Merge master into staging

2024-09-23 05:35:50 +02:00 · 2018-08-26 12:10:05 +02:00 · 2018-08-26 12:10:05 +02:00 · b61b993b75
parent f02bfc74c9 4d3ce5ca36
commit b61b993b75
95 changed files with 2446 additions and 1934 deletions
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@ -645,9 +645,15 @@ in python.withPackages(ps: [ps.blaze])).env

 #### `buildPythonApplication` function

-The `buildPythonApplication` function is practically the same as `buildPythonPackage`.
-The difference is that `buildPythonPackage` by default prefixes the names of the packages with the version of the interpreter.
-Because this is irrelevant for applications, the prefix is omitted.
+The `buildPythonApplication` function is practically the same as
+`buildPythonPackage`. The main purpose of this function is to build a Python
+package where one is interested only in the executables, and not importable
+modules. For that reason, when adding this package to a `python.buildEnv`, the
+modules won't be made available.
+
+Another difference is that `buildPythonPackage` by default prefixes the names of
+the packages with the version of the interpreter. Because this is irrelevant for
+applications, the prefix is omitted.

 #### `toPythonApplication` function

--- a/nixos/doc/manual/release-notes/rl-1809.xml
+++ b/nixos/doc/manual/release-notes/rl-1809.xml
@ -111,6 +111,12 @@ $ nix-instantiate -E '(import &lt;nixpkgsunstable&gt; {}).gitFull'
      <link xlink:href="https://github.com/strongswan/strongswan/blob/master/README_LEGACY.md">stroke configuration interface</link>.
    </para>
   </listitem>
+   <listitem>
+    <para>
+      The new <varname>services.elasticsearch-curator</varname> service
+      periodically curates or manages, your Elasticsearch indices and snapshots.
+    </para>
+   </listitem>
  </itemizedlist>
 </section>

@ -190,6 +196,39 @@ $ nix-instantiate -E '(import &lt;nixpkgsunstable&gt; {}).gitFull'
      which indicates that the nix output hash will be used as tag.
    </para>
   </listitem>
+   <listitem>
+    <para>
+     The ELK stack: <varname>elasticsearch</varname>, <varname>logstash</varname> and <varname>kibana</varname>
+     has been upgraded from 2.* to 6.3.*.
+     The 2.* versions have been <link xlink:href="https://www.elastic.co/support/eol">unsupported since last year</link>
+     so they have been removed. You can still use the 5.* versions under the names
+     <varname>elasticsearch5</varname>, <varname>logstash5</varname> and
+     <varname>kibana5</varname>.
+    </para>
+    <para>
+     The elastic beats:
+     <varname>filebeat</varname>, <varname>heartbeat</varname>,
+     <varname>metricbeat</varname> and <varname>packetbeat</varname>
+     have had the same treatment: they now target 6.3.* as well.
+     The 5.* versions are available under the names:
+     <varname>filebeat5</varname>, <varname>heartbeat5</varname>,
+     <varname>metricbeat5</varname> and <varname>packetbeat5</varname>
+    </para>
+    <para>
+     The ELK-6.3 stack now comes with
+     <link xlink:href="https://www.elastic.co/products/x-pack/open">X-Pack by default</link>.
+     Since X-Pack is licensed under the
+     <link xlink:href="https://github.com/elastic/elasticsearch/blob/master/licenses/ELASTIC-LICENSE.txt">Elastic License</link>
+     the ELK packages now have an unfree license. To use them you need to specify
+     <literal>allowUnfree = true;</literal> in your nixpkgs configuration.
+    </para>
+    <para>
+     Fortunately there is also a free variant of the ELK stack without X-Pack.
+     The packages are available under the names:
+     <varname>elasticsearch-oss</varname>, <varname>logstash-oss</varname> and
+     <varname>kibana-oss</varname>.
+    </para>
+   </listitem>
   <listitem>
    <para>
      Options
--- a/nixos/lib/qemu-flags.nix
+++ b/nixos/lib/qemu-flags.nix
@ -1,11 +1,15 @@
 # QEMU flags shared between various Nix expressions.
 { pkgs }:

+let
+  zeroPad = n: if n < 10 then "0${toString n}" else toString n;
+in
+
 {

  qemuNICFlags = nic: net: machine:
-    [ "-net nic,vlan=${toString nic},macaddr=52:54:00:12:${toString net}:${toString machine},model=virtio"
-      "-net vde,vlan=${toString nic},sock=$QEMU_VDE_SOCKET_${toString net}"
+    [ "-device virtio-net-pci,netdev=vlan${toString nic},mac=52:54:00:12:${zeroPad net}:${zeroPad machine}"
+      "-netdev vde,id=vlan${toString nic},sock=$QEMU_VDE_SOCKET_${toString net}"
    ];

  qemuSerialDevice = if pkgs.stdenv.isi686 || pkgs.stdenv.isx86_64 then "ttyS0"
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -250,6 +250,7 @@
  ./services/desktops/zeitgeist.nix
  ./services/development/bloop.nix
  ./services/development/hoogle.nix
+  ./services/development/jupyter/default.nix
  ./services/editors/emacs.nix
  ./services/editors/infinoted.nix
  ./services/games/factorio.nix
@ -623,6 +624,7 @@
  ./services/scheduling/fcron.nix
  ./services/scheduling/marathon.nix
  ./services/search/elasticsearch.nix
+  ./services/search/elasticsearch-curator.nix
  ./services/search/hound.nix
  ./services/search/kibana.nix
  ./services/search/solr.nix
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@ -256,6 +256,7 @@ with lib;
    (mkRemovedOptionModule [ "fonts" "fontconfig" "forceAutohint" ] "")
    (mkRemovedOptionModule [ "fonts" "fontconfig" "renderMonoTTFAsBitmap" ] "")
    (mkRemovedOptionModule [ "virtualisation" "xen" "qemu" ] "You don't need this option anymore, it will work without it.")
+    (mkRemovedOptionModule [ "services" "logstash" "enableWeb" ] "The web interface was removed from logstash")
    (mkRemovedOptionModule [ "boot" "zfs" "enableLegacyCrypto" ] "The corresponding package was removed from nixpkgs.")

    # ZSH
--- a/nixos/modules/services/development/jupyter/default.nix
+++ b/nixos/modules/services/development/jupyter/default.nix
@ -0,0 +1,184 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  cfg = config.services.jupyter;
+
+  # NOTE: We don't use top-level jupyter because we don't
+  # want to pass in JUPYTER_PATH but use .environment instead,
+  # saving a rebuild.
+  package = pkgs.python3.pkgs.notebook;
+
+  kernels = (pkgs.jupyter-kernel.create  {
+    definitions = if cfg.kernels != null
+      then cfg.kernels
+      else  pkgs.jupyter-kernel.default;
+  });
+
+  notebookConfig = pkgs.writeText "jupyter_config.py" ''
+    ${cfg.notebookConfig}
+
+    c.NotebookApp.password = ${cfg.password}
+  '';
+
+in {
+  meta.maintainers = with maintainers; [ aborsu ];
+
+  options.services.jupyter = {
+    enable = mkEnableOption "Jupyter development server";
+
+    ip = mkOption {
+      type = types.str;
+      default = "localhost";
+      description = ''
+        IP address Jupyter will be listening on.
+      '';
+    };
+
+    port = mkOption {
+      type = types.int;
+      default = 8888;
+      description = ''
+        Port number Jupyter will be listening on.
+      '';
+    };
+
+    notebookDir = mkOption {
+      type = types.str;
+      default = "~/";
+      description = ''
+        Root directory for notebooks.
+      '';
+    };
+
+    user = mkOption {
+      type = types.str;
+      default = "jupyter";
+      description = ''
+        Name of the user used to run the jupyter service.
+        For security reason, jupyter should really not be run as root.
+        If not set (jupyter), the service will create a jupyter user with appropriate settings.
+      '';
+      example = "aborsu";
+    };
+
+    group = mkOption {
+      type = types.str;
+      default = "jupyter";
+      description = ''
+        Name of the group used to run the jupyter service.
+        Use this if you want to create a group of users that are able to view the notebook directory's content.
+      '';
+      example = "users";
+    };
+
+    password = mkOption {
+      type = types.str;
+      description = ''
+        Password to use with notebook.
+        Can be generated using:
+          In [1]: from notebook.auth import passwd
+          In [2]: passwd('test')
+          Out[2]: 'sha1:1b961dc713fb:88483270a63e57d18d43cf337e629539de1436ba'
+          NOTE: you need to keep the single quote inside the nix string.
+        Or you can use a python oneliner:
+          "open('/path/secret_file', 'r', encoding='utf8').read().strip()"
+        It will be interpreted at the end of the notebookConfig.
+      '';
+      example = [
+        "'sha1:1b961dc713fb:88483270a63e57d18d43cf337e629539de1436ba'"
+        "open('/path/secret_file', 'r', encoding='utf8').read().strip()"
+      ];
+    };
+
+    notebookConfig = mkOption {
+      type = types.lines;
+      default = "";
+      description = ''
+        Raw jupyter config.
+      '';
+    };
+
+    kernels = mkOption {
+      type = types.nullOr (types.attrsOf(types.submodule (import ./kernel-options.nix {
+        inherit lib;
+      })));
+
+      default = null;
+      example = literalExample ''
+        {
+          python3 = let
+            env = (pkgs.python3.withPackages (pythonPackages: with pythonPackages; [
+                    ipykernel
+                    pandas
+                    scikitlearn
+                  ]));
+          in {
+            displayName = "Python 3 for machine learning";
+            argv = [
+              "$ {env.interpreter}"
+              "-m"
+              "ipykernel_launcher"
+              "-f"
+              "{connection_file}"
+            ];
+            language = "python";
+            logo32 = "$ {env.sitePackages}/ipykernel/resources/logo-32x32.png";
+            logo64 = "$ {env.sitePackages}/ipykernel/resources/logo-64x64.png";
+          };
+        }
+      '';
+      description = "Declarative kernel config
+
+      Kernels can be declared in any language that supports and has the required
+      dependencies to communicate with a jupyter server.
+      In python's case, it means that ipykernel package must always be included in
+      the list of packages of the targeted environment.
+      ";
+    };
+  };
+
+  config = mkMerge [
+    (mkIf cfg.enable  {
+      systemd.services.jupyter = {
+        description = "Jupyter development server";
+
+        wantedBy = [ "multi-user.target" ];
+
+        # TODO: Patch notebook so we can explicitly pass in a shell
+        path = [ pkgs.bash ]; # needed for sh in cell magic to work
+
+        environment = {
+          JUPYTER_PATH = toString kernels;
+        };
+
+        serviceConfig = {
+          Restart = "always";
+          ExecStart = ''${package}/bin/jupyter-notebook \
+            --no-browser \
+            --ip=${cfg.ip} \
+            --port=${toString cfg.port} --port-retries 0 \
+            --notebook-dir=${cfg.notebookDir} \
+            --NotebookApp.config_file=${notebookConfig}
+          '';
+          User = cfg.user;
+          Group = cfg.group;
+          WorkingDirectory = "~";
+        };
+      };
+    })
+    (mkIf (cfg.enable && (cfg.group == "jupyter")) {
+      users.groups.jupyter = {};
+    })
+    (mkIf (cfg.enable && (cfg.user == "jupyter")) {
+      users.extraUsers.jupyter = {
+        extraGroups = [ cfg.group ];
+        home = "/var/lib/jupyter";
+        createHome = true;
+        useDefaultShell = true; # needed so that the user can start a terminal.
+      };
+    })
+  ];
+}
--- a/nixos/modules/services/development/jupyter/kernel-options.nix
+++ b/nixos/modules/services/development/jupyter/kernel-options.nix
@ -0,0 +1,60 @@
+# Options that can be used for creating a jupyter kernel.
+{lib }:
+
+with lib;
+
+{
+  options = {
+
+    displayName = mkOption {
+      type = types.str;
+      default = "";
+      example = [
+        "Python 3"
+        "Python 3 for Data Science"
+      ];
+      description = ''
+        Name that will be shown to the user.
+      '';
+    };
+
+    argv = mkOption {
+      type = types.listOf types.str;
+      example = [
+        "{customEnv.interpreter}"
+        "-m"
+        "ipykernel_launcher"
+        "-f"
+        "{connection_file}"
+      ];
+      description = ''
+        Command and arguments to start the kernel.
+      '';
+    };
+
+    language = mkOption {
+      type = types.str;
+      example = "python";
+      description = ''
+        Language of the environment. Typically the name of the binary.
+      '';
+    };
+
+    logo32 = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = "{env.sitePackages}/ipykernel/resources/logo-32x32.png";
+      description = ''
+        Path to 32x32 logo png.
+      '';
+    };
+    logo64 = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = "{env.sitePackages}/ipykernel/resources/logo-64x64.png";
+      description = ''
+        Path to 64x64 logo png.
+      '';
+    };
+  };
+}
--- a/nixos/modules/services/logging/logstash.nix
+++ b/nixos/modules/services/logging/logstash.nix
@ -4,25 +4,12 @@ with lib;

 let
  cfg = config.services.logstash;
-  atLeast54 = versionAtLeast (builtins.parseDrvName cfg.package.name).version "5.4";
  pluginPath = lib.concatStringsSep ":" cfg.plugins;
  havePluginPath = lib.length cfg.plugins > 0;
  ops = lib.optionalString;
-  verbosityFlag =
-    if atLeast54
-    then "--log.level " + cfg.logLevel
-    else {
-      debug = "--debug";
-      info  = "--verbose";
-      warn  = ""; # intentionally empty
-      error = "--quiet";
-      fatal = "--silent";
-    }."${cfg.logLevel}";
+  verbosityFlag = "--log.level " + cfg.logLevel;

-  pluginsPath =
-    if atLeast54
-    then "--path.plugins ${pluginPath}"
-    else "--pluginpath ${pluginPath}";
+  pluginsPath = "--path.plugins ${pluginPath}";

  logstashConf = pkgs.writeText "logstash.conf" ''
    input {
@ -63,7 +50,7 @@ in
        type = types.package;
        default = pkgs.logstash;
        defaultText = "pkgs.logstash";
-        example = literalExample "pkgs.logstash";
+        example = literalExample "pkgs.logstash5";
        description = "Logstash package to use.";
      };

@ -95,12 +82,6 @@ in
        description = "The quantity of filter workers to run.";
      };

-      enableWeb = mkOption {
-        type = types.bool;
-        default = false;
-        description = "Enable the logstash web interface.";
-      };
-
      listenAddress = mkOption {
        type = types.str;
        default = "127.0.0.1";
@ -174,16 +155,6 @@ in
  ###### implementation

  config = mkIf cfg.enable {
-    assertions = [
-      { assertion = atLeast54 -> !cfg.enableWeb;
-        message = ''
-          The logstash web interface is only available for versions older than 5.4.
-          So either set services.logstash.enableWeb = false,
-          or set services.logstash.package to an older logstash.
-        '';
-      }
-    ];
-
    systemd.services.logstash = with pkgs; {
      description = "Logstash Daemon";
      wantedBy = [ "multi-user.target" ];
@ -193,14 +164,12 @@ in
        ExecStartPre = ''${pkgs.coreutils}/bin/mkdir -p "${cfg.dataDir}" ; ${pkgs.coreutils}/bin/chmod 700 "${cfg.dataDir}"'';
        ExecStart = concatStringsSep " " (filter (s: stringLength s != 0) [
          "${cfg.package}/bin/logstash"
-          (ops (!atLeast54) "agent")
          "-w ${toString cfg.filterWorkers}"
          (ops havePluginPath pluginsPath)
          "${verbosityFlag}"
          "-f ${logstashConf}"
-          (ops atLeast54 "--path.settings ${logstashSettingsDir}")
-          (ops atLeast54 "--path.data ${cfg.dataDir}")
-          (ops cfg.enableWeb "-- web -a ${cfg.listenAddress} -p ${cfg.port}")
+          "--path.settings ${logstashSettingsDir}"
+          "--path.data ${cfg.dataDir}"
        ]);
      };
    };
--- a/nixos/modules/services/misc/gitea.nix
+++ b/nixos/modules/services/misc/gitea.nix
@ -261,7 +261,8 @@ in
        runConfig = "${cfg.stateDir}/custom/conf/app.ini";
        secretKey = "${cfg.stateDir}/custom/conf/secret_key";
      in ''
-        mkdir -p ${cfg.stateDir}
+        # Make sure that the stateDir exists, as well as the conf dir in there
+        mkdir -p ${cfg.stateDir}/conf

        # copy custom configuration and generate a random secret key if needed
        ${optionalString (cfg.useWizard == false) ''
@ -290,11 +291,13 @@ in
          sed -ri 's,/nix/store/[a-z0-9.-]+/bin/bash,${pkgs.bash}/bin/bash,g' $HOOKS
          sed -ri 's,/nix/store/[a-z0-9.-]+/bin/perl,${pkgs.perl}/bin/perl,g' $HOOKS
        fi
-        if [ ! -d ${cfg.stateDir}/conf/locale ]
+        # If we have a folder or symlink with gitea locales, remove it
+        if [ -e ${cfg.stateDir}/conf/locale ]
        then
-          mkdir -p ${cfg.stateDir}/conf
-          cp -r ${gitea.out}/locale ${cfg.stateDir}/conf/locale
+          rm -r ${cfg.stateDir}/conf/locale
        fi
+        # And symlink the current gitea locales in place
+        ln -s ${gitea.out}/locale ${cfg.stateDir}/conf/locale
        # update command option in authorized_keys
        if [ -r ${cfg.stateDir}/.ssh/authorized_keys ]
        then
--- a/nixos/modules/services/search/elasticsearch-curator.nix
+++ b/nixos/modules/services/search/elasticsearch-curator.nix
@ -0,0 +1,93 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+    cfg = config.services.elasticsearch-curator;
+    curatorConfig = pkgs.writeTextFile {
+      name = "config.yaml";
+      text = ''
+        ---
+        # Remember, leave a key empty if there is no value.  None will be a string,
+        # not a Python "NoneType"
+        client:
+          hosts: ${builtins.toJSON cfg.hosts}
+          port: ${toString cfg.port}
+          url_prefix:
+          use_ssl: False
+          certificate:
+          client_cert:
+          client_key:
+          ssl_no_validate: False
+          http_auth:
+          timeout: 30
+          master_only: False
+        logging:
+          loglevel: INFO
+          logfile:
+          logformat: default
+          blacklist: ['elasticsearch', 'urllib3']
+        '';
+    };
+    curatorAction = pkgs.writeTextFile {
+      name = "action.yaml";
+      text = cfg.actionYAML;
+    };
+in {
+
+  options.services.elasticsearch-curator = {
+
+    enable = mkEnableOption "elasticsearch curator";
+    interval = mkOption {
+      description = "The frequency to run curator, a systemd.time such as 'hourly'";
+      default = "hourly";
+      type = types.str;
+    };
+    hosts = mkOption {
+      description = "a list of elasticsearch hosts to connect to";
+      type = types.listOf types.str;
+      default = ["localhost"];
+    };
+    port = mkOption {
+      description = "the port that elasticsearch is listening on";
+      type = types.int;
+      default = 9200;
+    };
+    actionYAML = mkOption {
+      description = "curator action.yaml file contents, alternatively use curator-cli which takes a simple action command";
+      example = ''
+        ---
+        actions:
+          1:
+            action: delete_indices
+            description: >-
+              Delete indices older than 45 days (based on index name), for logstash-
+              prefixed indices. Ignore the error if the filter does not result in an
+              actionable list of indices (ignore_empty_list) and exit cleanly.
+            options:
+              ignore_empty_list: True
+              disable_action: False
+            filters:
+            - filtertype: pattern
+              kind: prefix
+              value: logstash-
+            - filtertype: age
+              source: name
+              direction: older
+              timestring: '%Y.%m.%d'
+              unit: days
+              unit_count: 45
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    systemd.services.elasticsearch-curator = {
+      startAt = cfg.interval;
+      serviceConfig = {
+        ExecStart = ''${pkgs.python36Packages.elasticsearch-curator}/bin/curator --config ${curatorConfig} ${curatorAction}'';
+      };
+    };
+  };
+}
--- a/nixos/modules/services/search/elasticsearch.nix
+++ b/nixos/modules/services/search/elasticsearch.nix
@ -5,22 +5,14 @@ with lib;
 let
  cfg = config.services.elasticsearch;

-  es5 = builtins.compareVersions (builtins.parseDrvName cfg.package.name).version "5" >= 0;
-  es6 = builtins.compareVersions (builtins.parseDrvName cfg.package.name).version "6" >= 0;
+  es6 = builtins.compareVersions cfg.package.version "6" >= 0;

  esConfig = ''
    network.host: ${cfg.listenAddress}
    cluster.name: ${cfg.cluster_name}

-    ${if es5 then ''
-      http.port: ${toString cfg.port}
-      transport.tcp.port: ${toString cfg.tcp_port}
-    '' else ''
-      network.port: ${toString cfg.port}
-      network.tcp.port: ${toString cfg.tcp_port}
-      # TODO: find a way to enable security manager
-      security.manager.enabled: false
-    ''}
+    http.port: ${toString cfg.port}
+    transport.tcp.port: ${toString cfg.tcp_port}

    ${cfg.extraConf}
  '';
@ -32,7 +24,7 @@ let
    text = esConfig;
  };

-  loggingConfigFilename = if es5 then "log4j2.properties" else "logging.yml";
+  loggingConfigFilename = "log4j2.properties";
  loggingConfigFile = pkgs.writeTextFile {
    name = loggingConfigFilename;
    text = cfg.logging;
@ -41,8 +33,7 @@ let
  esPlugins = pkgs.buildEnv {
    name = "elasticsearch-plugins";
    paths = cfg.plugins;
-    # Elasticsearch 5.x won't start when the plugins directory does not exist
-    postBuild = if es5 then "${pkgs.coreutils}/bin/mkdir -p $out/plugins" else "";
+    postBuild = "${pkgs.coreutils}/bin/mkdir -p $out/plugins";
  };

 in {
@ -58,8 +49,8 @@ in {

    package = mkOption {
      description = "Elasticsearch package to use.";
-      default = pkgs.elasticsearch2;
-      defaultText = "pkgs.elasticsearch2";
+      default = pkgs.elasticsearch;
+      defaultText = "pkgs.elasticsearch";
      type = types.package;
    };

@ -100,30 +91,18 @@ in {

    logging = mkOption {
      description = "Elasticsearch logging configuration.";
-      default =
-        if es5 then ''
-          logger.action.name = org.elasticsearch.action
-          logger.action.level = info
+      default = ''
+        logger.action.name = org.elasticsearch.action
+        logger.action.level = info

-          appender.console.type = Console
-          appender.console.name = console
-          appender.console.layout.type = PatternLayout
-          appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] %marker%m%n
+        appender.console.type = Console
+        appender.console.name = console
+        appender.console.layout.type = PatternLayout
+        appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] %marker%m%n

-          rootLogger.level = info
-          rootLogger.appenderRef.console.ref = console
-        '' else ''
-          rootLogger: INFO, console
-          logger:
-            action: INFO
-            com.amazonaws: WARN
-          appender:
-            console:
-              type: console
-              layout:
-                type: consolePattern
-                conversionPattern: "[%d{ISO8601}][%-5p][%-25c] %m%n"
-        '';
+        rootLogger.level = info
+        rootLogger.appenderRef.console.ref = console
+      '';
      type = types.str;
    };

@ -204,9 +183,9 @@ in {

        cp ${elasticsearchYml} ${configDir}/elasticsearch.yml
        # Make sure the logging configuration for old elasticsearch versions is removed:
-        rm -f ${if es5 then "${configDir}/logging.yml" else "${configDir}/log4j2.properties"}
+        rm -f "${configDir}/logging.yml"
        cp ${loggingConfigFile} ${configDir}/${loggingConfigFilename}
-        ${optionalString es5 "mkdir -p ${configDir}/scripts"}
+        mkdir -p ${configDir}/scripts
        ${optionalString es6 "cp ${cfg.package}/config/jvm.options ${configDir}/jvm.options"}

        if [ "$(id -u)" = 0 ]; then chown -R elasticsearch:elasticsearch ${cfg.dataDir}; fi
--- a/nixos/modules/services/search/kibana.nix
+++ b/nixos/modules/services/search/kibana.nix
@ -5,43 +5,7 @@ with lib;
 let
  cfg = config.services.kibana;

-  atLeast54 = versionAtLeast (builtins.parseDrvName cfg.package.name).version "5.4";
-
-  cfgFile = if atLeast54 then cfgFile5 else cfgFile4;
-
-  cfgFile4 = pkgs.writeText "kibana.json" (builtins.toJSON (
-    (filterAttrsRecursive (n: v: v != null) ({
-      host = cfg.listenAddress;
-      port = cfg.port;
-      ssl_cert_file = cfg.cert;
-      ssl_key_file = cfg.key;
-
-      kibana_index = cfg.index;
-      default_app_id = cfg.defaultAppId;
-
-      elasticsearch_url = cfg.elasticsearch.url;
-      kibana_elasticsearch_username = cfg.elasticsearch.username;
-      kibana_elasticsearch_password = cfg.elasticsearch.password;
-      kibana_elasticsearch_cert = cfg.elasticsearch.cert;
-      kibana_elasticsearch_key = cfg.elasticsearch.key;
-      ca = cfg.elasticsearch.ca;
-
-      bundled_plugin_ids = [
-        "plugins/dashboard/index"
-        "plugins/discover/index"
-        "plugins/doc/index"
-        "plugins/kibana/index"
-        "plugins/markdown_vis/index"
-        "plugins/metric_vis/index"
-        "plugins/settings/index"
-        "plugins/table_vis/index"
-        "plugins/vis_types/index"
-        "plugins/visualize/index"
-      ];
-    } // cfg.extraConf)
-  )));
-
-  cfgFile5 = pkgs.writeText "kibana.json" (builtins.toJSON (
+  cfgFile = pkgs.writeText "kibana.json" (builtins.toJSON (
    (filterAttrsRecursive (n: v: v != null) ({
      server.host = cfg.listenAddress;
      server.port = cfg.port;
--- a/nixos/tests/ec2.nix
+++ b/nixos/tests/ec2.nix
@ -68,7 +68,9 @@ let
          # again when it deletes link-local addresses.) Ideally we'd
          # turn off the DHCP server, but qemu does not have an option
          # to do that.
-          my $startCommand = "qemu-kvm -m 768 -net nic,vlan=0,model=virtio -net 'user,vlan=0,net=169.0.0.0/8,guestfwd=tcp:169.254.169.254:80-cmd:${pkgs.micro-httpd}/bin/micro_httpd ${metaData}'";
+          my $startCommand = "qemu-kvm -m 768";
+          $startCommand .= " -device virtio-net-pci,netdev=vlan0";
+          $startCommand .= " -netdev 'user,id=vlan0,net=169.0.0.0/8,guestfwd=tcp:169.254.169.254:80-cmd:${pkgs.micro-httpd}/bin/micro_httpd ${metaData}'";
          $startCommand .= " -drive file=$diskImage,if=virtio,werror=report";
          $startCommand .= " \$QEMU_OPTS";

--- a/nixos/tests/elk.nix
+++ b/nixos/tests/elk.nix
@ -63,6 +63,33 @@ let
                package = elk.kibana;
                elasticsearch.url = esUrl;
              };
+
+              elasticsearch-curator = {
+                enable = true;
+                actionYAML = ''
+                ---
+                actions:
+                  1:
+                    action: delete_indices
+                    description: >-
+                      Delete indices older than 1 second (based on index name), for logstash-
+                      prefixed indices. Ignore the error if the filter does not result in an
+                      actionable list of indices (ignore_empty_list) and exit cleanly.
+                    options:
+                      ignore_empty_list: True
+                      disable_action: False
+                    filters:
+                    - filtertype: pattern
+                      kind: prefix
+                      value: logstash-
+                    - filtertype: age
+                      source: name
+                      direction: older
+                      timestring: '%Y.%m.%d'
+                      unit: seconds
+                      unit_count: 1
+                '';
+              };
            };
          };
      };
@ -91,6 +118,11 @@ let
      # See if logstash messages arive in elasticsearch.
      $one->waitUntilSucceeds("curl --silent --show-error '${esUrl}/_search' -H 'Content-Type: application/json' -d '{\"query\" : { \"match\" : { \"message\" : \"flowers\"}}}' | jq .hits.total | grep -v 0");
      $one->waitUntilSucceeds("curl --silent --show-error '${esUrl}/_search' -H 'Content-Type: application/json' -d '{\"query\" : { \"match\" : { \"message\" : \"dragons\"}}}' | jq .hits.total | grep 0");
+
+      # Test elasticsearch-curator.
+      $one->systemctl("stop logstash");
+      $one->systemctl("start elasticsearch-curator");
+      $one->waitUntilSucceeds("! curl --silent --show-error '${esUrl}/_cat/indices' | grep logstash | grep -q ^$1");
    '';
  };
 in mapAttrs mkElkTest {
--- a/nixos/tests/matrix-synapse.nix
+++ b/nixos/tests/matrix-synapse.nix
@ -6,12 +6,13 @@ import ./make-test.nix ({ pkgs, ... } : {
  };

  nodes = {
-    server_postgres = args: {
+    # Since 0.33.0, matrix-synapse doesn't allow underscores in server names
+    serverpostgres = args: {
      services.matrix-synapse.enable = true;
      services.matrix-synapse.database_type = "psycopg2";
    };

-    server_sqlite = args: {
+    serversqlite = args: {
      services.matrix-synapse.enable = true;
      services.matrix-synapse.database_type = "sqlite3";
    };
@ -19,12 +20,12 @@ import ./make-test.nix ({ pkgs, ... } : {

  testScript = ''
    startAll;
-    $server_postgres->waitForUnit("matrix-synapse.service");
-    $server_postgres->waitUntilSucceeds("curl -Lk https://localhost:8448/");
-    $server_postgres->requireActiveUnit("postgresql.service");
-    $server_sqlite->waitForUnit("matrix-synapse.service");
-    $server_sqlite->waitUntilSucceeds("curl -Lk https://localhost:8448/");
-    $server_sqlite->mustSucceed("[ -e /var/lib/matrix-synapse/homeserver.db ]");
+    $serverpostgres->waitForUnit("matrix-synapse.service");
+    $serverpostgres->waitUntilSucceeds("curl -Lk https://localhost:8448/");
+    $serverpostgres->requireActiveUnit("postgresql.service");
+    $serversqlite->waitForUnit("matrix-synapse.service");
+    $serversqlite->waitUntilSucceeds("curl -Lk https://localhost:8448/");
+    $serversqlite->mustSucceed("[ -e /var/lib/matrix-synapse/homeserver.db ]");
  '';

 })
--- a/nixos/tests/munin.nix
+++ b/nixos/tests/munin.nix
@ -12,16 +12,23 @@ import ./make-test.nix ({ pkgs, ...} : {
      { config, ... }:
        {
          services = {
-           munin-node.enable = true;
-           munin-cron = {
+           munin-node = {
             enable = true;
-             hosts = ''
-               [${config.networking.hostName}]
-               address localhost
+             # disable a failing plugin to prevent irrelevant error message, see #23049
+             extraConfig = ''
+               ignore_file ^apc_nis$
             '';
           };
+           munin-cron = {
+            enable = true;
+            hosts = ''
+              [${config.networking.hostName}]
+              address localhost
+            '';
+           };
          };
-          systemd.services.munin-node.serviceConfig.TimeoutStartSec = "3min";
+          # long timeout to prevent hydra failure on high load
+          systemd.services.munin-node.serviceConfig.TimeoutStartSec = "10min";
        };
    };

@ -29,7 +36,10 @@ import ./make-test.nix ({ pkgs, ...} : {
    startAll;

    $one->waitForUnit("munin-node.service");
+    # make sure the node is actually listening
+    $one->waitForOpenPort(4949);
    $one->succeed('systemctl start munin-cron');
+    # wait for munin-cron output
    $one->waitForFile("/var/lib/munin/one/one-uptime-uptime-g.rrd");
    $one->waitForFile("/var/www/munin/one/index.html");
  '';
--- a/pkgs/applications/audio/google-play-music-desktop-player/default.nix
+++ b/pkgs/applications/audio/google-play-music-desktop-player/default.nix
@ -1,10 +1,10 @@
 { stdenv, alsaLib, atk, cairo, cups, dbus, dpkg, expat, fontconfig, freetype
-, fetchurl, GConf, gdk_pixbuf, glib, gtk2, libpulseaudio, makeWrapper, nspr
+, fetchurl, GConf, gdk_pixbuf, glib, gtk2, gtk3, libpulseaudio, makeWrapper, nspr
 , nss, pango, udev, xorg
 }:

 let
-  version = "4.5.0";
+  version = "4.6.1";

  deps = [
    alsaLib
@ -19,6 +19,7 @@ let
    gdk_pixbuf
    glib
    gtk2
+    gtk3
    libpulseaudio
    nspr
    nss
@ -46,7 +47,7 @@ stdenv.mkDerivation {

  src = fetchurl {
    url = "https://github.com/MarshallOfSound/Google-Play-Music-Desktop-Player-UNOFFICIAL-/releases/download/v${version}/google-play-music-desktop-player_${version}_amd64.deb";
-    sha256 = "06h9g1yhd5q7gg8v55q143fr65frxg0khfgckr03gsaw0swin51q";
+    sha256 = "0dyn2fxhcri9d9nmcprszs6yg79gsr09bjfzzb1p10yjmi77cj2g";
  };

  dontBuild = true;
--- a/pkgs/applications/audio/split2flac/default.nix
+++ b/pkgs/applications/audio/split2flac/default.nix
@ -0,0 +1,62 @@
+{ stdenv, fetchFromGitHub, makeWrapper
+, shntool, cuetools
+, flac, faac, mp4v2, wavpack, mac
+, imagemagick, libiconv, enca, lame, pythonPackages, vorbis-tools
+, aacgain, mp3gain, vorbisgain
+}:
+
+let
+  wrapSplit2flac =  format: ''
+    makeWrapper $out/bin/.split2flac-wrapped $out/bin/split2${format} \
+      --set SPLIT2FLAC_FORMAT ${format} \
+      --prefix PATH : ${stdenv.lib.makeBinPath [
+        shntool cuetools
+        flac faac mp4v2 wavpack mac
+        imagemagick libiconv enca lame pythonPackages.mutagen vorbis-tools
+        aacgain mp3gain vorbisgain
+      ]}
+  '';
+
+in stdenv.mkDerivation rec {
+  name = "split2flac-${version}";
+  version = "122";
+
+  src = fetchFromGitHub {
+    owner = "ftrvxmtrx";
+    repo = "split2flac";
+    rev = version;
+    sha256 = "1a71amamip25hhqx7wwzfcl3d5snry9xsiha0kw73iq2m83r2k63";
+  };
+
+  dontBuild = true;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  patchPhase = ''
+    substituteInPlace split2flac \
+      --replace 'FORMAT="''${0##*split2}"' 'FORMAT=''${SPLIT2FLAC_FORMAT:-flac}'
+  '';
+
+  installPhase = ''
+    mkdir -p $out/share/bash-completion/completions
+    cp split2flac-bash-completion.sh \
+      $out/share/bash-completion/completions/split2flac-bash-completion.sh
+
+    mkdir -p $out/bin
+    cp split2flac $out/bin/.split2flac-wrapped
+
+    ${wrapSplit2flac "flac"}
+    ${wrapSplit2flac "mp3"}
+    ${wrapSplit2flac "ogg"}
+    ${wrapSplit2flac "m4a"}
+    ${wrapSplit2flac "wav"}
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Split flac/ape/wv/wav + cue sheet into separate tracks";
+    homepage = https://github.com/ftrvxmtrx/split2flac;
+    license = licenses.mit;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ jfrankenau ];
+  };
+}
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@ -13,9 +13,9 @@ let
    sha256Hash = "0xx6yprylmcb32ipmwdcfkgddlm1nrxi1w68miclvgrbk015brf2";
  };
  betaVersion = {
-    version = "3.2.0.23"; # "Android Studio 3.2 RC 1"
-    build = "181.4963425";
-    sha256Hash = "0b3mmafpnc07chiy3fv3vlrarkiwbb0c62x3qk26kpxq1l6m8bgw";
+    version = "3.2.0.24"; # "Android Studio 3.2 RC 2"
+    build = "181.4974118";
+    sha256Hash = "0sj848pzpsbmnfi2692gg73v6m72hr1pwlk5x8q912w60iypi3pz";
  };
  latestVersion = { # canary & dev
    version = "3.3.0.6"; # "Android Studio 3.3 Canary 7"
--- a/pkgs/applications/editors/jupyter/default.nix
+++ b/pkgs/applications/editors/jupyter/default.nix
@ -0,0 +1,18 @@
+# Jupyter notebook with the given kernel definitions
+
+{ python3
+, jupyter-kernel
+, definitions ? jupyter-kernel.default
+}:
+
+let
+
+  jupyterPath = (jupyter-kernel.create { inherit definitions; });
+
+in
+
+with python3.pkgs; toPythonModule (
+  notebook.overridePythonAttrs(oldAttrs: {
+    makeWrapperArgs = ["--set JUPYTER_PATH ${jupyterPath}"];
+  })
+)
--- a/pkgs/applications/editors/jupyter/kernel.nix
+++ b/pkgs/applications/editors/jupyter/kernel.nix
@ -0,0 +1,74 @@
+{ lib, stdenv, python3}:
+
+let
+
+  default = {
+    python3 = let
+      env = (python3.withPackages (ps: with ps; [ ipykernel ]));
+    in {
+      displayName = "Python 3";
+      argv = [
+        "${env.interpreter}"
+        "-m"
+        "ipykernel_launcher"
+        "-f"
+        "{connection_file}"
+      ];
+      language = "python";
+      logo32 = "${env.sitePackages}/ipykernel/resources/logo-32x32.png";
+      logo64 = "${env.sitePackages}/ipykernel/resources/logo-64x64.png";
+    };
+  };
+
+in
+{
+  inherit default;
+
+  # Definitions is an attribute set.
+
+  create = { definitions ?  default }: with lib; stdenv.mkDerivation rec {
+
+    name = "jupyter-kernels";
+
+    src = "/dev/null";
+
+    unpackCmd = "mkdir jupyter_kernels";
+
+    installPhase =  ''
+      mkdir kernels
+
+      ${concatStringsSep "\n" (mapAttrsToList (kernelName: kernel:
+        let
+          config = builtins.toJSON {
+            display_name = if (kernel.displayName != "")
+              then kernel.displayName
+              else kernelName;
+            argv = kernel.argv;
+            language = kernel.language;
+          };
+          logo32 =
+            if (kernel.logo32 != null)
+            then "ln -s ${kernel.logo32} 'kernels/${kernelName}/logo-32x32.png';"
+            else "";
+          logo64 =
+            if (kernel.logo64 != null)
+            then "ln -s ${kernel.logo64} 'kernels/${kernelName}/logo-64x64.png';"
+            else "";
+        in ''
+          mkdir 'kernels/${kernelName}';
+          echo '${config}' > 'kernels/${kernelName}/kernel.json';
+          ${logo32}
+          ${logo64}
+        '') definitions)}
+
+      mkdir $out
+      cp -r kernels $out
+    '';
+
+    meta = {
+      description = "Wrapper to create jupyter notebook kernel definitions";
+      homepage = http://jupyter.org/;
+      maintainers = with maintainers; [ aborsu ];
+    };
+  };
+}
--- a/pkgs/applications/editors/kdevelop5/kdevelop.nix
+++ b/pkgs/applications/editors/kdevelop5/kdevelop.nix
@ -1,23 +1,23 @@
 { mkDerivation, lib, fetchurl, cmake, gettext, pkgconfig, extra-cmake-modules
-, qtquickcontrols, qtwebkit, qttools, kde-cli-tools
+, qtquickcontrols, qtwebkit, qttools, kde-cli-tools, qtbase
 , kconfig, kdeclarative, kdoctools, kiconthemes, ki18n, kitemmodels, kitemviews
 , kjobwidgets, kcmutils, kio, knewstuff, knotifyconfig, kparts, ktexteditor
 , threadweaver, kxmlgui, kwindowsystem, grantlee, kcrash, karchive, kguiaddons
-, plasma-framework, krunner, kdevplatform, kdevelop-pg-qt, shared-mime-info
-, libksysguard, konsole, llvmPackages, makeWrapper
+, plasma-framework, krunner, kdevelop-pg-qt, shared-mime-info, libkomparediff2
+, libksysguard, konsole, llvmPackages, makeWrapper, kpurpose, boost
 }:

 let
  pname = "kdevelop";
-  version = "5.1.2";
-
+  version = "5.2.4";
+  qtVersion = "5.${lib.versions.minor qtbase.version}";
 in
 mkDerivation rec {
  name = "${pname}-${version}";

  src = fetchurl {
    url = "mirror://kde/stable/${pname}/${version}/src/${name}.tar.xz";
-    sha256 = "af54e807847d145fe5f3eb55962ed0d22e6363c2bc6c32167e51ca4823c00ac7";
+    sha256 = "1jbks7nh9rybz4kg152l39hfj2x0p6mjins8x9mz03bbv8jf8gic";
  };

  nativeBuildInputs = [
@ -30,20 +30,22 @@ mkDerivation rec {
  ];

  propagatedBuildInputs = [
-    qtquickcontrols qtwebkit
+    qtquickcontrols qtwebkit boost libkomparediff2
    kconfig kdeclarative kdoctools kiconthemes ki18n kitemmodels kitemviews
    kjobwidgets kcmutils kio knewstuff knotifyconfig kparts ktexteditor
    threadweaver kxmlgui kwindowsystem grantlee plasma-framework krunner
-    kdevplatform shared-mime-info libksysguard konsole kcrash karchive kguiaddons
+    shared-mime-info libksysguard konsole kcrash karchive kguiaddons kpurpose
  ];

  postInstall = ''
    # The kdevelop! script (shell environment) needs qdbus and kioclient5 in PATH.
-    wrapProgram "$out/bin/kdevelop!" --prefix PATH ":" "${lib.makeBinPath [ qttools kde-cli-tools ]}"
+    wrapProgram "$out/bin/kdevelop!" \
+      --prefix PATH ":" "${lib.makeBinPath [ qttools kde-cli-tools ]}"
+
+    wrapProgram "$out/bin/kdevelop" \
+      --prefix QT_PLUGIN_PATH : $out/lib/qt-${qtVersion}/plugins

    # Fix the (now wrapped) kdevelop! to find things in right places:
-    # - Make KDEV_BASEDIR point to bin directory of kdevplatform.
-    kdev_fixup_sed="s|^export KDEV_BASEDIR=.*$|export KDEV_BASEDIR=${kdevplatform}/bin|"
    # - Fixup the one use where KDEV_BASEDIR is assumed to contain kdevelop.
    kdev_fixup_sed+=";s|\\\$KDEV_BASEDIR/kdevelop|$out/bin/kdevelop|"
    sed -E -i "$kdev_fixup_sed" "$out/bin/.kdevelop!-wrapped"
--- a/pkgs/applications/editors/kdevelop5/kdevplatform.nix
+++ b/pkgs/applications/editors/kdevelop5/kdevplatform.nix
@ -1,44 +0,0 @@
-{ stdenv, fetchurl, cmake, gettext, pkgconfig, extra-cmake-modules
-, boost, subversion, apr, aprutil, kwindowsystem
-, qtscript, qtwebkit, grantlee, karchive, kconfig, kcoreaddons, kguiaddons, kiconthemes, ki18n
-, kitemmodels, kitemviews, kio, kparts, sonnet, kcmutils, knewstuff, knotifications
-, knotifyconfig, ktexteditor, threadweaver, kdeclarative, libkomparediff2 }:
-
-let
-  pname = "kdevplatform";
-  version = "5.1.2";
-
-in
-stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
-
-  src = fetchurl {
-    url = "mirror://kde/stable/kdevelop/${version}/src/${name}.tar.xz";
-    sha256 = "e622ddad552a678baaf1166d5cbdc5fd1192d2324300c52ef2d25f1c6778664a";
-  };
-
-  nativeBuildInputs = [ cmake gettext pkgconfig extra-cmake-modules ];
-
-  buildInputs = [
-    boost subversion apr aprutil kwindowsystem
-    qtscript qtwebkit grantlee karchive kconfig kcoreaddons kguiaddons kiconthemes
-    ki18n kitemmodels kitemviews kio kparts sonnet kcmutils knewstuff
-    knotifications knotifyconfig ktexteditor threadweaver kdeclarative
-    libkomparediff2
-  ];
-
-  enableParallelBuilding = true;
-
-  meta = with stdenv.lib; {
-    maintainers = [ maintainers.ambrop72 ];
-    platforms = platforms.linux;
-    description = "KDE libraries for IDE-like programs";
-    longDescription = ''
-      A free, opensource set of libraries that can be used as a foundation for
-      IDE-like programs. It is programing-language independent, and is planned
-      to be used by programs like: KDevelop, Quanta, Kile, KTechLab ... etc."
-    '';
-    homepage = https://www.kdevelop.org;
-    license = with stdenv.lib.licenses; [ gpl2Plus lgpl2Plus ];
-  };
-}
--- a/pkgs/applications/kde/default.nix
+++ b/pkgs/applications/kde/default.nix
@ -113,6 +113,7 @@ let
      kidentitymanagement = callPackage ./kidentitymanagement.nix {};
      kig = callPackage ./kig.nix {};
      kimap = callPackage ./kimap.nix {};
+      kitinerary = callPackage ./kitinerary.nix {};
      kio-extras = callPackage ./kio-extras.nix {};
      kldap = callPackage ./kldap.nix {};
      kleopatra = callPackage ./kleopatra.nix {};
@ -132,6 +133,7 @@ let
      kpimtextedit = callPackage ./kpimtextedit.nix {};
      ksmtp = callPackage ./ksmtp {};
      kqtquickcharts = callPackage ./kqtquickcharts.nix {};
+      kpkpass = callPackage ./kpkpass.nix {};
      krdc = callPackage ./krdc.nix {};
      krfb = callPackage ./krfb.nix {};
      kruler = callPackage ./kruler.nix {};
--- a/pkgs/applications/kde/dolphin.nix
+++ b/pkgs/applications/kde/dolphin.nix
@ -21,4 +21,8 @@ mkDerivation {
    phonon solid
  ];
  outputs = [ "out" "dev" ];
+  # We need the RPATH for linking, because the `libkdeinit5_dolphin.so` links
+  # private against its dependencies and without the correct RPATH, these
+  # dependencies are not found.
+  cmakeFlags = [ "-DCMAKE_SKIP_BUILD_RPATH=OFF" ];
 }
--- a/pkgs/applications/kde/eventviews.nix
+++ b/pkgs/applications/kde/eventviews.nix
@ -1,7 +1,8 @@
 {
  mkDerivation, lib, kdepimTeam,
  extra-cmake-modules, kdoctools,
-  akonadi, calendarsupport, kcalutils, kdiagram, libkdepim, qtbase, qttools,
+  akonadi, calendarsupport, kcalutils,
+  kdiagram, libkdepim, qtbase, qttools, kholidays
 }:

 mkDerivation {
@ -12,7 +13,8 @@ mkDerivation {
  };
  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
  buildInputs = [
-    akonadi calendarsupport kcalutils kdiagram libkdepim qtbase qttools
+    akonadi calendarsupport kcalutils kdiagram
+    libkdepim qtbase qttools kholidays
  ];
  outputs = [ "out" "dev" ];
 }
--- a/pkgs/applications/kde/fetch.sh
+++ b/pkgs/applications/kde/fetch.sh
@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/applications/18.04.3/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/applications/18.08.0/ -A '*.tar.xz' )
--- a/pkgs/applications/kde/grantleetheme/grantlee-merge-theme-dirs.patch
+++ b/pkgs/applications/kde/grantleetheme/grantlee-merge-theme-dirs.patch
@ -1,82 +1,8 @@
-Index: grantleetheme-17.04.0/src/grantleetheme_p.h
-===================================================================
--- grantleetheme-17.04.0.orig/src/grantleetheme_p.h
-+++ grantleetheme-17.04.0/src/grantleetheme_p.h
-@@ -47,7 +47,7 @@ public:
-     QString description;
-     QString name;
-     QString dirName;
-    QString absolutePath;
-+    QStringList absolutePaths;
-     QString author;
-     QString email;
- 
-Index: grantleetheme-17.04.0/src/grantleetheme.h
-===================================================================
--- grantleetheme-17.04.0.orig/src/grantleetheme.h
-+++ grantleetheme-17.04.0/src/grantleetheme.h
-@@ -50,11 +50,14 @@ public:
-     QStringList displayExtraVariables() const;
-     QString dirName() const;
-     QString absolutePath() const;
-+    QStringList absolutePaths() const;
-     QString author() const;
-     QString authorEmail() const;
- 
-     QString render(const QString &templateName, const QVariantHash &data, const QByteArray &applicationDomain = QByteArray());
- 
-+    void addThemeDir(const QString&);
-+
-     static void addPluginPath(const QString &path);
- 
- private:
-Index: grantleetheme-17.04.0/src/grantleethememanager.cpp
-===================================================================
--- grantleetheme-17.04.0.orig/src/grantleethememanager.cpp
-+++ grantleetheme-17.04.0/src/grantleethememanager.cpp
-@@ -142,25 +142,18 @@ public:
- 
-         for (const QString &directory : qAsConst(themesDirectories)) {
-             QDirIterator dirIt(directory, QStringList(), QDir::AllDirs | QDir::NoDotAndDotDot);
-            QStringList alreadyLoadedThemeName;
-             while (dirIt.hasNext()) {
-                 dirIt.next();
-                 const QString dirName = dirIt.fileName();
-                 GrantleeTheme::Theme theme = q->loadTheme(dirIt.filePath(), dirName, defaultDesktopFileName);
-                 if (theme.isValid()) {
-                     QString themeName = theme.name();
-                    if (alreadyLoadedThemeName.contains(themeName)) {
-                        int i = 2;
-                        const QString originalName(theme.name());
-                        while (alreadyLoadedThemeName.contains(themeName)) {
-                            themeName = originalName + QStringLiteral(" (%1)").arg(i);
-                            ++i;
-                        }
-                        theme.d->name = themeName;
-+                    QMap<QString, GrantleeTheme::Theme>::iterator i = themes.find(dirName);
-+                    if (i != themes.end()) {
-+                        i.value().addThemeDir(dirIt.filePath());
-+                    } else {
-+                        themes.insert(dirName, theme);
-                     }
-                    alreadyLoadedThemeName << themeName;
-                    themes.insert(dirName, theme);
-                    //qDebug()<<" theme.name()"<<theme.name();
-                 }
-             }
-             watch->addDir(directory);
-@@ -374,7 +367,7 @@ QString ThemeManager::pathFromThemes(con
-                 GrantleeTheme::Theme theme = loadTheme(dirIt.filePath(), dirName, defaultDesktopFileName);
-                 if (theme.isValid()) {
-                     if (dirName == themeName) {
-                        return theme.absolutePath();
-+                        return theme.absolutePaths().first();
-                     }
-                 }
-             }
--- src/grantleetheme.cpp.orig	2017-12-22 16:11:39.863598126 +0300
-+++ ./src/grantleetheme.cpp	2017-12-22 16:16:14.045664607 +0300
-@@ -46,7 +46,7 @@ ThemePrivate::ThemePrivate(const ThemePr
+diff --git a/src/grantleetheme.cpp b/src/grantleetheme.cpp
+index 27d5bc8..8d43140 100644
+--- a/src/grantleetheme.cpp
+++ b/src/grantleetheme.cpp
+@@ -46,7 +46,7 @@ ThemePrivate::ThemePrivate(const ThemePrivate &other)
     , description(other.description)
     , name(other.name)
     , dirName(other.dirName)
@ -105,7 +31,7 @@ Index: grantleetheme-17.04.0/src/grantleethememanager.cpp
     loader->setTheme(dirName);
 
     if (!sEngine) {
-@@ -121,7 +124,7 @@ Theme::Theme(const QString &themePath, c
+@@ -121,7 +124,7 @@ Theme::Theme(const QString &themePath, const QString &dirName, const QString &de
     KConfigGroup group(&config, QStringLiteral("Desktop Entry"));
     if (group.isValid()) {
         d->dirName = dirName;
@ -137,7 +63,7 @@ Index: grantleetheme-17.04.0/src/grantleethememanager.cpp
 }
 
 QString Theme::author() const
-@@ -223,6 +231,13 @@ QString Theme::render(const QString &tem
+@@ -223,6 +231,13 @@ QString Theme::render(const QString &templateName, const QVariantHash &data, con
     return result;
 }
 
@ -151,3 +77,79 @@ Index: grantleetheme-17.04.0/src/grantleethememanager.cpp
 void Theme::addPluginPath(const QString &path)
 {
     if (!ThemePrivate::sEngine) {
+diff --git a/src/grantleetheme.h b/src/grantleetheme.h
+index a25c27b..be38299 100644
+--- a/src/grantleetheme.h
+++ b/src/grantleetheme.h
+@@ -48,11 +48,14 @@ public:
+     Q_REQUIRED_RESULT QStringList displayExtraVariables() const;
+     Q_REQUIRED_RESULT QString dirName() const;
+     Q_REQUIRED_RESULT QString absolutePath() const;
+    Q_REQUIRED_RESULT QStringList absolutePaths() const;
+     Q_REQUIRED_RESULT QString author() const;
+     Q_REQUIRED_RESULT QString authorEmail() const;
+ 
+     Q_REQUIRED_RESULT QString render(const QString &templateName, const QVariantHash &data, const QByteArray &applicationDomain = QByteArray());
+ 
+    void addThemeDir(const QString&);
+
+     static void addPluginPath(const QString &path);
+ 
+ private:
+diff --git a/src/grantleetheme_p.h b/src/grantleetheme_p.h
+index eb73dcb..00510e9 100644
+--- a/src/grantleetheme_p.h
+++ b/src/grantleetheme_p.h
+@@ -43,7 +43,7 @@ public:
+     QString description;
+     QString name;
+     QString dirName;
+-    QString absolutePath;
+    QStringList absolutePaths;
+     QString author;
+     QString email;
+ 
+diff --git a/src/grantleethememanager.cpp b/src/grantleethememanager.cpp
+index 606d717..dc99041 100644
+--- a/src/grantleethememanager.cpp
+++ b/src/grantleethememanager.cpp
+@@ -125,25 +125,18 @@ public:
+ 
+         for (const QString &directory : qAsConst(themesDirectories)) {
+             QDirIterator dirIt(directory, QStringList(), QDir::AllDirs | QDir::NoDotAndDotDot);
+-            QStringList alreadyLoadedThemeName;
+             while (dirIt.hasNext()) {
+                 dirIt.next();
+                 const QString dirName = dirIt.fileName();
+                 GrantleeTheme::Theme theme = q->loadTheme(dirIt.filePath(), dirName, defaultDesktopFileName);
+                 if (theme.isValid()) {
+                     QString themeName = theme.name();
+-                    if (alreadyLoadedThemeName.contains(themeName)) {
+-                        int i = 2;
+-                        const QString originalName(theme.name());
+-                        while (alreadyLoadedThemeName.contains(themeName)) {
+-                            themeName = originalName + QStringLiteral(" (%1)").arg(i);
+-                            ++i;
+-                        }
+-                        theme.d->name = themeName;
+                    QMap<QString, GrantleeTheme::Theme>::iterator i = themes.find(dirName);
+                    if (i != themes.end()) {
+                        i.value().addThemeDir(dirIt.filePath());
+                    } else {
+                        themes.insert(dirName, theme);
+                     }
+-                    alreadyLoadedThemeName << themeName;
+-                    themes.insert(dirName, theme);
+-                    //qDebug()<<" theme.name()"<<theme.name();
+                 }
+             }
+             watch->addDir(directory);
+@@ -366,7 +359,7 @@ QString ThemeManager::pathFromThemes(const QString &themesRelativePath, const QS
+                 GrantleeTheme::Theme theme = loadTheme(dirIt.filePath(), dirName, defaultDesktopFileName);
+                 if (theme.isValid()) {
+                     if (dirName == themeName) {
+-                        return theme.absolutePath();
+                        return theme.absolutePaths().first();
+                     }
+                 }
+             }
--- a/pkgs/applications/kde/kdepim-addons.nix
+++ b/pkgs/applications/kde/kdepim-addons.nix
@ -4,7 +4,8 @@
  akonadi-import-wizard, akonadi-notes, calendarsupport, eventviews,
  incidenceeditor, kcalcore, kcalutils, kconfig, kdbusaddons, kdeclarative,
  kdepim-apps-libs, kholidays, ki18n, kmime, ktexteditor, ktnef, libgravatar,
-  libksieve, mailcommon, mailimporter, messagelib, poppler, prison
+  libksieve, mailcommon, mailimporter, messagelib, poppler, prison, kpkpass,
+  kitinerary
 }:

 mkDerivation {
@ -18,6 +19,7 @@ mkDerivation {
    akonadi-import-wizard akonadi-notes calendarsupport eventviews
    incidenceeditor kcalcore kcalutils kconfig kdbusaddons kdeclarative
    kdepim-apps-libs kholidays ki18n kmime ktexteditor ktnef libgravatar
-    libksieve mailcommon mailimporter messagelib poppler prison
+    libksieve mailcommon mailimporter messagelib poppler prison kpkpass
+    kitinerary
  ];
 }
--- a/pkgs/applications/kde/kitinerary.nix
+++ b/pkgs/applications/kde/kitinerary.nix
@ -0,0 +1,19 @@
+{
+  mkDerivation, lib, extra-cmake-modules
+, qtbase, qtdeclarative, ki18n, kmime, kpkpass
+, poppler, kcontacts, kcalcore
+}:
+
+mkDerivation {
+  name = "kitinerary";
+  meta = {
+    license = with lib.licenses; [ lgpl21 ];
+    maintainers = [ lib.maintainers.bkchr ];
+  };
+  nativeBuildInputs = [ extra-cmake-modules ];
+  buildInputs = [
+    qtbase qtdeclarative ki18n kmime kpkpass poppler
+    kcontacts kcalcore
+  ];
+  outputs = [ "out" "dev" ];
+}
--- a/pkgs/applications/kde/kleopatra.nix
+++ b/pkgs/applications/kde/kleopatra.nix
@ -2,7 +2,7 @@
  mkDerivation, lib, kdepimTeam,
  extra-cmake-modules, kdoctools,
  boost, gpgme, kcmutils, kdbusaddons, kiconthemes, kitemmodels, kmime,
-  knotifications, kwindowsystem, kxmlgui, libkleo
+  knotifications, kwindowsystem, kxmlgui, libkleo, kcrash
 }:

 mkDerivation {
@ -14,6 +14,6 @@ mkDerivation {
  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
  buildInputs = [
    boost gpgme kcmutils kdbusaddons kiconthemes kitemmodels kmime
-    knotifications kwindowsystem kxmlgui libkleo
+    knotifications kwindowsystem kxmlgui libkleo kcrash
  ];
 }
--- a/pkgs/applications/kde/kmailtransport.nix
+++ b/pkgs/applications/kde/kmailtransport.nix
@ -1,7 +1,9 @@
 {
  mkDerivation, lib, kdepimTeam,
  extra-cmake-modules, kdoctools,
-  akonadi, akonadi-mime, cyrus_sasl, kcmutils, ki18n, kio, kmime, kwallet, ksmtp
+  akonadi, akonadi-mime, cyrus_sasl, kcmutils,
+  ki18n, kio, kmime, kwallet, ksmtp, libkgapi,
+  kcalcore, kcontacts
 }:

 mkDerivation {
@ -11,7 +13,7 @@ mkDerivation {
    maintainers = kdepimTeam;
  };
  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
-  buildInputs = [ akonadi kcmutils ki18n kio ksmtp ];
+  buildInputs = [ akonadi kcmutils ki18n kio ksmtp libkgapi kcalcore kcontacts ];
  propagatedBuildInputs = [ akonadi-mime cyrus_sasl kmime kwallet ];
  outputs = [ "out" "dev" ];
 }
--- a/pkgs/applications/kde/kpkpass.nix
+++ b/pkgs/applications/kde/kpkpass.nix
@ -0,0 +1,15 @@
+{
+  mkDerivation, lib, extra-cmake-modules
+, qtbase, karchive, shared-mime-info
+}:
+
+mkDerivation {
+  name = "kpkpass";
+  meta = {
+    license = with lib.licenses; [ lgpl21 ];
+    maintainers = [ lib.maintainers.bkchr ];
+  };
+  nativeBuildInputs = [ extra-cmake-modules shared-mime-info ];
+  buildInputs = [ qtbase karchive ];
+  outputs = [ "out" "dev" ];
+}
--- a/pkgs/applications/kde/libkgapi.nix
+++ b/pkgs/applications/kde/libkgapi.nix
@ -1,7 +1,8 @@
 {
  mkDerivation, lib, kdepimTeam,
  extra-cmake-modules, kdoctools,
-  qtwebengine, kio, kcalcore, kcontacts
+  qtwebengine, kio, kcalcore, kcontacts,
+  cyrus_sasl
 }:

 mkDerivation {
@ -11,5 +12,5 @@ mkDerivation {
    maintainers = kdepimTeam;
  };
  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
-  buildInputs = [ qtwebengine kio kcalcore kcontacts ];
+  buildInputs = [ qtwebengine kio kcalcore kcontacts cyrus_sasl ];
 }
--- a/pkgs/applications/kde/srcs.nix
+++ b/pkgs/applications/kde/srcs.nix
--- a/pkgs/applications/misc/sequeler/default.nix
+++ b/pkgs/applications/misc/sequeler/default.nix
@ -4,7 +4,7 @@


 let
-  version = "0.5.9";
+  version = "0.6.0";
  sqlGda = libgda.override {
    mysqlSupport = true;
    postgresSupport = true;
@ -17,7 +17,7 @@ in stdenv.mkDerivation rec {
    owner = "Alecaddd";
    repo = "sequeler";
    rev = "v${version}";
-    sha256 = "08dgir1prjfh7kxdxksabia5093gcjyy2yy7s57yizszplw2v07v";
+    sha256 = "04x3fg665201g3zy66sicfna4vac4n1pmrahbra90gvfzaia1cai";
  };

  nativeBuildInputs = [ meson ninja pkgconfig vala gobjectIntrospection gettext wrapGAppsHook desktop-file-utils ];
--- a/pkgs/applications/networking/cluster/mesos/default.nix
+++ b/pkgs/applications/networking/cluster/mesos/default.nix
@ -4,6 +4,7 @@
 , leveldb, glog, perf, utillinux, libnl, iproute, openssl, libevent
 , ethtool, coreutils, which, iptables, maven
 , bash, autoreconfHook
+, utf8proc, lz4
 , withJava ? !stdenv.isDarwin
 }:

@ -50,6 +51,7 @@ in stdenv.mkDerivation rec {
    makeWrapper curl sasl
    python wrapPython boto setuptools leveldb
    subversion apr glog openssl libevent
+    utf8proc lz4
  ] ++ lib.optionals stdenv.isLinux [
    libnl
  ] ++ lib.optionals withJava [
--- a/pkgs/applications/networking/firehol/default.nix
+++ b/pkgs/applications/networking/firehol/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  name = "firehol-${version}";
-  version = "3.1.5";
+  version = "3.1.6";

  src = fetchFromGitHub {
    owner = "firehol";
    repo = "firehol";
    rev = "v${version}";
-    sha256 = "15cy1zxfpprma2zkmhj61zzhmw1pfnyhln7pca5lzvr1ifn2d0y0";
+    sha256 = "0l7sjpsb300kqv21hawd26a7jszlmafplacpn5lfj64m4yip93fd";
  };

  patches = [
--- a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
@ -6,7 +6,7 @@ let

  # Please keep the version x.y.0.z and do not update to x.y.76.z because the
  # source of the latter disappears much faster.
-  version = "8.24.0.2";
+  version = "8.28.0.41";

  rpath = stdenv.lib.makeLibraryPath [
    alsaLib
@ -56,7 +56,7 @@ let
    if stdenv.system == "x86_64-linux" then
      fetchurl {
        url = "https://repo.skype.com/deb/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb";
-        sha256 = "079bv0wilwwd9gqykcyfs4bj8za140788dxi058k4275h1jlvrww";
+        sha256 = "1kydf71qbz35dx4674h3nxfx8a88k620217906i54ic4qq2mgy2x";
      }
    else
      throw "Skype for linux is not supported on ${stdenv.system}";
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@ -22,8 +22,6 @@

 with stdenv.lib;
 let
-  version = "2.12.1";
-  sha256 = "1jp5y56682bgpfjapagxjfrjdvqkal34pj9qzn6kj8fqaad80l21";
  audio = optionalString (hasSuffix "linux" stdenv.system) "alsa,"
    + optionalString pulseSupport "pa,"
    + optionalString sdlSupport "sdl,";
@ -36,6 +34,7 @@ let
 in

 stdenv.mkDerivation rec {
+  version = "3.0.0";
  name = "qemu-"
    + stdenv.lib.optionalString xenSupport "xen-"
    + stdenv.lib.optionalString hostCpuOnly "host-cpu-only-"
@ -43,8 +42,8 @@ stdenv.mkDerivation rec {
    + version;

  src = fetchurl {
-    url = "http://wiki.qemu.org/download/qemu-${version}.tar.bz2";
-    inherit sha256;
+    url = "https://wiki.qemu.org/download/qemu-${version}.tar.bz2";
+    sha256 = "1s7bm2xhcxbc9is0rg8xzwijx7azv67skq7mjc58spsgc2nn4glk";
  };

  buildInputs =
--- a/pkgs/applications/virtualization/virt-manager/default.nix
+++ b/pkgs/applications/virtualization/virt-manager/default.nix
@ -1,5 +1,5 @@
 { stdenv, fetchurl, python2Packages, intltool, file
-, wrapGAppsHook, gtkvnc, vte, avahi, dconf
+, wrapGAppsHook, gtk-vnc, vte, avahi, dconf
 , gobjectIntrospection, libvirt-glib, system-libvirt
 , gsettings-desktop-schemas, glib, libosinfo, gnome3, gtk3
 , spiceSupport ? true, spice-gtk ? null
@ -24,7 +24,7 @@ python2Packages.buildPythonApplication rec {
  ];

  buildInputs =
-    [ libvirt-glib vte dconf gtkvnc gnome3.defaultIconTheme avahi
+    [ libvirt-glib vte dconf gtk-vnc gnome3.defaultIconTheme avahi
      gsettings-desktop-schemas libosinfo gtk3
    ] ++ optional spiceSupport spice-gtk;

--- a/pkgs/applications/virtualization/virt-viewer/default.nix
+++ b/pkgs/applications/virtualization/virt-viewer/default.nix
@ -1,6 +1,6 @@
-{ stdenv, fetchurl, pkgconfig, intltool, glib, libxml2, gtk3, gtkvnc, gmp
+{ stdenv, fetchurl, pkgconfig, intltool, glib, libxml2, gtk3, gtk-vnc, gmp
 , libgcrypt, gnupg, cyrus_sasl, shared-mime-info, libvirt, yajl, xen
-, gsettings-desktop-schemas, makeWrapper, libvirt-glib, libcap_ng, numactl
+, gsettings-desktop-schemas, wrapGAppsHook, libvirt-glib, libcap_ng, numactl
 , libapparmor, gst_all_1
 , spiceSupport ? true
 , spice-gtk ? null, spice-protocol ? null, libcap ? null, gdbm ? null
@ -21,10 +21,10 @@ stdenv.mkDerivation rec {
    sha256 = "00y9vi69sja4pkrfnvrkwsscm41bqrjzvp8aijb20pvg6ymczhj7";
  };

-  nativeBuildInputs = [ pkgconfig intltool ];
+  nativeBuildInputs = [ pkgconfig intltool wrapGAppsHook ];
  buildInputs = [
-    glib libxml2 gtk3 gtkvnc gmp libgcrypt gnupg cyrus_sasl shared-mime-info
-    libvirt yajl gsettings-desktop-schemas makeWrapper libvirt-glib
+    glib libxml2 gtk3 gtk-vnc gmp libgcrypt gnupg cyrus_sasl shared-mime-info
+    libvirt yajl gsettings-desktop-schemas libvirt-glib
    libcap_ng numactl libapparmor
  ] ++ optionals stdenv.isx86_64 [
    xen
@ -33,14 +33,6 @@ stdenv.mkDerivation rec {
    gst_all_1.gst-plugins-base gst_all_1.gst-plugins-good
  ];

-  postInstall = ''
-    for f in "$out"/bin/*; do
-        wrapProgram "$f" \
-          --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH" \
-          --prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0"
-    done
-  '';
-
  meta = {
    description = "A viewer for remote virtual machines";
    maintainers = [ maintainers.raskin ];
--- a/pkgs/desktops/gnome-3/apps/gnome-boxes/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-boxes/default.nix
@ -1,5 +1,5 @@
 { stdenv, fetchurl, meson, ninja, wrapGAppsHook, pkgconfig, gettext, itstool, libvirt-glib
-, glib, gobjectIntrospection, libxml2, gtk3, gtkvnc, libvirt, spice-gtk
+, glib, gobjectIntrospection, libxml2, gtk3, gtk-vnc, libvirt, spice-gtk
 , spice-protocol, libsoup, libosinfo, systemd, tracker, tracker-miners, vala
 , libcap, yajl, gmp, gdbm, cyrus_sasl, gnome3, librsvg, desktop-file-utils
 , mtools, cdrkit, libcdio, libusb, libarchive, acl, libgudev, qemu, libsecret
@ -28,7 +28,7 @@ in stdenv.mkDerivation rec {
  propagatedUserEnvPkgs = [ spice-gtk ];

  buildInputs = [
-    libvirt-glib glib gtk3 gtkvnc libxml2
+    libvirt-glib glib gtk3 gtk-vnc libxml2
    libvirt spice-gtk spice-protocol libsoup json-glib webkitgtk libosinfo systemd
    tracker tracker-miners libcap yajl gmp gdbm cyrus_sasl libusb libarchive
    gnome3.defaultIconTheme librsvg acl libgudev libsecret
--- a/pkgs/desktops/gnome-3/apps/gnome-documents/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-documents/default.nix
@ -2,17 +2,17 @@
 , pkgconfig, gtk3, glib, tracker, tracker-miners
 , itstool, libxslt, webkitgtk, libgdata
 , gnome-desktop, libzapojit, libgepub
-, gnome3, gdk_pixbuf, libsoup, docbook_xsl
+, gnome3, gdk_pixbuf, libsoup, docbook_xsl, docbook_xml_dtd_42
 , gobjectIntrospection, inkscape, poppler_utils
 , desktop-file-utils, wrapGAppsHook }:

 stdenv.mkDerivation rec {
  name = "gnome-documents-${version}";
-  version = "3.28.1";
+  version = "3.28.2";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-documents/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "1i0s246bg9xcjxgbajph744pn65bq5gk6r9kkl3f5iwdq3rjc0pm";
+    sha256 = "0aannnq39gjg6jnjm4kr8fqigg5npjvd8dyxw7k4hy4ny0ffxwjq";
  };

  doCheck = true;
@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
  mesonFlags = [ "-Dgetting-started=true" ];

  nativeBuildInputs = [
-    meson ninja pkgconfig gettext itstool libxslt desktop-file-utils docbook_xsl wrapGAppsHook
+    meson ninja pkgconfig gettext itstool libxslt desktop-file-utils docbook_xsl docbook_xml_dtd_42 wrapGAppsHook
    inkscape poppler_utils # building getting started
  ];
  buildInputs = [
--- a/pkgs/desktops/gnome-3/apps/vinagre/default.nix
+++ b/pkgs/desktops/gnome-3/apps/vinagre/default.nix
@ -1,5 +1,5 @@
-{ stdenv, fetchurl, pkgconfig, gtk3, gnome3, vte, libxml2, gtkvnc, intltool
-, libsecret, itstool, makeWrapper, librsvg }:
+{ stdenv, fetchurl, pkgconfig, gtk3, gnome3, vte, libxml2, gtk-vnc, intltool
+, libsecret, itstool, wrapGAppsHook, librsvg }:

 stdenv.mkDerivation rec {
  name = "vinagre-${version}";
@ -10,25 +10,25 @@ stdenv.mkDerivation rec {
    sha256 = "cd1cdbacca25c8d1debf847455155ee798c3e67a20903df8b228d4ece5505e82";
  };

-  passthru = {
-    updateScript = gnome3.updateScript { packageName = "vinagre"; attrPath = "gnome3.vinagre"; };
-  };
-
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ gtk3 vte libxml2 gtkvnc intltool libsecret
-                  itstool makeWrapper gnome3.defaultIconTheme librsvg ];
+  nativeBuildInputs = [ pkgconfig intltool itstool wrapGAppsHook ];
+  buildInputs = [
+    gtk3 vte libxml2 gtk-vnc libsecret gnome3.defaultIconTheme librsvg
+  ];

  NIX_CFLAGS_COMPILE = "-Wno-format-nonliteral";

-  preFixup = ''
-    wrapProgram "$out/bin/vinagre" \
-      --prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH:$out/share"
-  '';
+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = "vinagre";
+      attrPath = "gnome3.vinagre";
+    };
+  };

  meta = with stdenv.lib; {
-    homepage = https://wiki.gnome.org/Apps/Vinagre;
    description = "Remote desktop viewer for GNOME";
-    platforms = platforms.linux;
+    homepage = https://wiki.gnome.org/Apps/Vinagre;
+    license = licenses.gpl2Plus;
    maintainers = gnome3.maintainers;
+    platforms = platforms.linux;
  };
 }
--- a/pkgs/desktops/gnome-3/core/caribou/default.nix
+++ b/pkgs/desktops/gnome-3/core/caribou/default.nix
@ -1,11 +1,11 @@
-{ fetchurl, stdenv, pkgconfig, gnome3, clutter, dbus, python3Packages, libxml2
+{ fetchurl, stdenv, pkgconfig, gnome3, glib, gtk3, clutter, dbus, python3, libxml2
 , libxklavier, libXtst, gtk2, intltool, libxslt, at-spi2-core, autoreconfHook
 , wrapGAppsHook }:

 let
  pname = "caribou";
  version = "0.4.21";
-  pythonEnv = python3Packages.python.withPackages ( ps: with ps; [ pygobject3 ] );
+  pythonEnv = python3.withPackages ( ps: with ps; [ pygobject3 ] );
 in stdenv.mkDerivation rec {
  name = "${pname}-${version}";

@ -14,11 +14,21 @@ in stdenv.mkDerivation rec {
    sha256 = "0mfychh1q3dx0b96pjz9a9y112bm9yqyim40yykzxx1hppsdjhww";
  };

+  patches = [
+    # Fix crash in GNOME Flashback
+    # https://bugzilla.gnome.org/show_bug.cgi?id=791001
+    (fetchurl {
+      url = https://bugzilla.gnome.org/attachment.cgi?id=364774;
+      sha256 = "15k1455grf6knlrxqbjnk7sals1730b0whj30451scp46wyvykvd";
+    })
+  ];
+
  nativeBuildInputs = [ pkgconfig intltool libxslt libxml2 autoreconfHook wrapGAppsHook ];

-  buildInputs = with gnome3;
-    [ glib gtk clutter at-spi2-core dbus pythonEnv python3Packages.pygobject3
-      libXtst gtk2 ];
+  buildInputs = [
+    glib gtk3 clutter at-spi2-core dbus pythonEnv python3.pkgs.pygobject3
+    libXtst gtk2
+  ];

  propagatedBuildInputs = [ gnome3.libgee libxklavier ];

@ -37,9 +47,8 @@ in stdenv.mkDerivation rec {
  meta = with stdenv.lib; {
    description = "An input assistive technology intended for switch and pointer users";
    homepage = https://wiki.gnome.org/Projects/Caribou;
-    platforms = platforms.linux;
    license = licenses.lgpl21;
    maintainers = gnome3.maintainers;
+    platforms = platforms.linux;
  };
-
 }
--- a/pkgs/desktops/gnome-3/core/gnome-bluetooth/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-bluetooth/default.nix
@ -1,28 +1,47 @@
 { stdenv, fetchurl, gnome3, meson, ninja, pkgconfig, gtk3, intltool, glib
-, udev, itstool, libxml2, wrapGAppsHook, libnotify, libcanberra-gtk3, gobjectIntrospection }:
+, udev, itstool, libxml2, wrapGAppsHook, libnotify, libcanberra-gtk3, gobjectIntrospection
+, gtk-doc, docbook_xsl, docbook_xml_dtd_43 }:

-stdenv.mkDerivation rec {
-  name = "gnome-bluetooth-${version}";
-  version = "3.28.1";
+let
+  pname = "gnome-bluetooth";
+in stdenv.mkDerivation rec {
+  name = "${pname}-${version}";
+  version = "3.28.2";
+
+  # TODO: split out "lib"
+  outputs = [ "out" "dev" "devdoc" "man" ];

  src = fetchurl {
-    url = "mirror://gnome/sources/gnome-bluetooth/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "1g3yrq5792qvc5rxnf26cgciawrca27hqn6wxfcf63bpa2dsjcsn";
+    url = "mirror://gnome/sources/${pname}/${gnome3.versionBranch version}/${name}.tar.xz";
+    sha256 = "0ch7lll5n8v7m26y6y485gnrik19ml42rsh1drgcxydm6fn62j8z";
  };

-  passthru = {
-    updateScript = gnome3.updateScript { packageName = "gnome-bluetooth"; attrPath = "gnome3.gnome-bluetooth"; };
-  };
+  nativeBuildInputs = [
+    meson ninja intltool itstool pkgconfig libxml2 wrapGAppsHook gobjectIntrospection
+    gtk-doc docbook_xsl docbook_xml_dtd_43
+  ];
+  buildInputs = [
+    glib gtk3 udev libnotify libcanberra-gtk3
+    gnome3.defaultIconTheme gnome3.gsettings-desktop-schemas
+  ];

-  nativeBuildInputs = [ meson ninja intltool itstool pkgconfig libxml2 wrapGAppsHook gobjectIntrospection ];
-  buildInputs = [ glib gtk3 udev libnotify libcanberra-gtk3
-                  gnome3.defaultIconTheme gnome3.gsettings-desktop-schemas ];
+  mesonFlags = [
+    "-Dicon_update=false"
+    "-Dgtk_doc=true"
+  ];

  postPatch = ''
    chmod +x meson_post_install.py # patchShebangs requires executable file
    patchShebangs meson_post_install.py
  '';

+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+      attrPath = "gnome3.${pname}";
+    };
+  };
+
  meta = with stdenv.lib; {
    homepage = https://help.gnome.org/users/gnome-bluetooth/stable/index.html.en;
    description = "Application that let you manage Bluetooth in the GNOME destkop";
--- a/pkgs/desktops/gnome-3/core/tracker-miners/default.nix
+++ b/pkgs/desktops/gnome-3/core/tracker-miners/default.nix
@ -1,24 +1,24 @@
-{ stdenv, fetchurl, substituteAll, intltool, itstool, libxslt, makeWrapper
+{ stdenv, fetchurl, substituteAll, intltool, itstool, libxslt
 , meson, ninja, pkgconfig, vala, wrapGAppsHook, bzip2, dbus, evolution-data-server
 , exempi, flac, giflib, glib, gnome3, gst_all_1, icu, json-glib, libcue, libexif
-, libgsf, libiptcdata, libjpeg, libpng, libseccomp, libsoup, libtiff, libuuid
+, libgrss, libgsf, libiptcdata, libjpeg, libpng, libseccomp, libsoup, libtiff, libuuid
 , libvorbis, libxml2, poppler, taglib, upower }:

-stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
+let
  pname = "tracker-miners";
-  version = "2.0.5";
+in stdenv.mkDerivation rec {
+  name = "${pname}-${version}";
+  version = "2.1.1";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "00k8nb8dbkjnqjk12gcs5n2cm6yny553qildsm5b2c8nfs1w16b4";
+    sha256 = "107638773mihxdi194wf3saacqrr4cp9xn3qjfmx60bwq5451ma0";
  };

  nativeBuildInputs = [
    intltool
    itstool
    libxslt
-    makeWrapper
    meson
    ninja
    pkgconfig
@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
    wrapGAppsHook
  ];

-  # TODO: add libgrss, libenca, libosinfo
+  # TODO: add libenca, libosinfo
  buildInputs = [
    bzip2
    dbus
@ -44,6 +44,7 @@ stdenv.mkDerivation rec {
    json-glib
    libcue
    libexif
+    libgrss
    libgsf
    libiptcdata
    libjpeg
@ -60,7 +61,8 @@ stdenv.mkDerivation rec {
  ];

  mesonFlags = [
-    "-Dminer_rss=false" # needs libgrss
+    # TODO: tests do not like our sandbox
+    "-Dfunctional_tests=false"
  ];

  patches = [
@ -75,13 +77,7 @@ stdenv.mkDerivation rec {
    })
  ];

-  passthru = {
-    updateScript = gnome3.updateScript {
-      packageName = pname;
-      attrPath = "gnome3.${pname}";
-    };
-  };
-
+  # Symlinks require absolute path and we still cannot use placeholders
  # https://github.com/NixOS/nixpkgs/pull/39534#discussion_r184339131
  # https://github.com/NixOS/nixpkgs/pull/37693
  preConfigure = ''
@ -92,10 +88,13 @@ stdenv.mkDerivation rec {
    ${glib.dev}/bin/glib-compile-schemas $out/share/glib-2.0/schemas
  '';

-  # https://bugzilla.gnome.org/show_bug.cgi?id=796145
-  postFixup = ''
-    rm $out/share/tracker/miners/org.freedesktop.Tracker1.Miner.RSS.service
-  '';
+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+      attrPath = "gnome3.${pname}";
+      versionPolicy = "none";
+    };
+  };

  meta = with stdenv.lib; {
    homepage = https://wiki.gnome.org/Projects/Tracker;
--- a/pkgs/desktops/gnome-3/core/tracker-miners/fix-paths.patch
+++ b/pkgs/desktops/gnome-3/core/tracker-miners/fix-paths.patch
@ -1,3 +1,25 @@
+--- a/meson.build
+++ b/meson.build
+@@ -37,15 +37,15 @@
+   #
+   # This check acts as a guard to make sure we are being configured with the
+   # right prefix, among other things.
+-  tracker_store = find_program(join_paths(get_option('prefix'), get_option('libexecdir'), 'tracker-store'))
+  tracker_store = find_program(join_paths(tracker_miner.get_pkgconfig_variable('prefix'), 'libexec', 'tracker-store'))
+   tracker_store_path = tracker_store.path()
+ 
+   # If we are building against an installed version of tracker core rather than
+   # having it as a subproject, these 'uninstalled' locations point to the actual
+   # installed locations.
+-  tracker_uninstalled_domain_rule = join_paths(get_option('prefix'), get_option('datadir'), 'tracker', 'domain-ontologies', 'default.rule')
+-  tracker_uninstalled_nepomuk_ontologies_dir = join_paths(get_option('prefix'), get_option('datadir'), 'tracker', 'ontologies', 'nepomuk')
+-  tracker_uninstalled_stop_words_dir = join_paths(get_option('prefix'), get_option('datadir'), 'tracker', 'stop-words', 'default.rule')
+  tracker_uninstalled_domain_rule = join_paths(tracker_miner.get_pkgconfig_variable('prefix'), 'share', 'tracker', 'domain-ontologies', 'default.rule')
+  tracker_uninstalled_nepomuk_ontologies_dir = join_paths(tracker_miner.get_pkgconfig_variable('prefix'), 'share', 'tracker', 'ontologies', 'nepomuk')
+  tracker_uninstalled_stop_words_dir = join_paths(tracker_miner.get_pkgconfig_variable('prefix'), 'share', 'tracker', 'stop-words', 'default.rule')
+ endif
+ 
+ avcodec = dependency('libavcodec', version: '>= 0.8.4', required: false)
 --- a/src/libtracker-miners-common/tracker-domain-ontology.c
 +++ b/src/libtracker-miners-common/tracker-domain-ontology.c
@@ -313,7 +313,7 @@
@ -9,7 +31,7 @@
 		                         DEFAULT_RULE, NULL);
 
 		if (!g_file_test (path, G_FILE_TEST_IS_REGULAR)) {
-@@ -372,7 +372,7 @@
+@@ -378,7 +378,7 @@
 	if (!priv->ontology_location) {
 		gchar *ontology_path;
 
--- a/pkgs/desktops/gnome-3/core/tracker/default.nix
+++ b/pkgs/desktops/gnome-3/core/tracker/default.nix
@ -1,39 +1,53 @@
-{ stdenv, fetchurl, intltool, pkgconfig, gobjectIntrospection
-, libxml2, upower, glib, wrapGAppsHook, vala, sqlite, libxslt
+{ stdenv, fetchurl, intltool, meson, ninja, pkgconfig, gobjectIntrospection, python2
+, gtk-doc, docbook_xsl, docbook_xml_dtd_412, docbook_xml_dtd_43, glibcLocales
+, libxml2, upower, glib, wrapGAppsHook, vala, sqlite, libxslt, libstemmer
 , gnome3, icu, libuuid, networkmanager, libsoup, json-glib }:

 let
  pname = "tracker";
-  version = "2.0.4";
+  version = "2.1.2";
 in stdenv.mkDerivation rec {
  name = "${pname}-${version}";

-  outputs = [ "out" "dev" ];
+  outputs = [ "out" "dev" "devdoc" ];

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "1mfc5lv820kr7ssi7hldn25gmshh65k19kh478qjsnb64sshsbyf";
+    sha256 = "1sf923f3ya3gj5s90da8qkqqvjj3fdll7xrjgscpb6yhgv0kzqsi";
  };

-  enableParallelBuilding = true;
-
-  nativeBuildInputs = [ vala pkgconfig intltool libxslt wrapGAppsHook gobjectIntrospection ];
-  # TODO: add libstemmer
-  buildInputs = [
-    glib libxml2 sqlite upower icu networkmanager libsoup libuuid json-glib
+  nativeBuildInputs = [
+    meson ninja vala pkgconfig intltool libxslt wrapGAppsHook gobjectIntrospection
+    gtk-doc docbook_xsl docbook_xml_dtd_412 docbook_xml_dtd_43 glibcLocales
+    python2 # for data-generators
  ];

-  # TODO: figure out wrapping unit tests, some of them fail on missing gsettings-desktop-schemas
-  configureFlags = [ "--disable-unit-tests" ];
+  buildInputs = [
+    glib libxml2 sqlite upower icu networkmanager libsoup libuuid json-glib libstemmer
+  ];
+
+  LC_ALL = "en_US.UTF-8";
+
+  mesonFlags = [
+    "-Ddbus_services=share/dbus-1/services"
+    # TODO: figure out wrapping unit tests, some of them fail on missing gsettings-desktop-schemas
+    "-Dfunctional_tests=false"
+  ];

  postPatch = ''
    patchShebangs utils/g-ir-merge/g-ir-merge
+    patchShebangs utils/data-generators/cc/generate
+  '';
+
+  postInstall = ''
+    ${glib.dev}/bin/glib-compile-schemas $out/share/glib-2.0/schemas
  '';

  passthru = {
    updateScript = gnome3.updateScript {
      packageName = pname;
      attrPath = "gnome3.${pname}";
+      versionPolicy = "none";
    };
  };

--- a/pkgs/desktops/gnome-3/default.nix
+++ b/pkgs/desktops/gnome-3/default.nix
@ -43,7 +43,7 @@ lib.makeScope pkgs.newScope (self: with self; {
  inherit (pkgs) atk glib gobjectIntrospection gspell webkitgtk gtk3 gtkmm3
    libgtop libgudev libhttpseverywhere librsvg libsecret gdk_pixbuf gtksourceview gtksourceview4
    easytag meld orca rhythmbox shotwell gnome-usage
-    clutter clutter-gst clutter-gtk cogl gtkvnc libdazzle;
+    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle;

  libsoup = pkgs.libsoup.override { gnomeSupport = true; };
  libchamplain = pkgs.libchamplain.override { libsoup = libsoup; };
@ -399,6 +399,8 @@ lib.makeScope pkgs.newScope (self: with self; {

  gnome-packagekit = callPackage ./misc/gnome-packagekit { };

+  # TODO: remove this after 18.09 has forked off
+  gconf = throw "gconf is deprecated since 2009 and has been removed from the package set. Use gnome2.GConf instead. For more details see https://github.com/NixOS/nixpkgs/pull/43268";
 } // lib.optionalAttrs (config.allowAliases or true) {
 #### Legacy aliases

--- a/pkgs/desktops/gnome-3/games/gnome-nibbles/default.nix
+++ b/pkgs/desktops/gnome-3/games/gnome-nibbles/default.nix
@ -4,29 +4,31 @@

 stdenv.mkDerivation rec {
  name = "gnome-nibbles-${version}";
-  version = "3.24.0";
+  version = "3.24.1";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-nibbles/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "0ddc1fe03483958dd5513d04f5919ade991902d12da18a4c2d3307f818a5cb4f";
+    sha256 = "19g44cnrb191v50bdvy2qkrfhvyfsahd0kx9hz95x9gkjfn2nn35";
  };

-  passthru = {
-    updateScript = gnome3.updateScript { packageName = "gnome-nibbles"; attrPath = "gnome3.gnome-nibbles"; };
-  };
-
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig wrapGAppsHook intltool itstool libxml2 ];
  buildInputs = [
-    gtk3 wrapGAppsHook intltool itstool libxml2
-    librsvg libcanberra-gtk3 clutter-gtk gnome3.defaultIconTheme
+    gtk3 librsvg libcanberra-gtk3 clutter-gtk gnome3.defaultIconTheme
    libgee libgnome-games-support
  ];

+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = "gnome-nibbles";
+      attrPath = "gnome3.gnome-nibbles";
+    };
+  };
+
  meta = with stdenv.lib; {
-    homepage = https://wiki.gnome.org/Apps/Nibbles;
    description = "Guide a worm around a maze";
-    maintainers = gnome3.maintainers;
+    homepage = https://wiki.gnome.org/Apps/Nibbles;
    license = licenses.gpl2;
+    maintainers = gnome3.maintainers;
    platforms = platforms.linux;
  };
 }
--- a/pkgs/desktops/gnome-3/games/quadrapassel/default.nix
+++ b/pkgs/desktops/gnome-3/games/quadrapassel/default.nix
@ -2,8 +2,10 @@
 , librsvg, libcanberra-gtk3
 , intltool, itstool, libxml2, clutter, clutter-gtk, wrapGAppsHook }:

-stdenv.mkDerivation rec {
-  name = "quadrapassel-${version}";
+let
+  pname = "quadrapassel";
+in stdenv.mkDerivation rec {
+  name = "${pname}-${version}";
  version = "3.22.0";

  src = fetchurl {
@ -11,22 +13,26 @@ stdenv.mkDerivation rec {
    sha256 = "0ed44ef73c8811cbdfc3b44c8fd80eb6e2998d102d59ac324e4748f5d9dddb55";
  };

-  passthru = {
-    updateScript = gnome3.updateScript { packageName = "quadrapassel"; attrPath = "gnome3.quadrapassel"; };
-  };
-
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ gtk3 gnome3.defaultIconTheme gdk_pixbuf librsvg
-                  libcanberra-gtk3 itstool intltool clutter
-                  libxml2 clutter-gtk wrapGAppsHook ];
+  nativeBuildInputs = [ pkgconfig itstool intltool wrapGAppsHook ];
+  buildInputs = [
+    gtk3 gnome3.defaultIconTheme gdk_pixbuf librsvg
+    libcanberra-gtk3 clutter libxml2 clutter-gtk
+  ];

  enableParallelBuilding = true;

+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+      attrPath = "gnome3.${pname}";
+    };
+  };
+
  meta = with stdenv.lib; {
-    homepage = https://wiki.gnome.org/Apps/Quadrapassel;
    description = "Classic falling-block game, Tetris";
-    maintainers = gnome3.maintainers;
+    homepage = https://wiki.gnome.org/Apps/Quadrapassel;
    license = licenses.gpl2;
+    maintainers = gnome3.maintainers;
    platforms = platforms.linux;
  };
 }
--- a/pkgs/desktops/gnome-3/misc/libgda/default.nix
+++ b/pkgs/desktops/gnome-3/misc/libgda/default.nix
@ -1,4 +1,5 @@
 { stdenv, fetchurl, pkgconfig, intltool, itstool, libxml2, gtk3, openssl, gnome3
+, overrideCC, gcc6
 , mysqlSupport ? false, mysql ? null
 , postgresSupport ? false, postgresql ? null
 }:
@ -6,7 +7,7 @@
 assert mysqlSupport -> mysql != null;
 assert postgresSupport -> postgresql != null;

-stdenv.mkDerivation rec {
+(if stdenv.isAarch64 then overrideCC stdenv gcc6 else stdenv).mkDerivation rec {
  name = "libgda-${version}";
  version = "5.2.4";

--- a/pkgs/desktops/gnome-3/misc/libgnome-games-support/default.nix
+++ b/pkgs/desktops/gnome-3/misc/libgnome-games-support/default.nix
@ -3,13 +3,13 @@

 let
  pname = "libgnome-games-support";
-  version = "1.4.1";
+  version = "1.4.2";
 in stdenv.mkDerivation rec {
  name = "${pname}-${version}";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "1j7lfcnc29lgn8ppn13wkn9w2y1n3lsapagwp91zh3bf0h2h4hv1";
+    sha256 = "02hirpk885jndwarbl3cl5fk7w2z5ziv677csyv1wi2n6rmpn088";
  };

  nativeBuildInputs = [ pkgconfig intltool ];
--- a/pkgs/development/compilers/openjdk/darwin/10.nix
+++ b/pkgs/development/compilers/openjdk/darwin/10.nix
@ -0,0 +1,59 @@
+{ stdenv, fetchurl, unzip, setJavaClassPath, freetype }:
+let
+  jce-policies = fetchurl {
+    # Ugh, unversioned URLs... I hope this doesn't change often enough to cause pain before we move to a Darwin source build of OpenJDK!
+    url    = "http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
+    sha256 = "0nk7m0lgcbsvldq2wbfni2pzq8h818523z912i7v8hdcij5s48c0";
+  };
+
+  jdk = stdenv.mkDerivation {
+    name = "zulu10.1+11-jdk10";
+
+    src = fetchurl {
+      url = "https://cdn.azul.com/zulu/bin/zulu10.1+11-jdk10-macosx_x64.zip";
+      sha256 = "1c5ib136nv6gz7ij31mg15nhzrl6zr7kp8spm17zwm1ib82bc73y";
+      curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/zulu-linux/";
+    };
+
+    buildInputs = [ unzip freetype ];
+
+    installPhase = ''
+      mkdir -p $out
+      mv * $out
+
+      unzip ${jce-policies}
+      mv -f ZuluJCEPolicies/*.jar $out/lib/security/
+
+      # jni.h expects jni_md.h to be in the header search path.
+      ln -s $out/include/darwin/*_md.h $out/include/
+
+      if [ -f $out/LICENSE ]; then
+        install -D $out/LICENSE $out/share/zulu/LICENSE
+        rm $out/LICENSE
+      fi
+    '';
+
+    preFixup = ''
+      # Propagate the setJavaClassPath setup hook from the JRE so that
+      # any package that depends on the JRE has $CLASSPATH set up
+      # properly.
+      mkdir -p $out/nix-support
+      printWords ${setJavaClassPath} > $out/nix-support/propagated-build-inputs
+
+      install_name_tool -change /usr/X11/lib/libfreetype.6.dylib ${freetype}/lib/libfreetype.6.dylib $out/lib/libfontmanager.dylib
+
+      # Set JAVA_HOME automatically.
+      cat <<EOF >> $out/nix-support/setup-hook
+      if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out; fi
+      EOF
+    '';
+
+    passthru = {
+      jre = jdk;
+      home = jdk;
+    };
+
+    meta.platforms = stdenv.lib.platforms.darwin;
+
+  };
+in jdk
--- a/pkgs/development/libraries/cmrt/default.nix
+++ b/pkgs/development/libraries/cmrt/default.nix
@ -0,0 +1,24 @@
+{ stdenv, fetchurl, autoreconfHook, pkgconfig, libdrm, libva }:
+
+stdenv.mkDerivation rec {
+  name = "cmrt-${version}";
+  version = "1.0.6";
+
+  src = fetchurl {
+    url = "https://github.com/intel/cmrt/archive/${version}.tar.gz";
+    sha256 = "1q7651nvvcqhph5rgfhklm71zqd0c405mrh3wx0cfzvil82yj8na";
+  };
+
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+
+  buildInputs = [ libdrm libva ];
+
+  meta = with stdenv.lib; {
+    homepage = https://01.org/linuxmedia;
+    description = "Intel C for Media Runtime";
+    longDescription = "Media GPU kernel manager for Intel G45 & HD Graphics family";
+    license = licenses.mit;
+    maintainers = with maintainers; [ tadfisher ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/development/libraries/kde-frameworks/default.nix
+++ b/pkgs/development/libraries/kde-frameworks/default.nix
@ -173,6 +173,7 @@ let
      kxmlgui = callPackage ./kxmlgui.nix {};
      kxmlrpcclient = callPackage ./kxmlrpcclient.nix {};
      plasma-framework = callPackage ./plasma-framework.nix {};
+      kpurpose = callPackage ./purpose.nix {};

    # TIER 4
      frameworkintegration = callPackage ./frameworkintegration.nix {};
--- a/pkgs/development/libraries/kde-frameworks/purpose.nix
+++ b/pkgs/development/libraries/kde-frameworks/purpose.nix
@ -0,0 +1,14 @@
+{
+  mkDerivation, lib, extra-cmake-modules, qtbase
+, qtdeclarative, kconfig, kcoreaddons, ki18n, kio
+}:
+
+mkDerivation {
+  name = "purpose";
+  meta = { maintainers = [ lib.maintainers.bkchr ]; };
+  nativeBuildInputs = [ extra-cmake-modules ];
+  buildInputs = [
+    qtbase qtdeclarative kconfig kcoreaddons 
+    ki18n kio
+  ];
+}
--- a/pkgs/development/libraries/lensfun/default.nix
+++ b/pkgs/development/libraries/lensfun/default.nix
@ -1,12 +1,12 @@
 { stdenv, fetchurl, pkgconfig, glib, zlib, libpng, gnumake3, cmake }:

 stdenv.mkDerivation rec {
-  version = "0.3.2";
+  version = "0.3.95";
  name = "lensfun-${version}";

  src = fetchurl {
    url = "mirror://sourceforge/lensfun/${version}/${name}.tar.gz";
-    sha256 = "0cfk8jjhs9nbfjfdy98plrj9ayi59aph0nx6ppslgjhlcvacm2xf";
+    sha256 = "0218f3xrlln0jmh4gcf1zbpvi2bidgl3b2mblf6c810n7j1rrhl2";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/development/libraries/libgrss/default.nix
+++ b/pkgs/development/libraries/libgrss/default.nix
@ -0,0 +1,39 @@
+{ stdenv, fetchurl, pkgconfig, vala, gobjectIntrospection, gtk-doc, docbook_xsl, docbook_xml_dtd_412, glib, libxml2, libsoup, gnome3 }:
+
+let
+  version = "0.7.0";
+  pname = "libgrss";
+in
+stdenv.mkDerivation {
+  name = "${pname}-${version}";
+
+  outputs = [ "out" "dev" "devdoc" ];
+
+  src = fetchurl {
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "1nalslgyglvhpva3px06fj6lv5zgfg0qmj0sbxyyl5d963vc02b7";
+  };
+
+  nativeBuildInputs = [ pkgconfig vala gobjectIntrospection gtk-doc docbook_xsl docbook_xml_dtd_412 ];
+  buildInputs = [ glib libxml2 libsoup ];
+
+  configureFlags = [
+    "--enable-gtk-doc"
+  ];
+
+  doCheck = true;
+
+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+    };
+  };
+
+  meta = with stdenv.lib; {
+    description = "Glib abstaction to handle feeds in RSS, Atom and other formats";
+    homepage = https://wiki.gnome.org/Projects/Libgrss;
+    license = licenses.lgpl3Plus;
+    maintainers = gnome3.maintainers;
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/development/libraries/libmanette/default.nix
+++ b/pkgs/development/libraries/libmanette/default.nix
@ -0,0 +1,36 @@
+{ stdenv, fetchurl, ninja, meson, pkgconfig, vala, gobjectIntrospection
+, glib, libgudev, libevdev, gnome3 }:
+
+let
+  version = "0.2.1";
+  pname = "libmanette";
+in
+stdenv.mkDerivation {
+  name = "${pname}-${version}";
+
+  outputs = [ "out" "dev" ];
+
+  src = fetchurl {
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "14vqz30p4693yy3yxs0gj858x25sl2kawib1g9lj8g5frgl0hd82";
+  };
+
+  nativeBuildInputs = [ meson ninja pkgconfig vala gobjectIntrospection ];
+  buildInputs = [ glib libgudev libevdev ];
+
+  doCheck = true;
+
+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+    };
+  };
+
+  meta = with stdenv.lib; {
+    description = "A simple GObject game controller library";
+    homepage = https://wiki.gnome.org/Apps/Builder;
+    license = licenses.lgpl21Plus;
+    maintainers = gnome3.maintainers;
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/development/libraries/libtensorflow/default.nix
+++ b/pkgs/development/libraries/libtensorflow/default.nix
@ -31,19 +31,19 @@ let

 in stdenv.mkDerivation rec {
  pname = "libtensorflow";
-  version = "1.9.0";
+  version = "1.10.0";
  name = "${pname}-${version}";
  src = fetchurl {
    url = "https://storage.googleapis.com/tensorflow/${pname}/${pname}-${tfType}-${system}-${version}.tar.gz";
    sha256 =
      if system == "linux-x86_64" then
        if cudaSupport
-        then "1q3mh06x344im25z7r3vgrfksfdsi8fh8ldn6y2mf86h4d11yxc3"
-        else "0l9ps115ng5ffzdwphlqmj3jhidps2v5afppdzrbpzmy41xz0z21"
+        then "0v66sscxpyixjrf9yjshl001nix233i6chc61akx0kx7ial4l1wn"
+        else "11sbpcbgdzj8v17mdppfv7v1fn3nbzkdad60gc42y2j6knjbmwxb"
      else if system == "darwin-x86_64" then
        if cudaSupport
        then unavailable
-        else "1qj0v1706w6mczycdsh38h2glyv5d25v62kdn98wxd5rw8f9v657"
+        else "11p0f77m4wycpc024mh7jx0kbdhgm0wp6ir6dsa8lkcpdb59bn59"
      else unavailable;
  };

--- a/pkgs/development/libraries/mac/default.nix
+++ b/pkgs/development/libraries/mac/default.nix
@ -0,0 +1,36 @@
+{ stdenv, fetchurl, fetchpatch, yasm }:
+
+stdenv.mkDerivation rec {
+  name = "mac-${version}";
+  version = "4.11-u4-b5-s7";
+
+  src = fetchurl {
+    url = "https://www.deb-multimedia.org/pool/main/m/monkeys-audio/monkeys-audio_${version}.orig.tar.gz";
+    sha256 = "16i96cw5r3xbsivjigqp15vv32wa38k86mxq11qx1pzmpryqpqkk";
+  };
+
+  patches = [
+    (fetchpatch {
+      name = "mac-4.11.4.5.7-gcc6.patch";
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-sound/mac/files/mac-4.11.4.5.7-gcc6.patch?id=1bd4e0e30e4d8a8862217d7067323851b34c7fe4";
+      sha256 = "093b8m8p8s6dmc62fc8vb4hlmjc2ncb4rdgc82g0a8gg6w5kcj8x";
+    })
+    (fetchpatch {
+      name = "mac-4.11.4.5.7-output.patch";
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-sound/mac/files/mac-4.11.4.5.7-output.patch?id=1bd4e0e30e4d8a8862217d7067323851b34c7fe4";
+      sha256 = "0njmwj6d9jqi4pz4fax02w37gk22vda0grszrs2nn97zzmjl36zk";
+    })
+  ];
+
+  CXXFLAGS = "-DSHNTOOL";
+
+  nativeBuildInputs = [ yasm ];
+
+  meta = with stdenv.lib; {
+    description = "APE codec and decompressor";
+    homepage = http://www.deb-multimedia.org/dists/testing/main/binary-amd64/package/monkeys-audio.php;
+    license = licenses.unfreeRedistributable;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ jfrankenau ];
+  };
+}
--- a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
@ -13,6 +13,7 @@
 , systemd
 , enableProprietaryCodecs ? true
 , gn, darwin, openbsm
+, ffmpeg ? null
 , lib, stdenv # lib.optional, needsPax
 }:

@ -115,7 +116,9 @@ EOF
    fi
   '';

-  qmakeFlags = optional enableProprietaryCodecs "-- -proprietary-codecs";
+  qmakeFlags = if stdenv.hostPlatform.isAarch32 || stdenv.hostPlatform.isAarch64
+    then [ "--" "-system-ffmpeg" ] ++ optional enableProprietaryCodecs "-proprietary-codecs"
+    else optional enableProprietaryCodecs "-- -proprietary-codecs";

  propagatedBuildInputs = [
    # Image formats
@ -131,6 +134,8 @@ EOF
    harfbuzz icu

    libevent
+  ] ++ optionals stdenv.hostPlatform.isArm [
+    ffmpeg
  ] ++ optionals (!stdenv.isDarwin) [
    dbus zlib minizip snappy nss protobuf jsoncpp

--- a/pkgs/development/libraries/vaapi-intel-hybrid/default.nix
+++ b/pkgs/development/libraries/vaapi-intel-hybrid/default.nix
@ -0,0 +1,47 @@
+{ stdenv, fetchurl, autoreconfHook, pkgconfig, cmrt, libdrm, libva, libX11, libGL, wayland }:
+
+stdenv.mkDerivation rec {
+  name = "intel-hybrid-driver-${version}";
+  version = "1.0.2";
+
+  src = fetchurl {
+    url = "https://github.com/01org/intel-hybrid-driver/archive/${version}.tar.gz";
+    sha256 = "0ywdhbvzwzzrq4qhylnw1wc8l3j67h26l0cs1rncwhw05s3ndk8n";
+  };
+
+  patches = [
+    # driver_init: load libva-x11.so for any ABI version
+    (fetchurl {
+      url = https://github.com/01org/intel-hybrid-driver/pull/26.diff;
+      sha256 = "1ql4mbi5x1d2a5c8mkjvciaq60zj8nhx912992winbhfkyvpb3gx";
+    })
+  ];
+
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+
+  buildInputs = [ cmrt libdrm libva libX11 libGL wayland ];
+
+  enableParallelBuilding = true;
+
+  configureFlags = [
+    "--enable-drm"
+    "--enable-x11"
+    "--enable-wayland"
+  ];
+
+  postPatch = ''
+    patchShebangs ./src/shaders/gpp.py
+  '';
+
+  preConfigure = ''
+    sed -i -e "s,LIBVA_DRIVERS_PATH=.*,LIBVA_DRIVERS_PATH=$out/lib/dri," configure
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://01.org/linuxmedia;
+    description = "Intel driver for the VAAPI library with partial HW acceleration";
+    license = licenses.mit;
+    maintainers = with maintainers; [ tadfisher ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/development/libraries/vaapi-intel/default.nix
+++ b/pkgs/development/libraries/vaapi-intel/default.nix
@ -1,5 +1,6 @@
 { stdenv, fetchFromGitHub, autoreconfHook, gnum4, pkgconfig, python2
 , intel-gpu-tools, libdrm, libva, libX11, libGL, wayland, libXext
+, enableHybridCodec ? false, vaapi-intel-hybrid
 }:

 stdenv.mkDerivation rec {
@ -7,8 +8,8 @@ stdenv.mkDerivation rec {
  inherit (libva) version;

  src = fetchFromGitHub {
-    owner  = "01org";
-    repo   = "libva-intel-driver";
+    owner  = "intel";
+    repo   = "intel-vaapi-driver";
    rev    = version;
    sha256 = "15ag4al9h6b8f8sw1zpighyhsmr5qfqp1882q7r3gsh5g4cnj763";
  };
@ -21,20 +22,25 @@ stdenv.mkDerivation rec {
    sed -i -e "s,LIBVA_DRIVERS_PATH=.*,LIBVA_DRIVERS_PATH=$out/lib/dri," configure
  '';

+  postInstall = stdenv.lib.optionalString enableHybridCodec ''
+    ln -s ${vaapi-intel-hybrid}/lib/dri/* $out/lib/dri/
+  '';
+
  configureFlags = [
    "--enable-drm"
    "--enable-x11"
    "--enable-wayland"
-  ];
+  ] ++ stdenv.lib.optional enableHybridCodec "--enable-hybrid-codec";

  nativeBuildInputs = [ autoreconfHook gnum4 pkgconfig python2 ];

-  buildInputs = [ intel-gpu-tools libdrm libva libX11 libXext libGL wayland ];
+  buildInputs = [ intel-gpu-tools libdrm libva libX11 libXext libGL wayland ]
+    ++ stdenv.lib.optional enableHybridCodec vaapi-intel-hybrid;

  enableParallelBuilding = true;

  meta = with stdenv.lib; {
-    homepage = https://cgit.freedesktop.org/vaapi/intel-driver/;
+    homepage = https://01.org/linuxmedia;
    license = licenses.mit;
    description = "Intel driver for the VAAPI library";
    platforms = platforms.unix;
--- a/pkgs/development/libraries/wt/default.nix
+++ b/pkgs/development/libraries/wt/default.nix
@ -43,12 +43,12 @@ let
    };
 in {
  wt3 = generic {
-    version = "3.3.10";
-    sha256 = "1y25mhghgbgjgycpny0x4z95xn98q0wraab1c5gkwnay097bgwdy";
+    version = "3.3.11";
+    sha256 = "1s1bwg3s7brnspr9ya1vg5mr29dbvhf05s606fiv409b7ladqvxq";
  };

  wt4 = generic {
-    version = "4.0.3";
-    sha256 = "01xch5dkpcanwhr515236wa9mdmnq2a2j13dn7smyhwzqgbpknsg";
+    version = "4.0.4";
+    sha256 = "17kq9fxc0xqx7q7kyryiph3mg0d3hnd3jw0rl55zvzfsdd71220w";
  };
 }
--- a/pkgs/development/python-modules/elasticsearch-curator/default.nix
+++ b/pkgs/development/python-modules/elasticsearch-curator/default.nix
@ -1,8 +1,10 @@
 { stdenv
 , buildPythonPackage
 , fetchPypi
+, boto3
 , click
 , certifi
+, requests-aws4auth
 , voluptuous
 , pyyaml
 , elasticsearch
@ -22,17 +24,17 @@ buildPythonPackage rec {
    sha256 = "e75abeb7f7be939b1c64c071898760dc10ab5f08307c253fc074abf8a41a76f0";
  };

-  # The integration tests require a running elasticsearch cluster.
-  postUnpackPhase = ''
-    rm -r test/integration
-  '';
+  # The test hangs so we disable it.
+  doCheck = false;

  propagatedBuildInputs = [
    click
    certifi
+    requests-aws4auth
    voluptuous
    pyyaml
    elasticsearch
+    boto3
  ];

  checkInputs = [
--- a/pkgs/development/python-modules/requests-aws4auth/default.nix
+++ b/pkgs/development/python-modules/requests-aws4auth/default.nix
@ -0,0 +1,28 @@
+{ lib, buildPythonPackage, fetchPypi, fetchzip, isPy3k, requests }:
+with lib;
+buildPythonPackage rec {
+  pname = "requests-aws4auth";
+  version = "0.9";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0g52a1pm53aqkc9qb5q1m918c1qy6q47c1qz63p5ilynfbs3m5y9";
+  };
+
+  postPatch = optionalString isPy3k ''
+    sed "s/path_encoding_style/'path_encoding_style'/" \
+      -i requests_aws4auth/service_parameters.py
+  '';
+
+  propagatedBuildInputs = [ requests ];
+
+  # The test fail on Python >= 3 because of module import errors.
+  doCheck = !isPy3k;
+
+  meta = {
+    description = "Amazon Web Services version 4 authentication for the Python Requests library.";
+    homepage = https://github.com/sam-washington/requests-aws4auth;
+    license = licenses.mit;
+    maintainers = [ maintainers.basvandijk ];
+  };
+}
--- a/pkgs/development/tools/misc/kibana/6.x.nix
+++ b/pkgs/development/tools/misc/kibana/6.x.nix
@ -1,75 +0,0 @@
-{ elk6Version
-, enableUnfree ? true
-, stdenv
-, makeWrapper
-, fetchzip
-, fetchurl
-, nodejs
-, coreutils
-, which
-}:
-
-with stdenv.lib;
-let
-  inherit (builtins) elemAt;
-  info = splitString "-" stdenv.system;
-  arch = elemAt info 0;
-  plat = elemAt info 1;
-  shas =
-    if enableUnfree
-    then {
-      "x86_64-linux"  = "1kk97ggpzmblhqm6cfd2sv5940f58h323xcyg6rba1njj7lzanv0";
-      "x86_64-darwin" = "1xvwffk8d8br92h0laf4b1m76kvki6cj0pbgcvirfcj1r70vk6c3";
-    }
-    else {
-      "x86_64-linux"  = "0m81ki1v61gpwb3s6zf84azqrirlm9pdfx65g3xmvdp3d3wii5ly";
-      "x86_64-darwin" = "0zh9p6vsq1d0gh6ks7z6bh8sbhn6rm4jshjcfp3c9k7n2qa8vv9b";
-    };
-
-  # For the correct phantomjs version see:
-  # https://github.com/elastic/kibana/blob/master/x-pack/plugins/reporting/server/browsers/phantom/paths.js
-  phantomjs = rec {
-    name = "phantomjs-${version}-linux-x86_64";
-    version = "2.1.1";
-    src = fetchzip {
-      inherit name;
-      url = "https://github.com/Medium/phantomjs/releases/download/v${version}/${name}.tar.bz2";
-      sha256 = "0g2dqjzr2daz6rkd6shj6rrlw55z4167vqh7bxadl8jl6jk7zbfv";
-    };
-  };
-
-in stdenv.mkDerivation rec {
-  name = "kibana-${optionalString (!enableUnfree) "oss-"}${version}";
-  version = elk6Version;
-
-  src = fetchurl {
-    url = "https://artifacts.elastic.co/downloads/kibana/${name}-${plat}-${arch}.tar.gz";
-    sha256 = shas."${stdenv.system}" or (throw "Unknown architecture");
-  };
-
-  buildInputs = [ makeWrapper ];
-
-  installPhase = ''
-    mkdir -p $out/libexec/kibana $out/bin
-    mv * $out/libexec/kibana/
-    rm -r $out/libexec/kibana/node
-    makeWrapper $out/libexec/kibana/bin/kibana $out/bin/kibana \
-      --prefix PATH : "${stdenv.lib.makeBinPath [ nodejs coreutils which ]}"
-    sed -i 's@NODE=.*@NODE=${nodejs}/bin/node@' $out/libexec/kibana/bin/kibana
-  '' +
-  # phantomjs is needed in the unfree version. When phantomjs doesn't exist in
-  # $out/libexec/kibana/data kibana will try to download and unpack it during
-  # runtime which will fail because the nix store is read-only. So we make sure
-  # it already exist in the nix store.
-  optionalString enableUnfree ''
-    ln -s ${phantomjs.src} $out/libexec/kibana/data/${phantomjs.name}
-  '';
-
-  meta = {
-    description = "Visualize logs and time-stamped data";
-    homepage = http://www.elasticsearch.org/overview/kibana;
-    license = if enableUnfree then licenses.elastic else licenses.asl20;
-    maintainers = with maintainers; [ offline rickynils basvandijk ];
-    platforms = with platforms; unix;
-  };
-}
--- a/pkgs/development/tools/misc/kibana/default.nix
+++ b/pkgs/development/tools/misc/kibana/default.nix
@ -1,26 +1,49 @@
-{ stdenv, makeWrapper, fetchurl, nodejs, coreutils, which }:
+{ elk6Version
+, enableUnfree ? true
+, stdenv
+, makeWrapper
+, fetchzip
+, fetchurl
+, nodejs
+, coreutils
+, which
+}:

 with stdenv.lib;
 let
  inherit (builtins) elemAt;
-  archOverrides = {
-    "i686" = "x86";
-  };
  info = splitString "-" stdenv.system;
-  arch = (elemAt info 0);
-  elasticArch = archOverrides."${arch}" or arch;
+  arch = elemAt info 0;
  plat = elemAt info 1;
-  shas = {
-    "x86_64-linux"  = "1wnnrhhpgc58s09p99cmi8r2jmwsd5lmh2inb0k8nmizz5v1sjz0";
-    "i686-linux"    = "0sdx59jlfrf7r9793xpn2vxaxjdczgn3qfw8yny03dcs6fjaxi2y";
-    "x86_64-darwin" = "0rmp536kn001g52lxngpj6x6d0j3qj0r11d4djbz7h6s5ml03kza";
+  shas =
+    if enableUnfree
+    then {
+      "x86_64-linux"  = "1kk97ggpzmblhqm6cfd2sv5940f58h323xcyg6rba1njj7lzanv0";
+      "x86_64-darwin" = "1xvwffk8d8br92h0laf4b1m76kvki6cj0pbgcvirfcj1r70vk6c3";
+    }
+    else {
+      "x86_64-linux"  = "0m81ki1v61gpwb3s6zf84azqrirlm9pdfx65g3xmvdp3d3wii5ly";
+      "x86_64-darwin" = "0zh9p6vsq1d0gh6ks7z6bh8sbhn6rm4jshjcfp3c9k7n2qa8vv9b";
+    };
+
+  # For the correct phantomjs version see:
+  # https://github.com/elastic/kibana/blob/master/x-pack/plugins/reporting/server/browsers/phantom/paths.js
+  phantomjs = rec {
+    name = "phantomjs-${version}-linux-x86_64";
+    version = "2.1.1";
+    src = fetchzip {
+      inherit name;
+      url = "https://github.com/Medium/phantomjs/releases/download/v${version}/${name}.tar.bz2";
+      sha256 = "0g2dqjzr2daz6rkd6shj6rrlw55z4167vqh7bxadl8jl6jk7zbfv";
+    };
  };
+
 in stdenv.mkDerivation rec {
-  name = "kibana-${version}";
-  version = "4.6.5";
+  name = "kibana-${optionalString (!enableUnfree) "oss-"}${version}";
+  version = elk6Version;

  src = fetchurl {
-    url = "https://download.elastic.co/kibana/kibana/${name}-${plat}-${elasticArch}.tar.gz";
+    url = "https://artifacts.elastic.co/downloads/kibana/${name}-${plat}-${arch}.tar.gz";
    sha256 = shas."${stdenv.system}" or (throw "Unknown architecture");
  };

@ -33,13 +56,20 @@ in stdenv.mkDerivation rec {
    makeWrapper $out/libexec/kibana/bin/kibana $out/bin/kibana \
      --prefix PATH : "${stdenv.lib.makeBinPath [ nodejs coreutils which ]}"
    sed -i 's@NODE=.*@NODE=${nodejs}/bin/node@' $out/libexec/kibana/bin/kibana
+  '' +
+  # phantomjs is needed in the unfree version. When phantomjs doesn't exist in
+  # $out/libexec/kibana/data kibana will try to download and unpack it during
+  # runtime which will fail because the nix store is read-only. So we make sure
+  # it already exist in the nix store.
+  optionalString enableUnfree ''
+    ln -s ${phantomjs.src} $out/libexec/kibana/data/${phantomjs.name}
  '';

  meta = {
    description = "Visualize logs and time-stamped data";
    homepage = http://www.elasticsearch.org/overview/kibana;
-    license = licenses.asl20;
-    maintainers = with maintainers; [ offline rickynils ];
+    license = if enableUnfree then licenses.elastic else licenses.asl20;
+    maintainers = with maintainers; [ offline rickynils basvandijk ];
    platforms = with platforms; unix;
  };
 }
--- a/pkgs/games/20kly/default.nix
+++ b/pkgs/games/20kly/default.nix
@ -0,0 +1,40 @@
+{ stdenv
+, fetchurl
+, python }:
+
+python.pkgs.buildPythonApplication rec {
+  pname = "20kly";
+  version = "1.4";
+  format = "other";
+  disabled = !(python.isPy2 or false);
+
+  src = fetchurl {
+    url = "http://jwhitham.org.uk/20kly/lightyears-${version}.tar.bz2";
+    sha256 = "13h73cmfjqkipffimfc4iv0hf89if490ng6vd6xf3wcalpgaim5d";
+  };
+
+  patchPhase = ''
+    substituteInPlace lightyears \
+      --replace \
+        "LIGHTYEARS_DIR = \".\"" \
+        "LIGHTYEARS_DIR = \"$out/share\""
+  '';
+
+  propagatedBuildInputs = with python.pkgs; [ pygame ];
+
+  buildPhase = "python -O -m compileall .";
+
+  installPhase = ''
+    mkdir -p "$out/share"
+    cp -r audio code data lightyears "$out/share"
+    install -Dm755 lightyears "$out/bin/lightyears"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A steampunk-themed strategy game where you have to manage a steam supply network";
+    homepage = http://jwhitham.org.uk/20kly/;
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ fgaz ];
+  };
+}
+
--- a/pkgs/misc/logging/beats/5.x.nix
+++ b/pkgs/misc/logging/beats/5.x.nix
@ -23,10 +23,10 @@ let beat = package : extraArgs : buildGoPackage (rec {
      };
    } // extraArgs);
 in {
-  filebeat   = beat "filebeat"   {meta.description = "Lightweight shipper for logfiles";};
-  heartbeat  = beat "heartbeat"  {meta.description = "Lightweight shipper for uptime monitoring";};
-  metricbeat = beat "metricbeat" {meta.description = "Lightweight shipper for metrics";};
-  packetbeat = beat "packetbeat" {
+  filebeat5   = beat "filebeat"   {meta.description = "Lightweight shipper for logfiles";};
+  heartbeat5  = beat "heartbeat"  {meta.description = "Lightweight shipper for uptime monitoring";};
+  metricbeat5 = beat "metricbeat" {meta.description = "Lightweight shipper for metrics";};
+  packetbeat5 = beat "packetbeat" {
    buildInputs = [ libpcap ];
    meta.description = "Network packet analyzer that ships data to Elasticsearch";
    meta.longDescription = ''
--- a/pkgs/misc/logging/beats/6.x.nix
+++ b/pkgs/misc/logging/beats/6.x.nix
@ -23,10 +23,10 @@ let beat = package : extraArgs : buildGoPackage (rec {
      };
    } // extraArgs);
 in {
-  filebeat   = beat "filebeat"   {meta.description = "Lightweight shipper for logfiles";};
-  heartbeat  = beat "heartbeat"  {meta.description = "Lightweight shipper for uptime monitoring";};
-  metricbeat = beat "metricbeat" {meta.description = "Lightweight shipper for metrics";};
-  packetbeat = beat "packetbeat" {
+  filebeat6   = beat "filebeat"   {meta.description = "Lightweight shipper for logfiles";};
+  heartbeat6  = beat "heartbeat"  {meta.description = "Lightweight shipper for uptime monitoring";};
+  metricbeat6 = beat "metricbeat" {meta.description = "Lightweight shipper for metrics";};
+  packetbeat6 = beat "packetbeat" {
    buildInputs = [ libpcap ];
    meta.description = "Network packet analyzer that ships data to Elasticsearch";
    meta.longDescription = ''
--- a/pkgs/os-specific/linux/firmware/fwupdate/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupdate/default.nix
@ -1,16 +1,14 @@
 { efivar, fetchurl, gettext, gnu-efi, libsmbios, pkgconfig, popt, stdenv }:
 let
-  version = "10";
+  version = "12";
 in stdenv.mkDerivation {
  name = "fwupdate-${version}";
  src = fetchurl {
    url = "https://github.com/rhinstaller/fwupdate/releases/download/${version}/fwupdate-${version}.tar.bz2";
-    sha256 = "0fpk3q0msq2l0bs2mvk0cqp8jbwnmi17ggc81r4v96h4jxh2rx3k";
+    sha256 = "00w7jsg7wrlq4cpfz26m9rbv2jwyf0sansf343vfq02fy5lxars1";
  };

  patches = [
-    # https://github.com/rhboot/fwupdate/pull/99
-    ./fix-paths.patch
    ./do-not-create-sharedstatedir.patch
  ];

--- a/pkgs/os-specific/linux/firmware/fwupdate/fix-paths.patch
+++ b/pkgs/os-specific/linux/firmware/fwupdate/fix-paths.patch
@ -1,116 +0,0 @@
--- a/Make.defaults
-+++ b/Make.defaults
-@@ -18,19 +18,20 @@
- ABIDIFF		:= abidiff
- ABIDW		:= abidw
- prefix		?= /usr/
-prefix		:= $(abspath $(prefix))/
-+prefix		:= $(abspath $(prefix))
-+exec_prefix		?= $(prefix)
- ARCH		= $(shell $(CC) -dumpmachine | cut -f1 -d- | sed s,i[3456789]86,ia32,)
- ifeq ($(ARCH),x86_64)
-  LIBDIR	?= $(prefix)lib64
-+  LIBDIR	?= $(exec_prefix)/lib64
- endif
- ifeq ($(ARCH),ia32)
-  LIBDIR	?= $(prefix)lib
-+  LIBDIR	?= $(exec_prefix)/lib
- endif
- ifeq ($(ARCH),aarch64)
-  LIBDIR	?= $(prefix)lib64
-+  LIBDIR	?= $(exec_prefix)/lib64
- endif
- ifeq ($(ARCH),arm)
-  LIBDIR	?= $(prefix)lib
-+  LIBDIR	?= $(exec_prefix)/lib
- endif
- LIBDIR		?= unknown
- ifeq ($(LIBDIR),unknown)
-@@ -45,13 +46,13 @@
- GNUEFIDIR	?= $(LIBDIR)/gnuefi
- libdir		?= $(LIBDIR)
- pcdir		?= $(libdir)/pkgconfig
-mandir		?= $(prefix)share/man
-includedir	?= $(prefix)include
-bindir		?= $(prefix)bin
-datadir 	?= $(prefix)share
-+mandir		?= $(prefix)/share/man
-+includedir	?= $(prefix)/include
-+bindir		?= $(exec_prefix)/bin
-+datadir 	?= $(prefix)/share
- localedir	?= $(datadir)/locale
-libexecdir	?= $(prefix)libexec
-libdatadir	?= $(prefix)lib
-+libexecdir	?= $(exec_prefix)/libexec
-+libdatadir	?= $(exec_prefix)/lib
- sharedstatedir	?= /var/lib
- 
- EFIDIR		?= $(shell x=$$(which --skip-alias --skip-functions git 2>/dev/null) ; [ -n "$$x" ] && git config --get fwupdate.efidir)
-@@ -63,8 +64,8 @@
- 	ESPMOUNTPOINT = "/boot/efi"
- endif
- 
-DEBUGINFO	?= $(prefix)lib/debug
-DEBUGSOURCE	?= $(prefix)src/debug
-+DEBUGINFO	?= $(exec_prefix)/lib/debug
-+DEBUGSOURCE	?= $(prefix)/src/debug
- TARGETDIR	?= $(ESPMOUNTPOINT)/EFI/$(EFIDIR)
- 
- .PHONY: check_efidir_error
--- a/linux/Makefile
-+++ b/linux/Makefile
-@@ -93,16 +93,19 @@
- 	sed -e "s,@@VERSION@@,$(VERSION),g" \
- 		-e "s,@@FWUP_MAJOR_VERSION@@,$(MAJOR_VERSION),g" \
- 		-e "s,@@FWUP_MINOR_VERSION@@,$(MINOR_VERSION),g" \
-+		-e "s,@@PREFIX@@,$(prefix),g" \
-+		-e "s,@@EXEC_PREFIX@@,$(exec_prefix),g" \
- 		-e "s,@@SHAREDSTATEDIR@@,$(sharedstatedir),g" \
- 		-e "s,@@ESPMOUNTPOINT@@,$(ESPMOUNTPOINT),g" \
- 		-e "s,@@EFIDIR@@,$(EFIDIR),g" \
- 		-e "s,@@LIBDIR@@,$(libdir),g" \
- 		-e "s,@@LIBEXECDIR@@,$(libexecdir),g" \
-+		-e "s,@@INCLUDEDIR@@,$(includedir),g" \
- 		$< > $@
- 
- tester : tester.c
-	$(CC) -Wall -Werror -ggdb -L. -I./include -I/usr/include/efivar \
-		-lefivar -lfwup -o $@ $^
-+	$(CC) -Wall -Werror -ggdb -L. -I./include $(shell $(PKG_CONFIG) --cflags efivar) \
-+		$(shell $(PKG_CONFIG) --libs efivar) -lfwup -o $@ $^
- 
- test : tester
- 	LD_LIBRARY_PATH=$(shell pwd) ./tester
-@@ -134,6 +137,6 @@
- 	$(INSTALL) -d -m 755 $(DESTDIR)$(libdatadir)/systemd/system
- 	$(INSTALL) -m 644 cleanup.service \
- 		$(DESTDIR)$(libdatadir)/systemd/system/fwupdate-cleanup.service
-	$(INSTALL) -d -m 755 $(DESTDIR)/usr/share/bash-completion/completions/
-+	$(INSTALL) -d -m 755 $(DESTDIR)$(datadir)/bash-completion/completions/
- 	$(INSTALL) -m 755 $(VPATH)/bash-completion \
-		$(DESTDIR)/usr/share/bash-completion/completions/fwupdate
-+		$(DESTDIR)$(datadir)/bash-completion/completions/fwupdate
--- a/linux/fwup.pc.in
-+++ b/linux/fwup.pc.in
-@@ -1,7 +1,7 @@
-prefix=/usr
-exec_prefix=/usr
-+prefix=@@PREFIX@@
-+exec_prefix=@@EXEC_PREFIX@@
- libdir=@@LIBDIR@@
-includedir=/usr/include
-+includedir=@@INCLUDEDIR@@
- 
- Name: fwup
- Description: Library for deployment of UEFI firmware updates.
--- a/linux/libfwup.c
-+++ b/linux/libfwup.c
-@@ -35,7 +35,7 @@
- 
- #include <dell-wmi-smi.h>
- #ifdef FWUPDATE_HAVE_LIBSMBIOS__
-#include </usr/include/smbios_c/token.h>
-+#include <smbios_c/token.h>
- #include <smbios_c/smi.h>
- #endif
- 
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@ -146,6 +146,14 @@ let

      # needed for iwd WPS support (wpa_supplicant replacement)
      KEY_DH_OPERATIONS = whenAtLeast "4.7" yes;
+
+      # needed for nftables
+      NF_TABLES_INET              = whenAtLeast "4.17" yes;
+      NF_TABLES_NETDEV            = whenAtLeast "4.17" yes;
+      NF_TABLES_IPV4              = whenAtLeast "4.17" yes;
+      NF_TABLES_ARP               = whenAtLeast "4.17" yes;
+      NF_TABLES_IPV6              = whenAtLeast "4.17" yes;
+      NF_TABLES_BRIDGE            = whenAtLeast "4.17" yes;
    };

    wireless = {
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@ -17,11 +17,11 @@ in
 rec {
  # Policy: use the highest stable version as the default (on our master).
  stable = generic {
-    version = "390.67";
-    sha256_32bit = "01c8fa80njyyr39c1pyf7ssmfq65ci8mapbs94fd6gnhwc7gfjkg";
-    sha256_64bit = "0np6xj93fali2hss8xsdlmy5ykjgn4hx6mzjr8dpbdi0fhdcmwkd";
-    settingsSha256 = "1wk4587czysnbj5yxijmv3bldcffzwp4yvfx133apsr31dqca0s7";
-    persistencedSha256 = "1zia1r97lyj6fbmvsw4hv5qfcj84x3sz971m4430d8qyks2c4sdw";
+    version = "390.77";
+    sha256_32bit = "1yd313ghh2qbn07d5wbkshfwgkm4mh49vcqkydds3b3xk0mx4i8l";
+    sha256_64bit = "10kjccrkdn360035lh985cadhwy6lk9xrw3wlmww2wqfaa25f775";
+    settingsSha256 = "1wvxldpjkrx0ldjm5l6ycm6paxpcw89h0n6hfkznfkahkq7fwxdj";
+    persistencedSha256 = "1gklmc0v17m018cwpdlzwdyd45y4sjvjhj8a3l44baygix5zn30f";
  };

  beta = stable; # not enough interest to maintain beta ATM
--- a/pkgs/os-specific/linux/nvidia-x11/generic.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/generic.nix
@ -84,7 +84,6 @@ let
      platforms = [ "i686-linux" "x86_64-linux" ];
      maintainers = [ maintainers.vcunat ];
      priority = 4; # resolves collision with xorg-server's "lib/xorg/modules/extensions/libglx.so"
-      broken = stdenv.lib.versionAtLeast kernel.version "4.18";
    };
  };

--- a/pkgs/servers/monitoring/munin/default.nix
+++ b/pkgs/servers/monitoring/munin/default.nix
@ -52,6 +52,9 @@ stdenv.mkDerivation rec {
    perlPackages.IOStringy
  ];

+  # needs to find a local perl module during build
+  PERL_USE_UNSAFE_INC = stdenv.lib.optionalString (stdenv.lib.versionAtLeast (stdenv.lib.getVersion perl) "5.26") "1";
+
  # TODO: tests are failing http://munin-monitoring.org/ticket/1390#comment:1
  # NOTE: important, test command always exits with 0, think of a way to abort the build once tests pass
  doCheck = false;
--- a/pkgs/servers/search/elasticsearch/2.x.nix
+++ b/pkgs/servers/search/elasticsearch/2.x.nix
@ -1,40 +0,0 @@
-{ stdenv, fetchurl, makeWrapper, jre, utillinux }:
-
-with stdenv.lib;
-
-stdenv.mkDerivation rec {
-  version = "2.4.4";
-  name = "elasticsearch-${version}";
-
-  src = fetchurl {
-    url = "https://download.elasticsearch.org/elasticsearch/release/org/elasticsearch/distribution/tar/elasticsearch/${version}/${name}.tar.gz";
-    sha256 = "1qjq04sfqb35pf2xpvr8j5p27chfxpjp8ymrp1h5bfk5rbk9444q";
-  };
-
-  patches = [ ./es-home-2.x.patch ./es-classpath-2.x.patch ];
-
-  buildInputs = [ makeWrapper jre utillinux ];
-
-  installPhase = ''
-    mkdir -p $out
-    cp -R bin config lib modules $out
-
-    # don't want to have binary with name plugin
-    mv $out/bin/plugin $out/bin/elasticsearch-plugin
-    wrapProgram $out/bin/elasticsearch \
-      --prefix ES_CLASSPATH : "$out/lib/${name}.jar":"$out/lib/*" \
-      --prefix PATH : "${utillinux}/bin" \
-      --set JAVA_HOME "${jre}"
-    wrapProgram $out/bin/elasticsearch-plugin --set JAVA_HOME "${jre}"
-  '';
-
-  meta = {
-    description = "Open Source, Distributed, RESTful Search Engine";
-    license = licenses.asl20;
-    platforms = platforms.unix;
-    maintainers = [
-      maintainers.offline
-      maintainers.markWot
-    ];
-  };
-}
--- a/pkgs/servers/search/elasticsearch/6.x.nix
+++ b/pkgs/servers/search/elasticsearch/6.x.nix
@ -1,65 +0,0 @@
-{ elk6Version
-, enableUnfree ? true
-, stdenv
-, fetchurl
-, makeWrapper
-, jre_headless
-, utillinux
-, autoPatchelfHook
-, zlib
-}:
-
-with stdenv.lib;
-
-stdenv.mkDerivation (rec {
-  version = elk6Version;
-  name = "elasticsearch-${optionalString (!enableUnfree) "oss-"}${version}";
-
-  src = fetchurl {
-    url = "https://artifacts.elastic.co/downloads/elasticsearch/${name}.tar.gz";
-    sha256 =
-      if enableUnfree
-      then "0960ak602pm95p2mha9cb1mrwdky8pfw3y89r2v4zpr5n730hmnh"
-      else "1i4i1ai75bf8k0zd1qf8x0bavrm8rcw13xdim443zza09w95ypk4";
-  };
-
-  patches = [ ./es-home-6.x.patch ];
-
-  postPatch = ''
-    sed -i "s|ES_CLASSPATH=\"\$ES_HOME/lib/\*\"|ES_CLASSPATH=\"$out/lib/*\"|" ./bin/elasticsearch-env
-  '';
-
-  buildInputs = [ makeWrapper jre_headless utillinux ];
-
-  installPhase = ''
-    mkdir -p $out
-    cp -R bin config lib modules plugins $out
-
-    chmod -x $out/bin/*.*
-
-    wrapProgram $out/bin/elasticsearch \
-      --prefix PATH : "${utillinux}/bin/" \
-      --set JAVA_HOME "${jre_headless}"
-
-    wrapProgram $out/bin/elasticsearch-plugin --set JAVA_HOME "${jre_headless}"
-  '';
-
-  passthru = { inherit enableUnfree; };
-
-  meta = {
-    description = "Open Source, Distributed, RESTful Search Engine";
-    license = if enableUnfree then licenses.elastic else licenses.asl20;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [ apeschar basvandijk ];
-  };
-} // optionalAttrs enableUnfree {
-  dontPatchELF = true;
-  nativeBuildInputs = [ autoPatchelfHook ];
-  runtimeDependencies = [ zlib ];
-  postFixup = ''
-    for exe in $(find $out/modules/x-pack/x-pack-ml/platform/linux-x86_64/bin -executable -type f); do
-      echo "patching $exe..."
-      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$exe"
-    done
-  '';
-})
--- a/pkgs/servers/search/elasticsearch/default.nix
+++ b/pkgs/servers/search/elasticsearch/default.nix
@ -1,40 +1,65 @@
-{ stdenv, fetchurl, makeWrapper, jre, utillinux }:
+{ elk6Version
+, enableUnfree ? true
+, stdenv
+, fetchurl
+, makeWrapper
+, jre_headless
+, utillinux
+, autoPatchelfHook
+, zlib
+}:

 with stdenv.lib;

-stdenv.mkDerivation rec {
-  name = "elasticsearch-1.7.2";
+stdenv.mkDerivation (rec {
+  version = elk6Version;
+  name = "elasticsearch-${optionalString (!enableUnfree) "oss-"}${version}";

  src = fetchurl {
-    url = "https://download.elastic.co/elasticsearch/elasticsearch/${name}.tar.gz";
-    sha256 = "1lix4asvx1lbc227gzsrws3xqbcbqaal7v10w60kch0c4xg970bg";
+    url = "https://artifacts.elastic.co/downloads/elasticsearch/${name}.tar.gz";
+    sha256 =
+      if enableUnfree
+      then "0960ak602pm95p2mha9cb1mrwdky8pfw3y89r2v4zpr5n730hmnh"
+      else "1i4i1ai75bf8k0zd1qf8x0bavrm8rcw13xdim443zza09w95ypk4";
  };

-  patches = [ ./es-home.patch ];
+  patches = [ ./es-home-6.x.patch ];

-  buildInputs = [ makeWrapper jre utillinux ];
+  postPatch = ''
+    sed -i "s|ES_CLASSPATH=\"\$ES_HOME/lib/\*\"|ES_CLASSPATH=\"$out/lib/*\"|" ./bin/elasticsearch-env
+  '';
+
+  buildInputs = [ makeWrapper jre_headless utillinux ];

  installPhase = ''
    mkdir -p $out
-    cp -R bin config lib $out
+    cp -R bin config lib modules plugins $out

-    # don't want to have binary with name plugin
-    mv $out/bin/plugin $out/bin/elasticsearch-plugin
+    chmod -x $out/bin/*.*

-    # set ES_CLASSPATH and JAVA_HOME
    wrapProgram $out/bin/elasticsearch \
-      --prefix ES_CLASSPATH : "$out/lib/${name}.jar":"$out/lib/*":"$out/lib/sigar/*" \
-      --prefix PATH : "${utillinux}/bin" \
-      --set JAVA_HOME "${jre}"
-    wrapProgram $out/bin/elasticsearch-plugin \
-      --prefix ES_CLASSPATH : "$out/lib/${name}.jar":"$out/lib/*":"$out/lib/sigar/*" \
-      --set JAVA_HOME "${jre}"
+      --prefix PATH : "${utillinux}/bin/" \
+      --set JAVA_HOME "${jre_headless}"
+
+    wrapProgram $out/bin/elasticsearch-plugin --set JAVA_HOME "${jre_headless}"
  '';

+  passthru = { inherit enableUnfree; };
+
  meta = {
    description = "Open Source, Distributed, RESTful Search Engine";
-    license = licenses.asl20;
+    license = if enableUnfree then licenses.elastic else licenses.asl20;
    platforms = platforms.unix;
-    maintainers = [ maintainers.offline ];
+    maintainers = with maintainers; [ apeschar basvandijk ];
  };
-}
+} // optionalAttrs enableUnfree {
+  dontPatchELF = true;
+  nativeBuildInputs = [ autoPatchelfHook ];
+  runtimeDependencies = [ zlib ];
+  postFixup = ''
+    for exe in $(find $out/modules/x-pack/x-pack-ml/platform/linux-x86_64/bin -executable -type f); do
+      echo "patching $exe..."
+      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$exe"
+    done
+  '';
+})
--- a/pkgs/servers/search/elasticsearch/es-classpath-2.x.patch
+++ b/pkgs/servers/search/elasticsearch/es-classpath-2.x.patch
@ -1,38 +0,0 @@
-diff -rupN a/bin/elasticsearch b/bin/elasticsearch
--- a/bin/elasticsearch	2017-02-08 18:32:28.000298543 -0500
-+++ b/bin/elasticsearch	2017-02-08 19:10:45.692916675 -0500
-@@ -81,12 +81,7 @@ ES_HOME=`cd "$ES_HOME"; pwd`
- # If an include wasn't specified in the environment, then search for one...
- if [ "x$ES_INCLUDE" = "x" ]; then
-     # Locations (in order) to use when searching for an include file.
-    for include in /usr/share/elasticsearch/elasticsearch.in.sh \
-                   /usr/local/share/elasticsearch/elasticsearch.in.sh \
-                   /opt/elasticsearch/elasticsearch.in.sh \
-                   ~/.elasticsearch.in.sh \
-                   "$ES_HOME/bin/elasticsearch.in.sh" \
-                   "`dirname "$0"`"/elasticsearch.in.sh; do
-+    for include in "`dirname "$0"`"/elasticsearch.in.sh; do
-         if [ -r "$include" ]; then
-             . "$include"
-             break
-diff -rupN a/bin/elasticsearch.in.sh b/bin/elasticsearch.in.sh
--- a/bin/elasticsearch.in.sh	2017-02-08 18:32:28.000298543 -0500
-+++ b/bin/elasticsearch.in.sh	2017-02-08 18:33:46.816634599 -0500
-@@ -1,17 +1,5 @@
- #!/bin/sh
- 
-# check in case a user was using this mechanism
-if [ "x$ES_CLASSPATH" != "x" ]; then
-    cat >&2 << EOF
-Error: Don't modify the classpath with ES_CLASSPATH. Best is to add
-additional elements via the plugin mechanism, or if code must really be
-added to the main classpath, add jars to lib/ (unsupported).
-EOF
-    exit 1
-fi
-
-ES_CLASSPATH="$ES_HOME/lib/elasticsearch-2.4.4.jar:$ES_HOME/lib/*"
-
- if [ "x$ES_MIN_MEM" = "x" ]; then
-     ES_MIN_MEM=256m
- fi
--- a/pkgs/servers/search/elasticsearch/es-home-2.x.patch
+++ b/pkgs/servers/search/elasticsearch/es-home-2.x.patch
@ -1,31 +0,0 @@
-diff -rupN a/bin/elasticsearch b/bin/elasticsearch
--- a/bin/elasticsearch	2015-11-18 21:48:18.000000000 +0100
-+++ b/bin/elasticsearch	2015-12-04 00:52:21.032475098 +0100
-@@ -72,7 +72,11 @@ while [ -h "$SCRIPT" ] ; do
- done
- 
- # determine elasticsearch home
-ES_HOME=`dirname "$SCRIPT"`/..
-+
-+if [ -z "$ES_HOME" ]; then
-+    echo "You must set the ES_HOME var" >&2
-+    exit 1
-+fi
- 
- # make ELASTICSEARCH_HOME absolute
- ES_HOME=`cd "$ES_HOME"; pwd`
-diff -rupN a/bin/plugin b/bin/plugin
--- a/bin/plugin	2015-11-18 21:48:18.000000000 +0100
-+++ b/bin/plugin	2015-12-04 00:52:55.947453619 +0100
-@@ -17,7 +17,10 @@ while [ -h "$SCRIPT" ] ; do
- done
- 
- # determine elasticsearch home
-ES_HOME=`dirname "$SCRIPT"`/..
-+if [ -z "$ES_HOME" ]; then
-+    echo "You must set the ES_HOME var" >&2
-+    exit 1
-+fi
- 
- # make ELASTICSEARCH_HOME absolute
- ES_HOME=`cd "$ES_HOME"; pwd`
--- a/pkgs/servers/search/elasticsearch/es-home.patch
+++ b/pkgs/servers/search/elasticsearch/es-home.patch
@ -1,37 +0,0 @@
-diff -rupN a/bin/elasticsearch b/bin/elasticsearch
--- a/bin/elasticsearch	2015-08-05 17:52:05.740819671 +0200
-+++ b/bin/elasticsearch	2015-08-05 17:22:34.664657364 +0200
-@@ -83,7 +83,10 @@ while [ -h "$SCRIPT" ] ; do
- done
- 
- # determine elasticsearch home
-ES_HOME=`dirname "$SCRIPT"`/..
-+if [ -z "$ES_HOME" ]; then
-+    echo "You must set the ES_HOME var" >&2
-+    exit 1
-+fi
- 
- # make ELASTICSEARCH_HOME absolute
- ES_HOME=`cd "$ES_HOME"; pwd`
-diff -rupN a/bin/plugin b/bin/plugin
--- a/bin/plugin	2015-08-05 17:57:07.903088815 +0200
-+++ b/bin/plugin	2015-08-05 17:57:38.979808139 +0200
-@@ -16,7 +16,10 @@ while [ -h "$SCRIPT" ] ; do
- done
- 
- # determine elasticsearch home
-ES_HOME=`dirname "$SCRIPT"`/..
-+if [ -z "$ES_HOME" ]; then
-+    echo "You must set the ES_HOME var" >&2
-+    exit 1
-+fi
- 
- # make ELASTICSEARCH_HOME absolute
- ES_HOME=`cd "$ES_HOME"; pwd`
-@@ -105,4 +105,4 @@
-
- export HOSTNAME=`hostname -s`
-
-eval "$JAVA" $JAVA_OPTS $ES_JAVA_OPTS -Xmx64m -Xms16m -Delasticsearch -Des.path.home=\""$ES_HOME"\" $properties -cp \""$ES_HOME/lib/*"\" org.elasticsearch.plugins.PluginManager $args
-\ No newline at end of file
-+eval "$JAVA" $JAVA_OPTS $ES_JAVA_OPTS -Xmx64m -Xms16m -Delasticsearch -Des.path.home="$ES_HOME" $properties -cp "$ES_CLASSPATH/lib/*" org.elasticsearch.plugins.PluginManager $args
--- a/pkgs/servers/search/elasticsearch/plugins.nix
+++ b/pkgs/servers/search/elasticsearch/plugins.nix
@ -1,4 +1,4 @@
-{ pkgs,  stdenv, fetchurl, unzip, elasticsearch }:
+{ pkgs,  stdenv, fetchurl, unzip, elasticsearch-oss, javaPackages, elk6Version }:

 with pkgs.lib;

@ -6,8 +6,9 @@ let
  esPlugin = a@{
    pluginName,
    installPhase ? ''
-      mkdir -p $out/bin
-      ES_HOME=$out ${elasticsearch}/bin/elasticsearch-plugin --install ${pluginName} --url file://$src
+      mkdir -p $out/config
+      mkdir -p $out/plugins
+      ES_HOME=$out ${elasticsearch-oss}/bin/elasticsearch-plugin install --batch -v file://$src
    '',
    ...
  }:
@ -16,33 +17,19 @@ let
      unpackPhase = "true";
      buildInputs = [ unzip ];
      meta = a.meta // {
-        platforms = elasticsearch.meta.platforms;
+        platforms = elasticsearch-oss.meta.platforms;
        maintainers = (a.meta.maintainers or []) ++ [ maintainers.offline ];
      };
    });
 in {
-  elasticsearch_river_jdbc = esPlugin rec {
-    name = "elasticsearch-river-jdbc-${version}";
-    pluginName = "elasticsearch-river-jdbc";
-    version = "1.5.0.5";
-    src = fetchurl {
-      url = "http://xbib.org/repository/org/xbib/elasticsearch/plugin/elasticsearch-river-jdbc/${version}/${name}-plugin.zip";
-      sha256 = "1p75l3vcnb90ar4j3dci2xf8dqnqyy31kc1r075fa2xqlsxgigcp";
-    };
-    meta = {
-      homepage = https://github.com/jprante/elasticsearch-river-jdbc;
-      description = "Plugin to fetch data from JDBC sources for indexing into Elasticsearch";
-      license = licenses.asl20;
-    };
-  };

  elasticsearch_analysis_lemmagen = esPlugin rec {
    name = "elasticsearch-analysis-lemmagen-${version}";
    pluginName = "elasticsearch-analysis-lemmagen";
-    version = "0.1";
+    version = "${elk6Version}";
    src = fetchurl {
      url = "https://github.com/vhyza/elasticsearch-analysis-lemmagen/releases/download/v${version}/${name}-plugin.zip";
-      sha256 = "bf7bf5ce3ccdd3afecd0e18cd6fce1ef56f824e41f4ef50553ae598caa5c366d";
+      sha256 = "1m4z05wixjrq4nlbdjyhvprkrwxjym8aba18scmzfn25fhbjgvkz";
    };
    meta = {
      homepage = https://github.com/vhyza/elasticsearch-analysis-lemmagen;
@ -51,68 +38,28 @@ in {
    };
  };

-  elasticsearch_http_basic = stdenv.mkDerivation rec {
-    name = "elasticsearch-http-basic-${version}";
-    version = "1.5.0";
-
-    src = fetchurl {
-      url = "https://github.com/Asquera/elasticsearch-http-basic/releases/download/v${version}/${name}.jar";
-      sha256 = "0fif6sbn2ich39lrgm039y9d5bxkylx9pvly04wss8rdhspvdskb";
+  discovery-ec2 = esPlugin {
+    name = "elasticsearch-discovery-ec2-${version}";
+    pluginName = "discovery-ec2";
+    version = "${elk6Version}";
+    src = pkgs.fetchurl {
+      url = "https://artifacts.elastic.co/downloads/elasticsearch-plugins/discovery-ec2/discovery-ec2-${elk6Version}.zip";
+      sha256 = "1i7ksy69132sr84h51lamgq967yz3a3dw0b54nckxpqwad9pcpj0";
    };
-
-    phases = ["installPhase"];
-    installPhase = "install -D $src $out/plugins/http-basic/${name}.jar";
-
    meta = {
-      homepage = https://github.com/Asquera/elasticsearch-http-basic;
-      description = "HTTP Basic Authentication for Elasticsearch";
-      license = licenses.mit;
-      platforms = elasticsearch.meta.platforms;
-    };
-  };
-
-  elasticsearch_river_twitter = esPlugin rec {
-    name = pname + "-" + version;
-    pname = "elasticsearch-river-twitter";
-    pluginName = "elasticsearch/" + pname + "/" + version;
-    version = "2.5.0";
-
-    src = fetchurl {
-      url = "http://download.elasticsearch.org/elasticsearch/${pname}/${name}.zip";
-      sha256 = "0851yrmyrpp6whyxk34ykcj7b28f90w0nvkrhvl49dwqgr5s4mn4";
-    };
-
-    meta = {
-      homepage = https://github.com/elasticsearch/elasticsearch-river-twitter;
-      description = "Twitter River Plugin for ElasticSearch";
+      homepage = https://github.com/elastic/elasticsearch/tree/master/plugins/discovery-ec2;
+      description = "The EC2 discovery plugin uses the AWS API for unicast discovery.";
      license = licenses.asl20;
-      maintainers = [ maintainers.edwtjo ];
-      platforms = elasticsearch.meta.platforms;
-    };
-  };
-
-  elasticsearch_kopf = esPlugin rec {
-    name = "elasticsearch-kopf-${version}";
-    pluginName = "elasticsearch-kopf";
-    version = "2.1.1";
-    src = fetchurl {
-      url = "https://github.com/lmenezes/elasticsearch-kopf/archive/v${version}.zip";
-      sha256 = "1nwwd92g0jxhfpkxb1a9z5a62naa1y7hvlx400dm6mwwav3mrf4v";
-    };
-    meta = {
-      homepage = https://github.com/lmenezes/elasticsearch-kopf;
-      description = "Web administration tool for ElasticSearch";
-      license = licenses.mit;
    };
  };

  search_guard = esPlugin rec {
    name = "elastic-search-guard-${version}";
    pluginName = "search-guard";
-    version = "0.5";
-    src = fetchurl {
-      url = "https://github.com/floragunncom/search-guard/releases/download/v${version}/${pluginName}-${version}.zip";
-      sha256 = "1zima4jmq1rrcqxhlrp2xian80vp244d2splby015n5cgqrp39fl";
+    version = "${elk6Version}-22.3";
+    src = fetchurl rec {
+      url = "mirror://maven/com/floragunn/search-guard-6/${version}/search-guard-6-${version}.zip";
+      sha256 = "1r71h4h9bmxak1mq5gpm19xq5ji1gry1kp3sjmm8azy4ykdqdncx";
    };
    meta = {
      homepage = https://github.com/floragunncom/search-guard;
--- a/pkgs/tools/admin/gtk-vnc/default.nix
+++ b/pkgs/tools/admin/gtk-vnc/default.nix
@ -1,49 +1,42 @@
 { stdenv, fetchurl, gobjectIntrospection
 , gnutls, cairo, libtool, glib, pkgconfig
-, libffi, cyrus_sasl, intltool, perl, perlPackages, libpulseaudio
-, libgcrypt, gtk3, vala_0_32
-, libogg, libgpgerror, pythonPackages }:
+, cyrus_sasl, intltool, libpulseaudio
+, libgcrypt, gtk3, vala, gnome3
+, python3 }:

-let
-  inherit (pythonPackages) pygobject3 python;
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
  name = "gtk-vnc-${version}";
-  version = "0.7.0";
+  version = "0.9.0";
+
+  outputs = [ "out" "bin" "man" "dev" ];

  src = fetchurl {
-    url = "mirror://gnome/sources/gtk-vnc/${stdenv.lib.strings.substring 0 3 version}/${name}.tar.xz";
-    sha256 = "0gj8dpy3sj4dp810gy67spzh5f0jd8aqg69clcwqjcskj1yawbiw";
+    url = "mirror://gnome/sources/gtk-vnc/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    sha256 = "1dya1wc9vis8h0fv625pii1n70cckf1xjg1m2hndz989d118i6is";
  };

-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [
+    python3 pkgconfig intltool libtool gobjectIntrospection vala
+  ];
  buildInputs = [
-    python gnutls cairo libtool glib libffi libgcrypt
-    intltool cyrus_sasl libpulseaudio perl perlPackages.TextCSV
-    gobjectIntrospection libogg libgpgerror
-    gtk3 vala_0_32 pygobject3
+    gnutls cairo glib libgcrypt cyrus_sasl libpulseaudio gtk3
  ];

-  NIX_CFLAGS_COMPILE = "-fstack-protector-all";
  configureFlags = [
-    "--with-python"
    "--with-examples"
  ];

-  # Fix broken .la files
-  preFixup = ''
-    sed 's,-lgpg-error,-L${libgpgerror.out}/lib -lgpg-error,' -i $out/lib/*.la
-  '';
+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = "gtk-vnc";
+    };
+  };

  meta = with stdenv.lib; {
    description = "A GTK VNC widget";
+    homepage = https://wiki.gnome.org/Projects/gtk-vnc;
+    license = licenses.lgpl21;
    maintainers = with maintainers; [ raskin offline ];
    platforms = platforms.linux;
-    license = licenses.lgpl21;
-  };
-
-  passthru = {
-    updateInfo = {
-      downloadPage = "http://ftp.gnome.org/pub/GNOME/sources/gtk-vnc";
-    };
  };
 }
--- a/pkgs/tools/backup/duplicity/default.nix
+++ b/pkgs/tools/backup/duplicity/default.nix
@ -2,11 +2,11 @@

 python2Packages.buildPythonApplication rec {
  name = "duplicity-${version}";
-  version = "0.7.17";
+  version = "0.7.18";

  src = fetchurl {
    url = "http://code.launchpad.net/duplicity/${stdenv.lib.versions.majorMinor version}-series/${version}/+download/${name}.tar.gz";
-    sha256 = "0jmh3h09680xyf33hzxxxl74bwz66zqhzvjlj7j89r9rz3qwa91p";
+    sha256 = "1qlika4l1k1nx8zr657ihcy0yzr1c1cdnjlbs325l5krvc3zbc5b";
  };

  buildInputs = [ librsync makeWrapper python2Packages.wrapPython ];
--- a/pkgs/tools/misc/logstash/6.x.nix
+++ b/pkgs/tools/misc/logstash/6.x.nix
@ -1,53 +0,0 @@
-{ elk6Version
-, enableUnfree ? true
-, stdenv
-, fetchurl
-, makeWrapper
-, jre
-}:
-
-with stdenv.lib;
-
-stdenv.mkDerivation rec {
-  version = elk6Version;
-  name = "logstash-${optionalString (!enableUnfree) "oss-"}${version}";
-
-  src = fetchurl {
-    url = "https://artifacts.elastic.co/downloads/logstash/${name}.tar.gz";
-    sha256 =
-      if enableUnfree
-      then "0yx9hpiav4d5z1b52x2h5i0iknqs9lmxy8vmz0wkb23mjiz8njdr"
-      else "1ir8pbq706mxr56k5cgc9ajn2jp603zrqj66dimx6xxf2nfamw0w";
-  };
-
-  dontBuild         = true;
-  dontPatchELF      = true;
-  dontStrip         = true;
-  dontPatchShebangs = true;
-
-  buildInputs = [
-    makeWrapper jre
-  ];
-
-  installPhase = ''
-    mkdir -p $out
-    cp -r {Gemfile*,modules,vendor,lib,bin,config,data,logstash-core,logstash-core-plugin-api} $out
-
-    patchShebangs $out/bin/logstash
-    patchShebangs $out/bin/logstash-plugin
-
-    wrapProgram $out/bin/logstash \
-       --set JAVA_HOME "${jre}"
-
-    wrapProgram $out/bin/logstash-plugin \
-       --set JAVA_HOME "${jre}"
-  '';
-
-  meta = with stdenv.lib; {
-    description = "Logstash is a data pipeline that helps you process logs and other event data from a variety of systems";
-    homepage    = https://www.elastic.co/products/logstash;
-    license     = if enableUnfree then licenses.elastic else licenses.asl20;
-    platforms   = platforms.unix;
-    maintainers = with maintainers; [ wjlroe offline basvandijk ];
-  };
-}
--- a/pkgs/tools/misc/logstash/default.nix
+++ b/pkgs/tools/misc/logstash/default.nix
@ -1,12 +1,23 @@
-{ stdenv, fetchurl, makeWrapper, jre  }:
+{ elk6Version
+, enableUnfree ? true
+, stdenv
+, fetchurl
+, makeWrapper
+, jre
+}:
+
+with stdenv.lib;

 stdenv.mkDerivation rec {
-  version = "2.4.0";
-  name = "logstash-${version}";
+  version = elk6Version;
+  name = "logstash-${optionalString (!enableUnfree) "oss-"}${version}";

  src = fetchurl {
-    url = "https://download.elasticsearch.org/logstash/logstash/logstash-${version}.tar.gz";
-    sha256 = "1k27hb6q1r26rp3y9pb2ry92kicw83mi352dzl2y4h0gbif46b32";
+    url = "https://artifacts.elastic.co/downloads/logstash/${name}.tar.gz";
+    sha256 =
+      if enableUnfree
+      then "0yx9hpiav4d5z1b52x2h5i0iknqs9lmxy8vmz0wkb23mjiz8njdr"
+      else "1ir8pbq706mxr56k5cgc9ajn2jp603zrqj66dimx6xxf2nfamw0w";
  };

  dontBuild         = true;
@ -20,14 +31,14 @@ stdenv.mkDerivation rec {

  installPhase = ''
    mkdir -p $out
-    cp -r {Gemfile*,vendor,lib,bin} $out
+    cp -r {Gemfile*,modules,vendor,lib,bin,config,data,logstash-core,logstash-core-plugin-api} $out
+
+    patchShebangs $out/bin/logstash
+    patchShebangs $out/bin/logstash-plugin

    wrapProgram $out/bin/logstash \
       --set JAVA_HOME "${jre}"

-    wrapProgram $out/bin/rspec \
-       --set JAVA_HOME "${jre}"
-
    wrapProgram $out/bin/logstash-plugin \
       --set JAVA_HOME "${jre}"
  '';
@ -35,8 +46,8 @@ stdenv.mkDerivation rec {
  meta = with stdenv.lib; {
    description = "Logstash is a data pipeline that helps you process logs and other event data from a variety of systems";
    homepage    = https://www.elastic.co/products/logstash;
-    license     = licenses.asl20;
+    license     = if enableUnfree then licenses.elastic else licenses.asl20;
    platforms   = platforms.unix;
-    maintainers = [ maintainers.wjlroe maintainers.offline ];
+    maintainers = with maintainers; [ wjlroe offline basvandijk ];
  };
 }
--- a/pkgs/tools/system/minijail/default.nix
+++ b/pkgs/tools/system/minijail/default.nix
@ -3,12 +3,12 @@
 stdenv.mkDerivation rec {
  shortname = "minijail";
  name = "${shortname}-${version}";
-  version = "android-8.0.0_r34";
+  version = "android-9.0.0_r3";

  src = fetchgit {
    url = "https://android.googlesource.com/platform/external/minijail";
    rev = version;
-    sha256 = "1d0q08cgks6h6ffsw3zw8dz4rm9y2djj2pwwy3xi6flx7vwy0psf";
+    sha256 = "1g1g52s3q61amcnx8cv1332sbixpck1bmjzgsrjiw5ix7chrzkp2";
  };

  buildInputs = [ libcap ];
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -849,23 +849,23 @@ with pkgs;

  bchunk = callPackage ../tools/cd-dvd/bchunk { };

-  inherit (callPackages ../misc/logging/beats/5.x.nix { })
-    filebeat
-    heartbeat
-    metricbeat
-    packetbeat;
-
-  inherit (let beats6 = callPackages ../misc/logging/beats/6.x.nix { }; in {
-    filebeat6   = beats6.filebeat;
-    heartbeat6  = beats6.heartbeat;
-    metricbeat6 = beats6.metricbeat;
-    packetbeat6 = beats6.packetbeat;
-  })
+  inherit (callPackages ../misc/logging/beats/6.x.nix { })
    filebeat6
    heartbeat6
    metricbeat6
    packetbeat6;

+  filebeat = filebeat6;
+  heartbeat = heartbeat6;
+  metricbeat = metricbeat6;
+  packetbeat = packetbeat6;
+
+  inherit (callPackages ../misc/logging/beats/5.x.nix { })
+    filebeat5
+    heartbeat5
+    metricbeat5
+    packetbeat5;
+
  bfr = callPackage ../tools/misc/bfr { };

  bibtool = callPackage ../tools/misc/bibtool { };
@ -2303,13 +2303,13 @@ with pkgs;
  elk5Version = "5.6.9";
  elk6Version = "6.3.2";

-  elasticsearch = callPackage ../servers/search/elasticsearch { };
-  elasticsearch2 = callPackage ../servers/search/elasticsearch/2.x.nix { };
  elasticsearch5 = callPackage ../servers/search/elasticsearch/5.x.nix { };
-  elasticsearch6 = callPackage ../servers/search/elasticsearch/6.x.nix { };
-  elasticsearch6-oss = callPackage ../servers/search/elasticsearch/6.x.nix {
+  elasticsearch6 = callPackage ../servers/search/elasticsearch { };
+  elasticsearch6-oss = callPackage ../servers/search/elasticsearch {
    enableUnfree = false;
  };
+  elasticsearch = elasticsearch6;
+  elasticsearch-oss = elasticsearch6-oss;

  elasticsearchPlugins = recurseIntoAttrs (
    callPackage ../servers/search/elasticsearch/plugins.nix { }
@ -2963,7 +2963,7 @@ with pkgs;

  gtkperf = callPackage ../development/tools/misc/gtkperf { };

-  gtkvnc = callPackage ../tools/admin/gtk-vnc {};
+  gtk-vnc = callPackage ../tools/admin/gtk-vnc {};

  gtmess = callPackage ../applications/networking/instant-messengers/gtmess { };

@ -3383,6 +3383,10 @@ with pkgs;

  jupp = callPackage ../applications/editors/jupp { };

+  jupyter = callPackage ../applications/editors/jupyter { };
+
+  jupyter-kernel = callPackage ../applications/editors/jupyter/kernel.nix { };
+
  jwhois = callPackage ../tools/networking/jwhois { };

  k2pdfopt = callPackage ../applications/misc/k2pdfopt { };
@ -3424,12 +3428,13 @@ with pkgs;

  keyfuzz = callPackage ../tools/inputmethods/keyfuzz { };

-  kibana  = callPackage ../development/tools/misc/kibana { };
  kibana5 = callPackage ../development/tools/misc/kibana/5.x.nix { };
-  kibana6 = callPackage ../development/tools/misc/kibana/6.x.nix { };
-  kibana6-oss = callPackage ../development/tools/misc/kibana/6.x.nix {
+  kibana6 = callPackage ../development/tools/misc/kibana/default.nix { };
+  kibana6-oss = callPackage ../development/tools/misc/kibana/default.nix {
    enableUnfree = false;
  };
+  kibana = kibana6;
+  kibana-oss = kibana6-oss;

  kismet = callPackage ../applications/networking/sniffers/kismet { };

@ -3506,12 +3511,12 @@ with pkgs;

  lockfileProgs = callPackage ../tools/misc/lockfile-progs { };

-  logstash  = callPackage ../tools/misc/logstash { };
  logstash5 = callPackage ../tools/misc/logstash/5.x.nix { };
-  logstash6 = callPackage ../tools/misc/logstash/6.x.nix { };
-  logstash6-oss = callPackage ../tools/misc/logstash/6.x.nix {
+  logstash6 = callPackage ../tools/misc/logstash { };
+  logstash6-oss = callPackage ../tools/misc/logstash {
    enableUnfree = false;
  };
+  logstash = logstash6;

  logstash-contrib = callPackage ../tools/misc/logstash/contrib.nix { };

@ -6795,6 +6800,9 @@ with pkgs;
      };

  openjdk10 =
+    if stdenv.isDarwin then
+      callPackage ../development/compilers/openjdk/darwin/10.nix { }
+    else
      callPackage ../development/compilers/openjdk/10.nix {
        inherit (gnome2) GConf gnome_vfs;
      };
@ -9032,6 +9040,8 @@ with pkgs;

  cmocka = callPackage ../development/libraries/cmocka { };

+  cmrt = callPackage ../development/libraries/cmrt { };
+
  cogl = callPackage ../development/libraries/cogl { };

  coin3d = callPackage ../development/libraries/coin3d { };
@ -10323,6 +10333,8 @@ with pkgs;

  libgroove = callPackage ../development/libraries/libgroove { };

+  libgrss = callPackage ../development/libraries/libgrss { };
+
  libseccomp = callPackage ../development/libraries/libseccomp { };

  libsecret = callPackage ../development/libraries/libsecret { };
@ -10619,6 +10631,8 @@ with pkgs;

  libmad = callPackage ../development/libraries/libmad { };

+  libmanette = callPackage ../development/libraries/libmanette { };
+
  libmatchbox = callPackage ../development/libraries/libmatchbox { };

  libmatheval = callPackage ../development/libraries/libmatheval {
@ -11647,7 +11661,7 @@ with pkgs;
      kservice ktexteditor ktextwidgets kunitconversion kwallet kwayland
      kwidgetsaddons kwindowsystem kxmlgui kxmlrpcclient modemmanager-qt
      networkmanager-qt plasma-framework prison solid sonnet syntax-highlighting
-      threadweaver kirigami2 kholidays;
+      threadweaver kirigami2 kholidays kpurpose;

    ### KDE PLASMA 5

@ -12272,6 +12286,8 @@ with pkgs;

  vaapiIntel = callPackage ../development/libraries/vaapi-intel { };

+  vaapi-intel-hybrid = callPackage ../development/libraries/vaapi-intel-hybrid { };
+
  vaapiVdpau = callPackage ../development/libraries/vaapi-vdpau { };

  vale = callPackage ../tools/text/vale { };
@ -17067,7 +17083,7 @@ with pkgs;
  inherit (kdeApplications)
    akonadi akregator ark dolphin dragon ffmpegthumbs filelight gwenview k3b
    kaddressbook kate kcachegrind kcalc kcolorchooser kcontacts kdenlive kdf kdialog keditbookmarks
-    kget kgpg khelpcenter kig kleopatra kmail kmix kolourpaint kompare konsole
+    kget kgpg khelpcenter kig kleopatra kmail kmix kolourpaint kompare konsole kpkpass kitinerary
    kontact korganizer krdc krfb ksystemlog kwalletmanager marble minuet okular spectacle;

  okteta = libsForQt5.callPackage ../applications/editors/okteta { };
@ -17084,8 +17100,6 @@ with pkgs;
    llvmPackages = llvmPackages_38;
  };

-  kdevplatform = libsForQt5.callPackage ../applications/editors/kdevelop5/kdevplatform.nix { };
-
  keepnote = callPackage ../applications/office/keepnote { };

  kega-fusion = pkgsi686Linux.callPackage ../misc/emulators/kega-fusion { };
@ -17318,6 +17332,8 @@ with pkgs;

  lyx = libsForQt5.callPackage ../applications/misc/lyx { };

+  mac = callPackage ../development/libraries/mac { };
+
  magic-wormhole = with python3Packages; toPythonApplication magic-wormhole;

  mail-notification = callPackage ../desktops/gnome-2/desktop/mail-notification {};
@ -18421,6 +18437,8 @@ with pkgs;

  spideroak = callPackage ../applications/networking/spideroak { };

+  split2flac = callPackage ../applications/audio/split2flac { };
+
  squishyball = callPackage ../applications/audio/squishyball {
    ncurses = ncurses5;
  };
@ -19560,6 +19578,8 @@ with pkgs;

  _2048-in-terminal = callPackage ../games/2048-in-terminal { };

+  _20kly = callPackage ../games/20kly { };
+
  _90secondportraits = callPackage ../games/90secondportraits { love = love_0_10; };

  adom = callPackage ../games/adom { };
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -2022,6 +2022,8 @@ in {

  requests-unixsocket = callPackage ../development/python-modules/requests-unixsocket {};

+  requests-aws4auth = callPackage ../development/python-modules/requests-aws4auth { };
+
  howdoi = callPackage ../development/python-modules/howdoi {};

  neurotools = callPackage ../development/python-modules/neurotools {};