Merge remote-tracking branch 'upstream/master' into sage-8.5

doc/stdenv.xml

@@ -2428,12 +2428,31 @@ addEnvHooks "$hostOffset" myBashFunction
       <para>
        This is a special setup hook which helps in packaging proprietary
        software in that it automatically tries to find missing shared library
-       dependencies of ELF files. All packages within the
+       dependencies of ELF files based on the given
-       <envar>runtimeDependencies</envar> environment variable are
+       <varname>buildInputs</varname> and <varname>nativeBuildInputs</varname>.
-       unconditionally added to executables, which is useful for programs that
+      </para>
-       use <citerefentry>
+      <para>
-       <refentrytitle>dlopen</refentrytitle>
+       You can also specify a <envar>runtimeDependencies</envar> environment
-       <manvolnum>3</manvolnum> </citerefentry> to load libraries at runtime.
+       variable which lists dependencies that are unconditionally added to all
+       executables.
+      </para>
+      <para>
+       This is useful for programs that use <citerefentry>
+        <refentrytitle>dlopen</refentrytitle>
+        <manvolnum>3</manvolnum>
+       </citerefentry> to load libraries at runtime.
+      </para>
+      <para>
+        In certain situations you may want to run the main command
+        (<command>autoPatchelf</command>) of the setup hook on a file or a set
+        of directories instead of unconditionally patching all outputs. This
+        can be done by setting the <envar>dontAutoPatchelf</envar> environment
+        variable to a non-empty value.
+      </para>
+      <para>
+        The <command>autoPatchelf</command> command also recognizes a
+        <parameter class="command">--no-recurse</parameter> command line flag,
+        which prevents it from recursing into subdirectories.
       </para>
      </listitem>
     </varlistentry>
@@ -2455,7 +2474,17 @@ addEnvHooks "$hostOffset" myBashFunction
        use the cntr exec subcommand. Note that <command>cntr</command> also
        needs to be executed on the machine that is doing the build, which might
        be not the case when remote builders are enabled.
-       <command>cntr</command> is only supported on linux based platforms.
+       <command>cntr</command> is only supported on Linux-based platforms. To
+       use it first add <literal>cntr</literal> to your
+       <literal>environment.systemPackages</literal> on NixOS or alternatively to
+       the root user on non-NixOS systems. Then in the package that is supposed
+       to be inspected, add <literal>breakpointHook</literal> to
+       <literal>nativeBuildInputs</literal>.
+<programlisting>
+         nativeBuildInputs = [ breakpointHook ];
+       </programlisting>
+       When a build failure happens there will be an instruction printed that
+       shows how to attach with <literal>cntr</literal> to the build sandbox.
       </para>
      </listitem>
     </varlistentry>

nixos/lib/make-system-tarball.nix

@@ -1,4 +1,4 @@
-{ stdenv, perl, pixz, pathsFromGraph
+{ stdenv, closureInfo, pixz
 
 , # The file name of the resulting tarball
   fileName ? "nixos-system-${stdenv.hostPlatform.system}"
@@ -29,24 +29,28 @@
 , extraInputs ? [ pixz ]
 }:
 
+let
+  symlinks = map (x: x.symlink) storeContents;
+  objects = map (x: x.object) storeContents;
+in
+
 stdenv.mkDerivation {
   name = "tarball";
   builder = ./make-system-tarball.sh;
-  buildInputs = [ perl ] ++ extraInputs;
+  buildInputs = extraInputs;
 
-  inherit fileName pathsFromGraph extraArgs extraCommands compressCommand;
+  inherit fileName extraArgs extraCommands compressCommand;
 
   # !!! should use XML.
   sources = map (x: x.source) contents;
   targets = map (x: x.target) contents;
 
   # !!! should use XML.
-  objects = map (x: x.object) storeContents;
+  inherit symlinks objects;
-  symlinks = map (x: x.symlink) storeContents;
 
-  # For obtaining the closure of `storeContents'.
+  closureInfo = closureInfo {
-  exportReferencesGraph =
+    rootPaths = objects;
-    map (x: [("closure-" + baseNameOf x.object) x.object]) storeContents;
+  };
 
   extension = compressionExtension;
 }

nixos/lib/make-system-tarball.sh

@@ -3,7 +3,6 @@ source $stdenv/setup
 sources_=($sources)
 targets_=($targets)
 
-echo $objects
 objects=($objects)
 symlinks=($symlinks)
 
@@ -14,8 +13,6 @@ stripSlash() {
     if test "${res:0:1}" = /; then res=${res:1}; fi
 }
 
-touch pathlist
-
 # Add the individual files.
 for ((i = 0; i < ${#targets_[@]}; i++)); do
     stripSlash "${targets_[$i]}"
@@ -25,9 +22,9 @@ done
 
 
 # Add the closures of the top-level store objects.
+chmod +w .
 mkdir -p nix/store
-storePaths=$(perl $pathsFromGraph closure-*)
+for i in $(< $closureInfo/store-paths); do
-for i in $storePaths; do
     cp -a "$i" "${i:1}"
 done
 
@@ -35,7 +32,7 @@ done
 # TODO tar ruxo
 # Also include a manifest of the closures in a format suitable for
 # nix-store --load-db.
-printRegistration=1 perl $pathsFromGraph closure-* > nix-path-registration
+cp $closureInfo/registration nix-path-registration
 
 # Add symlinks to the top-level store objects.
 for ((n = 0; n < ${#objects[*]}; n++)); do

nixos/lib/testing.nix

@@ -1,5 +1,5 @@
 { system
-, pkgs
+, pkgs ? import ../.. { inherit system config; }
   # Use a minimal kernel?
 , minimal ? false
   # Ignored

nixos/maintainers/scripts/gce/create-gce.sh

@@ -7,9 +7,9 @@ BUCKET_NAME="${BUCKET_NAME:-nixos-cloud-images}"
 TIMESTAMP="$(date +%Y%m%d%H%M)"
 export TIMESTAMP
 
-nix-build '<nixpkgs/nixos>' \
+nix-build '<nixpkgs/nixos/lib/eval-config.nix>' \
    -A config.system.build.googleComputeImage \
-   --arg configuration "{ imports = [ <nixpkgs/nixos/modules/virtualisation/google-compute-image.nix> ]; }" \
+   --arg modules "[ <nixpkgs/nixos/modules/virtualisation/google-compute-image.nix> ]" \
    --argstr system x86_64-linux \
    -o gce \
    -j 10

nixos/modules/profiles/docker-container.nix

@@ -15,15 +15,19 @@ in {
 
   # Create the tarball
   system.build.tarball = pkgs.callPackage ../../lib/make-system-tarball.nix {
-    contents = [];
+    contents = [
+      {
+        source = "${config.system.build.toplevel}/.";
+        target = "./";
+      }
+    ];
     extraArgs = "--owner=0";
 
     # Add init script to image
-    storeContents = [
+    storeContents = pkgs2storeContents [
-      { object = config.system.build.toplevel + "/init";
+      config.system.build.toplevel
-        symlink = "/init";
+      pkgs.stdenv
-      }
+    ];
-    ] ++ (pkgs2storeContents [ pkgs.stdenv ]);
 
     # Some container managers like lxc need these
     extraCommands = "mkdir -p proc sys dev";

nixos/modules/services/cluster/kubernetes/default.nix

@@ -784,7 +784,7 @@ in {
     clusterCidr = mkOption {
       description = "Kubernetes controller manager and proxy CIDR Range for Pods in cluster.";
       default = "10.1.0.0/16";
-      type = types.str;
+      type = types.nullOr types.str;
     };
 
     flannel.enable = mkOption {
@@ -1018,9 +1018,9 @@ in {
             ${if (cfg.controllerManager.rootCaFile!=null)
               then "--root-ca-file=${cfg.controllerManager.rootCaFile}"
               else "--root-ca-file=/var/run/kubernetes/apiserver.crt"} \
-            ${optionalString (cfg.clusterCidr!=null)
+            ${if (cfg.clusterCidr!=null)
-              "--cluster-cidr=${cfg.clusterCidr}"} \
+              then "--cluster-cidr=${cfg.clusterCidr} --allocate-node-cidrs=true"
-            --allocate-node-cidrs=true \
+              else "--allocate-node-cidrs=false"} \
             ${optionalString (cfg.controllerManager.featureGates != [])
               "--feature-gates=${concatMapStringsSep "," (feature: "${feature}=true") cfg.controllerManager.featureGates}"} \
             ${optionalString cfg.verbose "--v=6"} \

nixos/modules/services/mail/rspamd.nix

@@ -45,7 +45,9 @@ let
       else "${config.socket}${maybeOption "mode"}${maybeOption "owner"}${maybeOption "group"}";
   };
 
-  workerOpts = { name, ... }: {
+  traceWarning = w: x: builtins.trace "warning: ${w}" x;
+
+  workerOpts = { name, options, ... }: {
     options = {
       enable = mkOption {
         type = types.nullOr types.bool;
@@ -59,9 +61,18 @@ let
       };
       type = mkOption {
         type = types.nullOr (types.enum [
-          "normal" "controller" "fuzzy_storage" "rspamd_proxy" "lua"
+          "normal" "controller" "fuzzy_storage" "rspamd_proxy" "lua" "proxy"
         ]);
-        description = "The type of this worker";
+        description = ''
+          The type of this worker. The type <literal>proxy</literal> is
+          deprecated and only kept for backwards compatibility and should be
+          replaced with <literal>rspamd_proxy</literal>.
+        '';
+        apply = let
+            from = "services.rspamd.workers.\”${name}\".type";
+            files = options.type.files;
+            warning = "The option `${from}` defined in ${showFiles files} has enum value `proxy` which has been renamed to `rspamd_proxy`";
+          in x: if x == "proxy" then traceWarning warning "rspamd_proxy" else x;
       };
       bindSockets = mkOption {
         type = types.listOf (types.either types.str (types.submodule bindSocketOpts));

nixos/modules/system/boot/systemd-nspawn.nix

@@ -112,7 +112,7 @@ in {
 
       environment.etc."systemd/nspawn".source = generateUnits "nspawn" units [] [];
 
-      systemd.targets."multi-user".wants = [ "machines.target "];
+      systemd.targets."multi-user".wants = [ "machines.target" ];
   };
 
 }

nixos/modules/virtualisation/docker-image.nix

@@ -17,3 +17,41 @@
   # Socket activated ssh presents problem in Docker.
   services.openssh.startWhenNeeded = false;
 }
+
+# Example usage:
+#
+## default.nix
+# let
+#   nixos = import <nixpkgs/nixos> {
+#     configuration = ./configuration.nix;
+#     system = "x86_64-linux";
+#   };
+# in
+# nixos.config.system.build.tarball
+#
+## configuration.nix
+# { pkgs, config, lib, ... }:
+# {
+#   imports = [
+#     <nixpkgs/nixos/modules/virtualisation/docker-image.nix>
+#     <nixpkgs/nixos/modules/installer/cd-dvd/channel.nix>
+#   ];
+#
+#   documentation.doc.enable = false;
+#
+#   environment.systemPackages = with pkgs; [
+#     bashInteractive
+#     cacert
+#     nix
+#   ];
+# }
+#
+## Run
+# Build the tarball:
+# $ nix-build default.nix
+# Load into docker:
+# $ docker import result/tarball/nixos-system-*.tar.xz nixos-docker
+# Boots into systemd
+# $ docker run --privileged -it nixos-docker /init
+# Log into the container
+# $ docker exec -it <container-name> /run/current-system/sw/bin/bash

nixos/modules/virtualisation/google-compute-config.nix

@@ -1,5 +1,261 @@
-{ ... }:
+{ config, lib, pkgs, ... }:
-
+with lib;
+let
+  gce = pkgs.google-compute-engine;
+  cfg = config.virtualisation.googleComputeImage;
+in
 {
-  imports = [ <nixpkgs/nixos/modules/virtualisation/google-compute-image.nix> ];
+  imports = [
+    ../profiles/headless.nix
+    ../profiles/qemu-guest.nix
+  ];
+
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/nixos";
+    autoResize = true;
+  };
+
+  boot.growPartition = true;
+  boot.kernelParams = [ "console=ttyS0" "panic=1" "boot.panic_on_fail" ];
+  boot.initrd.kernelModules = [ "virtio_scsi" ];
+  boot.kernelModules = [ "virtio_pci" "virtio_net" ];
+
+  # Generate a GRUB menu.  Amazon's pv-grub uses this to boot our kernel/initrd.
+  boot.loader.grub.device = "/dev/sda";
+  boot.loader.timeout = 0;
+
+  # Don't put old configurations in the GRUB menu.  The user has no
+  # way to select them anyway.
+  boot.loader.grub.configurationLimit = 0;
+
+  # Allow root logins only using the SSH key that the user specified
+  # at instance creation time.
+  services.openssh.enable = true;
+  services.openssh.permitRootLogin = "prohibit-password";
+  services.openssh.passwordAuthentication = mkDefault false;
+
+  # Use GCE udev rules for dynamic disk volumes
+  services.udev.packages = [ gce ];
+
+  # Force getting the hostname from Google Compute.
+  networking.hostName = mkDefault "";
+
+  # Always include cryptsetup so that NixOps can use it.
+  environment.systemPackages = [ pkgs.cryptsetup ];
+
+  # Make sure GCE image does not replace host key that NixOps sets
+  environment.etc."default/instance_configs.cfg".text = lib.mkDefault ''
+    [InstanceSetup]
+    set_host_keys = false
+  '';
+
+  # Rely on GCP's firewall instead
+  networking.firewall.enable = mkDefault false;
+
+  # Configure default metadata hostnames
+  networking.extraHosts = ''
+    169.254.169.254 metadata.google.internal metadata
+  '';
+
+  networking.timeServers = [ "metadata.google.internal" ];
+
+  networking.usePredictableInterfaceNames = false;
+
+  # GC has 1460 MTU
+  networking.interfaces.eth0.mtu = 1460;
+
+  # allow the google-accounts-daemon to manage users
+  users.mutableUsers = true;
+  # and allow users to sudo without password
+  security.sudo.enable = true;
+  security.sudo.extraConfig = ''
+  %google-sudoers ALL=(ALL:ALL) NOPASSWD:ALL
+  '';
+
+  # NOTE: google-accounts tries to write to /etc/sudoers.d but the folder doesn't exist
+  # FIXME: not such file or directory on dynamic SSH provisioning
+  systemd.services.google-accounts-daemon = {
+    description = "Google Compute Engine Accounts Daemon";
+    # This daemon creates dynamic users
+    enable = config.users.mutableUsers;
+    after = [
+      "network.target"
+      "google-instance-setup.service"
+      "google-network-setup.service"
+    ];
+    requires = ["network.target"];
+    wantedBy = ["multi-user.target"];
+    path = with pkgs; [ shadow ];
+    serviceConfig = {
+      Type = "simple";
+      ExecStart = "${gce}/bin/google_accounts_daemon --debug";
+    };
+  };
+
+  systemd.services.google-clock-skew-daemon = {
+    description = "Google Compute Engine Clock Skew Daemon";
+    after = [
+      "network.target"
+      "google-instance-setup.service"
+      "google-network-setup.service"
+    ];
+    requires = ["network.target"];
+    wantedBy = ["multi-user.target"];
+    serviceConfig = {
+      Type = "simple";
+      ExecStart = "${gce}/bin/google_clock_skew_daemon --debug";
+    };
+  };
+
+  systemd.services.google-instance-setup = {
+    description = "Google Compute Engine Instance Setup";
+    after = ["local-fs.target" "network-online.target" "network.target" "rsyslog.service"];
+    before = ["sshd.service"];
+    wants = ["local-fs.target" "network-online.target" "network.target"];
+    wantedBy = [ "sshd.service" "multi-user.target" ];
+    path = with pkgs; [ ethtool openssh ];
+    serviceConfig = {
+      ExecStart = "${gce}/bin/google_instance_setup --debug";
+      Type = "oneshot";
+    };
+  };
+
+  systemd.services.google-network-daemon = {
+    description = "Google Compute Engine Network Daemon";
+    after = ["local-fs.target" "network-online.target" "network.target" "rsyslog.service" "google-instance-setup.service"];
+    wants = ["local-fs.target" "network-online.target" "network.target"];
+    requires = ["network.target"];
+    partOf = ["network.target"];
+    wantedBy = [ "multi-user.target" ];
+    path = with pkgs; [ iproute ];
+    serviceConfig = {
+      ExecStart = "${gce}/bin/google_network_daemon --debug";
+    };
+  };
+
+  systemd.services.google-shutdown-scripts = {
+    description = "Google Compute Engine Shutdown Scripts";
+    after = [
+      "local-fs.target"
+      "network-online.target"
+      "network.target"
+      "rsyslog.service"
+      "systemd-resolved.service"
+      "google-instance-setup.service"
+      "google-network-daemon.service"
+    ];
+    wants = [ "local-fs.target" "network-online.target" "network.target"];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      ExecStart = "${pkgs.coreutils}/bin/true";
+      ExecStop = "${gce}/bin/google_metadata_script_runner --debug --script-type shutdown";
+      Type = "oneshot";
+      RemainAfterExit = true;
+      TimeoutStopSec = "infinity";
+    };
+  };
+
+  systemd.services.google-startup-scripts = {
+    description = "Google Compute Engine Startup Scripts";
+    after = [
+      "local-fs.target"
+      "network-online.target"
+      "network.target"
+      "rsyslog.service"
+      "google-instance-setup.service"
+      "google-network-daemon.service"
+    ];
+    wants = ["local-fs.target" "network-online.target" "network.target"];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      ExecStart = "${gce}/bin/google_metadata_script_runner --debug --script-type startup";
+      KillMode = "process";
+      Type = "oneshot";
+    };
+  };
+
+
+  # Settings taken from https://github.com/GoogleCloudPlatform/compute-image-packages/blob/master/google_config/sysctl/11-gce-network-security.conf
+  boot.kernel.sysctl = {
+    # Turn on SYN-flood protections.  Starting with 2.6.26, there is no loss
+    # of TCP functionality/features under normal conditions.  When flood
+    # protections kick in under high unanswered-SYN load, the system
+    # should remain more stable, with a trade off of some loss of TCP
+    # functionality/features (e.g. TCP Window scaling).
+    "net.ipv4.tcp_syncookies" = mkDefault "1";
+
+    # ignores source-routed packets
+    "net.ipv4.conf.all.accept_source_route" = mkDefault "0";
+
+    # ignores source-routed packets
+    "net.ipv4.conf.default.accept_source_route" = mkDefault "0";
+
+    # ignores ICMP redirects
+    "net.ipv4.conf.all.accept_redirects" = mkDefault "0";
+
+    # ignores ICMP redirects
+    "net.ipv4.conf.default.accept_redirects" = mkDefault "0";
+
+    # ignores ICMP redirects from non-GW hosts
+    "net.ipv4.conf.all.secure_redirects" = mkDefault "1";
+
+    # ignores ICMP redirects from non-GW hosts
+    "net.ipv4.conf.default.secure_redirects" = mkDefault "1";
+
+    # don't allow traffic between networks or act as a router
+    "net.ipv4.ip_forward" = mkDefault "0";
+
+    # don't allow traffic between networks or act as a router
+    "net.ipv4.conf.all.send_redirects" = mkDefault "0";
+
+    # don't allow traffic between networks or act as a router
+    "net.ipv4.conf.default.send_redirects" = mkDefault "0";
+
+    # reverse path filtering - IP spoofing protection
+    "net.ipv4.conf.all.rp_filter" = mkDefault "1";
+
+    # reverse path filtering - IP spoofing protection
+    "net.ipv4.conf.default.rp_filter" = mkDefault "1";
+
+    # ignores ICMP broadcasts to avoid participating in Smurf attacks
+    "net.ipv4.icmp_echo_ignore_broadcasts" = mkDefault "1";
+
+    # ignores bad ICMP errors
+    "net.ipv4.icmp_ignore_bogus_error_responses" = mkDefault "1";
+
+    # logs spoofed, source-routed, and redirect packets
+    "net.ipv4.conf.all.log_martians" = mkDefault "1";
+
+    # log spoofed, source-routed, and redirect packets
+    "net.ipv4.conf.default.log_martians" = mkDefault "1";
+
+    # implements RFC 1337 fix
+    "net.ipv4.tcp_rfc1337" = mkDefault "1";
+
+    # randomizes addresses of mmap base, heap, stack and VDSO page
+    "kernel.randomize_va_space" = mkDefault "2";
+
+    # Reboot the machine soon after a kernel panic.
+    "kernel.panic" = mkDefault "10";
+
+    ## Not part of the original config
+
+    # provides protection from ToCToU races
+    "fs.protected_hardlinks" = mkDefault "1";
+
+    # provides protection from ToCToU races
+    "fs.protected_symlinks" = mkDefault "1";
+
+    # makes locating kernel addresses more difficult
+    "kernel.kptr_restrict" = mkDefault "1";
+
+    # set ptrace protections
+    "kernel.yama.ptrace_scope" = mkOverride 500 "1";
+
+    # set perf only available to root
+    "kernel.perf_event_paranoid" = mkDefault "2";
+
+  };
+
 }

nixos/modules/virtualisation/google-compute-image.nix

@@ -2,333 +2,59 @@
 
 with lib;
 let
-  diskSize = 1536; # MB
+  cfg = config.virtualisation.googleComputeImage;
-  gce = pkgs.google-compute-engine;
+  defaultConfigFile = pkgs.writeText "configuration.nix" ''
+    { ... }:
+    {
+      imports = [
+        <nixpkgs/nixos/modules/virtualisation/google-compute-image.nix>
+      ];
+    }
+  '';
 in
 {
-  imports = [ ../profiles/headless.nix ../profiles/qemu-guest.nix ];
 
-  system.build.googleComputeImage = import ../../lib/make-disk-image.nix {
+  imports = [ ./google-compute-config.nix ];
-    name = "google-compute-image";
-    postVM = ''
-      PATH=$PATH:${pkgs.stdenv.lib.makeBinPath [ pkgs.gnutar pkgs.gzip ]}
-      pushd $out
-      mv $diskImage disk.raw
-      tar -Szcf nixos-image-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}.raw.tar.gz disk.raw
-      rm $out/disk.raw
-      popd
-    '';
-    configFile = <nixpkgs/nixos/modules/virtualisation/google-compute-config.nix>;
-    format = "raw";
-    inherit diskSize;
-    inherit config lib pkgs;
-  };
 
-  fileSystems."/" = {
+  options = {
-    device = "/dev/disk/by-label/nixos";
+    virtualisation.googleComputeImage.diskSize = mkOption {
-    autoResize = true;
+      type = with types; int;
-  };
+      default = 1536;
+      description = ''
+        Size of disk image. Unit is MB.
+      '';
+    };
 
-  boot.growPartition = true;
+    virtualisation.googleComputeImage.configFile = mkOption {
-  boot.kernelParams = [ "console=ttyS0" "panic=1" "boot.panic_on_fail" ];
+      type = with types; nullOr str;
-  boot.initrd.kernelModules = [ "virtio_scsi" ];
+      default = null;
-  boot.kernelModules = [ "virtio_pci" "virtio_net" ];
+      description = ''
-
+        A path to a configuration file which will be placed at `/etc/nixos/configuration.nix`
-  # Generate a GRUB menu.  Amazon's pv-grub uses this to boot our kernel/initrd.
+        and be used when switching to a new configuration.
-  boot.loader.grub.device = "/dev/sda";
+        If set to `null`, a default configuration is used, where the only import is
-  boot.loader.timeout = 0;
+        `<nixpkgs/nixos/modules/virtualisation/google-compute-image.nix>`.
-
+      '';
-  # Don't put old configurations in the GRUB menu.  The user has no
-  # way to select them anyway.
-  boot.loader.grub.configurationLimit = 0;
-
-  # Allow root logins only using the SSH key that the user specified
-  # at instance creation time.
-  services.openssh.enable = true;
-  services.openssh.permitRootLogin = "prohibit-password";
-  services.openssh.passwordAuthentication = mkDefault false;
-
-  # Use GCE udev rules for dynamic disk volumes
-  services.udev.packages = [ gce ];
-
-  # Force getting the hostname from Google Compute.
-  networking.hostName = mkDefault "";
-
-  # Always include cryptsetup so that NixOps can use it.
-  environment.systemPackages = [ pkgs.cryptsetup ];
-
-  # Make sure GCE image does not replace host key that NixOps sets
-  environment.etc."default/instance_configs.cfg".text = lib.mkDefault ''
-    [InstanceSetup]
-    set_host_keys = false
-  '';
-
-  # Rely on GCP's firewall instead
-  networking.firewall.enable = mkDefault false;
-
-  # Configure default metadata hostnames
-  networking.extraHosts = ''
-    169.254.169.254 metadata.google.internal metadata
-  '';
-
-  networking.timeServers = [ "metadata.google.internal" ];
-
-  networking.usePredictableInterfaceNames = false;
-
-  # GC has 1460 MTU
-  networking.interfaces.eth0.mtu = 1460;
-
-  # allow the google-accounts-daemon to manage users
-  users.mutableUsers = true;
-  # and allow users to sudo without password
-  security.sudo.enable = true;
-  security.sudo.extraConfig = ''
-  %google-sudoers ALL=(ALL:ALL) NOPASSWD:ALL
-  '';
-
-  # NOTE: google-accounts tries to write to /etc/sudoers.d but the folder doesn't exist
-  # FIXME: not such file or directory on dynamic SSH provisioning
-  systemd.services.google-accounts-daemon = {
-    description = "Google Compute Engine Accounts Daemon";
-    # This daemon creates dynamic users
-    enable = config.users.mutableUsers;
-    after = [
-      "network.target"
-      "google-instance-setup.service"
-      "google-network-setup.service"
-    ];
-    requires = ["network.target"];
-    wantedBy = ["multi-user.target"];
-    path = with pkgs; [ shadow ];
-    serviceConfig = {
-      Type = "simple";
-      ExecStart = "${gce}/bin/google_accounts_daemon --debug";
     };
   };
 
-  systemd.services.google-clock-skew-daemon = {
+  #### implementation
-    description = "Google Compute Engine Clock Skew Daemon";
+  config = {
-    after = [
+
-      "network.target"
+    system.build.googleComputeImage = import ../../lib/make-disk-image.nix {
-      "google-instance-setup.service"
+      name = "google-compute-image";
-      "google-network-setup.service"
+      postVM = ''
-    ];
+        PATH=$PATH:${with pkgs; stdenv.lib.makeBinPath [ gnutar gzip ]}
-    requires = ["network.target"];
+        pushd $out
-    wantedBy = ["multi-user.target"];
+        mv $diskImage disk.raw
-    serviceConfig = {
+        tar -Szcf nixos-image-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}.raw.tar.gz disk.raw
-      Type = "simple";
+        rm $out/disk.raw
-      ExecStart = "${gce}/bin/google_clock_skew_daemon --debug";
+        popd
+      '';
+      format = "raw";
+      configFile = if isNull cfg.configFile then defaultConfigFile else cfg.configFile;
+      inherit (cfg) diskSize;
+      inherit config lib pkgs;
     };
-  };
-
-  systemd.services.google-instance-setup = {
-    description = "Google Compute Engine Instance Setup";
-    after = ["local-fs.target" "network-online.target" "network.target" "rsyslog.service"];
-    before = ["sshd.service"];
-    wants = ["local-fs.target" "network-online.target" "network.target"];
-    wantedBy = [ "sshd.service" "multi-user.target" ];
-    path = with pkgs; [ ethtool openssh ];
-    serviceConfig = {
-      ExecStart = "${gce}/bin/google_instance_setup --debug";
-      Type = "oneshot";
-    };
-  };
-
-  systemd.services.google-network-daemon = {
-    description = "Google Compute Engine Network Daemon";
-    after = ["local-fs.target" "network-online.target" "network.target" "rsyslog.service" "google-instance-setup.service"];
-    wants = ["local-fs.target" "network-online.target" "network.target"];
-    requires = ["network.target"];
-    partOf = ["network.target"];
-    wantedBy = [ "multi-user.target" ];
-    path = with pkgs; [ iproute ];
-    serviceConfig = {
-      ExecStart = "${gce}/bin/google_network_daemon --debug";
-    };
-  };
-
-  systemd.services.google-shutdown-scripts = {
-    description = "Google Compute Engine Shutdown Scripts";
-    after = [
-      "local-fs.target"
-      "network-online.target"
-      "network.target"
-      "rsyslog.service"
-      "systemd-resolved.service"
-      "google-instance-setup.service"
-      "google-network-daemon.service"
-    ];
-    wants = [ "local-fs.target" "network-online.target" "network.target"];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      ExecStart = "${pkgs.coreutils}/bin/true";
-      ExecStop = "${gce}/bin/google_metadata_script_runner --debug --script-type shutdown";
-      Type = "oneshot";
-      RemainAfterExit = true;
-      TimeoutStopSec = "infinity";
-    };
-  };
-
-  systemd.services.google-startup-scripts = {
-    description = "Google Compute Engine Startup Scripts";
-    after = [
-      "local-fs.target"
-      "network-online.target"
-      "network.target"
-      "rsyslog.service"
-      "google-instance-setup.service"
-      "google-network-daemon.service"
-    ];
-    wants = ["local-fs.target" "network-online.target" "network.target"];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      ExecStart = "${gce}/bin/google_metadata_script_runner --debug --script-type startup";
-      KillMode = "process";
-      Type = "oneshot";
-    };
-  };
-
-  # TODO: remove this
-  systemd.services.fetch-ssh-keys =
-    { description = "Fetch host keys and authorized_keys for root user";
-
-      wantedBy = [ "sshd.service" ];
-      before = [ "sshd.service" ];
-      after = [ "network-online.target" ];
-      wants = [ "network-online.target" ];
-
-      script = let wget = "${pkgs.wget}/bin/wget --retry-connrefused -t 15 --waitretry=10 --header='Metadata-Flavor: Google'";
-                   mktemp = "mktemp --tmpdir=/run"; in
-        ''
-          # When dealing with cryptographic keys, we want to keep things private.
-          umask 077
-          # Don't download the SSH key if it has already been downloaded
-          echo "Obtaining SSH keys..."
-          mkdir -m 0700 -p /root/.ssh
-          AUTH_KEYS=$(${mktemp})
-          ${wget} -O $AUTH_KEYS http://metadata.google.internal/computeMetadata/v1/instance/attributes/sshKeys
-          if [ -s $AUTH_KEYS ]; then
-
-            # Read in key one by one, split in case Google decided
-            # to append metadata (it does sometimes) and add to
-            # authorized_keys if not already present.
-            touch /root/.ssh/authorized_keys
-            NEW_KEYS=$(${mktemp})
-            # Yes this is a nix escape of two single quotes.
-            while IFS=''' read -r line || [[ -n "$line" ]]; do
-              keyLine=$(echo -n "$line" | cut -d ':' -f2)
-              IFS=' ' read -r -a array <<< "$keyLine"
-              if [ ''${#array[@]} -ge 3 ]; then
-                echo ''${array[@]:0:3} >> $NEW_KEYS
-                echo "Added ''${array[@]:2} to authorized_keys"
-              fi
-            done < $AUTH_KEYS
-            mv $NEW_KEYS /root/.ssh/authorized_keys
-            chmod 600 /root/.ssh/authorized_keys
-            rm -f $KEY_PUB
-          else
-            echo "Downloading http://metadata.google.internal/computeMetadata/v1/project/attributes/sshKeys failed."
-            false
-          fi
-          rm -f $AUTH_KEYS
-          SSH_HOST_KEYS_DIR=$(${mktemp} -d)
-          ${wget} -O $SSH_HOST_KEYS_DIR/ssh_host_ed25519_key http://metadata.google.internal/computeMetadata/v1/instance/attributes/ssh_host_ed25519_key
-          ${wget} -O $SSH_HOST_KEYS_DIR/ssh_host_ed25519_key.pub http://metadata.google.internal/computeMetadata/v1/instance/attributes/ssh_host_ed25519_key_pub
-          if [ -s $SSH_HOST_KEYS_DIR/ssh_host_ed25519_key -a -s $SSH_HOST_KEYS_DIR/ssh_host_ed25519_key.pub ]; then
-              mv -f $SSH_HOST_KEYS_DIR/ssh_host_ed25519_key* /etc/ssh/
-              chmod 600 /etc/ssh/ssh_host_ed25519_key
-              chmod 644 /etc/ssh/ssh_host_ed25519_key.pub
-          else
-              echo "Setup of ssh host keys from http://metadata.google.internal/computeMetadata/v1/instance/attributes/ failed."
-              false
-          fi
-          rm -rf $SSH_HOST_KEYS_DIR
-        '';
-      serviceConfig.Type = "oneshot";
-      serviceConfig.RemainAfterExit = true;
-      serviceConfig.StandardError = "journal+console";
-      serviceConfig.StandardOutput = "journal+console";
-    };
-
-  # Settings taken from https://github.com/GoogleCloudPlatform/compute-image-packages/blob/master/google_config/sysctl/11-gce-network-security.conf
-  boot.kernel.sysctl = {
-    # Turn on SYN-flood protections.  Starting with 2.6.26, there is no loss
-    # of TCP functionality/features under normal conditions.  When flood
-    # protections kick in under high unanswered-SYN load, the system
-    # should remain more stable, with a trade off of some loss of TCP
-    # functionality/features (e.g. TCP Window scaling).
-    "net.ipv4.tcp_syncookies" = mkDefault "1";
-
-    # ignores source-routed packets
-    "net.ipv4.conf.all.accept_source_route" = mkDefault "0";
-
-    # ignores source-routed packets
-    "net.ipv4.conf.default.accept_source_route" = mkDefault "0";
-
-    # ignores ICMP redirects
-    "net.ipv4.conf.all.accept_redirects" = mkDefault "0";
-
-    # ignores ICMP redirects
-    "net.ipv4.conf.default.accept_redirects" = mkDefault "0";
-
-    # ignores ICMP redirects from non-GW hosts
-    "net.ipv4.conf.all.secure_redirects" = mkDefault "1";
-
-    # ignores ICMP redirects from non-GW hosts
-    "net.ipv4.conf.default.secure_redirects" = mkDefault "1";
-
-    # don't allow traffic between networks or act as a router
-    "net.ipv4.ip_forward" = mkDefault "0";
-
-    # don't allow traffic between networks or act as a router
-    "net.ipv4.conf.all.send_redirects" = mkDefault "0";
-
-    # don't allow traffic between networks or act as a router
-    "net.ipv4.conf.default.send_redirects" = mkDefault "0";
-
-    # reverse path filtering - IP spoofing protection
-    "net.ipv4.conf.all.rp_filter" = mkDefault "1";
-
-    # reverse path filtering - IP spoofing protection
-    "net.ipv4.conf.default.rp_filter" = mkDefault "1";
-
-    # ignores ICMP broadcasts to avoid participating in Smurf attacks
-    "net.ipv4.icmp_echo_ignore_broadcasts" = mkDefault "1";
-
-    # ignores bad ICMP errors
-    "net.ipv4.icmp_ignore_bogus_error_responses" = mkDefault "1";
-
-    # logs spoofed, source-routed, and redirect packets
-    "net.ipv4.conf.all.log_martians" = mkDefault "1";
-
-    # log spoofed, source-routed, and redirect packets
-    "net.ipv4.conf.default.log_martians" = mkDefault "1";
-
-    # implements RFC 1337 fix
-    "net.ipv4.tcp_rfc1337" = mkDefault "1";
-
-    # randomizes addresses of mmap base, heap, stack and VDSO page
-    "kernel.randomize_va_space" = mkDefault "2";
-
-    # Reboot the machine soon after a kernel panic.
-    "kernel.panic" = mkDefault "10";
-
-    ## Not part of the original config
-
-    # provides protection from ToCToU races
-    "fs.protected_hardlinks" = mkDefault "1";
-
-    # provides protection from ToCToU races
-    "fs.protected_symlinks" = mkDefault "1";
-
-    # makes locating kernel addresses more difficult
-    "kernel.kptr_restrict" = mkDefault "1";
-
-    # set ptrace protections
-    "kernel.yama.ptrace_scope" = mkOverride 500 "1";
-
-    # set perf only available to root
-    "kernel.perf_event_paranoid" = mkDefault "2";
 
   };
 

nixos/tests/gitlab.nix

@@ -16,6 +16,7 @@ import ./make-test.nix ({ pkgs, lib, ...} : with lib; {
 
       services.nginx = {
         enable = true;
+        recommendedProxySettings = true;
         virtualHosts = {
           "localhost" = {
             locations."/".proxyPass = "http://unix:/run/gitlab/gitlab-workhorse.socket";
@@ -75,7 +76,8 @@ import ./make-test.nix ({ pkgs, lib, ...} : with lib; {
     $gitlab->waitForUnit("gitlab.service");
     $gitlab->waitForUnit("gitlab-sidekiq.service");
     $gitlab->waitForFile("/var/gitlab/state/tmp/sockets/gitlab.socket");
-    $gitlab->waitUntilSucceeds("curl -sSf http://localhost/users/sign_in");
+    $gitlab->waitUntilSucceeds("curl -sSf http://gitlab/users/sign_in");
+    $gitlab->succeed("curl -isSf http://gitlab  | grep -i location | grep -q http://gitlab/users/sign_in");
     $gitlab->succeed("${pkgs.sudo}/bin/sudo -u gitlab -H gitlab-rake gitlab:check 1>&2")
   '';
 })

nixos/tests/rspamd.nix

@@ -235,6 +235,7 @@ in
       services.rspamd = {
         enable = true;
         postfix.enable = true;
+        workers.rspamd_proxy.type = "proxy";
       };
     };
     testScript = ''

pkgs/applications/audio/cadence/default.nix

@@ -1,5 +1,5 @@
 { stdenv
-, fetchurl
+, fetchzip
 , pkgconfig
 , qtbase
 , makeWrapper
@@ -12,31 +12,13 @@
   version = "0.9.0";
   name = "cadence";
 
-  src = fetchurl {
+  src = fetchzip {
     url = "https://github.com/falkTX/Cadence/archive/v${version}.tar.gz";
-    sha256 = "07z1mnb0bmldb3i31bgw816pnvlvr9gawr51rpx3mhixg5wpiqzb";
+    sha256 = "08vcggypkdfr70v49innahs5s11hi222dhhnm5wcqzdgksphqzwx";
   };
 
-  buildInputs = [
+  nativeBuildInputs = [ makeWrapper pkgconfig ];
-    makeWrapper
+  buildInputs = [ qtbase ];
-    pkgconfig
-    qtbase
-  ];
-
-  apps = [
-    "cadence"
-    "cadence-jacksettings"
-    "cadence-pulse2loopback"
-    "claudia"
-    "cadence-aloop-daemon"
-    "cadence-logs"
-    "cadence-render"
-    "catarina"
-    "claudia-launcher"
-    "cadence-pulse2jack"
-    "cadence-session-start"
-    "catia"
-  ];
 
   makeFlags = ''
     PREFIX=""
@@ -46,20 +28,54 @@
   propagatedBuildInputs = with python3Packages; [ pyqt5 ];
 
   postInstall = ''
-    # replace with our own wrappers.
+    # replace with our own wrappers. They need to be changed manually since it wouldn't work otherwise
-    for app in $apps; do
+    rm $out/bin/cadence
-      rm $out/bin/$app
+    makeWrapper ${python3Packages.python.interpreter} $out/bin/cadence \
-      makeWrapper ${python3Packages.python.interpreter} $out/bin/$app \
+      --set PYTHONPATH "$PYTHONPATH:$out/share/cadence" \
-        --set PYTHONPATH "$PYTHONPATH:$out/share/cadence" \
+      --add-flags "-O $out/share/cadence/src/cadence.py"
-        --add-flags "-O $out/share/cadence/src/$app.py"
+    rm $out/bin/claudia
-    done
+    makeWrapper ${python3Packages.python.interpreter} $out/bin/claudia \
+      --set PYTHONPATH "$PYTHONPATH:$out/share/cadence" \
+      --add-flags "-O $out/share/cadence/src/claudia.py"
+    rm $out/bin/catarina
+    makeWrapper ${python3Packages.python.interpreter} $out/bin/catarina \
+      --set PYTHONPATH "$PYTHONPATH:$out/share/cadence" \
+      --add-flags "-O $out/share/cadence/src/catarina.py"
+    rm $out/bin/catia
+    makeWrapper ${python3Packages.python.interpreter} $out/bin/catia \
+      --set PYTHONPATH "$PYTHONPATH:$out/share/cadence" \
+      --add-flags "-O $out/share/cadence/src/catia.py"
+    rm $out/bin/cadence-jacksettings
+    makeWrapper ${python3Packages.python.interpreter} $out/bin/cadence-jacksettings \
+      --set PYTHONPATH "$PYTHONPATH:$out/share/cadence" \
+      --add-flags "-O $out/share/cadence/src/jacksettings.py"
+    rm $out/bin/cadence-aloop-daemon
+    makeWrapper ${python3Packages.python.interpreter} $out/bin/cadence-aloop-daemon \
+      --set PYTHONPATH "$PYTHONPATH:$out/share/cadence" \
+      --add-flags "-O $out/share/cadence/src/cadence_aloop_daemon.py"
+    rm $out/bin/cadence-logs
+    makeWrapper ${python3Packages.python.interpreter} $out/bin/cadence-logs \
+      --set PYTHONPATH "$PYTHONPATH:$out/share/cadence" \
+      --add-flags "-O $out/share/cadence/src/logs.py"
+    rm $out/bin/cadence-render
+    makeWrapper ${python3Packages.python.interpreter} $out/bin/cadence-render \
+      --set PYTHONPATH "$PYTHONPATH:$out/share/cadence" \
+      --add-flags "-O $out/share/cadence/src/render.py"
+    rm $out/bin/claudia-launcher
+    makeWrapper ${python3Packages.python.interpreter} $out/bin/claudia-launcher \
+      --set PYTHONPATH "$PYTHONPATH:$out/share/cadence" \
+      --add-flags "-O $out/share/cadence/src/claudia_launcher.py"
+    rm $out/bin/cadence-session-start
+    makeWrapper ${python3Packages.python.interpreter} $out/bin/cadence-session-start \
+      --set PYTHONPATH "$PYTHONPATH:$out/share/cadence" \
+      --add-flags "-O $out/share/cadence/src/cadence_session_start.py"
   '';
 
   meta = {
     homepage = https://github.com/falkTX/Cadence/;
     description = "Collection of tools useful for audio production";
-    license = stdenv.lib.licenses.mit;
+    license = stdenv.lib.licenses.gpl2Plus;
     maintainers = with stdenv.lib.maintainers; [ genesis ];
-    platforms = stdenv.lib.platforms.linux;
+    platforms = [ "x86_64-linux" ];
   };
 }

pkgs/applications/kde/dolphin.nix

@@ -4,7 +4,8 @@
   baloo, baloo-widgets, kactivities, kbookmarks, kcmutils,
   kcompletion, kconfig, kcoreaddons, kdelibs4support, kdbusaddons,
   kfilemetadata, ki18n, kiconthemes, kinit, kio, knewstuff, knotifications,
-  kparts, ktexteditor, kwindowsystem, phonon, solid
+  kparts, ktexteditor, kwindowsystem, phonon, solid,
+  wayland, qtwayland
 }:
 
 mkDerivation {
@@ -19,6 +20,7 @@ mkDerivation {
     kcoreaddons kdelibs4support kdbusaddons kfilemetadata ki18n kiconthemes
     kinit kio knewstuff knotifications kparts ktexteditor kwindowsystem
     phonon solid
+    wayland qtwayland
   ];
   outputs = [ "out" "dev" ];
   # We need the RPATH for linking, because the `libkdeinit5_dolphin.so` links

pkgs/applications/misc/tilda/default.nix

@@ -1,6 +1,6 @@
-{ stdenv, fetchurl, pkgconfig
+{ stdenv, fetchzip, pkgconfig
 , autoreconfHook, gettext, expat
-, confuse, vte, gtk
+, libconfuse, vte, gtk
 , makeWrapper }:
 
 stdenv.mkDerivation rec {
@@ -8,13 +8,13 @@ stdenv.mkDerivation rec {
   name = "tilda-${version}";
   version = "1.4.1";
 
-  src = fetchurl {
+  src = fetchzip {
     url = "https://github.com/lanoxx/tilda/archive/${name}.tar.gz";
-    sha256 = "0w2hry2bqcqrkik4l100b1a9jlsih6sq8zwhfpl8zzfq20i00lfs";
+    sha256 = "154rsldqjv2m1bddisb930qicb0y35kx7bxq392n2hn68jr2pxkj";
   };
 
-  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  nativeBuildInputs = [ autoreconfHook makeWrapper pkgconfig ];
-  buildInputs = [ gettext confuse vte gtk makeWrapper ];
+  buildInputs = [ gettext libconfuse vte gtk ];
 
   LD_LIBRARY_PATH = "${expat.out}/lib"; # ugly hack for xgettext to work during build
 

pkgs/applications/networking/browsers/lynx/default.nix

@@ -8,14 +8,14 @@ assert sslSupport -> openssl != null;
 
 stdenv.mkDerivation rec {
   name = "lynx-${version}";
-  version = "2.8.9dev.17";
+  version = "2.8.9rel.1";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.invisible-island.net/lynx/tarballs/lynx${version}.tar.bz2"
       "https://invisible-mirror.net/archives/lynx/tarballs/lynx${version}.tar.bz2"
     ];
-    sha256 = "1lvfsnrw5mmwrmn1m76q9mx287xwm3h5lg8sv7bcqilc0ywi2f54";
+    sha256 = "15cmyyma2kz1hfaa6mwjgli8zwdzq3jv0q2cl6nwzycjfwyijzrq";
   };
 
   enableParallelBuilding = true;

pkgs/applications/networking/cluster/stern/default.nix

@@ -1,4 +1,6 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ stdenv, lib, buildPackages, buildGoPackage, fetchFromGitHub }:
+
+let isCrossBuild = stdenv.hostPlatform != stdenv.buildPlatform; in
 
 buildGoPackage rec {
   name = "stern-${version}";
@@ -15,11 +17,20 @@ buildGoPackage rec {
 
   goDeps = ./deps.nix;
 
-   meta = with lib; {
+  postInstall =
-      description      = "Multi pod and container log tailing for Kubernetes";
+    let stern = if isCrossBuild then buildPackages.stern else "$bin"; in
-      homepage         = "https://github.com/wercker/stern";
+    ''
-      license          = licenses.asl20;
+      mkdir -p $bin/share/bash-completion/completions
-      maintainers      = with maintainers; [ mbode ];
+      ${stern}/bin/stern --completion bash > $bin/share/bash-completion/completions/stern
-      platforms        = platforms.unix;
+      mkdir -p $bin/share/zsh/site-functions
-    };
+      ${stern}/bin/stern --completion zsh > $bin/share/zsh/site-functions/_stern
+    '';
+
+  meta = with lib; {
+    description      = "Multi pod and container log tailing for Kubernetes";
+    homepage         = "https://github.com/wercker/stern";
+    license          = licenses.asl20;
+    maintainers      = with maintainers; [ mbode ];
+    platforms        = platforms.unix;
+  };
 }

pkgs/applications/networking/cluster/terragrunt/default.nix

@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "terragrunt-${version}";
-  version = "0.17.2";
+  version = "0.17.3";
 
   goPackagePath = "github.com/gruntwork-io/terragrunt";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     owner  = "gruntwork-io";
     repo   = "terragrunt";
     rev    = "v${version}";
-    sha256 = "069l9ynyl96rfs9zw6w6n1yzjjin27731nj1ajr9jsyc8rhd84wv";
+    sha256 = "1b0fwql9nr00qpvcbsbdymxf1wrgr590gkms7yz3yirb4xfl3gl3";
   };
 
   goDeps = ./deps.nix;

pkgs/applications/networking/instant-messengers/dino/default.nix

@@ -10,16 +10,17 @@
 , dbus
 , gpgme
 , pcre
+, qrencode
  }:
 
 stdenv.mkDerivation rec {
-  name = "dino-unstable-2018-09-21";
+  name = "dino-unstable-2018-11-27";
 
   src = fetchFromGitHub {
     owner = "dino";
     repo = "dino";
-    rev = "6b7ef800f54e781a618425236ba8d4ed2f2fef9c";
+    rev = "141db9e40a3a81cfa3ad3587dc47f69c541d0fde";
-    sha256 = "1si815b6y06lridj88hws0dgq54w9jfam9sqbrq3cfcvmhc38ysk";
+    sha256 = "006r1x7drlz39jjxlfdnxgrnambw9amhl9jcgf6p1dx71h1x8221";
     fetchSubmodules = true;
   };
 
@@ -32,6 +33,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
+    qrencode
     gobjectIntrospection
     glib-networking
     glib

pkgs/applications/science/biology/picard-tools/default.nix

@@ -2,14 +2,15 @@
 
 stdenv.mkDerivation rec {
   name = "picard-tools-${version}";
-  version = "2.18.14";
+  version = "2.18.17";
 
   src = fetchurl {
     url = "https://github.com/broadinstitute/picard/releases/download/${version}/picard.jar";
-    sha256 = "0xc5mqifav2j4zbln04q07wjlzpwp3w0y5iv5bkp4v5486cp2ha9";
+    sha256 = "0ks7ymrjfya5h77hp0bqyipzdri0kf97c8wks32nvwkj821687zm";
   };
 
-  buildInputs = [ jre makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre ];
 
   phases = [ "installPhase" ];
 
@@ -21,7 +22,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    description = "Tools for high-throughput sequencing (HTS) data and formats such as SAM/BAM/CRAM and VCF.";
+    description = "Tools for high-throughput sequencing (HTS) data and formats such as SAM/BAM/CRAM and VCF";
     license = licenses.mit;
     homepage = https://broadinstitute.github.io/picard/;
     maintainers = with maintainers; [ jbedo ];

pkgs/applications/science/math/sage/default.nix

@@ -110,6 +110,7 @@ let
     sympy
     fpylll
     matplotlib
+    tkinter # optional, as a matplotlib backend (use with `%matplotlib tk`)
     scipy
     ipywidgets
     rpy2

pkgs/applications/science/physics/quantomatic/default.nix

@@ -0,0 +1,31 @@
+{ stdenv, fetchurl, jre, makeWrapper }:
+
+stdenv.mkDerivation rec {
+  name = "quantomatic-${version}";
+  version = "0.7";
+
+  src = fetchurl {
+    url = "https://github.com/Quantomatic/quantomatic/releases/download/v${version}/Quantomatic-v${version}.jar";
+    sha256 = "04dd5p73a7plb4l4x2balam8j7mxs8df06rjkalxycrr1id52q4r";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre ];
+
+  phases = [ "installPhase" ];
+
+  installPhase = ''
+    mkdir -p $out/libexec/quantomatic
+    cp $src $out/libexec/quantomatic/quantomatic.jar
+    mkdir -p $out/bin
+    makeWrapper ${jre}/bin/java $out/bin/quantomatic --add-flags "-jar $out/libexec/quantomatic/quantomatic.jar"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A piece of software for reasoning about monoidal theories; in particular, quantum information processing";
+    license = licenses.gpl3;
+    homepage = https://quantomatic.github.io/;
+    maintainers = with maintainers; [ nickhu ];
+    platforms = platforms.all;
+  };
+}

pkgs/applications/version-management/gitlab-shell/remove-hardcoded-locations.patch

@@ -1,27 +0,0 @@
-diff --git a/go/internal/config/config.go b/go/internal/config/config.go
-index c57b4de..88cfc95 100644
---- a/go/internal/config/config.go
-+++ b/go/internal/config/config.go
-@@ -27,7 +27,7 @@ func New() (*Config, error) {
- 	}
- 	cfg.RootDir = dir
- 
--	configBytes, err := ioutil.ReadFile(path.Join(cfg.RootDir, configFile))
-+	configBytes, err := ioutil.ReadFile("/run/gitlab/shell-config.yml")
- 	if err != nil {
- 		return nil, err
- 	}
-diff --git a/lib/gitlab_shell.rb b/lib/gitlab_shell.rb
-index 1452f95..2b40327 100644
---- a/lib/gitlab_shell.rb
-+++ b/lib/gitlab_shell.rb
-@@ -180,7 +180,8 @@ class GitlabShell
-     end
- 
-     # We use 'chdir: ROOT_PATH' to let the next executable know where config.yml is.
--    Kernel.exec(env, *args, unsetenv_others: true, chdir: ROOT_PATH)
-+    # Except we don't, because we're already in the right directory on nixos!
-+    Kernel.exec(env, *args, unsetenv_others: true)
-   end
- 
-   def api

pkgs/applications/version-management/gitlab-workhorse/deterministic-build.patch

@@ -1,11 +0,0 @@
---- a/Makefile	2018-10-08 12:45:15.206269937 +0200
-+++ b/Makefile	2018-10-08 12:45:24.435366307 +0200
-@@ -6,7 +6,7 @@
- BIN_BUILD_DIR := $(TARGET_DIR)/bin
- PKG_BUILD_DIR := $(TARGET_DIR)/src/$(PKG)
- COVERAGE_DIR := $(TARGET_DIR)/cover
--VERSION := $(shell git describe)-$(shell date -u +%Y%m%d.%H%M%S)
-+VERSION := 6.1.1
- GOBUILD := go build -ldflags "-X main.Version=$(VERSION)"
- EXE_ALL := gitlab-zip-cat gitlab-zip-metadata gitlab-workhorse
- INSTALL := install

pkgs/applications/version-management/gitlab/data.json

@@ -0,0 +1,32 @@
+{
+  "ce": {
+    "version": "11.5.0",
+    "repo_hash": "0cjkkap3n9g9zahrxk99a330ahyb6cvx97dsnrxcdsn0cbrsxsrb",
+    "deb_hash": "0kn7mg1lk4gvc3x76z4rbh0j03b0wk6x1p5938wx8sc50k0bgrcp",
+    "deb_url": "https://packages.gitlab.com/gitlab/gitlab-ce/packages/debian/stretch/gitlab-ce_11.5.0-ce.0_amd64.deb/download.deb",
+    "owner": "gitlab-org",
+    "repo": "gitlab-ce",
+    "rev": "v11.5.0",
+    "passthru": {
+      "GITALY_SERVER_VERSION": "0.129.0",
+      "GITLAB_PAGES_VERSION": "1.3.0",
+      "GITLAB_SHELL_VERSION": "8.4.1",
+      "GITLAB_WORKHORSE_VERSION": "7.1.0"
+    }
+  },
+  "ee": {
+    "version": "11.5.0",
+    "repo_hash": "1s2jr7vhbpklpcfjxgxnmq0zq14hh2aa6akdsb7ld7fj5lmzp00z",
+    "deb_hash": "108mgmlf947h200qrwg71ilhq5ihr4awxns6lqs2wa90ph9yq25c",
+    "deb_url": "https://packages.gitlab.com/gitlab/gitlab-ee/packages/debian/stretch/gitlab-ee_11.5.0-ee.0_amd64.deb/download.deb",
+    "owner": "gitlab-org",
+    "repo": "gitlab-ee",
+    "rev": "v11.5.0-ee",
+    "passthru": {
+      "GITALY_SERVER_VERSION": "0.129.0",
+      "GITLAB_PAGES_VERSION": "1.3.0",
+      "GITLAB_SHELL_VERSION": "8.4.1",
+      "GITLAB_WORKHORSE_VERSION": "7.1.0"
+    }
+  }
+}

pkgs/applications/version-management/gitlab/default.nix

@@ -11,32 +11,22 @@ let
     groups = [ "default" "unicorn" "ed25519" "metrics" ];
   };
 
-  version = "11.4.4";
+  flavour = if gitlabEnterprise then "ee" else "ce";
+  data = (builtins.fromJSON (builtins.readFile ./data.json)).${flavour};
 
-  sources = if gitlabEnterprise then {
+  version = data.version;
-    gitlabDeb = fetchurl {
+  sources = {
-      url = "https://packages.gitlab.com/gitlab/gitlab-ee/packages/debian/stretch/gitlab-ee_${version}-ee.0_amd64.deb/download.deb";
-      sha256 = "15lpcdjcw6lpmzlhqnpd6pgaxh7wvx2mldjd1vqr414r4bcnhgy4";
-    };
     gitlab = fetchFromGitLab {
-      owner = "gitlab-org";
+      owner = data.owner;
-      repo = "gitlab-ee";
+      repo = data.repo;
-      rev = "v${version}-ee";
+      rev = data.rev;
-      sha256 = "046hchr7q4jnx3j4yxg3rdixfzlva35al3ci26pf9vxrbbl5y8cg";
+      sha256 = data.repo_hash;
     };
-  } else {
     gitlabDeb = fetchurl {
-      url = "https://packages.gitlab.com/gitlab/gitlab-ce/packages/debian/stretch/gitlab-ce_${version}-ce.0_amd64.deb/download.deb";
+      url = data.deb_url;
-      sha256 = "02p7azyjgb984bk491q6f4zk1mikbcd38rif08kl07bjjzzkir81";
+      sha256 = data.deb_hash;
-    };
-    gitlab = fetchFromGitLab {
-      owner = "gitlab-org";
-      repo = "gitlab-ce";
-      rev = "v${version}";
-      sha256 = "1hq9iyp0xrxwmncn61ja3pdj9h2hmdy1l63d1ic3r1dyacybaf2g";
     };
   };
-
 in
 
 stdenv.mkDerivation rec {
@@ -101,6 +91,10 @@ stdenv.mkDerivation rec {
   passthru = {
     inherit rubyEnv;
     ruby = rubyEnv.wrappedRuby;
+    GITALY_SERVER_VERSION = data.passthru.GITALY_SERVER_VERSION;
+    GITLAB_PAGES_VERSION = data.passthru.GITLAB_PAGES_VERSION;
+    GITLAB_SHELL_VERSION = data.passthru.GITLAB_SHELL_VERSION;
+    GITLAB_WORKHORSE_VERSION = data.passthru.GITLAB_WORKHORSE_VERSION;
   };
 
   meta = with lib; {

pkgs/applications/version-management/gitlab/gitaly/Gemfile

@@ -1,14 +1,17 @@
 source 'https://rubygems.org'
 
-gem 'rugged', '~> 0.27.4'
+# Require bundler >= 1.16.5 to avoid this bug: https://github.com/bundler/bundler/issues/6537
+gem 'bundler', '>= 1.16.5'
+
+gem 'rugged', '~> 0.27'
 gem 'github-linguist', '~> 6.1', require: 'linguist'
 gem 'gitlab-markup', '~> 1.6.4'
-gem 'gitaly-proto', '~> 0.116.0', require: 'gitaly'
+gem 'gitaly-proto', '~> 0.123.0', require: 'gitaly'
 gem 'activesupport', '~> 5.0.2'
 gem 'rdoc', '~> 4.2'
 gem 'gitlab-gollum-lib', '~> 4.2', require: false
 gem 'gitlab-gollum-rugged_adapter', '~> 0.4.4', require: false
-gem 'grpc', '~> 1.11.0'
+gem 'grpc', '~> 1.15.0'
 gem 'sentry-raven', '~> 2.7.2', require: false
 gem 'faraday', '~> 0.12'
 
@@ -16,10 +19,12 @@ gem 'faraday', '~> 0.12'
 # This version needs to be in sync with GitLab CE/EE
 gem 'licensee', '~> 8.9.0'
 
-# Locked until https://github.com/google/protobuf/issues/4210 is closed
+gem 'google-protobuf', '~> 3.6'
-gem 'google-protobuf', '= 3.5.1'
 
 group :development, :test do
-  gem 'gitlab-styles', '~> 2.0.0', require: false
+  gem 'rubocop', '~> 0.50', require: false
   gem 'rspec', require: false
+  gem 'rspec-parameterized', require: false
+  gem 'timecop', require: false
+  gem 'factory_bot', require: false
 end

pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock

@@ -1,26 +1,37 @@
 GEM
   remote: https://rubygems.org/
   specs:
+    abstract_type (0.0.7)
     activesupport (5.0.6)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (~> 0.7)
       minitest (~> 5.1)
       tzinfo (~> 1.1)
-    addressable (2.5.2)
+    adamantium (0.2.0)
-      public_suffix (>= 2.0.2, < 4.0)
+      ice_nine (~> 0.11.0)
-    ast (2.3.0)
+      memoizable (~> 0.4.0)
+    ast (2.4.0)
+    binding_of_caller (0.8.0)
+      debug_inspector (>= 0.0.1)
     charlock_holmes (0.7.6)
+    coderay (1.1.2)
+    concord (0.1.5)
+      adamantium (~> 0.2.0)
+      equalizer (~> 0.0.9)
     concurrent-ruby (1.0.5)
     crass (1.0.4)
+    debug_inspector (0.0.3)
     diff-lcs (1.3)
+    equalizer (0.0.11)
     escape_utils (1.2.1)
-    faraday (0.12.2)
+    factory_bot (4.11.1)
+      activesupport (>= 3.0.0)
+    faraday (0.15.3)
       multipart-post (>= 1.2, < 3)
     gemojione (3.3.0)
       json
-    gitaly-proto (0.116.0)
+    gitaly-proto (0.123.0)
-      google-protobuf (~> 3.1)
+      grpc (~> 1.0)
-      grpc (~> 1.10)
     github-linguist (6.2.0)
       charlock_holmes (~> 0.7.6)
       escape_utils (~> 1.2.0)
@@ -44,60 +55,44 @@ GEM
       mime-types (>= 1.16)
       posix-spawn (~> 0.3)
     gitlab-markup (1.6.4)
-    gitlab-styles (2.0.0)
-      rubocop (~> 0.49)
-      rubocop-gitlab-security (~> 0.1.0)
-      rubocop-rspec (~> 1.15)
     gollum-grit_adapter (1.0.1)
       gitlab-grit (~> 2.7, >= 2.7.1)
-    google-protobuf (3.5.1)
+    google-protobuf (3.6.1)
-    googleapis-common-protos-types (1.0.1)
+    googleapis-common-protos-types (1.0.2)
       google-protobuf (~> 3.0)
-    googleauth (0.6.2)
+    grpc (1.15.0)
-      faraday (~> 0.12)
-      jwt (>= 1.4, < 3.0)
-      logging (~> 2.0)
-      memoist (~> 0.12)
-      multi_json (~> 1.11)
-      os (~> 0.9)
-      signet (~> 0.7)
-    grpc (1.11.0)
       google-protobuf (~> 3.1)
       googleapis-common-protos-types (~> 1.0.0)
-      googleauth (>= 0.5.1, < 0.7)
     i18n (0.8.1)
+    ice_nine (0.11.2)
     json (2.1.0)
-    jwt (2.1.0)
     licensee (8.9.2)
       rugged (~> 0.24)
-    little-plugger (1.1.4)
+    memoizable (0.4.2)
-    logging (2.2.2)
+      thread_safe (~> 0.3, >= 0.3.1)
-      little-plugger (~> 1.1)
-      multi_json (~> 1.10)
-    memoist (0.16.0)
     mime-types (3.2.2)
       mime-types-data (~> 3.2015)
     mime-types-data (3.2018.0812)
     mini_portile2 (2.3.0)
     minitest (5.9.1)
-    multi_json (1.13.1)
     multipart-post (2.0.0)
     nokogiri (1.8.4)
       mini_portile2 (~> 2.3.0)
     nokogumbo (1.5.0)
       nokogiri
-    os (0.9.6)
+    parallel (1.12.1)
-    parallel (1.12.0)
+    parser (2.5.1.2)
-    parser (2.4.0.0)
+      ast (~> 2.4.0)
-      ast (~> 2.2)
     posix-spawn (0.3.13)
-    powerpack (0.1.1)
+    powerpack (0.1.2)
-    public_suffix (3.0.2)
+    proc_to_ast (0.1.0)
-    rainbow (2.2.2)
+      coderay
-      rake
+      parser
-    rake (12.1.0)
+      unparser
+    procto (0.0.3)
+    rainbow (3.0.0)
     rdoc (4.3.0)
-    rouge (3.2.1)
+    rouge (3.3.0)
     rspec (3.7.0)
       rspec-core (~> 3.7.0)
       rspec-expectations (~> 3.7.0)
@@ -110,56 +105,66 @@ GEM
     rspec-mocks (3.7.0)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.7.0)
+    rspec-parameterized (0.4.0)
+      binding_of_caller
+      parser
+      proc_to_ast
+      rspec (>= 2.13, < 4)
+      unparser
     rspec-support (3.7.1)
-    rubocop (0.50.0)
+    rubocop (0.54.0)
       parallel (~> 1.10)
-      parser (>= 2.3.3.1, < 3.0)
+      parser (>= 2.5)
       powerpack (~> 0.1)
-      rainbow (>= 2.2.2, < 3.0)
+      rainbow (>= 2.2.2, < 4.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (~> 1.0, >= 1.0.1)
-    rubocop-gitlab-security (0.1.0)
+    ruby-progressbar (1.10.0)
-      rubocop (>= 0.47.1)
+    rugged (0.27.5)
-    rubocop-rspec (1.17.0)
-      rubocop (>= 0.50.0)
-    ruby-progressbar (1.8.3)
-    rugged (0.27.4)
     sanitize (4.6.6)
       crass (~> 1.0.2)
       nokogiri (>= 1.4.4)
       nokogumbo (~> 1.4)
     sentry-raven (2.7.2)
       faraday (>= 0.7.6, < 1.0)
-    signet (0.8.1)
-      addressable (~> 2.3)
-      faraday (~> 0.9)
-      jwt (>= 1.5, < 3.0)
-      multi_json (~> 1.10)
     stringex (2.8.4)
     thread_safe (0.3.6)
+    timecop (0.9.1)
     tzinfo (1.2.2)
       thread_safe (~> 0.1)
-    unicode-display_width (1.3.0)
+    unicode-display_width (1.4.0)
+    unparser (0.2.8)
+      abstract_type (~> 0.0.7)
+      adamantium (~> 0.2.0)
+      concord (~> 0.1.5)
+      diff-lcs (~> 1.3)
+      equalizer (~> 0.0.9)
+      parser (>= 2.3.1.2, < 2.6)
+      procto (~> 0.0.2)
 
 PLATFORMS
   ruby
 
 DEPENDENCIES
   activesupport (~> 5.0.2)
+  bundler (>= 1.16.5)
+  factory_bot
   faraday (~> 0.12)
-  gitaly-proto (~> 0.116.0)
+  gitaly-proto (~> 0.123.0)
   github-linguist (~> 6.1)
   gitlab-gollum-lib (~> 4.2)
   gitlab-gollum-rugged_adapter (~> 0.4.4)
   gitlab-markup (~> 1.6.4)
-  gitlab-styles (~> 2.0.0)
+  google-protobuf (~> 3.6)
-  google-protobuf (= 3.5.1)
+  grpc (~> 1.15.0)
-  grpc (~> 1.11.0)
   licensee (~> 8.9.0)
   rdoc (~> 4.2)
   rspec
-  rugged (~> 0.27.4)
+  rspec-parameterized
+  rubocop (~> 0.50)
+  rugged (~> 0.27)
   sentry-raven (~> 2.7.2)
+  timecop
 
 BUNDLED WITH
-   1.16.4
+   1.17.1

pkgs/applications/version-management/gitlab/gitaly/default.nix

@@ -7,14 +7,14 @@ let
     gemdir = ./.;
   };
 in buildGoPackage rec {
-  version = "0.125.1";
+  version = "0.129.0";
   name = "gitaly-${version}";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitaly";
     rev = "v${version}";
-    sha256 = "0vbxjqjs1r5c350r67812andasby5zk25xlaqp201lmlvamiv0ni";
+    sha256 = "0lidqa0w0vy87p5xfmqrfvbyzvl9wj2p918qs2f5rc7shzm38rn6";
   };
 
   goPackagePath = "gitlab.com/gitlab-org/gitaly";

pkgs/applications/version-management/gitlab/gitaly/gemset.nix

@@ -1,4 +1,12 @@
 {
+  abstract_type = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "09330cmhrc2wmfhdj9zzg82sv6cdhm3qgdkva5ni5xfjril2pf14";
+      type = "gem";
+    };
+    version = "0.0.7";
+  };
   activesupport = {
     dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo"];
     source = {
@@ -8,22 +16,31 @@
     };
     version = "5.0.6";
   };
-  addressable = {
+  adamantium = {
-    dependencies = ["public_suffix"];
+    dependencies = ["ice_nine" "memoizable"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0viqszpkggqi8hq87pqp0xykhvz60g99nwmkwsb0v45kc2liwxvk";
+      sha256 = "0165r2ikgfwv2rm8dzyijkp74fvg0ni72hpdx8ay2v7cj08dqyak";
       type = "gem";
     };
-    version = "2.5.2";
+    version = "0.2.0";
   };
   ast = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0pp82blr5fakdk27d1d21xq9zchzb6vmyb1zcsl520s3ygvprn8m";
+      sha256 = "184ssy3w93nkajlz2c70ifm79jp3j737294kbc5fjw69v1w0n9x7";
       type = "gem";
     };
-    version = "2.3.0";
+    version = "2.4.0";
+  };
+  binding_of_caller = {
+    dependencies = ["debug_inspector"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "05syqlks7463zsy1jdfbbdravdhj9hpj5pv2m74blqpv8bq4vv5g";
+      type = "gem";
+    };
+    version = "0.8.0";
   };
   charlock_holmes = {
     source = {
@@ -33,6 +50,23 @@
     };
     version = "0.7.6";
   };
+  coderay = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "15vav4bhcc2x3jmi3izb11l4d9f3xv8hp2fszb7iqmpsccv1pz4y";
+      type = "gem";
+    };
+    version = "1.1.2";
+  };
+  concord = {
+    dependencies = ["adamantium" "equalizer"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1b6cdn0fg4n9gzbdr7zyf4jq40y6h0c0g9cra7wk9hhmsylk91bg";
+      type = "gem";
+    };
+    version = "0.1.5";
+  };
   concurrent-ruby = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -49,6 +83,14 @@
     };
     version = "1.0.4";
   };
+  debug_inspector = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0vxr0xa1mfbkfcrn71n7c4f2dj7la5hvphn904vh20j3x4j5lrx0";
+      type = "gem";
+    };
+    version = "0.0.3";
+  };
   diff-lcs = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -57,6 +99,14 @@
     };
     version = "1.3";
   };
+  equalizer = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1kjmx3fygx8njxfrwcmn7clfhjhb6bvv3scy2lyyi0wqyi3brra4";
+      type = "gem";
+    };
+    version = "0.0.11";
+  };
   escape_utils = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -65,14 +115,23 @@
     };
     version = "1.2.1";
   };
+  factory_bot = {
+    dependencies = ["activesupport"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "13q1b7imb591068plg4ashgsqgzarvfjz6xxn3jk6klzikz5zhg1";
+      type = "gem";
+    };
+    version = "4.11.1";
+  };
   faraday = {
     dependencies = ["multipart-post"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "157c4cmb5g1b3ny6k9qf9z57rfijl54fcq3hnqqf6g31g1m096b2";
+      sha256 = "16hwxc8v0z6gkanckjhx0ffgqmzpc4ywz4dfhxpjlz2mbz8d5m52";
       type = "gem";
     };
-    version = "0.12.2";
+    version = "0.15.3";
   };
   gemojione = {
     dependencies = ["json"];
@@ -84,13 +143,13 @@
     version = "3.3.0";
   };
   gitaly-proto = {
-    dependencies = ["google-protobuf" "grpc"];
+    dependencies = ["grpc"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "15946776v5v8c2jisknjm82s4q3b3q9x2xygjf4bkk4m45n766w1";
+      sha256 = "16b9sdaimhcda401z2s7apf0nz6y0lxs74xhkwlz4jzf6ms44mgg";
       type = "gem";
     };
-    version = "0.116.0";
+    version = "0.123.0";
   };
   github-linguist = {
     dependencies = ["charlock_holmes" "escape_utils" "mime-types" "rugged"];
@@ -144,15 +203,6 @@
     };
     version = "1.6.4";
   };
-  gitlab-styles = {
-    dependencies = ["rubocop" "rubocop-gitlab-security" "rubocop-rspec"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1k8xrkjx8rcny8p0gsp18wskvn1qbw4rfgdp1f6x0p4xp6dlhjf4";
-      type = "gem";
-    };
-    version = "2.0.0";
-  };
   gollum-grit_adapter = {
     dependencies = ["gitlab-grit"];
     source = {
@@ -165,37 +215,28 @@
   google-protobuf = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0s8ijd9wdrkqwsb6nasrsv7f9i5im2nyax7f7jlb5y9vh8nl98qi";
+      sha256 = "134d3ini9ymdwxpz445m28ss9x0m6vcpijcdkzvgk4n538wdmppf";
       type = "gem";
     };
-    version = "3.5.1";
+    version = "3.6.1";
   };
   googleapis-common-protos-types = {
     dependencies = ["google-protobuf"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0yf10s7w8wpa49hc86z7z2fkn9yz7j2njz0n8xmqb24ji090z4ck";
+      sha256 = "01ds7g01pxqm3mg283xjzy0lhhvvhvzw3m7gf7szd1r7la4wf0qq";
       type = "gem";
     };
-    version = "1.0.1";
+    version = "1.0.2";
-  };
-  googleauth = {
-    dependencies = ["faraday" "jwt" "logging" "memoist" "multi_json" "os" "signet"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "08z4zfj9cwry13y8c2w5p4xylyslxxjq4wahd95bk1ddl5pknd4f";
-      type = "gem";
-    };
-    version = "0.6.2";
   };
   grpc = {
-    dependencies = ["google-protobuf" "googleapis-common-protos-types" "googleauth"];
+    dependencies = ["google-protobuf" "googleapis-common-protos-types"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1is4czi3i7y6zyxzyrpsma1z91axmc0jz2ngr6ckixqd3629npkz";
+      sha256 = "0m2wspnm1cfkmhlbp7yqv5bb4vsfh246cm0aavxra67aw4l8plhb";
       type = "gem";
     };
-    version = "1.11.0";
+    version = "1.15.0";
   };
   i18n = {
     source = {
@@ -205,6 +246,14 @@
     };
     version = "0.8.1";
   };
+  ice_nine = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1nv35qg1rps9fsis28hz2cq2fx1i96795f91q4nmkm934xynll2x";
+      type = "gem";
+    };
+    version = "0.11.2";
+  };
   json = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -213,14 +262,6 @@
     };
     version = "2.1.0";
   };
-  jwt = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1w0kaqrbl71cq9sbnixc20x5lqah3hs2i93xmhlfdg2y3by7yzky";
-      type = "gem";
-    };
-    version = "2.1.0";
-  };
   licensee = {
     dependencies = ["rugged"];
     source = {
@@ -230,30 +271,14 @@
     };
     version = "8.9.2";
   };
-  little-plugger = {
+  memoizable = {
+    dependencies = ["thread_safe"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1frilv82dyxnlg8k1jhrvyd73l6k17mxc5vwxx080r4x1p04gwym";
+      sha256 = "0v42bvghsvfpzybfazl14qhkrjvx0xlmxz0wwqc960ga1wld5x5c";
       type = "gem";
     };
-    version = "1.1.4";
+    version = "0.4.2";
-  };
-  logging = {
-    dependencies = ["little-plugger" "multi_json"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "06j6iaj89h9jhkx1x3hlswqrfnqds8br05xb1qra69dpvbdmjcwn";
-      type = "gem";
-    };
-    version = "2.2.2";
-  };
-  memoist = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0pq8fhqh8w25qcw9v3vzfb0i6jp0k3949ahxc3wrwz2791dpbgbh";
-      type = "gem";
-    };
-    version = "0.16.0";
   };
   mime-types = {
     dependencies = ["mime-types-data"];
@@ -288,14 +313,6 @@
     };
     version = "5.9.1";
   };
-  multi_json = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1rl0qy4inf1mp8mybfk56dfga0mvx97zwpmq5xmiwl5r770171nv";
-      type = "gem";
-    };
-    version = "1.13.1";
-  };
   multipart-post = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -322,30 +339,22 @@
     };
     version = "1.5.0";
   };
-  os = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1llv8w3g2jwggdxr5a5cjkrnbbfnvai3vxacxxc0fy84xmz3hymz";
-      type = "gem";
-    };
-    version = "0.9.6";
-  };
   parallel = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0qv2yj4sxr36ga6xdxvbq9h05hn10bwcbkqv6j6q1fiixhsdnnzd";
+      sha256 = "01hj8v1qnyl5ndrs33g8ld8ibk0rbcqdpkpznr04gkbxd11pqn67";
       type = "gem";
     };
-    version = "1.12.0";
+    version = "1.12.1";
   };
   parser = {
     dependencies = ["ast"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "130rfk8a2ws2fyq52hmi1n0xakylw39wv4x1qhai4z17x2b0k9cq";
+      sha256 = "1zp89zg7iypncszxsjp8kiccrpbdf728jl449g6cnfkz990fyb5k";
       type = "gem";
     };
-    version = "2.4.0.0";
+    version = "2.5.1.2";
   };
   posix-spawn = {
     source = {
@@ -358,35 +367,35 @@
   powerpack = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1fnn3fli5wkzyjl4ryh0k90316shqjfnhydmc7f8lqpi0q21va43";
+      sha256 = "1r51d67wd467rpdfl6x43y84vwm8f5ql9l9m85ak1s2sp3nc5hyv";
       type = "gem";
     };
-    version = "0.1.1";
+    version = "0.1.2";
   };
-  public_suffix = {
+  proc_to_ast = {
+    dependencies = ["coderay" "parser" "unparser"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1x5h1dh1i3gwc01jbg01rly2g6a1qwhynb1s8a30ic507z1nh09s";
+      sha256 = "14c65w48bbzp5lh1cngqd1y25kqvfnq1iy49hlzshl12dsk3z9wj";
       type = "gem";
     };
-    version = "3.0.2";
+    version = "0.1.0";
+  };
+  procto = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "13imvg1x50rz3r0yyfbhxwv72lbf7q28qx9l9nfbb91h2n9ch58c";
+      type = "gem";
+    };
+    version = "0.0.3";
   };
   rainbow = {
-    dependencies = ["rake"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "08w2ghc5nv0kcq5b257h7dwjzjz1pqcavajfdx2xjyxqsvh2y34w";
+      sha256 = "0bb2fpjspydr6x0s8pn1pqkzmxszvkfapv0p4627mywl7ky4zkhk";
       type = "gem";
     };
-    version = "2.2.2";
+    version = "3.0.0";
-  };
-  rake = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0mfqgpp3m69s5v1rd51lfh5qpjwyia5p4rg337pw8c8wzm6pgfsw";
-      type = "gem";
-    };
-    version = "12.1.0";
   };
   rdoc = {
     source = {
@@ -399,10 +408,10 @@
   rouge = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0h79gn2wmn1wix2d27lgiaimccyj8gvizrllyym500pir408x62f";
+      sha256 = "1digsi2s8wyzx8vsqcxasw205lg6s7izx8jypl8rrpjwshmv83ql";
       type = "gem";
     };
-    version = "3.2.1";
+    version = "3.3.0";
   };
   rspec = {
     dependencies = ["rspec-core" "rspec-expectations" "rspec-mocks"];
@@ -440,6 +449,15 @@
     };
     version = "3.7.0";
   };
+  rspec-parameterized = {
+    dependencies = ["binding_of_caller" "parser" "proc_to_ast" "rspec" "unparser"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0arynbr6cfjhccwc8gy2xf87nybdnncsnmfwknnh8s7d4mj730p0";
+      type = "gem";
+    };
+    version = "0.4.0";
+  };
   rspec-support = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -452,44 +470,26 @@
     dependencies = ["parallel" "parser" "powerpack" "rainbow" "ruby-progressbar" "unicode-display_width"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1hpd7zcv4y9y750wj630abvmcjwv39dsrj1fjff60ik7gfri0xlz";
+      sha256 = "106y99lq0fg62k3vk1w5wwb4vq16pnh4l61skc82xck627z0h8is";
       type = "gem";
     };
-    version = "0.50.0";
+    version = "0.54.0";
-  };
-  rubocop-gitlab-security = {
-    dependencies = ["rubocop"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0aw9qmyc6xj6fi0jxp8m4apk358rd91z492ragn6jp4rghkqj5cy";
-      type = "gem";
-    };
-    version = "0.1.0";
-  };
-  rubocop-rspec = {
-    dependencies = ["rubocop"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1hf48ng67yswvshmv4cyysj1rs1z3fnvlycr50jdcgwlynpyxkhs";
-      type = "gem";
-    };
-    version = "1.17.0";
   };
   ruby-progressbar = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "029kv0q3kfq53rjyak4ypn7196l8z4hflfmv4p5787n78z7baiqf";
+      sha256 = "1cv2ym3rl09svw8940ny67bav7b2db4ms39i4raaqzkf59jmhglk";
       type = "gem";
     };
-    version = "1.8.3";
+    version = "1.10.0";
   };
   rugged = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1y6k5yrfmhc1v4albbpa3xzl28vk5lric3si8ada28sp9mmk2x72";
+      sha256 = "1jv4nw9hvlxp8hhhlllrfcznki82i50fp1sj65zsjllfl2bvz8x6";
       type = "gem";
     };
-    version = "0.27.4";
+    version = "0.27.5";
   };
   sanitize = {
     dependencies = ["crass" "nokogiri" "nokogumbo"];
@@ -509,15 +509,6 @@
     };
     version = "2.7.2";
   };
-  signet = {
-    dependencies = ["addressable" "faraday" "jwt" "multi_json"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0js81lxqirdza8gf2f6avh11fny49ygmxfi1qx7jp8l9wrhznbkv";
-      type = "gem";
-    };
-    version = "0.8.1";
-  };
   stringex = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -534,6 +525,14 @@
     };
     version = "0.3.6";
   };
+  timecop = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0d7mm786180v4kzvn1f77rhfppsg5n0sq2bdx63x9nv114zm8jrp";
+      type = "gem";
+    };
+    version = "0.9.1";
+  };
   tzinfo = {
     dependencies = ["thread_safe"];
     source = {
@@ -546,9 +545,18 @@
   unicode-display_width = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "12pi0gwqdnbx1lv5136v3vyr0img9wr0kxcn4wn54ipq4y41zxq8";
+      sha256 = "0040bsdpcmvp8w31lqi2s9s4p4h031zv52401qidmh25cgyh4a57";
       type = "gem";
     };
-    version = "1.3.0";
+    version = "1.4.0";
+  };
+  unparser = {
+    dependencies = ["abstract_type" "adamantium" "concord" "diff-lcs" "equalizer" "parser" "procto"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0rh1649846ac17av30x0b0v9l45v0x1j2y1i8m1a7xdd0v4sld0z";
+      type = "gem";
+    };
+    version = "0.2.8";
   };
 }

pkgs/applications/version-management/gitlab/gitlab-shell/default.nix

@@ -1,14 +1,14 @@
 { stdenv, ruby, bundler, fetchFromGitLab, go }:
 
 stdenv.mkDerivation rec {
-  version = "8.3.3";
+  version = "8.4.1";
   name = "gitlab-shell-${version}";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-shell";
     rev = "v${version}";
-    sha256 = "1qapw0yvlw1nxjik7jpbbbl3yx299sfvdx67zsd5ai7bhk1gd8xl";
+    sha256 = "00jzrpdfqgrba2qi5ngc0g07p7gmip7my563hw542gg8l88d27xq";
   };
 
   buildInputs = [ ruby bundler go ];

pkgs/applications/version-management/gitlab/gitlab-shell/remove-hardcoded-locations.patch

@@ -0,0 +1,45 @@
+diff --git a/go/internal/config/config.go b/go/internal/config/config.go
+index 435cb29..078c1df 100644
+--- a/go/internal/config/config.go
++++ b/go/internal/config/config.go
+@@ -2,7 +2,6 @@ package config
+ 
+ import (
+ 	"io/ioutil"
+-	"os"
+ 	"path"
+ 
+ 	yaml "gopkg.in/yaml.v2"
+@@ -26,16 +25,13 @@ type Config struct {
+ }
+ 
+ func New() (*Config, error) {
+-	dir, err := os.Getwd()
+-	if err != nil {
+-		return nil, err
+-	}
++	dir := "/run/gitlab"
+ 
+ 	return NewFromDir(dir)
+ }
+ 
+ func NewFromDir(dir string) (*Config, error) {
+-	return newFromFile(path.Join(dir, configFile))
++	return newFromFile(path.Join(dir, "shell-config.yml"))
+ }
+ 
+ func newFromFile(filename string) (*Config, error) {
+diff --git a/lib/gitlab_shell.rb b/lib/gitlab_shell.rb
+index 57c70f5..700569b 100644
+--- a/lib/gitlab_shell.rb
++++ b/lib/gitlab_shell.rb
+@@ -187,7 +187,8 @@ class GitlabShell # rubocop:disable Metrics/ClassLength
+ 
+     args = [executable, gitaly_address, json_args]
+     # We use 'chdir: ROOT_PATH' to let the next executable know where config.yml is.
+-    Kernel.exec(env, *args, unsetenv_others: true, chdir: ROOT_PATH)
++    # Except we don't, because we're already in the right directory on nixos!
++    Kernel.exec(env, *args, unsetenv_others: true)
+   end
+ 
+   def api

pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix

@@ -3,18 +3,18 @@
 stdenv.mkDerivation rec {
   name = "gitlab-workhorse-${version}";
 
-  version = "7.0.0";
+  version = "7.1.0";
 
-  srcs = fetchFromGitLab {
+  src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-workhorse";
     rev = "v${version}";
-    sha256 = "1mmfb7h5sbva2kv9h9cxfg7dyksxrwwikq7jwggfawqaadzwm677";
+    sha256 = "1jq28z2kf58wnbv8jkwfx2bm8ki22hpm9ssdy2ymza22gq0zx00g";
   };
 
   buildInputs = [ git go ];
 
-  patches = [ ./remove-hardcoded-paths.patch ./deterministic-build.patch ];
+  patches = [ ./remove-hardcoded-paths.patch ];
 
   makeFlags = [ "PREFIX=$(out)" "VERSION=${version}" ];
 

pkgs/applications/version-management/gitlab/update.py

@@ -0,0 +1,234 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i python3 -p bundix common-updater-scripts nix nix-prefetch-git python3 python3Packages.requests python3Packages.lxml python3Packages.click python3Packages.click-log
+
+import click
+import click_log
+import os
+import re
+import logging
+import subprocess
+import json
+import pathlib
+from typing import Iterable
+
+import requests
+from xml.etree import ElementTree
+
+logger = logging.getLogger(__name__)
+
+
+class GitLabRepo:
+    def __init__(self, owner: str, repo: str):
+        self.owner = owner
+        self.repo = repo
+
+    @property
+    def url(self):
+        return f"https://gitlab.com/{self.owner}/{self.repo}"
+
+    @property
+    def tags(self) -> Iterable[str]:
+        r = requests.get(self.url + "/tags?format=atom", stream=True)
+
+        tree = ElementTree.fromstring(r.content)
+        return sorted((e.text for e in tree.findall(
+            '{http://www.w3.org/2005/Atom}entry/{http://www.w3.org/2005/Atom}title')), reverse=True)
+
+    def get_git_hash(self, rev: str):
+        out = subprocess.check_output(['nix-prefetch-git', self.url, rev])
+        j = json.loads(out)
+        return j['sha256']
+
+    def get_deb_url(self, flavour: str, version: str, arch: str = 'amd64') -> str:
+        """
+        gitlab builds debian packages, which we currently need as we don't build the frontend on our own
+        this returns the url of a given flavour, version and arch
+        :param flavour: 'ce' or 'ee'
+        :param version: a version, without 'v' prefix and '-ee' suffix
+        :param arch: amd64
+        :return: url of the debian package
+        """
+        if self.owner != "gitlab-org" or self.repo not in ['gitlab-ce', 'gitlab-ee']:
+            raise Exception(f"don't know how to get deb_url for {self.url}")
+        return f"https://packages.gitlab.com/gitlab/gitlab-{flavour}/packages" + \
+               f"/debian/stretch/gitlab-{flavour}_{version}-{flavour}.0_{arch}.deb/download.deb"
+
+    def get_deb_hash(self, flavour: str, version: str) -> str:
+        out = subprocess.check_output(['nix-prefetch-url', self.get_deb_url(flavour, version)])
+        return out.decode('utf-8').strip()
+
+    @staticmethod
+    def rev2version(tag: str) -> str:
+        """
+        normalize a tag to a version number.
+        This obviously isn't very smart if we don't pass something that looks like a tag
+        :param tag: the tag to normalize
+        :return: a normalized version number
+        """
+        # strip v prefix
+        version = re.sub(r"^v", '', tag)
+        # strip -ee suffix
+        return re.sub(r"-ee$", '', version)
+
+    def get_file(self, filepath, rev):
+        """
+        returns file contents at a given rev
+        :param filepath: the path to the file, relative to the repo root
+        :param rev: the rev to fetch at
+        :return:
+        """
+        return requests.get(self.url + f"/raw/{rev}/{filepath}").text
+
+    def get_data(self, rev, flavour):
+        version = self.rev2version(rev)
+
+        passthru = {v: self.get_file(v, rev).strip() for v in ['GITALY_SERVER_VERSION', 'GITLAB_PAGES_VERSION',
+                                                               'GITLAB_SHELL_VERSION', 'GITLAB_WORKHORSE_VERSION']}
+        return dict(version=self.rev2version(rev),
+                    repo_hash=self.get_git_hash(rev),
+                    deb_hash=self.get_deb_hash(flavour, version),
+                    deb_url=self.get_deb_url(flavour, version),
+                    owner=self.owner,
+                    repo=self.repo,
+                    rev=rev,
+                    passthru=passthru)
+
+
+def _flavour2gitlabrepo(flavour: str):
+    if flavour not in ['ce', 'ee']:
+        raise Exception(f"unknown gitlab flavour: {flavour}, needs to be ce or ee")
+
+    owner = 'gitlab-org'
+    repo = 'gitlab-' + flavour
+
+    return GitLabRepo(owner, repo)
+
+
+def _update_data_json(filename: str, repo: GitLabRepo, rev: str, flavour: str):
+    flavour_data = repo.get_data(rev, flavour)
+
+    if not os.path.exists(filename):
+        with open(filename, 'w') as f:
+            json.dump({flavour: flavour_data}, f, indent=2)
+    else:
+        with open(filename, 'r+') as f:
+            data = json.load(f)
+            data[flavour] = flavour_data
+            f.seek(0)
+            json.dump(data, f, indent=2)
+
+
+def _get_data_json():
+    data_file_path = pathlib.Path(__file__).parent / 'data.json'
+    with open(data_file_path, 'r') as f:
+        return json.load(f)
+
+
+def _call_update_source_version(pkg, version):
+    """calls update-source-version from nixpkgs root dir"""
+    nixpkgs_path = pathlib.Path(__file__).parent / '../../../../'
+    return subprocess.check_output(['update-source-version', pkg, version], cwd=nixpkgs_path)
+
+
+@click_log.simple_verbosity_option(logger)
+@click.group()
+def cli():
+    pass
+
+
+@cli.command('update-data')
+@click.option('--rev', default='latest', help='The rev to use, \'latest\' points to the latest (stable) tag')
+@click.argument('flavour')
+def update_data(rev: str, flavour: str):
+    """Update data.nix for a selected flavour"""
+    r = _flavour2gitlabrepo(flavour)
+
+    if rev == 'latest':
+        # filter out pre and re releases
+        rev = next(filter(lambda x: not ('rc' in x or x.endswith('pre')), r.tags))
+    logger.debug(f"Using rev {rev}")
+
+    version = r.rev2version(rev)
+    logger.debug(f"Using version {version}")
+
+    data_file_path = pathlib.Path(__file__).parent / 'data.json'
+
+    _update_data_json(filename=data_file_path.as_posix(),
+                      repo=r,
+                      rev=rev,
+                      flavour=flavour)
+
+
+@cli.command('update-rubyenv')
+@click.argument('flavour')
+def update_rubyenv(flavour):
+    """Update rubyEnv-${flavour}"""
+    if flavour not in ['ce', 'ee']:
+        raise Exception(f"unknown gitlab flavour: {flavour}, needs to be ce or ee")
+
+    r = _flavour2gitlabrepo(flavour)
+    rubyenv_dir = pathlib.Path(__file__).parent / f"rubyEnv-{flavour}"
+
+    # load rev from data.json
+    data = _get_data_json()
+    rev = data[flavour]['rev']
+
+    for fn in ['Gemfile.lock', 'Gemfile']:
+        with open(rubyenv_dir / fn, 'w') as f:
+            f.write(r.get_file(fn, rev))
+
+    subprocess.check_output(['bundix'], cwd=rubyenv_dir)
+
+
+@cli.command('update-gitaly')
+def update_gitaly():
+    """Update gitaly"""
+    data = _get_data_json()
+    gitaly_server_version = data['ce']['passthru']['GITALY_SERVER_VERSION']
+    r = GitLabRepo('gitlab-org', 'gitaly')
+    rubyenv_dir = pathlib.Path(__file__).parent / 'gitaly'
+
+    for fn in ['Gemfile.lock', 'Gemfile']:
+        with open(rubyenv_dir / fn, 'w') as f:
+            f.write(r.get_file(f"ruby/{fn}", f"v{gitaly_server_version}"))
+
+    subprocess.check_output(['bundix'], cwd=rubyenv_dir)
+    # currently broken, as `gitaly.meta.position` returns
+    # pkgs/development/go-modules/generic/default.nix
+    # so update-source-version doesn't know where to update hashes
+    # _call_update_source_version('gitaly', gitaly_server_version)
+    gitaly_hash = r.get_git_hash(f"v{gitaly_server_version}")
+    click.echo(f"Please update gitaly/default.nix to version {gitaly_server_version} and hash {gitaly_hash}")
+
+
+
+@cli.command('update-gitlab-shell')
+def update_gitlab_shell():
+    """Update gitlab-shell"""
+    data = _get_data_json()
+    gitlab_shell_version = data['ce']['passthru']['GITLAB_SHELL_VERSION']
+    _call_update_source_version('gitlab-shell', gitlab_shell_version)
+
+
+@cli.command('update-gitlab-workhorse')
+def update_gitlab_workhorse():
+    """Update gitlab-shell"""
+    data = _get_data_json()
+    gitlab_workhorse_version = data['ce']['passthru']['GITLAB_WORKHORSE_VERSION']
+    _call_update_source_version('gitlab-workhorse', gitlab_workhorse_version)
+
+
+@cli.command('update-all')
+@click.pass_context
+def update_all(ctx):
+    """Update gitlab ce and ee data.nix and rubyenvs to the latest stable release"""
+    for flavour in ['ce', 'ee']:
+        ctx.invoke(update_data, rev='latest', flavour=flavour)
+        ctx.invoke(update_rubyenv, flavour=flavour)
+    ctx.invoke(update_gitaly)
+    ctx.invoke(update_gitlab_shell)
+    ctx.invoke(update_gitlab_workhorse)
+
+
+if __name__ == '__main__':
+    cli()

pkgs/applications/virtualization/open-vm-tools/default.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   name = "open-vm-tools-${version}";
-  version = "10.3.0";
+  version = "10.3.5";
 
   src = fetchFromGitHub {
     owner  = "vmware";
     repo   = "open-vm-tools";
     rev    = "stable-${version}";
-    sha256 = "0arx4yd8c5qszfgw8rqyi65j37r46dxibmzqqxb096isxhxjymw6";
+    sha256 = "10x24gkqcg9lnfxghq92nr76h40s5v3xrv0ymi9c7aqrqry404z7";
   };
 
   sourceRoot = "${src.name}/open-vm-tools";

pkgs/applications/window-managers/dwm/dwm-status.nix

@@ -3,13 +3,13 @@
 
 rustPlatform.buildRustPackage rec {
   name = "dwm-status-${version}";
-  version = "1.2.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "Gerschtli";
     repo = "dwm-status";
     rev = version;
-    sha256 = "0bv1jkqkf509akg3dvdy8b2q1kh8i75vw4n6a9rjvslx9s9nh6ca";
+    sha256 = "1v9ksv8hdxhpm7vs71p9s1y3gnahczza0w4wyrk2fsc6x2kwlh6x";
   };
 
   nativeBuildInputs = [ makeWrapper pkgconfig ];

pkgs/applications/window-managers/i3/status.nix

@@ -1,4 +1,4 @@
-{ fetchurl, stdenv, confuse, yajl, alsaLib, libpulseaudio, libnl, pkgconfig
+{ fetchurl, stdenv, libconfuse, yajl, alsaLib, libpulseaudio, libnl, pkgconfig
   }:
 
 stdenv.mkDerivation rec {
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ confuse yajl alsaLib libpulseaudio libnl ];
+  buildInputs = [ libconfuse yajl alsaLib libpulseaudio libnl ];
 
   makeFlags = [ "all" "PREFIX=$(out)" ];
 

pkgs/build-support/emacs/melpa.nix

@@ -35,11 +35,11 @@ import ./generic.nix { inherit lib stdenv emacs texinfo; } ({
     then pname
     else ename;
 
-  melpa = fetchFromGitHub {
+  packageBuild = fetchFromGitHub {
     owner = "melpa";
-    repo = "melpa";
+    repo = "package-build";
-    rev = "7103313a7c31bb1ebb71419e365cd2e279ee4609";
+    rev = "0a22c3fbbf661822ec1791739953b937a12fa623";
-    sha256 = "0m10f83ix0mzjk0vjd4kkb1m1p4b8ha0ll2yjsgk9bqjd7fwapqb";
+    sha256 = "0dpy5p34il600sc8ic5jdgb3glya9si3lrvhxab0swks8fdydjgs";
   };
 
   elpa2nix = ./elpa2nix.el;
@@ -51,7 +51,7 @@ import ./generic.nix { inherit lib stdenv emacs texinfo; } ({
       cp "$recipe" "$NIX_BUILD_TOP/recipes/$ename"
     fi
 
-    ln -s "$melpa/package-build" "$NIX_BUILD_TOP/package-build"
+    ln -s "$packageBuild" "$NIX_BUILD_TOP/package-build"
 
     mkdir -p "$NIX_BUILD_TOP/packages"
   '';
@@ -61,19 +61,18 @@ import ./generic.nix { inherit lib stdenv emacs texinfo; } ({
     ln -s "$NIX_BUILD_TOP/$sourceRoot" "$NIX_BUILD_TOP/working/$ename"
   '';
 
-  buildPhase =
+  buildPhase = ''
-    ''
+    runHook preBuild
-      runHook preBuild
 
-      cd "$NIX_BUILD_TOP"
+    cd "$NIX_BUILD_TOP"
 
-      emacs --batch -Q \
+    emacs --batch -Q \
-          -L "$melpa/package-build" \
+        -L "$NIX_BUILD_TOP/package-build" \
-          -l "$melpa2nix" \
+        -l "$melpa2nix" \
-          -f melpa2nix-build-package \
+        -f melpa2nix-build-package \
-          $ename $version
+        $ename $version
 
-      runHook postBuild
+    runHook postBuild
     '';
 
   installPhase = ''

pkgs/build-support/emacs/trivial.nix

@@ -7,27 +7,22 @@ with lib;
 args:
 
 import ./generic.nix envargs ({
-  #preConfigure = ''
-  #  export LISPDIR=$out/share/emacs/site-lisp
-  #  export VERSION_SPECIFIC_LISPDIR=$out/share/emacs/site-lisp
-  #'';
-
   buildPhase = ''
-    eval "$preBuild"
+    runHook preBuild
 
     emacs -L . --batch -f batch-byte-compile *.el
 
-    eval "$postBuild"
+    runHook postBuild
   '';
 
   installPhase = ''
-    eval "$preInstall"
+    runHook preInstall
 
     LISPDIR=$out/share/emacs/site-lisp
     install -d $LISPDIR
     install *.el *.elc $LISPDIR
 
-    eval "$postInstall"
+    runHook postInstall
   '';
 }
 

pkgs/build-support/setup-hooks/auto-patchelf.sh

@@ -147,15 +147,56 @@ autoPatchelfFile() {
     fi
 }
 
+# Can be used to manually add additional directories with shared object files
+# to be included for the next autoPatchelf invocation.
+addAutoPatchelfSearchPath() {
+    local -a findOpts=()
+
+    # XXX: Somewhat similar to the one in the autoPatchelf function, maybe make
+    #      it DRY someday...
+    while [ $# -gt 0 ]; do
+        case "$1" in
+            --) shift; break;;
+            --no-recurse) shift; findOpts+=("-maxdepth" 1);;
+            --*)
+                echo "addAutoPatchelfSearchPath: ERROR: Invalid command line" \
+                     "argument: $1" >&2
+                return 1;;
+            *) break;;
+        esac
+    done
+
+    cachedDependencies+=(
+        $(find "$@" "${findOpts[@]}" \! -type d \
+               \( -name '*.so' -o -name '*.so.*' \))
+    )
+}
+
 autoPatchelf() {
+    local norecurse=
+
+    while [ $# -gt 0 ]; do
+        case "$1" in
+            --) shift; break;;
+            --no-recurse) shift; norecurse=1;;
+            --*)
+                echo "autoPatchelf: ERROR: Invalid command line" \
+                     "argument: $1" >&2
+                return 1;;
+            *) break;;
+        esac
+    done
+
+    if [ $# -eq 0 ]; then
+        echo "autoPatchelf: No paths to patch specified." >&2
+        return 1
+    fi
+
     echo "automatically fixing dependencies for ELF files" >&2
 
     # Add all shared objects of the current output path to the start of
     # cachedDependencies so that it's choosen first in findDependency.
-    cachedDependencies+=(
+    addAutoPatchelfSearchPath ${norecurse:+--no-recurse} -- "$@"
-        $(find "$prefix" \! -type d \( -name '*.so' -o -name '*.so.*' \))
-    )
-    local elffile
 
     # Here we actually have a subshell, which also means that
     # $cachedDependencies is final at this point, so whenever we want to run
@@ -164,12 +205,15 @@ autoPatchelf() {
     # outside of this function.
     while IFS= read -r -d $'\0' file; do
       isELF "$file" || continue
+      segmentHeaders="$(LANG=C readelf -l "$file")"
+      # Skip if the ELF file doesn't have segment headers (eg. object files).
+      echo "$segmentHeaders" | grep -q '^Program Headers:' || continue
       if isExecutable "$file"; then
           # Skip if the executable is statically linked.
-          LANG=C readelf -l "$file" | grep -q "^ *INTERP\\>" || continue
+          echo "$segmentHeaders" | grep -q "^ *INTERP\\>" || continue
       fi
       autoPatchelfFile "$file"
-    done < <(find "$prefix" -type f -print0)
+    done < <(find "$@" ${norecurse:+-maxdepth 1} -type f -print0)
 }
 
 # XXX: This should ultimately use fixupOutputHooks but we currently don't have
@@ -180,6 +224,11 @@ autoPatchelf() {
 # So what we do here is basically run in postFixup and emulate the same
 # behaviour as fixupOutputHooks because the setup hook for patchelf is run in
 # fixupOutput and the postFixup hook runs later.
-postFixupHooks+=(
+postFixupHooks+=('
-    'for output in $outputs; do prefix="${!output}" autoPatchelf; done'
+    if [ -z "$dontAutoPatchelf" ]; then
-)
+        autoPatchelf -- $(for output in $outputs; do
+            [ -e "${!output}" ] || continue
+            echo "${!output}"
+        done)
+    fi
+')

pkgs/build-support/writers/default.nix

@@ -0,0 +1,239 @@
+{ pkgs, lib }:
+
+with lib;
+rec {
+  # Base implementation for non-compiled executables.
+  # Takes an interpreter, for example `${pkgs.bash}/bin/bash`
+  #
+  # Examples:
+  #   writeBash = makeScriptWriter { interpreter = "${pkgs.bash}/bin/bash"; }
+  #   makeScriptWriter { interpreter = "${pkgs.dash}/bin/dash"; } "hello" "echo hello world"
+  makeScriptWriter = { interpreter, check ? "" }: name: text:
+    assert lib.or (types.path.check name) (builtins.match "([0-9A-Za-z._])[0-9A-Za-z._-]*" name != null);
+
+    pkgs.writeTextFile {
+      name = last (builtins.split "/" name);
+      executable = true;
+      destination = if types.path.check name then name else "";
+      text = ''
+        #! ${interpreter}
+        ${text}
+        '';
+      checkPhase = check;
+    };
+
+  # Like writeScript but the first line is a shebang to bash
+  #
+  # Example:
+  #   writeBash "example" ''
+  #     echo hello world
+  #   ''
+  writeBash = makeScriptWriter {
+    interpreter = "${pkgs.bash}/bin/bash";
+  };
+
+  # Like writeScriptBIn but the first line is a shebang to bash
+  writeBashBin = name:
+    writeBash "/bin/${name}";
+
+  # writeC writes an executable c package called `name` to `destination` using `libraries`.
+  #
+  #  Examples:
+  #    writeC "hello-world-ncurses" { libraries = [ pkgs.ncurses ]; } ''
+  #      #include <ncurses.h>
+  #      int main() {
+  #        initscr();
+  #        printw("Hello World !!!");
+  #        refresh(); endwin();
+  #        return 0;
+  #      }
+  #    ''
+  writeC = name: {
+    libraries ? [],
+  }: text: pkgs.runCommand name {
+    inherit text;
+    buildInputs = [ pkgs.pkgconfig ] ++ libraries;
+    passAsFile = [ "text" ];
+  } ''
+    PATH=${makeBinPath [
+      pkgs.binutils-unwrapped
+      pkgs.coreutils
+      pkgs.gcc
+      pkgs.pkgconfig
+    ]}
+    mkdir -p "$(dirname "$out")"
+    gcc \
+        ${optionalString (libraries != [])
+          "$(pkg-config --cflags --libs ${
+            concatMapStringsSep " " (lib: escapeShellArg (builtins.parseDrvName lib.name).name) (libraries)
+          })"
+        } \
+        -O \
+        -o "$out" \
+        -Wall \
+        -x c \
+        "$textPath"
+    strip --strip-unneeded "$out"
+  '';
+
+  # writeCBin takes the same arguments as writeC but outputs a directory (like writeScriptBin)
+  writeCBin = name: spec: text:
+    pkgs.runCommand name {
+    } ''
+      mkdir -p $out/bin
+      ln -s ${writeC name spec text} $out/bin/${name}
+    '';
+
+  # Like writeScript but the first line is a shebang to dash
+  #
+  # Example:
+  #   writeDash "example" ''
+  #     echo hello world
+  #   ''
+  writeDash = makeScriptWriter {
+    interpreter = "${pkgs.dash}/bin/dash";
+  };
+
+  # Like writeScriptBin but the first line is a shebang to dash
+  writeDashBin = name:
+    writeDash "/bin/${name}";
+
+  # writeHaskell takes a name, an attrset with libraries and haskell version (both optional)
+  # and some haskell source code and returns an executable.
+  #
+  # Example:
+  #   writeHaskell "missiles" { libraries = [ pkgs.haskellPackages.acme-missiles ]; } ''
+  #     Import Acme.Missiles
+  #
+  #     main = launchMissiles
+  #   '';
+  writeHaskell = name: {
+    libraries ? [],
+    ghc ? pkgs.ghc
+  }: text: pkgs.runCommand name {
+    inherit text;
+    passAsFile = [ "text" ];
+  } ''
+    cp $textPath ${name}.hs
+    ${ghc.withPackages (_: libraries )}/bin/ghc ${name}.hs
+    cp ${name} $out
+  '';
+
+  # writeHaskellBin takes the same arguments as writeHaskell but outputs a directory (like writeScriptBin)
+  writeHaskellBin = name: spec: text:
+    pkgs.runCommand name {
+    } ''
+      mkdir -p $out/bin
+      ln -s ${writeHaskell name spec text} $out/bin/${name}
+    '';
+
+  # writeJS takes a name an attributeset with libraries and some JavaScript sourcecode and
+  # returns an executable
+  #
+  # Example:
+  #   writeJS "example" { libraries = [ pkgs.nodePackages.uglify-js ]; } ''
+  #     var UglifyJS = require("uglify-js");
+  #     var code = "function add(first, second) { return first + second; }";
+  #     var result = UglifyJS.minify(code);
+  #     console.log(result.code);
+  #   ''
+  writeJS = name: { libraries ? [] }: text:
+  let
+    node-env = pkgs.buildEnv {
+      name = "node";
+      paths = libraries;
+      pathsToLink = [
+        "/lib/node_modules"
+      ];
+    };
+  in writeDash name ''
+    export NODE_PATH=${node-env}/lib/node_modules
+    exec ${pkgs.nodejs}/bin/node ${pkgs.writeText "js" text}
+  '';
+
+  # writeJSBin takes the same arguments as writeJS but outputs a directory (like writeScriptBin)
+  writeJSBin = name:
+    writeJS "/bin/${name}";
+
+  # writePerl takes a name an attributeset with libraries and some perl sourcecode and
+  # returns an executable
+  #
+  # Example:
+  #   writePerl "example" { libraries = [ pkgs.perlPackages.boolean ]; } ''
+  #     use boolean;
+  #     print "Howdy!\n" if true;
+  #   ''
+  writePerl = name: { libraries ? [] }:
+  let
+    perl-env = pkgs.buildEnv {
+      name = "perl-environment";
+      paths = libraries;
+      pathsToLink = [
+        "/lib/perl5/site_perl"
+      ];
+    };
+  in
+  makeScriptWriter {
+    interpreter = "${pkgs.perl}/bin/perl -I ${perl-env}/lib/perl5/site_perl";
+  } name;
+
+  # writePerlBin takes the same arguments as writePerl but outputs a directory (like writeScriptBin)
+  writePerlBin = name:
+    writePerl "/bin/${name}";
+
+  # writePython2 takes a name an attributeset with libraries and some python2 sourcecode and
+  # returns an executable
+  #
+  # Example:
+  # writePython2 "test_python2" { libraries = [ pkgs.python2Packages.enum ]; } ''
+  #   from enum import Enum
+  #
+  #   class Test(Enum):
+  #       a = "success"
+  #
+  #   print Test.a
+  # ''
+  writePython2 = name: { libraries ? [], flakeIgnore ? [] }:
+  let
+    py = pkgs.python2.withPackages (ps: libraries);
+    ignoreAttribute = optionalString (flakeIgnore != []) "--ignore ${concatMapStringsSep "," escapeShellArg flakeIgnore}";
+  in
+  makeScriptWriter {
+    interpreter = "${py}/bin/python";
+    check = writeDash "python2check.sh" ''
+      exec ${pkgs.python2Packages.flake8}/bin/flake8 --show-source ${ignoreAttribute} "$1"
+    '';
+  } name;
+
+  # writePython2Bin takes the same arguments as writePython2 but outputs a directory (like writeScriptBin)
+  writePython2Bin = name:
+    writePython2 "/bin/${name}";
+
+  # writePython3 takes a name an attributeset with libraries and some python3 sourcecode and
+  # returns an executable
+  #
+  # Example:
+  # writePython3 "test_python3" { libraries = [ pkgs.python3Packages.pyyaml ]; } ''
+  #   import yaml
+  #
+  #   y = yaml.load("""
+  #     - test: success
+  #   """)
+  #   print(y[0]['test'])
+  # ''
+  writePython3 = name: { libraries ? [], flakeIgnore ? [] }:
+  let
+    py = pkgs.python3.withPackages (ps: libraries);
+    ignoreAttribute = optionalString (flakeIgnore != []) "--ignore ${concatMapStringsSep "," escapeShellArg flakeIgnore}";
+  in
+  makeScriptWriter {
+    interpreter = "${py}/bin/python";
+    check = writeDash "python3check.sh" ''
+      exec ${pkgs.python3Packages.flake8}/bin/flake8 --show-source ${ignoreAttribute} "$1"
+    '';
+  } name;
+
+  # writePython3Bin takes the same arguments as writePython3 but outputs a directory (like writeScriptBin)
+  writePython3Bin = name:
+    writePython3 "/bin/${name}";
+}

pkgs/build-support/writers/test.nix

@@ -0,0 +1,149 @@
+{ stdenv, lib, runCommand, haskellPackages, nodePackages, perlPackages, python2Packages, python3Packages, writers}:
+with writers;
+let
+
+  bin = {
+    bash = writeBashBin "test_writers" ''
+     if [[ "test" == "test" ]]; then echo "success"; fi
+    '';
+
+    c = writeCBin "test_writers" { libraries = [ ]; } ''
+      #include <stdio.h>
+      int main() {
+        printf("success\n");
+        return 0;
+      }
+    '';
+
+    dash = writeDashBin "test_writers" ''
+     test '~' = '~' && echo 'success'
+    '';
+
+    haskell = writeHaskellBin "test_writers" { libraries = [ haskellPackages.acme-default ]; } ''
+      import Data.Default
+
+      int :: Int
+      int = def
+
+      main :: IO ()
+      main = case int of
+        18871 -> putStrLn $ id "success"
+        _ -> print "fail"
+    '';
+
+    js = writeJSBin "test_writers" { libraries = [ nodePackages.semver ]; } ''
+      var semver = require('semver');
+
+      if (semver.valid('1.2.3')) {
+        console.log('success')
+      } else {
+        console.log('fail')
+      }
+    '';
+
+    perl = writePerlBin "test_writers" { libraries = [ perlPackages.boolean ]; } ''
+      use boolean;
+      print "success\n" if true;
+    '';
+
+    python2 = writePython2Bin "test_writers" { libraries = [ python2Packages.enum ]; } ''
+      from enum import Enum
+
+      class Test(Enum):
+          a = "success"
+
+      print Test.a
+    '';
+
+    python3 = writePython3Bin "test_writers" { libraries = [ python3Packages.pyyaml ]; } ''
+      import yaml
+
+      y = yaml.load("""
+        - test: success
+      """)
+      print(y[0]['test'])
+    '';
+  };
+
+  simple = {
+    bash = writeBash "test_bash" ''
+     if [[ "test" == "test" ]]; then echo "success"; fi
+    '';
+
+    c = writeC "test_c" { libraries = [ ]; } ''
+      #include <stdio.h>
+      int main() {
+        printf("success\n");
+        return 0;
+      }
+    '';
+
+    dash = writeDash "test_dash" ''
+     test '~' = '~' && echo 'success'
+    '';
+
+    haskell = writeHaskell "test_haskell" { libraries = [ haskellPackages.acme-default ]; } ''
+      import Data.Default
+
+      int :: Int
+      int = def
+
+      main :: IO ()
+      main = case int of
+        18871 -> putStrLn $ id "success"
+        _ -> print "fail"
+    '';
+
+    js = writeJS "test_js" { libraries = [ nodePackages.semver ]; } ''
+      var semver = require('semver');
+
+      if (semver.valid('1.2.3')) {
+        console.log('success')
+      } else {
+        console.log('fail')
+      }
+    '';
+
+    perl = writePerl "test_perl" { libraries = [ perlPackages.boolean ]; } ''
+      use boolean;
+      print "success\n" if true;
+    '';
+
+    python2 = writePython2 "test_python2" { libraries = [ python2Packages.enum ]; } ''
+      from enum import Enum
+
+      class Test(Enum):
+          a = "success"
+
+      print Test.a
+    '';
+
+    python3 = writePython3 "test_python3" { libraries = [ python3Packages.pyyaml ]; } ''
+      import yaml
+
+      y = yaml.load("""
+        - test: success
+      """)
+      print(y[0]['test'])
+    '';
+  };
+
+  writeTest = expectedValue: test:
+    writeDash "test-writers" ''
+      if test "$(${test})" != "${expectedValue}"; then
+        echo 'test ${test} failed'
+        exit 1
+      fi
+    '';
+
+in runCommand "test-writers" {
+  passthru = { inherit writeTest bin simple; };
+  meta.platforms = stdenv.lib.platforms.all;
+} ''
+  ${lib.concatMapStringsSep "\n" (test: writeTest "success" "${test}/bin/test_writers") (lib.attrValues bin)}
+  ${lib.concatMapStringsSep "\n" (test: writeTest "success" "${test}") (lib.attrValues simple)}
+
+  echo 'nix-writers successfully tested' >&2
+  touch $out
+''
+

pkgs/desktops/gnome-3/core/gnome-keyring/default.nix

@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     patchShebangs build
   '';
 
-  doCheck = true;
+  doCheck = !stdenv.isi686; # https://github.com/NixOS/nixpkgs/issues/51121
   # In 3.20.1, tests do not support Python 3
   checkInputs = [ dbus python2 ];
 

pkgs/development/haskell-modules/configuration-common.nix

@@ -33,7 +33,7 @@ self: super: {
   unbuildable = throw "package depends on meta package 'unbuildable'";
 
   # Use the latest version of the Cabal library.
-  cabal-install = super.cabal-install.overrideScope (self: super: { Cabal = self.Cabal_2_4_0_1; });
+  cabal-install = super.cabal-install.overrideScope (self: super: { Cabal = self.Cabal_2_4_1_0; });
 
   # The test suite depends on old versions of tasty and QuickCheck.
   hackage-security = dontCheck super.hackage-security;
@@ -1185,4 +1185,7 @@ self: super: {
   # });
   libnix = dontCheck super.libnix;
 
+  # https://github.com/jmillikin/chell/issues/1
+  chell = super.chell.override { patience = self.patience_0_1_1; };
+
 } // import ./configuration-tensorflow.nix {inherit pkgs haskellLib;} self super

pkgs/development/haskell-modules/configuration-ghc-8.4.x.nix

@@ -62,10 +62,10 @@ self: super: {
   # that have it as an actual library dependency. The explicit overrides are
   # more verbose but friendlier for Hydra.
   stack = (doJailbreak super.stack).override {
-    Cabal = self.Cabal_2_4_0_1;
+    Cabal = self.Cabal_2_4_1_0;
-    hpack = self.hpack_0_31_1.override { Cabal = self.Cabal_2_4_0_1; };
+    hpack = self.hpack_0_31_1.override { Cabal = self.Cabal_2_4_1_0; };
     yaml = self.yaml_0_11_0_0;
-    hackage-security = self.hackage-security.override { Cabal = self.Cabal_2_4_0_1; };
+    hackage-security = self.hackage-security.override { Cabal = self.Cabal_2_4_1_0; };
   };
   hpack_0_31_1 = super.hpack_0_31_1.override {
     yaml = self.yaml_0_11_0_0;

pkgs/development/haskell-modules/configuration-ghc-head.nix

@@ -40,7 +40,7 @@ self: super: {
   xhtml = null;
 
   # jailbreak-cabal can use the native Cabal library.
-  jailbreak-cabal = pkgs.haskell.packages.ghc802.jailbreak-cabal;
+  jailbreak-cabal = super.jailbreak-cabal.override { Cabal = null; };
 
   # haddock: No input file(s).
   nats = dontHaddock super.nats;

pkgs/development/haskell-modules/configuration-hackage2nix.yaml

@@ -2455,6 +2455,7 @@ extra-packages:
   - yesod-persistent < 1.5              # pre-lts-11.x versions neeed by git-annex 6.20180227
   - yesod-static ^>= 1.5                # pre-lts-11.x versions neeed by git-annex 6.20180227
   - yesod-test ^>= 1.5                  # pre-lts-11.x versions neeed by git-annex 6.20180227
+  - patience ^>= 0.1                    # required by chell-0.4.x
 
 package-maintainers:
   peti:
@@ -3008,6 +3009,7 @@ dont-distribute-packages:
   azure-servicebus:                             [ i686-linux, x86_64-linux, x86_64-darwin ]
   azurify:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
   b-tree:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
+  b9:                                             [ i686-linux, x86_64-linux, x86_64-darwin ]
   babylon:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
   backdropper:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
   backtracking-exceptions:                      [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -3070,6 +3072,7 @@ dont-distribute-packages:
   bench-show:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   BenchmarkHistory:                             [ i686-linux, x86_64-linux, x86_64-darwin ]
   benchpress:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
+  bencodex:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
   bencoding:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
   berkeleydb:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   BerkeleyDBXML:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -3492,6 +3495,7 @@ dont-distribute-packages:
   chuchu:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
   chunks:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
   chunky:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
+  church:                                         [ i686-linux, x86_64-linux, x86_64-darwin ]
   cielo:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
   cil:                                          [ i686-linux, x86_64-linux, x86_64-darwin ]
   cinvoke:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -3582,6 +3586,7 @@ dont-distribute-packages:
   CMQ:                                          [ i686-linux, x86_64-linux, x86_64-darwin ]
   cmv:                                          [ i686-linux, x86_64-linux, x86_64-darwin ]
   cnc-spec-compiler:                            [ i686-linux, x86_64-linux, x86_64-darwin ]
+  co-log-sys:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   co-log:                                         [ i686-linux, x86_64-linux, x86_64-darwin ]
   Coadjute:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   coalpit:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -3784,6 +3789,7 @@ dont-distribute-packages:
   cplusplus-th:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
   cprng-aes-effect:                             [ i686-linux, x86_64-linux, x86_64-darwin ]
   cpuperf:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
+  cpython:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
   cql-io:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
   cqrs-core:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
   cqrs-example:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -4146,6 +4152,9 @@ dont-distribute-packages:
   doctest-discover-configurator:                [ i686-linux, x86_64-linux, x86_64-darwin ]
   doctest-driver-gen:                           [ i686-linux, x86_64-linux, x86_64-darwin ]
   DocTest:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
+  docusign-base:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
+  docusign-client:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
+  docusign-example:                               [ i686-linux, x86_64-linux, x86_64-darwin ]
   docvim:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
   doi:                                          [ i686-linux, x86_64-linux, x86_64-darwin ]
   DOM:                                          [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -4253,6 +4262,7 @@ dont-distribute-packages:
   effects:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
   effin:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
   egison-quote:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
+  egison-tutorial:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
   ehaskell:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   ehs:                                          [ i686-linux, x86_64-linux, x86_64-darwin ]
   eibd-client-simple:                           [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -4408,6 +4418,7 @@ dont-distribute-packages:
   extemp:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
   extended-categories:                          [ i686-linux, x86_64-linux, x86_64-darwin ]
   extensible-data:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
+  extensible-effects-concurrent:                  [ i686-linux, x86_64-linux, x86_64-darwin ]
   Extra:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
   extract-dependencies:                         [ i686-linux, x86_64-linux, x86_64-darwin ]
   extractelf:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -4561,6 +4572,7 @@ dont-distribute-packages:
   flower:                                         [ i686-linux, x86_64-linux, x86_64-darwin ]
   flowlocks-framework:                            [ i686-linux, x86_64-linux, x86_64-darwin ]
   flowsim:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
+  fltkhs-fluid-examples:                          [ i686-linux, x86_64-linux, x86_64-darwin ]
   fluent-logger-conduit:                          [ i686-linux, x86_64-linux, x86_64-darwin ]
   fluent-logger:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
   fluidsynth:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -4679,6 +4691,7 @@ dont-distribute-packages:
   functor-infix:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
   functor:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
   functorm:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
+  funflow-nix:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
   funflow:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
   Fungi:                                          [ i686-linux, x86_64-linux, x86_64-darwin ]
   funion:                                         [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -4735,6 +4748,7 @@ dont-distribute-packages:
   generic-accessors:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
   generic-binary:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
   generic-church:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
+  generic-data-surgery:                           [ i686-linux, x86_64-linux, x86_64-darwin ]
   generic-data:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   generic-enum:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   generic-lens-labels:                            [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -4760,6 +4774,7 @@ dont-distribute-packages:
   GenSmsPdu:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
   gentlemark:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   GenussFold:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
+  genvalidity-hspec-optics:                       [ i686-linux, x86_64-linux, x86_64-darwin ]
   geo-resolver:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   GeocoderOpenCage:                               [ i686-linux, x86_64-linux, x86_64-darwin ]
   geodetic:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -4882,6 +4897,7 @@ dont-distribute-packages:
   gloss-banana:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   gloss-devil:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
   gloss-examples:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
+  gloss-export:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   gloss-game:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   gloss-juicy:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
   gloss-sodium:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -5134,6 +5150,7 @@ dont-distribute-packages:
   grpc-etcd-client:                               [ i686-linux, x86_64-linux, x86_64-darwin ]
   gruff-examples:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
   gruff:                                          [ i686-linux, x86_64-linux, x86_64-darwin ]
+  gscholar-rss:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   gsl-random-fu:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
   gsl-random:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   gstorable:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -5400,6 +5417,8 @@ dont-distribute-packages:
   haskell-tools-ast-fromghc:                      [ i686-linux, x86_64-linux, x86_64-darwin ]
   haskell-tools-ast-gen:                          [ i686-linux, x86_64-linux, x86_64-darwin ]
   haskell-tools-ast-trf:                          [ i686-linux, x86_64-linux, x86_64-darwin ]
+  haskell-tools-cli:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
+  haskell-tools-daemon:                           [ i686-linux, x86_64-linux, x86_64-darwin ]
   haskell-tor:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
   haskell-type-exts:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
   haskell-typescript:                             [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -5471,6 +5490,7 @@ dont-distribute-packages:
   hasktorch:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
   haskus-binary:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
   haskus-system-build:                            [ i686-linux, x86_64-linux, x86_64-darwin ]
+  haskus-utils-variant:                           [ i686-linux, x86_64-linux, x86_64-darwin ]
   haskus-utils:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   haslo:                                          [ i686-linux, x86_64-linux, x86_64-darwin ]
   hasloGUI:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -6258,6 +6278,7 @@ dont-distribute-packages:
   imperative-edsl-vhdl:                           [ i686-linux, x86_64-linux, x86_64-darwin ]
   imperative-edsl:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
   ImperativeHaskell:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
+  impl:                                           [ i686-linux, x86_64-linux, x86_64-darwin ]
   implicit-logging:                               [ i686-linux, x86_64-linux, x86_64-darwin ]
   implicit-params:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
   importify:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -6380,6 +6401,7 @@ dont-distribute-packages:
   JackMiniMix:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
   jackminimix:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
   jacobi-roots:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
+  jaeger-flamegraph:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
   jail:                                           [ i686-linux, x86_64-linux, x86_64-darwin ]
   jalaali:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
   jalla:                                          [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -6566,6 +6588,7 @@ dont-distribute-packages:
   lambda2js:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
   lambdaBase:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   lambdabot-utils:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
+  lambdabot-zulip:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
   lambdacms-core:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
   lambdacms-media:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
   lambdacube-bullet:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -7228,6 +7251,7 @@ dont-distribute-packages:
   multipass:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
   multipath:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
   multiplate-simplified:                          [ i686-linux, x86_64-linux, x86_64-darwin ]
+  multipool-persistent-postgresql:                [ i686-linux, x86_64-linux, x86_64-darwin ]
   multirec-alt-deriver:                           [ i686-linux, x86_64-linux, x86_64-darwin ]
   multirec-binary:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
   multirec:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -7296,6 +7320,7 @@ dont-distribute-packages:
   nanomsg:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
   nanoparsec:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   NanoProlog:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
+  nanovg-simple:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
   nanovg:                                         [ i686-linux, x86_64-linux, x86_64-darwin ]
   nanq:                                           [ i686-linux, x86_64-linux, x86_64-darwin ]
   Naperian:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -7454,6 +7479,7 @@ dont-distribute-packages:
   nymphaea:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
   o-clock:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
   oanda-rest-api:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
+  oauth2-jwt-bearer:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
   oauthenticated:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
   obd:                                            [ i686-linux, x86_64-linux, x86_64-darwin ]
   obdd:                                           [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -7501,6 +7527,7 @@ dont-distribute-packages:
   open-typerep:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   OpenAFP-Utils:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
   OpenAFP:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
+  openapi-petstore:                               [ i686-linux, x86_64-linux, x86_64-darwin ]
   opench-meteo:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   OpenCL:                                         [ i686-linux, x86_64-linux, x86_64-darwin ]
   OpenCLRaw:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -7744,6 +7771,7 @@ dont-distribute-packages:
   picoparsec:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   picosat:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
   pictikz:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
+  pier-core:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
   pier:                                           [ i686-linux, x86_64-linux, x86_64-darwin ]
   piet:                                           [ i686-linux, x86_64-linux, x86_64-darwin ]
   pinchot:                                        [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -7818,6 +7846,7 @@ dont-distribute-packages:
   pointless-lenses:                               [ i686-linux, x86_64-linux, x86_64-darwin ]
   pointless-rewrite:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
   pokemon-go-protobuf-types:                      [ i686-linux, x86_64-linux, x86_64-darwin ]
+  poker-eval:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   pokitdok:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
   polar-configfile:                               [ i686-linux, x86_64-linux, x86_64-darwin ]
   polar-shader:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -8571,6 +8600,7 @@ dont-distribute-packages:
   servant-auth-token:                             [ i686-linux, x86_64-linux, x86_64-darwin ]
   servant-checked-exceptions:                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   servant-client:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
+  servant-conduit:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
   servant-csharp:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
   servant-db-postgresql:                          [ i686-linux, x86_64-linux, x86_64-darwin ]
   servant-db:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -8584,8 +8614,11 @@ dont-distribute-packages:
   servant-iCalendar:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
   servant-jquery:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
   servant-js:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
+  servant-machines:                               [ i686-linux, x86_64-linux, x86_64-darwin ]
   servant-matrix-param:                           [ i686-linux, x86_64-linux, x86_64-darwin ]
+  servant-multipart:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
   servant-nix:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
+  servant-pipes:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
   servant-pool:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   servant-postgresql:                             [ i686-linux, x86_64-linux, x86_64-darwin ]
   servant-proto-lens:                             [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -8646,6 +8679,7 @@ dont-distribute-packages:
   shake-extras:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   shake-minify:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   shake-pack:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
+  shake-path:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   shake-persist:                                  [ i686-linux, x86_64-linux, x86_64-darwin ]
   shaker:                                         [ i686-linux, x86_64-linux, x86_64-darwin ]
   shakespeare-babel:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -9099,6 +9133,7 @@ dont-distribute-packages:
   supermonad:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   supero:                                         [ i686-linux, x86_64-linux, x86_64-darwin ]
   supervisor:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
+  supervisors:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
   supplemented:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   surjective:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   sv-cassava:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -9276,6 +9311,7 @@ dont-distribute-packages:
   texbuilder:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
   text-all:                                       [ i686-linux, x86_64-linux, x86_64-darwin ]
   text-and-plots:                                 [ i686-linux, x86_64-linux, x86_64-darwin ]
+  text-ansi:                                      [ i686-linux, x86_64-linux, x86_64-darwin ]
   text-builder:                                   [ i686-linux, x86_64-linux, x86_64-darwin ]
   text-containers:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
   text-format-heavy:                              [ i686-linux, x86_64-linux, x86_64-darwin ]
@@ -9793,6 +9829,7 @@ dont-distribute-packages:
   wai-request-spec:                               [ i686-linux, x86_64-linux, x86_64-darwin ]
   wai-responsible:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
   wai-router:                                     [ i686-linux, x86_64-linux, x86_64-darwin ]
+  wai-routing:                                    [ i686-linux, x86_64-linux, x86_64-darwin ]
   wai-secure-cookies:                             [ i686-linux, x86_64-linux, x86_64-darwin ]
   wai-session-alt:                                [ i686-linux, x86_64-linux, x86_64-darwin ]
   wai-session-mysql:                              [ i686-linux, x86_64-linux, x86_64-darwin ]

pkgs/development/libraries/confuse/default.nix

@@ -1,17 +0,0 @@
-{stdenv, fetchurl}:
-
-stdenv.mkDerivation rec {
-  name = "confuse-${version}";
-  version = "3.2.1";
-  src = fetchurl {
-    url = "https://github.com/martinh/libconfuse/releases/download/v${version}/${name}.tar.xz";
-    sha256 = "0pnjmlj9i0alp407qd7c0vq83sz7gpsjrbdgpcn4xvzjp9r35ii3";
-  };
-
-  meta = {
-    homepage = http://www.nongnu.org/confuse/;
-    description = "Configuration file parser library";
-    license = stdenv.lib.licenses.isc;
-    platforms = stdenv.lib.platforms.unix;
-  };
-}

pkgs/development/libraries/grpc/default.nix

@@ -1,13 +1,13 @@
 { stdenv, fetchFromGitHub, cmake, zlib, c-ares, pkgconfig, openssl, protobuf, gflags }:
 
 stdenv.mkDerivation rec {
-  version = "1.15.0";
+  version = "1.16.1";
   name = "grpc-${version}";
   src = fetchFromGitHub {
     owner = "grpc";
     repo = "grpc";
-    rev= "d2c7d4dea492b9a86a53555aabdbfa90c2b01730";
+    rev = "v${version}";
-    sha256 = "1dpnhc5kw7znivrnjx1gva57v6b548am4v5nvh3dkwwzsa1k6vkv";
+    sha256 = "1jimqz3115f9pli5w6ik9wi7mjc7ix6y7yrq4a1ab9fc3dalj7p2";
   };
   nativeBuildInputs = [ cmake pkgconfig ];
   buildInputs = [ zlib c-ares c-ares.cmake-config openssl protobuf gflags ];

pkgs/development/libraries/libftdi/1.x.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, cmake, pkgconfig, libusb1, confuse
+{ stdenv, fetchurl, cmake, pkgconfig, libusb1, libconfuse
 , cppSupport ? true, boost ? null
 , pythonSupport ? true, python ? null, swig ? null
 , docSupport ? true, doxygen ? null
@@ -16,8 +16,8 @@ stdenv.mkDerivation rec {
     sha256 = "0x0vncf6i92slgrn0h7ghkskqbglbs534220qa84d0qg114zndpc";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ cmake pkgconfig ];
-  buildInputs = with stdenv.lib; [ cmake confuse ]
+  buildInputs = with stdenv.lib; [ libconfuse ]
     ++ optionals cppSupport [ boost ]
     ++ optionals pythonSupport [ python swig ]
     ++ optionals docSupport [ doxygen ];

pkgs/development/libraries/taglib/1.9.nix

@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   name = "taglib-1.9.1";
 
   src = fetchurl {
-    url = http://taglib.github.io/releases/taglib-1.9.1.tar.gz;
+    url = https://taglib.github.io/releases/taglib-1.9.1.tar.gz;
     sha256 = "06n7gnbcqa3r6c9gv00y0y1r48dyyazm6yj403i7ma0r2k6p3lvj";
   };
 
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ zlib ];
 
   meta = {
-    homepage = http://developer.kde.org/~wheeler/taglib.html;
+    homepage = https://taglib.org/;
     repositories.git = git://github.com/taglib/taglib.git;
     description = "A library for reading and editing the meta-data of several popular audio formats";
     inherit (cmake.meta) platforms;

pkgs/development/perl-modules/catalyst-fix-chunked-encoding.patch

@@ -1,23 +0,0 @@
-diff -rc Catalyst-Engine-HTTP-Prefork-0.50-orig/lib/Catalyst/Engine/HTTP/Prefork/Handler.pm Catalyst-Engine-HTTP-Prefork-0.50/lib/Catalyst/Engine/HTTP/Prefork/Handler.pm
-*** Catalyst-Engine-HTTP-Prefork-0.50-orig/lib/Catalyst/Engine/HTTP/Prefork/Handler.pm	2008-03-14 18:23:47.000000000 +0100
---- Catalyst-Engine-HTTP-Prefork-0.50/lib/Catalyst/Engine/HTTP/Prefork/Handler.pm	2009-03-11 14:18:40.000000000 +0100
-***************
-*** 199,206 ****
-      
-      if ( $self->{_chunked_res} ) {
-          if ( !$self->{_chunked_done} ) {
-!             # Write the final '0' chunk
-!             syswrite STDOUT, "0$CRLF";
-          }
-          
-          delete $self->{_chunked_res};
---- 199,207 ----
-      
-      if ( $self->{_chunked_res} ) {
-          if ( !$self->{_chunked_done} ) {
-!             # Write the final '0' chunk and the CRLF that terminates
-!             # the chunked body.
-!             syswrite STDOUT, "0$CRLF$CRLF";
-          }
-          
-          delete $self->{_chunked_res};

pkgs/development/python-modules/affine/default.nix

@@ -0,0 +1,22 @@
+{ buildPythonPackage, pytest, lib, fetchPypi }:
+
+buildPythonPackage rec {
+  pname = "affine";
+  version = "2.2.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0j3mvcnmgjvvm0znqyf7xylq7i89zjf4dq0g8280xs6bwbl5cvih";
+  };
+
+  checkInputs = [ pytest ];
+  checkPhase = "py.test";
+
+  meta = with lib; {
+    description = "Matrices describing affine transformation of the plane";
+    license = licenses.bsd3;
+    homepage = https://github.com/sgillies/affine;
+    maintainers = with maintainers; [ mredaelli ];
+  };
+
+}

pkgs/development/python-modules/cartopy/default.nix

@@ -0,0 +1,46 @@
+{ buildPythonPackage, lib, fetchPypi
+, pytest, filelock, mock, pep8
+, cython, isPy37, glibcLocales
+, six, pyshp, shapely, geos, proj, numpy
+, gdal, pillow, matplotlib, pyepsg, pykdtree, scipy, owslib, fiona
+}:
+
+buildPythonPackage rec {
+  pname = "cartopy";
+  version = "0.17.0";
+
+  src = fetchPypi {
+    inherit version;
+    pname = "Cartopy";
+    sha256 = "0q9ckfi37cxj7jwnqnzij62vwcf4krccx576vv5lhvpgvplxjjs2";
+  };
+
+  checkInputs = [ filelock mock pytest pep8 ];
+
+  # several tests require network connectivity: we disable them
+  checkPhase = ''
+    export HOME=$(mktemp -d)
+    pytest --pyargs cartopy \
+      -m "not network and not natural_earth" \
+      -k "not test_nightshade_image"
+  '';
+
+  buildInputs = [ cython glibcLocales ];
+  LC_ALL = "en_US.UTF-8";
+
+  propagatedBuildInputs = [
+    # required
+    six pyshp shapely geos proj numpy
+
+    # optional
+    gdal pillow matplotlib pyepsg pykdtree scipy fiona owslib
+  ];
+
+  meta = with lib; {
+    description = "Process geospatial data to create maps and perform analyses";
+    license = licenses.lgpl3;
+    homepage = https://scitools.org.uk/cartopy/docs/latest/;
+    maintainers = with maintainers; [ mredaelli ];
+  };
+
+}

pkgs/development/python-modules/configshell/default.nix

@@ -0,0 +1,21 @@
+{ stdenv, fetchFromGitHub, buildPythonPackage, pyparsing, six }:
+
+buildPythonPackage rec {
+  pname = "configshell";
+  version = "1.1.fb25";
+
+  src = fetchFromGitHub {
+    owner = "open-iscsi";
+    repo ="${pname}-fb";
+    rev = "v${version}";
+    sha256 = "0zpr2n4105qqsklyfyr9lzl1rhxjcv0mnsl57hgk0m763w6na90h";
+  };
+
+  propagatedBuildInputs = [ pyparsing six ];
+
+  meta = with stdenv.lib; {
+    description = "A Python library for building configuration shells";
+    homepage = https://github.com/open-iscsi/configshell-fb;
+    license = licenses.asl20;
+  };
+}

pkgs/development/python-modules/gentools/default.nix

@@ -0,0 +1,31 @@
+{ buildPythonPackage, lib, fetchFromGitHub, pytest
+, typing, funcsigs, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "gentools";
+  version = "1.1.0";
+
+  # Pypi doesn't ship the tests, so we fetch directly from GitHub
+  src = fetchFromGitHub {
+    owner = "ariebovenberg";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1sm6cqi7fv2k3pc68r7wvvjjz8y6cjmz8bvxgqfa4v4wxibwnwrl";
+  };
+
+  propagatedBuildInputs =
+    lib.optionals (pythonOlder "3.5") [ typing ] ++
+    lib.optionals (pythonOlder "3.4") [ funcsigs ];
+
+  checkInputs = [ pytest ];
+  checkPhase = "pytest";
+
+  meta = with lib; {
+    description = "Tools for generators, generator functions, and generator-based coroutines";
+    license = licenses.mit;
+    homepage = http://gentools.readthedocs.io/;
+    maintainers = with maintainers; [ mredaelli ];
+  };
+
+}

pkgs/development/python-modules/grpcio-tools/default.nix

@@ -2,16 +2,16 @@
 
 buildPythonPackage rec {
   pname = "grpcio-tools";
-  version = "1.14.2";
+  version = "1.16.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b3fd64a5b8c1d981f6d68a331449109633710a346051c44e0f0cca1812e2b4b0";
+    sha256 = "0h0w7jlggm8nc250wwqai7lihw8mymx9jjpkl0cdmqmwbypj72vd";
   };
 
   enableParallelBuilding = true;
 
-  propagatedBuildInputs = [ grpc grpcio ];
+  propagatedBuildInputs = [ grpcio ];
 
   # no tests in the package
   doCheck = false;

pkgs/development/python-modules/grpcio/default.nix

@@ -4,11 +4,11 @@
 with stdenv.lib;
 buildPythonPackage rec {
   pname = "grpcio";
-  version = "1.15.0";
+  version = "1.16.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1lhh76kgyibgsk6c54nbzzhkskknkbvn71xvixsk0prfp8izr98m";
+    sha256 = "0am76f8r4v5kcvbar593n2c1mp25cxi67cxigjhd0rnncmk4bgs1";
   };
 
   nativeBuildInputs = [ pkgconfig ] ++ optional stdenv.isDarwin darwin.cctools;

pkgs/development/python-modules/manuel/default.nix

@@ -7,14 +7,15 @@
 
 buildPythonPackage rec {
   pname = "manuel";
-  version = "1.8.0";
+  version = "1.10.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1diyj6a8bvz2cdf9m0g2bbx9z2yjjnn3ylbg1zinpcjj6vldfx59";
+    sha256 = "1bdzay7j70fly5fy6wbdi8fbrxjrrlxnxnw226rwry1c8a351rpy";
   };
 
-  propagatedBuildInputs = [ six zope_testing ];
+  propagatedBuildInputs = [ six ];
+  checkInputs = [ zope_testing ];
 
   meta = with stdenv.lib; {
     description = "A documentation builder";

pkgs/development/python-modules/netaddr/default.nix

@@ -18,7 +18,10 @@ buildPythonPackage rec {
   buildInputs = [ pkgs.glibcLocales pytest ];
 
   checkPhase = ''
-    py.test netaddr/tests
+    # fails on python3.7: https://github.com/drkjam/netaddr/issues/182
+    py.test \
+      -k 'not test_ip_splitter_remove_prefix_larger_than_input_range' \
+      netaddr/tests
   '';
 
   patches = [

pkgs/development/python-modules/nvchecker/default.nix

@@ -1,16 +1,15 @@
-{ stdenv, buildPythonPackage, fetchPypi, pythonOlder, pytest, setuptools, structlog, pytest-asyncio, pytest_xdist, flaky, tornado }:
+{ stdenv, buildPythonPackage, fetchPypi, pythonOlder, pytest, setuptools, structlog, pytest-asyncio, pytest_xdist, flaky, tornado, pycurl }:
 
 buildPythonPackage rec {
   pname = "nvchecker";
-  version = "1.1";
+  version = "1.2.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1nk9ff26s5r6v5v7w4l9110qi5kmhllvwk5kh20zyyhdvxv72m3i";
+    sha256 = "19qc2wwkdr701mx94r75ayq5h2jz3q620hcqaj2ng9qdgxm90940";
   };
 
-  # tornado is not present in the tarball setup.py but is required by the executable
+  propagatedBuildInputs = [ setuptools structlog tornado pycurl ];
-  propagatedBuildInputs = [ setuptools structlog tornado ];
   checkInputs = [ pytest pytest-asyncio pytest_xdist flaky ];
 
   # Disable tests for now, because our version of pytest seems to be too new

pkgs/development/python-modules/pandas/default.nix

@@ -87,6 +87,8 @@ in buildPythonPackage rec {
     "test_clipboard"
   ]);
 
+  doCheck = !stdenv.isAarch64; # upstream doesn't test this architecture
+
   checkPhase = ''
     runHook preCheck
   ''

pkgs/development/python-modules/plotly/default.nix

@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "plotly";
-  version = "3.3.0";
+  version = "3.4.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1bsjk4crf9p08lmgmiibmk8w8kmlrfadyly5l12zz1d330acijl1";
+    sha256 = "1pq5k1b4gwdbdsb0alzgmr54zjvzf0csw5lq8s61zh5jnhfgn23y";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/protobuf/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, python, buildPythonPackage
+{ stdenv, fetchpatch, python, buildPythonPackage
 , protobuf, google_apputils, pyext, libcxx
 , disabled, doCheck ? true }:
 
@@ -16,6 +16,15 @@ buildPythonPackage rec {
   propagatedBuildInputs = [ protobuf google_apputils ];
   buildInputs = [ google_apputils pyext ];
 
+  patches = [
+    # Python 3.7 compatibility (remove when protobuf 3.7 is released)
+    (fetchpatch {
+      url = "https://github.com/protocolbuffers/protobuf/commit/0a59054c30e4f0ba10f10acfc1d7f3814c63e1a7.patch";
+      sha256 = "09hw22y3423v8bbmc9xm07znwdxfbya6rp78d4zqw6fisdvjkqf1";
+      stripLen = 1;
+    })
+  ];
+
   prePatch = ''
     while [ ! -d python ]; do
       cd *

pkgs/development/python-modules/pyepsg/default.nix

@@ -0,0 +1,23 @@
+{ buildPythonPackage, lib, fetchPypi, requests }:
+
+buildPythonPackage rec {
+  pname = "pyepsg";
+  version = "0.3.2";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0ng0k140kzq3xcffi4vy10py4cmwzfy8anccysw3vgn1x30ghzjr";
+  };
+
+  propagatedBuildInputs = [ requests ];
+
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Simple Python interface to epsg.io";
+    license = licenses.lgpl3;
+    homepage = https://pyepsg.readthedocs.io/en/latest/;
+    maintainers = with maintainers; [ mredaelli ];
+  };
+
+}

pkgs/development/python-modules/pyupdate/default.nix

@@ -0,0 +1,28 @@
+{ stdenv, buildPythonPackage, fetchPypi, isPy3k
+, requests }:
+
+buildPythonPackage rec {
+  pname = "pyupdate";
+  version = "0.2.16";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1p4zpjvwy6h9kr0dp80z5k04s14r9f75jg9481gpx8ygxj0l29bi";
+  };
+
+  propagatedBuildInputs = [ requests ];
+
+  # As of 0.2.16, pyupdate is intimately tied to Home Assistant which is py3 only
+  disabled = !isPy3k;
+
+  # no tests
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    # This description is terrible, but it's what upstream uses.
+    description = "Package to update stuff";
+    homepage = https://github.com/ludeeus/pyupdate;
+    license = licenses.mit;
+    maintainers = with maintainers; [ peterhoeg ];
+  };
+}

pkgs/development/python-modules/rasterio/default.nix

@@ -0,0 +1,29 @@
+{ buildPythonPackage, lib, fetchFromGitHub
+, cython
+, numpy, affine, attrs, cligj, click-plugins, snuggs, gdal
+, pytest, pytestcov, packaging, hypothesis, boto3
+}:
+
+buildPythonPackage rec {
+  pname = "rasterio";
+  version = "1.0.10";
+
+  # Pypi doesn't ship the tests, so we fetch directly from GitHub
+  src = fetchFromGitHub {
+    owner = "mapbox";
+    repo = "rasterio";
+    rev = version;
+    sha256 = "0gnck9y3n31nnazlrw54swab8wql9qjx5r5x9r7hrmzy72xlzjqq";
+  };
+
+  checkInputs = [ boto3 pytest pytestcov packaging hypothesis ];
+  buildInputs = [ cython ];
+  propagatedBuildInputs = [ gdal numpy attrs affine cligj click-plugins snuggs ];
+
+  meta = with lib; {
+    description = "Python package to read and write geospatial raster data";
+    license = licenses.bsd3;
+    homepage = https://rasterio.readthedocs.io/en/latest/;
+    maintainers = with maintainers; [ mredaelli ];
+  };
+}

pkgs/development/python-modules/rope/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, buildPythonPackage, fetchPypi }:
+{ stdenv, buildPythonPackage, fetchPypi, nose }:
 
 buildPythonPackage rec {
   pname = "rope";
@@ -9,6 +9,12 @@ buildPythonPackage rec {
     sha256 = "a108c445e1cd897fe19272ab7877d172e7faf3d4148c80e7d20faba42ea8f7b2";
   };
 
+  checkInputs = [ nose ];
+  checkPhase = ''
+    # tracked upstream here https://github.com/python-rope/rope/issues/247
+    NOSE_IGNORE_FILES=type_hinting_test.py nosetests ropetest
+  '';
+
   meta = with stdenv.lib; {
     description = "Python refactoring library";
     homepage = https://github.com/python-rope/rope;

pkgs/development/python-modules/rpy2/default.nix

@@ -1,10 +1,13 @@
 { lib
+, python
 , buildPythonPackage
 , fetchPypi
 , isPyPy
 , isPy27
 , readline
 , R
+, rWrapper
+, rPackages
 , pcre
 , lzma
 , bzip2
@@ -13,7 +16,11 @@
 , singledispatch
 , six
 , jinja2
+, pytz
+, numpy
 , pytest
+, mock
+, extraRPackages ? []
 }:
 
 buildPythonPackage rec {
@@ -38,18 +45,54 @@ buildPythonPackage rec {
       bzip2
       zlib
       icu
+    ] ++ (with rPackages; [
+      # packages expected by the test framework
+      ggplot2
+      dplyr
+      RSQLite
+      broom
+      DBI
+      dbplyr
+      hexbin
+      lme4
+      tidyr
+    ]) ++ extraRPackages ++ rWrapper.recommendedPackages;
+
+    patches = [
+      # R_LIBS_SITE is used by the nix r package to point to the installed R libraries.
+      # This patch sets R_LIBS_SITE when rpy2 is imported.
+      ./r-libs-site.patch
     ];
+    postPatch = ''
+      substituteInPlace rpy/rinterface/__init__.py --replace '@NIX_R_LIBS_SITE@' "$R_LIBS_SITE"
+    '';
+
     propagatedBuildInputs = [
       singledispatch
       six
       jinja2
+      pytz
+      numpy
     ];
-    checkInputs = [ pytest ];
+
-    # Tests fail with `assert not _relpath.startswith('..'), "Path must be within the project"`
+    checkInputs = [
-    # in the unittest `loader.py`. I don't know what causes this.
+      pytest
+      mock
+    ];
+    # One remaining test failure caused by different unicode encoding.
+    # https://bitbucket.org/rpy2/rpy2/issues/488
     doCheck = false;
-    # without this tests fail when looking for libreadline.so
+    checkPhase = ''
-    LD_LIBRARY_PATH = lib.makeLibraryPath buildInputs;
+      ${python.interpreter} -m 'rpy2.tests'
+    '';
+
+    # For some reason libreadline.so is not found. Curiously `ldd _rinterface.so | grep readline` shows two readline entries:
+    # libreadline.so.6 => not found
+    # libreadline.so.6 => /nix/store/z2zhmrg6jcrn5iq2779mav0nnq4vm2q6-readline-6.3p08/lib/libreadline.so.6 (0x00007f333ac43000)
+    # There must be a better way to fix this, but I don't know it.
+    postFixup = ''
+      patchelf --add-needed ${readline}/lib/libreadline.so "$out/${python.sitePackages}/rpy2/rinterface/"_rinterface*.so
+    '';
 
     meta = {
       homepage = http://rpy.sourceforge.net/rpy2;

pkgs/development/python-modules/rpy2/r-libs-site.patch

@@ -0,0 +1,20 @@
+diff --git a/rpy/rinterface/__init__.py b/rpy/rinterface/__init__.py
+index 9362e57..1af258e 100644
+--- a/rpy/rinterface/__init__.py
++++ b/rpy/rinterface/__init__.py
+@@ -43,6 +43,15 @@ if not R_HOME:
+ if not os.environ.get("R_HOME"):
+     os.environ['R_HOME'] = R_HOME
+ 
++# path to libraries
++existing = os.environ.get('R_LIBS_SITE')
++if existing is not None:
++    prefix = existing + ':'
++else:
++    prefix = ''
++additional = '@NIX_R_LIBS_SITE@'
++os.environ['R_LIBS_SITE'] = prefix + additional
++
+ if sys.platform == 'win32':
+     _load_r_dll(R_HOME)
+ 

pkgs/development/python-modules/rtslib/default.nix

@@ -0,0 +1,21 @@
+{ stdenv, fetchFromGitHub, buildPythonPackage, six, pyudev, pygobject3 }:
+
+buildPythonPackage rec {
+  pname = "rtslib";
+  version = "2.1.fb69";
+
+  src = fetchFromGitHub {
+    owner = "open-iscsi";
+    repo ="${pname}-fb";
+    rev = "v${version}";
+    sha256 = "17rlcrd9757nq91pa8xjr7147k7mxxp8zdka7arhlgsp3kcnbsfd";
+  };
+
+  propagatedBuildInputs = [ six pyudev pygobject3 ];
+
+  meta = with stdenv.lib; {
+    description = "A Python object API for managing the Linux LIO kernel target";
+    homepage = https://github.com/open-iscsi/rtslib-fb;
+    license = licenses.asl20;
+  };
+}

pkgs/development/python-modules/simplekml/default.nix

@@ -0,0 +1,20 @@
+{ lib , buildPythonPackage , fetchPypi }:
+
+buildPythonPackage rec {
+  pname = "simplekml";
+  version = "1.3.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "30c121368ce1d73405721730bf766721e580cae6fbb7424884c734c89ec62ad7";
+  };
+
+  doCheck = false; # no tests are defined in 1.3.1
+
+  meta = with lib; {
+    description = "Generate KML with as little effort as possible";
+    homepage =  https://readthedocs.org/projects/simplekml/;
+    license = licenses.lgpl3Plus;
+    maintainers = with maintainers; [ rvolosatovs ];
+  };
+}

pkgs/development/python-modules/snug/default.nix

@@ -0,0 +1,37 @@
+{ buildPythonPackage, lib, fetchFromGitHub, glibcLocales
+, pytest, pytest-mock, gentools
+, typing, singledispatch, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "snug";
+  version = "1.3.4";
+
+  # Pypi doesn't ship the tests, so we fetch directly from GitHub
+  src = fetchFromGitHub {
+    owner = "ariebovenberg";
+    repo = "snug";
+    rev = "v${version}";
+    sha256 = "0jmg0sivz9ljazlnsrrqaizrb3r7asy5pa0dj3idx49gbig4589i";
+  };
+
+  # Prevent unicode decoding error in setup.py
+  # while reading README.rst and HISTORY.rst
+  buildInputs = [ glibcLocales ];
+  LC_ALL = "en_US.UTF-8";
+
+  propagatedBuildInputs =
+    lib.optionals (pythonOlder "3.4") [ singledispatch ] ++
+    lib.optionals (pythonOlder "3.5") [ typing ];
+
+  checkInputs = [ pytest pytest-mock gentools ];
+  checkPhase = "pytest";
+
+  meta = with lib; {
+    description = "Tiny toolkit for writing reusable interactions with web APIs";
+    license = licenses.mit;
+    homepage = https://snug.readthedocs.io/en/latest/;
+    maintainers = with maintainers; [ mredaelli ];
+  };
+
+}

pkgs/development/python-modules/snuggs/default.nix

@@ -0,0 +1,29 @@
+{ buildPythonPackage, lib, fetchFromGitHub
+, click, numpy, pyparsing
+, pytest
+}:
+
+buildPythonPackage rec {
+  pname = "snuggs";
+  version = "1.4.2";
+
+  # Pypi doesn't ship the tests, so we fetch directly from GitHub
+  src = fetchFromGitHub {
+    owner = "mapbox";
+    repo = pname;
+    rev = version;
+    sha256 = "1q6jqwai4qgghdjgwhyx3yz8mlrm7p1vvnwc339lfl028hrgb5kb";
+  };
+
+  propagatedBuildInputs = [ click numpy pyparsing ];
+
+  checkInputs = [ pytest ];
+  checkPhase = "pytest test_snuggs.py";
+
+  meta = with lib; {
+    description = "S-expressions for Numpy";
+    license = licenses.mit;
+    homepage = https://github.com/mapbox/snuggs;
+    maintainers = with maintainers; [ mredaelli ];
+  };
+}

pkgs/development/python-modules/yattag/default.nix

@@ -0,0 +1,17 @@
+{ lib, stdenv, buildPythonPackage, fetchPypi }:
+
+buildPythonPackage rec {
+  pname = "yattag";
+  version = "1.10.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0r3pwfygvpkgc0hzxc6z8dl56g6brlh52r0x8kcjhywr1biahqb2";
+  };
+
+  meta = with lib; {
+    description = "Generate HTML or XML in a pythonic way. Pure python alternative to web template engines. Can fill HTML forms with default values and error messages.";
+    license = [ licenses.lgpl21 ];
+    homepage = http://www.yattag.org/;
+  };
+}

pkgs/development/r-modules/wrapper.nix

@@ -5,6 +5,9 @@ stdenv.mkDerivation {
 
   buildInputs = [makeWrapper R] ++ recommendedPackages ++ packages;
 
+  # Make the list of recommended R packages accessible to other packages such as rpy2
+  passthru.recommendedPackages = recommendedPackages;
+
   unpackPhase = ":";
 
   installPhase = ''

pkgs/development/tools/build-managers/rake/Gemfile.lock

@@ -1,7 +1,7 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    rake (12.0.0)
+    rake (12.3.1)
 
 PLATFORMS
   ruby
@@ -10,4 +10,4 @@ DEPENDENCIES
   rake
 
 BUNDLED WITH
-   1.14.6
+   1.17.1

pkgs/development/tools/build-managers/rake/gemset.nix

@@ -2,9 +2,9 @@
   rake = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "01j8fc9bqjnrsxbppncai05h43315vmz9fwg28qdsgcjw9ck1d7n";
+      sha256 = "1idi53jay34ba9j68c3mfr9wwkg3cd9qh0fn9cg42hv72c6q8dyg";
       type = "gem";
     };
-    version = "12.0.0";
+    version = "12.3.1";
   };
 }

pkgs/development/tools/continuous-integration/gitlab-runner/default.nix

@@ -1,16 +1,16 @@
 { lib, buildGoPackage, fetchFromGitLab, fetchurl }:
 
 let
-  version = "11.4.0";
+  version = "11.5.0";
   # Gitlab runner embeds some docker images these are prebuilt for arm and x86_64
   docker_x86_64 = fetchurl {
     url = "https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/helper-images/prebuilt-x86_64.tar.xz";
-    sha256 = "1vzp9d7dygb44b9x6vfl913fggjkiimzjj9arybn468rc2kh0si6";
+    sha256 = "1siiws19qzfv2nnyp9fy215yd08iv70x830b61kr1742ywc0jcbn";
   };
 
   docker_arm = fetchurl {
     url = "https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/helper-images/prebuilt-arm.tar.xz";
-    sha256 = "1krfd6ffzc78g7k04bkk32vzingplhn176jhw4p1ys19f4sqf5sw";
+    sha256 = "0d7wnpry4861dcmpspbaar97mkf0jf2bcxvr4nph9xnkw8w7fs2z";
   };
 in
 buildGoPackage rec {
@@ -29,7 +29,7 @@ buildGoPackage rec {
     owner = "gitlab-org";
     repo = "gitlab-runner";
     rev = "v${version}";
-    sha256 = "0nhqnw6nk5q716ir0vdkqy0jj1vbxz014jx080zk44cdj7l62lrm";
+    sha256 = "028bl249yfccdnwskbn6sxzf1xsg94chbm107n2h83j7a81cz8kw";
   };
 
   patches = [ ./fix-shell-path.patch ];

pkgs/development/tools/database/sqlite-web/default.nix

@@ -0,0 +1,25 @@
+{ lib
+, python3Packages
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "sqlite-web";
+  version = "0.3.5";
+
+  src = python3Packages.fetchPypi {
+    inherit pname version;
+    sha256 = "9e0c8938434b0129423544162d4ca6975abf7042c131445f79661a4b9c885d47";
+  };
+
+  propagatedBuildInputs = with python3Packages; [ flask peewee pygments ];
+
+  # no tests in repository
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Web-based SQLite database browser";
+    homepage = https://github.com/coleifer/sqlite-web;
+    license = licenses.mit;
+    maintainers = [ maintainers.costrouc ];
+  };
+}

pkgs/development/tools/fusee-launcher/default.nix

@@ -0,0 +1,43 @@
+{ stdenv
+, lib
+, python3Packages
+, python3
+, fetchFromGitHub
+, pkgsCross
+, makeWrapper
+} :
+
+stdenv.mkDerivation rec {
+  name = "fusee-launcher-${version}";
+  version = "unstable-2018-07-14";
+
+  src = fetchFromGitHub {
+    owner = "Cease-and-DeSwitch";
+    repo = "fusee-launcher";
+    rev = "265e8f3e1987751ec41db6f1946d132b296aba43";
+    sha256 = "1pqkgw5bk0xcz9x7pc1f0r0b9nsc8jnnvcs1315d8ml8mx23fshm";
+  };
+
+  installPhase = ''
+    mkdir -p $out/bin $out/share
+    cp fusee-launcher.py $out/bin/fusee-launcher
+    cp intermezzo.bin $out/share/intermezzo.bin
+
+    # Wrap with path to intermezzo.bin relocator binary in /share
+    wrapProgram $out/bin/fusee-launcher \
+      --add-flags "--relocator $out/share/intermezzo.bin" \
+      --prefix PYTHONPATH : "$PYTHONPATH:$(toPythonPath $out)"
+  '';
+
+  nativeBuildInputs = [ pkgsCross.arm-embedded.buildPackages.gcc makeWrapper python3Packages.wrapPython ];
+  buildInputs = [ python3 python3Packages.pyusb ];
+  pythonPath = with python3Packages; [ pyusb ];
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/Cease-and-DeSwitch/fusee-launcher;
+    description = "Work-in-progress launcher for one of the Tegra X1 bootROM exploits";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ pneumaticat ];
+  };
+
+}

pkgs/development/tools/gauge/default.nix

@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "gauge-${version}";
-  version = "1.0.2";
+  version = "1.0.3";
 
   goPackagePath = "github.com/getgauge/gauge";
   excludedPackages = ''\(build\|man\)'';
@@ -11,7 +11,7 @@ buildGoPackage rec {
     owner = "getgauge";
     repo = "gauge";
     rev = "v${version}";
-    sha256 = "0cnhkxfw78i4lgkbrk87hgrjh98f0z6a97g77c9av20z4962hmfy";
+    sha256 = "0dcsgszg6ilf3sxan3ahf9cfpw66z3mh2svg2srxv8ici3ak8a2x";
   };
 
   meta = with stdenv.lib; {

pkgs/development/tools/kubicorn/default.nix

@@ -0,0 +1,26 @@
+{ stdenv, lib, buildGoPackage, fetchFromGitHub }:
+
+with stdenv.lib;
+
+buildGoPackage rec {
+  name = "kubicorn-${version}";
+  version = "2018-10-13-${stdenv.lib.strings.substring 0 7 rev}";
+  rev = "4c7f3623e9188fba43778271afe161a4facfb657";
+
+  src = fetchFromGitHub {
+    rev = rev;
+    owner = "kubicorn";
+    repo = "kubicorn";
+    sha256 = "18h5sj4lcivrwjq2hzn7c3g4mblw17zicb5nma8sh7sakwzyg1k9";
+  };
+
+  subPackages = ["."];
+  goPackagePath = "github.com/kubicorn/kubicorn";
+
+  meta = {
+    description = "Simple, cloud native infrastructure for Kubernetes";
+    homepage = http://kubicorn.io/;
+    maintainers = with stdenv.lib.maintainers; [ offline ];
+    license = stdenv.lib.licenses.asl20;
+  };
+}

pkgs/development/tools/pew/default.nix

@@ -11,6 +11,8 @@ with python3Packages; buildPythonApplication rec {
 
     propagatedBuildInputs = [ virtualenv virtualenv-clone setuptools ];
 
+    LC_ALL = "en_US.UTF-8";
+
     postFixup = ''
       set -euo pipefail
       PEW_SITE="$out/lib/${python.libPrefix}/site-packages"
@@ -24,6 +26,7 @@ with python3Packages; buildPythonApplication rec {
     '';
 
     meta = with stdenv.lib; {
+      homepage = https://github.com/berdario/pew;
       description = "Tools to manage multiple virtualenvs written in pure python";
       license = licenses.mit;
       platforms = platforms.all;

pkgs/games/crack-attack/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, gtk2, freeglut, SDL, libGLU_combined, libXi, libXmu}:
+{ stdenv, fetchurl, pkgconfig, gtk2, freeglut, SDL, SDL_mixer, libGLU_combined, libXi, libXmu }:
 
 stdenv.mkDerivation {
   name = "crack-attack-1.1.14";
@@ -8,10 +8,18 @@ stdenv.mkDerivation {
     sha256 = "1sakj9a2q05brpd7lkqxi8q30bccycdzd96ns00s6jbxrzjlijkm";
   };
 
+  patches = [
+    ./crack-attack-1.1.14-gcc43.patch
+    ./crack-attack-1.1.14-glut.patch
+  ];
+
+  configureFlags = [ "--enable-sound=yes" ];
+
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ gtk2 freeglut SDL libGLU_combined libXi libXmu ];
+  buildInputs = [ gtk2 freeglut SDL SDL_mixer libGLU_combined libXi libXmu ];
 
   hardeningDisable = [ "format" ];
+  enableParallelBuilding = true;
 
   meta = {
     description = "A fast-paced puzzle game inspired by the classic Super NES title Tetris Attack!";
@@ -20,9 +28,4 @@ stdenv.mkDerivation {
     platforms = stdenv.lib.platforms.linux;
     maintainers = [ stdenv.lib.maintainers.piotr ];
   };
-
-  patches = [
-    ./crack-attack-1.1.14-gcc43.patch
-    ./crack-attack-1.1.14-glut.patch
-  ];
 }

pkgs/misc/cups/drivers/estudio/default.nix

@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
       TOSHIBA e-STUDIO6540C, TOSHIBA e-STUDIO6550C, TOSHIBA e-STUDIO6560C,
       TOSHIBA e-STUDIO6570C and TOSHIBA e-STUDIO7506AC.
     '';
-    homepage = https://www.toshiba-business.com.au/support/drivers;
+    homepage = http://business.toshiba.com/support/downloads/index.html;
     license = licenses.unfree;
     maintainers = [ maintainers.jpotier ];
   };

pkgs/misc/themes/nordic/default.nix

@@ -2,16 +2,16 @@
 
 stdenv.mkDerivation rec {
   name = "nordic-${version}";
-  version = "1.2.1";
+  version = "1.3.0";
 
   srcs = [
     (fetchurl {
       url = "https://github.com/EliverLara/Nordic/releases/download/v${version}/Nordic.tar.xz";
-      sha256 = "1k8fzvjb92wcqha378af5hk6r75xanff9iwlx51jmi67ny8z28pn";
+      sha256 = "04axs2yldppcx159nwj70g4cyw0hbbzk5250677i9ny8b0w3gr9x";
     })
     (fetchurl {
       url = "https://github.com/EliverLara/Nordic/releases/download/v${version}/Nordic-standard-buttons.tar.xz";
-      sha256 = "12w01z88rqkds1wm2kskql1x5c6prpgpc9cxxnl0b11knsfhi6jn";
+      sha256 = "0xnj1am1q26xppp8y07iik648hhgn3gmzqvkdhg3il4qnkndjvld";
     })
   ];
 

pkgs/os-specific/linux/kernel/linux-rpi.nix

@@ -25,7 +25,7 @@ lib.overrideDerivation (buildLinux (args // rec {
     efiBootStub = false;
   } // (args.features or {});
 
-  extraMeta.hydraPlatforms = [];
+  extraMeta.hydraPlatforms = with stdenv.lib.platforms; [ aarch64 ];
 })) (oldAttrs: {
   postConfigure = ''
     # The v7 defconfig has this set to '-v7' which screws up our modDirVersion.

pkgs/os-specific/linux/kernel/linux-testing.nix

@@ -1,13 +1,13 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, libelf, utillinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.20-rc3";
+  version = "4.20-rc4";
-  modDirVersion = "4.20.0-rc3";
+  modDirVersion = "4.20.0-rc4";
   extraMeta.branch = "4.20";
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "0iin34alr5ax15pvilhdn5pifqav4gkxalb7vqb8zvxnhsm6kk58";
+    sha256 = "0kni1l1gk9mva7ym091mrkn9f2bdbh80i7589ahk6j5blpj9m3ns";
   };
 
   # Should the testing kernels ever be built on Hydra?

pkgs/os-specific/linux/pommed-light/default.nix

@@ -1,8 +1,7 @@
-{
+{ stdenv
-  stdenv
+, fetchFromGitHub
-, fetchurl
 , pciutils
-, confuse
+, libconfuse
 , alsaLib
 , audiofile
 , pkgconfig
@@ -15,10 +14,11 @@ stdenv.mkDerivation rec {
   version = "1.51lw";
   name = "${pkgname}-${version}";
 
-  src = fetchurl {
+  src = fetchFromGitHub {
-    url = "https://github.com/bytbox/${pkgname}/archive/v${version}.tar.gz";
+    owner = "bytbox";
-
+    repo = pkgname;
-    sha256 = "11wi17bh2br1hp8gmq40b1hm5drm6h969505f7432zam3cm8mc8q";
+    rev = "v${version}";
+    sha256 = "18fvdwwhcl6s4bpf2f2i389s71c8k4g0yb81am9rdddqmzaw27iy";
   };
 
   postPatch = ''
@@ -28,12 +28,12 @@ stdenv.mkDerivation rec {
     substituteInPlace pommed/cd_eject.c --replace /usr/bin/eject ${eject}/bin/eject
   '';
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
     pciutils
-    confuse
+    libconfuse
     alsaLib
     audiofile
-    pkgconfig
     zlib
     eject
   ];

pkgs/os-specific/linux/pommed/default.nix

@@ -1,80 +0,0 @@
-{ 
-  stdenv
-, fetchurl
-, pciutils
-, confuse
-, dbus, dbus-glib
-, alsaLib
-, audiofile
-, pkgconfig
-, gtk2
-, gettext
-, libXpm
-}:
-
-let
-
-  build_flags_patch = fetchurl {
-    url = http://patch-tracker.debian.org/patch/series/dl/pommed/1.39~dfsg-2/build_flags.patch;
-    sha256 = "109n5v0m91fqf8vqnpqg1zw8mk8fi9pkzqsfrmlavalg4xz49x9j";
-  }; 
-
-in
-
-stdenv.mkDerivation rec {
-  name = "pommed-1.39";
-
-  src = fetchurl {
-    url = "http://alioth.debian.org/frs/download.php/3583/${name}.tar.gz";
-    sha256 = "18lxywmikanjr5pk1jdqda88dxd2579fpyd332xn4njjhlgwy5fp";
-  };
-
-  patches = [ build_flags_patch ./find-eject-in-path.patch ];
-
-  buildInputs = [
-    pciutils
-    confuse
-    dbus
-    alsaLib
-    audiofile
-    dbus-glib
-    pkgconfig
-    gtk2
-    gettext
-    libXpm
-  ];
-
-  installPhase = ''
-    mkdir -pv $out/bin $out/etc/init.d $out/etc/dbus-1/system.d \
-      $out/share/pommed $out/share/gpomme $out/share/applications \
-      $out/share/icons/hicolor/scalable/apps $out/share/pixmaps
-
-    install -v -m755 pommed/pommed wmpomme/wmpomme gpomme/gpomme $out/bin
-    install -v -m644 pommed/data/* $out/share/pommed
-    install -v -m644 pommed.conf.mactel $out/etc/pommed.conf
-    install -v -m644 pommed.init $out/etc/init.d
-    install -v -m644 dbus-policy.conf $out/etc/dbus-1/system.d/pommed.conf
-
-    cp -av gpomme/themes $out/share/gpomme
-    for lang in de es fr it ja; do
-      mkdir -pv $out/share/locale/"$lang"/LC_MESSAGES
-      install -v -m644 gpomme/po/"$lang".mo $out/share/locale/"$lang"/LC_MESSAGES/gpomme.mo
-    done
-    install -v -m644 gpomme/gpomme*.desktop $out/share/applications
-    for size in 128 16 192 22 24 32 36 48 64 72 96; do
-      mkdir -pv $out/share/icons/hicolor/"$size"x"$size"/apps
-      install -v -m644 icons/gpomme_"$size"x"$size".png \
-        $out/share/icons/hicolor/"$size"x"$size"/apps
-    done
-    install -v -m644 icons/gpomme.svg  $out/share/icons/hicolor/scalable/apps
-
-    install -v -m644 icons/gpomme_192x192.xpm $out/share/pixmaps/wmpomme.xpm
-  '';
-
-  meta = {
-    description = "A tool to handle hotkeys on Apple laptop keyboards";
-    homepage = http://www.technologeek.org/projects/pommed/index.html;
-    license = stdenv.lib.licenses.gpl2;
-    broken = true; # hash changed, and it's quite suspicious
-  };
-}

pkgs/os-specific/linux/pommed/find-eject-in-path.patch

@@ -1,12 +0,0 @@
-diff -Naur pommed-1.39-orig/pommed/cd_eject.c pommed-1.39/pommed/cd_eject.c
---- pommed-1.39-orig/pommed/cd_eject.c	2011-06-02 05:24:05.000000000 -0400
-+++ pommed-1.39/pommed/cd_eject.c	2012-03-20 14:25:33.397712520 -0400
-@@ -100,7 +100,7 @@
-       for (fd = 3; fd < max_fd; fd++)
- 	close(fd);
- 
--      execve("/usr/bin/eject", eject_argv, eject_envp);
-+      execvpe("eject", eject_argv, eject_envp);
- 
-       logmsg(LOG_ERR, "Could not execute eject: %s", strerror(errno));
-       exit(1);

pkgs/os-specific/linux/sssd/default.nix

@@ -1,13 +1,14 @@
-{ stdenv, fetchurl, pkgs, glibc, augeas, dnsutils, c-ares, curl,
+{ stdenv, fetchurl, fetchpatch, glibc, augeas, dnsutils, c-ares, curl,
   cyrus_sasl, ding-libs, libnl, libunistring, nss, samba, nfs-utils, doxygen,
   python, python3, pam, popt, talloc, tdb, tevent, pkgconfig, ldb, openldap,
   pcre, kerberos, cifs-utils, glib, keyutils, dbus, fakeroot, libxslt, libxml2,
   libuuid, ldap, systemd, nspr, check, cmocka, uid_wrapper,
-  nss_wrapper, ncurses, Po4a, http-parser, jansson
+  nss_wrapper, ncurses, Po4a, http-parser, jansson,
-  , withSudo ? false }:
+  docbook_xsl, docbook_xml_dtd_44,
+  withSudo ? false }:
 
 let
-  docbookFiles = "${pkgs.docbook_xsl}/share/xml/docbook-xsl/catalog.xml:${pkgs.docbook_xml_dtd_44}/xml/dtd/docbook/catalog.xml";
+  docbookFiles = "${docbook_xsl}/share/xml/docbook-xsl/catalog.xml:${docbook_xml_dtd_44}/xml/dtd/docbook/catalog.xml";
 in
 stdenv.mkDerivation rec {
   name = "sssd-${version}";
@@ -18,13 +19,21 @@ stdenv.mkDerivation rec {
     sha256 = "032ppk57qs1lnvz7pb7lw9ldwm9i1yagh9fzgqgn6na3bg61ynzy";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "duplicate-case-value.diff";
+      url = "https://github.com/SSSD/sssd/commit/1ee12b05570fcfb8.diff";
+      sha256 = "01y8i8cfs2gydn84097cl5fynx0db8b0vr345gh57ypp84in3ixw";
+    })
+  ];
+
   # Something is looking for <libxml/foo.h> instead of <libxml2/libxml/foo.h>
   NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
 
   preConfigure = ''
     export SGML_CATALOG_FILES="${docbookFiles}"
     export PYTHONPATH=${ldap}/lib/python2.7/site-packages
-    export PATH=$PATH:${pkgs.openldap}/libexec
+    export PATH=$PATH:${openldap}/libexec
 
     configureFlagsArray=(
       --prefix=$out

pkgs/os-specific/linux/targetcli/default.nix

@@ -0,0 +1,22 @@
+{ stdenv, python, fetchFromGitHub }:
+
+python.pkgs.buildPythonApplication rec {
+  pname = "targetcli";
+  version = "2.1.fb49";
+
+  src = fetchFromGitHub {
+    owner = "open-iscsi";
+    repo = "${pname}-fb";
+    rev = "v${version}";
+    sha256 = "093dmwc5g6yz4cdgpbfszmc97i7nd286w4x447dvg22hvwvjwqhh";
+  };
+
+  propagatedBuildInputs = with python.pkgs; [ configshell rtslib ];
+
+  meta = with stdenv.lib; {
+    description = "A command shell for managing the Linux LIO kernel target";
+    homepage = https://github.com/open-iscsi/targetcli-fb;
+    license = licenses.asl20;
+    platforms = platforms.linux;
+  };
+}

pkgs/os-specific/linux/udisks-glue/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, automake, autoconf, udisks1, dbus-glib, glib, confuse }:
+{ stdenv, fetchurl, pkgconfig, automake, autoconf, udisks1, dbus-glib, glib, libconfuse }:
 
 stdenv.mkDerivation {
   name = "udisks-glue-1.3.5";
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
   };
 
   nativeBuildInputs = [ pkgconfig automake autoconf ];
-  buildInputs = [ udisks1 dbus-glib glib confuse ];
+  buildInputs = [ udisks1 dbus-glib glib libconfuse ];
 
   preConfigure = "sh autogen.sh";
 
@@ -18,6 +18,6 @@ stdenv.mkDerivation {
     description = "A tool to associate udisks events to user-defined actions";
     platforms = stdenv.lib.platforms.linux;
     maintainers = with stdenv.lib.maintainers; [pSub];
-    license = stdenv.lib.licenses.free;
+    license = stdenv.lib.licenses.bsd2;
   };
 }

pkgs/servers/echoip/default.nix

@@ -0,0 +1,30 @@
+{ lib, buildGoPackage, fetchFromGitHub }:
+
+buildGoPackage rec {
+  name = "echoip-${version}";
+  version = "unstable-2018-11-20";
+
+  goPackagePath = "github.com/mpolden/echoip";
+
+  src = fetchFromGitHub {
+    owner = "mpolden";
+    repo = "echoip";
+    rev = "4bfaf671b9f75a7b2b37543b2991401cbf57f1f0";
+    sha256 = "0n5d9i8cc5lqgy5apqd3zhyl3h1xjacf612z8xpvbm75jnllcvxy";
+  };
+
+  goDeps = ./deps.nix;
+
+  outputs = [ "bin" "out" ];
+
+  postInstall = ''
+    mkdir -p $out
+    cp $src/index.html $out/index.html
+  '';
+
+  meta = with lib; {
+    homepage = https://github.com/mpolden/echoip;
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ rvolosatovs ];
+  };
+}