Merge master into x-updates

Conflicts (auto-solved):
	pkgs/os-specific/linux/alsa-plugins/default.nix

nixos/doc/manual/installation.xml

@@ -353,7 +353,7 @@ changes:
 
 <title xml:id="sec-booting-from-usb">Booting from a USB stick</title>
 
-<para>For systems withoua CD drive, the NixOS livecd can be booted from
+<para>For systems without CD drive, the NixOS livecd can be booted from
 a usb stick. For non-UEFI installations,
 <link xlink:href="http://unetbootin.sourceforge.net/">unetbootin</link>
 will work. For UEFI installations, you should mount the ISO, copy its contents

nixos/modules/installer/cd-dvd/installation-cd-graphical-new-kernel.nix

@@ -3,6 +3,5 @@
 {
   imports = [ ./installation-cd-graphical.nix ];
 
-  boot.kernelPackages = pkgs.linuxPackages_3_10;
-  boot.vesa = false;
+  boot.kernelPackages = pkgs.linuxPackages_latest;
 }

nixos/modules/installer/cd-dvd/installation-cd-minimal-new-kernel.nix

@@ -3,6 +3,5 @@
 {
   imports = [ ./installation-cd-minimal.nix ];
 
-  boot.kernelPackages = pkgs.linuxPackages_3_10;
-  boot.vesa = false;
+  boot.kernelPackages = pkgs.linuxPackages_latest;
 }

nixos/modules/programs/shadow.nix

@@ -48,6 +48,7 @@ in
         Rather, it should be the path of a symlink that points to the
         actual shell in the Nix store.
       '';
+      example = "/run/current-system/sw/bin/zsh";
       type = types.path;
     };
 

nixos/modules/security/sudo.nix

@@ -83,7 +83,7 @@ in
 	  {src = pkgs.writeText "sudoers-in" cfg.configFile; }
           # Make sure that the sudoers file is syntactically valid.
           # (currently disabled - NIXOS-66)
-          "${pkgs.sudo.override {keepVisudo = true;}}/sbin/visudo -f $src -c &&
+          "${pkgs.sudo}/sbin/visudo -f $src -c &&
 	      cp $src $out";
         target = "sudoers";
         mode = "0440";

nixos/modules/services/audio/mpd.nix

@@ -52,7 +52,7 @@ in {
       };  
 
       dataDir = mkOption {
-        default = "/var/lib/mpd/";
+        default = "/var/lib/mpd";
         description = ''
           The directory where MPD stores its state, tag cache,
           playlists etc.

nixos/modules/services/network-filesystems/samba.nix

@@ -59,7 +59,7 @@ let
   daemonService = appName: args:
     { description = "Samba Service Daemon ${appName}";
 
-      wantedBy = [ "samba.target" ];
+      requiredBy = [ "samba.target" ];
       partOf = [ "samba.target" ];
 
       environment = {

nixos/modules/services/web-servers/nginx/default.nix

@@ -84,8 +84,6 @@ in
   };
 
   config = mkIf cfg.enable {
-    environment.systemPackages = [ nginx ];
-
     # TODO: test user supplied config file pases syntax test
 
     systemd.services.nginx = {
@@ -96,6 +94,7 @@ in
       preStart =
         ''
         mkdir -p ${cfg.stateDir}/logs
+        chmod 700 ${cfg.stateDir}
         chown -R ${cfg.user}:${cfg.group} ${cfg.stateDir}
         '';
       serviceConfig = {
@@ -105,7 +104,7 @@ in
 
     users.extraUsers = optionalAttrs (cfg.user == "nginx") (singleton
       { name = "nginx";
-        group = "nginx";
+        group = cfg.group;
         uid = config.ids.uids.nginx;
       });
 

nixos/modules/services/web-servers/phpfpm.nix

@@ -42,6 +42,12 @@ in {
         '';
       };
 
+      phpIni = mkOption {
+        type = types.path;
+        default = "${cfg.phpPackage}/etc/php-recommended.ini";
+        description = "php.ini file to use.";
+      };
+
       poolConfigs = mkOption {
         type = types.attrsOf types.lines;
         default = {};
@@ -75,7 +81,7 @@ in {
         mkdir -p "${stateDir}"
       '';
       serviceConfig = {
-        ExecStart = "${cfg.phpPackage}/sbin/php-fpm -y ${cfgFile}";
+        ExecStart = "${cfg.phpPackage}/sbin/php-fpm -y ${cfgFile} -c ${cfg.phpIni}";
         PIDFile = pidFile;
       };
     };

nixos/modules/virtualisation/amazon-image.nix

@@ -26,7 +26,7 @@ in
               ''
                 mkdir $out
                 diskImage=$out/nixos.img
-                ${pkgs.vmTools.qemu}/bin/qemu-img create -f raw $diskImage "4G"
+                ${pkgs.vmTools.qemu}/bin/qemu-img create -f raw $diskImage "8G"
                 mv closure xchg/
               '';
             buildInputs = [ pkgs.utillinux pkgs.perl ];
@@ -34,16 +34,32 @@ in
               [ "closure" config.system.build.toplevel ];
           }
           ''
-            # Create an empty filesystem and mount it.
-            ${pkgs.e2fsprogs}/sbin/mkfs.ext4 -L nixos /dev/vda
-            ${pkgs.e2fsprogs}/sbin/tune2fs -c 0 -i 0 /dev/vda
-            mkdir /mnt
-            mount /dev/vda /mnt
+            ${if cfg.hvm then ''
+              # Create a single / partition.
+              ${pkgs.parted}/sbin/parted /dev/vda mklabel msdos
+              ${pkgs.parted}/sbin/parted /dev/vda -- mkpart primary ext2 1M -1s
+              . /sys/class/block/vda1/uevent
+              mknod /dev/vda1 b $MAJOR $MINOR
+
+              # Create an empty filesystem and mount it.
+              ${pkgs.e2fsprogs}/sbin/mkfs.ext4 -L nixos /dev/vda1
+              ${pkgs.e2fsprogs}/sbin/tune2fs -c 0 -i 0 /dev/vda1
+              mkdir /mnt
+              mount /dev/vda1 /mnt
+            '' else ''
+              # Create an empty filesystem and mount it.
+              ${pkgs.e2fsprogs}/sbin/mkfs.ext4 -L nixos /dev/vda
+              ${pkgs.e2fsprogs}/sbin/tune2fs -c 0 -i 0 /dev/vda
+              mkdir /mnt
+              mount /dev/vda /mnt
+            ''}
 
             # The initrd expects these directories to exist.
             mkdir /mnt/dev /mnt/proc /mnt/sys
 
             mount -o bind /proc /mnt/proc
+            mount -o bind /dev /mnt/dev
+            mount -o bind /sys /mnt/sys
 
             # Copy all paths in the closure to the filesystem.
             storePaths=$(perl ${pkgs.pathsFromGraph} /tmp/xchg/closure)
@@ -73,9 +89,10 @@ in
             cp ${./amazon-config.nix} /mnt/etc/nixos/configuration.nix
 
             # Generate the GRUB menu.
+            ln -s vda /dev/xvda
             chroot /mnt ${config.system.build.toplevel}/bin/switch-to-configuration boot
 
-            umount /mnt/proc
+            umount /mnt/proc /mnt/dev /mnt/sys
             umount /mnt
           ''
       );
@@ -86,7 +103,7 @@ in
     boot.kernelModules = [ "xen-netfront" ];
 
     # Generate a GRUB menu.  Amazon's pv-grub uses this to boot our kernel/initrd.
-    boot.loader.grub.version = 1;
+    boot.loader.grub.version = if cfg.hvm then 2 else 1;
     boot.loader.grub.device = if cfg.hvm then "/dev/xvda" else "nodev";
     boot.loader.grub.timeout = 0;
     boot.loader.grub.extraPerEntryConfig = "root (hd0${lib.optionalString cfg.hvm ",0"})";

nixos/release.nix

@@ -122,14 +122,6 @@ in rec {
     inherit system;
   });
 
-  /*
-  iso_minimal_new_kernel = forAllSystems (system: makeIso {
-    module = ./modules/installer/cd-dvd/installation-cd-minimal-new-kernel.nix;
-    type = "minimal-new-kernel";
-    inherit system;
-  });
-  */
-
   iso_graphical = forAllSystems (system: makeIso {
     module = ./modules/installer/cd-dvd/installation-cd-graphical.nix;
     type = "graphical";
@@ -138,13 +130,17 @@ in rec {
 
   # A variant with a more recent (but possibly less stable) kernel
   # that might support more hardware.
-  /*
-  iso_new_kernel = forAllSystems (system: makeIso {
-    module = ./modules/installer/cd-dvd/installation-cd-new-kernel.nix;
-    type = "new-kernel";
+  iso_minimal_new_kernel = forAllSystems (system: makeIso {
+    module = ./modules/installer/cd-dvd/installation-cd-minimal-new-kernel.nix;
+    type = "minimal-new-kernel";
+    inherit system;
+  });
+
+  iso_graphical_new_kernel = forAllSystems (system: makeIso {
+    module = ./modules/installer/cd-dvd/installation-cd-graphical-new-kernel.nix;
+    type = "graphical-new-kernel";
     inherit system;
   });
-  */
 
 
   # A bootable VirtualBox virtual appliance as an OVA file (i.e. packaged OVF).

pkgs/applications/editors/emacs-modes/idris/default.nix

@@ -1,12 +1,13 @@
-{ stdenv, fetchgit, emacs }:
+{ stdenv, fetchurl, emacs }:
 
 stdenv.mkDerivation rec {
-  name = "idris-mode-20140405";
+  name = "${pname}-${version}";
+  pname = "idris-mode";
+  version = "0.9.13.1";
 
-  src = fetchgit {
-    url = https://github.com/idris-hackers/idris-mode.git;
-    rev = "2e2d18fb757da4b42940ebe2a57d7a117175489f";
-    sha256 = "d4b52c6c43c038c94a7464cd9c849cd40c01696c440da8b057c00a9be22f9ac0";
+  src = fetchurl {
+    url = "https://github.com/idris-hackers/${pname}/archive/${version}.tar.gz";
+    sha256 = "0ymjbkwsq7qra691wyldw91xcdgrbx3468vvrha5jj92v7nwb8wx";
   };
 
   buildInputs = [ emacs ];

pkgs/applications/editors/emacs-modes/metaweblog/default.nix

@@ -0,0 +1,31 @@
+{ stdenv, fetchgit, emacs, xmlRpc }:
+
+stdenv.mkDerivation rec {
+  name = "metaweblog-0.1";
+
+  src = fetchgit {
+    url = https://github.com/punchagan/metaweblog.git;
+    rev = "ceda65048afaa4c7596c7f50ced998c59ef41167";
+    sha256 = "a4c10bb1b4be574e560f87d5f07da4e24e5fffe9ecc83e6d4f9325f3a7eb1e2f";
+  };
+
+  buildInputs = [ emacs ];
+  propagatedUserEnvPkgs = [ xmlRpc ];
+
+  buildPhase = ''
+    emacs -L . -L ${xmlRpc}/share/emacs/site-lisp --batch -f batch-byte-compile *.el
+  '';
+
+  installPhase = ''
+    install -d $out/share/emacs/site-lisp
+    install *.el* $out/share/emacs/site-lisp
+  '';
+
+  meta = {
+    description = "an emacs library to access metaweblog based weblogs";
+    homepage = https://github.com/punchagan/metaweblog;
+    license = "GPLv3+";
+
+    platforms = stdenv.lib.platforms.all;
+  };
+}

pkgs/applications/editors/emacs-modes/org/default.nix

@@ -1,4 +1,5 @@
-{ fetchurl, stdenv, emacs, texinfo, which, texLive }:
+{ fetchurl, stdenv, emacs, texinfo, which, texLive, texLiveCMSuper
+, texLiveAggregationFun }:
 
 stdenv.mkDerivation rec {
   name = "org-8.2.7";
@@ -9,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [ emacs ];
-  nativeBuildInputs = [ texinfo texLive ];
+  nativeBuildInputs = [ (texLiveAggregationFun { paths=[ texinfo texLive texLiveCMSuper ]; }) ];
 
   configurePhase =
     '' sed -i mk/default.mk \

pkgs/applications/editors/emacs-modes/org2blog/default.nix

@@ -1,19 +1,22 @@
-{ stdenv, fetchgit, emacs, xmlRpc }:
+{ stdenv, fetchgit, emacs, org, xmlRpc, metaweblog }:
 
 stdenv.mkDerivation rec {
-  name = "org2blog-0.5";
+  name = "org2blog-0.8.1";
 
   src = fetchgit {
     url = https://github.com/punchagan/org2blog.git;
-    rev = "338abe30e9bc89684f8384f8deaf826b63844da6";
-    sha256 = "46ab31e90d0d54071c126b7d5599a3e82062baa79ddf26b988bcb88d306d6827";
+    rev = "5f573ff3e4007c16517a5fe28c4f5d8dde3f8a77";
+    sha256 = "e83c08ceece92bb507be70046db4a7fa87a4af34ad3f84a727e0bd6a1dd99a33";
   };
 
   buildInputs = [ emacs ];
-  propagatedUserEnvPkgs = [ xmlRpc ];
+  propagatedUserEnvPkgs = [ org xmlRpc metaweblog ];
 
   buildPhase = ''
-    emacs -L . -L ${xmlRpc}/share/emacs/site-lisp --batch -f batch-byte-compile *.el
+    emacs -L . -L ${org}/share/emacs/site-lisp/org \
+               -L ${xmlRpc}/share/emacs/site-lisp \
+               -L ${metaweblog}/share/emacs/site-lisp \
+               --batch -f batch-byte-compile *.el
   '';
 
   installPhase = ''

pkgs/applications/editors/sublime3/default.nix

@@ -1,40 +1,63 @@
-{ fetchurl, stdenv, glib, xlibs, cairo, gtk, pango}:
-let
-  libPath = stdenv.lib.makeLibraryPath [glib xlibs.libX11 gtk cairo pango];
-in
+{ fetchurl, stdenv, glib, xlibs, cairo, gtk, pango, makeWrapper}:
+
 assert stdenv.system == "i686-linux" || stdenv.system == "x86_64-linux";
 
-stdenv.mkDerivation rec {
-  name = "sublimetext3-3.0.59";
-  src = 
-    if stdenv.system == "i686-linux" then
-      fetchurl {
-        name = "sublimetext-3.0.59.tar.bz2";
-        url = http://c758482.r82.cf2.rackcdn.com/sublime_text_3_build_3059_x32.tar.bz2;
-        sha256 = "5ee7b42b5db057108e97b86fd408124fc3f7b56662b2851f59d91f8f0c288088";
-      }
-    else
-      fetchurl {
-        name = "sublimetext-3.0.59.tar.bz2";
-        url = http://c758482.r82.cf2.rackcdn.com/sublime_text_3_build_3059_x64.tar.bz2;
-        sha256 = "da3039687664d33a734cea0151b2291ece9c7f35e5b73df5b2b5eac28a20b972";
-      };
-  buildCommand = ''
-    tar xvf ${src}
-    mkdir -p $out/bin
-    mv sublime_text_3 $out/sublime
-    ln -s $out/sublime/sublime_text $out/bin/sublime
-    ln -s $out/sublime/sublime_text $out/bin/sublime3
+let
+  build = "3059";
+  libPath = stdenv.lib.makeLibraryPath [glib xlibs.libX11 gtk cairo pango];
+in let
+  # package with just the binaries
+  sublime = stdenv.mkDerivation {
+    name = "sublimetext3-${build}-bin";
 
-    echo ${libPath}
-    patchelf \
-      --interpreter "$(cat $NIX_GCC/nix-support/dynamic-linker)" \
-      --set-rpath ${libPath}:${stdenv.gcc.gcc}/lib${stdenv.lib.optionalString stdenv.is64bit "64"} \
-      $out/sublime/sublime_text
+    src =
+      if stdenv.system == "i686-linux" then
+        fetchurl {
+          name = "sublimetext-3.0.59.tar.bz2";
+          url = "http://c758482.r82.cf2.rackcdn.com/sublime_text_3_build_${build}_x32.tar.bz2";
+          sha256 = "5ee7b42b5db057108e97b86fd408124fc3f7b56662b2851f59d91f8f0c288088";
+        }
+      else
+        fetchurl {
+          name = "sublimetext-3.0.59.tar.bz2";
+          url = "http://c758482.r82.cf2.rackcdn.com/sublime_text_3_build_${build}_x64.tar.bz2";
+          sha256 = "da3039687664d33a734cea0151b2291ece9c7f35e5b73df5b2b5eac28a20b972";
+        };
+
+    dontStrip = true;
+    dontPatchELF = true;
+    buildInputs = [ makeWrapper ];
+
+    buildPhase = ''
+      for i in sublime_text plugin_host crash_reporter; do
+        patchelf \
+          --interpreter "$(cat $NIX_GCC/nix-support/dynamic-linker)" \
+          --set-rpath ${libPath}:${stdenv.gcc.gcc}/lib${stdenv.lib.optionalString stdenv.is64bit "64"} \
+          $i
+      done
+    '';
+
+    installPhase = ''
+      mkdir -p $out
+      cp -prvd * $out/
+      # Without this, plugin_host crashes, even though it has the rpath
+      wrapProgram $out/plugin_host --prefix LD_PRELOAD : ${stdenv.gcc.gcc}/lib${stdenv.lib.optionalString stdenv.is64bit "64"}/libgcc_s.so.1
+    '';
+  };
+in stdenv.mkDerivation {
+  name = "sublimetext3-${build}";
+
+  phases = [ "installPhase" ];
+  installPhase = ''
+    mkdir -p $out/bin
+    ln -s ${sublime}/sublime_text $out/bin/sublime
+    ln -s ${sublime}/sublime_text $out/bin/sublime3
   '';
 
   meta = {
     description = "Sophisticated text editor for code, markup and prose";
+    maintainers = stdenv.lib.maintainers.wmertens;
     license = "unfree";
   };
 }
+

pkgs/applications/networking/browsers/chromium/browser.nix

@@ -1,17 +1,17 @@
-{ stdenv, mkChromiumDerivation, arch }:
+{ stdenv, mkChromiumDerivation }:
 
 with stdenv.lib;
 
 mkChromiumDerivation (base: rec {
   name = "chromium-browser";
   packageName = "chromium";
-  buildTargets = [ "mksnapshot.${arch}" "chrome" ];
+  buildTargets = [ "mksnapshot" "chrome" ];
 
   installPhase = ''
     ensureDir "$libExecPath"
     cp -v "$buildPath/"*.pak "$libExecPath/"
     cp -v "$buildPath/icudtl.dat" "$libExecPath/"
-    cp -vR "$buildPath/locales" "$buildPath/resources" "$libExecPath/"
+    cp -vLR "$buildPath/locales" "$buildPath/resources" "$libExecPath/"
     cp -v $buildPath/libffmpegsumo.so "$libExecPath/"
 
     cp -v "$buildPath/chrome" "$libExecPath/$packageName"

pkgs/applications/networking/browsers/chromium/common.nix

@@ -30,7 +30,6 @@
 
 , source
 , plugins
-, archInfo
 }:
 
 buildFun:
@@ -133,6 +132,8 @@ let
       find -iname '*.gyp*' \( -type f -o -type l \) \
         -exec sed -i -e 's|<(DEPTH)|'"$(pwd)"'|g' {} + \
         -exec chmod u+w {} +
+    '' + optionalString (!versionOlder source.version "37.0.0.0") ''
+      python third_party/libaddressinput/chromium/tools/update-strings.py
     '';
 
     postPatch = let
@@ -143,6 +144,10 @@ let
       sed -i -e '/base::FilePath exe_dir/,/^ *} *$/c \
         sandbox_binary = base::FilePath(getenv("CHROMIUM_SANDBOX_BINARY_PATH"));
       ' ${toPatch}
+    '' + optionalString (!versionOlder source.version "36.0.0.0") ''
+      sed -i -e '/module_path *=.*libexif.so/ {
+        s|= [^;]*|= base::FilePath().AppendASCII("${libexif}/lib/libexif.so")|
+      }' chrome/utility/media_galleries/image_metadata_extractor.cc
     '';
 
     gypFlags = mkGypFlags (gypFlagsUseSystemLibs // {
@@ -161,6 +166,9 @@ let
       linux_sandbox_chrome_path="${libExecPath}/${packageName}";
       werror = "";
 
+      # FIXME: In version 37, omnibox.mojom.js doesn't seem to be generated.
+      use_mojo = versionOlder source.version "37.0.0.0";
+
       # Google API keys, see:
       #   http://www.chromium.org/developers/how-tos/api-keys
       # Note: These are for NixOS/nixpkgs use ONLY. For your own distribution,
@@ -173,7 +181,13 @@ let
       # enable support for the H.264 codec
       proprietary_codecs = true;
       ffmpeg_branding = "Chrome";
-    } // archInfo // (extraAttrs.gypFlags or {}));
+    } // optionalAttrs (stdenv.system == "x86_64-linux") {
+      target_arch = "x64";
+      python_arch = "x86-64";
+    } // optionalAttrs (stdenv.system == "i686-linux") {
+      target_arch = "ia32";
+      python_arch = "ia32";
+    } // (extraAttrs.gypFlags or {}));
 
     configurePhase = ''
       # This is to ensure expansion of $out.
@@ -185,17 +199,20 @@ let
     buildPhase = let
       CC = "${gcc}/bin/gcc";
       CXX = "${gcc}/bin/g++";
-      buildCommand = target: ''
+      buildCommand = target: let
+        # XXX: Only needed for version 36 and older!
+        targetSuffix = optionalString
+          (versionOlder source.version "37.0.0.0" && target == "mksnapshot")
+          (if stdenv.is64bit then ".x64" else ".ia32");
+      in ''
         CC="${CC}" CC_host="${CC}"     \
         CXX="${CXX}" CXX_host="${CXX}" \
         LINK_host="${CXX}"             \
           "${ninja}/bin/ninja" -C "${buildPath}"  \
             -j$NIX_BUILD_CORES -l$NIX_BUILD_CORES \
-            ${target}
-
-        if [[ "${target}" == mksnapshot.* || "${target}" == "chrome" ]]; then
-          paxmark m "${buildPath}/${target}"
-        fi
+            "${target}${targetSuffix}"
+      '' + optionalString (target == "mksnapshot" || target == "chrome") ''
+        paxmark m "${buildPath}/${target}${targetSuffix}"
       '';
       targets = extraAttrs.buildTargets or [];
       commands = map buildCommand targets;

pkgs/applications/networking/browsers/chromium/default.nix

@@ -15,14 +15,6 @@
 }:
 
 let
-  archInfo = with stdenv.lib; optionalAttrs (stdenv.system == "i686-linux") {
-    target_arch = "ia32";
-    python_arch = "ia32";
-  } // optionalAttrs (stdenv.system == "x86_64-linux") {
-    target_arch = "x64";
-    python_arch = "x86-64";
-  };
-
   callPackage = newScope chromium;
 
   chromium = {
@@ -35,13 +27,10 @@ let
     mkChromiumDerivation = callPackage ./common.nix {
       inherit enableSELinux enableNaCl useOpenSSL gnomeSupport
               gnomeKeyringSupport proprietaryCodecs cupsSupport
-              pulseSupport archInfo;
-    };
-
-    browser = callPackage ./browser.nix {
-      arch = archInfo.target_arch;
+              pulseSupport;
     };
 
+    browser = callPackage ./browser.nix { };
     sandbox = callPackage ./sandbox.nix { };
 
     plugins = callPackage ./plugins.nix {

pkgs/applications/networking/browsers/chromium/source/angle_build_37.patch

@@ -0,0 +1,347 @@
+commit 9c4b24a52e0ff478aa170d33e26c44acd8c68be3
+Author: Jamie Madill <jmadill@chromium.org>
+Date:   Thu Jun 12 13:41:17 2014 -0400
+
+    Use commit_id.py on Windows, and handle missing git.
+    
+    This allows us to delete the Windows batch file.
+    
+    Changes the commit_id script to take the working directory so that it
+    can be called from a different working directory than the angle
+    repository is in.
+    
+    Renames the generated commit header to angle_commit.h. This is being
+    written to the shared generated code directory for the entire build,
+    and "commit.h" is insufficiently unique.
+    
+    BUG=angle:669
+    
+    Change-Id: I35e80411a7e8ba1e02ce3f6a4fc54ed4dbc918f3
+    Reviewed-on: https://chromium-review.googlesource.com/202048
+    Reviewed-by: Geoff Lang <geofflang@chromium.org>
+    Tested-by: Jamie Madill <jmadill@chromium.org>
+    [Removed and/or fixed up Windows specific hunks]
+    Signed-off-by: aszlig <aszlig@redmoonstudios.org>
+
+diff --git a/generate_projects b/generate_projects
+index 6743254..8175277 100644
+--- a/generate_projects
++++ b/generate_projects
+@@ -34,6 +34,7 @@ if __name__ == '__main__':
+     gyp_cmd += ' -D angle_build_tests=' + ('1' if build_tests else '0')
+     gyp_cmd += ' -D angle_build_samples=' + ('1' if build_samples else '0')
+     gyp_cmd += ' -D release_symbols=' + ('true' if release_symbols else 'false')
++    gyp_cmd += ' -D angle_use_commit_id=0'
+     gyp_cmd += ' ' + os.path.join(script_dir, 'all.gyp')
+ 
+     print 'Generating projects to ' + generation_dir + ' from gyp files...'
+diff --git a/projects/build/all.sln b/projects/build/all.sln
+index 1aa0796..5862edd 100644
+--- a/projects/build/all.sln
++++ b/projects/build/all.sln
+@@ -3,11 +3,11 @@ Microsoft Visual Studio Solution File, Format Version 11.00
+ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "All", "All.vcxproj", "{D048EF6F-5312-AF41-8D8A-DB22CD8634E6}"
+ 	ProjectSection(ProjectDependencies) = postProject
+ 		{63FB0B97-D1D9-5158-8E85-7F5B1E403817} = {63FB0B97-D1D9-5158-8E85-7F5B1E403817}
+-		{3B7F5656-177F-52EE-26B3-D6A75368D0A9} = {3B7F5656-177F-52EE-26B3-D6A75368D0A9}
+ 		{C7BAF548-697D-2DCB-9DF3-9D1506A7B444} = {C7BAF548-697D-2DCB-9DF3-9D1506A7B444}
+ 		{276D20F5-2943-414C-0FF6-21F4723A5CF6} = {276D20F5-2943-414C-0FF6-21F4723A5CF6}
+ 		{C15697F6-5057-016E-BD29-422971875679} = {C15697F6-5057-016E-BD29-422971875679}
+ 		{19386E01-D811-FA3B-9F1E-122BB0C0E9F5} = {19386E01-D811-FA3B-9F1E-122BB0C0E9F5}
++		{3B7F5656-177F-52EE-26B3-D6A75368D0A9} = {3B7F5656-177F-52EE-26B3-D6A75368D0A9}
+ 		{22DC02D5-1598-943C-13E1-82185B469F81} = {22DC02D5-1598-943C-13E1-82185B469F81}
+ 		{7FBD6F69-B9A4-69F1-A12B-8DACB3F8CD81} = {7FBD6F69-B9A4-69F1-A12B-8DACB3F8CD81}
+ 		{FBAEE4F6-562A-588F-01F9-72DCABB3B061} = {FBAEE4F6-562A-588F-01F9-72DCABB3B061}
+@@ -30,9 +30,6 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "All", "All.vcxproj", "{D048
+ 	EndProjectSection
+ EndProject
+ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "commit_id", "..\src\commit_id.vcxproj", "{3B7F5656-177F-52EE-26B3-D6A75368D0A9}"
+-	ProjectSection(ProjectDependencies) = postProject
+-		{63FB0B97-D1D9-5158-8E85-7F5B1E403817} = {63FB0B97-D1D9-5158-8E85-7F5B1E403817}
+-	EndProjectSection
+ EndProject
+ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "copy_compiler_dll", "..\src\copy_compiler_dll.vcxproj", "{22DC02D5-1598-943C-13E1-82185B469F81}"
+ 	ProjectSection(ProjectDependencies) = postProject
+@@ -68,7 +65,6 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libEGL", "..\src\libEGL.vcx
+ 	ProjectSection(ProjectDependencies) = postProject
+ 		{7FBD6F69-B9A4-69F1-A12B-8DACB3F8CD81} = {7FBD6F69-B9A4-69F1-A12B-8DACB3F8CD81}
+ 		{3B7F5656-177F-52EE-26B3-D6A75368D0A9} = {3B7F5656-177F-52EE-26B3-D6A75368D0A9}
+-		{63FB0B97-D1D9-5158-8E85-7F5B1E403817} = {63FB0B97-D1D9-5158-8E85-7F5B1E403817}
+ 	EndProjectSection
+ EndProject
+ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libGLESv2", "..\src\libGLESv2.vcxproj", "{7FBD6F69-B9A4-69F1-A12B-8DACB3F8CD81}"
+diff --git a/projects/samples/samples.sln b/projects/samples/samples.sln
+index 53cec34..b927860 100644
+--- a/projects/samples/samples.sln
++++ b/projects/samples/samples.sln
+@@ -1,9 +1,6 @@
+ Microsoft Visual Studio Solution File, Format Version 11.00
+ # Visual C++ Express 2010
+ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "commit_id", "..\src\commit_id.vcxproj", "{3B7F5656-177F-52EE-26B3-D6A75368D0A9}"
+-	ProjectSection(ProjectDependencies) = postProject
+-		{63FB0B97-D1D9-5158-8E85-7F5B1E403817} = {63FB0B97-D1D9-5158-8E85-7F5B1E403817}
+-	EndProjectSection
+ EndProject
+ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "copy_compiler_dll", "..\src\copy_compiler_dll.vcxproj", "{22DC02D5-1598-943C-13E1-82185B469F81}"
+ 	ProjectSection(ProjectDependencies) = postProject
+@@ -39,7 +36,6 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libEGL", "..\src\libEGL.vcx
+ 	ProjectSection(ProjectDependencies) = postProject
+ 		{7FBD6F69-B9A4-69F1-A12B-8DACB3F8CD81} = {7FBD6F69-B9A4-69F1-A12B-8DACB3F8CD81}
+ 		{3B7F5656-177F-52EE-26B3-D6A75368D0A9} = {3B7F5656-177F-52EE-26B3-D6A75368D0A9}
+-		{63FB0B97-D1D9-5158-8E85-7F5B1E403817} = {63FB0B97-D1D9-5158-8E85-7F5B1E403817}
+ 	EndProjectSection
+ EndProject
+ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libGLESv2", "..\src\libGLESv2.vcxproj", "{7FBD6F69-B9A4-69F1-A12B-8DACB3F8CD81}"
+diff --git a/projects/src/angle.sln b/projects/src/angle.sln
+index 0d6ec65..cdf9f53 100644
+--- a/projects/src/angle.sln
++++ b/projects/src/angle.sln
+@@ -1,9 +1,6 @@
+ Microsoft Visual Studio Solution File, Format Version 11.00
+ # Visual C++ Express 2010
+ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "commit_id", "commit_id.vcxproj", "{3B7F5656-177F-52EE-26B3-D6A75368D0A9}"
+-	ProjectSection(ProjectDependencies) = postProject
+-		{63FB0B97-D1D9-5158-8E85-7F5B1E403817} = {63FB0B97-D1D9-5158-8E85-7F5B1E403817}
+-	EndProjectSection
+ EndProject
+ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "copy_compiler_dll", "copy_compiler_dll.vcxproj", "{22DC02D5-1598-943C-13E1-82185B469F81}"
+ 	ProjectSection(ProjectDependencies) = postProject
+@@ -16,7 +13,6 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libEGL", "libEGL.vcxproj",
+ 	ProjectSection(ProjectDependencies) = postProject
+ 		{7FBD6F69-B9A4-69F1-A12B-8DACB3F8CD81} = {7FBD6F69-B9A4-69F1-A12B-8DACB3F8CD81}
+ 		{3B7F5656-177F-52EE-26B3-D6A75368D0A9} = {3B7F5656-177F-52EE-26B3-D6A75368D0A9}
+-		{63FB0B97-D1D9-5158-8E85-7F5B1E403817} = {63FB0B97-D1D9-5158-8E85-7F5B1E403817}
+ 	EndProjectSection
+ EndProject
+ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libGLESv2", "libGLESv2.vcxproj", "{7FBD6F69-B9A4-69F1-A12B-8DACB3F8CD81}"
+diff --git a/src/angle.gypi b/src/angle.gypi
+index 5339369..ef16749 100644
+--- a/src/angle.gypi
++++ b/src/angle.gypi
+@@ -7,6 +7,12 @@
+     {
+         'angle_code': 1,
+         'angle_post_build_script%': 0,
++        'angle_gen_path': '<(SHARED_INTERMEDIATE_DIR)/angle',
++        'angle_id_script_base': 'commit_id.py',
++        'angle_id_script': '<(angle_gen_path)/<(angle_id_script_base)',
++        'angle_id_header_base': 'commit.h',
++        'angle_id_header': '<(angle_gen_path)/id/<(angle_id_header_base)',
++        'angle_use_commit_id%': '<!(python <(angle_id_script_base) check ..)',
+     },
+     'includes':
+     [
+@@ -23,57 +29,71 @@
+             'copies':
+             [
+                 {
+-                    'destination': '<(SHARED_INTERMEDIATE_DIR)',
+-                    'files': [ 'commit_id.bat', 'copy_compiler_dll.bat', 'commit_id.py' ],
++                    'destination': '<(angle_gen_path)',
++                    'files': [ 'copy_compiler_dll.bat', '<(angle_id_script_base)' ],
+                 },
+             ],
+         },
+-
++    ],
++    'conditions':
++    [
++        ['angle_use_commit_id!=0',
+         {
+-            'target_name': 'commit_id',
+-            'type': 'none',
+-            'includes': [ '../build/common_defines.gypi', ],
+-            'dependencies': [ 'copy_scripts', ],
+-            'conditions':
++            'targets':
+             [
+-                ['OS=="win"',
+                 {
++                    'target_name': 'commit_id',
++                    'type': 'none',
++                    'includes': [ '../build/common_defines.gypi', ],
++                    'dependencies': [ 'copy_scripts', ],
+                     'actions':
+                     [
+                         {
+-                            'action_name': 'Generate Commit ID Header',
+-                            'message': 'Generating commit ID header...',
++                            'action_name': 'Generate ANGLE Commit ID Header',
++                            'message': 'Generating ANGLE Commit ID',
++                            # reference the git index as an input, so we rebuild on changes to the index
++                            'inputs': [ '<(angle_id_script)', '<(angle_path)/.git/index' ],
++                            'outputs': [ '<(angle_id_header)' ],
+                             'msvs_cygwin_shell': 0,
+-                            'inputs': [ '<(SHARED_INTERMEDIATE_DIR)/commit_id.bat', '<(angle_path)/.git/index' ],
+-                            'outputs': [ '<(SHARED_INTERMEDIATE_DIR)/commit.h' ],
+-                            'action': [ '<(SHARED_INTERMEDIATE_DIR)/commit_id.bat', '<(SHARED_INTERMEDIATE_DIR)' ],
++                            'action':
++                            [
++                                'python', '<(angle_id_script)', 'gen', '<(angle_path)', '<(angle_id_header)'
++                            ],
+                         },
+                     ],
+-                },
+-                { # OS != win
+-                    'actions':
++                    'direct_dependent_settings':
++                    {
++                        'include_dirs':
++                        [
++                            '<(angle_gen_path)',
++                        ],
++                    },
++                }
++            ]
++        },
++        { # angle_use_commit_id==0
++            'targets':
++            [
++                {
++                    'target_name': 'commit_id',
++                    'type': 'none',
++                    'copies':
+                     [
+                         {
+-                            'action_name': 'Generate Commit ID Header',
+-                            'message': 'Generating commit ID header...',
+-                            'inputs': [ '<(SHARED_INTERMEDIATE_DIR)/commit_id.py', '<(angle_path)/.git/index' ],
+-                            'outputs': [ '<(SHARED_INTERMEDIATE_DIR)/commit.h' ],
+-                            'action': [ 'python', '<(SHARED_INTERMEDIATE_DIR)/commit_id.py', '<(SHARED_INTERMEDIATE_DIR)/commit.h' ],
+-                        },
++                            'destination': '<(angle_gen_path)/id',
++                            'files': [ '<(angle_id_header_base)' ]
++                        }
+                     ],
+-                }],
+-            ],
+-            'direct_dependent_settings':
+-            {
+-                'include_dirs':
+-                [
+-                    '<(SHARED_INTERMEDIATE_DIR)',
+-                ],
+-            },
+-        },
+-    ],
+-    'conditions':
+-    [
++                    'direct_dependent_settings':
++                    {
++                        'include_dirs':
++                        [
++                            '<(angle_gen_path)',
++                        ],
++                    },
++                }
++            ]
++        }],
+         ['OS=="win"',
+         {
+             'targets':
+@@ -93,7 +113,7 @@
+                             'outputs': [ '<(PRODUCT_DIR)/D3DCompiler_46.dll' ],
+                             'action':
+                             [
+-                                "<(SHARED_INTERMEDIATE_DIR)/copy_compiler_dll.bat",
++                                "<(angle_gen_path)/copy_compiler_dll.bat",
+                                 "$(PlatformName)",
+                                 "<(windows_sdk_path)",
+                                 "<(PRODUCT_DIR)"
+diff --git a/src/commit.h b/src/commit.h
+new file mode 100644
+index 0000000..4c89a65
+--- /dev/null
++++ b/src/commit.h
+@@ -0,0 +1,14 @@
++//
++// Copyright (c) 2014 The ANGLE Project Authors. All rights reserved.
++// Use of this source code is governed by a BSD-style license that can be
++// found in the LICENSE file.
++//
++// commit.h:
++//   This is a default commit hash header, when git is not available.
++//
++
++#define ANGLE_COMMIT_HASH "unknown hash"
++#define ANGLE_COMMIT_HASH_SIZE 12
++#define ANGLE_COMMIT_DATE "unknown date"
++
++#define ANGLE_DISABLE_PROGRAM_BINARY_LOAD
+diff --git a/src/commit_id.py b/src/commit_id.py
+index 6339cca..7f711e7 100644
+--- a/src/commit_id.py
++++ b/src/commit_id.py
+@@ -1,19 +1,35 @@
+ import subprocess as sp
+ import sys
++import os
+ 
+-def grab_output(*command):
+-    return sp.Popen(command, stdout=sp.PIPE).communicate()[0].strip()
++# Usage: commit_id.py check <angle_dir> (checks if git is present)
++# Usage: commit_id.py gen <angle_dir> <file_to_write> (generates commit id)
+ 
++def grab_output(command, cwd):
++    return sp.Popen(command, stdout=sp.PIPE, shell=True, cwd=cwd).communicate()[0].strip()
++
++operation = sys.argv[1]
++cwd = sys.argv[2]
++
++if operation == 'check':
++    index_path = os.path.join(cwd, '.git', 'index')
++    if os.path.exists(index_path):
++        print("1")
++    else:
++        print("0")
++    sys.exit(0)
++
++output_file = sys.argv[3]
+ commit_id_size = 12
+ 
+ try:
+-    commit_id = grab_output('git', 'rev-parse', '--short=%d' % commit_id_size, 'HEAD')
+-    commit_date = grab_output('git', 'show', '-s', '--format=%ci', 'HEAD')
++    commit_id = grab_output('git rev-parse --short=%d HEAD' % commit_id_size, cwd)
++    commit_date = grab_output('git show -s --format=%ci HEAD', cwd)
+ except:
+     commit_id = 'invalid-hash'
+     commit_date = 'invalid-date'
+ 
+-hfile = open(sys.argv[1], 'w')
++hfile = open(output_file, 'w')
+ 
+ hfile.write('#define ANGLE_COMMIT_HASH "%s"\n'    % commit_id)
+ hfile.write('#define ANGLE_COMMIT_HASH_SIZE %d\n' % commit_id_size)
+diff --git a/src/common/version.h b/src/common/version.h
+index b9781d7..d9148d1 100644
+--- a/src/common/version.h
++++ b/src/common/version.h
+@@ -1,4 +1,4 @@
+-#include "commit.h"
++#include "id/commit.h"
+ 
+ #define ANGLE_MAJOR_VERSION 2
+ #define ANGLE_MINOR_VERSION 1
+diff --git a/src/libGLESv2/ProgramBinary.cpp b/src/libGLESv2/ProgramBinary.cpp
+index 8525ffb..e3ffa47 100644
+--- a/src/libGLESv2/ProgramBinary.cpp
++++ b/src/libGLESv2/ProgramBinary.cpp
+@@ -1018,6 +1018,9 @@ bool ProgramBinary::linkVaryings(InfoLog &infoLog, FragmentShader *fragmentShade
+ 
+ bool ProgramBinary::load(InfoLog &infoLog, const void *binary, GLsizei length)
+ {
++#ifdef ANGLE_DISABLE_PROGRAM_BINARY_LOAD
++    return false;
++#else
+     BinaryInputStream stream(binary, length);
+ 
+     int format = stream.readInt<int>();
+@@ -1260,6 +1263,7 @@ bool ProgramBinary::load(InfoLog &infoLog, const void *binary, GLsizei length)
+     initializeUniformStorage();
+ 
+     return true;
++#endif // #ifdef ANGLE_DISABLE_PROGRAM_BINARY_LOAD
+ }
+ 
+ bool ProgramBinary::save(void* binary, GLsizei bufSize, GLsizei *length)

pkgs/applications/networking/browsers/chromium/source/default.nix

@@ -38,7 +38,8 @@ stdenv.mkDerivation {
       third_party/WebKit/Source/build/scripts/preprocessor.pm
   '' + optionalString useOpenSSL ''
     cat $opensslPatches | patch -p1 -d third_party/openssl/openssl
-  '' + optionalString (!versionOlder version "34.0.0.0") ''
+  '' + optionalString (!versionOlder version "37.0.0.0") ''
+    patch -p1 -d third_party/angle < "${./angle_build_37.patch}"
   '';
 
   outputs = [ "out" "sandbox" "bundled" "main" ];

pkgs/applications/networking/browsers/chromium/source/sandbox_userns_36.patch

@@ -1,4 +1,4 @@
-commit c66c07a2ebcd1b68f412a5a2945fef15b3ba567c
+commit 0fec7e4a742f001c9816a8b58a1120fb44230867
 Author: aszlig <aszlig@redmoonstudios.org>
 Date:   Thu May 16 14:17:56 2013 +0200
 
@@ -47,7 +47,7 @@ index 9e39fba..00e4c79 100644
  
  #if defined(OS_CHROMEOS)
 diff --git a/base/process/launch_posix.cc b/base/process/launch_posix.cc
-index fe4da1a..7f118b8 100644
+index 457234f..a99ce9b 100644
 --- a/base/process/launch_posix.cc
 +++ b/base/process/launch_posix.cc
 @@ -40,6 +40,10 @@
@@ -111,7 +111,7 @@ index fe4da1a..7f118b8 100644
      // DANGER: fork() rule: in the child, if you don't end up doing exec*(),
      // you call _exit() instead of exit(). This is because _exit() does not
      // call any previously-registered (in the parent) exit handlers, which
-@@ -451,6 +480,40 @@ bool LaunchProcess(const std::vector<std::string>& argv,
+@@ -452,6 +481,40 @@ bool LaunchProcess(const std::vector<std::string>& argv,
      _exit(127);
    } else {
      // Parent process
@@ -153,10 +153,10 @@ index fe4da1a..7f118b8 100644
        // While this isn't strictly disk IO, waiting for another process to
        // finish is the sort of thing ThreadRestrictions is trying to prevent.
 diff --git a/content/browser/zygote_host/zygote_host_impl_linux.cc b/content/browser/zygote_host/zygote_host_impl_linux.cc
-index 94bdc16..3398615 100644
+index 9d63ad9..0885705 100644
 --- a/content/browser/zygote_host/zygote_host_impl_linux.cc
 +++ b/content/browser/zygote_host/zygote_host_impl_linux.cc
-@@ -143,6 +143,9 @@ void ZygoteHostImpl::Init(const std::string& sandbox_cmd) {
+@@ -144,6 +144,9 @@ void ZygoteHostImpl::Init(const std::string& sandbox_cmd) {
    // A non empty sandbox_cmd means we want a SUID sandbox.
    using_suid_sandbox_ = !sandbox_cmd.empty();
  
@@ -166,10 +166,10 @@ index 94bdc16..3398615 100644
    // Start up the sandbox host process and get the file descriptor for the
    // renderers to talk to it.
    const int sfd = RenderSandboxHostLinux::GetInstance()->GetRendererSocket();
-@@ -162,11 +165,24 @@ void ZygoteHostImpl::Init(const std::string& sandbox_cmd) {
-     dummy_fd.reset(socket(AF_UNIX, SOCK_DGRAM, 0));
-     CHECK_GE(dummy_fd.get(), 0);
-     fds_to_map.push_back(std::make_pair(dummy_fd.get(), kZygoteIdFd));
+@@ -156,11 +159,24 @@ void ZygoteHostImpl::Init(const std::string& sandbox_cmd) {
+     sandbox_client->PrependWrapper(&cmd_line);
+     sandbox_client->SetupLaunchOptions(&options, &fds_to_map, &dummy_fd);
+     sandbox_client->SetupLaunchEnvironment();
 +    userns_sandbox = sandbox_client->IsNoSuid();
    }
  
@@ -192,7 +192,7 @@ index 94bdc16..3398615 100644
    dummy_fd.reset();
  
 diff --git a/content/zygote/zygote_main_linux.cc b/content/zygote/zygote_main_linux.cc
-index cc28a6f..e8f665a 100644
+index 11f0602..b7b8214 100644
 --- a/content/zygote/zygote_main_linux.cc
 +++ b/content/zygote/zygote_main_linux.cc
 @@ -389,6 +389,13 @@ static bool EnterSuidSandbox(sandbox::SetuidSandboxClient* setuid_sandbox) {
@@ -210,10 +210,10 @@ index cc28a6f..e8f665a 100644
    // Previously, we required that the binary be non-readable. This causes the
    // kernel to mark the process as non-dumpable at startup. The thinking was
 diff --git a/sandbox/linux/suid/client/setuid_sandbox_client.cc b/sandbox/linux/suid/client/setuid_sandbox_client.cc
-index 3300cb4..4bfa516 100644
+index fc03cdd..a972faa 100644
 --- a/sandbox/linux/suid/client/setuid_sandbox_client.cc
 +++ b/sandbox/linux/suid/client/setuid_sandbox_client.cc
-@@ -212,6 +212,10 @@ bool SetuidSandboxClient::IsInNewNETNamespace() const {
+@@ -229,6 +229,10 @@ bool SetuidSandboxClient::IsInNewNETNamespace() const {
    return env_->HasVar(kSandboxNETNSEnvironmentVarName);
  }
  
@@ -224,7 +224,7 @@ index 3300cb4..4bfa516 100644
  bool SetuidSandboxClient::IsSandboxed() const {
    return sandboxed_;
  }
-@@ -267,8 +271,7 @@ void SetuidSandboxClient::PrependWrapper(base::CommandLine* cmd_line,
+@@ -277,8 +281,7 @@ void SetuidSandboxClient::PrependWrapper(base::CommandLine* cmd_line) {
                                      "LinuxSUIDSandboxDevelopment.";
    }
  
@@ -234,10 +234,10 @@ index 3300cb4..4bfa516 100644
      LOG(FATAL) << "The SUID sandbox helper binary was found, but is not "
                    "configured correctly. Rather than run without sandboxing "
                    "I'm aborting now. You need to make sure that "
-@@ -284,6 +287,12 @@ void SetuidSandboxClient::PrependWrapper(base::CommandLine* cmd_line,
-     options->allow_new_privs = true;
-     UnsetExpectedEnvironmentVariables(&options->environ);
+@@ -286,6 +289,12 @@ void SetuidSandboxClient::PrependWrapper(base::CommandLine* cmd_line) {
    }
+ 
+   cmd_line->PrependWrapper(sandbox_binary);
 +
 +  if (!((st.st_uid == 0) &&
 +        (st.st_mode & S_ISUID) &&
@@ -246,12 +246,12 @@ index 3300cb4..4bfa516 100644
 +  }
  }
  
- void SetuidSandboxClient::SetupLaunchEnvironment() {
+ void SetuidSandboxClient::SetupLaunchOptions(
 diff --git a/sandbox/linux/suid/client/setuid_sandbox_client.h b/sandbox/linux/suid/client/setuid_sandbox_client.h
-index 332c63b..4f603f8 100644
+index 2bbad7a..8605475 100644
 --- a/sandbox/linux/suid/client/setuid_sandbox_client.h
 +++ b/sandbox/linux/suid/client/setuid_sandbox_client.h
-@@ -70,6 +70,8 @@ class SANDBOX_EXPORT SetuidSandboxClient {
+@@ -66,6 +66,8 @@ class SANDBOX_EXPORT SetuidSandboxClient {
    bool IsInNewPIDNamespace() const;
    // Did the setuid helper create a new network namespace ?
    bool IsInNewNETNamespace() const;

pkgs/applications/networking/browsers/chromium/source/sources.nix

@@ -1,21 +1,21 @@
 # This file is autogenerated from update.sh in the parent directory.
 {
   dev = {
-    version = "36.0.1964.2";
-    sha256 = "0yrp1553pl0310h5pkfh2x27xhfrrxrpc25zad36f3k73iwmbg4c";
-    sha256bin32 = "02brz6lj7vfyyapc942dhdw7z26ksvnm7xqryfxn49y1rkd26xrf";
-    sha256bin64 = "0ibry2bfjcqnihwb8ykyl48qk25bzfxmw948sm70xnrmwbkv42ny";
+    version = "37.0.2054.3";
+    sha256 = "1sly1fb9wh10m36crikahn7wgsq7j090jaga4l8zk4kihzprcnj2";
+    sha256bin32 = "0242ypzgzskkmsw3iyirxzlm1gbng94lv723ffcr018grq9yg4gs";
+    sha256bin64 = "17kzb7k0vn96wa6a4xfx05885li1qjg8bp6y3ngs2i0wws9ypfd9";
   };
   beta = {
-    version = "35.0.1916.86";
-    sha256 = "0pjgpif8fiq14fk05pxs3js0pcg2jwmw0fklcci11rzq6rcm7r2g";
-    sha256bin32 = "1js71l88hqfli6c342iigwddxrqrzlx5fcazfxwlps4bdwgig6f8";
-    sha256bin64 = "1sqavz6lh0ryf8jlw8jcfwk265spxs70bhigcgcqsd6647fbdqsr";
+    version = "36.0.1985.84";
+    sha256 = "02hhqx5m4hxmnf8l3a2ah9k39bpz35sll6gv89vz27vdgb6mza0j";
+    sha256bin32 = "1jjxzknyiw6d5p0bcb7c9d0siffg55wmm34lq1phz1jlqq6hz6zy";
+    sha256bin64 = "1jr9a386arfmd8rskns9bmlczzr3xzcw9ykv7xf23iz86qqp723r";
   };
   stable = {
-    version = "35.0.1916.114";
-    sha256 = "1bvpkwjchkzx1qfc93hd8md6sz5sd7pl55xc8b8m3iakbp0csvsn";
-    sha256bin32 = "0zm5770cv9dld37xall9lpl9faa0bgjcp8hjx6l1ivfhs6lxbxxa";
-    sha256bin64 = "18p302aj2d7xdza9kf438vbz3wqh8db7v2dq5d9b4b3ak6w9ld03";
+    version = "35.0.1916.153";
+    sha256 = "03p7wmlvbrgd8m94344z4azkhrffwrr5c76dm8c4jcxs0x1yn318";
+    sha256bin32 = "0xm34xwdai8ns6bkq5dshh4izls70rwgvya23md4vxq6iv78sykn";
+    sha256bin64 = "1x2cm1i8v8d69856b42anms33clv63adzpqy58in6i9vba13swif";
   };
 }

pkgs/applications/networking/browsers/chromium/source/update.nix

@@ -99,7 +99,9 @@ in rec {
 
     prefetch_sha()
     {
-      echo "$(prefetch_main_sha "$@").$(prefetch_deb_sha "$@")";
+      main_sha="$(prefetch_main_sha "$@")" || return 1;
+      deb_sha="$(prefetch_deb_sha "$@")" || return 1;
+      echo "$main_sha.$deb_sha";
       return 0;
     }
 

pkgs/applications/networking/browsers/conkeror/default.nix

@@ -1,12 +1,12 @@
 { stdenv, fetchgit, unzip, xulrunner, makeWrapper }:
 
 stdenv.mkDerivation {
-  name = "conkeror-1.0pre-20140509";
+  name = "conkeror-1.0pre-20140616";
 
   src = fetchgit {
     url = git://repo.or.cz/conkeror.git;
-    rev = "eaf02dccf979d824667d177544103af000ae40bf";
-    sha256 = "1896db59d260f34a459402cb0c252b636aab9bf0378ae663a6d039f15af5b350";
+    rev = "8a26fff5896a3360549e2adfbf06b1d57e909266";
+    sha256 = "56f1c71ca1753a63d7599d3e8bf52277711b2693e7709ed7c146f34940441cb4";
   };
 
   buildInputs = [ unzip makeWrapper ];

pkgs/applications/networking/browsers/dwb/default.nix

@@ -2,12 +2,12 @@
   m4, glib_networking, gsettings_desktop_schemas }:
 
 stdenv.mkDerivation {
-  name = "dwb-2014-06-03";
+  name = "dwb-2014-06-17";
 
   src = fetchgit {
     url = "https://bitbucket.org/portix/dwb.git";
-    rev = "d00af56c1e60978060f1b2077f3d49995b98c54f";
-    sha256 = "02bs9nbgk8ghaxywhqd8mii4lik748dssn551m00i1305p6q1cjj";
+    rev = "9f4bdb9a1f8d5e45071019da4626231dfebd4d8e";
+    sha256 = "1nj34w2hhw47jsmswsc1y6a09my8zdd01qxwai8dxdvisld3marm";
   };
 
   buildInputs = [ pkgconfig makeWrapper gsettings_desktop_schemas libsoup webkit gtk3 gnutls json_c m4 ];

pkgs/applications/networking/mailreaders/thunderbird/default.nix

@@ -12,13 +12,14 @@
   enableOfficialBranding ? false
 }:
 
-let version = "17.0.11esr"; in
+let version = "17.0.11"; in
+let verName = "${version}esr"; in
 
 stdenv.mkDerivation {
-  name = "thunderbird-${version}";
+  name = "thunderbird-${verName}";
 
   src = fetchurl {
-    url = "ftp://ftp.mozilla.org/pub/thunderbird/releases/${version}/source/thunderbird-${version}.source.tar.bz2";
+    url = "ftp://ftp.mozilla.org/pub/thunderbird/releases/${verName}/source/thunderbird-${verName}.source.tar.bz2";
     sha256 = "1m2lph8x82kgxqzlyaxr1l1x7s4qnqfzfnqck4b777914mrv1mdp";
   };
 

pkgs/applications/version-management/git-and-tools/git/default.nix

@@ -82,6 +82,10 @@ stdenv.mkDerivation {
       # gitweb.cgi, need to patch so that it's found
       sed -i -e "s|'compressor' => \['gzip'|'compressor' => ['${gzip}/bin/gzip'|" \
           $out/share/gitweb/gitweb.cgi
+
+      wrapProgram $out/bin/git \
+          --set GIT_SSL_CAINFO "\$OPENSSL_X509_CERT_FILE"
+
     ''
 
    + (if svnSupport then

pkgs/data/fonts/aurulent-sans/default.nix

@@ -0,0 +1,23 @@
+{stdenv, fetchgit}:
+
+stdenv.mkDerivation rec {
+  name = "aurulent-sans-0.1";
+  src = fetchgit {
+    url = "https://github.com/deepfire/hartke-aurulent-sans.git";
+    rev = "refs/tags/${name}";
+    sha256 = "01hvpvbrks40g9k1xr2f1gxnd5wd0sxidgfbwrm94pdi1a36xxrk";
+  };
+  buildPhase = "true";
+  installPhase = "
+    fontDir=$out/share/fonts/opentype
+    mkdir -p $fontDir
+    cp *.otf $fontDir
+  ";
+  meta = {
+    description = "Aurulent Sans";
+    longDescription = "Aurulent Sans is a humanist sans serif intended to be used as an interface font.";
+    homepage = http://delubrum.org/;
+    license = "SIL";
+    platforms = stdenv.lib.platforms.all;
+  };
+}

pkgs/development/compilers/agda/stdlib-0.8.nix

@@ -1,16 +1,15 @@
 { cabal, fetchurl, filemanip, Agda }:
 
-cabal.mkDerivation (self: {
-  pname = "Agda-lib-ffi";
-  version = "2.4.0";
+cabal.mkDerivation (self: rec {
+  pname = "Agda-stdlib";
+  version = "0.8";
 
   src = fetchurl {
-    url = "https://github.com/agda/agda-stdlib/archive/v2.4.0.tar.gz";
-    sha256 = "1rz0jrkm1b8d8aj9hbj3yl2k219c57r0cizfx98qqf1b9mwixzbf";
+    url = "https://github.com/agda/agda-stdlib/archive/v${version}.tar.gz";
+    sha256 = "03gdcy2gar46qlmd6w91y05cm1x304ig6bda90ryww9qn05kif78";
   };
 
   buildDepends = [ filemanip Agda ];
-  jailbreak = true;             # otherwise, it complains about base
 
   preConfigure = "cd ffi";
 
@@ -18,7 +17,7 @@ cabal.mkDerivation (self: {
       mkdir -p $out/share
       cd ..
       runhaskell GenerateEverything
-      ${Agda}/bin/agda -i . -i src Everything.agda
+      agda -i . -i src Everything.agda
       cp -pR src $out/share/agda
   '';
 

pkgs/development/compilers/chicken/default.nix

@@ -1,7 +1,7 @@
 { stdenv, fetchurl }:
 
 let
-  version = "4.9.0";
+  version = "4.9.0.1";
   platform = with stdenv;
     if isDarwin then "macosx"
     else if isCygwin then "cygwin"
@@ -14,7 +14,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "http://code.call-cc.org/releases/4.9.0/chicken-${version}.tar.gz";
-    sha256 = "08jaavr3lhs0z2q9k7b7w8l3fsxpms58zxg8nyk8674p54cbwaig";
+    sha256 = "0598mar1qswfd8hva9nqs88zjn02lzkqd8fzdd21dz1nki1prpq4";
   };
 
   buildFlags = "PLATFORM=${platform} PREFIX=$(out) VARDIR=$(out)/var/lib";

pkgs/development/compilers/cudatoolkit/6.0.nix

@@ -0,0 +1,60 @@
+{ stdenv, fetchurl, patchelf, perl, ncurses, expat, python, zlib
+, xlibs, gtk2, glib, fontconfig, freetype, unixODBC, alsaLib
+} :
+
+stdenv.mkDerivation rec {
+  name = "cudatoolkit-6.0.37";
+
+  dontPatchELF = true;
+  dontStrip = true;
+
+  src =
+    if stdenv.system == "x86_64-linux" then
+      fetchurl {
+        url = http://developer.download.nvidia.com/compute/cuda/6_0/rel/installers/cuda_6.0.37_linux_64.run;
+        sha256 = "991e436c7a6c94ec67cf44204d136adfef87baa3ded270544fa211179779bc40";
+      }
+    else throw "cudatoolkit does not support platform ${stdenv.system}";
+
+  outputs = [ "out" "sdk" ];
+
+  buildInputs = [ perl ];
+
+  runtimeDependencies = [
+    ncurses expat python zlib
+    xlibs.libX11 xlibs.libXext xlibs.libXrender xlibs.libXt xlibs.libXtst xlibs.libXi xlibs.libXext
+    gtk2 glib fontconfig freetype unixODBC alsaLib
+  ];
+
+  rpath = "${stdenv.lib.makeLibraryPath runtimeDependencies}:${stdenv.gcc.gcc}/lib64";
+
+  unpackPhase = ''
+    sh $src --keep --noexec
+    cd pkg/run_files
+    sh cuda-linux64-rel-6.0.37-18176142.run --keep --noexec
+    sh cuda-samples-linux-6.0.37-18176142.run --keep --noexec
+    cd pkg
+  '';
+
+  buildPhase = ''
+    find . -type f -executable -exec patchelf \
+      --set-interpreter "$(cat $NIX_GCC/nix-support/dynamic-linker)" \
+      '{}' \; || true
+    find . -type f -exec patchelf \
+      --set-rpath $rpath:$out/jre/lib/amd64/jli:$out/lib:$out/lib64:$out/nvvm/lib:$out/nvvm/lib64:$(cat $NIX_GCC/nix-support/orig-gcc)/lib \
+      --force-rpath \
+      '{}' \; || true
+  '';
+
+  installPhase = ''
+    mkdir $out $sdk
+    perl ./install-linux.pl --prefix="$out"
+    rm $out/tools/CUDA_Occupancy_Calculator.xls
+    perl ./install-sdk-linux.pl --prefix="$sdk" --cudaprefix="$out"
+  '';
+
+  meta = {
+    license = [ "nonfree" ];
+  };
+}
+

pkgs/development/compilers/idris/wrapper.nix

@@ -1,10 +1,10 @@
-{ gmp, makeWrapper, gcc, runCommand, idris_plain}:
+{ gmp, makeWrapper, gcc, runCommand, idris_plain, boehmgc}:
 
 runCommand "idris-wrapper" {} ''
   source ${makeWrapper}/nix-support/setup-hook
   mkdir -p $out/bin
   ln -s ${idris_plain}/bin/idris $out/bin
       wrapProgram $out/bin/idris \
-        --suffix NIX_CFLAGS_COMPILE : '"-I${gmp}/include -L${gmp}/lib"' \
+        --suffix NIX_CFLAGS_COMPILE : '"-I${gmp}/include -L${gmp}/lib -L${boehmgc}/lib"' \
         --suffix PATH : ${gcc}/bin
 ''

pkgs/development/interpreters/php/5.4.nix

@@ -1,7 +1,7 @@
 { stdenv, fetchurl, composableDerivation, autoconf, automake, flex, bison
 , apacheHttpd, mysql, libxml2, readline, zlib, curl, gd, postgresql, gettext
 , openssl, pkgconfig, sqlite, config, libiconv, libjpeg, libpng, freetype
-, libxslt, libmcrypt, bzip2, icu, openldap, cyrus_sasl, libmhash }:
+, libxslt, libmcrypt, bzip2, icu, openldap, cyrus_sasl, libmhash, freetds }:
 
 let
   libmcryptOverride = libmcrypt.override { disablePosixThreads = true; };
@@ -171,6 +171,11 @@ composableDerivation.composableDerivation {} ( fixed : let inherit (fixed.fixed)
         configureFlags = ["--enable-fpm"];
       };
 
+      mssql = {
+        configureFlags = ["--with-mssql=${freetds}"];
+        buildInputs = [freetds];
+      };
+
       /*
          php is build within this derivation in order to add the xdebug lines to the php.ini.
          So both Apache and command line php both use xdebug without having to configure anything.
@@ -213,6 +218,7 @@ composableDerivation.composableDerivation {} ( fixed : let inherit (fixed.fixed)
     zipSupport = config.php.zip or true;
     ftpSupport = config.php.ftp or true;
     fpmSupport = config.php.fpm or true;
+    mssqlSupport = config.php.mssql or true;
   };
 
   configurePhase = ''

pkgs/development/interpreters/pypy/2.3/setup-hook.sh

@@ -1,12 +1,12 @@
 addPythonPath() {
-    addToSearchPathWithCustomDelimiter : PYTHONPATH $1/lib/pypy2.2/site-packages
+    addToSearchPathWithCustomDelimiter : PYTHONPATH $1/lib/pypy2.3/site-packages
 }
 
 toPythonPath() {
     local paths="$1"
     local result=
     for i in $paths; do
-        p="$i/lib/pypy2.2/site-packages"
+        p="$i/lib/pypy2.3/site-packages"
         result="${result}${result:+:}$p"
     done
     echo $result

pkgs/development/libraries/freetds/default.nix

@@ -8,6 +8,13 @@ stdenv.mkDerivation {
     sha256 = "0r946axzxs0czsmr7283w7vmk5jx3jnxxc32d2ncxsrsh2yli0ba";
   };
 
+  doDist = true;
+
+  distPhase = ''
+    touch $out/include/tds.h
+    touch $out/lib/libtds.a
+  '';
+
   meta = {
     description =
       "Libraries to natively talk to Microsoft SQL Server and Sybase databases";

pkgs/development/libraries/haskell/digestive-functors-aeson/default.nix

@@ -4,8 +4,8 @@
 
 cabal.mkDerivation (self: {
   pname = "digestive-functors-aeson";
-  version = "1.1.8";
-  sha256 = "0qvzr9s0vzgzh7mix6ncjn731krln9w47zrqb5jkj92rv7mf5sgz";
+  version = "1.1.9";
+  sha256 = "0lm6byv5vayzg2jp0fqkbi4wkbhvnjw5sl61qnvpa1pqk6p64mrm";
   buildDepends = [ aeson digestiveFunctors lens safe text vector ];
   testDepends = [
     aeson digestiveFunctors HUnit mtl scientific tasty tastyHunit text

pkgs/development/libraries/haskell/fb/default.nix

@@ -27,4 +27,5 @@ cabal.mkDerivation (self: {
     license = self.stdenv.lib.licenses.bsd3;
     platforms = self.ghc.meta.platforms;
   };
+  jailbreak = true;
 })

pkgs/development/libraries/haskell/json-assertions/default.nix

@@ -2,8 +2,8 @@
 
 cabal.mkDerivation (self: {
   pname = "json-assertions";
-  version = "1.0.2";
-  sha256 = "0ppj1xxbi0yrmv6vkmwkz91vvwzjd0ixj60432liwmd6h13apky0";
+  version = "1.0.3";
+  sha256 = "1iklsgzfxgiizqn90r9wfzfaz84fj8by4arppp139w6ybzh3b0r8";
   buildDepends = [ aeson indexed indexedFree lens text ];
   meta = {
     homepage = "http://github.com/ocharles/json-assertions.git";

pkgs/development/libraries/haskell/tcache-AWS/default.nix

@@ -0,0 +1,14 @@
+{ cabal, aws, conduit, httpConduit, network, TCache, text }:
+
+cabal.mkDerivation (self: {
+  pname = "tcache-AWS";
+  version = "0.0.1";
+  sha256 = "18hi8jvc117pxjhpb891hqlsbi4wvmd6nr3vwnqqr7rcw2dsmnwv";
+  buildDepends = [ aws conduit httpConduit network TCache text ];
+  meta = {
+    description = "tcache using Amazon Web Services as default persistence mechanism";
+    license = self.stdenv.lib.licenses.bsd3;
+    platforms = self.ghc.meta.platforms;
+  };
+  maintainers = [ self.stdenv.lib.maintainers.tomberek ];
+})

pkgs/development/libraries/haskell/wai/default.nix

@@ -2,8 +2,8 @@
 
 cabal.mkDerivation (self: {
   pname = "wai";
-  version = "3.0.0.1";
-  sha256 = "1f8alq4lygjdb4pzb7xm6jml3dviygk18siwfwb751va3j2fmi0v";
+  version = "3.0.0.2";
+  sha256 = "1zmpalgck8jns45wnlarw26kfw45ml0cp82kdqqpbckscxnr04r1";
   buildDepends = [ blazeBuilder httpTypes network text vault ];
   testDepends = [ blazeBuilder hspec ];
   meta = {

pkgs/development/libraries/haskell/warp/default.nix

@@ -6,8 +6,8 @@
 
 cabal.mkDerivation (self: {
   pname = "warp";
-  version = "3.0.0.1";
-  sha256 = "05x216fj7s1i963xipi0p7vmkz5l0nma1fjqiq040fg3rngw4yqb";
+  version = "3.0.0.3";
+  sha256 = "0lhmhgbza49lkbay6ydj5h1g04qzs4jx2wyq4bhddjrpmxsdsy2y";
   buildDepends = [
     blazeBuilder caseInsensitive hashable httpDate httpTypes network
     simpleSendfile streamingCommons text unixCompat void wai

pkgs/development/libraries/haskell/websockets/default.nix

@@ -24,4 +24,5 @@ cabal.mkDerivation (self: {
     platforms = self.ghc.meta.platforms;
     maintainers = [ self.stdenv.lib.maintainers.ocharles ];
   };
+  jailbreak = true;
 })

pkgs/development/libraries/libogg/default.nix

@@ -1,16 +1,20 @@
-{ stdenv, fetchurl, xz }:
+{ stdenv, fetchurl }:
 
-stdenv.mkDerivation rec {
-  name = "libogg-1.3.1";
+let
+  name = "libogg-1.3.2";
+in
+stdenv.mkDerivation {
+  inherit name;
   
   src = fetchurl {
     url = "http://downloads.xiph.org/releases/ogg/${name}.tar.xz";
-    sha256 = "1ynwij1qdibwb2nvcl3ixri0c6pvq1higl96hf87iyqsv1wasnrs";
+    sha256 = "16z74q422jmprhyvy7c9x909li8cqzmvzyr8cgbm52xcsp6pqs1z";
   };
 
-  nativeBuildInputs = [ xz ];
-
-  meta = {
+  meta = with stdenv.lib; {
     homepage = http://xiph.org/ogg/;
+    license = licenses.bsd3;
+    maintainers = [ maintainers.emery ];
+    platforms = platforms.all;
   };
 }

pkgs/development/libraries/libvorbis/default.nix

@@ -1,17 +1,24 @@
-{ stdenv, fetchurl, libogg, xz }:
+{ stdenv, fetchurl, libogg }:
 
-stdenv.mkDerivation rec {
-  name = "libvorbis-1.3.3";
+let
+  name = "libvorbis-1.3.4";
+in
+stdenv.mkDerivation {
+  inherit name;
   
   src = fetchurl {
     url = "http://downloads.xiph.org/releases/vorbis/${name}.tar.xz";
-    sha256 = "1gby6hapz9njx4l9g0pndyk4q83z5fgrgc30mfwfgx7bllspsk43";
+    sha256 = "0wpk87jnhngcl3nc5i39flkycx1sjzilx8jjx4zc4p8r55ylj19g";
   };
 
-  nativeBuildInputs = [ xz ];
   propagatedBuildInputs = [ libogg ];
 
-  meta = {
+  doCheck = true;
+
+  meta = with stdenv.lib; {
     homepage = http://xiph.org/vorbis/;
+    license = licenses.bsd3;
+    maintainers = [ maintainers.emery ];
+    platforms = platforms.all;
   };
 }

pkgs/development/tools/build-managers/leiningen/default.nix

@@ -3,17 +3,17 @@
 
 stdenv.mkDerivation rec {
   pname = "leiningen";
-  version = "2.4.0";
+  version = "2.4.2";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "https://raw.github.com/technomancy/leiningen/${version}/bin/lein-pkg";
-    sha256 = "0mdfp5r5qid42x7rq1cmyxqmvjdj2hk9rjz8pryf4zq3bk38m1cg";
+    sha256 = "1qdq3v7wv9jacw4bipgx24knlipw6zdcx43yd1qyw6zwaad51ckw";
   };
 
   jarsrc = fetchurl {
     url = "https://github.com/technomancy/leiningen/releases/download/${version}/${name}-standalone.jar";
-    sha256 = "099r5qcldb214c3857i7dbbqn531aahzrz39qfhqxc6f476ncdh0";
+    sha256 = "0n4kpmzw9nvppq758lhnrr7xps5j6gwmdm98m772cj7j4vixsrzb";
   };
 
   patches = [ ./lein-fix-jar-path.patch ];

pkgs/development/tools/misc/arcanist/default.nix

@@ -3,18 +3,18 @@
 let
   libphutil = fetchgit {
     url    = "git://github.com/facebook/libphutil.git";
-    rev    = "7e75bf271c669b61eb6e6e2ea312a36e64b80a4a";
-    sha256 = "ffb7ee8141b925889e9bbc945d2f38f12d1489148b9c9b7eaeadd7524d254a78";
+    rev    = "0027e97cd6cbafcbdc626b4ac6cf315b9508a14f";
+    sha256 = "4781a4e3e1cb72da24e97f89a9b879803be8e1cf6baa2a4517801dfb893eec26";
   };
   arcanist = fetchgit {
     url    = "git://github.com/facebook/arcanist.git";
-    rev    = "50caec620a8ed45c54323cb71fee72fd0d935115";
-    sha256 = "dd18ed22375ad1ba058703952be0d339d9c93704e9d75dd7e4e6625236dfe9b0";
+    rev    = "680ec3670cd9d9195debf3e9b674b1b232156e61";
+    sha256 = "a70cde586960676c0d69f4d98e6936633e0d79c37c6f6cc5b0213146a6b18c83";
   };
 in
 stdenv.mkDerivation rec {
   name    = "arcanist-${version}";
-  version = "20140606";
+  version = "20140617";
 
   src = [ arcanist libphutil ];
   buildInputs = [ php makeWrapper flex ];

pkgs/games/openxcom/default.nix

@@ -0,0 +1,25 @@
+{stdenv, fetchurl, cmake, mesa, zlib, openssl, libyamlcpp, boostHeaders
+, SDL, SDL_image, SDL_mixer, SDL_gfx }:
+
+let version = "1.0.0"; in
+stdenv.mkDerivation {
+  name = "openxcom-${version}";
+  src = fetchurl {
+    url = http://openxcom.org/file/1726/;
+    sha256 = "1rmg10nklvf86ckbbssyvbg5cd4p7in5zq3mas2yyffdjk9i40v6";
+    name = "openxcom-${version}.tar.gz";
+  };
+
+  buildInputs = [ cmake mesa zlib openssl libyamlcpp boostHeaders
+    SDL SDL_image SDL_mixer SDL_gfx ];
+
+  meta = {
+    description = "Open source clone of UFO: Enemy Unknown";
+    homepage = http://openxcom.org;
+    repositories.git = https://github.com/SupSuper/OpenXcom.git;
+    maintainers = [ stdenv.lib.maintainers.page ];
+    platforms = stdenv.lib.platforms.linux;
+    license = "GPLv3";
+  };
+
+}

pkgs/os-specific/linux/alsa-plugins/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, lib, pkgconfig, alsaLib, pulseaudio ? null, jackaudio ? null }:
+{ stdenv, fetchurl, lib, pkgconfig, alsaLib, libogg, pulseaudio ? null, jackaudio ? null }:
 
 stdenv.mkDerivation rec {
   name = "alsa-plugins-1.0.28";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   # ToDo: a52, etc.?
   buildInputs =
-    [ pkgconfig alsaLib ]
+    [ pkgconfig alsaLib libogg ]
     ++ lib.optional (pulseaudio != null) pulseaudio
     ++ lib.optional (jackaudio != null) jackaudio;
 

pkgs/os-specific/linux/kernel/common-config.nix

@@ -238,7 +238,7 @@ with stdenv.lib;
   SLIP_COMPRESSED y # CSLIP compressed headers
   SLIP_SMART y
   THERMAL_HWMON y # Hardware monitoring support
-  USB_DEBUG n
+  USB_DEBUG? n
   USB_EHCI_ROOT_HUB_TT y # Root Hub Transaction Translators
   USB_EHCI_TT_NEWSCHED y # Improved transaction translator scheduling
   X86_CHECK_BIOS_CORRUPTION y

pkgs/os-specific/linux/kernel/linux-3.15.nix

@@ -1,13 +1,12 @@
 { stdenv, fetchurl, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.15";
+  version = "3.15.1";
   extraMeta.branch = "3.15";
-  modDirVersion = "3.15.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "153pn0zjzgi3ls4gy12n900ayskpq0yncn0vra5glh20ps3px4n3";
+    sha256 = "0bmzag945bb9v20xc2f6i4syx456prai3qj5cxhm8cb76wby4s8b";
   };
 
   features.iwlwifi = true;

pkgs/os-specific/linux/kernel/linux-testing.nix

@@ -1,12 +1,14 @@
 { stdenv, fetchurl, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.15-rc8";
-  extraMeta.branch = "3.15";
+  # Reason to add:  RTL8192EE
+  version = "3.16-rc1";
+  modDirVersion = "3.16.0-rc1";
+  extraMeta.branch = "3.16";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/testing/linux-${version}.tar.xz";
-    sha256 = "";
+    sha256 = "1y2ssifw6db40mr4j6k9c0kjwb4ssrrps74pc38krq4d6yzinhmq";
   };
 
   features.iwlwifi = true;
@@ -14,4 +16,8 @@ import ./generic.nix (args // rec {
   features.needsCifsUtils = true;
   features.canDisableNetfilterConntrackHelpers = true;
   features.netfilterRPFilter = true;
+
+  # Should the testing kernels ever be built on Hydra?
+  extraMeta.hydraPlatforms = [];
+
 } // (args.argsOverride or {}))

pkgs/servers/http/nginx/default.nix

@@ -3,7 +3,10 @@
 , rtmp ? false
 , fullWebDAV ? false
 , syslog ? false
-, moreheaders ? false}:
+, moreheaders ? false
+, echo ? false }:
+
+with stdenv.lib;
 
 let
   version = "1.6.0";
@@ -35,6 +38,12 @@ let
     rev = "0c6e05d3125a97892a250e9ba8b7674163ba500b";
     sha256 = "e121d97fd3c81c64e6cbf6902bbcbdb01be9ac985c6832d40434379d5e998eaf";
   };
+
+  echo-ext = fetchgit {
+    url = https://github.com/openresty/echo-nginx-module.git;
+    rev = "refs/tags/v0.53";
+    sha256 = "90d4e3a49c678019f4f335bc18529aa108fcc9cfe0747ea4e2f6084a70da2868";
+  };
 in
 
 stdenv.mkDerivation rec {
@@ -43,7 +52,7 @@ stdenv.mkDerivation rec {
 
   buildInputs =
     [ openssl zlib pcre libxml2 libxslt gd geoip
-    ] ++ stdenv.lib.optional fullWebDAV expat;
+    ] ++ optional fullWebDAV expat;
 
   patches = if syslog then [ "${syslog-ext}/syslog-1.5.6.patch" ] else [];
 
@@ -69,12 +78,15 @@ stdenv.mkDerivation rec {
     "--with-ipv6"
     # Install destination problems
     # "--with-http_perl_module"
-  ] ++ stdenv.lib.optional rtmp "--add-module=${rtmp-ext}"
-    ++ stdenv.lib.optional fullWebDAV "--add-module=${dav-ext}"
-    ++ stdenv.lib.optional syslog "--add-module=${syslog-ext}"
-    ++ stdenv.lib.optional moreheaders "--add-module=${moreheaders-ext}";
+  ] ++ optional rtmp "--add-module=${rtmp-ext}"
+    ++ optional fullWebDAV "--add-module=${dav-ext}"
+    ++ optional syslog "--add-module=${syslog-ext}"
+    ++ optional moreheaders "--add-module=${moreheaders-ext}"
+    ++ optional echo "--add-module=${echo-ext}"
+    ++ optional (elem stdenv.system (with platforms; linux ++ freebsd)) "--with-file-aio";
 
-  additionalFlags = stdenv.lib.optionalString stdenv.isDarwin "-Wno-error=deprecated-declarations";
+
+  additionalFlags = optionalString stdenv.isDarwin "-Wno-error=deprecated-declarations";
 
   preConfigure = ''
     export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -I${libxml2}/include/libxml2 $additionalFlags"
@@ -87,8 +99,8 @@ stdenv.mkDerivation rec {
   meta = {
     description = "A reverse proxy and lightweight webserver";
     homepage    = http://nginx.org;
-    license     = stdenv.lib.licenses.bsd2;
-    platforms   = stdenv.lib.platforms.all;
-    maintainers = with stdenv.lib.maintainers; [ thoughtpolice raskin ];
+    license     = licenses.bsd2;
+    platforms   = platforms.all;
+    maintainers = with maintainers; [ thoughtpolice raskin ];
   };
 }

pkgs/stdenv/generic/default.nix

@@ -82,9 +82,7 @@ let
               { nixpkgs.config.allowUnfree = true; }
             in configuration.nix to override this. If you use Nix standalone, you can add
               { allowUnfree = true; }
-            to ~/.nixpkgs/config.nix or pass
-              --arg config '{ allowUnfree = true; }'
-            on the command line.''
+            to ~/.nixpkgs/config.nix.''
         else if !allowBroken && attrs.meta.broken or false then
           throw "you can't use package ‘${attrs.name}’ in ${pos'} because it has been marked as broken"
         else if !allowBroken && attrs.meta.platforms or null != null && !lib.lists.elem result.system attrs.meta.platforms then

pkgs/tools/X11/xpra/default.nix

@@ -4,12 +4,12 @@
 , ffmpeg, x264, libvpx, pil, libwebp }:
 
 buildPythonPackage rec {
-  name = "xpra-0.12.5";
+  name = "xpra-0.11.6";
   namePrefix = "";
 
   src = fetchurl {
     url = "http://xpra.org/src/${name}.tar.bz2";
-    sha256 = "1qr9gxmfnkays9hrw2qki1jdkyxhbbkjx71gy23x423cfsxsjmiw";
+    sha256 = "0n3lr8nrfmrll83lgi1nzalng902wv0dcmcyx4awnman848dxij0";
   };
 
   buildInputs = [

pkgs/tools/admin/gtk-vnc/default.nix

@@ -2,7 +2,7 @@
 , python, gtk, pygtk, gnutls, cairo, libtool, glib, pkgconfig, libtasn1
 , libffi, cyrus_sasl, intltool, perl, perlPackages, firefoxPkgs, pulseaudio
 , kbproto, libX11, libXext, xextproto, pygobject, libgcrypt, gtk3, vala
-, pygobject3, enableGTK3 ? false }:
+, pygobject3, libogg, enableGTK3 ? false }:
 
 stdenv.mkDerivation rec {
   name = "gtk-vnc-${version}";
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     python gnutls cairo libtool pkgconfig glib libffi libgcrypt
     intltool cyrus_sasl pulseaudio perl perlPackages.TextCSV
-    gobjectIntrospection
+    gobjectIntrospection libogg
   ] ++ (if enableGTK3 then [ gtk3 vala pygobject3 ] else [ gtk pygtk pygobject ]);
 
   NIX_CFLAGS_COMPILE = "-fstack-protector-all";

pkgs/tools/misc/logstash/default.nix

@@ -1,11 +1,11 @@
 { fetchurl }:
 
-let version = "1.2.1"; in
+let version = "1.3.3"; in
 
 fetchurl {
-  url = "https://logstash.objects.dreamhost.com/release/logstash-${version}-flatjar.jar";
+  url = "https://download.elasticsearch.org/logstash/logstash/logstash-${version}-flatjar.jar";
 
-  name = "logstash-${version}.jar";
+  name = "logstash-${version}-flatjar.jar";
 
-  sha256 = "08zfhq6klhkqapqnyzbdikgryd8bj2fp0wdb5d6dawdan5psbf6h";
+  sha256 = "a83503bd2aa32e1554b98f812d0b411fbc5f7b6b21cebb48b7d344474f2dfc6d";
 }

pkgs/tools/networking/s3cmd/git.nix

@@ -0,0 +1,19 @@
+{ stdenv, fetchgit, pythonPackages }:
+
+pythonPackages.buildPythonPackage rec {
+  name = "s3cmd-1.5-pre-81e3842f7a";
+
+  src  = fetchgit {
+    url    = "https://github.com/s3tools/s3cmd.git";
+    rev    = "81e3842f7afbc8c629f408f4d7dc22058f7bd536";
+    sha256 = "13jqw19ws5my8r856j1p7xydwpyp8agnzxkjv6pa7h72wl7rz90i";
+  };
+
+  propagatedBuildInputs = with pythonPackages; [ dateutil ];
+
+  meta = with stdenv.lib;  {
+    description = "Command line tool for managing Amazon S3 and CloudFront services";
+    homepage    = http://s3tools.org/s3cmd;
+    license     = licenses.gpl2;
+  };
+}

pkgs/tools/security/duo-unix/default.nix

@@ -1,12 +1,12 @@
 { stdenv, fetchurl, pam, openssl, zlib }:
 
 stdenv.mkDerivation rec {
-  name = "duo-unix";
-  version = "1.9.7";
+  name = "duo-unix-${version}";
+  version = "1.9.11";
 
   src = fetchurl {
     url    = "https://dl.duosecurity.com/duo_unix-${version}.tar.gz";
-    sha256 = "090kx9nixlhvy5nw0ywqmi7yhd4nz7wvdv38cpkgrspkridfl07j";
+    sha256 = "0747avzmzzz1gaisahgjlpxyxxbrn04w1mip90lfj9wp2x6a9jgm";
   };
 
   buildInputs = [ pam openssl zlib ];

pkgs/tools/security/jd-gui/default.nix

@@ -0,0 +1,33 @@
+{ stdenv, fetchurl, gtk, atk, gdk_pixbuf, pango, makeWrapper }:
+
+let
+  dynlibPath = stdenv.lib.makeLibraryPath
+    [ gtk atk gdk_pixbuf pango ];
+in
+stdenv.mkDerivation rec {
+  name    = "jd-gui-${version}";
+  version = "0.3.5";
+
+  src = fetchurl {
+    url    = "http://jd.benow.ca/jd-gui/downloads/${name}.linux.i686.tar.gz";
+    sha256 = "0jrvzs2s836yvqi41c7fq0gfiwf187qg765b9r1il2bjc0mb3dqv";
+  };
+
+  buildInputs = [ makeWrapper ];
+
+  phases = "unpackPhase installPhase";
+  unpackPhase = "tar xf ${src}";
+  installPhase = ''
+    mkdir -p $out/bin && mv jd-gui $out/bin
+    wrapProgram $out/bin/jd-gui \
+      --prefix LD_LIBRARY_PATH ":" "${dynlibPath}"
+  '';
+
+  meta = {
+    description = "Fast Java Decompiler with powerful GUI";
+    homepage    = "http://jd.benow.ca/";
+    license     = stdenv.lib.licenses.unfreeRedistributable;
+    platforms   = [ "i686-linux" ];
+    maintainers = [ stdenv.lib.maintainers.thoughtpolice ];
+  };
+}

pkgs/tools/security/sudo/default.nix

@@ -1,14 +1,14 @@
-{ stdenv, fetchurl, coreutils, pam, groff, keepVisudo ? false }:
+{ stdenv, fetchurl, coreutils, pam, groff }:
 
 stdenv.mkDerivation rec {
-  name = "sudo-1.8.9p4";
+  name = "sudo-1.8.10p3";
 
   src = fetchurl {
     urls =
       [ "ftp://ftp.sudo.ws/pub/sudo/${name}.tar.gz"
         "ftp://ftp.sudo.ws/pub/sudo/OLD/${name}.tar.gz"
       ];
-    sha256 = "19y75bsh4z2kid5jk2r84z7rvmnh90n8cb9fbn9l4rcw83lzjhqr";
+    sha256 = "002l6h27pnhb77b65frhazbhknsxvrsnkpi43j7i0qw1lrgi7nkf";
   };
 
   postConfigure = ''
@@ -32,11 +32,6 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   postInstall = ''
-    # ‘visudo’ does not make sense on NixOS - except for checking sudoers
-    # file syntax
-    rm ${if keepVisudo then "" else "$out/sbin/visudo"} \
-        $out/share/man/man8/visudo.8
-
     rm $out/share/doc/sudo/ChangeLog
   '';
 

pkgs/top-level/all-packages.nix

@@ -821,10 +821,16 @@ let
 
   cron = callPackage ../tools/system/cron { };
 
-  cudatoolkit = callPackage ../development/compilers/cudatoolkit {
+  cudatoolkit5 = callPackage ../development/compilers/cudatoolkit/5.5.nix {
     python = python26;
   };
 
+  cudatoolkit6 = callPackage ../development/compilers/cudatoolkit/6.0.nix {
+    python = python26;
+  };
+
+  cudatoolkit = cudatoolkit5;
+
   curl = callPackage ../tools/networking/curl rec {
     fetchurl = fetchurlBoot;
     zlibSupport = true;
@@ -1314,6 +1320,8 @@ let
 
   isync = callPackage ../tools/networking/isync { };
 
+  jd-gui = callPackage_i686 ../tools/security/jd-gui { };
+
   jdiskreport = callPackage ../tools/misc/jdiskreport { };
 
   jfsrec = callPackage ../tools/filesystems/jfsrec {
@@ -1966,6 +1974,8 @@ let
 
   s3cmd = callPackage ../tools/networking/s3cmd { };
 
+  s3cmd_15_pre_81e3842f7a = lowPrio (callPackage ../tools/networking/s3cmd/git.nix { });
+
   s3sync = callPackage ../tools/networking/s3sync {
     ruby = ruby18;
   };
@@ -3521,7 +3531,7 @@ let
   python = python27;
   python3 = python3Packages.python;
 
-  pypy = callPackage ../development/interpreters/pypy/2.2 { };
+  pypy = callPackage ../development/interpreters/pypy/2.3 { };
 
   pythonFull = python27Full;
   python26Full = callPackage ../development/interpreters/python/wrapper.nix {
@@ -7776,6 +7786,8 @@ let
 
   arkpandora_ttf = builderDefsPackage (import ../data/fonts/arkpandora) { };
 
+  aurulent-sans = callPackage ../data/fonts/aurulent-sans { };
+
   bakoma_ttf = callPackage ../data/fonts/bakoma-ttf { };
 
   cacert = callPackage ../data/misc/cacert { };
@@ -8353,6 +8365,8 @@ let
 
     maudeMode = callPackage ../applications/editors/emacs-modes/maude { };
 
+    metaweblog = callPackage ../applications/editors/emacs-modes/metaweblog { };
+
     notmuch = lowPrio (callPackage ../applications/networking/mailreaders/notmuch { });
 
     offlineimap = callPackage ../applications/editors/emacs-modes/offlineimap {};
@@ -10126,6 +10140,8 @@ let
 
   opentyrian = callPackage ../games/opentyrian { };
 
+  openxcom = callPackage ../games/openxcom { };
+
   pingus = callPackage ../games/pingus {};
 
   pioneers = callPackage ../games/pioneers { };

pkgs/top-level/haskell-packages.nix

@@ -2186,6 +2186,8 @@ self : let callPackage = x : y : modifyPrio (newScope self x y); in
 
   TCache = callPackage ../development/libraries/haskell/TCache {};
 
+  tcacheAWS = callPackage ../development/libraries/haskell/tcache-AWS {};
+
   templateDefault = callPackage ../development/libraries/haskell/template-default {};
 
   temporary = callPackage ../development/libraries/haskell/temporary {};
@@ -2462,6 +2464,7 @@ self : let callPackage = x : y : modifyPrio (newScope self x y); in
 
   websockets = callPackage ../development/libraries/haskell/websockets {
     testFrameworkQuickcheck2 = self.testFrameworkQuickcheck2.override { QuickCheck = self.QuickCheck_2_6; };
+    QuickCheck = self.QuickCheck_2_6;
   };
 
   websocketsSnap = callPackage ../development/libraries/haskell/websockets-snap {};
@@ -2601,16 +2604,18 @@ self : let callPackage = x : y : modifyPrio (newScope self x y); in
   # Compilers.
 
   Agda_2_3_2_2 = callPackage ../development/compilers/agda/2.3.2.2.nix {};
-  Agda_2_4_0_1 = callPackage ../development/compilers/agda/2.4.0.1.nix {};
-  Agda = self.Agda_2_3_2_2;
+  Agda_2_4_0_1 = callPackage ../development/compilers/agda/2.4.0.1.nix {
+    binary = self.binary_0_7_2_1;
+  };
+  Agda = self.Agda_2_4_0_1;
 
   AgdaStdlib_0_7 = callPackage ../development/compilers/agda/stdlib-0.7.nix {
     Agda = self.Agda_2_3_2_2;
   };
-  AgdaStdlib_2_4_0 = callPackage ../development/compilers/agda/stdlib-2.4.0.nix {
+  AgdaStdlib_0_8 = callPackage ../development/compilers/agda/stdlib-0.8.nix {
     Agda = self.Agda_2_4_0_1;
   };
-  AgdaStdlib = self.AgdaStdlib_0_7;
+  AgdaStdlib = self.AgdaStdlib_0_8;
 
   uhc = callPackage ../development/compilers/uhc {};
 
@@ -2716,6 +2721,10 @@ self : let callPackage = x : y : modifyPrio (newScope self x y); in
   darcs = callPackage ../applications/version-management/darcs {};
 
   idris_plain = callPackage ../development/compilers/idris {
+    parsers = self.parsers_0_10_3;
+    trifecta = self.trifecta.override {
+      parsers = self.parsers_0_10_3;
+    };
     llvmGeneral = self.llvmGeneral_3_3_8_2;
     llvmGeneralPure = self.llvmGeneralPure_3_3_8_2;
   };

pkgs/top-level/python-packages.nix

@@ -3385,13 +3385,13 @@ rec {
 
 
   gyp = buildPythonPackage rec {
-    rev = "1738";
+    rev = "1944";
     name = "gyp-r${rev}";
 
     src = fetchsvn {
       url = "http://gyp.googlecode.com/svn/trunk";
       inherit rev;
-      sha256 = "155k7v6453j2kg02xqfqbkzkbaqc8aynxs2k462jmrp638vxia9s";
+      sha256 = "15k3ivk3jyhx4rwdf1mn6qpyrwixvy01jpkir8d14c4g9hax1dx1";
     };
 
     patches = optionals pkgs.stdenv.isDarwin [

pkgs/top-level/release-python.nix

@@ -1521,6 +1521,7 @@ let
   rxvt = { type = "job"; systems = ["x86_64-linux"]; schedulingPriority = 4; };
   rxvt_unicode = { type = "job"; systems = ["x86_64-linux"]; schedulingPriority = 4; };
   s3cmd = { type = "job"; systems = ["x86_64-linux"]; schedulingPriority = 4; };
+  s3cmd_git = { type = "job"; systems = ["x86_64-linux"]; schedulingPriority = 4; };
   sabnzbd = { type = "job"; systems = ["x86_64-linux"]; schedulingPriority = 4; };
   sakura = { type = "job"; systems = ["x86_64-linux"]; schedulingPriority = 4; };
   salut_a_toi = { type = "job"; systems = ["x86_64-linux"]; schedulingPriority = 4; };