Merge branch 'master' into staging

Hydra: ?compare=1401528

.github/PULL_REQUEST_TEMPLATE.md

@@ -9,7 +9,7 @@
 - Built on platform(s)
    - [ ] NixOS
    - [ ] macOS
-   - [ ] Linux
+   - [ ] other Linux distributions
 - [ ] Tested via one or more NixOS test(s) if existing and applicable for the change (look inside [nixos/tests](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests))
 - [ ] Tested compilation of all pkgs that depend on this change using `nix-shell -p nox --run "nox-review wip"`
 - [ ] Tested execution of all binary files (usually in `./result/bin/`)

README.md

@@ -30,7 +30,7 @@ For pull-requests, please rebase onto nixpkgs `master`.
 * [Documentation (Nix Expression Language chapter)](https://nixos.org/nix/manual/#ch-expression-language)
 * [Manual (How to write packages for Nix)](https://nixos.org/nixpkgs/manual/)
 * [Manual (NixOS)](https://nixos.org/nixos/manual/)
-* [Nix Wiki](https://nixos.org/wiki/) (deprecated, see milestone ["Move the Wiki!"](https://github.com/NixOS/nixpkgs/issues?q=is%3Aopen+is%3Aissue+milestone%3A%22Move+the+wiki%21%22))
+* [Community maintained wiki](https://nixos.wiki/)
 * [Continuous package builds for unstable/master](https://hydra.nixos.org/jobset/nixos/trunk-combined)
 * [Continuous package builds for 17.09 release](https://hydra.nixos.org/jobset/nixos/release-17.09)
 * [Tests for unstable/master](https://hydra.nixos.org/job/nixos/trunk-combined/tested#tabs-constituents)

lib/maintainers.nix

@@ -107,6 +107,7 @@
   chaoflow = "Florian Friesdorf <flo@chaoflow.net>";
   chattered = "Phil Scott <me@philscotted.com>";
   choochootrain = "Hurshal Patel <hurshal@imap.cc>";
+  chpatrick = "Patrick Chilton <chpatrick@gmail.com>";
   chris-martin = "Chris Martin <ch.martin@gmail.com>";
   chrisjefferson = "Christopher Jefferson <chris@bubblescope.net>";
   chrisrosset = "Christopher Rosset <chris@rosset.org.uk>";
@@ -171,6 +172,7 @@
   drewkett = "Andrew Burkett <burkett.andrew@gmail.com>";
   dsferruzza = "David Sferruzza <david.sferruzza@gmail.com>";
   dtzWill = "Will Dietz <nix@wdtz.org>";
+  dupgit = "Olivier Delhomme <olivier.delhomme@free.fr>";
   dywedir = "Vladyslav M. <dywedir@protonmail.ch>";
   e-user = "Alexander Kahl <nixos@sodosopa.io>";
   ebzzry = "Rommel Martinez <ebzzry@ebzzry.io>";
@@ -205,6 +207,7 @@
   falsifian = "James Cook <james.cook@utoronto.ca>";
   fare = "Francois-Rene Rideau <fahree@gmail.com>";
   fgaz = "Francesco Gazzetta <francygazz@gmail.com>";
+  flokli = "Florian Klink <flokli@flokli.de>";
   florianjacob = "Florian Jacob <projects+nixos@florianjacob.de>";
   flosse = "Markus Kohlhase <mail@markus-kohlhase.de>";
   fluffynukeit = "Daniel Austin <dan@fluffynukeit.com>";

nixos/lib/testing.nix

@@ -149,6 +149,7 @@ rec {
           { key = "run-in-machine";
             networking.hostName = "client";
             nix.readOnlyStore = false;
+            virtualisation.writableStore = false;
           }
         ];
 

nixos/modules/config/debug-info.nix

@@ -30,14 +30,15 @@ with lib;
   };
 
 
-  config = {
+  config = mkIf config.environment.enableDebugInfo {
 
     # FIXME: currently disabled because /lib is already in
     # environment.pathsToLink, and we can't have both.
     #environment.pathsToLink = [ "/lib/debug/.build-id" ];
 
-    environment.extraOutputsToInstall =
+    environment.extraOutputsToInstall = [ "debug" ];
-      optional config.environment.enableDebugInfo "debug";
+
+    environment.variables.NIX_DEBUG_INFO_DIRS = [ "/run/current-system/sw/lib/debug" ];
 
   };
 

nixos/modules/hardware/network/intel-2030.nix

@@ -1,3 +0,0 @@
-{
-  hardware.enableRedistributableFirmware = true;
-}

nixos/modules/hardware/network/intel-2100bg.nix

@@ -1,30 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-{
-
-  ###### interface
-
-  options = {
-
-    networking.enableIntel2100BGFirmware = lib.mkOption {
-      default = false;
-      type = lib.types.bool;
-      description = ''
-        Turn on this option if you want firmware for the Intel
-        PRO/Wireless 2100BG to be loaded automatically.  This is
-        required if you want to use this device.
-      '';
-    };
-
-  };
-
-
-  ###### implementation
-
-  config = lib.mkIf config.networking.enableIntel2100BGFirmware {
-
-    hardware.enableRedistributableFirmware = true;
-
-  };
-
-}

nixos/modules/hardware/network/intel-3945abg.nix

@@ -1,29 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-{
-
-  ###### interface
-
-  options = {
-
-    networking.enableIntel3945ABGFirmware = lib.mkOption {
-      default = false;
-      type = lib.types.bool;
-      description = ''
-        This option enables automatic loading of the firmware for the Intel
-        PRO/Wireless 3945ABG.
-      '';
-    };
-
-  };
-
-
-  ###### implementation
-
-  config = lib.mkIf config.networking.enableIntel3945ABGFirmware {
-
-    hardware.enableRedistributableFirmware = true;
-
-  };
-
-}

nixos/modules/hardware/network/intel-4965agn.nix

@@ -1,3 +0,0 @@
-{
-  hardware.enableRedistributableFirmware = true;
-}

nixos/modules/hardware/network/intel-5000.nix

@@ -1,3 +0,0 @@
-{
-  hardware.enableRedistributableFirmware = true;
-}

nixos/modules/hardware/network/intel-5150.nix

@@ -1,3 +0,0 @@
-{
-  hardware.enableRedistributableFirmware = true;
-}

nixos/modules/hardware/network/intel-6000.nix

@@ -1,3 +0,0 @@
-{
-  hardware.enableRedistributableFirmware = true;
-}

nixos/modules/hardware/network/intel-6000g2a.nix

@@ -1,3 +0,0 @@
-{
-  hardware.enableRedistributableFirmware = true;
-}

nixos/modules/hardware/network/intel-6000g2b.nix

@@ -1,3 +0,0 @@
-{
-  hardware.enableRedistributableFirmware = true;
-}

nixos/modules/hardware/network/ralink.nix

@@ -1,26 +0,0 @@
-{pkgs, config, lib, ...}:
-
-{
-
-  ###### interface
-
-  options = {
-
-    networking.enableRalinkFirmware = lib.mkOption {
-      default = false;
-      type = lib.types.bool;
-      description = ''
-        Turn on this option if you want firmware for the RT73 NIC.
-      '';
-    };
-
-  };
-
-
-  ###### implementation
-
-  config = lib.mkIf config.networking.enableRalinkFirmware {
-    hardware.enableRedistributableFirmware = true;
-  };
-
-}

nixos/modules/hardware/network/rtl8192c.nix

@@ -1,26 +0,0 @@
-{pkgs, config, lib, ...}:
-
-{
-
-  ###### interface
-
-  options = {
-
-    networking.enableRTL8192cFirmware = lib.mkOption {
-      default = false;
-      type = lib.types.bool;
-      description = ''
-        Turn on this option if you want firmware for the RTL8192c (and related) NICs.
-      '';
-    };
-
-  };
-
-
-  ###### implementation
-
-  config = lib.mkIf config.networking.enableRTL8192cFirmware {
-    hardware.enableRedistributableFirmware = true;
-  };
-
-}

nixos/modules/installer/scan/detected.nix

@@ -6,8 +6,7 @@ with lib;
 
 {
   config = mkDefault {
-    # Wireless card firmware
+    # Common firmware, i.e. for wifi cards
-    networking.enableIntel2200BGFirmware = true;
+    hardware.enableRedistributableFirmware = true;
-    networking.enableIntel3945ABGFirmware = true;
   };
 }

nixos/modules/installer/tools/nixos-generate-config.pl

@@ -402,7 +402,7 @@ EOF
         if ($status != 0 || join("", @info) =~ /ERROR:/) {
             die "Failed to retrieve subvolume info for $mountPoint\n";
         }
-        my @ids = join("", @info) =~ m/Subvolume ID:[ \t\n]*([0-9]*)/;
+        my @ids = join("\n", @info) =~ m/^(?!\/\n).*Subvolume ID:[ \t\n]*([0-9]+)/s;
         if ($#ids > 0) {
             die "Btrfs subvol name for $mountPoint listed multiple times in mount\n"
         } elsif ($#ids == 0) {

nixos/modules/misc/ids.nix

@@ -296,6 +296,9 @@
       clickhouse = 278;
       rslsync = 279;
       minio = 280;
+      kanboard = 281;
+      pykms = 282;
+      kodi = 283;
 
       # When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!
 
@@ -561,6 +564,9 @@
       clickhouse = 278;
       rslsync = 279;
       minio = 280;
+      kanboard = 281;
+      pykms = 282;
+      kodi = 283;
 
       # When adding a gid, make sure it doesn't match an existing
       # uid. Users and groups with the same name should have equal

nixos/modules/misc/locate.nix

@@ -125,13 +125,16 @@ in {
     warnings = optional (isMLocate && cfg.localuser != null) "mlocate does not support searching as user other than root"
             ++ optional (isFindutils && cfg.pruneNames != []) "findutils locate does not support pruning by directory component"
             ++ optional (isFindutils && cfg.pruneBindMounts) "findutils locate does not support skipping bind mounts";
-  
+
+    # directory creation needs to be separated from main service
+    # because ReadWritePaths fails when the directory doesn't already exist
+    systemd.tmpfiles.rules = [ "d ${dirOf cfg.output} 0755 root root -" ];
+
     systemd.services.update-locatedb =
       { description = "Update Locate Database";
         path = mkIf (!isMLocate) [ pkgs.su ];
         script =
           ''
-            mkdir -m 0755 -p ${dirOf cfg.output}
             exec ${cfg.locate}/bin/updatedb \
               ${optionalString (cfg.localuser != null && ! isMLocate) ''--localuser=${cfg.localuser}''} \
               --output=${toString cfg.output} ${concatStringsSep " " cfg.extraFlags}
@@ -147,8 +150,13 @@ in {
         serviceConfig.PrivateTmp = "yes";
         serviceConfig.PrivateNetwork = "yes";
         serviceConfig.NoNewPrivileges = "yes";
-        serviceConfig.ReadOnlyDirectories = "/";
+        serviceConfig.ReadOnlyPaths = "/";
-        serviceConfig.ReadWriteDirectories = dirOf cfg.output;
+        # Use dirOf cfg.output because mlocate creates temporary files next to
+        # the actual database. We could specify and create them as well,
+        # but that would make this quite brittle when they change something.
+        # NOTE: If /var/cache does not exist, this leads to the misleading error message:
+        # update-locatedb.service: Failed at step NAMESPACE spawning …/update-locatedb-start: No such file or directory
+        serviceConfig.ReadWritePaths = dirOf cfg.output;
       };
 
     systemd.timers.update-locatedb =

nixos/modules/module-list.nix

@@ -35,11 +35,6 @@
   ./hardware/ksm.nix
   ./hardware/mcelog.nix
   ./hardware/network/b43.nix
-  ./hardware/network/intel-2100bg.nix
-  ./hardware/network/intel-2200bg.nix
-  ./hardware/network/intel-3945abg.nix
-  ./hardware/network/ralink.nix
-  ./hardware/network/rtl8192c.nix
   ./hardware/nitrokey.nix
   ./hardware/opengl.nix
   ./hardware/pcmcia.nix
@@ -136,8 +131,6 @@
   ./security/rtkit.nix
   ./security/wrappers/default.nix
   ./security/sudo.nix
-  ./service-managers/docker.nix
-  ./service-managers/trivial.nix
   ./services/admin/salt/master.nix
   ./services/admin/salt/minion.nix
   ./services/amqp/activemq/default.nix
@@ -333,6 +326,7 @@
   ./services/misc/parsoid.nix
   ./services/misc/phd.nix
   ./services/misc/plex.nix
+  ./services/misc/pykms.nix
   ./services/misc/radarr.nix
   ./services/misc/redmine.nix
   ./services/misc/rippled.nix

nixos/modules/profiles/all-hardware.nix

@@ -41,15 +41,12 @@
 
       # Virtio (QEMU, KVM etc.) support.
       "virtio_net" "virtio_pci" "virtio_blk" "virtio_scsi" "virtio_balloon" "virtio_console"
-      
+
       # VMware support.
       "mptspi" "vmw_balloon" "vmwgfx" "vmw_vmci" "vmw_vsock_vmci_transport" "vmxnet3" "vsock"
 
       # Hyper-V support.
       "hv_storvsc"
-
-      # Keyboards
-      "usbhid" "hid_apple" "hid_logitech_dj" "hid_lenovo_tpkbd" "hid_roccat"
     ];
 
   # Include lots of firmware.

nixos/modules/programs/command-not-found/command-not-found.nix

@@ -25,7 +25,14 @@ in
 {
   options.programs.command-not-found = {
 
-    enable = mkEnableOption "command-not-found hook for interactive shell";
+    enable = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        Whether interactive shells should show which Nix package (if
+        any) provides a missing command.
+      '';
+    };
 
     dbPath = mkOption {
       default = "/nix/var/nix/profiles/per-user/root/channels/nixos/programs.sqlite" ;

nixos/modules/programs/zsh/zsh-syntax-highlighting.nix

@@ -5,74 +5,74 @@ with lib;
 let
   cfg = config.programs.zsh.syntaxHighlighting;
 in
-  {
+{
-    options = {
+  options = {
-      programs.zsh.syntaxHighlighting = {
+    programs.zsh.syntaxHighlighting = {
-        enable = mkEnableOption "zsh-syntax-highlighting";
+      enable = mkEnableOption "zsh-syntax-highlighting";
 
-        highlighters = mkOption {
+      highlighters = mkOption {
-          default = [ "main" ];
+        default = [ "main" ];
 
-          # https://github.com/zsh-users/zsh-syntax-highlighting/blob/master/docs/highlighters.md
+        # https://github.com/zsh-users/zsh-syntax-highlighting/blob/master/docs/highlighters.md
-          type = types.listOf(types.enum([
+        type = types.listOf(types.enum([
-            "main"
+          "main"
-            "brackets"
+          "brackets"
-            "pattern"
+          "pattern"
-            "cursor"
+          "cursor"
-            "root"
+          "root"
-            "line"
+          "line"
-          ]));
+        ]));
 
-          description = ''
+        description = ''
-            Specifies the highlighters to be used by zsh-syntax-highlighting.
+          Specifies the highlighters to be used by zsh-syntax-highlighting.
 
-            The following defined options can be found here:
+          The following defined options can be found here:
-            https://github.com/zsh-users/zsh-syntax-highlighting/blob/master/docs/highlighters.md
+          https://github.com/zsh-users/zsh-syntax-highlighting/blob/master/docs/highlighters.md
-          '';
+        '';
-        };
+      };
 
-        patterns = mkOption {
+      patterns = mkOption {
-          default = {};
+        default = {};
-          type = types.attrsOf types.string;
+        type = types.attrsOf types.string;
 
-          example = literalExample ''
+        example = literalExample ''
-            {
+          {
-              "rm -rf *" = "fg=white,bold,bg=red";
+            "rm -rf *" = "fg=white,bold,bg=red";
-            }
+          }
-          '';
+        '';
 
-          description = ''
+        description = ''
-            Specifies custom patterns to be highlighted by zsh-syntax-highlighting.
+          Specifies custom patterns to be highlighted by zsh-syntax-highlighting.
 
-            Please refer to the docs for more information about the usage:
+          Please refer to the docs for more information about the usage:
-            https://github.com/zsh-users/zsh-syntax-highlighting/blob/master/docs/highlighters/pattern.md
+          https://github.com/zsh-users/zsh-syntax-highlighting/blob/master/docs/highlighters/pattern.md
-          '';
+        '';
-        };
       };
     };
+  };
 
-    config = mkIf cfg.enable {
+  config = mkIf cfg.enable {
-      environment.systemPackages = with pkgs; [ zsh-syntax-highlighting ];
+    environment.systemPackages = with pkgs; [ zsh-syntax-highlighting ];
 
-      programs.zsh.interactiveShellInit = with pkgs; with builtins; ''
+    assertions = [
-        source ${zsh-syntax-highlighting}/share/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh
+      {
+        assertion = length(attrNames cfg.patterns) > 0 -> elem "pattern" cfg.highlighters;
+        message = ''
+          When highlighting patterns, "pattern" needs to be included in the list of highlighters.
+        '';
+      }
+    ];
 
-        ${optionalString (length(cfg.highlighters) > 0)
+    programs.zsh.interactiveShellInit = with pkgs;
-          "ZSH_HIGHLIGHT_HIGHLIGHTERS=(${concatStringsSep " " cfg.highlighters})"
+      lib.concatStringsSep "\n" ([
-        }
+        "source ${zsh-syntax-highlighting}/share/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh"
-
+      ] ++ optional (length(cfg.highlighters) > 0)
-        ${let
+        "ZSH_HIGHLIGHT_HIGHLIGHTERS=(${concatStringsSep " " cfg.highlighters})"
-            n = attrNames cfg.patterns;
+        ++ optionals (length(attrNames cfg.patterns) > 0)
-          in
+          (mapAttrsToList (
-            optionalString (length(n) > 0)
+            pattern: design:
-              (assert(elem "pattern" cfg.highlighters); (foldl (
+            "ZSH_HIGHLIGHT_PATTERNS+=('${pattern}' '${design}')"
-                a: b:
+          ) cfg.patterns)
-                  ''
+      );
-                    ${a}
+  };
-                    ZSH_HIGHLIGHT_PATTERNS+=('${b}' '${attrByPath [b] "" cfg.patterns}')
+}
-                  ''
-              ) "") n)
-        }
-      '';
-    };
-  }

nixos/modules/rename.nix

@@ -11,7 +11,11 @@ with lib;
     (mkRenamedOptionModule [ "fonts" "extraFonts" ] [ "fonts" "fonts" ])
 
     (mkRenamedOptionModule [ "networking" "enableWLAN" ] [ "networking" "wireless" "enable" ])
-    (mkRenamedOptionModule [ "networking" "enableRT73Firmware" ] [ "networking" "enableRalinkFirmware" ])
+    (mkRenamedOptionModule [ "networking" "enableRT73Firmware" ] [ "hardware" "enableRedistributableFirmware" ])
+    (mkRenamedOptionModule [ "networking" "enableIntel3945ABGFirmware" ] [ "hardware" "enableRedistributableFirmware" ])
+    (mkRenamedOptionModule [ "networking" "enableIntel2100BGFirmware" ] [ "hardware" "enableRedistributableFirmware" ])
+    (mkRenamedOptionModule [ "networking" "enableRalinkFirmware" ] [ "hardware" "enableRedistributableFirmware" ])
+    (mkRenamedOptionModule [ "networking" "enableRTL8192cFirmware" ] [ "hardware" "enableRedistributableFirmware" ])
 
     (mkRenamedOptionModule [ "services" "cadvisor" "host" ] [ "services" "cadvisor" "listenAddress" ])
     (mkChangedOptionModule [ "services" "printing" "gutenprint" ] [ "services" "printing" "drivers" ]

nixos/modules/service-managers/docker.nix

@@ -1,29 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-  cfg = config.docker-containers;
-
-  containerModule = {
-    script = mkOption {
-      type = types.lines;
-      description = "Shell commands executed as the service's main process.";
-    };
-  };
-
-  toContainer = name: value: pkgs.dockerTools.buildImage {
-    inherit name;
-    config = {
-      Cmd = [ value.script ];
-    };
-  };
-in {
-  options.docker-containers = mkOption {
-    default = {};
-    type = with types; attrsOf (types.submodule containerModule);
-    description = "Definition of docker containers";
-  };
-
-  config.system.build.toplevel-docker = lib.mapAttrs toContainer cfg;
-}

nixos/modules/service-managers/trivial.nix

@@ -1,35 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-  cfg = config.trivial-services;
-
-  serviceModule.options = {
-    script = mkOption {
-      type = types.lines;
-      description = "Shell commands executed as the service's main process.";
-    };
-
-    environment = mkOption {
-      default = {};
-      type = types.attrs; # FIXME
-      example = { PATH = "/foo/bar/bin"; LANG = "nl_NL.UTF-8"; };
-      description = "Environment variables passed to the service's processes.";
-    };
-  };
-
-  launcher = name: value: pkgs.writeScript name ''
-    #!${pkgs.stdenv.shell} -eu
-
-    ${pkgs.writeScript "${name}-entry" value.script}
-  '';
-in {
-  options.trivial-services = mkOption {
-    default = {};
-    type = with types; attrsOf (types.submodule serviceModule);
-    description = "Definition of trivial services";
-  };
-
-  config.system.build.toplevel-trivial = lib.mapAttrs launcher cfg;
-}

nixos/modules/services/misc/nix-daemon.nix

@@ -189,6 +189,7 @@ in
               sshKey = "/root/.ssh/id_buildfarm";
               system = "x86_64-linux";
               maxJobs = 2;
+              speedFactor = 2;
               supportedFeatures = [ "kvm" ];
               mandatoryFeatures = [ "perf" ];
             }

nixos/modules/services/misc/plex.nix

@@ -137,7 +137,7 @@ in
         User = cfg.user;
         Group = cfg.group;
         PermissionsStartOnly = "true";
-        ExecStart = "/bin/sh -c ${cfg.package}/usr/lib/plexmediaserver/Plex\\ Media\\ Server";
+        ExecStart = "\"${cfg.package}/usr/lib/plexmediaserver/Plex Media Server\"";
         KillSignal = "SIGQUIT";
         Restart = "on-failure";
       };

nixos/modules/services/misc/pykms.nix

@@ -0,0 +1,90 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.pykms;
+
+  home = "/var/lib/pykms";
+
+  services = {
+    serviceConfig = {
+      Restart = "on-failure";
+      RestartSec = "10s";
+      StartLimitInterval = "1min";
+      PrivateTmp = true;
+      ProtectSystem = "full";
+      ProtectHome = true;
+    };
+  };
+
+in {
+
+  options = {
+    services.pykms = rec {
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Whether to enable the PyKMS service.";
+      };
+
+      listenAddress = mkOption {
+        type = types.str;
+        default = "0.0.0.0";
+        description = "The IP address on which to listen.";
+      };
+
+      port = mkOption {
+        type = types.int;
+        default = 1688;
+        description = "The port on which to listen.";
+      };
+
+      verbose = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Show verbose output.";
+      };
+
+      openFirewallPort = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Whether the listening port should be opened automatically.";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewallPort [ cfg.port ];
+
+    systemd.services = {
+      pykms = services // {
+        description = "Python KMS";
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = with pkgs; {
+          User = "pykms";
+          Group = "pykms";
+          ExecStartPre = "${getBin pykms}/bin/create_pykms_db.sh ${home}/clients.db";
+          ExecStart = "${getBin pykms}/bin/server.py ${optionalString cfg.verbose "--verbose"} ${cfg.listenAddress} ${toString cfg.port}";
+          WorkingDirectory = home;
+          MemoryLimit = "64M";
+        };
+      };
+    };
+
+    users = {
+      extraUsers.pykms = {
+        name = "pykms";
+        group = "pykms";
+        home  = home;
+        createHome = true;
+        uid = config.ids.uids.pykms;
+        description = "PyKMS daemon user";
+      };
+
+      extraGroups.pykms = {
+        gid = config.ids.gids.pykms;
+      };
+    };
+  };
+}

nixos/modules/services/networking/connman.nix

@@ -115,10 +115,5 @@ in {
       wireless.enable = true;
       networkmanager.enable = false;
     };
-
-    powerManagement.resumeCommands = ''
-      systemctl restart connman
-    '';
-
   };
 }

nixos/modules/services/networking/dnscache.nix

@@ -18,10 +18,13 @@ let
       '') ips}
     '') cfg.domainServers)}
 
-    # djbdns contains an outdated list of root servers;
+    # if a list of root servers was not provided in config, copy it
-    # if one was not provided in config, provide a current list
+    # over. (this is also done by dnscache-conf, but we 'rm -rf
-    if [ ! -e servers/@ ]; then
+    # /var/lib/dnscache/root' below & replace it wholesale with this,
-      awk '/^.?.ROOT-SERVERS.NET/ { print $4 }' ${pkgs.dns-root-data}/root.hints > $out/servers/@
+    # so we have to ensure servers/@ exists ourselves.)
+    if [ ! -e $out/servers/@ ]; then
+      # symlink does not work here, due chroot
+      cp ${pkgs.djbdns}/etc/dnsroots.global $out/servers/@;
     fi
   '';
 

nixos/modules/services/networking/firewall.nix

@@ -95,18 +95,18 @@ let
     ip46tables -N nixos-fw-log-refuse
 
     ${optionalString cfg.logRefusedConnections ''
-      ip46tables -A nixos-fw-log-refuse -p tcp --syn -j LOG --log-level info --log-prefix "rejected connection: "
+      ip46tables -A nixos-fw-log-refuse -p tcp --syn -j LOG --log-level info --log-prefix "refused connection: "
     ''}
     ${optionalString (cfg.logRefusedPackets && !cfg.logRefusedUnicastsOnly) ''
       ip46tables -A nixos-fw-log-refuse -m pkttype --pkt-type broadcast \
-        -j LOG --log-level info --log-prefix "rejected broadcast: "
+        -j LOG --log-level info --log-prefix "refused broadcast: "
       ip46tables -A nixos-fw-log-refuse -m pkttype --pkt-type multicast \
-        -j LOG --log-level info --log-prefix "rejected multicast: "
+        -j LOG --log-level info --log-prefix "refused multicast: "
     ''}
     ip46tables -A nixos-fw-log-refuse -m pkttype ! --pkt-type unicast -j nixos-fw-refuse
     ${optionalString cfg.logRefusedPackets ''
       ip46tables -A nixos-fw-log-refuse \
-        -j LOG --log-level info --log-prefix "rejected packet: "
+        -j LOG --log-level info --log-prefix "refused packet: "
     ''}
     ip46tables -A nixos-fw-log-refuse -j nixos-fw-refuse
 

nixos/modules/services/networking/unbound.nix

@@ -105,7 +105,7 @@ in
       description = "Unbound recursive Domain Name Server";
       after = [ "network.target" ];
       before = [ "nss-lookup.target" ];
-      wants = [" nss-lookup.target" ];
+      wants = [ "nss-lookup.target" ];
       wantedBy = [ "multi-user.target" ];
 
       preStart = ''

nixos/modules/services/scheduling/fcron.nix

@@ -137,10 +137,7 @@ in
       after = [ "local-fs.target" ];
       wantedBy = [ "multi-user.target" ];
 
-      # FIXME use specific path
+      path = [ pkgs.fcron ];
-      environment = {
-        PATH = "/run/current-system/sw/bin";
-      };
 
       preStart = ''
         install \
@@ -149,7 +146,7 @@ in
           --group fcron \
           --directory /var/spool/fcron
         # load system crontab file
-        /run/wrappers/bin/fcrontab -u systab ${pkgs.writeText "systab" cfg.systab}
+        /run/wrappers/bin/fcrontab -u systab - < ${pkgs.writeText "systab" cfg.systab}
       '';
 
       serviceConfig = {

nixos/modules/services/security/hologram-server.nix

@@ -23,8 +23,6 @@ let
     stats  = cfg.statsAddress;
     listen = cfg.listenAddress;
   });
-
-  script = "${pkgs.hologram.bin}/bin/hologram-server --debug --conf ${cfgFile}";
 in {
   options = {
     services.hologram-server = {
@@ -96,15 +94,9 @@ in {
       after       = [ "network.target" ];
       wantedBy    = [ "multi-user.target" ];
 
-      inherit script;
+      serviceConfig = {
-    };
+        ExecStart = "${pkgs.hologram.bin}/bin/hologram-server --debug --conf ${cfgFile}";
-
+      };
-    docker-containers.hologram-server = {
-      inherit script;
-    };
-
-    trivial-services.hologram-server = {
-      inherit script;
     };
   };
 }

nixos/modules/services/web-apps/mattermost.nix

@@ -184,10 +184,12 @@ in
           fi
         '' + lib.optionalString cfg.localDatabaseCreate ''
           if ! test -e "${cfg.statePath}/.db-created"; then
-            ${config.services.postgresql.package}/bin/psql postgres -c \
+            ${pkgs.sudo}/bin/sudo -u ${config.services.postgresql.superUser} \
-              "CREATE ROLE ${cfg.localDatabaseUser} WITH LOGIN NOCREATEDB NOCREATEROLE ENCRYPTED PASSWORD '${cfg.localDatabasePassword}'"
+              ${config.services.postgresql.package}/bin/psql postgres -c \
-            ${config.services.postgresql.package}/bin/createdb \
+                "CREATE ROLE ${cfg.localDatabaseUser} WITH LOGIN NOCREATEDB NOCREATEROLE ENCRYPTED PASSWORD '${cfg.localDatabasePassword}'"
-              --owner ${cfg.localDatabaseUser} ${cfg.localDatabaseName}
+            ${pkgs.sudo}/bin/sudo -u ${config.services.postgresql.superUser} \
+              ${config.services.postgresql.package}/bin/createdb \
+                --owner ${cfg.localDatabaseUser} ${cfg.localDatabaseName}
             touch ${cfg.statePath}/.db-created
           fi
         '' + ''

nixos/modules/services/web-servers/lighttpd/default.nix

@@ -15,7 +15,8 @@ let
   # Some modules are always imported and should not appear in the config:
   # disallowedModules = [ "mod_indexfile" "mod_dirlisting" "mod_staticfile" ];
   #
-  # Get full module list: "ls -1 $lighttpd/lib/*.so"
+  # For full module list, see the output of running ./configure in the lighttpd
+  # source.
   allKnownModules = [
     "mod_rewrite"
     "mod_redirect"
@@ -38,12 +39,15 @@ let
     "mod_accesslog"
     # Remaining list of modules, order assumed to be unimportant.
     "mod_authn_file"
+    "mod_authn_gssapi"
+    "mod_authn_ldap"
     "mod_authn_mysql"
     "mod_cml"
     "mod_deflate"
     "mod_evasive"
     "mod_extforward"
     "mod_flv_streaming"
+    "mod_geoip"
     "mod_magnet"
     "mod_mysql_vhost"
     "mod_scgi"

nixos/modules/services/x11/compton.nix

@@ -7,7 +7,12 @@ let
 
   cfg = config.services.compton;
 
-  configFile = pkgs.writeText "compton.conf"
+  configFile = let
+    opacityRules = optionalString (length cfg.opacityRules != 0)
+      (concatStringsSep "\n"
+        (map (a: "opacity-rule = [ \"${a}\" ];") cfg.opacityRules)
+      );
+  in pkgs.writeText "compton.conf"
     (optionalString cfg.fade ''
       # fading
       fading = true;
@@ -30,7 +35,9 @@ let
       active-opacity   = ${cfg.activeOpacity};
       inactive-opacity = ${cfg.inactiveOpacity};
       menu-opacity     = ${cfg.menuOpacity};
-      
+
+      ${opacityRules}
+
       # other options
       backend = ${toJSON cfg.backend};
       vsync = ${toJSON cfg.vSync};
@@ -155,6 +162,14 @@ in {
       '';
     };
 
+    opacityRules = mkOption {
+      type = types.listOf types.str;
+      default = [];
+      description = ''
+        Opacity rules to be handled by compton.
+      '';
+    };
+
     backend = mkOption {
       type = types.str;
       default = "glx";

nixos/modules/services/x11/desktop-managers/mate.nix

@@ -72,6 +72,7 @@ in
     ];
 
     services.gnome3.gnome-keyring.enable = true;
+    services.upower.enable = config.powerManagement.enable;
 
     environment.pathsToLink = [ "/share" ];
   };

nixos/modules/services/x11/desktop-managers/plasma5.nix

@@ -142,7 +142,8 @@ in
 
           kde-gtk-config breeze-gtk
 
-          phonon-backend-gstreamer
+          libsForQt56.phonon-backend-gstreamer
+          libsForQt5.phonon-backend-gstreamer
         ]
 
         ++ lib.optionals cfg.enableQt4Support [ breeze-qt4 pkgs.phonon-backend-gstreamer ]

nixos/modules/services/x11/hardware/libinput.nix

@@ -75,12 +75,13 @@ in {
         default = null;
         description =
           ''
-            Enables a click method. Permitted values are none, buttonareas, clickfinger.
+            Enables a click method. Permitted values are <literal>none</literal>,
+            <literal>buttonareas</literal>, <literal>clickfinger</literal>.
             Not all devices support all methods, if an option is unsupported,
-            the default click method for this device is used. 
+            the default click method for this device is used.
           '';
       };
-      
+
       leftHanded = mkOption {
         type = types.bool;
         default = false;
@@ -96,7 +97,7 @@ in {
             simultaneously produces a middle mouse button click.
           '';
       };
-      
+
       naturalScrolling = mkOption {
         type = types.bool;
         default = false;
@@ -120,7 +121,8 @@ in {
         example = "edge";
         description =
           ''
-            Specify the scrolling method.
+            Specify the scrolling method: <literal>twofinger</literal>, <literal>edge</literal>,
+            or <literal>none</literal>
           '';
       };
 
@@ -141,7 +143,8 @@ in {
         example = "disabled";
         description =
           ''
-            Sets the send events mode to disabled, enabled, or "disable when an external mouse is connected".
+            Sets the send events mode to <literal>disabled</literal>, <literal>enabled</literal>,
+            or <literal>disabled-on-external-mouse</literal>
           '';
       };
 

nixos/modules/services/x11/xautolock.nix

@@ -31,7 +31,17 @@ in
           type = types.string;
 
           description = ''
-            The script to use when locking the computer.
+            The script to use when automatically locking the computer.
+          '';
+        };
+
+        nowlocker = mkOption {
+          default = null;
+          example = "i3lock -i /path/to/img";
+          type = types.nullOr types.string;
+
+          description = ''
+            The script to use when manually locking the computer with <command>xautolock -locknow</command>.
           '';
         };
 
@@ -45,28 +55,82 @@ in
         };
 
         notifier = mkOption {
-          default = "notify-send 'Locking in 10 seconds'";
+          default = null;
-          type = types.string;
+          example = literalExample ''
+            "${pkgs.libnotify}/bin/notify-send \"Locking in 10 seconds\""
+          '';
+          type = types.nullOr types.string;
 
           description = ''
             Notification script to be used to warn about the pending autolock.
           '';
         };
+
+        killer = mkOption {
+          default = null; # default according to `man xautolock` is none
+          example = "systemctl suspend";
+          type = types.nullOr types.string;
+
+          description = ''
+            The script to use when nothing has happend for as long as <option>killtime</option>
+          '';
+        };
+
+        killtime = mkOption {
+          default = 20; # default according to `man xautolock`
+          type = types.int;
+
+          description = ''
+            Minutes xautolock waits until it executes the script specified in <option>killer</option>
+            (Has to be at least 10 minutes)
+          '';
+        };
+
+        extraOptions = mkOption {
+          type = types.listOf types.str;
+          default = [ ];
+          example = [ "-detectsleep" ];
+          description = ''
+            Additional command-line arguments to pass to
+            <command>xautolock</command>.
+          '';
+        };
       };
     };
 
     config = mkIf cfg.enable {
       environment.systemPackages = with pkgs; [ xautolock ];
-
+      systemd.user.services.xautolock = {
-      services.xserver.displayManager.sessionCommands = with builtins; with pkgs; ''
+        description = "xautolock service";
-        ${xautolock}/bin/xautolock \
+        wantedBy = [ "graphical-session.target" ];
-          ${concatStringsSep " \\\n" ([
+        partOf = [ "graphical-session.target" ];
-            "-time ${toString(cfg.time)}"
+        serviceConfig = with lib; {
-            "-locker ${cfg.locker}"
+          ExecStart = strings.concatStringsSep " " ([
-          ] ++ optional cfg.enableNotifier (concatStringsSep " " [ 
+            "${pkgs.xautolock}/bin/xautolock"
-            "-notify ${toString(cfg.notify)}"
+            "-noclose"
-            "-notifier \"${cfg.notifier}\""
+            "-time ${toString cfg.time}"
-          ]))} &
+            "-locker '${cfg.locker}'"
-      '';
+          ] ++ optionals cfg.enableNotifier [
+            "-notify ${toString cfg.notify}"
+            "-notifier '${cfg.notifier}'"
+          ] ++ optionals (cfg.nowlocker != null) [
+            "-nowlocker '${cfg.nowlocker}'"
+          ] ++ optionals (cfg.killer != null) [
+            "-killer '${cfg.killer}'"
+            "-killtime ${toString cfg.killtime}"
+          ] ++ cfg.extraOptions);
+          Restart = "always";
+        };
+      };
+      assertions = [
+        {
+          assertion = cfg.enableNotifier -> cfg.notifier != null;
+          message = "When enabling the notifier for xautolock, you also need to specify the notify script";
+        }
+        {
+          assertion = cfg.killer != null -> cfg.killtime >= 10;
+          message = "killtime has to be at least 10 minutes according to `man xautolock`";
+        }
+      ];
     };
   }

nixos/modules/system/boot/kernel.nix

@@ -193,11 +193,6 @@ in
         "sd_mod"
         "sr_mod"
 
-        # Standard IDE stuff.
-        "ide_cd"
-        "ide_disk"
-        "ide_generic"
-
         # SD cards and internal eMMC drives.
         "mmc_block"
 
@@ -211,21 +206,11 @@ in
         "xhci_hcd"
         "xhci_pci"
         "usbhid"
-        "hid_generic" "hid_lenovo"
+        "hid_generic" "hid_lenovo" "hid_apple" "hid_roccat"
-        "hid_apple" "hid_logitech_dj" "hid_lenovo_tpkbd" "hid_roccat"
 
         # Misc. keyboard stuff.
         "pcips2" "atkbd" "i8042"
 
-        # Temporary fix for https://github.com/NixOS/nixpkgs/issues/18451
-        # Remove as soon as upstream gets fixed - marking it:
-        # TODO
-        # FIXME
-        "i8042"
-
-        # To wait for SCSI devices to appear.
-        "scsi_wait_scan"
-
         # Needed by the stage 2 init script.
         "rtc_cmos"
       ];

nixos/modules/system/boot/loader/grub/install-grub.pl

@@ -197,7 +197,7 @@ sub GrubFs {
                 if ($status != 0) {
                     die "Failed to retrieve subvolume info for @{[$fs->mount]}\n";
                 }
-                my @ids = join("", @id_info) =~ m/Subvolume ID:[ \t\n]*([^ \t\n]*)/;
+                my @ids = join("\n", @id_info) =~ m/^(?!\/\n).*Subvolume ID:[ \t\n]*([0-9]+)/s;
                 if ($#ids > 0) {
                     die "Btrfs subvol name for @{[$fs->device]} listed multiple times in mount\n"
                 } elsif ($#ids == 0) {

nixos/tests/run-in-machine.nix

@@ -2,7 +2,16 @@
 
 with import ../lib/testing.nix { inherit system; };
 
-runInMachine {
+let
-  drv = pkgs.hello;
+  output = runInMachine {
-  machine = { config, pkgs, ... }: { /* services.sshd.enable = true; */ };
+    drv = pkgs.hello;
-}
+    machine = { config, pkgs, ... }: { /* services.sshd.enable = true; */ };
+  };
+in pkgs.runCommand "verify-output" { inherit output; } ''
+  if [ ! -e "$output/bin/hello" ]; then
+    echo "Derivation built using runInMachine produced incorrect output:" >&2
+    ls -laR "$output" >&2
+    exit 1
+  fi
+  "$output/bin/hello" > "$out"
+''

pkgs/applications/altcoins/go-ethereum-classic/default.nix

@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "go-ethereum-classic-${version}";
-  version = "3.5.86";
+  version = "4.0.0";
 
   goPackagePath = "github.com/ethereumproject/go-ethereum";
   subPackages = [ "cmd/evm" "cmd/geth" ];
@@ -10,7 +10,7 @@ buildGoPackage rec {
   src = fetchgit {
     rev = "v${version}";
     url = "https://github.com/ethereumproject/go-ethereum";
-    sha256 = "1k59hl3qvx4422zqlp259566fnxq5bs67jhm0v6a1zfr1k8iqzwh";
+    sha256 = "06f1w7s45q4zva1xjrx92xinsdrixl0m6zhx5hvdjmg3xqcbwr79";
   };
 
   goDeps = ./deps.nix;

pkgs/applications/editors/atom/beta.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "atom-beta-${version}";
-  version = "1.22.0-beta0";
+  version = "1.22.0-beta1";
 
   src = fetchurl {
     url = "https://github.com/atom/atom/releases/download/v${version}/atom-amd64.deb";
-    sha256 = "0xsj0vvaxjw60gg6niaws2lf9lkrh1sz7ypk41g6l4hdgmqyg6fi";
+    sha256 = "0qggj0j0cnkzqwgvzw2fb1z10rvvx9jh0ymhdy1aca18hms44p3d";
     name = "${name}.deb";
   };
 

pkgs/applications/editors/atom/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "atom-${version}";
-  version = "1.21.0";
+  version = "1.21.1";
 
   src = fetchurl {
     url = "https://github.com/atom/atom/releases/download/v${version}/atom-amd64.deb";
-    sha256 = "0xnja2jdjjryisxgyxhh8ik861snl9wdpmr3rjlnalfglghqqb5h";
+    sha256 = "13mpj3wvcgsxz9q6lai36lkfgd7rabcjrrih1j5309kd1dqaswnn";
     name = "${name}.deb";
   };
 

pkgs/applications/editors/emacs-modes/elpa-generated.nix

@@ -28,10 +28,10 @@
     ada-mode = callPackage ({ cl-lib ? null, elpaBuild, emacs, fetchurl, lib, wisi }:
     elpaBuild {
         pname = "ada-mode";
-        version = "5.2.2";
+        version = "5.3.1";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/ada-mode-5.2.2.tar";
+          url = "https://elpa.gnu.org/packages/ada-mode-5.3.1.tar";
-          sha256 = "0c0lrj4vgsbawyshqbfb7gvndf0yb97wybqb0b34z7kan7q0xgvd";
+          sha256 = "0srna7w3y2nq0y80a01bcx8mg6gvind7nzvsbk9bd7rrr05njrd9";
         };
         packageRequires = [ cl-lib emacs wisi ];
         meta = {
@@ -95,10 +95,10 @@
     ahungry-theme = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
     elpaBuild {
         pname = "ahungry-theme";
-        version = "1.4.0";
+        version = "1.5.0";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/ahungry-theme-1.4.0.tar";
+          url = "https://elpa.gnu.org/packages/ahungry-theme-1.5.0.tar";
-          sha256 = "1n8k12mfn01f20j0pyd7ycj77x0y3a008xc94frklaaqjc0v26s4";
+          sha256 = "0xxzmqawd7cwafzb9z6c7hjlh6adc5sj7hfcqxf30b7b7ragqn19";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -149,10 +149,10 @@
     ascii-art-to-unicode = callPackage ({ elpaBuild, fetchurl, lib }:
     elpaBuild {
         pname = "ascii-art-to-unicode";
-        version = "1.9";
+        version = "1.11";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/ascii-art-to-unicode-1.9.el";
+          url = "https://elpa.gnu.org/packages/ascii-art-to-unicode-1.11.el";
-          sha256 = "0lfgfkx81s4dd318xcxsl7hdgpi0dc1fv3d00m3xg8smyxcf3adv";
+          sha256 = "1z1vjpskvhynja41cv5z6xrz3rmpdzz51avv2gzrpxxa4k6iaz8s";
         };
         packageRequires = [];
         meta = {
@@ -281,10 +281,10 @@
       }) {};
     captain = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
         pname = "captain";
-        version = "1.0.1";
+        version = "1.0.2";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/captain-1.0.1.el";
+          url = "https://elpa.gnu.org/packages/captain-1.0.2.el";
-          sha256 = "1jqbgzcgq4kxpcsma9ia6w6rjy9sdn51lz2f4rfjjy3qgy4fqjx5";
+          sha256 = "0rslksfwzf5bngmbfgv2mwmls5dpwmz7rs9av9p60y7k848haqf1";
         };
         packageRequires = [];
         meta = {
@@ -700,10 +700,10 @@
     ebdb = callPackage ({ cl-lib ? null, elpaBuild, emacs, fetchurl, lib, seq }:
     elpaBuild {
         pname = "ebdb";
-        version = "0.3.1";
+        version = "0.3.4";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/ebdb-0.3.1.tar";
+          url = "https://elpa.gnu.org/packages/ebdb-0.3.4.tar";
-          sha256 = "1g8chkw302nhjj8n6v7j3xfcw24wpn43pcp8f3bh4s4haw1l75q3";
+          sha256 = "1jj7s0646wqg9ykmpi52cc6m6m0gk2inqc2h6h7cr7gr4v7n2l00";
         };
         packageRequires = [ cl-lib emacs seq ];
         meta = {
@@ -728,10 +728,10 @@
     ebdb-i18n-chn = callPackage ({ ebdb, elpaBuild, fetchurl, lib, pyim }:
     elpaBuild {
         pname = "ebdb-i18n-chn";
-        version = "1.1";
+        version = "1.2";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/ebdb-i18n-chn-1.1.el";
+          url = "https://elpa.gnu.org/packages/ebdb-i18n-chn-1.2.el";
-          sha256 = "0pf7qp15z9wp41dazvi4bhdz7y13h9k5nnghhsb0nvknn6if0k4m";
+          sha256 = "1qgrlk625mhfd6n1mc0kqfzbisnb61kx3vrrl3bzlz4viq3kcc10";
         };
         packageRequires = [ ebdb pyim ];
         meta = {
@@ -1556,10 +1556,10 @@
       }) {};
     org = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
         pname = "org";
-        version = "20170911";
+        version = "20171009";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/org-20170911.tar";
+          url = "https://elpa.gnu.org/packages/org-20171009.tar";
-          sha256 = "0w91f5lx64klwbpym0b73z919dagzakykkmx6g13iscsh7fflx06";
+          sha256 = "03j7vcj5rihhdh1mmy667s1jy39wfs0kf4gc0gmqxldml062gcpm";
         };
         packageRequires = [];
         meta = {
@@ -2068,10 +2068,10 @@
       }) {};
     tramp-theme = callPackage ({ elpaBuild, emacs, fetchurl, lib }: elpaBuild {
         pname = "tramp-theme";
-        version = "0.1.1";
+        version = "0.2";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/tramp-theme-0.1.1.el";
+          url = "https://elpa.gnu.org/packages/tramp-theme-0.2.el";
-          sha256 = "0l8i625h9sc6h59qfj847blmfwfhf9bvfsbmwfb56qzs535fby3y";
+          sha256 = "1q1j0vcdyv5gnfbnfl08rnwd5j4ayc1gi1vpinr99ny70wsv7gbf";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -2293,10 +2293,10 @@
     wisi = callPackage ({ cl-lib ? null, elpaBuild, emacs, fetchurl, lib }:
     elpaBuild {
         pname = "wisi";
-        version = "1.1.5";
+        version = "1.1.6";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/wisi-1.1.5.tar";
+          url = "https://elpa.gnu.org/packages/wisi-1.1.6.tar";
-          sha256 = "1q0dbykh9gvh0355vc1lwpriwlqq07jaydqx8zdrs6s0zyffx3a4";
+          sha256 = "0p7hm9l4gbp50rmpqna6jnc1pss2axdd6m6hk9ik4afbz0knzwnk";
         };
         packageRequires = [ cl-lib emacs ];
         meta = {

pkgs/applications/editors/emacs-modes/org-generated.nix

@@ -1,10 +1,10 @@
 { callPackage }: {
     org = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
         pname = "org";
-        version = "20170911";
+        version = "20171009";
         src = fetchurl {
-          url = "http://orgmode.org/elpa/org-20170911.tar";
+          url = "http://orgmode.org/elpa/org-20171009.tar";
-          sha256 = "16d69g1qnfcj7d2q9ni5dz5wh9pid9mzhwyfg4z93s9xizzlnw64";
+          sha256 = "1v8y4gmfrnzsdy9mspqzn157da7lb7z2wvp95r1iywf64325gv5s";
         };
         packageRequires = [];
         meta = {
@@ -14,10 +14,10 @@
       }) {};
     org-plus-contrib = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
         pname = "org-plus-contrib";
-        version = "20170911";
+        version = "20171009";
         src = fetchurl {
-          url = "http://orgmode.org/elpa/org-plus-contrib-20170911.tar";
+          url = "http://orgmode.org/elpa/org-plus-contrib-20171009.tar";
-          sha256 = "0bgrsccar4v9viq99w2h4rjavql14zgdwkwaa1bprga3af78jr82";
+          sha256 = "0iv1f7hbqh46mymk097x69q00pqpbkcyzjfd9a9slf5xkw1g1lk1";
         };
         packageRequires = [];
         meta = {

pkgs/applications/editors/vscode/default.nix

@@ -2,7 +2,7 @@
   makeWrapper, libXScrnSaver, libxkbfile, libsecret }:
 
 let
-  version = "1.17.0";
+  version = "1.17.1";
   channel = "stable";
 
   plat = {
@@ -12,9 +12,9 @@ let
   }.${stdenv.system};
 
   sha256 = {
-    "i686-linux" = "1s6nkzdsgfn5x7y91bwb6d7sw4b8s335myc0yhbsfpfks5pgi331";
+    "i686-linux" = "09nvibfn2z5cxjcdxqa2xy63jqwpvfgk7hdy1pc0mnpszz6kn4v7";
-    "x86_64-linux" = "1av7xcb2sig5p344y2v1zjspg5nl9bds03r1yvgssm7mcy9l1gqk";
+    "x86_64-linux" = "1fb3hil7dggnz7hks1i806ckd3wl5g0a2syjdbh9dx5iqarp2782";
-    "x86_64-darwin" = "1fn9i5vs4b6xir51zavx7i8m68bwqa1hfr03aagy8byg9v8w5dx8";
+    "x86_64-darwin" = "1vgbsmbcsdxc0h0ny61a3rhbwxzrfzkxl47sy3w410xcqlv8ad2v";
   }.${stdenv.system};
 
   archive_fmt = if stdenv.system == "x86_64-darwin" then "zip" else "tar.gz";

pkgs/applications/graphics/feh/default.nix

@@ -6,11 +6,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "feh-${version}";
-  version = "2.20";
+  version = "2.21";
 
   src = fetchurl {
     url = "https://feh.finalrewind.org/${name}.tar.bz2";
-    sha256 = "02vhdv16nf4kjna4inpbfy4k3p40bhl7xpc4kh4xvily14146l2b";
+    sha256 = "0azgpr4al2pi4858z4xh4lfz84cvzxw3n426fn7rz6cdj34q212j";
   };
 
   outputs = [ "out" "man" "doc" ];

pkgs/applications/graphics/shutter/default.nix

@@ -11,21 +11,13 @@ let
     ];
 in
 stdenv.mkDerivation rec {
-  name = "shutter-0.93.1";
+  name = "shutter-0.94";
 
   src = fetchurl {
-    url = "http://shutter-project.org/wp-content/uploads/releases/tars/${name}.tar.gz";
+    url = "https://launchpad.net/shutter/0.9x/0.94/+download/shutter-0.94.tar.gz";
-    sha256 = "09cn3scwy98wqxkrjhnmxhpfnnynlbb41856yn5m3zwzqrxiyvak";
+    sha256 = "943152cdf9e1b2096d38e3da9622d8bf97956a08eda747c3e7fcc564a3f0f40d";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "http://svnweb.mageia.org/packages/cauldron/shutter/current/SOURCES/CVE-2015-0854.patch?revision=880308&view=co";
-      name = "CVE-2015-0854.patch";
-      sha256 = "14r18sxz3ylf39cn9b85snjhjxdk6ngq4vnpljwghw2q5430nb12";
-    })
-  ];
-
   buildInputs = [ perl makeWrapper gdk_pixbuf librsvg ] ++ perlModules;
 
   installPhase = ''

pkgs/applications/graphics/solvespace/default.nix

@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     substituteInPlace $out/share/applications/solvespace.desktop \
-      --replace /usr/bin/ $out/bin/ \
+      --replace /usr/bin/ $out/bin/
   '';
 
   meta = {

pkgs/applications/misc/calibre/default.nix

@@ -5,12 +5,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "3.7.0";
+  version = "3.9.0";
   name = "calibre-${version}";
 
   src = fetchurl {
     url = "https://download.calibre-ebook.com/${version}/${name}.tar.xz";
-    sha256 = "1wb0ixx11q0p5dzcszq1n2lx9bcl5dynr87d7anfiz73mxdq20za";
+    sha256 = "0zsf1czw8bz41nk9f55vxwncf0chxdflyhjj2khw9da67ph6yknx";
   };
 
   patches = [

pkgs/applications/misc/cbatticon/default.nix

@@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
 
   name = "cbatticon-${version}";
-  version = "1.6.6";
+  version = "1.6.7";
 
   src = fetchFromGitHub {
     owner = "valr";
     repo = "cbatticon";
     rev = version;
-    sha256 = "0gphijkjmg5q349ffhnx12dppg6hajkr90n0x5b6s9cad5b4q0kq";
+    sha256 = "0rm1rpq81cxjwd4f11c3ivg5hwsd08qm47vdn16yr1cmm2cw4r2d";
   };
 
   makeFlags = "PREFIX=$(out)";

pkgs/applications/misc/gummi/default.nix

@@ -0,0 +1,41 @@
+{ stdenv, fetchFromGitHub, pkgs, makeWrapper
+, glib, gnome2, gnome3, gtk2-x11, gtkspell2, poppler
+, pkgconfig, intltool, autoreconfHook, wrapGAppsHook
+}:
+
+stdenv.mkDerivation rec {
+  version = "0.6.6";
+  name = "gummi-${version}";
+
+  src = pkgs.fetchFromGitHub {
+    owner = "alexandervdm";
+    repo = "gummi";
+    rev = "${version}";
+    sha256 = "1vw8rhv8qj82l6l22kpysgm9mxilnki2kjmvxsnajbqcagr6s7cn";
+  };
+
+  nativeBuildInputs = [
+    pkgconfig intltool autoreconfHook makeWrapper wrapGAppsHook
+  ];
+  buildInputs = [
+    glib gnome2.gtksourceview gnome2.pango gtk2-x11 gtkspell2 poppler
+    gnome3.defaultIconTheme
+  ];
+
+  preConfigure = ''
+    gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "${pkgs.gnome2.gtksourceview}/share")
+  '';
+
+  postInstall = ''
+    install -Dpm644 COPYING $out/share/licenses/$name/COPYING
+  '';
+
+  meta = {
+    homepage = http://gummi.midnightcoding.org/;
+    description = "Simple LaTex editor for GTK users";
+    license = stdenv.lib.licenses.mit;
+    maintainers = with stdenv.lib.maintainers; [ flokli ];
+    platforms = with stdenv.lib.platforms; linux;
+    inherit version;
+  };
+}

pkgs/applications/misc/kdeconnect/default.nix

@@ -15,12 +15,13 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "kdeconnect-${version}";
+  pname = "kdeconnect";
-  version = "1.0.3";
+  version = "1.2";
+  name = "${pname}-${version}";
 
   src = fetchurl {
-    url = "http://download.kde.org/stable/kdeconnect/${version}/src/kdeconnect-kde-${version}.tar.xz";
+    url = "mirror://kde/stable/${pname}/${version}/src/${pname}-kde-${version}.tar.xz";
-    sha256 = "0b40402adw7cqz19fh8zw70f6l7b5p400mw668n3wic4favn27r2";
+    sha256 = "0w3rdldnr6md70r4ch255vk712d37vy63ml7ly2fhr4cfnk2i1ay";
   };
 
   buildInputs = [

pkgs/applications/misc/mediainfo-gui/default.nix

@@ -2,11 +2,11 @@
 , desktop_file_utils, libSM, imagemagick }:
 
 stdenv.mkDerivation rec {
-  version = "0.7.97";
+  version = "0.7.99";
   name = "mediainfo-gui-${version}";
   src = fetchurl {
-    url = "http://mediaarea.net/download/source/mediainfo/${version}/mediainfo_${version}.tar.xz";
+    url = "https://mediaarea.net/download/source/mediainfo/${version}/mediainfo_${version}.tar.xz";
-    sha256 = "10hp23a9hdlqvrhskssd9g15f4n55yq48cmbpjwdqwzfrblj598n";
+    sha256 = "127d6wsrq3wg3ibbb28m26wrm54qbkv8h8xycanvml6ys4zqsc6a";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
       MediaInfo is a convenient unified display of the most relevant technical
       and tag data for video and audio files.
     '';
-    homepage = http://mediaarea.net/;
+    homepage = https://mediaarea.net/;
     license = licenses.bsd2;
     platforms = platforms.linux;
     maintainers = [ maintainers.devhell ];

pkgs/applications/misc/mediainfo/default.nix

@@ -1,11 +1,11 @@
 { stdenv, fetchurl, autoreconfHook, pkgconfig, libzen, libmediainfo, zlib }:
 
 stdenv.mkDerivation rec {
-  version = "0.7.97";
+  version = "0.7.99";
   name = "mediainfo-${version}";
   src = fetchurl {
-    url = "http://mediaarea.net/download/source/mediainfo/${version}/mediainfo_${version}.tar.xz";
+    url = "https://mediaarea.net/download/source/mediainfo/${version}/mediainfo_${version}.tar.xz";
-    sha256 = "10hp23a9hdlqvrhskssd9g15f4n55yq48cmbpjwdqwzfrblj598n";
+    sha256 = "127d6wsrq3wg3ibbb28m26wrm54qbkv8h8xycanvml6ys4zqsc6a";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
       MediaInfo is a convenient unified display of the most relevant technical
       and tag data for video and audio files.
     '';
-    homepage = http://mediaarea.net/;
+    homepage = https://mediaarea.net/;
     license = licenses.bsd2;
     platforms = platforms.unix;
     maintainers = [ maintainers.devhell ];

pkgs/applications/misc/tnef/default.nix

@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, autoreconfHook }:
 
 stdenv.mkDerivation rec {
-  version = "1.4.14";
+  version = "1.4.15";
   name = "tnef-${version}";
 
   src = fetchFromGitHub {
     owner  = "verdammelt";
     repo   = "tnef";
     rev    = version;
-    sha256 = "0p7yji5hqq7k4pcba1cnv4jkl0fkg7jd77c1q164wk0vwinpmsc2";
+    sha256 = "0wm5ylppkjg518ldb9kzlx58a9l8z66gpz9ljalmyq6a77khd7pj";
   };
 
   doCheck = true;

pkgs/applications/misc/udiskie/default.nix

@@ -4,13 +4,13 @@
 
 pythonPackages.buildPythonApplication rec {
   name = "udiskie-${version}";
-  version = "1.7.0";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "coldfix";
     repo = "udiskie";
     rev = version;
-    sha256 = "1dvfhf0d79al0vnrwdknfiy2297m3f7fgn7syr85p29hd6260jnv";
+    sha256 = "12d0fc88wlbh5vvsijvy3cwk37wagmg8193n9zcipr1ivmcmhx15";
   };
 
   buildInputs = [

pkgs/applications/networking/browsers/chromium/plugins.nix

@@ -94,12 +94,12 @@ let
 
   flash = stdenv.mkDerivation rec {
     name = "flashplayer-ppapi-${version}";
-    version = "27.0.0.130";
+    version = "27.0.0.159";
 
     src = fetchzip {
       url = "https://fpdownload.adobe.com/pub/flashplayer/pdc/"
           + "${version}/flash_player_ppapi_linux.x86_64.tar.gz";
-      sha256 = "005sxx3ll18c6idy1db2gb47chd9c5mf83qac0vyvljsrlc7430c";
+      sha256 = "00nbn8nv6irsak05cwlx9x8q0n91kbjxnkdg4c66ilx2gq5wrz05";
       stripRoot = false;
     };
 

pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix

@@ -73,7 +73,7 @@ let
 in
 stdenv.mkDerivation rec {
   name = "flashplayer-${version}";
-  version = "27.0.0.130";
+  version = "27.0.0.159";
 
   src = fetchurl {
     url =
@@ -84,14 +84,14 @@ stdenv.mkDerivation rec {
     sha256 =
       if debug then
         if arch == "x86_64" then
-          "1sj06x4kfwxi9cnc8adjkxk6p81acl39l2idnyqb429l2s84d1d9"
+          "0fgz1aszihjrxpzyrs29wr11imfgnyfb2ca9c1i3n6k9wpwv926p"
         else
-          "0f9vzdn523m408sw76r32zqf7d86l2mhcfsszbfh2bixg8p2cxzz"
+          "052dx764b6cfbc7mkxckcr3hbwd5b7l98cp3jqmddkllv4w4h6dp"
       else
         if arch == "x86_64" then
-          "0qkdabcnqfpbfsbs8ssms9xk2pqvps6fbasvcyvhnywclra25ggc"
+          "1p136zn059hp59j0llk7rfsybjx51qjz2h5sd4xl8zqbs0szynid"
         else
-          "0qkwkc6s4ganja4b2jsz4yff0bziirvbzxg0wyf648hqlb3bw5a6";
+          "06l8rjnhpqip6ikc97rf3zsgmy381q4wgzyl9rsjwlvhpgqdlhrl";
   };
 
   nativeBuildInputs = [ unzip ];

pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix

@@ -55,7 +55,7 @@ let
 in
 stdenv.mkDerivation rec {
   name = "flashplayer-standalone-${version}";
-  version = "27.0.0.130";
+  version = "27.0.0.159";
 
   src = fetchurl {
     url =
@@ -65,9 +65,9 @@ stdenv.mkDerivation rec {
         "https://fpdownload.macromedia.com/pub/flashplayer/updaters/27/flash_player_sa_linux.x86_64.tar.gz";
     sha256 =
       if debug then
-        "0gqm90j8czjnzar3ia65msd18kydjhgq5l9iv1difgm8lqji5ii0"
+        "0h9jpkdkf4kvr2sg61r6pkwcdyf4z3qdj0nlnm27whac9w56jjpj"
       else
-        "1agplangzlrp326dhz3xcvi6i325a644ggrh8g0cmgq9nfcpssnb";
+        "013a0ar5afm62bk7f4s89235bx36n75z65b3afv941jajijiacc9";
   };
 
   nativeBuildInputs = [ unzip ];

pkgs/applications/networking/browsers/palemoon/default.nix

@@ -10,14 +10,14 @@
 
 stdenv.mkDerivation rec {
   name = "palemoon-${version}";
-  version = "27.4.2";
+  version = "27.5.0";
 
   src = fetchFromGitHub {
     name   = "palemoon-src";
     owner  = "MoonchildProductions";
     repo   = "Pale-Moon";
     rev    = version + "_Release";
-    sha256 = "155c1a76kkx9p8cnz9d33xx30asjr32x10cccx0gyq1lm1b9ffbl";
+    sha256 = "0m4fgwxn6hs8r240i6acaajx76cvqy1b7cqmdsxd33qpjrrj1h9d";
   };
 
   desktopItem = makeDesktopItem {

pkgs/applications/networking/browsers/qutebrowser/default.nix

@@ -2,10 +2,13 @@
 , qtbase, pyqt5, jinja2, pygments, pyyaml, pypeg2, pyopengl, cssutils, glib_networking
 , asciidoc, docbook_xml_dtd_45, docbook_xsl, libxml2, libxslt
 , gst-plugins-base, gst-plugins-good, gst-plugins-bad, gst-plugins-ugly, gst-libav
-, qtwebkit-plugins
+, qtwebkit-plugins ? null
-, withWebEngineDefault ? false
+, attrs
+, withWebEngineDefault ? true
 }:
 
+assert (! withWebEngineDefault) -> qtwebkit-plugins != null;
+
 let
   pdfjs = stdenv.mkDerivation rec {
     name = "pdfjs-${version}";
@@ -26,29 +29,30 @@ let
 
 in buildPythonApplication rec {
   name = "qutebrowser-${version}";
-  version = "0.11.0";
+  version = "1.0.1";
   namePrefix = "";
 
   src = fetchurl {
     url = "https://github.com/The-Compiler/qutebrowser/releases/download/v${version}/${name}.tar.gz";
-    sha256 = "13ihx66jm1dd6vx8px7pm0kbzf2sf9x43hhivc1rp17kahnxxdyv";
+    sha256 = "1gphn8a0xfy5iqiznvgd6fbbzp7r5sp697ayfwnvllvmbr5az9vs";
   };
 
   # Needs tox
   doCheck = false;
 
   buildInputs = [
-    qtbase qtwebkit-plugins
+    qtbase
     gst-plugins-base gst-plugins-good gst-plugins-bad gst-plugins-ugly gst-libav
     glib_networking
-  ];
+  ]
+    ++ lib.optional (! withWebEngineDefault) qtwebkit-plugins;
 
   nativeBuildInputs = [
     makeWrapper wrapGAppsHook asciidoc docbook_xml_dtd_45 docbook_xsl libxml2 libxslt
   ];
 
   propagatedBuildInputs = [
-    pyyaml pyqt5 jinja2 pygments pypeg2 cssutils pyopengl
+    pyyaml pyqt5 jinja2 pygments pypeg2 cssutils pyopengl attrs
   ];
 
   postPatch = ''
@@ -62,7 +66,7 @@ in buildPythonApplication rec {
 
   postInstall = ''
     install -Dm644 doc/qutebrowser.1 "$out/share/man/man1/qutebrowser.1"
-    install -Dm644 qutebrowser.desktop \
+    install -Dm644 misc/qutebrowser.desktop \
         "$out/share/applications/qutebrowser.desktop"
     for i in 16 24 32 48 64 128 256 512; do
         install -Dm644 "icons/qutebrowser-''${i}x''${i}.png" \
@@ -73,8 +77,8 @@ in buildPythonApplication rec {
     install -Dm755 -t "$out/share/qutebrowser/userscripts/" misc/userscripts/*
   '';
 
-  postFixup = lib.optionalString withWebEngineDefault ''
+  postFixup = lib.optionalString (! withWebEngineDefault) ''
-    wrapProgram $out/bin/qutebrowser --add-flags "--backend webengine"
+    wrapProgram $out/bin/qutebrowser --add-flags "--backend webkit"
   '';
 
   meta = {

pkgs/applications/networking/browsers/vivaldi/default.nix

@@ -7,17 +7,17 @@
 , glib, gtk3, pango, gdk_pixbuf, cairo, atk, gnome3
 , nss, nspr
 , patchelf, makeWrapper
-, proprietaryCodecs ? true, vivaldi-ffmpeg-codecs ? null
+, proprietaryCodecs ? false, vivaldi-ffmpeg-codecs ? null
 }:
 
 stdenv.mkDerivation rec {
   name = "${product}-${version}";
   product = "vivaldi";
-  version = "1.12.955.36-1";
+  version = "1.12.955.38-1";
 
   src = fetchurl {
     url = "https://downloads.vivaldi.com/stable/${product}-stable_${version}_amd64.deb";
-    sha256 = "0fh6v4byqvyywlf9xsxn78kfypcqsmf4vypv5mwxh5nrpwim4xqj";
+    sha256 = "1bq1ss6vkpr6rw5n0sw9zipxx19vficvxys1lra9symcxk1b4gqw";
   };
 
   unpackPhase = ''

pkgs/applications/networking/cluster/kanif/default.nix

@@ -4,8 +4,6 @@ stdenv.mkDerivation rec {
   version = "1.2.2";
   name = "kanif-${version}";
 
-  propagateBuildInputs = [ perl taktuk ];
-
   src = fetchurl {
     url = "http://gforge.inria.fr/frs/download.php/26773/${name}.tar.gz";
     sha256 = "3f0c549428dfe88457c1db293cfac2a22b203f872904c3abf372651ac12e5879";

pkgs/applications/networking/cluster/kubernetes/default.nix

@@ -18,13 +18,13 @@ with lib;
 
 stdenv.mkDerivation rec {
   name = "kubernetes-${version}";
-  version = "1.7.1";
+  version = "1.7.8";
 
   src = fetchFromGitHub {
     owner = "kubernetes";
     repo = "kubernetes";
     rev = "v${version}";
-    sha256 = "1frf2nxk45lsbkq73fj72gxgr76icqdrsdqh20f5gpwiqn23n7c3";
+    sha256 = "1xfvfdn04wn7ldmr5ypnyi99gsrgz1w8l02jnvyalpdnjbj73b89";
   };
 
   buildInputs = [ removeReferencesTo makeWrapper which go rsync go-bindata ];

pkgs/applications/networking/cluster/minikube/default.nix

@@ -23,7 +23,7 @@ let
 in buildGoPackage rec {
   pname   = "minikube";
   name    = "${pname}-${version}";
-  version = "0.22.2";
+  version = "0.22.3";
 
   goPackagePath = "k8s.io/minikube";
 
@@ -31,7 +31,7 @@ in buildGoPackage rec {
     owner  = "kubernetes";
     repo   = "minikube";
     rev    = "v${version}";
-    sha256 = "04h0hp0mkps3ilcig6xnmp41rlgaxhhpxakc86lsknvkk9kmrx89";
+    sha256 = "0jcfw0yrd4vqyiyhg15cy2knn2fjw91das8id4famz5gl6dnlm28";
   };
 
   # kubernetes is here only to shut up a loud warning when generating the completions below. minikube checks very eagerly

pkgs/applications/networking/feedreaders/newsbeuter/default.nix

@@ -36,6 +36,11 @@ stdenv.mkDerivation rec {
       url = "https://github.com/akrennmair/newsbeuter/commit/26f5a4350f3ab5507bb8727051c87bb04660f333.patch";
       sha256 = "1jjxj4z3s4f1n8rfpwyd42a40gjnziykqas6a26s1lsdkklnbp6q";
     })
+    # https://github.com/akrennmair/newsbeuter/issues/591 / CVE-2017-12904
+    (fetchpatch {
+      url = "https://github.com/akrennmair/newsbeuter/commit/d1460189f6f810ca9a3687af7bc43feb7f2af2d9.patch";
+      sha256 = "1a8k73ckziszsbdwdhcmkfvlmgy955gssg9v4sqvg20v91l5rmai";
+    })
    ];
 
   installFlags = [ "DESTDIR=$(out)" "prefix=" ];

pkgs/applications/networking/feedreaders/newsbeuter/dev.nix

@@ -1,45 +0,0 @@
-{ stdenv, fetchgit, sqlite, curl, pkgconfig, libxml2, stfl, json-c-0-11, ncurses
-, gettext, libiconv, makeWrapper, perl }:
-
-stdenv.mkDerivation rec {
-  name = "newsbeuter-dev-20140309";
-
-  src = fetchgit {
-    url = "https://github.com/akrennmair/newsbeuter.git";
-    rev = "1427bdb0705806368db39576a9b803df82fa0415";
-    sha256 = "1g47b8pxkz84r5m3avkjb7p2i88crcrp9gxwhq7xdfywrgg9pgnd";
-  };
-
-  buildInputs
-    # use gettext instead of libintlOrEmpty so we have access to the msgfmt
-    # command
-    = [ pkgconfig sqlite curl libxml2 stfl json-c-0-11 ncurses gettext perl libiconv ]
-      ++ stdenv.lib.optional stdenv.isDarwin makeWrapper;
-
-  preBuild = ''
-    sed -i -e 110,114d config.sh
-    sed -i "1 s%^.*$%#!${perl}/bin/perl%" txt2h.pl
-    export LDFLAGS=-lncursesw
-  '';
-
-  NIX_CFLAGS_COMPILE =
-    "-I${libxml2.dev}/include/libxml2 -I${json-c-0-11}/include/json-c";
-
-  NIX_LDFLAGS = "-lsqlite3 -lcurl -lxml2 -lstfl -ljson";
-
-  installPhase = ''
-    DESTDIR=$out prefix=\"\" make install
-  '' + stdenv.lib.optionalString stdenv.isDarwin ''
-    for prog in $out/bin/*; do
-      wrapProgram "$prog" --prefix DYLD_LIBRARY_PATH : "${stfl}/lib"
-    done
-  '';
-
-  meta = with stdenv.lib; {
-    homepage    = http://www.newsbeuter.org;
-    description = "An open-source RSS/Atom feed reader for text terminals";
-    maintainers = with maintainers; [ lovek323 ];
-    license     = licenses.mit;
-    platforms   = platforms.linux;
-  };
-}

pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-hangouts/default.nix

@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   name = "purple-hangouts-hg-${version}";
-  version = "2016-12-22";
+  version = "2017-10-08";
 
   src = fetchhg {
     url = "https://bitbucket.org/EionRobb/purple-hangouts/";
-    rev = "754e3bb971cfe913b90c7fd028fe47a42f9e83cb";
+    rev = "5e769791d282a6e5ae4d94dc66a1ff9d6904ec9c";
-    sha256 = "0b826hj5jgfdckzh9wyycxxhpyxhrhxm3n0mhaf3f57gqarriics";
+    sha256 = "0cs7dcd44lkc2anradyddjvmfvnl46ixw4idaf1m9fd7j35mg7b1";
   };
 
   buildInputs = [ pidgin glib json_glib protobuf protobufc ];

pkgs/applications/networking/instant-messengers/zoom-us/default.nix

@@ -4,11 +4,11 @@
 
 let
 
-  version = "2.0.98253.0707";
+  version = "2.0.106600.0904";
   srcs = {
     x86_64-linux = fetchurl {
       url = "https://zoom.us/client/${version}/zoom_x86_64.tar.xz";
-      sha256 = "1znw7459pzfl2jzmj9akfwq3z10sndfb1swdr1p3rrjpiwqh3p7r";
+      sha256 = "1dcr0rqgjingjqbqv37hqjhhwy8axnjyirrnmjk44b5xnh239w9s";
     };
   };
 
@@ -53,6 +53,7 @@ in stdenv.mkDerivation {
     xorg.libXrender
     xorg.libXcomposite
     xorg.libXScrnSaver
+    xorg.libXrandr
 
     stdenv.cc.cc
   ];

pkgs/applications/networking/mailreaders/neomutt/default.nix

@@ -2,14 +2,14 @@
 , cyrus_sasl, gss, gpgme, kerberos, libidn, notmuch, openssl, lmdb, libxslt, docbook_xsl, docbook_xml_dtd_42 }:
 
 stdenv.mkDerivation rec {
-  version = "20170912";
+  version = "20171013";
   name = "neomutt-${version}";
 
   src = fetchFromGitHub {
     owner  = "neomutt";
     repo   = "neomutt";
     rev    = "neomutt-${version}";
-    sha256 = "0qndszmaihly3pp2wqiqm31nxbv9ys3j05kzffaqhzngfilmar9g";
+    sha256 = "0zn8imqfa76bxpkpy111c4vn6vjarbxc8gqv6m18qkksk0ly26l1";
   };
 
   nativeBuildInputs = [ autoreconfHook docbook_xsl docbook_xml_dtd_42 libxslt.bin which ];

pkgs/applications/networking/remote/citrix-receiver/default.nix

@@ -20,9 +20,11 @@
 , fontconfig
 , gtk_engines
 , alsaLib
+, libidn
+, zlib
 }:
 
-let versionRec = { major = "13"; minor = "4"; patch = "0"; };
+let versionRec = { major = "13"; minor = "7"; patch = "0"; };
 in stdenv.mkDerivation rec {
   name = "citrix-receiver-${version}";
   version = with versionRec; "${major}.${minor}.${patch}";
@@ -31,11 +33,14 @@ in stdenv.mkDerivation rec {
   prefixWithBitness = if stdenv.is64bit then "linuxx64" else "linuxx86";
 
   src = with versionRec; requireFile rec {
-    name = "${prefixWithBitness}-${version}.10109380.tar.gz";
+    name =
+      if stdenv.is64bit
+      then "${prefixWithBitness}-${version}.10276927.tar.gz"
+      else "${prefixWithBitness}-${version}.10276925.tar.gz";
     sha256 =
       if stdenv.is64bit
-      then "133brs0sq6d0mgr19rc6ig1n9ahm3ryi23v5nrgqfh0hgxqcrrjb"
+      then "18fb374b9fb8e249b79178500dddca7a1f275411c6537e7695da5dcf19c5ba91"
-      else "0r7jfl5yqv1s2npy8l9gsn0gbb82f6raa092ppkc8xy5pni5sh7l";
+      else "4c68723b0327cf6f12da824056fce2b7853c38e6163a48c9d222b93dd8da75b6";
     message = ''
       In order to use Citrix Receiver, you need to comply with the Citrix EULA and download
       the ${if stdenv.is64bit then "64-bit" else "32-bit"} binaries, .tar.gz from:
@@ -79,6 +84,8 @@ in stdenv.mkDerivation rec {
     xlibs.libXinerama
     xlibs.libXfixes
     libpng12
+    libidn
+    zlib
     gtk_engines
     freetype
     fontconfig

pkgs/applications/networking/syncthing/default.nix

@@ -1,14 +1,14 @@
 { stdenv, lib, fetchFromGitHub, go, procps, removeReferencesTo }:
 
 stdenv.mkDerivation rec {
-  version = "0.14.38";
+  version = "0.14.39";
   name = "syncthing-${version}";
 
   src = fetchFromGitHub {
     owner  = "syncthing";
     repo   = "syncthing";
     rev    = "v${version}";
-    sha256 = "0afid083azvrihv1v2cas09dprr2fflmj9gi7iy18gvwy2pg0jj8";
+    sha256 = "0bq2vdfnl77qldg1zvfhdbmhsj80qz8pds4slqlwjmmjmk19sqnh";
   };
 
   buildInputs = [ go removeReferencesTo ];

pkgs/applications/science/logic/coq/default.nix

@@ -19,7 +19,7 @@ let
    "8.5pl3"    = "15c3rdk59nifzihsp97z4vjxis5xmsnrvpb86qiazj143z2fmdgw";
    "8.6"       = "148mb48zpdax56c0blfi7v67lx014lnmrvxxasi28hsibyz2lvg4";
    "8.6.1"     = "0llrxcxwy5j87vbbjnisw42rfw1n1pm5602ssx64xaxx3k176g6l";
-   "8.7+beta1" = "006rn5896pf39p4z9c6d4xj4zm80j4b67v5gwcixd63msrjqkmxp";
+   "8.7+beta2" = "1r274m44z774xigvj43g211ms9z9bwgyp1g43rvq4fswb3gzxc4b";
   }."${version}";
   coq-version = builtins.substring 0 3 version;
   camlp5 = ocamlPackages.camlp5_strict;

pkgs/applications/science/logic/cubicle/default.nix

@@ -1,20 +1,24 @@
-{ stdenv, fetchurl, ocaml, ocamlPackages }:
+{ stdenv, fetchurl, ocamlPackages }:
 
 stdenv.mkDerivation rec {
   name = "cubicle-${version}";
-  version = "1.0.2";
+  version = "1.1.1";
   src = fetchurl {
     url = "http://cubicle.lri.fr/cubicle-${version}.tar.gz";
-    sha256 = "1fg39vlr2d5067512df32hkw6g8vglxj1m47md5mw3pn3ij6dpsx";
+    sha256 = "1sny9c4fm14k014pk62ibpwbrjjirkx8xmhs9jg7q1hk7y7x3q2h";
   };
 
-  buildInputs = [ ocaml ocamlPackages.functory ];
+  postPatch = ''
+    substituteInPlace Makefile.in --replace "\\n" ""
+  '';
+
+  buildInputs = with ocamlPackages; [ ocaml findlib functory ];
 
   meta = with stdenv.lib; {
     description = "An open source model checker for verifying safety properties of array-based systems";
     homepage = http://cubicle.lri.fr/;
     license = licenses.asl20;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     maintainers = with maintainers; [ lucas8 ];
   };
 }

pkgs/applications/science/logic/isabelle/default.nix

@@ -2,21 +2,21 @@
 # nettools needed for hostname
 
 let
-  dirname = "Isabelle2016-1";
+  dirname = "Isabelle2017";
 in
 
 stdenv.mkDerivation {
-  name = "isabelle-2016-1";
+  name = "isabelle-2017";
   inherit dirname;
 
   src = if stdenv.isDarwin
     then fetchurl {
       url = "http://isabelle.in.tum.de/website-${dirname}/dist/${dirname}.dmg";
-      sha256 = "0553l7m2z32ajmiv6sgg11rh16n490w8i4q9hr7vx4zzggr9nrlr";
+      sha256 = "1awgg39i72pivwfijdwffvil3glnpimjz2x04qbl5la2j6la48nb";
     }
     else fetchurl {
       url = "http://isabelle.in.tum.de/website-${dirname}/dist/${dirname}_linux.tar.gz";
-      sha256 = "1w1cgfmmi1sr43z6hczyc29lxlnlz7dd8fa88ai44wkc13y05b5r";
+      sha256 = "01v1zrajyfamjq5b8v18qr3ffivjckifsvvx2vs13di6wsnmm9gw";
     };
 
   buildInputs = [ perl polyml z3 ]
@@ -43,6 +43,10 @@ stdenv.mkDerivation {
       --replace '$ML_HOME/poly' ${polyml}/bin/poly
     substituteInPlace contrib/z3*/etc/settings \
       --replace '$Z3_HOME/z3' '${z3}/bin/z3'
+
+    for comp in contrib/jdk contrib/polyml*; do
+      rm -rf $comp/x86*
+    done
     '' + (if ! stdenv.isLinux then "" else ''
     arch=${if stdenv.system == "x86_64-linux" then "x86_64-linux" else "x86-linux"}
     for f in contrib/*/$arch/{bash_process,epclextract,eprover,nunchaku,SPASS}; do

pkgs/applications/science/math/qalculate-gtk/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "qalculate-gtk-${version}";
-  version = "2.0.0a";
+  version = "2.1.0";
 
   src = fetchurl {
     url = "https://github.com/Qalculate/qalculate-gtk/archive/v${version}.tar.gz";
-    sha256 = "0bif79wl2hi0sf4pk2b4s2xz33lj7401pygsdmxrnr5gqqq0s696";
+    sha256 = "14q89l6laa7v7d9qx7v71a0r2m65saxqgr9r871fasm400a9x8pw";
   };
 
   patchPhase = ''

pkgs/applications/version-management/git-lfs/default.nix

@@ -2,8 +2,8 @@
 
 buildGoPackage rec {
   name = "git-lfs-${version}";
-  version = "2.2.1";
+  version = "2.3.3";
-  rev = "621d1f821f73efcedc829dda43fd9c1fcf07c6ab";
+  rev = "c9d3beb098254f067680a5ccbb8742387f81d82e";
 
   goPackagePath = "github.com/git-lfs/git-lfs";
 
@@ -11,7 +11,7 @@ buildGoPackage rec {
     inherit rev;
     owner = "git-lfs";
     repo = "git-lfs";
-    sha256 = "00wc4gjs4yy2qld1m4yar37jkw9fdi2h8xp25hy2y80cnyiafn7s";
+    sha256 = "1hzpzbm46f45vh5liijpyppfcmr7wycnsa09vmilq0wm341ivnsf";
   };
 
   preBuild = ''

pkgs/applications/window-managers/yabar/build.nix

@@ -2,6 +2,7 @@
 , xcbutilwm, alsaLib, wirelesstools, asciidoc, libxslt, makeWrapper, docbook_xsl
 , configFile ? null, lib
 , rev, sha256, version
+, playerctl
 }:
 
 stdenv.mkDerivation {
@@ -20,6 +21,7 @@ stdenv.mkDerivation {
   buildInputs = [
     cairo gdk_pixbuf libconfig pango xcbutilwm docbook_xsl
     alsaLib wirelesstools asciidoc libxslt makeWrapper
+    playerctl
   ];
 
   postPatch = ''
@@ -28,7 +30,7 @@ stdenv.mkDerivation {
       --replace "a2x" "${asciidoc}/bin/a2x --no-xmllint"
   '';
 
-  makeFlags = [ "DESTDIR=$(out)" "PREFIX=/" ];
+  makeFlags = [ "DESTDIR=$(out)" "PREFIX=/" "PLAYERCTL=1" ];
 
   postInstall = ''
     mkdir -p $out/share/yabar/examples

pkgs/applications/window-managers/yabar/unstable.nix

@@ -2,9 +2,9 @@
 
 let
   overrides = {
-    version = "unstable-2017-09-09";
+    version = "unstable-2017-10-12";
 
-    rev    = "d3934344ba27f5bdf122bf74daacee6d49284dab";
+    rev    = "cbecc7766e37f29d50705da0a82dc76ce7c3b86e";
-    sha256 = "14zrlzva8i83ffg426mrf6yli8afwq6chvc7yi78ngixyik5gzhx";
+    sha256 = "1wprjas3k14rxfl06mgr0xq2ra735w1c7dq4xrdvii887wnl37xb";
   } // attrs;
 in callPackage ./build.nix overrides

pkgs/data/fonts/inconsolata/lgc.nix

@@ -24,6 +24,10 @@ stdenv.mkDerivation rec {
     cp -v AUTHORS ChangeLog COPYING License.txt README "$out/doc/${name}" || true
   '';
 
+  outputHashAlgo = "sha256";
+  outputHashMode = "recursive";
+  outputHash = "18brmw0h4hjq1m2l0abwc3zmib4rnfalpywdk68djm711zldxr76";
+
   meta = with stdenv.lib; {
     description = "Fork of Inconsolata font, with proper support of Cyrillic and Greek";
     longDescription = ''

pkgs/data/fonts/libertine/default.nix

@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "0x7cz6hvhpil1rh03rax9zsfzm54bh7r4bbrq8rz673gl9h47v0v";
   };
 
-  setSourceRoot = "sourceRoot=`pwd`";
+  sourceRoot = ".";
 
   nativeBuildInputs = [ fontforge ];
 
@@ -40,9 +40,14 @@ stdenv.mkDerivation rec {
     cp *.map $out/share/texmf/fonts/map
   '';
 
-  meta = {
+  outputHashAlgo = "sha256";
+  outputHashMode = "recursive";
+  outputHash = "1mj0j0hkp8pn7jcs4pvcan6whba60bfd671g3vhx3s9kxwf7xjvr";
+
+  meta = with stdenv.lib; {
     description = "Linux Libertine Fonts";
     homepage = http://linuxlibertine.sf.net;
-    platforms = stdenv.lib.platforms.all;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.volth ];
   };
 }

pkgs/data/fonts/monoid/default.nix

@@ -13,15 +13,13 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ python fontforge ];
 
-  enableParallelBuilding = true;
-
   buildPhase = ''
     local _d=""
     local _l=""
     for _d in {Monoisome,Source}/*.sfdir; do
       _l="''${_d##*/}.log"
       echo "Building $_d (log at $_l)"
-      python Scripts/build.py ${if enableParallelBuilding then "$NIX_BUILD_CORES" else "1"} 0 $_d > $_l
+      python Scripts/build.py 1 0 $_d > $_l
     done
   '';
 
@@ -31,6 +29,10 @@ stdenv.mkDerivation rec {
     cp -va Readme.md $out/share/doc
   '';
 
+  outputHashAlgo = "sha256";
+  outputHashMode = "recursive";
+  outputHash = "0lbipgygiva3gg1pqw07phpnnf0s6ka9vqdk1pw7bkybjw3f7wzm";
+
   meta = with stdenv.lib; {
     homepage = http://larsenwork.com/monoid;
     description = "Customisable coding font with alternates, ligatures and contextual positioning";

pkgs/data/fonts/rictydiminished-with-firacode/default.nix

@@ -11,6 +11,13 @@ stdenv.mkDerivation rec {
   };
 
   buildPhase = ''
+    substituteInPlace apply-feature.py --replace \
+      'ricty = ttLib.TTFont(options.in_font)' \
+      'ricty = ttLib.TTFont(options.in_font, recalcTimestamp=False)'
+    substituteInPlace build-py3.py --replace \
+      'datetime.date.today()' \
+      'datetime.date.fromtimestamp(float(os.environ["SOURCE_DATE_EPOCH"]))'
+
     make
   '';
 
@@ -28,6 +35,10 @@ stdenv.mkDerivation rec {
     ]))
   ];
 
+  outputHashAlgo = "sha256";
+  outputHashMode = "recursive";
+  outputHash = "09ldviapljn4bb1mcxap2pkz7cq3wr2k2qialbnav5y7ii82acd4";
+
   meta = with stdenv.lib; {
     homepage = https://github.com/hakatashi/RictyDiminished-with-FiraCode;
     description = "The best Japanese programming font meets the awesone ligatures of Firacode";

pkgs/data/fonts/unscii/default.nix

@@ -23,6 +23,11 @@ stdenv.mkDerivation rec {
     cp *.svg "$out/share/fonts/svg"
     cp *.woff "$out/share/fonts/web"
   '';
+
+  outputHashAlgo = "sha256";
+  outputHashMode = "recursive";
+  outputHash = "03zvczdka665zcyf9fjrnx434mwpr5q8396j34kjmc67w7nhc49r";
+
   meta = {
     inherit version;
     description = ''Bitmapped character-art-friendly Unicode fonts'';

pkgs/data/fonts/xits-math/default.nix

@@ -15,6 +15,10 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     rm *.otf
+
+    substituteInPlace tools/postprocess.py --replace \
+      'font = ttLib.TTFont(sys.argv[1])' \
+      'font = ttLib.TTFont(sys.argv[1], recalcTimestamp=False)'
   '';
 
   installPhase = ''
@@ -22,6 +26,10 @@ stdenv.mkDerivation rec {
     cp *.otf $out/share/fonts/opentype
   '';
 
+  outputHashAlgo = "sha256";
+  outputHashMode = "recursive";
+  outputHash = "00xycmb9ka67j5s66nkng53y8q6362igisxz04zb58r2717jk50m";
+
   meta = with stdenv.lib; {
     homepage = https://github.com/khaledhosny/xits-math;
     description = "OpenType implementation of STIX fonts with math support";

pkgs/desktops/enlightenment/enlightenment.nix

@@ -4,11 +4,11 @@ mesa_glu, xkeyboard_config, pcre }:
 
 stdenv.mkDerivation rec {
   name = "enlightenment-${version}";
-  version = "0.21.9";
+  version = "0.21.10";
 
   src = fetchurl {
     url = "http://download.enlightenment.org/rel/apps/enlightenment/${name}.tar.xz";
-    sha256 = "0w5f3707hyfc20i6xqh4jlr5p2yhy1z794061mjsz2rp4w00qmpb";
+    sha256 = "053zmlpjx45xg2rbbxyjh0phhgbsnmsnypzz2bib545klp51bfcv";
   };
 
   nativeBuildInputs = [ (pkgconfig.override { vanilla = true; }) ];

pkgs/desktops/mate/default.nix

@@ -25,6 +25,7 @@ let
     mate-menus = callPackage ./mate-menus { };
     mate-notification-daemon = callPackage ./mate-notification-daemon { };
     mate-panel = callPackage ./mate-panel { };
+    mate-power-manager = callPackage ./mate-power-manager { };
     mate-session-manager = callPackage ./mate-session-manager { };
     mate-settings-daemon = callPackage ./mate-settings-daemon { };
     mate-terminal = callPackage ./mate-terminal { };
@@ -55,6 +56,7 @@ let
       engrampa
       eom
       mate-icon-theme-faenza
+      mate-power-manager
       mate-terminal
       pluma
     ];

pkgs/desktops/mate/mate-power-manager/default.nix

@@ -0,0 +1,44 @@
+{ stdenv, fetchurl, pkgconfig, intltool, glib, itstool, libxml2, mate, libnotify, libcanberra_gtk3, dbus_glib, upower, gnome3, libtool, wrapGAppsHook }:
+
+stdenv.mkDerivation rec {
+  name = "mate-power-manager-${version}";
+  version = "${major-ver}.${minor-ver}";
+  major-ver = "1.18";
+  minor-ver = "0";
+
+  src = fetchurl {
+    url = "http://pub.mate-desktop.org/releases/${major-ver}/${name}.tar.xz";
+    sha256 = "1gmka9ybxvkrdjaga1md6pbw6q1cx5yxb58ai5315a0f5p45y36x";
+  };
+
+  buildInputs = [
+     glib
+     itstool
+     libxml2
+     libcanberra_gtk3
+     gnome3.gtk
+     gnome3.libgnome_keyring
+     libnotify
+     dbus_glib
+     upower
+
+     mate.mate-panel
+  ];
+
+  nativeBuildInputs = [
+    pkgconfig
+    intltool
+    libtool
+    wrapGAppsHook
+  ];
+
+  configureFlags = [ "--enable-applets" ];
+
+  meta = with stdenv.lib; {
+    description = "The MATE Power Manager";
+    homepage = http://mate-desktop.org;
+    license = licenses.gpl3;
+    platforms = platforms.unix;
+    maintainers = [ maintainers.romildo maintainers.chpatrick ];
+  };
+}

pkgs/desktops/plasma-5/default.nix

@@ -137,6 +137,7 @@ let
       plasma-workspace-wallpapers = callPackage ./plasma-workspace-wallpapers.nix {};
       polkit-kde-agent = callPackage ./polkit-kde-agent.nix {};
       powerdevil = callPackage ./powerdevil.nix {};
+      sddm-kcm = callPackage ./sddm-kcm.nix {};
       startkde = callPackage ./startkde {};
       systemsettings = callPackage ./systemsettings.nix {};
     };

pkgs/desktops/plasma-5/sddm-kcm.nix

@@ -0,0 +1,16 @@
+{
+  mkDerivation, extra-cmake-modules, shared_mime_info,
+  libpthreadstubs, libXcursor, libXdmcp,
+  qtquickcontrols2, qtx11extras,
+  karchive, ki18n, kio, knewstuff
+}:
+
+mkDerivation {
+  name = "sddm-kcm";
+  nativeBuildInputs = [ extra-cmake-modules shared_mime_info ];
+  buildInputs = [
+    libpthreadstubs libXcursor libXdmcp
+    qtquickcontrols2 qtx11extras
+    karchive ki18n kio knewstuff
+  ];
+}