Merge branch 'master' into staging

2017-07-15 12:15:56 +02:00 · 2017-07-15 12:15:56 +02:00 · e2b7b09960
commit e2b7b09960
parent 7d80f94f75 071693e5df
156 changed files with 6903 additions and 3679 deletions
--- a/lib/maintainers.nix
+++ b/lib/maintainers.nix
@ -219,6 +219,7 @@
  goodrone = "Andrew Trachenko <goodrone@gmail.com>";
  gpyh = "Yacine Hmito <yacine.hmito@gmail.com>";
  grahamc = "Graham Christensen <graham@grahamc.com>";
+  grburst = "Julius Elias <grburst@openmailbox.org>";
  gridaphobe = "Eric Seidel <eric@seidel.io>";
  guibert = "David Guibert <david.guibert@gmail.com>";
  guillaumekoenig = "Guillaume Koenig <guillaume.edward.koenig@gmail.com>";
@ -230,6 +231,7 @@
  hectorj = "Hector Jusforgues <hector.jusforgues+nixos@gmail.com>";
  heel = "Sergii Paryzhskyi <parizhskiy@gmail.com>";
  henrytill = "Henry Till <henrytill@gmail.com>";
+  hhm = "hhm <heehooman+nixpkgs@gmail.com>";
  hinton = "Tom Hinton <t@larkery.com>";
  hodapp = "Chris Hodapp <hodapp87@gmail.com>";
  hrdinka = "Christoph Hrdinka <c.nix@hrdinka.at>";
@ -577,6 +579,7 @@
  utdemir = "Utku Demir <me@utdemir.com>";
  #urkud = "Yury G. Kudryashov <urkud+nix@ya.ru>"; inactive since 2012
  uwap = "uwap <me@uwap.name>";
+  vaibhavsagar = "Vaibhav Sagar <vaibhavsagar@gmail.com>";
  vandenoever = "Jos van den Oever <jos@vandenoever.info>";
  vanzef = "Ivan Solyankin <vanzef@gmail.com>";
  vbgl = "Vincent Laporte <Vincent.Laporte@gmail.com>";
@ -596,6 +599,7 @@
  volth = "Jaroslavas Pocepko <jaroslavas@volth.com>";
  vozz = "Oliver Hunt <oliver.huntuk@gmail.com>";
  vrthra = "Rahul Gopinath <rahul@gopinath.org>";
+  vyp = "vyp <elisp.vim@gmail.com>";
  wedens = "wedens <kirill.wedens@gmail.com>";
  willtim = "Tim Philip Williams <tim.williams.public@gmail.com>";
  winden = "Antonio Vargas Gonzalez <windenntw@gmail.com>";
--- a/maintainers/scripts/gnome.sh
+++ b/maintainers/scripts/gnome.sh
@ -6,7 +6,7 @@ GNOME_FTP="ftp.gnome.org/pub/GNOME/sources"

 # projects that don't follow the GNOME major versioning, or that we don't want to
 # programmatically update
-NO_GNOME_MAJOR="gtkhtml gdm"
+NO_GNOME_MAJOR="ghex gtkhtml gdm"

 usage() {
  echo "Usage: $0 gnome_dir <show project>|<update project>|<update-all> [major.minor]" >&2
--- a/nixos/modules/config/networking.nix
+++ b/nixos/modules/config/networking.nix
@ -223,7 +223,9 @@ in
            '';

      } // optionalAttrs config.services.resolved.enable {
-        "resolv.conf".source = "/run/systemd/resolve/resolv.conf";
+        # symlink the static version of resolv.conf as recommended by upstream:
+        # https://www.freedesktop.org/software/systemd/man/systemd-resolved.html#/etc/resolv.conf
+        "resolv.conf".source = "${pkgs.systemd}/lib/systemd/resolv.conf";
      } // optionalAttrs (config.services.resolved.enable && dnsmasqResolve) {
        "dnsmasq-resolv.conf".source = "/run/systemd/resolve/resolv.conf";
      };
--- a/nixos/modules/installer/tools/nix-fallback-paths.nix
+++ b/nixos/modules/installer/tools/nix-fallback-paths.nix
@ -1,5 +1,5 @@
 {
-  x86_64-linux = "/nix/store/crqd5wmrqipl4n1fcm5kkc1zg4sj80js-nix-1.11.11";
-  i686-linux = "/nix/store/wsjn14xp5ja509d4dxb1c78zhirw0b5x-nix-1.11.11";
-  x86_64-darwin = "/nix/store/zqkqnhk85g2shxlpb04y72h1i3db3gpl-nix-1.11.11";
+  x86_64-linux = "/nix/store/2y3cn6siixhr7pbsz2grry89jzchkxyd-nix-1.11.12";
+  i686-linux = "/nix/store/sbz8z995lysxja8brnxmw7hgi6ljigrq-nix-1.11.12";
+  x86_64-darwin = "/nix/store/gs2z548x41ah2h8fqnbn87syzazrlsb8-nix-1.11.12";
 }
--- a/nixos/modules/installer/tools/nixos-install.sh
+++ b/nixos/modules/installer/tools/nixos-install.sh
@ -140,7 +140,7 @@ channel_closure="$tmpdir/channel.closure"
 nix-store --export $channel_root > $channel_closure

 # Populate the target root directory with the basics
-@prepare_root@/bin/nixos-prepare-root $mountPoint $channel_root $system_root @nixClosure@ $system_closure $channel_closure
+@prepare_root@/bin/nixos-prepare-root "$mountPoint" "$channel_root" "$system_root" @nixClosure@ "$system_closure" "$channel_closure"

 # nixos-prepare-root doesn't currently do anything with file ownership, so we set it up here instead
 chown @root_uid@:@nixbld_gid@ $mountPoint/nix/store
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@ -139,6 +139,7 @@
      btsync = 113;
      minecraft = 114;
      #monetdb = 115; # unused (not packaged), removed 2016-09-19
+      vault = 115;
      rippled = 116;
      murmur = 117;
      foundationdb = 118;
@ -415,6 +416,7 @@
      btsync = 113;
      #minecraft = 114; # unused
      #monetdb = 115; # unused (not packaged), removed 2016-09-19
+      vault = 115;
      #ripped = 116; # unused
      #murmur = 117; # unused
      foundationdb = 118;
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -558,6 +558,7 @@
  ./services/security/tor.nix
  ./services/security/torify.nix
  ./services/security/torsocks.nix
+  ./services/security/vault.nix
  ./services/system/cgmanager.nix
  ./services/system/cloud-init.nix
  ./services/system/dbus.nix
--- a/nixos/modules/programs/gnupg.nix
+++ b/nixos/modules/programs/gnupg.nix
@ -55,84 +55,29 @@ in
  };

  config = mkIf cfg.agent.enable {
-    systemd.user.services.gpg-agent = {
-      serviceConfig = {
-        ExecStart = [
-          ""
-          ("${pkgs.gnupg}/bin/gpg-agent --supervised "
-            + optionalString cfg.agent.enableSSHSupport "--enable-ssh-support")
-        ];
-        ExecReload = "${pkgs.gnupg}/bin/gpgconf --reload gpg-agent";
-      };
-    };
-
    systemd.user.sockets.gpg-agent = {
      wantedBy = [ "sockets.target" ];
-      listenStreams = [ "%t/gnupg/S.gpg-agent" ];
-      socketConfig = {
-        FileDescriptorName = "std";
-        SocketMode = "0600";
-        DirectoryMode = "0700";
-      };
    };

    systemd.user.sockets.gpg-agent-ssh = mkIf cfg.agent.enableSSHSupport {
      wantedBy = [ "sockets.target" ];
-      listenStreams = [ "%t/gnupg/S.gpg-agent.ssh" ];
-      socketConfig = {
-        FileDescriptorName = "ssh";
-        Service = "gpg-agent.service";
-        SocketMode = "0600";
-        DirectoryMode = "0700";
-      };
    };

    systemd.user.sockets.gpg-agent-extra = mkIf cfg.agent.enableExtraSocket {
      wantedBy = [ "sockets.target" ];
-      listenStreams = [ "%t/gnupg/S.gpg-agent.extra" ];
-      socketConfig = {
-        FileDescriptorName = "extra";
-        Service = "gpg-agent.service";
-        SocketMode = "0600";
-        DirectoryMode = "0700";
-      };
    };

    systemd.user.sockets.gpg-agent-browser = mkIf cfg.agent.enableBrowserSocket {
      wantedBy = [ "sockets.target" ];
-      listenStreams = [ "%t/gnupg/S.gpg-agent.browser" ];
-      socketConfig = {
-        FileDescriptorName = "browser";
-        Service = "gpg-agent.service";
-        SocketMode = "0600";
-        DirectoryMode = "0700";
-      };
    };

-    systemd.user.services.dirmngr = {
-      requires = [ "dirmngr.socket" ];
-      after = [ "dirmngr.socket" ];
-      unitConfig = {
-        RefuseManualStart = "true";
-      };
-      serviceConfig = {
-        ExecStart = "${pkgs.gnupg}/bin/dirmngr --supervised";
-        ExecReload = "${pkgs.gnupg}/bin/gpgconf --reload dirmngr";
-      };
-    };
-
-    systemd.user.sockets.dirmngr = {
+    systemd.user.sockets.dirmngr = mkIf cfg.dirmngr.enable {
      wantedBy = [ "sockets.target" ];
-      listenStreams = [ "%t/gnupg/S.dirmngr" ];
-      socketConfig = {
-        SocketMode = "0600";
-        DirectoryMode = "0700";
-      };
    };

    systemd.packages = [ pkgs.gnupg ];

-    environment.extraInit = ''
+    environment.interactiveShellInit = ''
      # Bind gpg-agent to this TTY if gpg commands are used.
      export GPG_TTY=$(tty)

--- a/nixos/modules/services/computing/slurm/slurm.nix
+++ b/nixos/modules/services/computing/slurm/slurm.nix
@ -36,9 +36,9 @@ in

      package = mkOption {
        type = types.package;
-        default = pkgs.slurm-llnl;
-        defaultText = "pkgs.slurm-llnl";
-        example = literalExample "pkgs.slurm-llnl-full";
+        default = pkgs.slurm;
+        defaultText = "pkgs.slurm";
+        example = literalExample "pkgs.slurm-full";
        description = ''
          The package to use for slurm binaries.
        '';
--- a/nixos/modules/services/continuous-integration/gitlab-runner.nix
+++ b/nixos/modules/services/continuous-integration/gitlab-runner.nix
@ -15,6 +15,23 @@ in
      description = "Verbatim config.toml to use";
    };

+    gracefulTermination = mkOption {
+      default = false;
+      type = types.bool;
+      description = ''
+        Finish all remaining jobs before stopping, restarting or reconfiguring.
+        If not set gitlab-runner will stop immediatly without waiting for jobs to finish,
+        which will lead to failed builds.
+      '';
+    };
+
+    gracefulTimeout = mkOption {
+      default = "infinity";
+      type = types.str;
+      example = "5min 20s";
+      description = ''Time to wait until a graceful shutdown is turned into a forceful one.'';
+    };
+
    workDir = mkOption {
      default = "/var/lib/gitlab-runner";
      type = types.path;
@ -45,6 +62,11 @@ in
          --service gitlab-runner \
          --user gitlab-runner \
        '';
+
+      } //  optionalAttrs (cfg.gracefulTermination) {
+        TimeoutStopSec = "${cfg.gracefulTimeout}";
+        KillSignal = "SIGQUIT";
+        KillMode = "process";
      };
    };

--- a/nixos/modules/services/mail/postfix.nix
+++ b/nixos/modules/services/mail/postfix.nix
@ -9,7 +9,8 @@ let
  group = cfg.group;
  setgidGroup = cfg.setgidGroup;

-  haveAliases = cfg.postmasterAlias != "" || cfg.rootAlias != "" || cfg.extraAliases != "";
+  haveAliases = cfg.postmasterAlias != "" || cfg.rootAlias != ""
+                      || cfg.extraAliases != "";
  haveTransport = cfg.transport != "";
  haveVirtual = cfg.virtual != "";

@ -25,149 +26,275 @@ let

  clientRestrictions = concatStringsSep ", " (clientAccess ++ dnsBl);

-  mainCf =
-    ''
-      compatibility_level = 9999
+  mainCf = let
+    escape = replaceStrings ["$"] ["$$"];
+    mkList = items: "\n  " + concatMapStringsSep "\n  " escape items;
+    mkVal = value:
+      if isList value then mkList value
+        else " " + (if value == true then "yes"
+        else if value == false then "no"
+        else toString value);
+    mkEntry = name: value: "${escape name} =${mkVal value}";
+  in
+    concatStringsSep "\n" (mapAttrsToList mkEntry (recursiveUpdate defaultConf cfg.config))
+      + "\n" + cfg.extraConfig;

-      mail_owner = ${user}
-      default_privs = nobody
+  defaultConf = {
+    compatibility_level  = "9999";
+    mail_owner           = user;
+    default_privs        = "nobody";

-      # NixOS specific locations
-      data_directory = /var/lib/postfix/data
-      queue_directory = /var/lib/postfix/queue
+    # NixOS specific locations
+    data_directory       = "/var/lib/postfix/data";
+    queue_directory      = "/var/lib/postfix/queue";

-      # Default location of everything in package
-      meta_directory = ${pkgs.postfix}/etc/postfix
-      command_directory = ${pkgs.postfix}/bin
-      sample_directory = /etc/postfix
-      newaliases_path = ${pkgs.postfix}/bin/newaliases
-      mailq_path = ${pkgs.postfix}/bin/mailq
-      readme_directory = no
-      sendmail_path = ${pkgs.postfix}/bin/sendmail
-      daemon_directory = ${pkgs.postfix}/libexec/postfix
-      manpage_directory = ${pkgs.postfix}/share/man
-      html_directory = ${pkgs.postfix}/share/postfix/doc/html
-      shlib_directory = no
+    # Default location of everything in package
+    meta_directory       = "${pkgs.postfix}/etc/postfix";
+    command_directory    = "${pkgs.postfix}/bin";
+    sample_directory     = "/etc/postfix";
+    newaliases_path      = "${pkgs.postfix}/bin/newaliases";
+    mailq_path           = "${pkgs.postfix}/bin/mailq";
+    readme_directory     = false;
+    sendmail_path        = "${pkgs.postfix}/bin/sendmail";
+    daemon_directory     = "${pkgs.postfix}/libexec/postfix";
+    manpage_directory    = "${pkgs.postfix}/share/man";
+    html_directory       = "${pkgs.postfix}/share/postfix/doc/html";
+    shlib_directory      = false;
+    relayhost            = if cfg.lookupMX || cfg.relayHost == ""
+                             then cfg.relayHost
+                             else "[${cfg.relayHost}]";
+    mail_spool_directory = "/var/spool/mail/";
+    setgid_group         = setgidGroup;
+  }
+  // optionalAttrs config.networking.enableIPv6 { inet_protocols = "all"; }
+  // optionalAttrs (cfg.networks != null) { mynetworks = cfg.networks; }
+  // optionalAttrs (cfg.networksStyle != "") { mynetworks_style = cfg.networksStyle; }
+  // optionalAttrs (cfg.hostname != "") { myhostname = cfg.hostname; }
+  // optionalAttrs (cfg.domain != "") { mydomain = cfg.domain; }
+  // optionalAttrs (cfg.origin != "") { myorigin =  cfg.origin; }
+  // optionalAttrs (cfg.destination != null) { mydestination = cfg.destination; }
+  // optionalAttrs (cfg.relayDomains != null) { relay_domains = cfg.relayDomains; }
+  // optionalAttrs (cfg.recipientDelimiter != "") { recipient_delimiter = cfg.recipientDelimiter; }
+  // optionalAttrs haveAliases { alias_maps = "${cfg.aliasMapType}:/etc/postfix/aliases"; }
+  // optionalAttrs haveTransport { transport_maps = "hash:/etc/postfx/transport"; }
+  // optionalAttrs haveVirtual { virtual_alias_maps = "${cfg.virtualMapType}:/etc/postfix/virtual"; }
+  // optionalAttrs (cfg.dnsBlacklists != []) { smtpd_client_restrictions = clientRestrictions; }
+  // optionalAttrs cfg.enableHeaderChecks { header_checks = "regexp:/etc/postfix/header_checks"; }
+  // optionalAttrs (cfg.sslCert != "") {
+    smtp_tls_CAfile = cfg.sslCACert;
+    smtp_tls_cert_file = cfg.sslCert;
+    smtp_tls_key_file = cfg.sslKey;

-    ''
-    + optionalString config.networking.enableIPv6 ''
-      inet_protocols = all
-    ''
-    + (if cfg.networks != null then
-        ''
-          mynetworks = ${concatStringsSep ", " cfg.networks}
-        ''
-      else if cfg.networksStyle != "" then
-        ''
-          mynetworks_style = ${cfg.networksStyle}
-        ''
-      else
-        "")
-    + optionalString (cfg.hostname != "") ''
-      myhostname = ${cfg.hostname}
-    ''
-    + optionalString (cfg.domain != "") ''
-      mydomain = ${cfg.domain}
-    ''
-    + optionalString (cfg.origin != "") ''
-      myorigin = ${cfg.origin}
-    ''
-    + optionalString (cfg.destination != null) ''
-      mydestination = ${concatStringsSep ", " cfg.destination}
-    ''
-    + optionalString (cfg.relayDomains != null) ''
-      relay_domains = ${concatStringsSep ", " cfg.relayDomains}
-    ''
-    + ''
-      relayhost = ${if cfg.lookupMX || cfg.relayHost == "" then
-          cfg.relayHost
-        else
-          "[" + cfg.relayHost + "]"}
+    smtp_use_tls = true;

-      mail_spool_directory = /var/spool/mail/
+    smtpd_tls_CAfile = cfg.sslCACert;
+    smtpd_tls_cert_file = cfg.sslCert;
+    smtpd_tls_key_file = cfg.sslKey;

-      setgid_group = ${setgidGroup}
-    ''
-    + optionalString (cfg.sslCert != "") ''
+    smtpd_use_tls = true;
+  };

-      smtp_tls_CAfile = ${cfg.sslCACert}
-      smtp_tls_cert_file = ${cfg.sslCert}
-      smtp_tls_key_file = ${cfg.sslKey}
+  masterCfOptions = { options, config, name, ... }: {
+    options = {
+      name = mkOption {
+        type = types.str;
+        default = name;
+        example = "smtp";
+        description = ''
+          The name of the service to run. Defaults to the attribute set key.
+        '';
+      };

-      smtp_use_tls = yes
+      type = mkOption {
+        type = types.enum [ "inet" "unix" "fifo" "pass" ];
+        default = "unix";
+        example = "inet";
+        description = "The type of the service";
+      };

-      smtpd_tls_CAfile = ${cfg.sslCACert}
-      smtpd_tls_cert_file = ${cfg.sslCert}
-      smtpd_tls_key_file = ${cfg.sslKey}
+      private = mkOption {
+        type = types.bool;
+        example = false;
+        description = ''
+          Whether the service's sockets and storage directory is restricted to
+          be only available via the mail system. If <literal>null</literal> is
+          given it uses the postfix default <literal>true</literal>.
+        '';
+      };

-      smtpd_use_tls = yes
-    ''
-    + optionalString (cfg.recipientDelimiter != "") ''
-      recipient_delimiter = ${cfg.recipientDelimiter}
-    ''
-    + optionalString haveAliases ''
-      alias_maps = hash:/etc/postfix/aliases
-    ''
-    + optionalString haveTransport ''
-      transport_maps = hash:/etc/postfix/transport
-    ''
-    + optionalString haveVirtual ''
-      virtual_alias_maps = hash:/etc/postfix/virtual
-    ''
-    + optionalString (cfg.dnsBlacklists != []) ''
-      smtpd_client_restrictions = ${clientRestrictions}
-    ''
-    + cfg.extraConfig;
+      privileged = mkOption {
+        type = types.bool;
+        example = true;
+        description = "";
+      };

-  masterCf = ''
-    # ==========================================================================
-    # service type  private unpriv  chroot  wakeup  maxproc command + args
-    #               (yes)   (yes)   (no)    (never) (100)
-    # ==========================================================================
-    smtp      inet  n       -       n       -       -       smtpd
-  '' + optionalString cfg.enableSubmission ''
-    submission inet n       -       n       -       -       smtpd
-      ${concatStringsSep "\n  " (mapAttrsToList (x: y: "-o " + x + "=" + y) cfg.submissionOptions)}
-  ''
-  + ''
-    pickup    unix  n       -       n       60      1       pickup
-    cleanup   unix  n       -       n       -       0       cleanup
-    qmgr      unix  n       -       n       300     1       qmgr
-    tlsmgr    unix  -       -       n       1000?   1       tlsmgr
-    rewrite   unix  -       -       n       -       -       trivial-rewrite
-    bounce    unix  -       -       n       -       0       bounce
-    defer     unix  -       -       n       -       0       bounce
-    trace     unix  -       -       n       -       0       bounce
-    verify    unix  -       -       n       -       1       verify
-    flush     unix  n       -       n       1000?   0       flush
-    proxymap  unix  -       -       n       -       -       proxymap
-    proxywrite unix -       -       n       -       1       proxymap
-  ''
-  + optionalString cfg.enableSmtp ''
-    smtp      unix  -       -       n       -       -       smtp
-    relay     unix  -       -       n       -       -       smtp
-    	      -o smtp_fallback_relay=
-    #       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
-  ''
-  + ''
-    showq     unix  n       -       n       -       -       showq
-    error     unix  -       -       n       -       -       error
-    retry     unix  -       -       n       -       -       error
-    discard   unix  -       -       n       -       -       discard
-    local     unix  -       n       n       -       -       local
-    virtual   unix  -       n       n       -       -       virtual
-    lmtp      unix  -       -       n       -       -       lmtp
-    anvil     unix  -       -       n       -       1       anvil
-    scache    unix  -       -       n       -       1       scache
-    ${cfg.extraMasterConf}
-  '';
+      chroot = mkOption {
+        type = types.bool;
+        example = true;
+        description = ''
+          Whether the service is chrooted to have only access to the
+          <option>services.postfix.queueDir</option> and the closure of
+          store paths specified by the <option>program</option> option.
+        '';
+      };

-  aliases =
+      wakeup = mkOption {
+        type = types.int;
+        example = 60;
+        description = ''
+          Automatically wake up the service after the specified number of
+          seconds. If <literal>0</literal> is given, never wake the service
+          up.
+        '';
+      };
+
+      wakeupUnusedComponent = mkOption {
+        type = types.bool;
+        example = false;
+        description = ''
+          If set to <literal>false</literal> the component will only be woken
+          up if it is used. This is equivalent to postfix' notion of adding a
+          question mark behind the wakeup time in
+          <filename>master.cf</filename>
+        '';
+      };
+
+      maxproc = mkOption {
+        type = types.int;
+        example = 1;
+        description = ''
+          The maximum number of processes to spawn for this service. If the
+          value is <literal>0</literal> it doesn't have any limit. If
+          <literal>null</literal> is given it uses the postfix default of
+          <literal>100</literal>.
+        '';
+      };
+
+      command = mkOption {
+        type = types.str;
+        default = name;
+        example = "smtpd";
+        description = ''
+          A program name specifying a Postfix service/daemon process.
+          By default it's the attribute <option>name</option>.
+        '';
+      };
+
+      args = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        example = [ "-o" "smtp_helo_timeout=5" ];
+        description = ''
+          Arguments to pass to the <option>command</option>. There is no shell
+          processing involved and shell syntax is passed verbatim to the
+          process.
+        '';
+      };
+
+      rawEntry = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        internal = true;
+        description = ''
+          The raw configuration line for the <filename>master.cf</filename>.
+        '';
+      };
+    };
+
+    config.rawEntry = let
+      mkBool = bool: if bool then "y" else "n";
+      mkArg = arg: "${optionalString (hasPrefix "-" arg) "\n  "}${arg}";
+
+      maybeOption = fun: option:
+        if options.${option}.isDefined then fun config.${option} else "-";
+
+      # This is special, because we have two options for this value.
+      wakeup = let
+        wakeupDefined = options.wakeup.isDefined;
+        wakeupUCDefined = options.wakeupUnusedComponent.isDefined;
+        finalValue = toString config.wakeup
+                   + optionalString (!config.wakeupUnusedComponent) "?";
+      in if wakeupDefined && wakeupUCDefined then finalValue else "-";
+
+    in [
+      config.name
+      config.type
+      (maybeOption mkBool "private")
+      (maybeOption (b: mkBool (!b)) "privileged")
+      (maybeOption mkBool "chroot")
+      wakeup
+      (maybeOption toString "maxproc")
+      (config.command + " " + concatMapStringsSep " " mkArg config.args)
+    ];
+  };
+
+  masterCfContent = let
+
+    labels = [
+      "# service" "type" "private" "unpriv" "chroot" "wakeup" "maxproc"
+      "command + args"
+    ];
+
+    labelDefaults = [
+      "# " "" "(yes)" "(yes)" "(no)" "(never)" "(100)" "" ""
+    ];
+
+    masterCf = mapAttrsToList (const (getAttr "rawEntry")) cfg.masterConfig;
+
+    # A list of the maximum width of the columns across all lines and labels
+    maxWidths = let
+      foldLine = line: acc: let
+        columnLengths = map stringLength line;
+      in zipListsWith max acc columnLengths;
+      # We need to handle the last column specially here, because it's
+      # open-ended (command + args).
+      lines = [ labels labelDefaults ] ++ (map (l: init l ++ [""]) masterCf);
+    in fold foldLine (genList (const 0) (length labels)) lines;
+
+    # Pad a string with spaces from the right (opposite of fixedWidthString).
+    pad = width: str: let
+      padWidth = width - stringLength str;
+      padding = concatStrings (genList (const " ") padWidth);
+    in str + optionalString (padWidth > 0) padding;
+
+    # It's + 2 here, because that's the amount of spacing between columns.
+    fullWidth = fold (width: acc: acc + width + 2) 0 maxWidths;
+
+    formatLine = line: concatStringsSep "  " (zipListsWith pad maxWidths line);
+
+    formattedLabels = let
+      sep = "# " + concatStrings (genList (const "=") (fullWidth + 5));
+      lines = [ sep (formatLine labels) (formatLine labelDefaults) sep ];
+    in concatStringsSep "\n" lines;
+
+  in formattedLabels + "\n" + concatMapStringsSep "\n" formatLine masterCf + "\n";
+
+  headerCheckOptions = { ... }:
+  {
+    options = {
+      pattern = mkOption {
+        type = types.str;
+        default = "/^.*/";
+        example = "/^X-Mailer:/";
+        description = "A regexp pattern matching the header";
+      };
+      action = mkOption {
+        type = types.str;
+        default = "DUNNO";
+        example = "BCC mail@example.com";
+        description = "The action to be executed when the pattern is matched";
+      };
+    };
+  };
+
+  headerChecks = concatStringsSep "\n" (map (x: "${x.pattern} ${x.action}") cfg.headerChecks) + cfg.extraHeaderChecks;
+
+  aliases = let seperator = if cfg.aliasMapType == "hash" then ":" else ""; in
    optionalString (cfg.postmasterAlias != "") ''
-      postmaster: ${cfg.postmasterAlias}
+      postmaster${seperator} ${cfg.postmasterAlias}
    ''
    + optionalString (cfg.rootAlias != "") ''
-      root: ${cfg.rootAlias}
+      root${seperator} ${cfg.rootAlias}
    ''
    + cfg.extraAliases
  ;
@ -176,8 +303,9 @@ let
  virtualFile = pkgs.writeText "postfix-virtual" cfg.virtual;
  checkClientAccessFile = pkgs.writeText "postfix-check-client-access" cfg.dnsBlacklistOverrides;
  mainCfFile = pkgs.writeText "postfix-main.cf" mainCf;
-  masterCfFile = pkgs.writeText "postfix-master.cf" masterCf;
+  masterCfFile = pkgs.writeText "postfix-master.cf" masterCfContent;
  transportFile = pkgs.writeText "postfix-transport" cfg.transport;
+  headerChecksFile = pkgs.writeText "postfix-header-checks" headerChecks;

 in

@ -199,27 +327,29 @@ in
        default = true;
        description = "Whether to enable smtp in master.cf.";
      };
-      
+
      enableSubmission = mkOption {
        type = types.bool;
        default = false;
-        description = "Whether to enable smtp submission";
+        description = "Whether to enable smtp submission.";
      };

      submissionOptions = mkOption {
        type = types.attrs;
-        default = { "smtpd_tls_security_level" = "encrypt";
-                    "smtpd_sasl_auth_enable" = "yes";
-                    "smtpd_client_restrictions" = "permit_sasl_authenticated,reject";
-                    "milter_macro_daemon_name" = "ORIGINATING";
-                  };
+        default = {
+          smtpd_tls_security_level = "encrypt";
+          smtpd_sasl_auth_enable = "yes";
+          smtpd_client_restrictions = "permit_sasl_authenticated,reject";
+          milter_macro_daemon_name = "ORIGINATING";
+        };
+        example = {
+          smtpd_tls_security_level = "encrypt";
+          smtpd_sasl_auth_enable = "yes";
+          smtpd_sasl_type = "dovecot";
+          smtpd_client_restrictions = "permit_sasl_authenticated,reject";
+          milter_macro_daemon_name = "ORIGINATING";
+        };
        description = "Options for the submission config in master.cf";
-        example = { "smtpd_tls_security_level" = "encrypt";
-                    "smtpd_sasl_auth_enable" = "yes";
-                    "smtpd_sasl_type" = "dovecot";
-                    "smtpd_client_restrictions" = "permit_sasl_authenticated,reject";
-                    "milter_macro_daemon_name" = "ORIGINATING";
-                  };
      };

      setSendmail = mkOption {
@ -352,6 +482,25 @@ in
        ";
      };

+      aliasMapType = mkOption {
+        type = with types; enum [ "hash" "regexp" "pcre" ];
+        default = "hash";
+        example = "regexp";
+        description = "The format the alias map should have. Use regexp if you want to use regular expressions.";
+      };
+
+      config = mkOption {
+        type = with types; attrsOf (either bool (either str (listOf str)));
+        default = defaultConf;
+        description = ''
+          The main.cf configuration file as key value set.
+        '';
+        example = {
+          mail_owner = "postfix";
+          smtp_use_tls = true;
+        };
+      };
+
      extraConfig = mkOption {
        type = types.lines;
        default = "";
@ -395,6 +544,14 @@ in
        ";
      };

+      virtualMapType = mkOption {
+        type = types.enum ["hash" "regexp" "pcre"];
+        default = "hash";
+        description = ''
+          What type of virtual alias map file to use. Use <literal>"regexp"</literal> for regular expressions.
+        '';
+      };
+
      transport = mkOption {
        default = "";
        description = "
@ -413,6 +570,22 @@ in
        description = "contents of check_client_access for overriding dnsBlacklists";
      };

+      masterConfig = mkOption {
+        type = types.attrsOf (types.submodule masterCfOptions);
+        default = {};
+        example =
+          { submission = {
+              type = "inet";
+              args = [ "-o" "smtpd_tls_security_level=encrypt" ];
+            };
+          };
+        description = ''
+          An attribute set of service options, which correspond to the service
+          definitions usually done within the Postfix
+          <filename>master.cf</filename> file.
+        '';
+      };
+
      extraMasterConf = mkOption {
        type = types.lines;
        default = "";
@ -420,6 +593,27 @@ in
        description = "Extra lines to append to the generated master.cf file.";
      };

+      enableHeaderChecks = mkOption {
+        type = types.bool;
+        default = false;
+        example = true;
+        description = "Whether to enable postfix header checks";
+      };
+
+      headerChecks = mkOption {
+        type = types.listOf (types.submodule headerCheckOptions);
+        default = [];
+        example = [ { pattern = "/^X-Spam-Flag:/"; action = "REDIRECT spam@example.com"; } ];
+        description = "Postfix header checks.";
+      };
+
+      extraHeaderChecks = mkOption {
+        type = types.lines;
+        default = "";
+        example = "/^X-Spam-Flag:/ REDIRECT spam@example.com";
+        description = "Extra lines to /etc/postfix/header_checks file.";
+      };
+
      aliasFiles = mkOption {
        type = types.attrsOf types.path;
        default = {};
@ -530,6 +724,101 @@ in
            ${pkgs.postfix}/bin/postfix set-permissions config_directory=/var/lib/postfix/conf
          '';
        };
+
+      services.postfix.masterConfig = {
+        smtp_inet = {
+          name = "smtp";
+          type = "inet";
+          private = false;
+          command = "smtpd";
+        };
+        pickup = {
+          private = false;
+          wakeup = 60;
+          maxproc = 1;
+        };
+        cleanup = {
+          private = false;
+          maxproc = 0;
+        };
+        qmgr = {
+          private = false;
+          wakeup = 300;
+          maxproc = 1;
+        };
+        tlsmgr = {
+          wakeup = 1000;
+          wakeupUnusedComponent = false;
+          maxproc = 1;
+        };
+        rewrite = {
+          command = "trivial-rewrite";
+        };
+        bounce = {
+          maxproc = 0;
+        };
+        defer = {
+          maxproc = 0;
+          command = "bounce";
+        };
+        trace = {
+          maxproc = 0;
+          command = "bounce";
+        };
+        verify = {
+          maxproc = 1;
+        };
+        flush = {
+          private = false;
+          wakeup = 1000;
+          wakeupUnusedComponent = false;
+          maxproc = 0;
+        };
+        proxymap = {
+          command = "proxymap";
+        };
+        proxywrite = {
+          maxproc = 1;
+          command = "proxymap";
+        };
+        showq = {
+          private = false;
+        };
+        error = {};
+        retry = {
+          command = "error";
+        };
+        discard = {};
+        local = {
+          privileged = true;
+        };
+        virtual = {
+          privileged = true;
+        };
+        lmtp = {
+        };
+        anvil = {
+          maxproc = 1;
+        };
+        scache = {
+          maxproc = 1;
+        };
+      } // optionalAttrs cfg.enableSubmission {
+        submission = {
+          type = "inet";
+          private = false;
+          command = "smtpd";
+          args = let
+            mkKeyVal = opt: val: [ "-o" (opt + "=" + val) ];
+          in concatLists (mapAttrsToList mkKeyVal cfg.submissionOptions);
+        };
+      } // optionalAttrs cfg.enableSmtp {
+        smtp = {};
+        relay = {
+          command = "smtp";
+          args = [ "-o" "smtp_fallback_relay=" ];
+        };
+      };
    }

    (mkIf haveAliases {
@ -541,9 +830,14 @@ in
    (mkIf haveVirtual {
      services.postfix.mapFiles."virtual" = virtualFile;
    })
+    (mkIf cfg.enableHeaderChecks {
+      services.postfix.mapFiles."header_checks" = headerChecksFile;
+    })
    (mkIf (cfg.dnsBlacklists != []) {
      services.postfix.mapFiles."client_access" = checkClientAccessFile;
    })
+    (mkIf (cfg.extraConfig != "") {
+      warnings = [ "The services.postfix.extraConfig option was deprecated. Please use services.postfix.config instead." ];
+    })
  ]);
-
 }
--- a/nixos/modules/services/misc/spice-vdagentd.nix
+++ b/nixos/modules/services/misc/spice-vdagentd.nix
@ -23,7 +23,7 @@ in
      '';
      serviceConfig = {
        Type = "forking";
-        ExecStart = "/bin/sh -c '${pkgs.spice-vdagent}/bin/spice-vdagentd'";
+        ExecStart = "${pkgs.spice-vdagent}/bin/spice-vdagentd";
      };
    };
  };
--- a/nixos/modules/services/security/vault.nix
+++ b/nixos/modules/services/security/vault.nix
@ -0,0 +1,143 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+  cfg = config.services.vault;
+
+  configFile = pkgs.writeText "vault.hcl" ''
+    listener "tcp" {
+      address = "${cfg.address}"
+      ${if (cfg.tlsCertFile == null || cfg.tlsKeyFile == null) then ''
+          tls_disable = "true"
+        '' else ''
+          tls_cert_file = "${cfg.tlsCertFile}"
+          tls_key_file = "${cfg.tlsKeyFile}"
+        ''}
+      ${cfg.listenerExtraConfig}
+    }
+    storage "${cfg.storageBackend}" {
+      ${optionalString (cfg.storagePath   != null) ''path = "${cfg.storagePath}"''}
+      ${optionalString (cfg.storageConfig != null) cfg.storageConfig}
+    }
+    ${optionalString (cfg.telemetryConfig != "") ''
+        telemetry {
+          ${cfg.telemetryConfig}
+        }
+      ''}
+  '';
+in
+{
+  options = {
+
+    services.vault = {
+
+      enable = mkEnableOption "Vault daemon";
+
+      address = mkOption {
+        type = types.str;
+        default = "127.0.0.1:8200";
+        description = "The name of the ip interface to listen to";
+      };
+
+      tlsCertFile = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        example = "/path/to/your/cert.pem";
+        description = "TLS certificate file. TLS will be disabled unless this option is set";
+      };
+
+      tlsKeyFile = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        example = "/path/to/your/key.pem";
+        description = "TLS private key file. TLS will be disabled unless this option is set";
+      };
+
+      listenerExtraConfig = mkOption {
+        type = types.lines;
+        default = ''
+          tls_min_version = "tls12"
+        '';
+        description = "extra configuration";
+      };
+
+      storageBackend = mkOption {
+        type = types.enum [ "inmem" "file" "consul" "zookeeper" "s3" "azure" "dynamodb" "etcd" "mssql" "mysql" "postgresql" "swift" "gcs" ];
+        default = "inmem";
+        description = "The name of the type of storage backend";
+      };
+
+      storagePath = mkOption {
+        type = types.nullOr types.path;
+        default = if cfg.storageBackend == "file" then "/var/lib/vault" else null;
+        description = "Data directory for file backend";
+      };
+
+      storageConfig = mkOption {
+        type = types.nullOr types.lines;
+        default = null;
+        description = "Storage configuration";
+      };
+
+      telemetryConfig = mkOption {
+        type = types.lines;
+        default = "";
+        description = "Telemetry configuration";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      { assertion = cfg.storageBackend == "inmem" -> (cfg.storagePath == null && cfg.storageConfig == null);
+        message = ''The "inmem" storage expects no services.vault.storagePath nor services.vault.storageConfig'';
+      }
+      { assertion = (cfg.storageBackend == "file" -> (cfg.storagePath != null && cfg.storageConfig == null)) && (cfg.storagePath != null -> cfg.storageBackend == "file");
+        message = ''You must set services.vault.storagePath only when using the "file" backend'';
+      }
+    ];
+
+    users.extraUsers.vault = {
+      name = "vault";
+      group = "vault";
+      uid = config.ids.uids.vault;
+      description = "Vault daemon user";
+    };
+    users.extraGroups.vault.gid = config.ids.gids.vault;
+
+    systemd.services.vault = {
+      description = "Vault server daemon";
+
+      wantedBy = ["multi-user.target"];
+      after = [ "network.target" ]
+           ++ optional (config.services.consul.enable && cfg.storageBackend == "consul") "consul.service";
+
+      restartIfChanged = false; # do not restart on "nixos-rebuild switch". It would seal the storage and disrupt the clients.
+
+      preStart = optionalString (cfg.storagePath != null) ''
+        install -d -m0700 -o vault -g vault "${cfg.storagePath}"
+      '';
+
+      serviceConfig = {
+        User = "vault";
+        Group = "vault";
+        PermissionsStartOnly = true;
+        ExecStart = "${pkgs.vault}/bin/vault server -config ${configFile}";
+        PrivateDevices = true;
+        PrivateTmp = true;
+        ProtectSystem = "full";
+        ProtectHome = "read-only";
+        AmbientCapabilities = "cap_ipc_lock";
+        NoNewPrivileges = true;
+        KillSignal = "SIGINT";
+        TimeoutStopSec = "30s";
+        Restart = "on-failure";
+        StartLimitInterval = "60s";
+        StartLimitBurst = 3;
+      };
+
+      unitConfig.RequiresMountsFor = optional (cfg.storagePath != null) cfg.storagePath;
+    };
+  };
+
+}
--- a/nixos/modules/services/web-servers/lighttpd/default.nix
+++ b/nixos/modules/services/web-servers/lighttpd/default.nix
@ -177,7 +177,7 @@ in
      configText = mkOption {
        default = "";
        type = types.lines;
-	example = ''...verbatim config file contents...'';
+        example = ''...verbatim config file contents...'';
        description = ''
          Overridable config file contents to use for lighttpd. By default, use
          the contents automatically generated by NixOS.
--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@ -94,7 +94,7 @@ let
  checkNetwork = checkUnitConfig "Network" [
    (assertOnlyFields [
      "Description" "DHCP" "DHCPServer" "IPForward" "IPMasquerade" "IPv4LL" "IPv4LLRoute"
-      "LLMNR" "Domains" "Bridge" "Bond"
+      "LLMNR" "MulticastDNS" "Domains" "Bridge" "Bond"
    ])
    (assertValueOneOf "DHCP" ["both" "none" "v4" "v6"])
    (assertValueOneOf "DHCPServer" boolValues)
@ -103,6 +103,7 @@ let
    (assertValueOneOf "IPv4LL" boolValues)
    (assertValueOneOf "IPv4LLRoute" boolValues)
    (assertValueOneOf "LLMNR" boolValues)
+    (assertValueOneOf "MulticastDNS" boolValues)
  ];

  checkAddress = checkUnitConfig "Address" [
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@ -659,16 +659,22 @@ in
        }));
    };

+    systemd.user.paths = mkOption {
+      default = {};
+      type = with types; attrsOf (submodule [ { options = pathOptions; } unitConfig ]);
+      description = "Definition of systemd per-user path units.";
+    };
+
    systemd.user.services = mkOption {
      default = {};
      type = with types; attrsOf (submodule [ { options = serviceOptions; } unitConfig serviceConfig ] );
      description = "Definition of systemd per-user service units.";
    };

-    systemd.user.timers = mkOption {
+    systemd.user.slices = mkOption {
      default = {};
-      type = with types; attrsOf (submodule [ { options = timerOptions; } unitConfig ] );
-      description = "Definition of systemd per-user timer units.";
+      type = with types; attrsOf (submodule [ { options = sliceOptions; } unitConfig ] );
+      description = "Definition of systemd per-user slice units.";
    };

    systemd.user.sockets = mkOption {
@ -683,6 +689,12 @@ in
      description = "Definition of systemd per-user target units.";
    };

+    systemd.user.timers = mkOption {
+      default = {};
+      type = with types; attrsOf (submodule [ { options = timerOptions; } unitConfig ] );
+      description = "Definition of systemd per-user timer units.";
+    };
+
    systemd.additionalUpstreamSystemUnits = mkOption {
      default = [ ];
      type = types.listOf types.str;
@ -799,12 +811,12 @@ in
      };

    systemd.units =
-      mapAttrs' (n: v: nameValuePair "${n}.target" (targetToUnit n v)) cfg.targets
+         mapAttrs' (n: v: nameValuePair "${n}.path"    (pathToUnit    n v)) cfg.paths
      // mapAttrs' (n: v: nameValuePair "${n}.service" (serviceToUnit n v)) cfg.services
-      // mapAttrs' (n: v: nameValuePair "${n}.socket" (socketToUnit n v)) cfg.sockets
-      // mapAttrs' (n: v: nameValuePair "${n}.timer" (timerToUnit n v)) cfg.timers
-      // mapAttrs' (n: v: nameValuePair "${n}.path" (pathToUnit n v)) cfg.paths
-      // mapAttrs' (n: v: nameValuePair "${n}.slice" (sliceToUnit n v)) cfg.slices
+      // mapAttrs' (n: v: nameValuePair "${n}.slice"   (sliceToUnit   n v)) cfg.slices
+      // mapAttrs' (n: v: nameValuePair "${n}.socket"  (socketToUnit  n v)) cfg.sockets
+      // mapAttrs' (n: v: nameValuePair "${n}.target"  (targetToUnit  n v)) cfg.targets
+      // mapAttrs' (n: v: nameValuePair "${n}.timer"   (timerToUnit   n v)) cfg.timers
      // listToAttrs (map
                   (v: let n = escapeSystemdPath v.where;
                       in nameValuePair "${n}.mount" (mountToUnit n v)) cfg.mounts)
@ -813,7 +825,9 @@ in
                       in nameValuePair "${n}.automount" (automountToUnit n v)) cfg.automounts);

    systemd.user.units =
-         mapAttrs' (n: v: nameValuePair "${n}.service" (serviceToUnit n v)) cfg.user.services
+         mapAttrs' (n: v: nameValuePair "${n}.path"    (pathToUnit    n v)) cfg.user.paths
+      // mapAttrs' (n: v: nameValuePair "${n}.service" (serviceToUnit n v)) cfg.user.services
+      // mapAttrs' (n: v: nameValuePair "${n}.slice"   (sliceToUnit   n v)) cfg.user.slices
      // mapAttrs' (n: v: nameValuePair "${n}.socket"  (socketToUnit  n v)) cfg.user.sockets
      // mapAttrs' (n: v: nameValuePair "${n}.target"  (targetToUnit  n v)) cfg.user.targets
      // mapAttrs' (n: v: nameValuePair "${n}.timer"   (timerToUnit   n v)) cfg.user.timers;
--- a/nixos/modules/virtualisation/libvirtd.nix
+++ b/nixos/modules/virtualisation/libvirtd.nix
@ -162,11 +162,14 @@ in {
        for file in /var/lib/libvirt/qemu/*.xml /var/lib/libvirt/lxc/*.xml; do
            test -f "$file" || continue
            # get (old) emulator path from config file
-            emulator=$(grep "^[[:space:]]*<emulator>" "$file" | sed 's,^[[:space:]]*<emulator>\(.*\)</emulator>.*,\1,')
+            emulator=$("${pkgs.xmlstarlet}/bin/xmlstarlet" select --template --value-of "/domain/devices/emulator" "$file")
            # get a (definitely) working emulator path by re-scanning $PATH
            new_emulator=$(PATH=${pkgs.libvirt}/libexec:$PATH command -v $(basename "$emulator"))
            # write back
-            sed -i "s,^[[:space:]]*<emulator>.*,    <emulator>$new_emulator</emulator> <!-- WARNING: emulator dirname is auto-updated by the nixos libvirtd module -->," "$file"
+            "${pkgs.xmlstarlet}/bin/xmlstarlet" edit --inplace --update "/domain/devices/emulator" -v "$new_emulator" "$file"
+
+            # Also refresh the OVMF path. Files with no matches are ignored.
+            "${pkgs.xmlstarlet}/bin/xmlstarlet" edit --inplace --update "/domain/os/loader" -v "${pkgs.OVMF.fd}/FV/OVMF_CODE.fd" "$file"
        done
      ''; # */

--- a/pkgs/applications/altcoins/default.nix
+++ b/pkgs/applications/altcoins/default.nix
@ -39,6 +39,8 @@ rec {
  ethrun = callPackage ./ethrun.nix { };
  seth = callPackage ./seth.nix { };

+  hsevm = (pkgs.haskellPackages.callPackage ./hsevm.nix {});
+
  primecoin  = callPackage ./primecoin.nix { withGui = true; };
  primecoind = callPackage ./primecoin.nix { withGui = false; };

--- a/pkgs/applications/altcoins/hsevm.nix
+++ b/pkgs/applications/altcoins/hsevm.nix
@ -0,0 +1,53 @@
+{ aeson, ansi-wl-pprint, base, base16-bytestring
+, base64-bytestring, binary, brick, bytestring, containers
+, cryptonite, data-dword, deepseq, directory, filepath, ghci-pretty
+, here, HUnit, lens, lens-aeson, memory, mtl, optparse-generic
+, process, QuickCheck, quickcheck-text, readline, rosezipper
+, stdenv, tasty, tasty-hunit, tasty-quickcheck, temporary, text
+, text-format, unordered-containers, vector, vty
+, mkDerivation, fetchFromGitHub, lib
+, ncurses, zlib, bzip2, solc
+}:
+
+lib.overrideDerivation (mkDerivation rec {
+  pname = "hsevm";
+  version = "0.3.2";
+
+  src = fetchFromGitHub {
+    owner = "dapphub";
+    repo = "hsevm";
+    rev = "v${version}";
+    sha256 = "1c6zpphs03yfvyfbv1cjf04qh5q2miq7rpd7kx2cil77msi8hxw4";
+  };
+
+  isLibrary = false;
+  isExecutable = true;
+  enableSharedExecutables = false;
+
+  postInstall = ''
+    rm -rf $out/{lib,share}
+  '';
+
+  extraLibraries = [
+    aeson ansi-wl-pprint base base16-bytestring base64-bytestring
+    binary brick bytestring containers cryptonite data-dword deepseq
+    directory filepath ghci-pretty lens lens-aeson memory mtl
+    optparse-generic process QuickCheck quickcheck-text readline
+    rosezipper temporary text text-format unordered-containers vector
+    vty
+  ];
+  executableHaskellDepends = [
+    readline zlib bzip2
+  ];
+  testHaskellDepends = [
+    base binary bytestring ghci-pretty here HUnit lens mtl QuickCheck
+    tasty tasty-hunit tasty-quickcheck text vector
+  ];
+
+  homepage = "https://github.com/dapphub/hsevm";
+  description = "Ethereum virtual machine evaluator";
+  license = stdenv.lib.licenses.agpl3;
+  maintainers = [stdenv.lib.maintainers.dbrock];
+}) (attrs: {
+  buildInputs = attrs.buildInputs ++ [solc];
+})
--- a/pkgs/applications/audio/helm/default.nix
+++ b/pkgs/applications/audio/helm/default.nix
@ -1,21 +1,21 @@
-  { stdenv, fetchFromGitHub , xorg, freetype, alsaLib, libjack2
+  { stdenv, fetchFromGitHub , xorg, freetype, alsaLib, curl, libjack2
  , lv2, pkgconfig, mesa }:

  stdenv.mkDerivation rec {
-  version = "0.8.6";
+  version = "0.9.0";
  name = "helm-${version}";

  src = fetchFromGitHub {
    owner = "mtytel";
    repo = "helm";
-    rev = "19f86e6b4db83c1c6b143fc27883592ac4e43489";
-    sha256 = "0a46wnbfqkns8l136v79rr9gv4hhba065igjwkjddf045c9l94l8";
+    rev = "927d2ed27f71a735c3ff2a1226ce3129d1544e7e";
+    sha256 = "17ys2vvhncx9i3ydg3xwgz1d3gqv4yr5mqi7vr0i0ca6nad6x3d4";
  };

  buildInputs = [
    xorg.libX11 xorg.libXcomposite xorg.libXcursor xorg.libXext
    xorg.libXinerama xorg.libXrender xorg.libXrandr
-    freetype alsaLib libjack2 pkgconfig mesa lv2
+    freetype alsaLib curl libjack2 pkgconfig mesa lv2
  ];

  CXXFLAGS = "-DHAVE_LROUND";
@ -26,6 +26,7 @@

  buildPhase = ''
    make lv2
+    make standalone
  '';

  installPhase = ''
--- a/pkgs/applications/audio/nova-filters/default.nix
+++ b/pkgs/applications/audio/nova-filters/default.nix
@ -16,6 +16,7 @@ stdenv.mkDerivation rec {
    sed -i -e '4d' SConstruct
    sed -i "s@mfpmath=sse@mfpmath=sse -I ${boost.dev}/include@g" SConstruct
    sed -i "s@ladspa.h@${ladspaH}/include/ladspa.h@g" filters.cpp
+    sed -i "s@LADSPA_HINT_SAMPLE_RATE, 0, 0.5@LADSPA_HINT_SAMPLE_RATE, 0.0001, 0.5@g" filters.cpp
    sed -i "s/= check/= detail::filter_base<internal_type, checked>::check/" nova/source/dsp/filter.hpp
  '';

@ -27,10 +28,11 @@ stdenv.mkDerivation rec {
    scons $sconsFlags "prefix=$out" install
  '';

-  meta = {
-    homepage = http://klingt.org/~tim/nova-filters/;
+  meta = with stdenv.lib; {
    description = "LADSPA plugins based on filters of nova";
-    license = stdenv.lib.licenses.gpl2Plus;
-    platforms = stdenv.lib.platforms.linux;
+    homepage = http://klingt.org/~tim/nova-filters/;
+    license = licenses.gpl2Plus;
+    maintainers = [ maintainers.magnetophon ];
+    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/editors/scite/default.nix
+++ b/pkgs/applications/editors/scite/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "scite-${version}";
-  version = "3.7.3";
+  version = "3.7.5";

  src = fetchurl {
-    url = "mirror://sourceforge/project/scintilla/SciTE/${version}/scite373.tgz";
-    sha256 = "05d81h1fqhjlw9apvrni3x2q4a562cd5ra1071qpna8h4ml0an9m";
+    url = http://www.scintilla.org/scite375.tgz;
+    sha256 = "11pg9bifyyqpblqsrl1b9f8shb3fa6fgzclvjba6hwh7hh98drji";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/applications/editors/vscode/default.nix
+++ b/pkgs/applications/editors/vscode/default.nix
@ -2,7 +2,7 @@
  makeWrapper, libXScrnSaver, libxkbfile }:

 let
-  version = "1.13.0";
+  version = "1.14.0";
  channel = "stable";

  plat = {
@ -12,9 +12,9 @@ let
  }.${stdenv.system};

  sha256 = {
-    "i686-linux" = "069pv0w8yhsv50glpcxzypsjc7mxmrcrv25c75rnv43yiyamjvyi";
-    "x86_64-linux" = "0cjkkvd5rs82yji0kpnbvzgwz5qvh9x6bmjd51rrvjz84dbwhgzq";
-    "x86_64-darwin" = "1qbxv5drqrx9k835a6zj3kkbh4sga5r9y0gf9bq16g3gf0dd9bwq";
+    "i686-linux" = "04xv9fr11j7k0yfb7aa2sdmq74hh43aarlvx8nxppzbn2k18dgb3";
+    "x86_64-linux" = "1m252cpj4pck40rxnrbp1wapn5d4grn15x7d3s059xb965kga4k7";
+    "x86_64-darwin" = "1hwjdrnrhvrmwbq935k4scgw68x817ms89gy471afbhpl65xmp8n";
  }.${stdenv.system};

  archive_fmt = if stdenv.system == "x86_64-darwin" then "zip" else "tar.gz";
--- a/pkgs/applications/misc/houdini/default.nix
+++ b/pkgs/applications/misc/houdini/default.nix
@ -0,0 +1,15 @@
+{ zsh, stdenv, callPackage, buildFHSUserEnv, undaemonize }:
+
+let
+  version = "16.0.633";
+  houdini-runtime = callPackage ./runtime.nix { };
+in buildFHSUserEnv rec {
+  name = "houdini-${version}";
+
+  extraBuildCommands = ''
+    mkdir -p $out/usr/lib/sesi
+  '';
+
+  runScript = "${undaemonize}/bin/undaemonize ${houdini-runtime}/bin/houdini";
+}
+
--- a/pkgs/applications/misc/houdini/runtime.nix
+++ b/pkgs/applications/misc/houdini/runtime.nix
@ -0,0 +1,76 @@
+{ stdenv, requireFile, zlib, libpng, libSM, libICE, fontconfig, xorg, mesa_glu, bc }:
+
+let
+  ld_library_path = builtins.concatStringsSep ":" [
+    "${stdenv.cc.cc.lib}/lib64"
+    "/run/opengl-driver/lib"
+    (stdenv.lib.makeLibraryPath [
+      mesa_glu
+      xorg.libXmu
+      xorg.libXi
+      xorg.libXext
+      xorg.libX11
+      xorg.libXrender
+      fontconfig
+      libSM
+      libICE
+      zlib
+      libpng
+    ])
+  ];
+  license_dir = "~/.config/houdini";
+in
+stdenv.mkDerivation rec {
+  version = "16.0.633";
+  name = "houdini-runtime-${version}";
+  src = requireFile rec {
+    name = "houdini-16.0.633-linux_x86_64_gcc4.8.tar.gz";
+    sha256 = "1laxncwgsr4hj53bn4pn9ibv3pkrpliwxlx0558wgnhq42js3wvl";
+    message = ''
+      This nix expression requires that ${name} is already part of the store.
+      Download it from https://sidefx.com and add it to the nix store with:
+        
+          nix-prefetch-url <URL>
+
+      This can't be done automatically because you need to create an account on
+      their website and agree to their license terms before you can download
+      it. That's what you get for using proprietary software.
+    '';
+  };
+
+  buildInputs = [ bc ];
+  installPhase = ''
+    patchShebangs houdini.install
+    mkdir -p $out
+    sed -i "s|/usr/lib/sesi|${license_dir}|g" houdini.install
+    ./houdini.install --install-houdini \
+                      --no-install-menus \
+                      --no-install-bin-symlink \
+                      --auto-install \
+                      --no-root-check \
+                      --accept-EULA \
+                      $out
+    sed -i "s|/usr/lib/sesi|${license_dir}|g" $out/houdini/Licensing.opt
+    sed -i "s|/usr/lib/sesi|${license_dir}|g" $out/houdini/sbin/sesinetd_safe
+    sed -i "s|/usr/lib/sesi|${license_dir}|g" $out/houdini/sbin/sesinetd.startup
+    echo "export LD_LIBRARY_PATH=${ld_library_path}" >> $out/bin/app_init.sh
+    echo "export LD_LIBRARY_PATH=${ld_library_path}" >> $out/houdini/sbin/app_init.sh
+  '';
+  postFixup = ''
+    INTERPRETER="$(cat "$NIX_CC"/nix-support/dynamic-linker)"
+    for BIN in $(find $out/bin -type f -executable); do
+      if patchelf $BIN 2>/dev/null ; then
+        echo "Patching ELF $BIN"
+        patchelf --set-interpreter "$INTERPRETER" "$BIN"
+      fi
+    done
+  '';
+  meta = {
+    description = "3D animation application software";
+    homepage = "https://sidefx.com";
+    license = stdenv.lib.licenses.unfree;
+    platforms = stdenv.lib.platforms.linux;
+    maintainers = [ stdenv.lib.maintainers.canndrew ];
+  };
+}
+
--- a/pkgs/applications/misc/nnn/default.nix
+++ b/pkgs/applications/misc/nnn/default.nix
@ -0,0 +1,31 @@
+{ stdenv, fetchFromGitHub, pkgconfig, ncurses, readline, conf ? null }:
+
+with stdenv.lib;
+
+stdenv.mkDerivation rec {
+  name = "nnn-${version}";
+  version = "1.2";
+
+  src = fetchFromGitHub {
+    owner = "jarun";
+    repo = "nnn";
+    rev = "v${version}";
+    sha256 = "1idrwm02218q7qd2pg2m8ld76bg32wbzl8y1h8ch7gzxihgn4559";
+  };
+
+  configFile = optionalString (conf!=null) (builtins.toFile "config.def.h" conf);
+  preBuild = optionalString (conf!=null) "cp ${configFile} config.def.h";
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ ncurses readline ];
+
+  installFlags = [ "DESTDIR=$(out)" "PREFIX=" ];
+
+  meta = {
+    description = "Small ncurses-based file browser forked from noice";
+    homepage = https://github.com/jarun/nnn;
+    license = licenses.bsd2;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ jfrankenau ];
+  };
+}
--- a/pkgs/applications/misc/pgadmin/default.nix
+++ b/pkgs/applications/misc/pgadmin/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, postgresql, wxGTK, libxml2, libxslt, openssl, zlib }:
+{ stdenv, fetchurl, postgresql, wxGTK, libxml2, libxslt, openssl, zlib, makeDesktopItem }:

 stdenv.mkDerivation rec {
  name = "pgadmin3-${version}";
@ -29,4 +29,21 @@ stdenv.mkDerivation rec {
    maintainers = with maintainers; [ domenkozar wmertens ];
    platforms = platforms.unix;
  };
+
+  postFixup = let
+    desktopItem = makeDesktopItem {
+      name = "pgAdmin";
+      desktopName = "pgAdmin III";
+      genericName = "SQL Administration";
+      exec = "pgadmin3";
+      icon = "pgAdmin3";
+      type = "Application";
+      categories = "Application;Development;";
+      mimeType = "text/html";
+    };
+  in ''
+    mkdir -p $out/share/pixmaps;
+    cp pgadmin/include/images/pgAdmin3.png $out/share/pixmaps/;
+    cp -rv ${desktopItem}/share/applications $out/share/
+  '';
 }
--- a/pkgs/applications/misc/st/default.nix
+++ b/pkgs/applications/misc/st/default.nix
@ -3,7 +3,7 @@

 with stdenv.lib;

-let patches' = if isNull patches then [] else patches;
+let patches' = if patches == null then [] else patches;
 in stdenv.mkDerivation rec {
  name = "st-0.7";

@ -25,7 +25,7 @@ in stdenv.mkDerivation rec {

  meta = {
    homepage = http://st.suckless.org/;
-    license = stdenv.lib.licenses.mit;
+    license = licenses.mit;
    maintainers = with maintainers; [viric andsild];
    platforms = platforms.linux;
  };
--- a/pkgs/applications/misc/st/wayland.nix
+++ b/pkgs/applications/misc/st/wayland.nix
@ -29,7 +29,7 @@ stdenv.mkDerivation rec {

  meta = {
    homepage = http://st.suckless.org/;
-    license = stdenv.lib.licenses.mit;
+    license = licenses.mit;
    maintainers = with maintainers; [ ];
    platforms = with platforms; linux;
  };
--- a/pkgs/applications/misc/st/xst.nix
+++ b/pkgs/applications/misc/st/xst.nix
@ -0,0 +1,31 @@
+{ stdenv, fetchFromGitHub, pkgconfig, libX11, ncurses, libXext, libXft, fontconfig }:
+
+with stdenv.lib;
+
+let
+  version = "0.7.1";
+  name = "xst-${version}";
+in stdenv.mkDerivation {
+  inherit name;
+
+  src = fetchFromGitHub {
+    owner = "neeasade";
+    repo = "xst";
+    rev = "v${version}";
+    sha256 = "1fh4y2w0icaij99kihl3w8j5d5b38d72afp17c81pi57f43ss6pc";
+  };
+
+  buildInputs = [ pkgconfig libX11 ncurses libXext libXft fontconfig ];
+
+  installPhase = ''
+    TERMINFO=$out/share/terminfo make install PREFIX=$out
+  '';
+
+  meta = {
+    homepage = "https://github.com/neeasade/xst";
+    description = "Simple terminal fork that can load config from Xresources";
+    license = licenses.mit;
+    maintainers = maintainers.vyp;
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/networking/browsers/chromium/plugins.nix
+++ b/pkgs/applications/networking/browsers/chromium/plugins.nix
@ -94,12 +94,12 @@ let

  flash = stdenv.mkDerivation rec {
    name = "flashplayer-ppapi-${version}";
-    version = "26.0.0.131";
+    version = "26.0.0.137";

    src = fetchzip {
      url = "https://fpdownload.adobe.com/pub/flashplayer/pdc/"
          + "${version}/flash_player_ppapi_linux.x86_64.tar.gz";
-      sha256 = "1cw5pmzfyaaxxd3kf90nz8zn5r06qmkh8l793j3db4n0ffxg5c1s";
+      sha256 = "0zmslmy7i7ywb2frckg5afkmfqb2lm2mahq0qs8msjzcx9jk4pyx";
      stripRoot = false;
    };

--- a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
@ -73,7 +73,7 @@ let
 in
 stdenv.mkDerivation rec {
  name = "flashplayer-${version}";
-  version = "26.0.0.131";
+  version = "26.0.0.137";

  src = fetchurl {
    url =
@ -84,14 +84,14 @@ stdenv.mkDerivation rec {
    sha256 =
      if debug then
        if arch == "x86_64" then
-          "0yqrw2gl9i0z33kcv5dpp3x3jyq9ksqfaqjgkk7xcy127ahric8s"
+          "1kdwprrrxbdgll05x148vhg86ph77ygr99ycfblblj8wjkcz9s0z"
        else
-          "0cmjqm5asqqcqavpkldm6wgjb49m9n018rixi7cj9zcwhfakm7zr"
+          "1ldv0fca43kdda949095r3gk1bc9p8n94z61qijkmrpv91zv5qvl"
      else
        if arch == "x86_64" then
-          "0agz4k5319m5bd0nqzkzvy8r28nr6c5j9b0jr6a8yh9s844aga8w"
+          "0db6dcqal7p79q26kglnsbiv3ysx9r3c7rkdiynww18gzr40vwls"
        else
-          "0jzvhyi1qgfjp9l85ffgcxqa87ymi899q2j68b9hfsn9hlw1sc5f";
+          "1fm6p91c63pyr0lra29vcq2dplb2c7a5114nm4r9rrrzjxakqw5w";
  };

  nativeBuildInputs = [ unzip ];
--- a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
@ -55,7 +55,7 @@ let
 in
 stdenv.mkDerivation rec {
  name = "flashplayer-standalone-${version}";
-  version = "26.0.0.131";
+  version = "26.0.0.137";

  src = fetchurl {
    url =
@ -65,9 +65,9 @@ stdenv.mkDerivation rec {
        "https://fpdownload.macromedia.com/pub/flashplayer/updaters/26/flash_player_sa_linux.x86_64.tar.gz";
    sha256 =
      if debug then
-        "000a019x15yk6qkx8yg7l496lc5knvw0kqgzial491d73zw8qjhn"
+        "095457h83zs6cvdyyrh01069kgg8cnhgs1by6s9xpdxgc851n8gp"
      else
-        "0rmsfi70hvp5vvdvcr8w7knz8bzf70r3ysnsgz3yv3b9p5dvsbjk";
+        "1zw3f612cfb8lr331hwqzlpd0gn3r0139bq76pbbbahh2chq99f8";
  };

  nativeBuildInputs = [ unzip ];
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@ -37,6 +37,9 @@

 # Pluggable transport dependencies
 , python27
+
+# Extra preferences
+, extraPrefs ? ""
 }:

 with stdenv.lib;
@ -173,11 +176,12 @@ stdenv.mkDerivation rec {
    cat >mozilla.cfg <<EOF
    // First line must be a comment

-    // Always update via Nix
+    // Always update via Nixpkgs
    lockPref("app.update.auto", false);
    lockPref("app.update.enabled", false);
    lockPref("extensions.update.autoUpdateDefault", false);
    lockPref("extensions.update.enabled", false);
+    lockPref("extensions.torbutton.versioncheck_enabled", false);

    // User should never change these.  Locking prevents these
    // values from being written to prefs.js, avoiding Store
@ -196,6 +200,10 @@ stdenv.mkDerivation rec {
    // Defaults to creating $TBB_HOME/TorBrowser/Data/Tor/{socks,control}.socket
    lockPref("extensions.torlauncher.control_port_use_ipc", true);
    lockPref("extensions.torlauncher.socks_port_use_ipc", true);
+
+    ${optionalString (extraPrefs != "") ''
+      ${extraPrefs}
+    ''}
    EOF

    # Hard-code path to TBB fonts; see also FONTCONFIG_FILE in
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@ -51,6 +51,7 @@ in {
  terraform_0_9_11 = generic {
    version = "0.9.11";
    sha256 = "045zcpd4g9c52ynhgh3213p422ahds63mzhmd2iwcmj88g8i1w6x";
-    doCheck = true;
+    # checks are failing again
+    doCheck = false;
  };
 }
--- a/pkgs/applications/networking/cluster/terragrunt/0.11.1.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/0.11.1.nix
@ -13,7 +13,7 @@ buildGoPackage rec {
    sha256 = "061ix4m64i8bvjpqm6hn83nnkvqrp5y0hh5gzmxiik2nz3by1rx5";
  };

-  goDeps = ./deps.nix;
+  goDeps = ./deps_0_11.nix;

  buildInputs = [ makeWrapper ];

--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@ -2,7 +2,7 @@

 buildGoPackage rec {
  name = "terragrunt-${version}";
-  version = "0.12.16";
+  version = "0.12.24";

  goPackagePath = "github.com/gruntwork-io/terragrunt";

@ -10,7 +10,7 @@ buildGoPackage rec {
    rev    = "v${version}";
    owner  = "gruntwork-io";
    repo   = "terragrunt";
-    sha256 = "07xxk7r9wvjv3v0l95g7sy5yphypfxmlymxzi7yv3b8dznifwm0y";
+    sha256 = "0rkbicvqjadb99qw65g3k7pqal5sn05png30qwy59cv4gjr9q9m4";
  };

  goDeps = ./deps.nix;
--- a/pkgs/applications/networking/cluster/terragrunt/deps.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/deps.nix
@ -1,12 +1,12 @@
-# This file was generated by https://github.com/kamilchm/go2nix v1.2.0
+# This file was generated by https://github.com/kamilchm/go2nix v1.2.1
 [
  {
    goPackagePath = "github.com/aws/aws-sdk-go";
    fetch = {
      type = "git";
      url = "https://github.com/aws/aws-sdk-go";
-      rev = "952498f4a390118ac65ad59cbe0c8b57ed69b6b5";
-      sha256 = "03j2dn4v2wr32jd9iki68ra0r8aghy7hpad94bf8zdgsrjn6rwvj";
+      rev = "ae53883b2478fd8e2bdca2748367d5b5fa27ca22";
+      sha256 = "0sa5g69wpk6hbd6g52cc7l5c6zph9zyc5l9dy4288xn4hpb6c23q";
    };
  }
  {
@ -32,8 +32,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/hashicorp/go-getter";
-      rev = "90b6568eac830f62a08e8f1f46375daa63e57015";
-      sha256 = "1cl0yqlhffjmf4qan093z49i88i7wjp9lsfwfzn52sk3c09ksism";
+      rev = "2814e6fb2ca5b3bd950c97eff22553ecb3c7f77b";
+      sha256 = "1pkqa5vdyc79iiw25b9vpl9f32nwv2pzh6f98l30678ypha0miqn";
    };
  }
  {
@ -86,8 +86,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/mitchellh/mapstructure";
-      rev = "cc8532a8e9a55ea36402aa21efdf403a60d34096";
-      sha256 = "0705c0hq7b993sabnjy65yymvpy9w1j84bg9bjczh5607z16nw86";
+      rev = "d0303fe809921458f417bcf828397a65db30a7e4";
+      sha256 = "1fjwi5ghc1ibyx93apz31n4hj6gcq1hzismpdfbg2qxwshyg0ya8";
    };
  }
  {
@ -95,8 +95,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/stretchr/testify";
-      rev = "4d4bfba8f1d1027c4fdbe371823030df51419987";
-      sha256 = "1d3yz1d2s88byjzmn60jbi1m9s552f7ghzbzik97fbph37i8yjhp";
+      rev = "f6abca593680b2315d2075e0f5e2a9751e3f431a";
+      sha256 = "0n2vidr9zyf6k296grnc6d3rk9hd6qw7mwvnfixlxm8g5y46rzl9";
    };
  }
  {
@ -104,8 +104,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/urfave/cli";
-      rev = "d70f47eeca3afd795160003bc6e28b001d60c67c";
-      sha256 = "1xm203qp4sdlvffcbag7v6mc2d6q61i25iiz3y9yqpy25jpcpgif";
+      rev = "4b90d79a682b4bf685762c7452db20f2a676ecb2";
+      sha256 = "0ls3lfmbfwirm9j95b6yrw41wgh72lfkp1cvs873zw04si4yvaqr";
    };
  }
 ]
--- a/pkgs/applications/networking/cluster/terragrunt/deps_0_11.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/deps_0_11.nix
@ -0,0 +1,111 @@
+# This file was generated by https://github.com/kamilchm/go2nix v1.2.0
+[
+  {
+    goPackagePath = "github.com/aws/aws-sdk-go";
+    fetch = {
+      type = "git";
+      url = "https://github.com/aws/aws-sdk-go";
+      rev = "952498f4a390118ac65ad59cbe0c8b57ed69b6b5";
+      sha256 = "03j2dn4v2wr32jd9iki68ra0r8aghy7hpad94bf8zdgsrjn6rwvj";
+    };
+  }
+  {
+    goPackagePath = "github.com/bgentry/go-netrc";
+    fetch = {
+      type = "git";
+      url = "https://github.com/bgentry/go-netrc";
+      rev = "9fd32a8b3d3d3f9d43c341bfe098430e07609480";
+      sha256 = "0dn2h8avgavqdzdqnph8bkhj35bx0wssczry1zdczr22xv650g1l";
+    };
+  }
+  {
+    goPackagePath = "github.com/go-errors/errors";
+    fetch = {
+      type = "git";
+      url = "https://github.com/go-errors/errors";
+      rev = "8fa88b06e5974e97fbf9899a7f86a344bfd1f105";
+      sha256 = "02mvb2clbmfcqb4yclv5zhs4clkk9jxi2hiawsynl5fwmgn0d3xa";
+    };
+  }
+  {
+    goPackagePath = "github.com/hashicorp/go-getter";
+    fetch = {
+      type = "git";
+      url = "https://github.com/hashicorp/go-getter";
+      rev = "90b6568eac830f62a08e8f1f46375daa63e57015";
+      sha256 = "1cl0yqlhffjmf4qan093z49i88i7wjp9lsfwfzn52sk3c09ksism";
+    };
+  }
+  {
+    goPackagePath = "github.com/hashicorp/go-version";
+    fetch = {
+      type = "git";
+      url = "https://github.com/hashicorp/go-version";
+      rev = "03c5bf6be031b6dd45afec16b1cf94fc8938bc77";
+      sha256 = "0sjq57gpfznaqdrbyb2p0bn90g9h661cvr0jrk6ngags4pbw14ik";
+    };
+  }
+  {
+    goPackagePath = "github.com/hashicorp/hcl";
+    fetch = {
+      type = "git";
+      url = "https://github.com/hashicorp/hcl";
+      rev = "392dba7d905ed5d04a5794ba89f558b27e2ba1ca";
+      sha256 = "1rfm67kma2hpakabf7hxlj196jags4rpjpcirwg4kan4g9b6j0kb";
+    };
+  }
+  {
+    goPackagePath = "github.com/mattn/go-zglob";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mattn/go-zglob";
+      rev = "95345c4e1c0ebc9d16a3284177f09360f4d20fab";
+      sha256 = "012hrd67v4gp3b621rykg2kp6a7iq4dr585qavragbif0z1whckx";
+    };
+  }
+  {
+    goPackagePath = "github.com/mitchellh/go-homedir";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mitchellh/go-homedir";
+      rev = "b8bc1bf767474819792c23f32d8286a45736f1c6";
+      sha256 = "13ry4lylalkh4g2vny9cxwvryslzyzwp9r92z0b10idhdq3wad1q";
+    };
+  }
+  {
+    goPackagePath = "github.com/mitchellh/go-testing-interface";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mitchellh/go-testing-interface";
+      rev = "477c2d05a845d8b55912a5a7993b9b24abcc5ef8";
+      sha256 = "0llpcyiqfjdri7pba1p13maafgcyzjbd29h99b1hgj848k5avd61";
+    };
+  }
+  {
+    goPackagePath = "github.com/mitchellh/mapstructure";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mitchellh/mapstructure";
+      rev = "cc8532a8e9a55ea36402aa21efdf403a60d34096";
+      sha256 = "0705c0hq7b993sabnjy65yymvpy9w1j84bg9bjczh5607z16nw86";
+    };
+  }
+  {
+    goPackagePath = "github.com/stretchr/testify";
+    fetch = {
+      type = "git";
+      url = "https://github.com/stretchr/testify";
+      rev = "4d4bfba8f1d1027c4fdbe371823030df51419987";
+      sha256 = "1d3yz1d2s88byjzmn60jbi1m9s552f7ghzbzik97fbph37i8yjhp";
+    };
+  }
+  {
+    goPackagePath = "github.com/urfave/cli";
+    fetch = {
+      type = "git";
+      url = "https://github.com/urfave/cli";
+      rev = "d70f47eeca3afd795160003bc6e28b001d60c67c";
+      sha256 = "1xm203qp4sdlvffcbag7v6mc2d6q61i25iiz3y9yqpy25jpcpgif";
+    };
+  }
+]
--- a/pkgs/applications/networking/dropbox/default.nix
+++ b/pkgs/applications/networking/dropbox/default.nix
@ -24,11 +24,11 @@
 let
  # NOTE: When updating, please also update in current stable,
  # as older versions stop working
-  version = "29.4.20";
+  version = "30.4.22";
  sha256 =
    {
-      "x86_64-linux" = "0w8n8q846mqq8f3yisn9xazf323sn579zyp1kwrdrmmqalwiwcl2";
-      "i686-linux"   = "0zgdnpizgkw2q6wglkdhpzzrhnpplfi2ldcw1z0k9r6slici5mfk";
+      "x86_64-linux" = "0qc99j6hpd1k5bmvcll3rjglksrjw0mw2nrwj3s3kh55j6fy8a0r";
+      "i686-linux"   = "0zyl1q76cpwly4k7h4klnyrv50nyxi2wpz5sii1a00jbmr7snhab";
    }."${stdenv.system}" or (throw "system ${stdenv.system} not supported");

  arch =
--- a/pkgs/applications/networking/instant-messengers/jackline/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jackline/default.nix
@ -3,14 +3,14 @@
 assert stdenv.lib.versionAtLeast ocamlPackages.ocaml.version "4.02.2";

 stdenv.mkDerivation rec {
-  version = "2017-05-21";
+  version = "2017-05-24";
  name = "jackline-${version}";

  src = fetchFromGitHub {
    owner  = "hannesm";
    repo   = "jackline";
-    rev    = "0a1e4ea23245633fe23edf09b2309659a1bc3649";
-    sha256 = "1wnmwsp3a5nh3qs4h9grrdsvv0i3p419cfmhrrql3lj2x3ngdw82";
+    rev    = "49a326d5696aa24f3ac18534c8860e03d0d58548";
+    sha256 = "0p741mzq4kkqyly8njga1f5dxdnfz31wy2lpvs5542pq0iwvdj7k";
  };

  buildInputs = with ocamlPackages; [
--- a/pkgs/applications/networking/instant-messengers/quaternion/default.nix
+++ b/pkgs/applications/networking/instant-messengers/quaternion/default.nix
@ -2,7 +2,7 @@

 mkDerivation rec {
  name = "quaternion-git-${version}";
-  version = "2017-04-15";
+  version = "2017-06-29";

  # quaternion and tensor share the same libqmatrixclient library as a git submodule
  #
@ -12,9 +12,9 @@ mkDerivation rec {
  # derivation.

  src = fetchgit {
-    url             = "https://github.com/Fxrh/Quaternion.git";
-    rev             = "c35475a6755cdb75e2a6c8ca5b943685d07d9707";
-    sha256          = "0cm5j4vdnp5cljfnv5jqf89ccymspaqc6j9bb4c1x891vr42np0m";
+    url             = "https://github.com/QMatrixClient/Quaternion.git";
+    rev             = "1febc0178fd3d02b7426f58981b54924ad60c84d";
+    sha256          = "1whjhlphdhk7kgw2zqc0wj3k2i9gkp79qq2bnrh4mbcp3qmcqngr";
    fetchSubmodules = true;
  };

@ -28,14 +28,12 @@ mkDerivation rec {
  postInstall = ''
    substituteInPlace $out/share/applications/quaternion.desktop \
      --replace 'Exec=quaternion' "Exec=$out/bin/quaternion"
-
-    rm $out/share/icons/hicolor/icon-theme.cache
  '';

  meta = with lib; {
-    homepage = https://matrix.org/docs/projects/client/quaternion.html;
    description = "Cross-platform desktop IM client for the Matrix protocol";
-    license = licenses.gpl3;
+    homepage    = https://matrix.org/docs/projects/client/quaternion.html;
+    license     = licenses.gpl3;
    maintainers = with maintainers; [ peterhoeg ];
    inherit (qtbase.meta) platforms;
    inherit version;
--- a/pkgs/applications/networking/instant-messengers/ring-daemon/default.nix
+++ b/pkgs/applications/networking/instant-messengers/ring-daemon/default.nix
@ -0,0 +1,149 @@
+{ stdenv
+, fetchgit
+, which
+, autoreconfHook
+, pkgconfig
+, automake
+, libtool
+, pjsip
+, libyamlcpp
+, alsaLib
+, libpulseaudio
+, libsamplerate
+, libsndfile
+, dbus
+, dbus_cplusplus
+, ffmpeg
+, udev
+, pcre
+, gsm
+, speex
+, boost
+, opendht
+, libmsgpack
+, gnutls
+, zlib
+, jsoncpp
+, xlibs
+, libargon2
+, cryptopp
+, openssl
+, perl
+, python3
+, bash
+, libupnp
+, speexdsp
+, fetchFromGitHub
+, cmake
+, asio
+}:
+
+let
+  myPython = python3.withPackages (ps: with ps; [
+    pygobject3
+    dbus-python
+  ]);
+
+  src = fetchgit {
+    url = https://gitlab.savoirfairelinux.com/ring/ring-daemon.git;
+    rev = "006b8dc7be08fe9beb68709af71004e7bc1ceb5c";
+    sha256 = "0ih9g0rismrhx6nqcy3jqfbcs166grg0shnfmrnmykl9h0xy8z47";
+  };
+
+  patchdir = "${src}/contrib/src";
+
+  restbed = import ./restbed.nix {
+    inherit stdenv fetchFromGitHub cmake asio openssl;
+    patches = [
+    "${patchdir}/restbed/CMakeLists.patch"
+    "${patchdir}/restbed/strand.patch"
+    "${patchdir}/restbed/uri_cpp.patch"
+    "${patchdir}/restbed/dns-resolution-error.patch"
+    "${patchdir}/restbed/string.patch"
+    ];
+  };
+
+  pjsip' = stdenv.lib.overrideDerivation pjsip (old: {
+    patches = [
+      "${patchdir}/pjproject/gnutls.patch"
+      ./notestsapps.patch # this one had to be modified
+      "${patchdir}/pjproject/fix_base64.patch"
+      "${patchdir}/pjproject/ipv6.patch"
+      "${patchdir}/pjproject/ice_config.patch"
+      "${patchdir}/pjproject/multiple_listeners.patch"
+      "${patchdir}/pjproject/pj_ice_sess.patch"
+      "${patchdir}/pjproject/fix_turn_fallback.patch"
+      "${patchdir}/pjproject/fix_ioqueue_ipv6_sendto.patch"
+      "${patchdir}/pjproject/add_dtls_transport.patch"
+    ];
+    CFLAGS = "-g -DPJ_ICE_MAX_CAND=256 -DPJ_ICE_MAX_CHECKS=150 -DPJ_ICE_COMP_BITS=2 -DPJ_ICE_MAX_STUN=3 -DPJSIP_MAX_PKT_LEN=8000";
+  }); 
+in
+stdenv.mkDerivation rec {
+  name = "ring-daemon-${version}";
+  version = "2017-07-11";
+
+  inherit src;
+
+  nativeBuildInputs = [
+    which
+    autoreconfHook
+    automake
+    libtool
+    pkgconfig
+  ];
+
+  buildInputs = [
+    pjsip'
+    libyamlcpp
+    alsaLib
+    libpulseaudio
+    libsamplerate
+    libsndfile
+    dbus
+    dbus_cplusplus
+    ffmpeg
+    udev
+    pcre
+    gsm
+    speex
+    boost
+    opendht
+    libmsgpack
+    gnutls
+    zlib
+    jsoncpp
+    restbed
+    xlibs.libX11
+    libargon2
+    cryptopp
+    openssl
+    perl
+    libupnp
+    speexdsp
+  ];
+
+  postInstall = ''
+    mkdir $out/bin
+    ln -s $out/lib/ring/dring $out/bin/dring
+    cp -R ./tools/dringctrl/ $out/
+    substitute ./tools/dringctrl/dringctrl.py $out/dringctrl/dringctrl.py \
+      --replace '#!/usr/bin/env python3' "#!${myPython}/bin/python3"
+    chmod +x $out/dringctrl/dringctrl.py
+    ln -s $out/dringctrl/dringctrl.py $out/bin/dringctrl.py
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A Voice-over-IP software phone";
+    longDescription = ''
+      As the SIP/audio daemon and the user interface are separate processes, it
+      is easy to provide different user interfaces. GNU Ring comes with various
+      graphical user interfaces and even scripts to control the daemon from the
+      shell.
+    '';
+    homepage = https://ring.cx;
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ taeer olynch ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/networking/instant-messengers/ring-daemon/notestsapps.patch
+++ b/pkgs/applications/networking/instant-messengers/ring-daemon/notestsapps.patch
@ -0,0 +1,106 @@
+/* diff --git a/Makefile b/Makefile */
+/* index 33a4e6b..a486eb7 100644 */
+/* --- a/Makefile */
+/* +++ b/Makefile */
+/* @@ -4,7 +4,7 @@ include build/host-$(HOST_NAME).mak */
+/*  include version.mak */
+ 
+/*  LIB_DIRS = pjlib/build pjlib-util/build pjnath/build third_party/build pjmedia/build pjsip/build */
+/* -DIRS = $(LIB_DIRS) pjsip-apps/build $(EXTRA_DIRS) */
+/* +DIRS = $(LIB_DIRS) $(EXTRA_DIRS) */
+ 
+/*  ifdef MINSIZE */
+/*  MAKE_FLAGS := MINSIZE=1 */
+diff --git a/pjlib-util/build/Makefile b/pjlib-util/build/Makefile
+index cb601cb..862a78a 100644
+--- a/pjlib-util/build/Makefile
+++ b/pjlib-util/build/Makefile
+@@ -54,7 +54,6 @@ export UTIL_TEST_OBJS += xml.o encryption.o stun.o resolver_test.o test.o \
+ export UTIL_TEST_CFLAGS += $(_CFLAGS)
+ export UTIL_TEST_CXXFLAGS += $(_CXXFLAGS)
+ export UTIL_TEST_LDFLAGS += $(PJLIB_UTIL_LDLIB) $(PJLIB_LDLIB) $(_LDFLAGS)
+-export UTIL_TEST_EXE:=pjlib-util-test-$(TARGET_NAME)$(HOST_EXE)
+ 
+ 	
+ export CC_OUT CC AR RANLIB HOST_MV HOST_RM HOST_RMDIR HOST_MKDIR OBJEXT LD LDOUT 
+diff --git a/pjlib/build/Makefile b/pjlib/build/Makefile
+index 1e64950..a75fa65 100644
+--- a/pjlib/build/Makefile
+++ b/pjlib/build/Makefile
+@@ -56,7 +56,6 @@ export TEST_OBJS += activesock.o atomic.o echo_clt.o errno.o exception.o \
+ export TEST_CFLAGS += $(_CFLAGS)
+ export TEST_CXXFLAGS += $(_CXXFLAGS)
+ export TEST_LDFLAGS += $(PJLIB_LDLIB) $(_LDFLAGS)
+-export TEST_EXE := pjlib-test-$(TARGET_NAME)$(HOST_EXE)
+ 
+ 
+ export CC_OUT CC AR RANLIB HOST_MV HOST_RM HOST_RMDIR HOST_MKDIR OBJEXT LD LDOUT 
+diff --git a/pjmedia/build/Makefile b/pjmedia/build/Makefile
+index 8012cb7..2ca283a 100644
+--- a/pjmedia/build/Makefile
+++ b/pjmedia/build/Makefile
+@@ -165,7 +165,6 @@ export PJMEDIA_TEST_LDFLAGS += $(PJMEDIA_CODEC_LDLIB) \
+ 			       $(PJLIB_UTIL_LDLIB) \
+ 			       $(PJNATH_LDLIB) \
+ 			       $(_LDFLAGS)
+-export PJMEDIA_TEST_EXE:=pjmedia-test-$(TARGET_NAME)$(HOST_EXE)
+ 
+ 	
+ export CC_OUT CC AR RANLIB HOST_MV HOST_RM HOST_RMDIR HOST_MKDIR OBJEXT LD LDOUT 
+diff --git a/pjnath/build/Makefile b/pjnath/build/Makefile
+index 1bc08b5..109f79b 100644
+--- a/pjnath/build/Makefile
+++ b/pjnath/build/Makefile
+@@ -54,7 +54,6 @@ export PJNATH_TEST_OBJS += ice_test.o stun.o sess_auth.o server.o concur_test.o
+ export PJNATH_TEST_CFLAGS += $(_CFLAGS)
+ export PJNATH_TEST_CXXFLAGS += $(_CXXFLAGS)
+ export PJNATH_TEST_LDFLAGS += $(PJNATH_LDLIB) $(PJLIB_UTIL_LDLIB) $(PJLIB_LDLIB) $(_LDFLAGS)
+-export PJNATH_TEST_EXE:=pjnath-test-$(TARGET_NAME)$(HOST_EXE)
+ 
+ 	
+ ###############################################################################
+@@ -65,7 +64,6 @@ export PJTURN_CLIENT_OBJS += client_main.o
+ export PJTURN_CLIENT_CFLAGS += $(_CFLAGS)
+ export PJTURN_CLIENT_CXXFLAGS += $(_CXXFLAGS)
+ export PJTURN_CLIENT_LDFLAGS += $(PJNATH_LDLIB) $(PJLIB_UTIL_LDLIB) $(PJLIB_LDLIB) $(_LDFLAGS)
+-export PJTURN_CLIENT_EXE:=pjturn-client-$(TARGET_NAME)$(HOST_EXE)
+ 
+ ###############################################################################
+ # Defines for building TURN server application
+@@ -76,7 +74,6 @@ export PJTURN_SRV_OBJS += allocation.o auth.o listener_udp.o \
+ export PJTURN_SRV_CFLAGS += $(_CFLAGS)
+ export PJTURN_SRV_CXXFLAGS += $(_CXXFLAGS)
+ export PJTURN_SRV_LDFLAGS += $(PJNATH_LDLIB) $(PJLIB_UTIL_LDLIB) $(PJLIB_LDLIB) $(_LDFLAGS)
+-export PJTURN_SRV_EXE:=pjturn-srv-$(TARGET_NAME)$(HOST_EXE)
+ 
+ 	
+ 	
+diff --git a/pjsip/build/Makefile b/pjsip/build/Makefile
+index d2a5c2a..7e2ec60 100644
+--- a/pjsip/build/Makefile
+++ b/pjsip/build/Makefile
+@@ -140,7 +140,7 @@ export PJSUA2_LIB_OBJS += $(OS_OBJS) $(M_OBJS) $(CC_OBJS) $(HOST_OBJS) \
+ 			   account.o endpoint.o json.o persistent.o types.o \
+ 			   siptypes.o call.o presence.o media.o
+ export PJSUA2_LIB_CFLAGS += $(_CFLAGS) $(PJ_VIDEO_CFLAGS)
+-export PJSUA2_LIB_CXXFLAGS = $(PJSUA2_LIB_CFLAGS) 
+export PJSUA2_LIB_CXXFLAGS = $(_CXXFLAGS) $(PJ_VIDEO_CFLAGS) 
+ export PJSUA2_LIB_LDFLAGS += $(PJSUA_LIB_LDLIB) \
+ 			     $(PJSIP_UA_LDLIB) \
+ 			     $(PJSIP_SIMPLE_LDLIB) \
+@@ -165,7 +165,6 @@ export PJSUA2_TEST_OBJS += $(OS_OBJS) $(M_OBJS) $(CC_OBJS) $(HOST_OBJS) \
+ export PJSUA2_TEST_CFLAGS += $(_CFLAGS) $(PJ_VIDEO_CFLAGS)
+ export PJSUA2_TEST_CXXFLAGS = $(PJSUA2_LIB_CFLAGS) 
+ export PJSUA2_TEST_LDFLAGS += $(PJ_LDXXFLAGS) $(PJ_LDXXLIBS) $(LDFLAGS)
+-export PJSUA2_TEST_EXE := pjsua2-test-$(TARGET_NAME)$(HOST_EXE)
+ 
+ export CC_OUT CC AR RANLIB HOST_MV HOST_RM HOST_RMDIR HOST_MKDIR OBJEXT LD LDOUT 
+ 
+@@ -195,7 +194,6 @@ export TEST_LDFLAGS += $(PJSIP_LDLIB) \
+ 		       $(PJLIB_UTIL_LDLIB) \
+ 		       $(PJNATH_LDLIB) \
+ 		       $(_LDFLAGS)
+-export TEST_EXE := pjsip-test-$(TARGET_NAME)$(HOST_EXE)
+ 
+ 	
+ export CC_OUT CC AR RANLIB HOST_MV HOST_RM HOST_RMDIR HOST_MKDIR OBJEXT LD LDOUT 
--- a/pkgs/applications/networking/instant-messengers/ring-daemon/restbed.nix
+++ b/pkgs/applications/networking/instant-messengers/ring-daemon/restbed.nix
@ -0,0 +1,41 @@
+{ stdenv
+, fetchFromGitHub
+, cmake
+, asio
+, openssl
+, patches
+}:
+
+stdenv.mkDerivation rec {
+  name = "restbed-${version}";
+  version = "2016-09-15";
+
+  src = fetchFromGitHub {
+    owner = "Corvusoft";
+    repo = "restbed";
+    rev = "34187502642144ab9f749ab40f5cdbd8cb17a54a";
+    sha256 = "1jb38331fcicyiisqdprhq6zwfc6g518fm3l4qw9aiv5k9nqim22";
+  };
+
+  inherit patches;
+
+  buildInputs = [
+    cmake
+    asio
+    openssl
+  ];
+
+  meta = with stdenv.lib; {
+    description = "HTTP framework for building networked applications";
+    longDescription = ''
+      HTTP framework for building networked applications that require seamless
+      and secure communication, with the flexability to model a range of
+      business processes. Targeting mobile, tablet, desktop, and embedded
+      production environments.
+    '';
+    homepage = https://corvusoft.co.uk/;
+    license = licenses.agpl3;
+    maintainers = with maintainers; [ taeer ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/networking/insync/default.nix
+++ b/pkgs/applications/networking/insync/default.nix
@ -2,12 +2,12 @@

 stdenv.mkDerivation rec {
  name = "insync-${version}";
-  version = "1.3.16.36155";
+  version = "1.3.17.36167";
  src =
    if stdenv.system == "x86_64-linux" then
      fetchurl {
        url = "http://s.insynchq.com/builds/insync-portable_${version}_amd64.tar.bz2";
-        sha256 = "1gf1qg7mkbcgqhwxkiljmd1w2zvarq6vhxhips3w06bqdyg12210";
+        sha256 = "0mvg22psiy4x9g7k1fm9pigz2a70jmin7zg2nfzapfnqjlnrbw3n";
      }
    else
      throw "${name} is not supported on ${stdenv.system}";
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@ -1,14 +1,14 @@
 { stdenv, lib, fetchFromGitHub, go, procps, removeReferencesTo }:

 stdenv.mkDerivation rec {
-  version = "0.14.31";
+  version = "0.14.32";
  name = "syncthing-${version}";

  src = fetchFromGitHub {
    owner  = "syncthing";
    repo   = "syncthing";
    rev    = "v${version}";
-    sha256 = "1zg9gj0g89swr8cxxrpl96adhqgxz40dwkm7n61q1vycd6hhl73d";
+    sha256 = "1agjr3m4gnywbp40idi0pwy25cp836sdcar7r6r9hwcqxyyzz545";
  };

  buildInputs = [ go removeReferencesTo ];
--- a/pkgs/applications/office/gnumeric/default.nix
+++ b/pkgs/applications/office/gnumeric/default.nix
@ -9,11 +9,11 @@ let
  isonum = fetchurl { url = http://www.oasis-open.org/docbook/xml/4.5/ent/isonum.ent; sha256 = "04b62dw2g3cj9i4vn9xyrsrlz8fpmmijq98dm0nrkky31bwbbrs3"; };
  isogrk1 = fetchurl { url = http://www.oasis-open.org/docbook/xml/4.5/ent/isogrk1.ent; sha256 = "04b23anhs5wr62n4rgsjirzvw7rpjcsf8smz4ffzaqh3b0vw90vm"; };
 in stdenv.mkDerivation rec {
-  name = "gnumeric-1.12.34";
+  name = "gnumeric-1.12.35";

  src = fetchurl {
    url = "mirror://gnome/sources/gnumeric/1.12/${name}.tar.xz";
-    sha256 = "0b4920812d82ec4c25204543dff9dd3bdbac17bfaaabd1aa02d47fbe2981c725";
+    sha256 = "77b1e3ce523578a807767ad71680fb865ac021d7bfadf93eada99ae094c06c0a";
  };

  configureFlags = "--disable-component";
@ -38,7 +38,7 @@ in stdenv.mkDerivation rec {
    for f in "$out"/bin/gnumeric-*; do
      wrapProgram $f \
        --prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH" \
-        ${stdenv.lib.optionalString (!stdenv.isDarwin) "--prefix GIO_EXTRA_MODULES : '${gnome3.dconf}/lib/gio/modules'"}
+        ${stdenv.lib.optionalString (!stdenv.isDarwin) "--prefix GIO_EXTRA_MODULES : '${stdenv.lib.getLib gnome3.dconf}/lib/gio/modules'"}
    done
  '';

--- a/pkgs/applications/science/logic/abc/default.nix
+++ b/pkgs/applications/science/logic/abc/default.nix
@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
  '';

  meta = {
-    description = "A tool for squential logic synthesis and ormal verification";
+    description = "A tool for squential logic synthesis and formal verification";
    homepage    = "https://people.eecs.berkeley.edu/~alanmi/abc/abc.htm";
    license     = stdenv.lib.licenses.mit;
    platforms   = stdenv.lib.platforms.unix;
--- a/pkgs/applications/science/math/ginac/default.nix
+++ b/pkgs/applications/science/math/ginac/default.nix
@ -1,18 +1,20 @@
-{ stdenv, fetchurl, cln, pkgconfig, readline, gmp }:
+{ stdenv, fetchurl, cln, pkgconfig, readline, gmp, python }:

 stdenv.mkDerivation rec {
-  name = "ginac-1.6.2";
+  name = "ginac-1.7.2";

  src = fetchurl {
    url    = "${meta.homepage}/${name}.tar.bz2";
-    sha256 = "1pivcqqaf142l6vrj2azq6dxrcyzhag4za2dwicb4gsb09ax4d0g";
+    sha256 = "1dyq47gc97jn1r5sy0klxs5b4lzhckyjqgsvwcs2a9ybqmhmpdr4";
  };

  propagatedBuildInputs = [ cln ];

  buildInputs = [ readline ] ++ stdenv.lib.optional stdenv.isDarwin gmp;

-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig python ];
+
+  preConfigure = "patchShebangs ginsh";

  configureFlags = "--disable-rpath";

--- a/pkgs/applications/version-management/git-and-tools/git-big-picture/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-big-picture/default.nix
@ -0,0 +1,30 @@
+{ fetchFromGitHub, python2Packages, stdenv, git, graphviz }:
+
+python2Packages.buildPythonApplication rec {
+  pname = "git-big-picture";
+  version = "0.9.0";
+
+  name = "${pname}-${version}";
+
+  src = fetchFromGitHub {
+    owner = "esc";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1h283gzs4nx8lrarmr454zza52cilmnbdrqn1n33v3cn1rayl3c9";
+  };
+
+  buildInputs = [ git graphviz ];
+
+  postFixup = ''
+    wrapProgram $out/bin/git-big-picture \
+      --prefix PATH ":" ${ stdenv.lib.makeBinPath buildInputs  }
+    '';
+
+  meta = {
+    description = "Tool for visualization of Git repositories.";
+    homepage = https://github.com/esc/git-big-picture;
+    license = stdenv.lib.licenses.gpl3;
+    platforms = stdenv.lib.platforms.linux;
+    maintainers = [ stdenv.lib.maintainers.nthorne ];
+  };
+}
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@ -1,5 +1,6 @@
 { fetchurl, stdenv, curl, openssl, zlib, expat, perl, python, gettext, cpio
-, gnugrep, gzip, openssh
+, gnugrep, gnused, gawk, coreutils # needed at runtime by git-filter-branch etc
+, gzip, openssh
 , asciidoc, texinfo, xmlto, docbook2x, docbook_xsl, docbook_xml_dtd_45
 , libxslt, tcl, tk, makeWrapper, libiconv
 , svnSupport, subversionClient, perlLibs, smtpPerlLibs, gitwebPerlLibs
@ -11,7 +12,7 @@
 }:

 let
-  version = "2.13.2";
+  version = "2.13.3";
  svn = subversionClient.override { perlBindings = true; };
 in

@ -20,7 +21,7 @@ stdenv.mkDerivation {

  src = fetchurl {
    url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "1rfx2gj7dw9rw0w22ihi940zv3wdrj1xmjv25djq2vs6a4vsq40d";
+    sha256 = "0qiy696pwqhbxcrvm3zhyjnfjrym541glhvgc4cynrwg8az27ali";
  };

  hardeningDisable = [ "format" ];
@ -104,11 +105,24 @@ stdenv.mkDerivation {
          --replace ' grep' ' ${gnugrep}/bin/grep' \
          --replace ' egrep' ' ${gnugrep}/bin/egrep'

-      # Fix references to the perl binary. Note that the tab character
-      # in the patterns is important.
-      sed -i -e 's|	perl -ne|	${perl}/bin/perl -ne|g' \
-             -e 's|	perl -e|	${perl}/bin/perl -e|g' \
-             $out/libexec/git-core/{git-am,git-submodule}
+      # Fix references to the perl, sed, awk and various coreutil binaries used by
+      # shell scripts that git calls (e.g. filter-branch)
+      SCRIPT="$(cat <<'EOS'
+        BEGIN{
+          @a=(
+            '${perl}/bin/perl', '${gnugrep}/bin/grep', '${gnused}/bin/sed', '${gawk}/bin/awk',
+            '${coreutils}/bin/cut', '${coreutils}/bin/basename', '${coreutils}/bin/dirname',
+            '${coreutils}/bin/wc', '${coreutils}/bin/tr'
+          );
+        }
+        foreach $c (@a) {
+          $n=(split("/", $c))[-1];
+          s|(?<=[^#][^/.-])\b''${n}(?=\s)|''${c}|g
+        }
+      EOS
+      )"
+      perl -0777 -i -pe "$SCRIPT" \
+        $out/libexec/git-core/git-{sh-setup,filter-branch,merge-octopus,mergetool,quiltimport,request-pull,stash,submodule,subtree,web--browse}

      # Fix references to gettext.
      substituteInPlace $out/libexec/git-core/git-sh-i18n \
--- a/pkgs/applications/window-managers/sway/default.nix
+++ b/pkgs/applications/window-managers/sway/default.nix
@ -1,11 +1,11 @@
 { stdenv, fetchFromGitHub, pango, libinput
 , makeWrapper, cmake, pkgconfig, asciidoc, libxslt, docbook_xsl, cairo
 , wayland, wlc, libxkbcommon, pixman, fontconfig, pcre, json_c, dbus_libs, libcap
-, xwayland
+, xwayland, pam, gdk_pixbuf
 }:

 let
-  version = "0.12.2";
+  version = "0.13.0";
 in
  stdenv.mkDerivation rec {
    name = "sway-${version}";
@ -14,18 +14,19 @@ in
      owner = "Sircmpwn";
      repo = "sway";
      rev = "${version}";
-      sha256 = "1hkr6pmz45xa5w5y21ijz7i2dwb62rifhcy28r8kh5r2hwbil2hs";
+      sha256 = "1vgk4rl51nx66yzpwg4yhnbj7wc30k5q0hh5lf8y0i1nvpal0p3q";
    };

    nativeBuildInputs = [ makeWrapper cmake pkgconfig asciidoc libxslt docbook_xsl ];

-    buildInputs = [ wayland wlc libxkbcommon pixman fontconfig pcre json_c dbus_libs pango cairo libinput libcap xwayland ];
+    buildInputs = [ wayland wlc libxkbcommon pixman fontconfig pcre json_c dbus_libs pango cairo libinput libcap xwayland pam gdk_pixbuf ];

    patchPhase = ''
      sed -i s@/etc/sway@$out/etc/sway@g CMakeLists.txt;
    '';

    makeFlags = "PREFIX=$(out)";
+    cmakeFlags = "-DVERSION=${version}";
    installPhase = "PREFIX=$out make install";

    LD_LIBRARY_PATH = stdenv.lib.makeLibraryPath [ wlc dbus_libs ];
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@ -42,7 +42,7 @@ rec {
    cp ${./tarsum.go} tarsum.go
    export GOPATH=$(pwd)
    mkdir src
-    ln -sT ${docker.src}/pkg/tarsum src/tarsum
+    ln -sT ${docker.src}/components/engine/pkg/tarsum src/tarsum
    go build

    cp tarsum $out
--- a/pkgs/build-support/make-startupitem/default.nix
+++ b/pkgs/build-support/make-startupitem/default.nix
@ -19,14 +19,14 @@ stdenv.mkDerivation {
  priority = 5;

  buildCommand = ''
-    mkdir -p $out/share/autostart
+    mkdir -p $out/etc/xdg/autostart
    target=${name}.desktop
    cp ${package}/share/applications/${srcPrefix}${name}.desktop $target
    chmod +rw $target
    echo "X-KDE-autostart-phase=${phase}" >> $target
    ${lib.optionalString (after != null) ''echo "${after}" >> $target''}
    ${lib.optionalString (condition != null) ''echo "${condition}" >> $target''}
-    cp $target $out/share/autostart
+    cp $target $out/etc/xdg/autostart
  '';

  # this will automatically put 'package' in the environment when you
--- a/pkgs/data/fonts/google-fonts/default.nix
+++ b/pkgs/data/fonts/google-fonts/default.nix
@ -2,18 +2,18 @@

 stdenv.mkDerivation rec {
  name = "google-fonts-${version}";
-  version = "2016-08-30";
+  version = "2017-06-28";

  src = fetchFromGitHub {
    owner = "google";
    repo = "fonts";
-    rev = "7a4070f65f2ca85ffdf2d465ff5e095005bae197";
-    sha256 = "0c20vcsd0jki8drrim68z2ca0cxli4wyh1i1gyg4iyac0a0v8wx3";
+    rev = "b1cb16c0ce2402242e0106d15b0429d1b8075ecc";
+    sha256 = "18kyclwipkdv4zxfws87x2l91jwn34vrizw8rmv8lqznnfsjh2lg";
  };

  outputHashAlgo = "sha256";
  outputHashMode = "recursive";
-  outputHash = "13n2icpdp1z7i14rnfwkjdydhbjgdvyl1crd71hfy6l1j2p3kzyf";
+  outputHash = "0n0j2hi1qb2sc6p3v6lpaqb2aq0m9xjmi7apz3hf2nx97rrsam22";

  phases = [ "unpackPhase" "patchPhase" "installPhase" ];

--- a/pkgs/data/fonts/terminus-font/default.nix
+++ b/pkgs/data/fonts/terminus-font/default.nix
@ -1,14 +1,14 @@
-{ stdenv, fetchurl, perl, bdftopcf, mkfontdir, mkfontscale }:
+{ stdenv, fetchurl, python3, bdftopcf, mkfontdir, mkfontscale }:

 stdenv.mkDerivation rec {
-  name = "terminus-font-4.40";
+  name = "terminus-font-4.46";

  src = fetchurl {
    url = "mirror://sourceforge/project/terminus-font/${name}/${name}.tar.gz";
-    sha256 = "0487cyx5h1f0crbny5sg73a22gmym5vk1i7646gy7hgiscj2rxb4";
+    sha256 = "1kavqw38aarz0vpwz4b7l6l8xkyc5096zaf9ypqnvdwraqz46aaf";
  };

-  buildInputs = [ perl bdftopcf mkfontdir mkfontscale ];
+  buildInputs = [ python3 bdftopcf mkfontdir mkfontscale ];

  patchPhase = ''
    substituteInPlace Makefile --replace 'fc-cache' '#fc-cache'
--- a/pkgs/data/misc/hackage/default.nix
+++ b/pkgs/data/misc/hackage/default.nix
@ -6,6 +6,6 @@
 fetchFromGitHub {
  owner = "commercialhaskell";
  repo = "all-cabal-hashes";
-  rev = "60443435510c1523ae4596f20595a274531dd485";
-  sha256 = "1k3c0ix5rax92ywrpjxd7cmbzwsgrv03s6dvq6wjm8vljchqg4li";
+  rev = "43b26c8a8f64f6caf7b4345eff0099798adcac28";
+  sha256 = "1yfaxzgdrf7cifz4qq462amja2iq7r99nvpggggs8scwg4dz1i0b";
 }
--- a/pkgs/desktops/gnome-3/3.22/apps/ghex/default.nix
+++ b/pkgs/desktops/gnome-3/3.22/apps/ghex/default.nix
@ -0,0 +1,17 @@
+{ stdenv, fetchurl, pkgconfig, gnome3, intltool, itstool, libxml2,
+  wrapGAppsHook }:
+
+stdenv.mkDerivation rec {
+  inherit (import ./src.nix fetchurl) name src;
+
+  nativeBuildInputs = [ pkgconfig wrapGAppsHook ];
+
+  buildInputs = [ gnome3.gtk intltool itstool libxml2 ];
+
+  meta = with stdenv.lib; {
+    homepage = https://wiki.gnome.org/Apps/Ghex;
+    description = "Hex editor for GNOME desktop environment";
+    platforms = platforms.linux;
+    maintainers = gnome3.maintainers;
+  };
+}
--- a/pkgs/desktops/gnome-3/3.22/apps/ghex/src.nix
+++ b/pkgs/desktops/gnome-3/3.22/apps/ghex/src.nix
@ -0,0 +1,10 @@
+# Autogenerated by maintainers/scripts/gnome.sh update
+
+fetchurl: {
+  name = "ghex-3.18.3";
+
+  src = fetchurl {
+    url = mirror://gnome/sources/ghex/3.18/ghex-3.18.3.tar.xz;
+    sha256 = "c67450f86f9c09c20768f1af36c11a66faf460ea00fbba628a9089a6804808d3";
+  };
+}
--- a/pkgs/desktops/gnome-3/3.22/core/evince/default.nix
+++ b/pkgs/desktops/gnome-3/3.22/core/evince/default.nix
@ -4,12 +4,23 @@
 , librsvg, gobjectIntrospection
 , recentListSize ? null # 5 is not enough, allow passing a different number
 , supportXPS ? false    # Open XML Paper Specification via libgxps
+, fetchpatch, autoreconfHook
 }:

 stdenv.mkDerivation rec {
  inherit (import ./src.nix fetchurl) name src;

-  nativeBuildInputs = [ pkgconfig wrapGAppsHook ];
+  patches = [
+    (fetchpatch {
+      name = "CVE-2017-1000083"; # https://bugzilla.gnome.org/show_bug.cgi?id=784630
+      url = "https://git.gnome.org/browse/evince/patch/?id=fa072dbbfd96";
+      sha256 = "12xg00jvbsh54dr2dyq2ha5a05x2bpzd1lh2k3sppq3h7a02lsjy";
+    })
+  ];
+  # missing help for now; fixing the autogen phase seemed too difficult
+  postPatch = "sed '/@YELP_HELP_RULES@/d' -i help/Makefile.am";
+
+  nativeBuildInputs = [ pkgconfig wrapGAppsHook autoreconfHook/*for patches*/ ];

  buildInputs = [
    intltool perl perlXMLParser libxml2
@ -43,6 +54,8 @@ stdenv.mkDerivation rec {
    gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "${shared_mime_info}/share")
  '';

+  enableParallelBuilding = true;
+
  doCheck = false; # would need pythonPackages.dogTail, which is missing

  meta = with stdenv.lib; {
--- a/pkgs/desktops/gnome-3/3.22/core/evince/src.nix
+++ b/pkgs/desktops/gnome-3/3.22/core/evince/src.nix
@ -1,10 +1,10 @@
 # Autogenerated by maintainers/scripts/gnome.sh update

 fetchurl: {
-  name = "evince-3.22.0";
+  name = "evince-3.22.1";

  src = fetchurl {
-    url = mirror://gnome/sources/evince/3.22/evince-3.22.0.tar.xz;
-    sha256 = "22ebabf890057e8b43020ffdebdbb57d6a586beba031838f0f0c8a596c479d46";
+    url = mirror://gnome/sources/evince/3.22/evince-3.22.1.tar.xz;
+    sha256 = "f3d439db3b5a5745d26175d615a71dffa1535235b1e3aa0b85d397ea33ab231c";
  };
 }
--- a/pkgs/desktops/gnome-3/3.22/core/gnome-control-center/default.nix
+++ b/pkgs/desktops/gnome-3/3.22/core/gnome-control-center/default.nix
@ -1,4 +1,4 @@
-{ fetchurl, stdenv, pkgconfig, gnome3, ibus, intltool, upower, makeWrapper
+{ fetchurl, stdenv, pkgconfig, gnome3, ibus, intltool, upower, wrapGAppsHook
 , libcanberra_gtk2, libcanberra_gtk3, accountsservice, libpwquality, libpulseaudio
 , gdk_pixbuf, librsvg, libxkbfile, libnotify, libgudev
 , libxml2, polkit, libxslt, libgtop, libsoup, colord, colord-gtk
@ -20,14 +20,14 @@ stdenv.mkDerivation rec {
  enableParallelBuilding = false;

  buildInputs = with gnome3;
-    [ pkgconfig intltool ibus gtk glib upower libcanberra_gtk2 gsettings_desktop_schemas
+    [ pkgconfig intltool ibus gtk glib glib_networking upower libcanberra_gtk2 gsettings_desktop_schemas
      libxml2 gnome_desktop gnome_settings_daemon polkit libxslt libgtop gnome-menus
      gnome_online_accounts libsoup colord libpulseaudio fontconfig colord-gtk libpwquality
      accountsservice libkrb5 networkmanagerapplet libwacom samba libnotify libxkbfile
      shared_mime_info icu libtool docbook_xsl docbook_xsl_ns gnome3.grilo
      gdk_pixbuf gnome3.defaultIconTheme librsvg clutter clutter_gtk
-      gnome3.vino udev libcanberra_gtk3 libgudev
-      networkmanager modemmanager makeWrapper gnome3.gnome-bluetooth grilo tracker
+      gnome3.vino udev libcanberra_gtk3 libgudev wrapGAppsHook
+      networkmanager modemmanager gnome3.gnome-bluetooth grilo tracker
      cracklib ];

  preBuild = ''
@ -39,9 +39,6 @@ stdenv.mkDerivation rec {
  '';

  preFixup = with gnome3; ''
-    wrapProgram $out/bin/gnome-control-center \
-      --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
-      --prefix XDG_DATA_DIRS : "${gnome3.gnome_themes_standard}/share:${sound-theme-freedesktop}/share:$out/share:$out/share/gnome-control-center:$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH"
    for i in $out/share/applications/*; do
      substituteInPlace $i --replace "gnome-control-center" "$out/bin/gnome-control-center"
    done
--- a/pkgs/desktops/gnome-3/3.22/core/gnome-online-accounts/default.nix
+++ b/pkgs/desktops/gnome-3/3.22/core/gnome-online-accounts/default.nix
@ -1,6 +1,6 @@
-{ stdenv, fetchurl, pkgconfig, glib, libxslt, gtk, makeWrapper
+{ stdenv, fetchurl, pkgconfig, glib, libxslt, gtk, wrapGAppsHook
 , webkitgtk, json_glib, rest, libsecret, dbus_glib, gnome_common
-, telepathy_glib, intltool, dbus_libs, icu
+, telepathy_glib, intltool, dbus_libs, icu, glib_networking
 , libsoup, docbook_xsl_ns, docbook_xsl, gnome3
 }:

@ -11,16 +11,10 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

-  buildInputs = [ pkgconfig glib libxslt gtk webkitgtk json_glib rest gnome_common makeWrapper
-                  libsecret dbus_glib telepathy_glib intltool icu libsoup
+  buildInputs = [ pkgconfig glib libxslt gtk webkitgtk json_glib rest gnome_common wrapGAppsHook
+                  libsecret dbus_glib telepathy_glib glib_networking intltool icu libsoup
                  docbook_xsl_ns docbook_xsl gnome3.defaultIconTheme ];

-  preFixup = ''
-    for f in "$out/libexec/"*; do
-      wrapProgram "$f" --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH"
-    done
-  '';
-
  meta = with stdenv.lib; {
    platforms = platforms.linux;
    maintainers = gnome3.maintainers;
--- a/pkgs/desktops/gnome-3/3.22/default.nix
+++ b/pkgs/desktops/gnome-3/3.22/default.nix
@ -268,6 +268,8 @@ let

  gedit = callPackage ./apps/gedit { };

+  ghex = callPackage ./apps/ghex { };
+
  glade = callPackage ./apps/glade { };

  gnome-boxes = callPackage ./apps/gnome-boxes { };
--- a/pkgs/development/compilers/llvm/4/default.nix
+++ b/pkgs/development/compilers/llvm/4/default.nix
@ -16,7 +16,7 @@ let
  # Add man output without introducing extra dependencies.
  overrideManOutput = drv:
    let drv-manpages = drv.override { enableManpages = true; }; in
-    drv // { man = drv-manpages.man; outputs = drv.outputs ++ ["man"]; };
+    drv // { man = drv-manpages.man; /*outputs = drv.outputs ++ ["man"];*/ };

  llvm = callPackage ./llvm.nix {
    inherit compiler-rt_src stdenv;
--- a/pkgs/development/compilers/ocaml/4.05.nix
+++ b/pkgs/development/compilers/ocaml/4.05.nix
@ -0,0 +1,9 @@
+import ./generic.nix {
+  major_version = "4";
+  minor_version = "05";
+  patch_version = "0";
+  sha256 = "1y9fw1ci9pwnbbrr9nwr8cq8vypcxwdf4akvxard3mxl2jx2g984";
+
+  # If the executable is stipped it does not work
+  dontStrip = true;
+}
--- a/pkgs/development/compilers/purescript/psc-package/default.nix
+++ b/pkgs/development/compilers/purescript/psc-package/default.nix
@ -4,13 +4,13 @@ with lib;

 mkDerivation rec {
  pname = "psc-package";
-  version = "0.1.1";
+  version = "0.2.0";

  src = fetchFromGitHub {
    owner = "purescript";
    repo = pname;
    rev = "v${version}";
-    sha256 = "078xjn10yq4i0ff78bxscvxhn29p3s7iwv3pjyqxzlhaymn5949l";
+    sha256 = "0vid8vc8n8xj0qa4gnm1any9s18rdh7yn960vgix17r7a3bdndwb";
  };

  isLibrary = false;
--- a/pkgs/development/compilers/solc/default.nix
+++ b/pkgs/development/compilers/solc/default.nix
@ -1,9 +1,9 @@
 { stdenv, fetchzip, fetchgit, boost, cmake }:

 let
-  version = "0.4.12";
-  rev = "194ff033ae44944ac59aa7bd3da89ba94ec5893c";
-  sha256 = "0gkg3nay0625qmhxxxax1d1c4dl554ri3pkwd12qfg6g1w6j04w7";
+  version = "0.4.13";
+  rev = "0fb4cb1ab9bb4b6cc72e28cc5a1753ad14781f14";
+  sha256 = "0rhrm0bmk5s2358j40yx7dzr1938q17dchzflrxw6y7yvkhscxrm";
  jsoncppURL = https://github.com/open-source-parsers/jsoncpp/archive/1.7.7.tar.gz;
  jsoncpp = fetchzip {
    url = jsoncppURL;
@ -27,6 +27,9 @@ stdenv.mkDerivation {
      --replace '${jsoncppURL}' ${jsoncpp}
    substituteInPlace cmake/EthCompilerSettings.cmake \
      --replace 'add_compile_options(-Werror)' ""
+    substituteInPlace cmake/EthDependencies.cmake \
+      --replace 'set(Boost_USE_STATIC_LIBS ON)'   \
+                'set(Boost_USE_STATIC_LIBS OFF)'
  '';

  buildInputs = [ boost cmake ];
@ -36,6 +39,7 @@ stdenv.mkDerivation {
    longDescription = "This package also includes `lllc', the LLL compiler.";
    homepage = https://github.com/ethereum/solidity;
    license = stdenv.lib.licenses.gpl3;
+    platforms = with stdenv.lib.platforms; linux ++ darwin;
    maintainers = [ stdenv.lib.maintainers.dbrock ];
    inherit version;
  };
--- a/pkgs/development/compilers/tinycc/default.nix
+++ b/pkgs/development/compilers/tinycc/default.nix
@ -2,10 +2,10 @@
 with stdenv.lib;

 let
-  date = "20170605";
+  date = "20170710";
  version = "0.9.27pre-${date}";
-  rev = "3e4b7693bfd5b76570b35558c83a935326513eff";
-  sha256 = "0m5k1df73kakvg9xz06y3nlac4mwfccni6hdijaf4w8fyy3zz4bg";
+  rev = "2acb04f7f2077a4cff103421d79ceee48441918a";
+  sha256 = "1rh89dx1myqfm752d4rlzrm8aadfm17fm88ps0q9ibmbxavb45qw";
 in

 stdenv.mkDerivation rec {
--- a/pkgs/development/compilers/zulu/default.nix
+++ b/pkgs/development/compilers/zulu/default.nix
@ -1,17 +1,28 @@
-{ stdenv, pkgs, fetchurl, unzip, makeWrapper, setJavaClassPath, swingSupport ? true }:
-
-with pkgs;
+{ stdenv, lib, fetchurl, unzip, makeWrapper, setJavaClassPath
+, zulu, glib, libxml2, libav_0_8, ffmpeg, libxslt, mesa_noglu, alsaLib
+, fontconfig, freetype, gnome2, cairo, gdk_pixbuf, atk, xorg
+, swingSupport ? true }:

 let
-  version = "8.19.0.1";
-  openjdk = "8.0.112";
+  version = "8.21.0.1";
+  openjdk = "8.0.131";

-  sha256_linux = "1icb6in1197n44wk2cqnrxr7w0bd5abxxysfrhbg56jlb9nzmp4x";
-  sha256_darwin = "0kxwh62a6kckc9l9jkgakf86lqkqazp3dwfwaxqc4cg5zczgbhmd";
+  sha256_linux = "0cr1wvk1ifdq69ia8sr6171yzciba8l5x7dszwa5g2v0vmmqq88p";
+  sha256_darwin = "0xq9bdzbdq8wq48gj6j56bw30l2iafz6sy1wdhrf92n9bnz5qmw7";

  platform = if stdenv.isDarwin then "macosx" else "linux";
  hash = if stdenv.isDarwin then sha256_darwin else sha256_linux;
  extension = if stdenv.isDarwin then "zip" else "tar.gz";
+
+  libraries = [
+    stdenv.cc.libc glib libxml2 libav_0_8 ffmpeg libxslt mesa_noglu
+    xorg.libXxf86vm alsaLib fontconfig freetype gnome2.pango
+    gnome2.gtk cairo gdk_pixbuf atk
+  ] ++ (lib.optionals swingSupport (with xorg; [
+    xorg.libX11 xorg.libXext xorg.libXtst xorg.libXi xorg.libXp
+    xorg.libXt xorg.libXrender stdenv.cc.cc
+  ]));
+
 in stdenv.mkDerivation rec {
  inherit version openjdk platform hash extension;

@ -22,7 +33,7 @@ in stdenv.mkDerivation rec {
    sha256 = hash;
  };

-  buildInputs = [ makeWrapper ] ++ stdenv.lib.optional stdenv.isDarwin [ unzip ];
+  buildInputs = [ makeWrapper ] ++ lib.optional stdenv.isDarwin unzip;

  installPhase = ''
    mkdir -p $out
@ -51,9 +62,6 @@ in stdenv.mkDerivation rec {
    EOF
  '';

-  libraries = [ stdenv.cc.libc glib libxml2 libav_0_8 ffmpeg libxslt mesa_noglu xorg.libXxf86vm alsaLib fontconfig freetype gnome2.pango gnome2.gtk cairo gdk_pixbuf atk ]
-      ++ (if swingSupport then [ xorg.libX11 xorg.libXext xorg.libXtst xorg.libXi xorg.libXp xorg.libXt xorg.libXrender stdenv.cc.cc ] else [ ]);
-
  rpath = stdenv.lib.strings.makeLibraryPath libraries;

  passthru = {
@ -64,8 +72,11 @@ in stdenv.mkDerivation rec {
    homepage = https://www.azul.com/products/zulu/;
    license = licenses.gpl2;
    description = "Certified builds of OpenJDK";
-    longDescription = "Certified builds of OpenJDK that can be deployed across multiple operating systems, containers, hypervisors and Cloud platforms";
-    maintainers = with maintainers; [ nequissimus ];
+    longDescription = ''
+      Certified builds of OpenJDK that can be deployed across multiple
+      operating systems, containers, hypervisors and Cloud platforms.
+    '';
+    maintainers = with maintainers; [ nequissimus fpletz ];
    platforms = [ "x86_64-linux" "x86_64-darwin" ];
  };
 }
--- a/pkgs/development/haskell-modules/configuration-ghc-8.2.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-8.2.x.nix
@ -39,8 +39,8 @@ self: super: {
  # cabal-install can use the native Cabal library.
  cabal-install = super.cabal-install.override { Cabal = null; };

-  # jailbreak-cabal can use the native Cabal library.
-  jailbreak-cabal = super.jailbreak-cabal.override { Cabal = null; };
+  # jailbreak-cabal doesn't seem to work right with the native Cabal version.
+  jailbreak-cabal = pkgs.haskellPackages.jailbreak-cabal;

  # https://github.com/bmillwood/applicative-quoters/issues/6
  applicative-quoters = appendPatch super.applicative-quoters (pkgs.fetchpatch {
@ -60,11 +60,16 @@ self: super: {
  ghc-syb-utils = dontCheck super.ghc-syb-utils;

  # Older, LTS-8-based versions don't compile.
-  vector = super.vector_0_12_0_1;
+  base-orphans = self.base-orphans_0_6;
+  hspec-meta = self.hspec-meta_2_4_4;
+  lens = self.lens_4_15_3;
  primitive = self.primitive_0_6_2_0;
+  semigroupoids = self.semigroupoids_5_2;
  syb = self.syb_0_7;
+  vector = super.vector_0_12_0_1;

  # Work around overly restrictive constraints on the version of 'base'.
-  doctest = doJailbreak super.doctest;
+  ChasingBottoms = doJailbreak super.ChasingBottoms;
+  hashable = doJailbreak super.hashable;

 }
--- a/pkgs/development/haskell-modules/configuration-ghcjs.nix
+++ b/pkgs/development/haskell-modules/configuration-ghcjs.nix
@ -150,6 +150,17 @@ self: super:
  http2 = addBuildDepends super.http2 [ self.aeson self.aeson-pretty self.hex self.unordered-containers self.vector self.word8 ];
  # ghcjsBoot uses async 2.0.1.6, protolude wants 2.1.*

+  # These are the correct dependencies specified when calling `cabal2nix --compiler ghcjs`
+  # By default, the `miso` derivation present in hackage-packages.nix
+  # does not contain dependencies suitable for ghcjs
+  miso = overrideCabal super.miso (drv: {
+      libraryHaskellDepends = with self; [
+        BoundedChan bytestring containers ghcjs-base aeson base
+        http-api-data http-types network-uri scientific servant text
+        transformers unordered-containers vector
+      ];
+    });
+
  pqueue = overrideCabal super.pqueue (drv: {
    postPatch = ''
      sed -i -e '12s|null|Data.PQueue.Internals.null|' Data/PQueue/Internals.hs
--- a/pkgs/development/interpreters/elixir/1.5.nix
+++ b/pkgs/development/interpreters/elixir/1.5.nix
@ -1,7 +1,7 @@
 { mkDerivation }:

 mkDerivation rec {
-  version = "1.5.0-rc.0";
-  sha256 = "1p0sawz86w9na56c42ivdacqxzldjb9s9cvl2isj3sy4nwsa0l0j";
+  version = "1.5.0-rc.1";
+  sha256 = "1aqbhyzwjqg57f99kwqzxkk4gjaqgwb7nmgpgdp7psa0ly742i9q";
  minimumOTPVersion = "18";
 }
--- a/pkgs/development/interpreters/jruby/default.nix
+++ b/pkgs/development/interpreters/jruby/default.nix
@ -3,11 +3,11 @@
 stdenv.mkDerivation rec {
  name = "jruby-${version}";

-  version = "9.1.5.0";
+  version = "9.1.12.0";

  src = fetchurl {
    url = "https://s3.amazonaws.com/jruby.org/downloads/${version}/jruby-bin-${version}.tar.gz";
-    sha256 = "0rmpbg62cy06pq8xxmnkqc2m2c5kg1kj816wbrf7qjdlzfpg7r18";
+    sha256 = "15x5w4awy8h6xfkbj0p4xnb68xzfrss1rf2prk0kzk5kyjakrcnx";
  };

  buildInputs = [ makeWrapper ];
--- a/pkgs/development/libraries/apr-util/default.nix
+++ b/pkgs/development/libraries/apr-util/default.nix
@ -13,11 +13,11 @@ assert ldapSupport -> openldap != null;
 with stdenv.lib;

 stdenv.mkDerivation rec {
-  name = "apr-util-1.5.4";
+  name = "apr-util-1.6.0";

  src = fetchurl {
    url = "mirror://apache/apr/${name}.tar.bz2";
-    sha256 = "0bn81pfscy9yjvbmyx442svf43s6dhrdfcsnkpxz43fai5qk5kx6";
+    sha256 = "0k6a90d67xl36brz69s7adgkswjmw7isnjblm1naqmjblwzwjx44";
  };

  patches = optional stdenv.isFreeBSD ./include-static-dependencies.patch;
--- a/pkgs/development/libraries/apr/default.nix
+++ b/pkgs/development/libraries/apr/default.nix
@ -1,11 +1,11 @@
 { stdenv, fetchurl }:

 stdenv.mkDerivation rec {
-  name = "apr-1.5.2";
+  name = "apr-1.6.2";

  src = fetchurl {
    url = "mirror://apache/apr/${name}.tar.bz2";
-    sha256 = "0ypn51xblix5ys9xy7da3ngdydip0qqh9rdq8nz54w9aq8lys0vx";
+    sha256 = "1gffipa87pflvgvw01dbkvgh75p8n2sr56m1pcl01avv6zm9q409";
  };

  patches = stdenv.lib.optionals stdenv.isDarwin [ ./is-this-a-compiler-bug.patch ];
--- a/pkgs/development/libraries/getdata/default.nix
+++ b/pkgs/development/libraries/getdata/default.nix
@ -1,12 +1,14 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, libtool }:
 stdenv.mkDerivation rec {
  name = "getdata-${version}";
-  version = "0.9.4";
+  version = "0.10.0";
  src = fetchurl {
    url = "mirror://sourceforge/getdata/${name}.tar.xz";
-    sha256 = "0kikla8sxv6f1rlh77m86dajcsa7b1029zb8iigrmksic27mj9ja";
+    sha256 = "18xbb32vygav9x6yz0gdklif4chjskmkgp06rwnjdf9myhia0iym";
  };

+  buildInputs = [ libtool ];
+
  meta = with stdenv.lib; {
    description = "Reference implementation of the Dirfile Standards";
    license = licenses.lgpl21Plus;
--- a/pkgs/development/libraries/goffice/default.nix
+++ b/pkgs/development/libraries/goffice/default.nix
@ -2,11 +2,11 @@
 , libgsf, libxml2, libxslt, cairo, pango, librsvg, libspectre }:

 stdenv.mkDerivation rec {
-  name = "goffice-0.10.34";
+  name = "goffice-0.10.35";

  src = fetchurl {
    url = "mirror://gnome/sources/goffice/0.10/${name}.tar.xz";
-    sha256 = "554a75a22b5863b3b17595148bee6462122f2dbf031dfa78b61e941e3c2dd603";
+    sha256 = "c19001afca09dc5446e06605a113d81a57124018a09c5889aeebba16cf1d5738";
  };

  nativeBuildInputs = [ pkgconfig intltool ];
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@ -4,6 +4,7 @@
 , libvpx, speex, flac, taglib, libshout
 , cairo, gdk_pixbuf, aalib, libcaca
 , libsoup, libpulseaudio, libintlOrEmpty
+, darwin
 }:

 let
@ -40,6 +41,7 @@ stdenv.mkDerivation rec {
    libsoup libshout
  ]
  ++ libintlOrEmpty
+  ++ optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Cocoa ]
  ++ optionals stdenv.isLinux [ libv4l libpulseaudio libavc1394 libiec61883 ];

  preFixup = ''
--- a/pkgs/development/libraries/libraw/default.nix
+++ b/pkgs/development/libraries/libraw/default.nix
@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
    description = "Library for reading RAW files obtained from digital photo cameras (CRW/CR2, NEF, RAF, DNG, and others)";
    homepage = http://www.libraw.org/;
    license = stdenv.lib.licenses.gpl2Plus;
-    platforms = stdenv.lib.platforms.linux;
+    platforms = stdenv.lib.platforms.unix;
  };
 }

--- a/pkgs/development/libraries/libspectre/default.nix
+++ b/pkgs/development/libraries/libspectre/default.nix
@ -28,6 +28,6 @@ stdenv.mkDerivation rec {
    '';

    license = stdenv.lib.licenses.gpl2Plus;
-    platforms = stdenv.lib.platforms.linux;
+    platforms = stdenv.lib.platforms.unix;
  };
 }
--- a/pkgs/development/libraries/libvirt/default.nix
+++ b/pkgs/development/libraries/libvirt/default.nix
@ -74,6 +74,8 @@ stdenv.mkDerivation rec {
    substituteInPlace $out/libexec/libvirt-guests.sh \
      --replace "$out/bin" "${gettext}/bin" \
      --replace "lock/subsys" "lock"
+    sed -e "/gettext\.sh/a \\\n# Added in nixpkgs:\ngettext() { \"${gettext}/bin/gettext\" \"\$@\"; }" \
+        -i "$out/libexec/libvirt-guests.sh"
  '' + optionalString stdenv.isLinux ''
    rm $out/lib/systemd/system/{virtlockd,virtlogd}.*
    wrapProgram $out/sbin/libvirtd \
--- a/pkgs/development/libraries/matio/default.nix
+++ b/pkgs/development/libraries/matio/default.nix
@ -1,9 +1,9 @@
 { stdenv, fetchurl }:
 stdenv.mkDerivation rec {
-  name = "matio-1.5.9";
+  name = "matio-1.5.10";
  src = fetchurl {
    url = "mirror://sourceforge/matio/${name}.tar.gz";
-    sha256 = "0p60c3wdj4w7v7hzdc0iivciq4hwxzhhx0zq8gpv9i8yhdjzkdxy";
+    sha256 = "00dmg2f5k2xgakp7l0lganz122b1agazw5d899xci35xrqc9j821";
  };

  meta = with stdenv.lib; {
--- a/pkgs/development/libraries/opendht/default.nix
+++ b/pkgs/development/libraries/opendht/default.nix
@ -0,0 +1,48 @@
+{ stdenv
+, fetchFromGitHub
+, autoconf
+, automake
+, libtool
+, pkgconfig
+, nettle
+, gnutls
+, libmsgpack
+, readline
+, libargon2
+}:
+
+stdenv.mkDerivation rec {
+  name = "opendht-${version}";
+  version = "1.3.4";
+
+  src = fetchFromGitHub {
+    owner = "savoirfairelinux";
+    repo = "opendht";
+    rev = "${version}";
+    sha256 = "0karj37f0zq39w0ip8ahrjr6lcrrn9jd6bpzylp1m92jzs8pfki8";
+  };
+
+  buildInputs = [
+    autoconf
+    automake
+    libtool
+    pkgconfig
+    nettle
+    gnutls
+    libmsgpack
+    readline
+    libargon2
+  ];
+
+  preConfigure = ''
+    ./autogen.sh
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A C++11 Kademlia distributed hash table implementation";
+    homepage = https://github.com/savoirfairelinux/opendht;
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ taeer olynch ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/development/node-packages/node-packages-v4.nix
+++ b/pkgs/development/node-packages/node-packages-v4.nix
--- a/pkgs/development/node-packages/node-packages-v6.json
+++ b/pkgs/development/node-packages/node-packages-v6.json
@ -15,6 +15,7 @@
 , "eslint"
 , "eslint_d"
 , "emojione"
+, "fast-cli"
 , "fetch-bower"
 , "forever"
 , "git-run"
@ -30,6 +31,7 @@
 , "jayschema"
 , "jshint"
 , "json"
+, "js-beautify"
 , "jsontool"
 , "json-server"
 , "js-yaml"
--- a/pkgs/development/node-packages/node-packages-v6.nix
+++ b/pkgs/development/node-packages/node-packages-v6.nix
--- a/pkgs/development/ocaml-modules/camomile/0.8.2.nix
+++ b/pkgs/development/ocaml-modules/camomile/0.8.2.nix
@ -1,5 +1,9 @@
 {stdenv, fetchurl, ocaml, findlib, camlp4}:

+if stdenv.lib.versionAtLeast ocaml.version "4.05"
+then throw "camomile-0.8.2 is not available for OCaml ${ocaml.version}"
+else
+
 stdenv.mkDerivation rec {
  name = "camomile-${version}";
  version = "0.8.2";
--- a/pkgs/development/ocaml-modules/camomile/default.nix
+++ b/pkgs/development/ocaml-modules/camomile/default.nix
@ -1,4 +1,4 @@
-{stdenv, fetchurl, ocaml, findlib, camlp4}:
+{stdenv, fetchurl, fetchpatch, ocaml, findlib, camlp4}:

 stdenv.mkDerivation rec {
  name = "camomile-${version}";
@ -9,6 +9,11 @@ stdenv.mkDerivation rec {
    sha256 = "003ikpvpaliy5hblhckfmln34zqz0mk3y2m1fqvbjngh3h2np045";
  };

+  patches = [ (fetchpatch {
+    url = https://raw.githubusercontent.com/ocaml/opam-repository/master/packages/camomile/camomile.0.8.5/files/4.05-typing-fix.patch;
+    sha256 = "167279lia6qx62mdcyc5rjsi4gf4yi52wn9mhgd9y1v3754z7fwb";
+  })];
+
  buildInputs = [ocaml findlib camlp4];

  createFindlibDestdir = true;
--- a/pkgs/development/ocaml-modules/csv/default.nix
+++ b/pkgs/development/ocaml-modules/csv/default.nix
@ -1,19 +1,35 @@
-{ stdenv, fetchzip, ocaml, findlib, ocamlbuild }:
+{ stdenv, fetchzip, ocaml, findlib, ocamlbuild, ocaml_lwt }:
+
+let param =
+  if stdenv.lib.versionAtLeast ocaml.version "4.2"
+  then {
+    version = "1.7";
+    url = https://math.umons.ac.be/anum/software/csv/csv-1.7.tar.gz;
+    sha256 = "1mmcjiiz0jppgipavpph5kn04xcpalw4scbjrw2z3drghvr3qqwf";
+    lwtSupport = true;
+  } else {
+    version = "1.5";
+    url = https://github.com/Chris00/ocaml-csv/releases/download/1.5/csv-1.5.tar.gz;
+    sha256 = "1ca7jgg58j24pccs5fshis726s06fdcjshnwza5kwxpjgdbvc63g";
+    lwtSupport = false;
+  };
+in

 stdenv.mkDerivation {

-  name = "ocaml-csv-1.5";
+  name = "ocaml${ocaml.version}-csv-${param.version}";

  src = fetchzip {
-    url = https://github.com/Chris00/ocaml-csv/releases/download/1.5/csv-1.5.tar.gz;
-    sha256 = "1ca7jgg58j24pccs5fshis726s06fdcjshnwza5kwxpjgdbvc63g";
+    inherit (param) url sha256;
  };

-  buildInputs = [ ocaml findlib ocamlbuild ];
+  buildInputs = [ ocaml findlib ocamlbuild ]
+  ++ stdenv.lib.optional param.lwtSupport ocaml_lwt;

  createFindlibDestdir = true;

-  configurePhase = "ocaml setup.ml -configure --prefix $out --enable-tests";
+  configurePhase = "ocaml setup.ml -configure --prefix $out --enable-tests"
+  + stdenv.lib.optionalString param.lwtSupport " --enable-lwt";

  buildPhase = "ocaml setup.ml -build";

--- a/pkgs/development/ocaml-modules/ctypes/default.nix
+++ b/pkgs/development/ocaml-modules/ctypes/default.nix
@ -2,13 +2,13 @@

 buildOcaml rec {
  name = "ctypes";
-  version = "0.11.2";
+  version = "0.11.5";

  minimumSupportedOcamlVersion = "4";

  src = fetchurl {
    url = "https://github.com/ocamllabs/ocaml-ctypes/archive/${version}.tar.gz";
-    sha256 = "1ml80i8j5lpg3qwc074fks2hgxjq5cfdm9r6cznv605s05ajr3kh";
+    sha256 = "164gyrs6zxr5pyljwpjgd4knwlrkcmamsq3gvkkkvgf9rmhrl3zf";
  };

  buildInputs = [ ncurses pkgconfig ];
--- a/pkgs/development/ocaml-modules/fmt/default.nix
+++ b/pkgs/development/ocaml-modules/fmt/default.nix
@ -1,11 +1,11 @@
 { stdenv, fetchurl, ocaml, findlib, ocamlbuild, opam, topkg, cmdliner, result, uchar }:

 stdenv.mkDerivation {
-  name = "ocaml${ocaml.version}-fmt-0.8.2";
+  name = "ocaml${ocaml.version}-fmt-0.8.4";

  src = fetchurl {
-    url = http://erratique.ch/software/fmt/releases/fmt-0.8.2.tbz;
-    sha256 = "020qz74cm65bzrywf6kylm93gr5x1ayl6hfmxaql995f6whb388i";
+    url = http://erratique.ch/software/fmt/releases/fmt-0.8.4.tbz;
+    sha256 = "1qilsbisqqhmn8b1ar9lvjbgz8vf4gmqwqjnnjzgld2a3gmh8qvv";
  };

  unpackCmd = "tar xjf $src";
--- a/pkgs/development/ocaml-modules/fpath/default.nix
+++ b/pkgs/development/ocaml-modules/fpath/default.nix
@ -1,10 +1,10 @@
 { stdenv, fetchurl, ocaml, findlib, ocamlbuild, opam, topkg, astring }:

 stdenv.mkDerivation {
-  name = "ocaml${ocaml.version}-fpath-0.7.1";
+  name = "ocaml${ocaml.version}-fpath-0.7.2";
  src = fetchurl {
-    url = http://erratique.ch/software/fpath/releases/fpath-0.7.1.tbz;
-    sha256 = "05134ij27xjl6gaqsc65yl19vfj6cjxq3mbm9bf4mija8grdpn6g";
+    url = http://erratique.ch/software/fpath/releases/fpath-0.7.2.tbz;
+    sha256 = "1hr05d8bpqmqcfdavn4rjk9rxr7v2zl84866f5knjifrm60sxqic";
  };

  unpackCmd = "tar xjf $src";
--- a/pkgs/development/ocaml-modules/gapi-ocaml/default.nix
+++ b/pkgs/development/ocaml-modules/gapi-ocaml/default.nix
@ -1,10 +1,13 @@
-{ stdenv, fetchurl, ocaml, findlib, ocamlbuild, ocurl, cryptokit, ocaml_extlib, yojson, ocamlnet, xmlm }:
+{ stdenv, fetchFromGitHub, ocaml, findlib, ocamlbuild, ocurl, cryptokit, ocaml_extlib, yojson, ocamlnet, xmlm }:

 stdenv.mkDerivation rec {
-  name = "gapi-ocaml-0.3.1";
-  src = fetchurl {
-    url = "https://forge.ocamlcore.org/frs/download.php/1665/${name}.tar.gz";
-    sha256 = "1fn563k9mpqp61909l5bzddnkyn04bk106vrcr7qiim1d2i6cf8i";
+  name = "gapi-ocaml-${version}";
+  version = "0.3.4";
+  src = fetchFromGitHub {
+    owner = "astrada";
+    repo = "gapi-ocaml";
+    rev = "v${version}";
+    sha256 = "07p6p108fyf9xz54jbcld40k3r9zyybxmr5i3rrkhgwm8gb6sbhv";
  };
  buildInputs = [ ocaml findlib ocamlbuild ];
  propagatedBuildInputs = [ ocurl cryptokit ocaml_extlib yojson ocamlnet xmlm ];
--- a/pkgs/development/ocaml-modules/integers/default.nix
+++ b/pkgs/development/ocaml-modules/integers/default.nix
@ -0,0 +1,24 @@
+{ stdenv, fetchurl, ocaml, findlib, ocamlbuild, topkg, opam }:
+
+stdenv.mkDerivation {
+	name = "ocaml${ocaml.version}-integers-0.2.2";
+
+	src = fetchurl {
+		url = https://github.com/ocamllabs/ocaml-integers/releases/download/v0.2.2/integers-0.2.2.tbz;
+		sha256 = "08b1ljw88ny3l0mdq6xmffjk8anfc77igryva5jz1p6f4f746ywk";
+	};
+
+	unpackCmd = "tar xjf $src";
+
+	buildInputs = [ ocaml findlib ocamlbuild topkg opam ];
+
+	inherit (topkg) buildPhase installPhase;
+
+	meta = {
+		description = "Various signed and unsigned integer types for OCaml";
+		license = stdenv.lib.licenses.mit;
+		homepage = https://github.com/ocamllabs/ocaml-integers;
+		maintainers = [ stdenv.lib.maintainers.vbgl ];
+		inherit (ocaml.meta) platforms;
+	};
+}
--- a/pkgs/development/ocaml-modules/menhir/default.nix
+++ b/pkgs/development/ocaml-modules/menhir/default.nix
@ -1,11 +1,11 @@
 { stdenv, fetchurl, ocaml, findlib, ocamlbuild
-, version ? if stdenv.lib.versionAtLeast (stdenv.lib.getVersion ocaml) "4.02" then "20170418" else "20140422"
+, version ? if stdenv.lib.versionAtLeast (stdenv.lib.getVersion ocaml) "4.02" then "20170712" else "20140422"
 }@args:

 let
  sha256 =
  if version == "20140422" then "1ki1f2id6a14h9xpv2k8yb6px7dyw8cvwh39csyzj4qpzx7wia0d"
-  else if version == "20170418" then "0avxkighxfr9x3vh2dkc5r1k2w7q2dz005w7syyzr7qjybpavpii"
+  else if version == "20170712" then "006hq3bwj81j67f2k9cgzj5wr4hai8j36925p5n3sd2j01ljsj6a"
  else throw ("menhir: unknown version " ++ version);
 in

--- a/pkgs/development/ocaml-modules/ocsigen-server/default.nix
+++ b/pkgs/development/ocaml-modules/ocsigen-server/default.nix
@ -1,7 +1,7 @@
 {stdenv, fetchurl, ocaml, findlib, which, ocaml_react, ocaml_ssl,
 lwt, ocamlnet, ocaml_pcre, cryptokit, tyxml, ipaddr, zlib,
 libev, openssl, ocaml_sqlite3, tree, uutf, makeWrapper, camlp4
-, pgocaml
+, camlzip, pgocaml
 }:

 let mkpath = p: n:
@ -19,7 +19,7 @@ stdenv.mkDerivation {

  buildInputs = [ocaml which findlib ocaml_react ocaml_ssl lwt
  ocamlnet ocaml_pcre cryptokit tyxml ipaddr zlib libev openssl
-  ocaml_sqlite3 tree uutf makeWrapper camlp4 pgocaml ];
+  ocaml_sqlite3 tree uutf makeWrapper camlp4 pgocaml camlzip ];

  configureFlags = "--root $(out) --prefix /";

--- a/pkgs/development/ocaml-modules/tsdl/default.nix
+++ b/pkgs/development/ocaml-modules/tsdl/default.nix
@ -1,44 +1,40 @@
-{ stdenv, fetchurl, ocaml, findlib, ocamlbuild, ctypes, result, SDL2, pkgconfig, opam }:
+{ stdenv, fetchurl, ocaml, findlib, ocamlbuild, topkg, ctypes, result, SDL2, pkgconfig, opam, ocb-stubblr }:
+
+if !stdenv.lib.versionAtLeast ocaml.version "4.02"
+then throw "tsdl is not available for OCaml ${ocaml.version}"
+else

 let
-  inherit (stdenv.lib) getVersion;
-
  pname = "tsdl";
-  version = "0.9.0";
+  version = "0.9.4";
  webpage = "http://erratique.ch/software/${pname}";
-
 in

 stdenv.mkDerivation {
-  name = "ocaml-${pname}-${version}";
+  name = "ocaml${ocaml.version}-${pname}-${version}";

  src = fetchurl {
    url = "${webpage}/releases/${pname}-${version}.tbz";
-    sha256 = "02x0wsy5nxagxrh07yb2h4yqqy1bxryp2gwrylds0j6ybqsv4shm";
+    sha256 = "13af37w2wybx8yzgjr5zz5l50402ldl614qiwphl1q69hig5mag2";
  };

-  buildInputs = [ ocaml findlib ocamlbuild result pkgconfig opam ];
+  buildInputs = [ ocaml findlib ocamlbuild topkg result pkgconfig opam ocb-stubblr ];
  propagatedBuildInputs = [ SDL2 ctypes ];

  createFindlibDestdir = true;

  unpackCmd = "tar xjf $src";

-  buildPhase = ''
+  preConfigure = ''
    # The following is done to avoid an additional dependency (ncurses)
    # due to linking in the custom bytecode runtime. Instead, just
    # compile directly into a native binary, even if it's just a
    # temporary build product.
    substituteInPlace myocamlbuild.ml \
      --replace ".byte" ".native"
-
-    ocaml pkg/build.ml native=true native-dynlink=true
  '';

-  installPhase = ''
-    opam-installer --script --prefix=$out ${pname}.install | sh
-    ln -s $out/lib/${pname} $out/lib/ocaml/${getVersion ocaml}/site-lib/${pname}
-  '';
+  inherit (topkg) buildPhase installPhase;

  meta = with stdenv.lib; {
    homepage = "${webpage}";
--- a/pkgs/development/python-modules/django/1_11.nix
+++ b/pkgs/development/python-modules/django/1_11.nix
@ -5,13 +5,13 @@
 buildPythonPackage rec {
  pname = "Django";
  name = "${pname}-${version}";
-  version = "1.11.2";
+  version = "1.11.3";

  disabled = pythonOlder "2.7";

  src = fetchurl {
    url = "http://www.djangoproject.com/m/releases/1.11/${name}.tar.gz";
-    sha256 = "05q6bgm3vkdqg72i1m1z8bp2jdrm9n1c37aka1brwkyzh820fnrw";
+    sha256 = "0swgmwnfi6sa5fg5yxcs4k554cj9zp92w5n454xfsibjjl5dxycy";
  };

  patches = [
--- a/Show More
+++ b/Show More