobName) = @_;
-    $self->execute("systemctl stop $jobName");
+    my ($self, $jobName, $user) = @_;
+    $self->systemctl("stop $jobName", $user);
 }


--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@ -197,10 +197,10 @@
      #input = 174; # unused
      sddm = 175;
      tss = 176;
-      memcached = 177;
+      #memcached = 177; removed 2018-01-03
      ntp = 179;
      zabbix = 180;
-      redis = 181;
+      #redis = 181; removed 2018-01-03
      unifi = 183;
      uptimed = 184;
      zope2 = 185;
@ -475,10 +475,10 @@
      input = 174;
      sddm = 175;
      tss = 176;
-      #memcached = 177; # unused
+      #memcached = 177; # unused, removed 2018-01-03
      #ntp = 179; # unused
      #zabbix = 180; # unused
-      #redis = 181; # unused
+      #redis = 181; # unused, removed 2018-01-03
      #unifi = 183; # unused
      #uptimed = 184; # unused
      #zope2 = 185; # unused
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -245,6 +245,7 @@
  ./services/hardware/udev.nix
  ./services/hardware/udisks2.nix
  ./services/hardware/upower.nix
+  ./services/hardware/usbmuxd.nix
  ./services/hardware/thermald.nix
  ./services/logging/SystemdJournal2Gelf.nix
  ./services/logging/awstats.nix
@ -260,6 +261,8 @@
  ./services/logging/rsyslogd.nix
  ./services/logging/syslog-ng.nix
  ./services/logging/syslogd.nix
+  ./services/mail/clamsmtp.nix
+  ./services/mail/dkimproxy-out.nix
  ./services/mail/dovecot.nix
  ./services/mail/dspam.nix
  ./services/mail/exim.nix
@ -443,7 +446,6 @@
  ./services/networking/dhcpd.nix
  ./services/networking/dnscache.nix
  ./services/networking/dnschain.nix
-  ./services/networking/dnscrypt-proxy.nix
  ./services/networking/dnscrypt-wrapper.nix
  ./services/networking/dnsmasq.nix
  ./services/networking/ejabberd.nix
@ -679,6 +681,7 @@
  ./system/activation/top-level.nix
  ./system/boot/coredump.nix
  ./system/boot/emergency-mode.nix
+  ./system/boot/grow-partition.nix
  ./system/boot/initrd-network.nix
  ./system/boot/initrd-ssh.nix
  ./system/boot/kernel.nix
@ -745,6 +748,7 @@
  ./virtualisation/lxcfs.nix
  ./virtualisation/lxd.nix
  ./virtualisation/amazon-options.nix
+  ./virtualisation/hyperv-guest.nix
  ./virtualisation/openvswitch.nix
  ./virtualisation/parallels-guest.nix
  ./virtualisation/rkt.nix
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@ -89,6 +89,9 @@ with lib;
    # Tarsnap
    (mkRenamedOptionModule [ "services" "tarsnap" "config" ] [ "services" "tarsnap" "archives" ])

+    # dnscrypt-proxy
+    (mkRemovedOptionModule [ "services" "dnscrypt-proxy" "enable" ] "")
+
    # ibus
    (mkRenamedOptionModule [ "programs" "ibus" "plugins" ] [ "i18n" "inputMethod" "ibus" "engines" ])

@ -186,6 +189,9 @@ with lib;
    (mkRenamedOptionModule [ "config" "fonts" "fontconfig" "ultimate" "forceAutohint" ] [ "config" "fonts" "fontconfig" "forceAutohint" ])
    (mkRenamedOptionModule [ "config" "fonts" "fontconfig" "ultimate" "renderMonoTTFAsBitmap" ] [ "config" "fonts" "fontconfig" "renderMonoTTFAsBitmap" ])

+    # Profile splitting
+    (mkRenamedOptionModule [ "virtualization" "growPartition" ] [ "boot" "growPartition" ])
+
    # Options that are obsolete and have no replacement.
    (mkRemovedOptionModule [ "boot" "initrd" "luks" "enable" ] "")
    (mkRemovedOptionModule [ "programs" "bash" "enable" ] "")
--- a/nixos/modules/services/audio/mopidy.nix
+++ b/nixos/modules/services/audio/mopidy.nix
@ -4,17 +4,22 @@ with pkgs;
 with lib;

 let
-
  uid = config.ids.uids.mopidy;
  gid = config.ids.gids.mopidy;
  cfg = config.services.mopidy;

  mopidyConf = writeText "mopidy.conf" cfg.configuration;

-  mopidyEnv = python.buildEnv.override {
-    extraLibs = [ mopidy ] ++ cfg.extensionPackages;
+  mopidyEnv = buildEnv {
+    name = "mopidy-with-extensions-${mopidy.version}";
+    paths = closePropagation cfg.extensionPackages;
+    pathsToLink = [ "/${python.sitePackages}" ];
+    buildInputs = [ makeWrapper ];
+    postBuild = ''
+      makeWrapper ${mopidy}/bin/mopidy $out/bin/mopidy \
+        --prefix PYTHONPATH : $out/${python.sitePackages}
+    '';
  };
-
 in {

  options = {
@ -61,7 +66,6 @@ in {

  };

-
  ###### implementation

  config = mkIf cfg.enable {
--- a/nixos/modules/services/continuous-integration/buildkite-agent.nix
+++ b/nixos/modules/services/continuous-integration/buildkite-agent.nix
@ -124,7 +124,7 @@ in
            name="${cfg.name}"
            meta-data="${cfg.meta-data}"
            build-path="${cfg.dataDir}/builds"
-            hooks-path="${cfg.hooks-path}"
+            hooks-path="${cfg.hooksPath}"
            bootstrap-script="${pkgs.buildkite-agent}/share/bootstrap.sh"
            EOF
          '';
--- a/nixos/modules/services/databases/memcached.nix
+++ b/nixos/modules/services/databases/memcached.nix
@ -40,11 +40,7 @@ in
        description = "The port to bind to";
      };

-      socket = mkOption {
-        default = "";
-        description = "Unix socket path to listen on. Setting this will disable network support";
-        example = "/var/run/memcached";
-      };
+      enableUnixSocket = mkEnableOption "unix socket at /run/memcached/memcached.sock";

      maxMemory = mkOption {
        default = 64;
@ -68,31 +64,40 @@ in

  config = mkIf config.services.memcached.enable {

-    users.extraUsers.memcached =
-      { name = cfg.user;
-        uid = config.ids.uids.memcached;
-        description = "Memcached server user";
-      };
+    users.extraUsers = optional (cfg.user == "memcached") {
+      name = "memcached";
+      description = "Memcached server user";
+    };

    environment.systemPackages = [ memcached ];

-    systemd.services.memcached =
-      { description = "Memcached server";
+    systemd.services.memcached = {
+      description = "Memcached server";

-        wantedBy = [ "multi-user.target" ];
-        after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];

-        serviceConfig = {
-          ExecStart =
-            let
-              networking = if cfg.socket != ""
-                then "-s ${cfg.socket}"
-                else "-l ${cfg.listen} -p ${toString cfg.port}";
-            in "${memcached}/bin/memcached ${networking} -m ${toString cfg.maxMemory} -c ${toString cfg.maxConnections} ${concatStringsSep " " cfg.extraOptions}";
+      serviceConfig = {
+        PermissionsStartOnly = true;
+        ExecStartPre = optionals cfg.enableUnixSocket [
+          "${pkgs.coreutils}/bin/install -d -o ${cfg.user} /run/memcached/"
+          "${pkgs.coreutils}/bin/chown -R ${cfg.user} /run/memcached/"
+        ];
+        ExecStart =
+        let
+          networking = if cfg.enableUnixSocket
+          then "-s /run/memcached/memcached.sock"
+          else "-l ${cfg.listen} -p ${toString cfg.port}";
+        in "${memcached}/bin/memcached ${networking} -m ${toString cfg.maxMemory} -c ${toString cfg.maxConnections} ${concatStringsSep " " cfg.extraOptions}";

-          User = cfg.user;
-        };
+        User = cfg.user;
      };
+    };
  };
+  imports = [
+    (mkRemovedOptionModule ["services" "memcached" "socket"] ''
+      This option was replaced by a fixed unix socket path at /run/memcached/memcached.sock enabled using services.memached.enableUnixSocket.
+    '')
+  ];

 }
--- a/nixos/modules/services/databases/redis.nix
+++ b/nixos/modules/services/databases/redis.nix
@ -219,7 +219,6 @@ in

    users.extraUsers.redis =
      { name = cfg.user;
-        uid = config.ids.uids.redis;
        description = "Redis database user";
      };

--- a/nixos/modules/services/hardware/80-net-setup-link.rules
+++ b/nixos/modules/services/hardware/80-net-setup-link.rules
@ -1,13 +0,0 @@
-# Copied from systemd 203.
-ACTION=="remove", GOTO="net_name_slot_end"
-SUBSYSTEM!="net", GOTO="net_name_slot_end"
-NAME!="", GOTO="net_name_slot_end"
-
-IMPORT{cmdline}="net.ifnames"
-ENV{net.ifnames}=="0", GOTO="net_name_slot_end"
-
-NAME=="", ENV{ID_NET_NAME_ONBOARD}!="", NAME="$env{ID_NET_NAME_ONBOARD}"
-NAME=="", ENV{ID_NET_NAME_SLOT}!="", NAME="$env{ID_NET_NAME_SLOT}"
-NAME=="", ENV{ID_NET_NAME_PATH}!="", NAME="$env{ID_NET_NAME_PATH}"
-
-LABEL="net_name_slot_end"
--- a/nixos/modules/services/hardware/udev.nix
+++ b/nixos/modules/services/hardware/udev.nix
@ -119,7 +119,7 @@ let
      fi

      ${optionalString config.networking.usePredictableInterfaceNames ''
-        cp ${./80-net-setup-link.rules} $out/80-net-setup-link.rules
+        cp ${udev}/lib/udev/rules.d/80-net-setup-link.rules $out/80-net-setup-link.rules
      ''}

      # If auto-configuration is disabled, then remove
--- a/nixos/modules/services/hardware/usbmuxd.nix
+++ b/nixos/modules/services/hardware/usbmuxd.nix
@ -0,0 +1,74 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  defaultUserGroup = "usbmux";
+  apple = "05ac";
+
+  cfg = config.services.usbmuxd;
+
+in
+
+{
+  options.services.usbmuxd = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Enable the usbmuxd ("USB multiplexing daemon") service. This daemon is
+        in charge of multiplexing connections over USB to an iOS device. This is
+        needed for transferring data from and to iOS devices (see ifuse). Also
+        this may enable plug-n-play tethering for iPhones.
+      '';
+    };
+
+    user = mkOption {
+      type = types.str;
+      default = defaultUserGroup;
+      description = ''
+        The user usbmuxd should use to run after startup.
+      '';
+    };
+
+    group = mkOption {
+      type = types.str;
+      default = defaultUserGroup;
+      description = ''
+        The group usbmuxd should use to run after startup.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    users.extraUsers = optional (cfg.user == defaultUserGroup) {
+      name = cfg.user;
+      description = "usbmuxd user";
+      group = cfg.group;
+    };
+
+    users.extraGroups = optional (cfg.group == defaultUserGroup) {
+      name = cfg.group;
+    };
+
+    # Give usbmuxd permission for Apple devices
+    services.udev.extraRules = ''
+      SUBSYSTEM=="usb", ATTR{idVendor}=="${apple}", GROUP="${cfg.group}"
+    '';
+
+    systemd.services.usbmuxd = {
+      description = "usbmuxd";
+      wantedBy = [ "multi-user.target" ];
+      unitConfig.Documentation = "man:usbmuxd(8)";
+      serviceConfig = {
+        # Trigger the udev rule manually. This doesn't require replugging the
+        # device when first enabling the option to get it to work
+        ExecStartPre = "${pkgs.libudev}/bin/udevadm trigger -s usb -a idVendor=${apple}";
+        ExecStart = "${pkgs.usbmuxd}/bin/usbmuxd -U ${cfg.user} -f";
+      };
+    };
+
+  };
+}
--- a/nixos/modules/services/mail/clamsmtp.nix
+++ b/nixos/modules/services/mail/clamsmtp.nix
@ -0,0 +1,179 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+  cfg = config.services.clamsmtp;
+  clamdSocket = "/run/clamav/clamd.ctl"; # See services/security/clamav.nix
+in
+{
+  ##### interface
+  options = {
+    services.clamsmtp = {
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Whether to enable clamsmtp.";
+      };
+
+      instances = mkOption {
+        description = "Instances of clamsmtp to run.";
+        type = types.listOf (types.submodule { options = {
+          action = mkOption {
+            type = types.enum [ "bounce" "drop" "pass" ];
+            default = "drop";
+            description =
+              ''
+                Action to take when a virus is detected.
+
+                Note that viruses often spoof sender addresses, so bouncing is
+                in most cases not a good idea.
+              '';
+          };
+
+          header = mkOption {
+            type = types.str;
+            default = "";
+            example = "X-Virus-Scanned: ClamAV using ClamSMTP";
+            description =
+              ''
+                A header to add to scanned messages. See clamsmtpd.conf(5) for
+                more details. Empty means no header.
+              '';
+          };
+
+          keepAlives = mkOption {
+            type = types.int;
+            default = 0;
+            description =
+              ''
+                Number of seconds to wait between each NOOP sent to the sending
+                server. 0 to disable.
+
+                This is meant for slow servers where the sending MTA times out
+                waiting for clamd to scan the file.
+              '';
+          };
+
+          listen = mkOption {
+            type = types.str;
+            example = "127.0.0.1:10025";
+            description =
+              ''
+                Address to wait for incoming SMTP connections on. See
+                clamsmtpd.conf(5) for more details.
+              '';
+          };
+
+          quarantine = mkOption {
+            type = types.bool;
+            default = false;
+            description =
+              ''
+                Whether to quarantine files that contain viruses by leaving them
+                in the temporary directory.
+              '';
+          };
+
+          maxConnections = mkOption {
+            type = types.int;
+            default = 64;
+            description = "Maximum number of connections to accept at once.";
+          };
+
+          outAddress = mkOption {
+            type = types.str;
+            description =
+              ''
+                Address of the SMTP server to send email to once it has been
+                scanned.
+              '';
+          };
+
+          tempDirectory = mkOption {
+            type = types.str;
+            default = "/tmp";
+            description =
+              ''
+                Temporary directory that needs to be accessible to both clamd
+                and clamsmtpd.
+              '';
+          };
+
+          timeout = mkOption {
+            type = types.int;
+            default = 180;
+            description = "Time-out for network connections.";
+          };
+
+          transparentProxy = mkOption {
+            type = types.bool;
+            default = false;
+            description = "Enable clamsmtp's transparent proxy support.";
+          };
+
+          virusAction = mkOption {
+            type = with types; nullOr path;
+            default = null;
+            description =
+              ''
+                Command to run when a virus is found. Please see VIRUS ACTION in
+                clamsmtpd(8) for a discussion of this option and its safe use.
+              '';
+          };
+
+          xClient = mkOption {
+            type = types.bool;
+            default = false;
+            description =
+              ''
+                Send the XCLIENT command to the receiving server, for forwarding
+                client addresses and connection information if the receiving
+                server supports this feature.
+              '';
+          };
+        };});
+      };
+    };
+  };
+
+  ##### implementation
+  config = let
+    configfile = conf: pkgs.writeText "clamsmtpd.conf"
+      ''
+        Action: ${conf.action}
+        ClamAddress: ${clamdSocket}
+        Header: ${conf.header}
+        KeepAlives: ${toString conf.keepAlives}
+        Listen: ${conf.listen}
+        Quarantine: ${if conf.quarantine then "on" else "off"}
+        MaxConnections: ${toString conf.maxConnections}
+        OutAddress: ${conf.outAddress}
+        TempDirectory: ${conf.tempDirectory}
+        TimeOut: ${toString conf.timeout}
+        TransparentProxy: ${if conf.transparentProxy then "on" else "off"}
+        User: clamav
+        ${optionalString (conf.virusAction != null) "VirusAction: ${conf.virusAction}"}
+        XClient: ${if conf.xClient then "on" else "off"}
+      '';
+  in
+    mkIf cfg.enable {
+      assertions = [
+        { assertion = config.services.clamav.daemon.enable;
+          message = "clamsmtp requires clamav to be enabled";
+        }
+      ];
+
+      systemd.services = listToAttrs (imap1 (i: conf:
+        nameValuePair "clamsmtp-${toString i}" {
+          description = "ClamSMTP instance ${toString i}";
+          wantedBy = [ "multi-user.target" ];
+          script = "exec ${pkgs.clamsmtp}/bin/clamsmtpd -f ${configfile conf}";
+          after = [ "clamav-daemon.service" ];
+          requires = [ "clamav-daemon.service" ];
+          serviceConfig.Type = "forking";
+          serviceConfig.PrivateTmp = "yes";
+          unitConfig.JoinsNamespaceOf = "clamav-daemon.service";
+        }
+      ) cfg.instances);
+    };
+}
--- a/nixos/modules/services/mail/dkimproxy-out.nix
+++ b/nixos/modules/services/mail/dkimproxy-out.nix
@ -0,0 +1,118 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+  cfg = config.services.dkimproxy-out;
+  keydir = "/var/lib/dkimproxy-out";
+  privkey = "${keydir}/private.key";
+  pubkey = "${keydir}/public.key";
+in
+{
+  ##### interface
+  options = {
+    services.dkimproxy-out = {
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description =
+          ''
+            Whether to enable dkimproxy_out.
+
+            Note that a key will be auto-generated, and can be found in
+            ${keydir}.
+          '';
+      };
+
+      listen = mkOption {
+        type = types.str;
+        example = "127.0.0.1:10027";
+        description = "Address:port DKIMproxy should listen on.";
+      };
+
+      relay = mkOption {
+        type = types.str;
+        example = "127.0.0.1:10028";
+        description = "Address:port DKIMproxy should forward mail to.";
+      };
+
+      domains = mkOption {
+        type = with types; listOf str;
+        example = [ "example.org" "example.com" ];
+        description = "List of domains DKIMproxy can sign for.";
+      };
+
+      selector = mkOption {
+        type = types.str;
+        example = "selector1";
+        description =
+          ''
+            The selector to use for DKIM key identification.
+
+            For example, if 'selector1' is used here, then for each domain
+            'example.org' given in `domain`, 'selector1._domainkey.example.org'
+            should contain the TXT record indicating the public key is the one
+            in ${pubkey}: "v=DKIM1; t=s; p=[THE PUBLIC KEY]".
+          '';
+      };
+
+      keySize = mkOption {
+        type = types.int;
+        default = 2048;
+        description =
+          ''
+            Size of the RSA key to use to sign outgoing emails. Note that the
+            maximum mandatorily verified as per RFC6376 is 2048.
+          '';
+      };
+
+      # TODO: allow signature for other schemes than dkim(c=relaxed/relaxed)?
+      # This being the scheme used by gmail, maybe nothing more is needed for
+      # reasonable use.
+    };
+  };
+
+  ##### implementation
+  config = let
+    configfile = pkgs.writeText "dkimproxy_out.conf"
+      ''
+        listen ${cfg.listen}
+        relay ${cfg.relay}
+
+        domain ${concatStringsSep "," cfg.domains}
+        selector ${cfg.selector}
+
+        signature dkim(c=relaxed/relaxed)
+
+        keyfile ${privkey}
+      '';
+  in
+    mkIf cfg.enable {
+      users.groups.dkimproxy-out = {};
+      users.users.dkimproxy-out = {
+        description = "DKIMproxy_out daemon";
+        group = "dkimproxy-out";
+        isSystemUser = true;
+      };
+
+      systemd.services.dkimproxy-out = {
+        description = "DKIMproxy_out";
+        wantedBy = [ "multi-user.target" ];
+        preStart = ''
+          if [ ! -d "${keydir}" ]; then
+            mkdir -p "${keydir}"
+            chmod 0700 "${keydir}"
+            ${pkgs.openssl}/bin/openssl genrsa -out "${privkey}" ${toString cfg.keySize}
+            ${pkgs.openssl}/bin/openssl rsa -in "${privkey}" -pubout -out "${pubkey}"
+            chown -R dkimproxy-out:dkimproxy-out "${keydir}"
+          fi
+        '';
+        script = ''
+          exec ${pkgs.dkimproxy}/bin/dkimproxy.out --conf_file=${configfile}
+        '';
+        serviceConfig = {
+          User = "dkimproxy-out";
+          PermissionsStartOnly = true;
+        };
+      };
+    };
+}
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@ -29,8 +29,12 @@ let

  gitalyToml = pkgs.writeText "gitaly.toml" ''
    socket_path = "${lib.escape ["\""] gitalySocket}"
+    bin_dir = "${cfg.packages.gitaly}/bin"
    prometheus_listen_addr = "localhost:9236"

+    [git]
+    bin_path = "${pkgs.git}/bin/git"
+
    [gitaly-ruby]
    dir = "${cfg.packages.gitaly.ruby}"

@ -70,7 +74,7 @@ let
      secret_key_base: ${cfg.secrets.secret}
      otp_key_base: ${cfg.secrets.otp}
      db_key_base: ${cfg.secrets.db}
-      jws_private_key: ${builtins.toJSON cfg.secrets.jws}
+      openid_connect_signing_key: ${builtins.toJSON cfg.secrets.jws}
  '';

  gitlabConfig = {
@ -104,6 +108,7 @@ let
      ldap.enabled = false;
      omniauth.enabled = false;
      shared.path = "${cfg.statePath}/shared";
+      gitaly.client_path = "${cfg.packages.gitaly}/bin";
      backup.path = "${cfg.backupPath}";
      gitlab_shell = {
        path = "${cfg.packages.gitlab-shell}";
@ -117,8 +122,6 @@ let
      };
      git = {
        bin_path = "git";
-        max_size = 20971520; # 20MB
-        timeout = 10;
      };
      monitoring = {
        ip_whitelist = [ "127.0.0.0/8" "::1/128" ];
@ -489,7 +492,9 @@ in {
      after = [ "network.target" "gitlab.service" ];
      wantedBy = [ "multi-user.target" ];
      environment.HOME = gitlabEnv.HOME;
-      path = with pkgs; [ gitAndTools.git cfg.packages.gitaly.rubyEnv ];
+      environment.GEM_HOME = "${cfg.packages.gitaly.rubyEnv}/${ruby.gemPath}";
+      environment.GITLAB_SHELL_CONFIG_PATH = gitlabEnv.GITLAB_SHELL_CONFIG_PATH;
+      path = with pkgs; [ gitAndTools.git cfg.packages.gitaly.rubyEnv ruby ];
      serviceConfig = {
        #PermissionsStartOnly = true; # preStart must be run as root
        Type = "simple";
--- a/nixos/modules/services/misc/matrix-synapse.nix
+++ b/nixos/modules/services/misc/matrix-synapse.nix
@ -578,6 +578,18 @@ in {
          Extra config options for matrix-synapse.
        '';
      };
+      extraConfigFiles = mkOption {
+        type = types.listOf types.path;
+        default = [];
+        description = ''
+          Extra config files to include.
+
+          The configuration files will be included based on the command line
+          argument --config-path. This allows to configure secrets without
+          having to go through the Nix store, e.g. based on deployment keys if
+          NixOPS is in use.
+        '';
+      };
      logConfig = mkOption {
        type = types.lines;
        default = readFile ./matrix-synapse-log_config.yaml;
@ -627,7 +639,11 @@ in {
        Group = "matrix-synapse";
        WorkingDirectory = cfg.dataDir;
        PermissionsStartOnly = true;
-        ExecStart = "${cfg.package}/bin/homeserver --config-path ${configFile} --keys-directory ${cfg.dataDir}";
+        ExecStart = ''
+          ${cfg.package}/bin/homeserver \
+            ${ concatMapStringsSep "\n  " (x: "--config-path ${x} \\") ([ configFile ] ++ cfg.extraConfigFiles) }
+            --keys-directory ${cfg.dataDir}
+        '';
        Restart = "on-failure";
      };
    };
--- a/nixos/modules/services/networking/dnscrypt-proxy.nix
+++ b/nixos/modules/services/networking/dnscrypt-proxy.nix
@ -1,321 +0,0 @@
-{ config, lib, pkgs, ... }:
-with lib;
-
-let
-  cfg = config.services.dnscrypt-proxy;
-
-  stateDirectory = "/var/lib/dnscrypt-proxy";
-
-  # The minisign public key used to sign the upstream resolver list.
-  # This is somewhat more flexible than preloading the key as an
-  # embedded string.
-  upstreamResolverListPubKey = pkgs.fetchurl {
-    url = https://raw.githubusercontent.com/jedisct1/dnscrypt-proxy/master/minisign.pub;
-    sha256 = "18lnp8qr6ghfc2sd46nn1rhcpr324fqlvgsp4zaigw396cd7vnnh";
-  };
-
-  # Internal flag indicating whether the upstream resolver list is used.
-  useUpstreamResolverList = cfg.customResolver == null;
-
-  # The final local address.
-  localAddress = "${cfg.localAddress}:${toString cfg.localPort}";
-
-  # The final resolvers list path.
-  resolverList = "${stateDirectory}/dnscrypt-resolvers.csv";
-
-  # Build daemon command line
-
-  resolverArgs =
-    if (cfg.customResolver == null)
-      then
-        [ "-L ${resolverList}"
-          "-R ${cfg.resolverName}"
-        ]
-      else with cfg.customResolver;
-        [ "-N ${name}"
-          "-k ${key}"
-          "-r ${address}:${toString port}"
-        ];
-
-  daemonArgs =
-       [ "-a ${localAddress}" ]
-    ++ resolverArgs
-    ++ cfg.extraArgs;
-in
-
-{
-  meta = {
-    maintainers = with maintainers; [ joachifm ];
-    doc = ./dnscrypt-proxy.xml;
-  };
-
-  options = {
-    # Before adding another option, consider whether it could
-    # equally well be passed via extraArgs.
-
-    services.dnscrypt-proxy = {
-      enable = mkOption {
-        default = false;
-        type = types.bool;
-        description = "Whether to enable the DNSCrypt client proxy";
-      };
-
-      localAddress = mkOption {
-        default = "127.0.0.1";
-        type = types.str;
-        description = ''
-          Listen for DNS queries to relay on this address. The only reason to
-          change this from its default value is to proxy queries on behalf
-          of other machines (typically on the local network).
-        '';
-      };
-
-      localPort = mkOption {
-        default = 53;
-        type = types.int;
-        description = ''
-          Listen for DNS queries to relay on this port. The default value
-          assumes that the DNSCrypt proxy should relay DNS queries directly.
-          When running as a forwarder for another DNS client, set this option
-          to a different value; otherwise leave the default.
-        '';
-      };
-
-      resolverName = mkOption {
-        default = "random";
-        example = "dnscrypt.eu-nl";
-        type = types.nullOr types.str;
-        description = ''
-          The name of the DNSCrypt resolver to use, taken from
-          <filename>${resolverList}</filename>.  The default is to
-          pick a random non-logging resolver that supports DNSSEC.
-        '';
-      };
-
-      customResolver = mkOption {
-        default = null;
-        description = ''
-          Use an unlisted resolver (e.g., a private DNSCrypt provider). For
-          advanced users only. If specified, this option takes precedence.
-        '';
-        type = types.nullOr (types.submodule ({ ... }: { options = {
-          address = mkOption {
-            type = types.str;
-            description = "IP address";
-            example = "208.67.220.220";
-          };
-
-          port = mkOption {
-            type = types.int;
-            description = "Port";
-            default = 443;
-          };
-
-          name = mkOption {
-            type = types.str;
-            description = "Fully qualified domain name";
-            example = "2.dnscrypt-cert.example.com";
-          };
-
-          key = mkOption {
-            type = types.str;
-            description = "Public key";
-            example = "B735:1140:206F:225D:3E2B:D822:D7FD:691E:A1C3:3CC8:D666:8D0C:BE04:BFAB:CA43:FB79";
-          };
-        }; }));
-      };
-
-      extraArgs = mkOption {
-        default = [];
-        type = types.listOf types.str;
-        description = ''
-          Additional command-line arguments passed verbatim to the daemon.
-          See <citerefentry><refentrytitle>dnscrypt-proxy</refentrytitle>
-          <manvolnum>8</manvolnum></citerefentry> for details.
-        '';
-        example = [ "-X libdcplugin_example_cache.so,--min-ttl=60" ];
-      };
-    };
-  };
-
-  config = mkIf cfg.enable (mkMerge [{
-    assertions = [
-      { assertion = (cfg.customResolver != null) || (cfg.resolverName != null);
-        message   = "please configure upstream DNSCrypt resolver";
-      }
-    ];
-
-    users.users.dnscrypt-proxy = {
-      description = "dnscrypt-proxy daemon user";
-      isSystemUser = true;
-      group = "dnscrypt-proxy";
-    };
-    users.groups.dnscrypt-proxy = {};
-
-    systemd.sockets.dnscrypt-proxy = {
-      description = "dnscrypt-proxy listening socket";
-      documentation = [ "man:dnscrypt-proxy(8)" ];
-
-      wantedBy = [ "sockets.target" ];
-
-      socketConfig = {
-        ListenStream = localAddress;
-        ListenDatagram = localAddress;
-      };
-    };
-
-    systemd.services.dnscrypt-proxy = {
-      description = "dnscrypt-proxy daemon";
-      documentation = [ "man:dnscrypt-proxy(8)" ];
-
-      before = [ "nss-lookup.target" ];
-      after = [ "network.target" ];
-      requires = [ "dnscrypt-proxy.socket "];
-
-      serviceConfig = {
-        NonBlocking = "true";
-        ExecStart = "${pkgs.dnscrypt-proxy}/bin/dnscrypt-proxy ${toString daemonArgs}";
-        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
-
-        User = "dnscrypt-proxy";
-
-        PrivateTmp = true;
-        PrivateDevices = true;
-        ProtectHome = true;
-      };
-    };
-    }
-
-    (mkIf config.security.apparmor.enable {
-    systemd.services.dnscrypt-proxy.after = [ "apparmor.service" ];
-
-    security.apparmor.profiles = singleton (pkgs.writeText "apparmor-dnscrypt-proxy" ''
-      ${pkgs.dnscrypt-proxy}/bin/dnscrypt-proxy {
-        /dev/null rw,
-        /dev/urandom r,
-
-        /etc/passwd r,
-        /etc/group r,
-        ${config.environment.etc."nsswitch.conf".source} r,
-
-        ${getLib pkgs.glibc}/lib/*.so mr,
-        ${pkgs.tzdata}/share/zoneinfo/** r,
-
-        network inet stream,
-        network inet6 stream,
-        network inet dgram,
-        network inet6 dgram,
-
-        ${getLib pkgs.dnscrypt-proxy}/lib/dnscrypt-proxy/libdcplugin*.so mr,
-
-        ${getLib pkgs.gcc.cc}/lib/libssp.so.* mr,
-        ${getLib pkgs.libsodium}/lib/libsodium.so.* mr,
-        ${getLib pkgs.systemd}/lib/libsystemd.so.* mr,
-        ${getLib pkgs.xz}/lib/liblzma.so.* mr,
-        ${getLib pkgs.libgcrypt}/lib/libgcrypt.so.* mr,
-        ${getLib pkgs.libgpgerror}/lib/libgpg-error.so.* mr,
-        ${getLib pkgs.libcap}/lib/libcap.so.* mr,
-        ${getLib pkgs.lz4}/lib/liblz4.so.* mr,
-        ${getLib pkgs.attr}/lib/libattr.so.* mr, # */
-
-        ${resolverList} r,
-
-        /run/systemd/notify rw,
-      }
-    '');
-    })
-
-    (mkIf useUpstreamResolverList {
-    systemd.services.init-dnscrypt-proxy-statedir = {
-      description = "Initialize dnscrypt-proxy state directory";
-
-      wantedBy = [ "dnscrypt-proxy.service" ];
-      before = [ "dnscrypt-proxy.service" ];
-
-      script = ''
-        mkdir -pv ${stateDirectory}
-        chown -c dnscrypt-proxy:dnscrypt-proxy ${stateDirectory}
-        cp -uv \
-          ${pkgs.dnscrypt-proxy}/share/dnscrypt-proxy/dnscrypt-resolvers.csv \
-          ${stateDirectory}
-      '';
-
-      serviceConfig = {
-        Type = "oneshot";
-        RemainAfterExit = true;
-      };
-    };
-
-    systemd.services.update-dnscrypt-resolvers = {
-      description = "Update list of DNSCrypt resolvers";
-
-      requires = [ "init-dnscrypt-proxy-statedir.service" ];
-      after = [ "init-dnscrypt-proxy-statedir.service" ];
-
-      path = with pkgs; [ curl diffutils dnscrypt-proxy minisign ];
-      script = ''
-        cd ${stateDirectory}
-        domain=raw.githubusercontent.com
-        get="curl -fSs --resolve $domain:443:$(hostip -r 8.8.8.8 $domain | head -1)"
-        $get -o dnscrypt-resolvers.csv.tmp \
-          https://$domain/jedisct1/dnscrypt-proxy/master/dnscrypt-resolvers.csv
-        $get -o dnscrypt-resolvers.csv.minisig.tmp \
-          https://$domain/jedisct1/dnscrypt-proxy/master/dnscrypt-resolvers.csv.minisig
-        mv dnscrypt-resolvers.csv.minisig{.tmp,}
-        if ! minisign -q -V -p ${upstreamResolverListPubKey} \
-          -m dnscrypt-resolvers.csv.tmp -x dnscrypt-resolvers.csv.minisig ; then
-          echo "failed to verify resolver list!" >&2
-          exit 1
-        fi
-        [[ -f dnscrypt-resolvers.csv ]] && mv dnscrypt-resolvers.csv{,.old}
-        mv dnscrypt-resolvers.csv{.tmp,}
-        if cmp dnscrypt-resolvers.csv{,.old} ; then
-          echo "no change"
-        else
-          echo "resolver list updated"
-        fi
-      '';
-
-      serviceConfig = {
-        PrivateTmp = true;
-        PrivateDevices = true;
-        ProtectHome = true;
-        ProtectSystem = "strict";
-        ReadWritePaths = "${dirOf stateDirectory} ${stateDirectory}";
-        SystemCallFilter = "~@mount";
-      };
-    };
-
-    systemd.timers.update-dnscrypt-resolvers = {
-      wantedBy = [ "timers.target" ];
-      timerConfig = {
-        OnBootSec = "5min";
-        OnUnitActiveSec = "6h";
-      };
-    };
-    })
-    ]);
-
-  imports = [
-    (mkRenamedOptionModule [ "services" "dnscrypt-proxy" "port" ] [ "services" "dnscrypt-proxy" "localPort" ])
-
-    (mkChangedOptionModule
-      [ "services" "dnscrypt-proxy" "tcpOnly" ]
-      [ "services" "dnscrypt-proxy" "extraArgs" ]
-      (config:
-        let val = getAttrFromPath [ "services" "dnscrypt-proxy" "tcpOnly" ] config; in
-        optional val "-T"))
-
-    (mkChangedOptionModule
-      [ "services" "dnscrypt-proxy" "ephemeralKeys" ]
-      [ "services" "dnscrypt-proxy" "extraArgs" ]
-      (config:
-        let val = getAttrFromPath [ "services" "dnscrypt-proxy" "ephemeralKeys" ] config; in
-        optional val "-E"))
-
-    (mkRemovedOptionModule [ "services" "dnscrypt-proxy" "resolverList" ] ''
-      The current resolver listing from upstream is always used
-      unless a custom resolver is specified.
-    '')
-  ];
-}
--- a/nixos/modules/services/networking/dnscrypt-proxy.xml
+++ b/nixos/modules/services/networking/dnscrypt-proxy.xml
@ -1,69 +0,0 @@
-<chapter xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-dnscrypt-proxy">
-
-  <title>DNSCrypt client proxy</title>
-
-  <para>
-    The DNSCrypt client proxy relays DNS queries to a DNSCrypt enabled
-    upstream resolver. The traffic between the client and the upstream
-    resolver is encrypted and authenticated, mitigating the risk of MITM
-    attacks, DNS poisoning attacks, and third-party snooping (assuming the
-    upstream is trustworthy).
-  </para>
-
-  <sect1><title>Basic configuration</title>
-
-  <para>
-    To enable the client proxy, set
-    <programlisting>
-      services.dnscrypt-proxy.enable = true;
-    </programlisting>
-  </para>
-
-  <para>
-    Enabling the client proxy does not alter the system nameserver; to
-    relay local queries, prepend <literal>127.0.0.1</literal> to
-    <option>networking.nameservers</option>.
-  </para>
-
-  </sect1>
-
-  <sect1><title>As a forwarder for another DNS client</title>
-
-  <para>
-    To run the DNSCrypt proxy client as a forwarder for another
-    DNS client, change the default proxy listening port to a
-    non-standard value and point the other client to it:
-    <programlisting>
-      services.dnscrypt-proxy.localPort = 43;
-    </programlisting>
-  </para>
-
-  <sect2><title>dnsmasq</title>
-  <para>
-    <programlisting>
-      {
-        services.dnsmasq.enable = true;
-        services.dnsmasq.servers = [ "127.0.0.1#43" ];
-      }
-    </programlisting>
-  </para>
-  </sect2>
-
-  <sect2><title>unbound</title>
-  <para>
-    <programlisting>
-      {
-        services.unbound.enable = true;
-        services.unbound.forwardAddresses = [ "127.0.0.1@43" ];
-      }
-    </programlisting>
-  </para>
-  </sect2>
-
-  </sect1>
-
-</chapter>
--- a/nixos/modules/services/security/clamav.nix
+++ b/nixos/modules/services/security/clamav.nix
@ -97,8 +97,8 @@ in

    systemd.services.clamav-daemon = optionalAttrs cfg.daemon.enable {
      description = "ClamAV daemon (clamd)";
-      after = mkIf cfg.updater.enable [ "clamav-freshclam.service" ];
-      requires = mkIf cfg.updater.enable [ "clamav-freshclam.service" ];
+      after = optional cfg.updater.enable "clamav-freshclam.service";
+      requires = optional cfg.updater.enable "clamav-freshclam.service";
      wantedBy = [ "multi-user.target" ];
      restartTriggers = [ clamdConfigFile ];

--- a/nixos/modules/services/web-apps/tt-rss.nix
+++ b/nixos/modules/services/web-apps/tt-rss.nix
@ -99,8 +99,8 @@ let

      user = mkOption {
        type = types.str;
-        default = "nginx";
-        example = "nginx";
+        default = "tt_rss";
+        example = "tt_rss";
        description = ''
          User account under which both the update daemon and the web-application run.
        '';
@ -466,26 +466,28 @@ let
      '';
    };

-    services.nginx.virtualHosts = mkIf (cfg.virtualHost != null) {
-      "${cfg.virtualHost}" = {
-        root = "${cfg.root}";
+    services.nginx = {
+      enable = true;
+      # NOTE: No configuration is done if not using virtual host
+      virtualHosts = mkIf (cfg.virtualHost != null) {
+        "${cfg.virtualHost}" = {
+          root = "${cfg.root}";

-        locations."/" = {
-          index = "index.php";
-        };
+          locations."/" = {
+            index = "index.php";
+          };

-        locations."~ \.php$" = {
-          extraConfig = ''
-            fastcgi_split_path_info ^(.+\.php)(/.+)$;
-            fastcgi_pass unix:${phpfpmSocketName};
-            fastcgi_index index.php;
-            fastcgi_param SCRIPT_FILENAME ${cfg.root}/$fastcgi_script_name;
-          '';
+          locations."~ \.php$" = {
+            extraConfig = ''
+              fastcgi_split_path_info ^(.+\.php)(/.+)$;
+              fastcgi_pass unix:${phpfpmSocketName};
+              fastcgi_index index.php;
+            '';
+          };
        };
      };
    };

-
    systemd.services.tt-rss = let
      dbService = if cfg.database.type == "pgsql" then "postgresql.service" else "mysql.service";
    in {
@ -496,7 +498,7 @@ let
          callSql = e:
              if cfg.database.type == "pgsql" then ''
                  ${optionalString (cfg.database.password != null) "PGPASSWORD=${cfg.database.password}"} \
-                  ${pkgs.postgresql95}/bin/psql \
+                  ${pkgs.sudo}/bin/sudo -u ${cfg.user} ${config.services.postgresql.package}/bin/psql \
                    -U ${cfg.database.user} \
                    ${optionalString (cfg.database.host != null) "-h ${cfg.database.host} --port ${toString dbPort}"} \
                    -c '${e}' \
@ -521,6 +523,14 @@ let
        ''

        + (optionalString (cfg.database.type == "pgsql") ''
+          ${optionalString (cfg.database.host == null && cfg.database.password == null) ''
+            if ! [ -e ${cfg.root}/.db-created ]; then
+              ${pkgs.sudo}/bin/sudo -u ${config.services.postgresql.superUser} ${config.services.postgresql.package}/bin/createuser ${cfg.database.user}
+              ${pkgs.sudo}/bin/sudo -u ${config.services.postgresql.superUser} ${config.services.postgresql.package}/bin/createdb -O ${cfg.database.user} ${cfg.database.name}
+              touch ${cfg.root}/.db-created
+            fi
+          ''}
+
          exists=$(${callSql "select count(*) > 0 from pg_tables where tableowner = user"} \
          | tail -n+3 | head -n-2 | sed -e 's/[ \n\t]*//')

@ -554,5 +564,28 @@ let
        requires = ["${dbService}"];
        after = ["network.target" "${dbService}"];
    };
+
+    services.mysql = optionalAttrs (cfg.database.type == "mysql") {
+      enable = true;
+      package = mkDefault pkgs.mysql;
+      ensureDatabases = [ cfg.database.name ];
+      ensureUsers = [
+        {
+          name = cfg.user;
+          ensurePermissions = {
+            "${cfg.database.name}.*" = "ALL PRIVILEGES";
+          };
+        }
+      ];
+    };
+
+    services.postgresql = optionalAttrs (cfg.database.type == "pgsql") {
+      enable = mkDefault true;
+    };
+
+    users = optionalAttrs (cfg.user == "tt_rss") {
+      extraUsers.tt_rss.group = "tt_rss";
+      extraGroups.tt_rss = {};
+    };
  };
 }
--- a/nixos/modules/services/web-servers/tomcat.nix
+++ b/nixos/modules/services/web-servers/tomcat.nix
@ -29,7 +29,7 @@ in
        type = types.package;
        default = pkgs.tomcat85;
        defaultText = "pkgs.tomcat85";
-        example = lib.literalExample "pkgs.tomcatUnstable";
+        example = lib.literalExample "pkgs.tomcat9";
        description = ''
          Which tomcat package to use.
        '';
--- a/nixos/modules/services/x11/desktop-managers/mate.nix
+++ b/nixos/modules/services/x11/desktop-managers/mate.nix
@ -12,6 +12,17 @@ let
    in
      filter (x: !(builtins.elem (pkgName x) ysNames)) xs;

+  addToXDGDirs = p: ''
+    if [ -d "${p}/share/gsettings-schemas/${p.name}" ]; then
+      export XDG_DATA_DIRS=$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}${p}/share/gsettings-schemas/${p.name}
+    fi
+
+    if [ -d "${p}/lib/girepository-1.0" ]; then
+      export GI_TYPELIB_PATH=$GI_TYPELIB_PATH''${GI_TYPELIB_PATH:+:}${p}/lib/girepository-1.0
+      export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}${p}/lib
+    fi
+  '';
+
  xcfg = config.services.xserver;
  cfg = xcfg.desktopManager.mate;

@ -20,10 +31,14 @@ in
 {
  options = {

-    services.xserver.desktopManager.mate.enable = mkOption {
-      type = types.bool;
-      default = false;
-      description = "Enable the MATE desktop environment";
+    services.xserver.desktopManager.mate = {
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Enable the MATE desktop environment";
+      };
+
+      debug = mkEnableOption "mate-session debug messages";
    };

    environment.mate.excludePackages = mkOption {
@ -52,10 +67,29 @@ in
        # Find the mouse
        export XCURSOR_PATH=~/.icons:${config.system.path}/share/icons

+        # Let caja find extensions
+        export CAJA_EXTENSION_DIRS=$CAJA_EXTENSION_DIRS''${CAJA_EXTENSION_DIRS:+:}${config.system.path}/lib/caja/extensions-2.0
+
+        # Let caja extensions find gsettings schemas
+        ${concatMapStrings (p: ''
+          if [ -d "${p}/lib/caja/extensions-2.0" ]; then
+            ${addToXDGDirs p}
+          fi
+          '')
+          config.environment.systemPackages
+        }
+
+        # Let mate-panel find applets
+        export MATE_PANEL_APPLETS_DIR=$MATE_PANEL_APPLETS_DIR''${MATE_PANEL_APPLETS_DIR:+:}${config.system.path}/share/mate-panel/applets
+        export MATE_PANEL_EXTRA_MODULES=$MATE_PANEL_EXTRA_MODULES''${MATE_PANEL_EXTRA_MODULES:+:}${config.system.path}/lib/mate-panel/applets
+
+        # Add mate-control-center paths to some XDG variables because its schemas are needed by mate-settings-daemon, and mate-settings-daemon is a dependency for mate-control-center (that is, they are mutually recursive)
+        ${addToXDGDirs pkgs.mate.mate-control-center}
+
        # Update user dirs as described in http://freedesktop.org/wiki/Software/xdg-user-dirs/
        ${pkgs.xdg-user-dirs}/bin/xdg-user-dirs-update

-        ${pkgs.mate.mate-session-manager}/bin/mate-session &
+        ${pkgs.mate.mate-session-manager}/bin/mate-session ${optionalString cfg.debug "--debug"} &
        waitPID=$!
      '';
    };
--- a/nixos/modules/services/x11/display-managers/lightdm-greeters/gtk.nix
+++ b/nixos/modules/services/x11/display-managers/lightdm-greeters/gtk.nix
@ -45,6 +45,8 @@ let
    theme-name = ${cfg.theme.name}
    icon-theme-name = ${cfg.iconTheme.name}
    background = ${ldmcfg.background}
+    ${optionalString (cfg.clock-format != null) "clock-format = ${cfg.clock-format}"}
+    ${optionalString (cfg.indicators != null) "indicators = ${concatStringsSep ";" cfg.indicators}"}
    ${cfg.extraConfig}
    '';

@ -104,6 +106,35 @@ in

      };

+      clock-format = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        example = "%F";
+        description = ''
+          Clock format string (as expected by strftime, e.g. "%H:%M")
+          to use with the lightdm gtk greeter panel.
+
+          If set to null the default clock format is used.
+        '';
+      };
+
+      indicators = mkOption {
+        type = types.nullOr (types.listOf types.str);
+        default = null;
+        example = [ "~host" "~spacer" "~clock" "~spacer" "~session" "~language" "~a11y" "~power" ];
+        description = ''
+          List of allowed indicator modules to use for the lightdm gtk
+          greeter panel.
+
+          Built-in indicators include "~a11y", "~language", "~session",
+          "~power", "~clock", "~host", "~spacer". Unity indicators can be
+          represented by short name (e.g. "sound", "power"), service file name,
+          or absolute path.
+
+          If set to null the default indicators are used.
+        '';
+      };
+
      extraConfig = mkOption {
        type = types.lines;
        default = "";
--- a/nixos/modules/system/boot/grow-partition.nix
+++ b/nixos/modules/system/boot/grow-partition.nix
@ -0,0 +1,43 @@
+# This module automatically grows the root partition.
+# This allows an instance to be created with a bigger root filesystem
+# than provided by the machine image.
+
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+{
+
+  options = {
+    boot.growPartition = mkEnableOption "grow the root partition on boot";
+  };
+
+  config = mkIf config.boot.growPartition {
+
+    boot.initrd.extraUtilsCommands = ''
+      copy_bin_and_libs ${pkgs.gawk}/bin/gawk
+      copy_bin_and_libs ${pkgs.gnused}/bin/sed
+      copy_bin_and_libs ${pkgs.utillinux}/sbin/sfdisk
+      copy_bin_and_libs ${pkgs.utillinux}/sbin/lsblk
+
+      substitute "${pkgs.cloud-utils}/bin/.growpart-wrapped" "$out/bin/growpart" \
+        --replace "${pkgs.bash}/bin/sh" "/bin/sh" \
+        --replace "awk" "gawk" \
+        --replace "sed" "gnused"
+
+      ln -s sed $out/bin/gnused
+    '';
+
+    boot.initrd.postDeviceCommands = ''
+      rootDevice="${config.fileSystems."/".device}"
+      if [ -e "$rootDevice" ]; then
+        rootDevice="$(readlink -f "$rootDevice")"
+        parentDevice="$(lsblk -npo PKNAME "$rootDevice")"
+        TMPDIR=/run sh $(type -P growpart) "$parentDevice" "''${rootDevice#$parentDevice}"
+        udevadm settle
+      fi
+    '';
+
+  };
+
+}
--- a/nixos/modules/system/boot/kernel.nix
+++ b/nixos/modules/system/boot/kernel.nix
@ -197,7 +197,7 @@ in
        "mmc_block"

        # Support USB keyboards, in case the boot fails and we only have
-        # a USB keyboard.
+        # a USB keyboard, or for LUKS passphrase prompt.
        "uhci_hcd"
        "ehci_hcd"
        "ehci_pci"
@ -206,7 +206,7 @@ in
        "xhci_hcd"
        "xhci_pci"
        "usbhid"
-        "hid_generic" "hid_lenovo" "hid_apple" "hid_roccat"
+        "hid_generic" "hid_lenovo" "hid_apple" "hid_roccat" "hid_logitech_hidpp"

        # Misc. keyboard stuff.
        "pcips2" "atkbd" "i8042"
--- a/nixos/modules/virtualisation/amazon-image.nix
+++ b/nixos/modules/virtualisation/amazon-image.nix
@ -11,7 +11,7 @@ with lib;
 let cfg = config.ec2; in

 {
-  imports = [ ../profiles/headless.nix ./ec2-data.nix ./grow-partition.nix ./amazon-init.nix ];
+  imports = [ ../profiles/headless.nix ./ec2-data.nix ./amazon-init.nix ];

  config = {

@ -21,7 +21,7 @@ let cfg = config.ec2; in
      }
    ];

-    virtualisation.growPartition = cfg.hvm;
+    boot.growPartition = cfg.hvm;

    fileSystems."/" = {
      device = "/dev/disk/by-label/nixos";
--- a/nixos/modules/virtualisation/google-compute-image.nix
+++ b/nixos/modules/virtualisation/google-compute-image.nix
@ -6,7 +6,7 @@ let
  gce = pkgs.google-compute-engine;
 in
 {
-  imports = [ ../profiles/headless.nix ../profiles/qemu-guest.nix ./grow-partition.nix ];
+  imports = [ ../profiles/headless.nix ../profiles/qemu-guest.nix ];

  system.build.googleComputeImage = import ../../lib/make-disk-image.nix {
    name = "google-compute-image";
@ -29,6 +29,7 @@ in
    autoResize = true;
  };

+  boot.growPartition = true;
  boot.kernelParams = [ "console=ttyS0" "panic=1" "boot.panic_on_fail" ];
  boot.initrd.kernelModules = [ "virtio_scsi" ];
  boot.kernelModules = [ "virtio_pci" "virtio_net" ];
--- a/nixos/modules/virtualisation/grow-partition.nix
+++ b/nixos/modules/virtualisation/grow-partition.nix
@ -1,48 +1,3 @@
-# This module automatically grows the root partition on virtual machines.
-# This allows an instance to be created with a bigger root filesystem
-# than provided by the machine image.
-
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-{
-
-  options = {
-
-    virtualisation.growPartition = mkOption {
-      type = types.bool;
-      default = true;
-    };
-
-  };
-
-  config = mkIf config.virtualisation.growPartition {
-
-    boot.initrd.extraUtilsCommands = ''
-      copy_bin_and_libs ${pkgs.gawk}/bin/gawk
-      copy_bin_and_libs ${pkgs.gnused}/bin/sed
-      copy_bin_and_libs ${pkgs.utillinux}/sbin/sfdisk
-      copy_bin_and_libs ${pkgs.utillinux}/sbin/lsblk
-
-      substitute "${pkgs.cloud-utils}/bin/.growpart-wrapped" "$out/bin/growpart" \
-        --replace "${pkgs.bash}/bin/sh" "/bin/sh" \
-        --replace "awk" "gawk" \
-        --replace "sed" "gnused"
-
-      ln -s sed $out/bin/gnused
-    '';
-
-    boot.initrd.postDeviceCommands = ''
-      rootDevice="${config.fileSystems."/".device}"
-      if [ -e "$rootDevice" ]; then
-        rootDevice="$(readlink -f "$rootDevice")"
-        parentDevice="$(lsblk -npo PKNAME "$rootDevice")"
-        TMPDIR=/run sh $(type -P growpart) "$parentDevice" "''${rootDevice#$parentDevice}"
-        udevadm settle
-      fi
-    '';
-
-  };
-
-}
+# This profile is deprecated, use boot.growPartition directly.
+builtins.trace "the profile <nixos/modules/virtualisation/grow-partition.nix> is deprecated, use boot.growPartition instead"
+{ }
--- a/nixos/modules/virtualisation/hyperv-guest.nix
+++ b/nixos/modules/virtualisation/hyperv-guest.nix
@ -0,0 +1,37 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.virtualisation.hypervGuest;
+
+in {
+  options = {
+    virtualisation.hypervGuest = {
+      enable = mkEnableOption "Hyper-V Guest Support";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ config.boot.kernelPackages.hyperv-daemons.bin ];
+
+    security.rngd.enable = false;
+
+    # enable hotadding memory
+    services.udev.packages = lib.singleton (pkgs.writeTextFile {
+      name = "hyperv-memory-hotadd-udev-rules";
+      destination = "/etc/udev/rules.d/99-hyperv-memory-hotadd.rules";
+      text = ''
+        ACTION="add", SUBSYSTEM=="memory", ATTR{state}="online"
+      '';
+    });
+
+    systemd = {
+      packages = [ config.boot.kernelPackages.hyperv-daemons.lib ];
+
+      targets.hyperv-daemons = {
+        wantedBy = [ "multi-user.target" ];
+      };
+    };
+  };
+}
--- a/nixos/modules/virtualisation/nova-config.nix
+++ b/nixos/modules/virtualisation/nova-config.nix
@ -6,7 +6,6 @@ with lib;
  imports = [
    ../profiles/qemu-guest.nix
    ../profiles/headless.nix
-    ./grow-partition.nix
  ];

  config = {
@ -15,8 +14,7 @@ with lib;
      autoResize = true;
    };

-    virtualisation.growPartition = true;
-
+    boot.growPartition = true;
    boot.kernelParams = [ "console=ttyS0" ];
    boot.loader.grub.device = "/dev/vda";
    boot.loader.timeout = 0;
--- a/nixos/modules/virtualisation/virtualbox-image.nix
+++ b/nixos/modules/virtualisation/virtualbox-image.nix
@ -8,8 +8,6 @@ let

 in {

-  imports = [ ./grow-partition.nix ];
-
  options = {
    virtualbox = {
      baseImageSize = mkOption {
@ -23,7 +21,6 @@ in {
  };

  config = {
-
    system.build.virtualBoxOVA = import ../../lib/make-disk-image.nix {
      name = "nixos-ova-${config.system.nixosLabel}-${pkgs.stdenv.system}";

@ -71,6 +68,7 @@ in {
      autoResize = true;
    };

+    boot.growPartition = true;
    boot.loader.grub.device = "/dev/sda";

    virtualisation.virtualbox.guest.enable = true;
--- a/nixos/release.nix
+++ b/nixos/release.nix
@ -255,7 +255,6 @@ in rec {
  tests.docker = hydraJob (import tests/docker.nix { system = "x86_64-linux"; });
  tests.docker-edge = hydraJob (import tests/docker-edge.nix { system = "x86_64-linux"; });
  tests.dovecot = callTest tests/dovecot.nix {};
-  tests.dnscrypt-proxy = callTest tests/dnscrypt-proxy.nix { system = "x86_64-linux"; };
  tests.ecryptfs = callTest tests/ecryptfs.nix {};
  tests.etcd = hydraJob (import tests/etcd.nix { system = "x86_64-linux"; });
  tests.ec2-nixops = hydraJob (import tests/ec2.nix { system = "x86_64-linux"; }).boot-ec2-nixops;
--- a/nixos/tests/dnscrypt-proxy.nix
+++ b/nixos/tests/dnscrypt-proxy.nix
@ -1,32 +0,0 @@
-import ./make-test.nix ({ pkgs, ... }: {
-  name = "dnscrypt-proxy";
-  meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ joachifm ];
-  };
-
-  nodes = {
-    # A client running the recommended setup: DNSCrypt proxy as a forwarder
-    # for a caching DNS client.
-    client =
-    { config, pkgs, ... }:
-    let localProxyPort = 43; in
-    {
-      security.apparmor.enable = true;
-
-      services.dnscrypt-proxy.enable = true;
-      services.dnscrypt-proxy.localPort = localProxyPort;
-      services.dnscrypt-proxy.extraArgs = [ "-X libdcplugin_example.so" ];
-
-      services.dnsmasq.enable = true;
-      services.dnsmasq.servers = [ "127.0.0.1#${toString localProxyPort}" ];
-    };
-  };
-
-  testScript = ''
-    $client->waitForUnit("dnsmasq");
-
-    # The daemon is socket activated; sending a single ping should activate it.
-    $client->execute("${pkgs.iputils}/bin/ping -c1 example.com");
-    $client->succeed("systemctl is-active dnscrypt-proxy");
-  '';
-})
--- a/pkgs/applications/altcoins/zcash/default.nix
+++ b/pkgs/applications/altcoins/zcash/default.nix
@ -2,20 +2,19 @@
 , zlib, gtest, gmock, callPackage, gmp, qt4, utillinux, protobuf, qrencode, libevent
 , withGui }:

-let libsnark     = callPackage ./libsnark { inherit boost openssl; };
-    librustzcash = callPackage ./librustzcash {};
+let librustzcash = callPackage ./librustzcash {};
 in
 with stdenv.lib;
 stdenv.mkDerivation rec {

  name = "zcash" + (toString (optional (!withGui) "d")) + "-" + version;
-  version = "1.0.12";
+  version = "1.0.13";

  src = fetchFromGitHub {
    owner = "zcash";
    repo  = "zcash";
    rev = "v${version}";
-    sha256 = "19bxhdnkvgncgl9x6nbaf5nwgrdfw99icvdbi9adfh646pd5z64s";
+    sha256 = "05y7wxs66anxr5akbf05r36mmjfzqpwawn6vyh3jhpva51hzzzyz";
  };

  # Dependencies are underspecified: "make -C src gtest/zcash_gtest-test_merkletree.o"
@ -23,17 +22,15 @@ stdenv.mkDerivation rec {
  enableParallelBuilding = false;

  nativeBuildInputs = [ autoreconfHook pkgconfig ];
-  buildInputs = [ gtest gmock gmp libsnark openssl wget db62 boost zlib
+  buildInputs = [ gtest gmock gmp openssl wget db62 boost zlib
                  protobuf libevent libsodium librustzcash ]
                  ++ optionals stdenv.isLinux [ utillinux ]
                  ++ optionals withGui [ qt4 qrencode ];

-  configureFlags = [ "LIBSNARK_INCDIR=${libsnark}/include/libsnark"
-                     "--with-boost-libdir=${boost.out}/lib"
+  configureFlags = [ "--with-boost-libdir=${boost.out}/lib"
                   ] ++ optionals withGui [ "--with-gui=qt4" ];

  patchPhase = ''
-    sed -i"" '/^\[LIBSNARK_INCDIR/d'               configure.ac
    sed -i"" 's,-lboost_system-mt,-lboost_system,' configure.ac
    sed -i"" 's,-fvisibility=hidden,,g'            src/Makefile.am
  '';
--- a/pkgs/applications/altcoins/zcash/libsnark/ate-pairing.nix
+++ b/pkgs/applications/altcoins/zcash/libsnark/ate-pairing.nix
@ -1,29 +0,0 @@
-{ stdenv, xbyak, gmp, fetchFromGitHub }:
-
-stdenv.mkDerivation rec {
-  name = "ate-pairing-unstable-${version}";
-  version = "2016-05-03";
-
-  src = fetchFromGitHub {
-    owner = "herumi";
-    repo  = "ate-pairing";
-    rev = "dcb9da999b1113f90b115bccb6f4b57ddf3a8452";
-    sha256 = "0jr6r1cma414k8mhsyp7n8hqaqxi7zklsp6820a095sbb3zajckh";
-  };
-
-  buildInputs = [ gmp xbyak ];
-
-  installPhase = ''
-    mkdir -p $out
-    cp -r lib $out
-    cp -r include $out
-  '';
-
-  meta = with stdenv.lib; {
-    description = "Optimal Ate Pairing over Barreto-Naehrig Curves";
-    homepage = https://github.com/herumi/ate-pairing;
-    maintainers = with maintainers; [ rht ];
-    license = licenses.bsd3;
-    platforms = platforms.unix;
-  };
-}
--- a/pkgs/applications/altcoins/zcash/libsnark/default.nix
+++ b/pkgs/applications/altcoins/zcash/libsnark/default.nix
@ -1,45 +0,0 @@
-{ stdenv, libsodium, callPackage, boost, zlib, openssl, gmp, procps, fetchFromGitHub }:
-
-let atePairing = callPackage ./ate-pairing.nix { inherit xbyak; };
-    mie        = callPackage ./mie.nix { };
-    xbyak      = callPackage ./xbyak.nix {};
-in
-stdenv.mkDerivation rec{
-  name = "libsnark-unstable-${version}";
-  version = "2017-02-09";
-
-  src = fetchFromGitHub {
-    owner = "zcash";
-    repo  = "libsnark";
-    rev = "9ada3f84ab484c57b2247c2f41091fd6a0916573";
-    sha256 = "0vhslcb9rwqab9szavyn856z4h9w1syiamfcixqmj0s908zzlaaq";
-  };
-
-  buildInputs = [ libsodium atePairing mie xbyak zlib openssl boost gmp ];
-
-  makeFlags = [
-    "PREFIX=$(out)"
-    "CURVE=ALT_BN128"
-    "NO_SUPERCOP=1"
-    "STATIC=1"
-  ];
-
-  buildPhase = ''
-    CXXFLAGS="-fPIC -DBINARY_OUTPUT -DNO_PT_COMPRESSION=1" \
-    make lib \
-      CURVE=ALT_BN128 \
-      MULTICORE=1 \
-      STATIC=1 \
-      NO_PROCPS=1 \
-      NO_GTEST=1 \
-      FEATUREFLAGS=-DMONTGOMERY_OUTPUT \
-  '';
-
-  meta = with stdenv.lib; {
-    description = "a C++ library for zkSNARK proofs";
-    homepage = https://github.com/zcash/libsnark;
-    maintainers = with maintainers; [ rht ];
-    license = licenses.mit;
-    platforms = platforms.unix;
-  };
-}
--- a/pkgs/applications/altcoins/zcash/libsnark/mie.nix
+++ b/pkgs/applications/altcoins/zcash/libsnark/mie.nix
@ -1,27 +0,0 @@
-{ stdenv, fetchFromGitHub }:
-
-stdenv.mkDerivation rec {
-  name = "mie-unstable-${version}";
-  version = "2016-05-10";
-
-  src = fetchFromGitHub {
-    owner = "herumi";
-    repo  = "mie";
-    rev = "704b625b7770a8e1eab26ac65d1fed14c2fcf090";
-    sha256 = "144bpmgfs2m4qqv7a2mccgi1aq5jmlr25gnk78ryq09z8cyv88y2";
-  };
-
-  phases = ["unpackPhase" "installPhase"];
-
-  installPhase = ''
-    mkdir -p $out
-    cp -r include $out
-  '';
-
-  meta = with stdenv.lib; {
-    homepage = https://github.com/herumi/mie;
-    maintainers = with maintainers; [ rht ];
-    license = licenses.bsd3;
-    platforms = platforms.unix;
-  };
-}
--- a/pkgs/applications/altcoins/zcash/libsnark/xbyak.nix
+++ b/pkgs/applications/altcoins/zcash/libsnark/xbyak.nix
@ -1,28 +0,0 @@
-{ stdenv, fetchFromGitHub }:
-
-stdenv.mkDerivation rec {
-  name = "xbyak-unstable-${version}";
-  version = "2016-05-03";
-
-  src = fetchFromGitHub {
-    owner = "herumi";
-    repo  = "xbyak";
-    rev = "b6133a02dd6b7116bea31d0e6b7142bf97f071aa";
-    sha256 = "1rc2nx8kj2lj13whxb9chhh79f4hmjjj4j1hpqsd0lbdb60jikrn";
-  };
-
-  dontBuild = true;
-
-  installPhase = ''
-    mkdir -p $out/include
-    cp -r xbyak $out/include
-  '';
-
-  meta = with stdenv.lib; {
-    description = "JIT assembler for x86, x64";
-    homepage = https://github.com/herumi/xbyak;
-    maintainers = with maintainers; [ rht ];
-    license = licenses.bsd3;
-    platforms = platforms.unix;
-  };
-}
--- a/pkgs/applications/audio/audacity/default.nix
+++ b/pkgs/applications/audio/audacity/default.nix
@ -7,12 +7,12 @@
 with stdenv.lib;

 stdenv.mkDerivation rec {
-  version = "2.2.0";
+  version = "2.2.1";
  name = "audacity-${version}";

  src = fetchurl {
    url = "https://github.com/audacity/audacity/archive/Audacity-${version}.tar.gz";
-    sha256 = "09xpr4bjnainz1xmc35v3qg3dadjr9wv8bmn1p4y91aqyihnhjry";
+    sha256 = "1n05r8b4rnf9fas0py0is8cm97s3h65dgvqkk040aym5d1x6wd7z";
  };

  preConfigure = /* we prefer system-wide libs */ ''
--- a/pkgs/applications/audio/jack-capture/default.nix
+++ b/pkgs/applications/audio/jack-capture/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "jack_capture-${version}";
-  version = "0.9.69";
+  version = "0.9.73";

  src = fetchurl {
    url = "http://archive.notam02.no/arkiv/src/${name}.tar.gz";
-    sha256 = "0sk7b92my1v1g7rhkpl1c608rb0rdb28m9zqfll95kflxajd16zv";
+    sha256 = "1pji0zdwm3kxjrkbzj7fnxhr8ncrc8pyqnwyrh47fhypgqjv1br1";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/applications/audio/jackmeter/default.nix
+++ b/pkgs/applications/audio/jackmeter/default.nix
@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
  name = "jackmeter-0.4";

  src = fetchurl {
-    url = "http://www.aelius.com/njh/jackmeter/${name}.tar.gz";
+    url = "https://www.aelius.com/njh/jackmeter/${name}.tar.gz";
    sha256 = "1cnvgx3jv0yvxlqy0l9k285zgvazmh5k8m4l7lxckjfm5bn6hm1r";
  };

@ -13,7 +13,7 @@ stdenv.mkDerivation rec {

  meta = { 
    description = "Console jack loudness meter";
-    homepage = http://www.aelius.com/njh/jackmeter/;
+    homepage = https://www.aelius.com/njh/jackmeter/;
    license = stdenv.lib.licenses.gpl2;
    maintainers = [ stdenv.lib.maintainers.marcweber ];
    platforms = stdenv.lib.platforms.linux;
--- a/pkgs/applications/audio/mixxx/default.nix
+++ b/pkgs/applications/audio/mixxx/default.nix
@ -1,6 +1,6 @@
-{ stdenv, fetchurl, chromaprint, fetchpatch, fftw, flac, libid3tag, libmad
-, libopus, libshout, libsndfile, libusb1, libvorbis, pkgconfig
-, portaudio, portmidi, protobuf, qt4, rubberband, scons, sqlite
+{ stdenv, fetchurl, chromaprint, fetchpatch, fftw, flac, faad2, mp4v2
+, libid3tag, libmad, libopus, libshout, libsndfile, libusb1, libvorbis
+, pkgconfig, portaudio, portmidi, protobuf, qt4, rubberband, scons, sqlite
 , taglib, vampSDK
 }:

@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 ];

  buildInputs = [
-    chromaprint fftw flac libid3tag libmad libopus libshout libsndfile
+    chromaprint fftw flac faad2 mp4v2 libid3tag libmad libopus libshout libsndfile
    libusb1 libvorbis pkgconfig portaudio portmidi protobuf qt4
    rubberband scons sqlite taglib vampSDK
  ];
@ -34,6 +34,7 @@ stdenv.mkDerivation rec {
  sconsFlags = [
    "build=release"
    "qtdir=${qt4}"
+    "faad=1"
  ];

  buildPhase = ''
--- a/pkgs/applications/audio/mopidy/default.nix
+++ b/pkgs/applications/audio/mopidy/default.nix
@ -33,7 +33,7 @@ pythonPackages.buildPythonApplication rec {
  '';

  meta = with stdenv.lib; {
-    homepage = http://www.mopidy.com/;
+    homepage = https://www.mopidy.com/;
    description = ''
      An extensible music server that plays music from local disk, Spotify,
      SoundCloud, Google Play Music, and more
--- a/pkgs/applications/audio/mpc/default.nix
+++ b/pkgs/applications/audio/mpc/default.nix
@ -19,7 +19,7 @@ stdenv.mkDerivation rec {

  meta = with stdenv.lib; {
    description = "A minimalist command line interface to MPD";
-    homepage = http://www.musicpd.org/clients/mpc/;
+    homepage = https://www.musicpd.org/clients/mpc/;
    license = licenses.gpl2;
    maintainers = with maintainers; [ algorith ];
    platforms = with platforms; linux ++ darwin;
--- a/pkgs/applications/audio/musescore/default.nix
+++ b/pkgs/applications/audio/musescore/default.nix
@ -50,7 +50,7 @@ stdenv.mkDerivation rec {

  meta = with stdenv.lib; {
    description = "Music notation and composition software";
-    homepage = http://musescore.org/;
+    homepage = https://musescore.org/;
    license = licenses.gpl2;
    platforms = platforms.linux;
    maintainers = [ maintainers.vandenoever ];
--- a/pkgs/applications/audio/ncmpc/default.nix
+++ b/pkgs/applications/audio/ncmpc/default.nix
@ -19,7 +19,7 @@ stdenv.mkDerivation rec {

  meta = with stdenv.lib; {
    description = "Curses-based interface for MPD (music player daemon)";
-    homepage    = http://www.musicpd.org/clients/ncmpc/;
+    homepage    = https://www.musicpd.org/clients/ncmpc/;
    license     = licenses.gpl2Plus;
    platforms   = platforms.all;
    maintainers = with maintainers; [ fpletz ];
--- a/pkgs/applications/audio/qjackctl/default.nix
+++ b/pkgs/applications/audio/qjackctl/default.nix
@ -1,14 +1,14 @@
 { stdenv, fetchurl, pkgconfig, alsaLib, libjack2, dbus, qtbase, qttools, qtx11extras }:

 stdenv.mkDerivation rec {
-  version = "0.4.5";
+  version = "0.5.0";
  name = "qjackctl-${version}";

  # some dependencies such as killall have to be installed additionally

  src = fetchurl {
    url = "mirror://sourceforge/qjackctl/${name}.tar.gz";
-    sha256 = "1dsavjfzz5bpzc80mvfs940w9f9f47cf4r9cqxnaqrl4xilsa3f5";
+    sha256 = "0lx81dfwanc10vrny1vzi0wx73ph82dlz99ffjzsigj3cqzz6x4s";
  };

  buildInputs = [
--- a/pkgs/applications/audio/qmidinet/default.nix
+++ b/pkgs/applications/audio/qmidinet/default.nix
@ -1,12 +1,12 @@
 { stdenv, fetchurl, pkgconfig, qt5, alsaLib, libjack2 }:

 stdenv.mkDerivation rec {
-  version = "0.4.3";
+  version = "0.5.0";
  name = "qmidinet-${version}";

  src = fetchurl {
    url = "mirror://sourceforge/qmidinet/${name}.tar.gz";
-    sha256 = "1qhxhlvi6bj2a06i48pw81zf5vd36idxbq04g30794yhqcimh6vw";
+    sha256 = "0nxbvjgx11ljy1nxqknyq7pla55ky2ybi1jbisvq2cqxa34jsxf6";
  };

  hardeningDisable = [ "format" ];
--- a/pkgs/applications/audio/radiotray-ng/default.nix
+++ b/pkgs/applications/audio/radiotray-ng/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, fetchpatch
+{ stdenv, fetchFromGitHub
 , cmake, pkgconfig
 # Transport
 , curl
@ -15,6 +15,7 @@
 , libappindicator-gtk3
 , libnotify
 , libxdg_basedir
+, wxGTK
 # GStreamer
 , gst_all_1
 # User-agent info
@ -39,13 +40,13 @@ let
 in
 stdenv.mkDerivation rec {
  name = "radiotray-ng-${version}";
-  version = "0.1.7";
+  version = "0.2.0";

  src = fetchFromGitHub {
    owner = "ebruck";
    repo = "radiotray-ng";
    rev = "v${version}";
-    sha256 = "1m853gzh9r249crn0xyrq22x154r005j58b0kq3nsrgi5cps2zdv";
+    sha256 = "12mhi0q137cjdpmpczvrcr7szq1ja1r8bm0gh03b925y8xyrqp5z";
  };

  nativeBuildInputs = [ cmake pkgconfig wrapGAppsHook makeWrapper ];
@ -56,6 +57,7 @@ stdenv.mkDerivation rec {
    glibmm hicolor_icon_theme gnome3.gsettings_desktop_schemas libappindicator-gtk3 libnotify
    libxdg_basedir
    lsb-release
+    wxGTK
  ] ++ stdenv.lib.optional doCheck gmock
    ++ gstInputs
    ++ pythonInputs;
@ -65,15 +67,13 @@ stdenv.mkDerivation rec {
      --replace /usr $out
    substituteInPlace include/radiotray-ng/common.hpp \
      --replace /usr $out
-  '';

-  patches = [
-    (fetchpatch {
-      # Fix menu separators and minor touchup to 'version'
-      url = "https://github.com/ebruck/radiotray-ng/commit/827e9f1baaa03ab4d8a5fb3aab043e72950eb965.patch";
-      sha256 = "1aykl6lq4pga34xg5r9mc616gxnd63q6gr8qzg57w6874cj3csrr";
-    })
-  ];
+    # We don't find the radiotray-ng-notification icon otherwise
+    substituteInPlace data/radiotray-ng.desktop \
+      --replace radiotray-ng-notification radiotray-ng-on
+    substituteInPlace data/rtng-bookmark-editor.desktop \
+      --replace radiotray-ng-notification radiotray-ng-on
+  '';

  enableParallelBuilding = true;

--- a/pkgs/applications/audio/setbfree/default.nix
+++ b/pkgs/applications/audio/setbfree/default.nix
@ -4,11 +4,11 @@

 stdenv.mkDerivation  rec {
  name = "setbfree-${version}";
-  version = "0.8.0";
+  version = "0.8.5";

  src = fetchurl {
    url = "https://github.com/pantherb/setBfree/archive/v${version}.tar.gz";
-    sha256 = "1lfylai4gyk512dknj16w2aq9ka8hvqca46nmq5b4rfjmi6dkxf6";
+    sha256 = "0qfccny0hh9lq54272mzmxvfz2jmzcgigjkjwn6v9h6n00gi5bw4";
  };

  patchPhase = ''
--- a/pkgs/applications/audio/yoshimi/default.nix
+++ b/pkgs/applications/audio/yoshimi/default.nix
@ -6,11 +6,11 @@ assert stdenv ? glibc;

 stdenv.mkDerivation  rec {
  name = "yoshimi-${version}";
-  version = "1.5.5";
+  version = "1.5.6";

  src = fetchurl {
    url = "mirror://sourceforge/yoshimi/${name}.tar.bz2";
-    sha256 = "0h71x9742bswifwll7bma1fz648fd5xd0yfp7byvsczy6zhjz5pf";
+    sha256 = "0bjfhfslpa2hjrc9h38m7dlr62953w9n4cvkgvfy495cbym12dak";
  };

  buildInputs = [
--- a/pkgs/applications/display-managers/lightdm-gtk-greeter/default.nix
+++ b/pkgs/applications/display-managers/lightdm-gtk-greeter/default.nix
@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
  '';

  meta = with stdenv.lib; {
-    homepage = http://launchpad.net/lightdm-gtk-greeter;
+    homepage = https://launchpad.net/lightdm-gtk-greeter;
    platforms = platforms.linux;
    license = licenses.gpl3;
    maintainers = with maintainers; [ ocharles wkennington ];
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@ -27,9 +27,9 @@ in rec {

  preview = mkStudio {
    pname = "android-studio-preview";
-    version = "3.1.0.5"; # "Android Studio 3.1 Canary 6"
-    build = "173.4506631";
-    sha256Hash = "10yw27rxv6pfvyl9w18ch63lm85ykj7ssrv87pchvwkmsscaw2zn";
+    version = "3.1.0.6"; # "Android Studio 3.1 Canary 7"
+    build = "173.4524538";
+    sha256Hash = "0rj7swychriznylrr09g0rnj12rymms925xbry85ba72hj1jjf6w";

    meta = stable.meta // {
      description = "The Official IDE for Android (preview version)";
--- a/pkgs/applications/editors/eclipse/plugins.nix
+++ b/pkgs/applications/editors/eclipse/plugins.nix
@ -424,16 +424,16 @@ rec {

  spotbugs = buildEclipsePlugin rec {
    name = "spotbugs-${version}";
-    version = "3.1.0.r201710241414-11c9895";
+    version = "3.1.1.r201712011030-903b7a0";

    srcFeature = fetchurl {
      url = "https://spotbugs.github.io/eclipse/features/com.github.spotbugs.plugin.eclipse_${version}.jar";
-      sha256 = "084dj2bid5issh28j32hi5w9vx5xs829h7d5lbz5hqj1fyn9h6bs";
+      sha256 = "12z5dbs10h5k567wbmwz1w4pnidmqsls52qcfdb3zlgr0rqvz072";
    };

    srcPlugin = fetchurl {
      url = "https://spotbugs.github.io/eclipse/plugins/com.github.spotbugs.plugin.eclipse_${version}.jar";
-      sha256 = "1mqpl3gx06f54w13jm01qd8fbniab3x989mi3lysx078vrp23jas";
+      sha256 = "0dnkp2alymvyyql7g8w79i27b3c64inhdvpxx1v014ng9liv54xb";
    };

    meta = with stdenv.lib; {
--- a/pkgs/applications/editors/emacs-modes/elpa-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/elpa-generated.nix
@ -135,10 +135,10 @@
    arbitools = callPackage ({ cl-lib ? null, elpaBuild, fetchurl, lib }:
    elpaBuild {
        pname = "arbitools";
-        version = "0.91";
+        version = "0.93";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/arbitools-0.91.el";
-          sha256 = "0r0nbpwjxal40ydvx7hmjq56x12jcfqgld7yc4fjfz93wn8m40qf";
+          url = "https://elpa.gnu.org/packages/arbitools-0.93.el";
+          sha256 = "0z3lqp8dqfkams5h4sw569p48d2rvpd3d8lb4xaw0z8l49y2mvg8";
        };
        packageRequires = [ cl-lib ];
        meta = {
@ -768,10 +768,10 @@
    el-search = callPackage ({ elpaBuild, emacs, fetchurl, lib, stream }:
    elpaBuild {
        pname = "el-search";
-        version = "1.4.0.11";
+        version = "1.4.0.12";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/el-search-1.4.0.11.tar";
-          sha256 = "12m468fxwfrwjkm0wcraafb7n9shh9fmw43nggc216ch3syxmfaw";
+          url = "https://elpa.gnu.org/packages/el-search-1.4.0.12.tar";
+          sha256 = "140p1ian8dwip6305spg4rvm3rqxhznlq0w5msixw6ykwm735a8z";
        };
        packageRequires = [ emacs stream ];
        meta = {
@ -2254,10 +2254,10 @@
      }) {};
    vlf = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
        pname = "vlf";
-        version = "1.7";
+        version = "1.7.1";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/vlf-1.7.tar";
-          sha256 = "007zdr5szimr6nwwrqz9s338s0qq82r006pdwgcm8nc41jsmsx7r";
+          url = "https://elpa.gnu.org/packages/vlf-1.7.1.tar";
+          sha256 = "0cnwxk20573iqkwk0c0h7pyjk0rkr8l2qd0xmyqj8mvdxjb8nnkz";
        };
        packageRequires = [];
        meta = {
--- a/pkgs/applications/editors/emacs-modes/font-lock-plus/default.nix
+++ b/pkgs/applications/editors/emacs-modes/font-lock-plus/default.nix
@ -2,11 +2,11 @@

 melpaBuild {
  pname = "font-lock-plus";
-  version = "20170222.1755";
+  version = "20180101.25";

  src = fetchurl {
-    url = "https://www.emacswiki.org/emacs/download/font-lock+.el";
-    sha256 = "0iajkgh0n3pbrwwxx9rmrrwz8dw2m7jsp4mggnhq7zsb20ighs30";
+    url = "https://www.emacswiki.org/emacs/download/font-lock%2b.el?revision=25";
+    sha256 = "0197yzn4hbjmw5h3m08264b7zymw63pdafph5f3yzfm50q8p7kp4";
    name = "font-lock+.el";
  };

--- a/pkgs/applications/editors/emacs-modes/melpa-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/melpa-generated.nix
--- a/pkgs/applications/editors/emacs-modes/melpa-stable-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/melpa-stable-generated.nix
@ -4256,12 +4256,12 @@
    cider = callPackage ({ clojure-mode, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild, pkg-info, queue, seq, spinner }:
    melpaBuild {
        pname = "cider";
-        version = "0.15.1";
+        version = "0.16.0";
        src = fetchFromGitHub {
          owner = "clojure-emacs";
          repo = "cider";
-          rev = "8a9eab32646abcaaf31fe83b2d897c01971b98f1";
-          sha256 = "0ddkm87l9ann05a6j57r0x59qqgfavwrvlzhkc5xhak1nmk5556h";
+          rev = "74f7901b416efbd032bb4f8b5c25f57fdf731115";
+          sha256 = "0n2b6q8r2gzr3ghyvg5sawir47rk7jmsslvxx6by27bn77h4nzil";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/55a937aed818dbe41530037da315f705205f189b/recipes/cider";
@ -7190,6 +7190,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    dimmer = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    melpaBuild {
+        pname = "dimmer";
+        version = "0.2.1";
+        src = fetchFromGitHub {
+          owner = "gonewest818";
+          repo = "dimmer.el";
+          rev = "b0faaa6919e633229ced07ff8bd8b5c68b90243a";
+          sha256 = "04k7m5kg2a32ldgxfc2jkdwbmxzyc3yv66871ywv9152db2g7iml";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/8ae80e9202d69ed3214325dd15c4b2f114263954/recipes/dimmer";
+          sha256 = "0w8n5svckk1jp8856pg2gkws9798prqjjkdqf8ili2hjcqnd1a3r";
+          name = "dimmer";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://melpa.org/#/dimmer";
+          license = lib.licenses.free;
+        };
+      }) {};
    dionysos = callPackage ({ alert, cl-lib ? null, dash, fetchFromGitHub, fetchurl, lib, libmpdee, melpaBuild, pkg-info, s }:
    melpaBuild {
        pname = "dionysos";
@ -7809,12 +7830,12 @@
    doom-themes = callPackage ({ all-the-icons, cl-lib ? null, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "doom-themes";
-        version = "2.0.9";
+        version = "2.1.0";
        src = fetchFromGitHub {
          owner = "hlissner";
          repo = "emacs-doom-themes";
-          rev = "8ff86e456b22ab4c28605c44e544b3ef0b4b4637";
-          sha256 = "0zfr6487hvn08dc9hhwf2snhd3ds4kfaglribxddx38dhd87hk73";
+          rev = "bc747b3b65baf737f99dc4ccf68558581958bbba";
+          sha256 = "0j5aywwh8cw0bb55frrpmyfmbzg6d6jv29ys61p1xf49gvki870m";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/c5084bc2c3fe378af6ff39d65e40649c6359b7b5/recipes/doom-themes";
@ -8270,12 +8291,12 @@
    easy-hugo = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "easy-hugo";
-        version = "2.7.19";
+        version = "2.8.20";
        src = fetchFromGitHub {
          owner = "masasam";
          repo = "emacs-easy-hugo";
-          rev = "1a8c4286ac1d92114dbda9042ed831cc83175db9";
-          sha256 = "11vwzgy1dn4sj1yhnvvim6p9w3dl896azh3wlrmg8g6y6qfzblc7";
+          rev = "253d91cda8722fa69b8ee67b1802137863bc3d9a";
+          sha256 = "1i5hdm9xwajid7kzx6gq8lhx5w2aihvb0ka5h2s88zb1xnnxss46";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/855ea20024b606314f8590129259747cac0bcc97/recipes/easy-hugo";
@ -8291,12 +8312,12 @@
    easy-jekyll = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "easy-jekyll";
-        version = "1.4.10";
+        version = "1.5.11";
        src = fetchFromGitHub {
          owner = "masasam";
          repo = "emacs-easy-jekyll";
-          rev = "d5226405c035d0dd675cacfd514388c348a4559a";
-          sha256 = "1pmaa0ry1yd8d2pbn4srv5bf1hqss046zjl2p3ag1ag0qb35fh39";
+          rev = "4eac3993d9bbec9ddfe38b128fd3ed6670f526e2";
+          sha256 = "0ffspw6xavfbk0klqjp8va7ybvsdcxlw1qmqhi6paqam90m6vazz";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/c3f281145bad12c27bdbef32ccc07b6a5f13b577/recipes/easy-jekyll";
@ -12988,12 +13009,12 @@
    flycheck-objc-clang = callPackage ({ emacs, fetchFromGitHub, fetchurl, flycheck, lib, melpaBuild }:
    melpaBuild {
        pname = "flycheck-objc-clang";
-        version = "2.0.0";
+        version = "2.0.1";
        src = fetchFromGitHub {
          owner = "GyazSquare";
          repo = "flycheck-objc-clang";
-          rev = "29a9eb320d62400564360986f7ad400b74070d8e";
-          sha256 = "0b4vwbxzhds9vb4nknfdywvfpr1gkk86vsbbq6f5ds0pfk75x022";
+          rev = "07f17d1dbe878fdcabac791a8916ddf643571a68";
+          sha256 = "03624xn6g1ybcjw634c7nd5s2yllwfffk2gzn5hm70vfz06q7wb9";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/4ff4412f507371b93cfb85fc744e54110cd87338/recipes/flycheck-objc-clang";
@ -13219,12 +13240,12 @@
    flycheck-swift3 = callPackage ({ emacs, fetchFromGitHub, fetchurl, flycheck, lib, melpaBuild }:
    melpaBuild {
        pname = "flycheck-swift3";
-        version = "2.0.0";
+        version = "2.0.1";
        src = fetchFromGitHub {
          owner = "GyazSquare";
          repo = "flycheck-swift3";
-          rev = "756833425f51baa9eb0a2fa7493df6e68612c88d";
-          sha256 = "1hvrg717q0nlz4r8wby82gs3vdx8fdhf38rg4j77j3fqfmxdd3fi";
+          rev = "34973cd28ca5e63f8f6328a17fd7b78cc913b93d";
+          sha256 = "1iy6j05dzpi7pi87y6rpjzmlnl2s9izqpbzknis2kx9072qddm3q";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/f1fb8c731c118327dc0bbb726e046fec46bcfb82/recipes/flycheck-swift3";
@ -14038,12 +14059,12 @@
    fountain-mode = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "fountain-mode";
-        version = "2.3.1";
+        version = "2.4.0";
        src = fetchFromGitHub {
          owner = "rnkn";
          repo = "fountain-mode";
-          rev = "5c63d2f199e96bdf8fd60d375b2b6e305a5f9017";
-          sha256 = "0vxizl4pr0668b1d94wrl42li2709srvnn5likn8lskv2mv0bnvn";
+          rev = "3f953ae30ad55bbbbb80aa0350992e79f4b00f56";
+          sha256 = "1zksjvpvhbr79fg281yhx8k419q9kd4jpi47i9943cs0m088ykyn";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/913386ac8d5049d37154da3ab32bde408a226511/recipes/fountain-mode";
@ -15765,6 +15786,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    go-tag = callPackage ({ emacs, fetchFromGitHub, fetchurl, go-mode, lib, melpaBuild }:
+    melpaBuild {
+        pname = "go-tag";
+        version = "1.0.0";
+        src = fetchFromGitHub {
+          owner = "brantou";
+          repo = "emacs-go-tag";
+          rev = "51b032465405a62f84d9181168a570610ba04085";
+          sha256 = "0158c3yjw21skwa03qmh3xpg9wg7rnk6xbxqx5vxi24205zsz0kd";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/fc4cd3fd8fb0707912e205b9d71789ea8126c442/recipes/go-tag";
+          sha256 = "18ff41i0gr708fl4gzzspf9cc09nv4wy21wsn609yhwlh7w0vs1f";
+          name = "go-tag";
+        };
+        packageRequires = [ emacs go-mode ];
+        meta = {
+          homepage = "https://melpa.org/#/go-tag";
+          license = lib.licenses.free;
+        };
+      }) {};
    godoctor = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "godoctor";
@ -15936,12 +15978,12 @@
    goto-chg = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "goto-chg";
-        version = "1.7";
+        version = "1.7.1";
        src = fetchFromGitHub {
          owner = "emacs-evil";
          repo = "goto-chg";
-          rev = "171b1331022caf12d8c3593e9b5075f87ee958d4";
-          sha256 = "1jcnrin4j1x8p63fd9r37dq1vr5a7a1nvzk6kp0bdsgn9vbjmapc";
+          rev = "6cb244922b733358fd6985b36c4b87ef2e177293";
+          sha256 = "0miscmk5gg7mqqwjb5mlrkbpsx4pny2w3rpr90f7yiv30rf83b5j";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/cf1fc176430fe3ab55ce537a0efc59780bb812be/recipes/goto-chg";
@ -16104,12 +16146,12 @@
    grails-mode = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "grails-mode";
-        version = "1.0.2";
+        version = "2.0";
        src = fetchFromGitHub {
          owner = "Groovy-Emacs-Modes";
          repo = "groovy-emacs-modes";
-          rev = "f8e9628916d4d41e1816b53d02f0b5a00c499555";
-          sha256 = "1myb15n207yl2cgacmn105r1xbjq076paq6anvw53smy3fhw9sh9";
+          rev = "d7b362e6186d263ec3eefc141dbb5b27a8773f24";
+          sha256 = "0c1d4cbnlny8gpcd20zr1wxx6ggf28jgh7sgd5r1skpsvjpbfqx2";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/3fe318b4e51a280a55c01fa30455e4a180df8bd6/recipes/grails-mode";
@ -16383,22 +16425,22 @@
          license = lib.licenses.free;
        };
      }) {};
-    groovy-mode = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    groovy-mode = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild, s }:
    melpaBuild {
        pname = "groovy-mode";
-        version = "1.0.2";
+        version = "2.0";
        src = fetchFromGitHub {
          owner = "Groovy-Emacs-Modes";
          repo = "groovy-emacs-modes";
-          rev = "f8e9628916d4d41e1816b53d02f0b5a00c499555";
-          sha256 = "1myb15n207yl2cgacmn105r1xbjq076paq6anvw53smy3fhw9sh9";
+          rev = "d7b362e6186d263ec3eefc141dbb5b27a8773f24";
+          sha256 = "0c1d4cbnlny8gpcd20zr1wxx6ggf28jgh7sgd5r1skpsvjpbfqx2";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/3fe318b4e51a280a55c01fa30455e4a180df8bd6/recipes/groovy-mode";
          sha256 = "1pxw7rdn56klmr6kw21lhzh7zhp338gyf54ypsml64ibzr1x9kal";
          name = "groovy-mode";
        };
-        packageRequires = [];
+        packageRequires = [ emacs s ];
        meta = {
          homepage = "https://melpa.org/#/groovy-mode";
          license = lib.licenses.free;
@ -16533,12 +16575,12 @@
    guix = callPackage ({ bui, dash, emacs, fetchFromGitHub, fetchurl, geiser, lib, magit-popup, melpaBuild }:
    melpaBuild {
        pname = "guix";
-        version = "0.3.3";
+        version = "0.3.4";
        src = fetchFromGitHub {
          owner = "alezost";
          repo = "guix.el";
-          rev = "54bd174b514c5de11e82c4263ac2723addb0fe87";
-          sha256 = "1i5kwzwlb6lx65rgixm8mbdi6x03n0hb4hbc7j76lar4j58ypwz2";
+          rev = "a43828f6e5d6dc4e623a4b78e0dfdddbf5b20185";
+          sha256 = "0c19njb5cg6g3fav9322hkbl4h9zwcbymhc5wr0k9yqi7pv8gz0v";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/b3d8c73e8a946b8265487a0825d615d80aa3337d/recipes/guix";
@ -21002,12 +21044,12 @@
    js-auto-format-mode = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "js-auto-format-mode";
-        version = "1.0.4";
+        version = "1.0.5";
        src = fetchFromGitHub {
          owner = "ybiquitous";
          repo = "js-auto-format-mode";
-          rev = "cad63f1760e765298cc91e3503ac46c8771da4be";
-          sha256 = "1pg4ghfi0fzmnwrw3y4z3gy031psxvzjydwm4jbdrm33ais7919g";
+          rev = "7872e6f1d8280830c70cae8f1e3edb8049aba295";
+          sha256 = "0a9rbs0pjx953rbblmia9jznxykz5qa9q5wzkj341z6vfq9rq3rf";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/2d3be16771b5b5fde639da3ee97890620354ee7a/recipes/js-auto-format-mode";
@ -23647,12 +23689,12 @@
    meghanada = callPackage ({ company, emacs, fetchFromGitHub, fetchurl, flycheck, lib, melpaBuild, yasnippet }:
    melpaBuild {
        pname = "meghanada";
-        version = "0.8.4";
+        version = "0.9.0";
        src = fetchFromGitHub {
          owner = "mopemope";
          repo = "meghanada-emacs";
-          rev = "555b8b9ea8ef56dda645ea605b38501cb4222b12";
-          sha256 = "1z3vvasah4gq6byq4ibkihy5mbch5zzxnn0gy86jldapwi1z74sq";
+          rev = "98ad6a5361c725319a355522d2d1ba0e0fbb7cde";
+          sha256 = "06iryz4dbldc9vxy67g977hih8r1bfvjld53lvwnjsc7r3x9i07q";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/4c75c69b2f00be9a93144f632738272c1e375785/recipes/meghanada";
@ -25364,11 +25406,11 @@
      }) {};
    notmuch = callPackage ({ fetchgit, fetchurl, lib, melpaBuild }: melpaBuild {
        pname = "notmuch";
-        version = "0.25.3";
+        version = "0.26pre1";
        src = fetchgit {
          url = "git://git.notmuchmail.org/git/notmuch";
-          rev = "ae55a86639f86ad1b547e961f71b1bde2180752d";
-          sha256 = "0kq2j23381qr50zkvx68yciq1xag20fzidgy5jd69bd7z6gziq90";
+          rev = "1ed211d042d5f413731f812b5af7e82819a6e8ae";
+          sha256 = "140c3bhh24dy2cfsvgf9y7h02sjp6cjv8qam6kd8wjlrd3y9zd80";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/b19f21ed7485036e799ccd88edbf7896a379d759/recipes/notmuch";
@ -25633,6 +25675,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    ob-coffeescript = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    melpaBuild {
+        pname = "ob-coffeescript";
+        version = "1.0.0";
+        src = fetchFromGitHub {
+          owner = "brantou";
+          repo = "ob-coffeescript";
+          rev = "b70f3d822c707cb02333fcb739ba4874614cad2a";
+          sha256 = "0284v3km41427q7dr0wmvf3zhbsgzj0j2r9zny0g3n85qvyk0rgd";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/ba1a808c77653bac1948d6c44bd1db09301ffeff/recipes/ob-coffeescript";
+          sha256 = "05q1wnabw52kd3fpcpinpxs9z6xmi4n1p19jbcz0bgjpnw05s27p";
+          name = "ob-coffeescript";
+        };
+        packageRequires = [];
+        meta = {
+          homepage = "https://melpa.org/#/ob-coffeescript";
+          license = lib.licenses.free;
+        };
+      }) {};
    ob-http = callPackage ({ cl-lib ? null, fetchFromGitHub, fetchurl, lib, melpaBuild, s }:
    melpaBuild {
        pname = "ob-http";
@ -25654,6 +25717,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    ob-hy = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    melpaBuild {
+        pname = "ob-hy";
+        version = "1.0.0";
+        src = fetchFromGitHub {
+          owner = "brantou";
+          repo = "ob-hy";
+          rev = "a3512f274709dc4ab6c18d7955d361f8715505f0";
+          sha256 = "1i796041svy7njjl3aqaxzjydmm24q688vpxvqd0pj5hyajqdgqw";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/12a7a7dba169010a3a047f961010236a203c16c2/recipes/ob-hy";
+          sha256 = "18a8fpda0f28wxmjprhd9dmz7bpk1j3iayl20lqffrcal6m4f1h7";
+          name = "ob-hy";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://melpa.org/#/ob-hy";
+          license = lib.licenses.free;
+        };
+      }) {};
    ob-prolog = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "ob-prolog";
@ -32959,12 +33043,12 @@
    shx = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "shx";
-        version = "0.0.12";
+        version = "0.0.13";
        src = fetchFromGitHub {
          owner = "riscy";
          repo = "shx-for-emacs";
-          rev = "aa45e7b586b1215ca1af05c14984ce872571b5f7";
-          sha256 = "0ya7vbp71vmvli35rwcwspbclss5ngr1ck9074i2gg1dzrqyxijn";
+          rev = "33383bd359d795df2d7ef725b5349c953f5a6aa8";
+          sha256 = "1arwsb6as8jpah0bs3b92a3kdnbfkhnsm1jglspfh4lqpafmx5vf";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/7a2ff78ae3c4289ebf9e06cdfd8f8082c395a16f/recipes/shx";
@ -33817,6 +33901,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    solidity-mode = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    melpaBuild {
+        pname = "solidity-mode";
+        version = "0.1.8";
+        src = fetchFromGitHub {
+          owner = "ethereum";
+          repo = "emacs-solidity";
+          rev = "b5d95ef678305ca70b17e94fc2ee4289a8328048";
+          sha256 = "04l3hvfpgqiaxdxh8s2cg2rx4cy50i7a411q81g8661fx60c6h6p";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/bb9df5ec0692352b6494d435d11166f4ea26c99e/recipes/solidity-mode";
+          sha256 = "1qdzdivrf5yaa80p61b9r1gryw112v5l2m2jkvkc7glhkhrcvwsx";
+          name = "solidity-mode";
+        };
+        packageRequires = [];
+        meta = {
+          homepage = "https://melpa.org/#/solidity-mode";
+          license = lib.licenses.free;
+        };
+      }) {};
    sos = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild, org }:
    melpaBuild {
        pname = "sos";
@ -34743,12 +34848,12 @@
    swift-mode = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild, seq }:
    melpaBuild {
        pname = "swift-mode";
-        version = "4.0.0";
+        version = "4.0.1";
        src = fetchFromGitHub {
          owner = "chrisbarrett";
          repo = "swift-mode";
-          rev = "18c3dc47dfece59640ad501266f2e47b918f2a14";
-          sha256 = "0qk962xzxm8si1h5p7vdnqw7xcaxdjxsaz1yad11pvn9l2b2zpzq";
+          rev = "8c45f69a078c41619a7a3db6d54a732c3fad8e3f";
+          sha256 = "1isy71vkws3ywm4iwa85dk12810az3h85n6bimd36dfqbhfwdrli";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/19cb133191cd6f9623e99e958d360113595e756a/recipes/swift-mode";
@ -38675,8 +38780,8 @@
        version = "1.80";
        src = fetchhg {
          url = "https://www.yatex.org/hgrepos/yatex/";
-          rev = "16763e5b7481";
-          sha256 = "1mrcc9amz0kflm570bd2cprhin0z8lr668k2s56mj6shixb61dwh";
+          rev = "feef2aa1f50f";
+          sha256 = "0453y7a9lq28bmbrrcbsnsrwnhjphq4s4vcr9ncb5252m6fnwdyl";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/e28710244a1bef8f56156fe1c271520896a9c694/recipes/yatex";
--- a/pkgs/applications/editors/emacs-modes/org-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/org-generated.nix
@ -1,10 +1,10 @@
 { callPackage }: {
    org = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
        pname = "org";
-        version = "20171225";
+        version = "20180102";
        src = fetchurl {
-          url = "http://orgmode.org/elpa/org-20171225.tar";
-          sha256 = "1wp1mbp0b8vygrlx0bb79d9zb91kca13nlhrxh59h9w496jj30dy";
+          url = "https://orgmode.org/elpa/org-20180102.tar";
+          sha256 = "1jz92wv637x1kp726kgcc29s4s4rscfhb7rhhnr69ny83r1hlczi";
        };
        packageRequires = [];
        meta = {
@ -14,10 +14,10 @@
      }) {};
    org-plus-contrib = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
        pname = "org-plus-contrib";
-        version = "20171225";
+        version = "20180102";
        src = fetchurl {
-          url = "http://orgmode.org/elpa/org-plus-contrib-20171225.tar";
-          sha256 = "10d44sqm9sh8gjy7xlnpqhyq35yxdijjm2322khc5bylvq60ianc";
+          url = "https://orgmode.org/elpa/org-plus-contrib-20180102.tar";
+          sha256 = "02ajqc8k44w2gskjazkglmn2v0jsxfns0wq3pgslhb7ychs3yrlv";
        };
        packageRequires = [];
        meta = {
--- a/pkgs/applications/editors/focuswriter/default.nix
+++ b/pkgs/applications/editors/focuswriter/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "focuswriter-${version}";
-  version = "1.6.7";
+  version = "1.6.8";

  src = fetchurl {
    url = "https://gottcode.org/focuswriter/focuswriter-${version}-src.tar.bz2";
-    sha256 = "10rqzinr6yd6ca06rklg34kdc08a3xgygfzmprsfg7gdsybfay5z";
+    sha256 = "1d2q99xa7dhdpqkipapzi1r1mvynf70s7sgdczd59kn0d8sr3map";
  };

  nativeBuildInputs = [ pkgconfig qmake qttools ];
--- a/pkgs/applications/editors/geany/default.nix
+++ b/pkgs/applications/editors/geany/default.nix
@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
      - Simple project management
      - Plugin interface
    '';
-    homepage = http://www.geany.org/;
+    homepage = https://www.geany.org/;
    license = "GPL";
    maintainers = [];
    platforms = platforms.all;
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@ -234,12 +234,12 @@ in

  clion = buildClion rec {
    name = "clion-${version}";
-    version = "2017.3"; /* updated by script */
+    version = "2017.3.1"; /* updated by script */
    description  = "C/C++ IDE. New. Intelligent. Cross-platform";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/cpp/CLion-${version}.tar.gz";
-      sha256 = "0gv9krqy4bhijx5s005qhswxnc05l1jsjlxs0h15z23bmv7rlpnf"; /* updated by script */
+      sha256 = "19pb78s5pa5ywifi1azs8gpg0a65c9n3yiqng348a7s27azkw01z"; /* updated by script */
    };
    wmClass = "jetbrains-clion";
    update-channel = "CLion_Release"; # channel's id as in http://www.jetbrains.com/updates/updates.xml
@ -273,12 +273,12 @@ in

  idea-community = buildIdea rec {
    name = "idea-community-${version}";
-    version = "2017.3"; /* updated by script */
+    version = "2017.3.2";
    description = "Integrated Development Environment (IDE) by Jetbrains, community edition";
    license = stdenv.lib.licenses.asl20;
    src = fetchurl {
      url = "https://download.jetbrains.com/idea/ideaIC-${version}.tar.gz";
-      sha256 = "04qp37pv4z6d9gw6j56m4zfxw4v2cydk8w7jzyzrcg52jr064kwi"; /* updated by script */
+      sha256 = "70cc4f36a6517c7af980456758214414ea74c5c4f314ecf30dd2640600badd62"; /* updated by script */
    };
    wmClass = "jetbrains-idea-ce";
    update-channel = "IDEA_Release";
@ -286,12 +286,12 @@ in

  idea-ultimate = buildIdea rec {
    name = "idea-ultimate-${version}";
-    version = "2017.3"; /* updated by script */
+    version = "2017.3.2"; /* updated by script */
    description = "Integrated Development Environment (IDE) by Jetbrains, requires paid license";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/idea/ideaIU-${version}-no-jdk.tar.gz";
-      sha256 = "0w9ihi6vzgfiav2qia7d7vrn14k8v56npir0dyx7ii8an887s7ws"; /* updated by script */
+      sha256 = "0lygnhn2wbs1678g3jbd3c5yzxnjp106qx7v9kgvb1k6l9mqb3my"; /* updated by script */
    };
    wmClass = "jetbrains-idea";
    update-channel = "IDEA_Release";
@ -299,12 +299,12 @@ in

  phpstorm = buildPhpStorm rec {
    name = "phpstorm-${version}";
-    version = "2017.3"; /* updated by script */
+    version = "2017.3.2";
    description = "Professional IDE for Web and PHP developers";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/webide/PhpStorm-${version}.tar.gz";
-      sha256 = "1byhlm5bnp6ic4n2xg17v4g34ipygy50i9xj4292b0xw7srxh910"; /* updated by script */
+      sha256 = "1grkqvj4j33d8hmy11ipkcci20sw7jpnc5zl28a9g85f2pzvsvs0";
    };
    wmClass = "jetbrains-phpstorm";
    update-channel = "PS2017.3";
@ -312,12 +312,12 @@ in

  pycharm-community = buildPycharm rec {
    name = "pycharm-community-${version}";
-    version = "2017.3"; /* updated by script */
+    version = "2017.3.2"; /* updated by script */
    description = "PyCharm Community Edition";
    license = stdenv.lib.licenses.asl20;
    src = fetchurl {
      url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "1lca3g5h716l97pkqfb8i7apsnx445xzcc9j41d0y3yyncf5hwxr"; /* updated by script */
+      sha256 = "1xp4hva2wj2r3haqwmji4vpg6xm9fsx2xihslwmq89vfrbzybyq6"; /* updated by script */
    };
    wmClass = "jetbrains-pycharm-ce";
    update-channel = "PyCharm_Release";
@ -325,12 +325,12 @@ in

  pycharm-professional = buildPycharm rec {
    name = "pycharm-professional-${version}";
-    version = "2017.3"; /* updated by script */
+    version = "2017.3.2"; /* updated by script */
    description = "PyCharm Professional Edition";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "06lh0nxmzn0lsyd6isyb6gf01h4nbksi0f03hwwm6wdfvsfw92pb"; /* updated by script */
+      sha256 = "0bqavq9f9pg82yh04bpzpb3a36980v2bn70j1ch6gsm3hdd75swv"; /* updated by script */
    };
    wmClass = "jetbrains-pycharm";
    update-channel = "PyCharm_Release";
@ -351,12 +351,12 @@ in

  ruby-mine = buildRubyMine rec {
    name = "ruby-mine-${version}";
-    version = "2017.3"; /* updated by script */
+    version = "2017.3.1"; /* updated by script */
    description = "The Most Intelligent Ruby and Rails IDE";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/ruby/RubyMine-${version}.tar.gz";
-      sha256 = "04h299mbzwrdgqxkff0vgpj2kbisb29l55mm6r45amgpqcnms6i5"; /* updated by script */
+      sha256 = "01y89blg30y41j2h254mhf7b7d7nd3bgscinn03vpkjfg7hzr689"; /* updated by script */
    };
    wmClass = "jetbrains-rubymine";
    update-channel = "rm2017.3";
@ -364,12 +364,12 @@ in

  webstorm = buildWebStorm rec {
    name = "webstorm-${version}";
-    version = "2017.3"; /* updated by script */
+    version = "2017.3.2"; /* updated by script */
    description = "Professional IDE for Web and JavaScript development";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/webstorm/WebStorm-${version}.tar.gz";
-      sha256 = "0whr5zygrbi044pl48ac2w7a4rxldbaqlf76dkfqj83g2wl4n990"; /* updated by script */
+      sha256 = "1if99qjpnf9x7d3f1anpiglg9lwc3phamfd4wbyi9yjnk3rf5qcr"; /* updated by script */
    };
    wmClass = "jetbrains-webstorm";
    update-channel = "WS_Release";
--- a/pkgs/applications/editors/micro/default.nix
+++ b/pkgs/applications/editors/micro/default.nix
@ -0,0 +1,28 @@
+{ stdenv, buildGoPackage, fetchFromGitHub }:
+
+buildGoPackage  rec {
+  name = "micro-${version}";
+  version = "1.3.4";
+
+  goPackagePath = "github.com/zyedidia/micro";
+
+  src = fetchFromGitHub {
+    owner = "zyedidia";
+    repo = "micro";
+    rev = "v${version}";
+    sha256 = "1giyp2xk2rb6vdyfnj5wa7qb9fwbcmmwm16wdlnmq7xnp7qamdkw";
+    fetchSubmodules = true;
+  };
+
+  subPackages = [ "cmd/micro" ];
+
+  buildFlagsArray = [ "-ldflags=" "-X main.Version=${version}" ];
+
+  meta = with stdenv.lib; {
+    homepage = https://micro-editor.github.io;
+    description = "Modern and intuitive terminal-based text editor";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dtzWill ];
+  };
+}
+
--- a/pkgs/applications/editors/nano/default.nix
+++ b/pkgs/applications/editors/nano/default.nix
@ -20,15 +20,13 @@ let

 in stdenv.mkDerivation rec {
  name = "nano-${version}";
-  version = "2.9.1";
+  version = "2.9.2";

  src = fetchurl {
    url = "mirror://gnu/nano/${name}.tar.xz";
-    sha256 = "0z5sxji8jh8sh0g3inbzndhsrbm4qyqlvjrxl5wkxbr61lnxa5k3";
+    sha256 = "0m9xm085pi0fhmmshgppipjimr1jkxksbyg8pa5cwaap3d2vgk2f";
  };

-  patches = [ ./nano-2.9.1-darwin.patch ];
-
  nativeBuildInputs = [ texinfo ] ++ optional enableNls gettext;
  buildInputs = [ ncurses ];

--- a/pkgs/applications/editors/nano/nano-2.9.1-darwin.patch
+++ b/pkgs/applications/editors/nano/nano-2.9.1-darwin.patch
@ -1,9 +0,0 @@
--- a/lib/stat.c
-+++ b/lib/stat.c
-@@ -48,4 +48,6 @@ orig_stat (const char *filename, struct stat *buf)
- #include "sys/stat.h"
- 
-+#include "stat-time.h"
-+
- #include <errno.h>
- #include <limits.h>
--- a/pkgs/applications/editors/neovim/default.nix
+++ b/pkgs/applications/editors/neovim/default.nix
@ -83,7 +83,7 @@ let
                       (optionalString withPython3 python3Wrapper) +
                       (optionalString withRuby rubyWrapper)}" --unset PYTHONPATH '' +
    optionalString (withRuby)
-      ''--suffix PATH : \"${rubyEnv}/bin\" --set GEM_HOME \"${rubyEnv}/${rubyEnv.ruby.gemPath}\" '';
+      ''--suffix PATH : ${rubyEnv}/bin --set GEM_HOME ${rubyEnv}/${rubyEnv.ruby.gemPath} '';

  neovim = stdenv.mkDerivation rec {
    name = "neovim-${version}";
--- a/pkgs/applications/editors/rstudio/default.nix
+++ b/pkgs/applications/editors/rstudio/default.nix
@ -124,7 +124,7 @@ stdenv.mkDerivation rec {

  meta = with stdenv.lib;
    { description = "Set of integrated tools for the R language";
-      homepage = http://www.rstudio.com/;
+      homepage = https://www.rstudio.com/;
      license = licenses.agpl3;
      maintainers = with maintainers; [ ehmry changlinli ciil ];
      platforms = platforms.linux;
--- a/pkgs/applications/editors/tiled/default.nix
+++ b/pkgs/applications/editors/tiled/default.nix
@ -1,17 +1,15 @@
 { stdenv, fetchFromGitHub, pkgconfig, qmake
 , python, qtbase, qttools, zlib }:

-let
-#  qtEnv = with qt5; env "qt-${qtbase.version}" [ qtbase qttools ];
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
  name = "tiled-${version}";
-  version = "1.0.3";
+  version = "1.1.1";

  src = fetchFromGitHub {
    owner = "bjorn";
    repo = "tiled";
    rev = "v${version}";
-    sha256 = "1j8307h7xkxqwr8rpr9fn1svm5h10k61w6zxr4sgph1hiv8x33aa";
+    sha256 = "1c6n5xshadxv5qwv8kfrj1kbfnkvx6nyxc9p4mpzkjrkxw1b1qf1";
  };

  nativeBuildInputs = [ pkgconfig qmake ];
--- a/pkgs/applications/editors/vbindiff/default.nix
+++ b/pkgs/applications/editors/vbindiff/default.nix
@ -7,13 +7,13 @@ stdenv.mkDerivation rec {
  buildInputs = [ ncurses ];

  src = fetchurl {
-    url = "http://www.cjmweb.net/vbindiff/${name}.tar.gz";
+    url = "https://www.cjmweb.net/vbindiff/${name}.tar.gz";
    sha256 = "0gcqy4ggp60qc6blq1q1gc90xmhip1m6yvvli4hdqlz9zn3mlpbx";
  };

  meta = {
    description = "A terminal visual binary diff viewer";
-    homepage = http://www.cjmweb.net/vbindiff/;
+    homepage = https://www.cjmweb.net/vbindiff/;
    license = stdenv.lib.licenses.gpl2Plus;
    platforms = stdenv.lib.platforms.unix;
  };
--- a/pkgs/applications/gis/saga/default.nix
+++ b/pkgs/applications/gis/saga/default.nix
@ -2,15 +2,15 @@
  libharu, opencv, vigra, postgresql }:

 stdenv.mkDerivation rec {
-  name = "saga-5.0.0";
+  name = "saga-6.2.0";

  buildInputs = [ gdal wxGTK30 proj libharu opencv vigra postgresql libiodbc lzma jasper ];

  enableParallelBuilding = true;

  src = fetchurl {
-    url = "mirror://sourceforge/project/saga-gis/SAGA%20-%205/SAGA%20-%205.0.0/saga-5.0.0.tar.gz";
-    sha256 = "9be997209737e80262d9f13fd9b9797194a9f2facb10e5b9bd756d8cda675089";
+    url = "mirror://sourceforge/project/saga-gis/SAGA%20-%206/SAGA%20-%206.2.0/saga-6.2.0.tar.gz";
+    sha256 = "91b030892c894ba02eb4292ebfc9ccbf4acf3062118f2a89a9a11208773fa280";
  };

  meta = {
--- a/pkgs/applications/graphics/ImageMagick/7.0.nix
+++ b/pkgs/applications/graphics/ImageMagick/7.0.nix
@ -14,8 +14,8 @@ let
    else throw "ImageMagick is not supported on this platform.";

  cfg = {
-    version = "7.0.7-14";
-    sha256 = "04hpc9i6fp09iy0xkidlfhfqr7zg45izqqj5fx93n3dxalq65xqw";
+    version = "7.0.7-19";
+    sha256 = "1naib6hspmq7d4gfpsksx78gc1lq3p2v3i9pxkkdvr9p9j15c4az";
    patches = [];
  };
 in
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, pkgconfig, libtool
+{ lib, stdenv, fetchFromGitHub, fetchpatch, pkgconfig, libtool
 , bzip2, zlib, libX11, libXext, libXt, fontconfig, freetype, ghostscript, libjpeg
 , lcms2, openexr, libpng, librsvg, libtiff, libxml2, openjpeg, libwebp
 , ApplicationServices
@ -14,8 +14,8 @@ let
    else throw "ImageMagick is not supported on this platform.";

  cfg = {
-    version = "6.9.9-26";
-    sha256 = "10rcq7b9hhz50m4yqnm4g3iai7lr9jkglb7sm49ycw59arrkmwnw";
+    version = "6.9.9-28";
+    sha256 = "132kdl7jlkghfg3smdab14c29cpvrx65ibipxkmwg1nc88ycqivh";
    patches = [];
  }
    # Freeze version on mingw so we don't need to port the patch too often.
@ -36,13 +36,10 @@ stdenv.mkDerivation rec {
  name = "imagemagick-${version}";
  inherit (cfg) version;

-  src = fetchurl {
-    urls = [
-      "mirror://imagemagick/releases/ImageMagick-${version}.tar.xz"
-      # the original source above removes tarballs quickly
-      "http://distfiles.macports.org/ImageMagick/ImageMagick-${version}.tar.xz"
-      "https://bintray.com/homebrew/mirror/download_file?file_path=imagemagick-${version}.tar.xz"
-    ];
+  src = fetchFromGitHub {
+    owner = "ImageMagick";
+    repo = "ImageMagick";
+    rev = cfg.version;
    inherit (cfg) sha256;
  };

--- a/pkgs/applications/graphics/displaycal/default.nix
+++ b/pkgs/applications/graphics/displaycal/default.nix
@ -49,7 +49,7 @@ buildPythonPackage {

  meta = {
    description = "Display Calibration and Characterization powered by Argyll CMS";
-    homepage = http://displaycal.net/;
+    homepage = https://displaycal.net/;
    license = stdenv.lib.licenses.gpl3;
    maintainers = [stdenv.lib.maintainers.marcweber];
    platforms = stdenv.lib.platforms.linux;
--- a/pkgs/applications/graphics/meh/default.nix
+++ b/pkgs/applications/graphics/meh/default.nix
@ -20,7 +20,7 @@ stdenv.mkDerivation rec {

  meta = {
    description = "A minimal image viewer using raw XLib";
-    homepage = http://www.johnhawthorn.com/meh/;
+    homepage = https://www.johnhawthorn.com/meh/;
    license = stdenv.lib.licenses.mit;
    platforms = stdenv.lib.platforms.linux;
  };
--- a/pkgs/applications/graphics/photoqt/default.nix
+++ b/pkgs/applications/graphics/photoqt/default.nix
@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
  version = "1.5.1";

  src = fetchurl {
-    url = "http://photoqt.org/pkgs/photoqt-${version}.tar.gz";
+    url = "https://photoqt.org/pkgs/photoqt-${version}.tar.gz";
    sha256 = "17kkpzkmzfnigs26jjyd75iy58qffjsclif81cmviq73lzmqy0b1";
  };

@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
  enableParallelBuilding = true;

  meta = {
-    homepage = http://photoqt.org/;
+    homepage = https://photoqt.org/;
    description = "Simple, yet powerful and good looking image viewer";
    license = stdenv.lib.licenses.gpl2Plus;
    platforms = stdenv.lib.platforms.unix;
--- a/pkgs/applications/misc/airspy/default.nix
+++ b/pkgs/applications/misc/airspy/default.nix
@ -26,7 +26,7 @@ in
      lib.optionals stdenv.isLinux [ "-DINSTALL_UDEV_RULES=ON" ];

    meta = with stdenv.lib; {
-      homepage = http://github.com/airspy/airspyone_host;
+      homepage = https://github.com/airspy/airspyone_host;
      description = "Host tools and driver library for the AirSpy SDR";
      license = licenses.free;
      platforms = with platforms; linux ++ darwin;
--- a/pkgs/applications/misc/calibre/default.nix
+++ b/pkgs/applications/misc/calibre/default.nix
@ -5,12 +5,12 @@
 }:

 stdenv.mkDerivation rec {
-  version = "3.12.0";
+  version = "3.14.0";
  name = "calibre-${version}";

  src = fetchurl {
    url = "https://download.calibre-ebook.com/${version}/${name}.tar.xz";
-    sha256 = "0l7r5ny9a36yg22fqzz3as6wh1xqpa3hrlx2gy25yp649sbkd9vq";
+    sha256 = "1367jh82mhjjlvyd30mfz3qwscg60l0gimakvzpbkrah918kfk51";
  };

  patches = [
--- a/pkgs/applications/misc/electron-cash/default.nix
+++ b/pkgs/applications/misc/electron-cash/default.nix
@ -7,14 +7,14 @@ let
 in

 python3Packages.buildPythonApplication rec {
-  version = "3.0";
+  version = "3.1.1";
  name = "electron-cash-${version}";

  src = fetchurl {
    url = "https://electroncash.org/downloads/${version}/win-linux/ElectronCash-${version}.tar.gz";
    # Verified using official SHA-1 and signature from
    # https://github.com/fyookball/keys-n-hashes
-    sha256 = "f0e2bf5c6d29da714eddd50b45761fea9fc905a0172c7b92df8fca7427439f1a";
+    sha256 = "cd42a0a0075787125f195508834d8c34d651896c0986d0b2066763add59bad2b";
  };

  propagatedBuildInputs = with python3Packages; [
@ -36,6 +36,11 @@ python3Packages.buildPythonApplication rec {
    trezor
  ];

+  postPatch = ''
+    # Remove pyqt5 check
+    sed -i '/pyqt5/d' setup.py
+  '';
+
  preBuild = ''
    sed -i 's,usr_share = .*,usr_share = "'$out'/share",g' setup.py
    pyrcc5 icons.qrc -o gui/qt/icons_rc.py
--- a/pkgs/applications/misc/electrum/default.nix
+++ b/pkgs/applications/misc/electrum/default.nix
@ -2,11 +2,11 @@

 python3Packages.buildPythonApplication rec {
  name = "electrum-${version}";
-  version = "3.0.3";
+  version = "3.0.5";

  src = fetchurl {
    url = "https://download.electrum.org/${version}/Electrum-${version}.tar.gz";
-    sha256 = "09h3s1mbkliwh8758prbdk3sm19bnma7wy3k10pl9q9fkarbhp75";
+    sha256 = "06z0a5p1jg93jialphslip8d72q9yg3651qqaf494gs3h9kw1sv1";
  };

  propagatedBuildInputs = with python3Packages; [
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@ -2,7 +2,7 @@

 buildGoPackage rec {
  name = "hugo-${version}";
-  version = "0.30.2";
+  version = "0.32.2";

  goPackagePath = "github.com/gohugoio/hugo";

@ -10,7 +10,7 @@ buildGoPackage rec {
    owner = "gohugoio";
    repo = "hugo";
    rev = "v${version}";
-    sha256 = "12dii2d0pirkj264857d5y83bdllk1knk5sjf31v0m9c25fapci0";
+    sha256 = "0k62sg9rvr4aqzh1r60m456cw8mj6kxjpri2nnj4c2dxmvll8qhr";
  };

  goDeps = ./deps.nix;
--- a/pkgs/applications/misc/icesl/default.nix
+++ b/pkgs/applications/misc/icesl/default.nix
@ -0,0 +1,39 @@
+{ stdenv, lib, fetchzip, patchelf, freeglut, libXmu, libXi, libX11, libICE, mesa, libSM, libXext, dialog, makeWrapper }:
+let
+  lpath = stdenv.lib.makeLibraryPath [ libXmu libXi libX11 freeglut libICE mesa libSM libXext ];
+in
+stdenv.mkDerivation rec {
+  name = "iceSL-${version}";
+  version = "2.1.10";
+
+  src =  if stdenv.system == "x86_64-linux" then fetchzip {
+    url = "https://gforge.inria.fr/frs/download.php/file/37268/icesl${version}-amd64.zip";
+    sha256 = "0dv3mq6wy46xk9blzzmgbdxpsjdaxid3zadfrysxlhmgl7zb2cn2";
+  } else if stdenv.system == "i686-linux" then fetchzip {
+    url = "https://gforge.inria.fr/frs/download.php/file/37267/icesl${version}-i386.zip";
+    sha256 = "0sl54fsb2gz6dy0bwdscpdq1ab6ph5b7zald3bwzgkqsvna7p1jr";
+  } else throw "Unsupported architecture";
+
+  buildInputs = [ makeWrapper ];
+  installPhase = ''
+    cp -r ./ $out
+    mkdir $out/oldbin
+    mv $out/bin/IceSL-slicer $out/oldbin/IceSL-slicer
+    runHook postInstall
+  '';
+
+  postInstall = ''
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --set-rpath "${lpath}" \
+      $out/oldbin/IceSL-slicer
+    makeWrapper $out/oldbin/IceSL-slicer $out/bin/icesl --prefix PATH : ${dialog}/bin
+  '';
+
+  meta = with lib; {
+    description = "IceSL is a GPU-accelerated procedural modeler and slicer for 3D printing.";
+    homepage = http://shapeforge.loria.fr/icesl/index.html;
+    license = licenses.inria-icesl;
+    platforms = [ "i686-linux" "x86_64-linux" ];
+    maintainers = with maintainers; [ mgttlinger ];
+  };
+}
--- a/pkgs/applications/misc/jekyll/default.nix
+++ b/pkgs/applications/misc/jekyll/default.nix
@ -11,7 +11,7 @@ bundlerEnv rec {

  meta = with lib; {
    description = "Simple, blog aware, static site generator";
-    homepage    =  http://jekyllrb.com/;
+    homepage    =  https://jekyllrb.com/;
    license     = licenses.mit;
    maintainers = with maintainers; [ pesterhazy ];
    platforms   = platforms.unix;
--- a/pkgs/applications/misc/josm/default.nix
+++ b/pkgs/applications/misc/josm/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "josm-${version}";
-  version = "13053";
+  version = "13265";

  src = fetchurl {
    url = "https://josm.openstreetmap.de/download/josm-snapshot-${version}.jar";
-    sha256 = "0czsmx0gsml3vqzx6940jw2xpmh16idypydw0d4147k4fi9gzyz6";
+    sha256 = "0mmpxmf17lw1j1m1gfz2jrm3qj2416zgbwgcy7xbvn6qcd8k7dr5";
  };

  buildInputs = [ jre8 makeWrapper ];
--- a/pkgs/applications/misc/lxterminal/default.nix
+++ b/pkgs/applications/misc/lxterminal/default.nix
@ -16,11 +16,13 @@ stdenv.mkDerivation rec {
    "--enable-man"
  ];

-  buildInputs = [
-    automake autoconf intltool pkgconfig gtk2 vte libxslt docbook_xml_dtd_412
-    docbook_xml_xslt libxml2 findXMLCatalogs
+  nativeBuildInputs = [
+    automake autoconf intltool pkgconfig
+    libxslt docbook_xml_dtd_412 docbook_xml_xslt libxml2 findXMLCatalogs
  ];

+  buildInputs = [ gtk2 vte ];
+
  patches = [
    ./respect-xml-catalog-files-var.patch
  ];
--- a/pkgs/applications/misc/octoprint/default.nix
+++ b/pkgs/applications/misc/octoprint/default.nix
@ -101,7 +101,7 @@ in pythonPackages.buildPythonApplication rec {
  checkPhase = "nosetests";

  meta = with stdenv.lib; {
-    homepage = http://octoprint.org/;
+    homepage = https://octoprint.org/;
    description = "The snappy web interface for your 3D printer";
    license = licenses.agpl3;
    maintainers = with maintainers; [ abbradar ];
--- a/pkgs/applications/misc/pdfpc/default.nix
+++ b/pkgs/applications/misc/pdfpc/default.nix
@ -4,13 +4,13 @@
 stdenv.mkDerivation rec {
  name = "${product}-${version}";
  product = "pdfpc";
-  version = "4.0.7";
+  version = "4.1";

  src = fetchFromGitHub {
    repo = "pdfpc";
    owner = "pdfpc";
    rev = "v${version}";
-    sha256 = "00qfmmk8h762p53z46g976z7j4fbxyi16w5axzsv1ymvdq95ds8c";
+    sha256 = "02cp0x5prqrizxdp0sf2sk5ip0363vyw6fxsb3zwyx4dw0vz4g96";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/qtpass/default.nix
+++ b/pkgs/applications/misc/qtpass/default.nix
@ -2,32 +2,29 @@

 stdenv.mkDerivation rec {
  name = "qtpass-${version}";
-  version = "1.1.6";
+  version = "1.2.1";

  src = fetchFromGitHub {
    owner  = "IJHack";
    repo   = "QtPass";
    rev    = "v${version}";
-    sha256 = "0jq5a1cvqvsjwld0nldl6kmcz9g59hiccmbg98xwji04n8174y7j";
+    sha256 = "0pp38b3fifkfwqcb6vi194ccgb8j3zc8j8jq8ww5ib0wvhldzsg8";
  };

+  patches = [ ./hidpi.patch ];
+
  buildInputs = [ git gnupg pass qtbase qtsvg qttools ];

  nativeBuildInputs = [ makeWrapper qmake ];

-  preConfigure = ''
-    qmakeFlags="$qmakeFlags DESTDIR=$out"
-  '';
-
-  installPhase = ''
-    mkdir $out/bin
-    mv $out/qtpass $out/bin
-    install -D {,$out/share/applications/}qtpass.desktop
-    install -D artwork/icon.svg $out/share/icons/hicolor/scalable/apps/qtpass-icon.svg
-    runHook postInstall
+  postPatch = ''
+    substituteInPlace qtpass.pro --replace "SUBDIRS += src tests main" "SUBDIRS += src main"
+    substituteInPlace qtpass.pro --replace "main.depends = tests" "main.depends = src"
  '';

  postInstall = ''
+    install -D qtpass.desktop $out/share/applications/qtpass.desktop
+    install -D artwork/icon.svg $out/share/icons/hicolor/scalable/apps/qtpass-icon.svg
    wrapProgram $out/bin/qtpass \
      --suffix PATH : ${git}/bin \
      --suffix PATH : ${gnupg}/bin \
--- a/pkgs/applications/misc/qtpass/hidpi.patch
+++ b/pkgs/applications/misc/qtpass/hidpi.patch
@ -0,0 +1,13 @@
+diff --git a/main/main.cpp b/main/main.cpp
+index 8a18409c..1cddd911 100644
+--- a/main/main.cpp
+++ b/main/main.cpp
+@@ -35,7 +35,7 @@
+  * @return
+  */
+ int main(int argc, char *argv[]) {
+-  qputenv("QT_AUTO_SCREEN_SCALE_FACTOR", "1");
+  QApplication::setAttribute(Qt::AA_EnableHighDpiScaling);
+   QString text = "";
+   for (int i = 1; i < argc; ++i) {
+     if (i > 1)
--- a/pkgs/applications/misc/redis-desktop-manager/default.nix
+++ b/pkgs/applications/misc/redis-desktop-manager/default.nix
@ -76,7 +76,7 @@ EOF

  meta = with lib; {
    description = "Cross-platform open source Redis DB management tool";
-    homepage = http://redisdesktop.com/;
+    homepage = https://redisdesktop.com/;
    license = licenses.lgpl21;
    platforms = platforms.linux;
    maintainers = with maintainers; [ cstrahan ];
--- a/pkgs/applications/misc/rescuetime/default.nix
+++ b/pkgs/applications/misc/rescuetime/default.nix
@ -11,33 +11,26 @@ let
      url = "https://www.rescuetime.com/installers/rescuetime_current_amd64.deb";
      sha256 = "0b56iglg8g45biddwsdn1hmx9gsz4kxr64civwyy7f69f022ppab";
    };
-
-in
-
-stdenv.mkDerivation {
+in stdenv.mkDerivation {
  # https://www.rescuetime.com/updates/linux_release_notes.html
  name = "rescuetime-2.10.0.1322";
  inherit src;
  buildInputs = [ dpkg makeWrapper ];
+  # avoid https://github.com/NixOS/patchelf/issues/99
+  dontStrip = true;
  unpackPhase = ''
    mkdir pkg
    dpkg-deb -x $src pkg
    sourceRoot=pkg
  '';
-  installPhase = let
-
-    lib = p: stdenv.lib.makeLibraryPath [ p ];
-
-  in ''
+  installPhase = ''
    mkdir -p $out/bin
    cp usr/bin/rescuetime $out/bin

    ${patchelf}/bin/patchelf \
      --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --set-rpath "${lib.makeLibraryPath [ qt4 libXtst libXext libX11 libXScrnSaver ]}" \
      $out/bin/rescuetime
-
-    wrapProgram $out/bin/rescuetime \
-      --prefix LD_PRELOAD : ${lib qt4}/libQtGui.so.4:${lib qt4}/libQtCore.so.4:${lib libXtst}/libXtst.so.6:${lib libXext}/libXext.so.6:${lib libX11}/libX11.so.6:${lib libXScrnSaver}/libXss.so.1
  '';
  meta = with lib; {
    description = "Helps you understand your daily habits so you can focus and be more productive";
--- a/pkgs/applications/misc/terminator/default.nix
+++ b/pkgs/applications/misc/terminator/default.nix
@ -32,7 +32,7 @@ pythonPackages.buildPythonApplication rec {
      quadkonsole, etc. in that the main focus is arranging terminals in grids
      (tabs is the most common default method, which Terminator also supports).
    '';
-    homepage = http://gnometerminator.blogspot.no/p/introduction.html;
+    homepage = https://gnometerminator.blogspot.no/p/introduction.html;
    license = licenses.gpl2;
    maintainers = with maintainers; [ bjornfor globin ];
    platforms = platforms.linux;
--- a/pkgs/applications/misc/timewarrior/default.nix
+++ b/pkgs/applications/misc/timewarrior/default.nix
@ -17,7 +17,7 @@ stdenv.mkDerivation rec {

  meta = with stdenv.lib; {
    description = "A command-line time tracker";
-    homepage = http://tasktools.org/projects/timewarrior.html;
+    homepage = https://tasktools.org/projects/timewarrior.html;
    license = licenses.mit;
    maintainers = with maintainers; [ matthiasbeyer ];
    platforms = platforms.linux;
--- a/Show More
+++ b/Show More