Merge branch 'master' into staging

There were some larger rebuilds because of security.
2024-11-10 16:45:51 +03:00 · 2017-01-26 16:49:41 +01:00 · 2017-01-26 16:49:41 +01:00 · 6973c7739e
commit 6973c7739e
parent 5dacc53af3 bca9bcb3c3
284 changed files with 6288 additions and 4232 deletions
--- a/doc/cross-compilation.xml
+++ b/doc/cross-compilation.xml
@ -0,0 +1,153 @@
+<chapter xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xml:id="chap-cross">
+
+<title>Cross-compilation</title>
+
+<section xml:id="sec-cross-intro">
+  <title>Introduction</title>
+  <para>
+    "Cross-compilation" means compiling a program on one machine for another type of machine.
+    For example, a typical use of cross compilation is to compile programs for embedded devices.
+    These devices often don't have the computing power and memory to compile their own programs.
+    One might think that cross-compilation is a fairly niche concern, but there are advantages to being rigorous about distinguishing build-time vs run-time environments even when one is developing and deploying on the same machine.
+    Nixpkgs is increasingly adopting this opinion in that packages should be written with cross-compilation in mind, and nixpkgs should evaluate in a similar way (by minimizing cross-compilation-specific special cases) whether or not one is cross-compiling.
+  </para>
+
+  <para>
+    This chapter will be organized in three parts.
+    First, it will describe the basics of how to package software in a way that supports cross-compilation.
+    Second, it will describe how to use Nixpkgs when cross-compiling.
+    Third, it will describe the internal infrastructure supporting cross-compilation.
+  </para>
+</section>
+
+<!--============================================================-->
+
+<section xml:id="sec-cross-packaging">
+  <title>Packing in a cross-friendly manner</title>
+
+  <section>
+    <title>Platform parameters</title>
+    <para>
+      The three GNU Autoconf platforms, <wordasword>build</wordasword>, <wordasword>host</wordasword>, and <wordasword>cross</wordasword>, are historically the result of much confusion.
+      <link xlink:href="https://gcc.gnu.org/onlinedocs/gccint/Configure-Terms.html" /> clears this up somewhat but there is more to be said.
+      An important advice to get out the way is, unless you are packaging a compiler or other build tool, just worry about the build and host platforms.
+      Dealing with just two platforms usually better matches people's preconceptions, and in this case is completely correct.
+    </para>
+    <para>
+      In Nixpkgs, these three platforms are defined as attribute sets under the names <literal>buildPlatform</literal>, <literal>hostPlatform</literal>, and <literal>targetPlatform</literal>.
+      All are guaranteed to contain at least a <varname>platform</varname> field, which contains detailed information on the platform.
+      All three are always defined at the top level, so one can get at them just like a dependency in a function that is imported with <literal>callPackage</literal>:
+      <programlisting>{ stdenv, buildPlatform, hostPlatform, fooDep, barDep, .. }: ...</programlisting>
+    </para>
+    <warning><para>
+      These platforms should all have the same structure in all scenarios, but that is currently not the case.
+      When not cross-compiling, they will each contain a <literal>system</literal> field with a short 2-part, hyphen-separated summering string name for the platform.
+      But, when when cross compiling, <literal>hostPlatform</literal> and <literal>targetPlatform</literal> may instead contain <literal>config</literal> with a fuller 3- or 4-part string in the manner of LLVM.
+      We should have all 3 platforms always contain both, and maybe give <literal>config</literal> a better name while we are at it.
+    </para></warning>
+    <variablelist>
+      <varlistentry>
+        <term><varname>buildPlatform</varname></term>
+        <listitem><para>
+          The "build platform" is the platform on which a package is built.
+          Once someone has a built package, or pre-built binary package, the build platform should not matter and be safe to ignore.
+        </para></listitem>
+      </varlistentry>
+      <varlistentry>
+        <term><varname>hostPlatform</varname></term>
+        <listitem><para>
+          The "host platform" is the platform on which a package is run.
+          This is the simplest platform to understand, but also the one with the worst name.
+        </para></listitem>
+      </varlistentry>
+      <varlistentry>
+        <term><varname>targetPlatform</varname></term>
+        <listitem>
+          <para>
+            The "target platform" is black sheep.
+            The other two intrinsically apply to all compiled software—or any build process with a notion of "build-time" followed by "run-time".
+            The target platform only applies to programming tools, and even then only is a good for for some of them.
+            Briefly, GCC, Binutils, GHC, and certain other tools are written in such a way such that a single build can only compiler code for a single platform.
+            Thus, when building them, one must think ahead about what platforms they wish to use the tool to produce machine code for, and build binaries for each.
+          </para>
+          <para>
+            There is no fundamental need to think about the target ahead of time like this.
+            LLVM, for example, was designed from the beginning with cross-compilation in mind, and so a normal LLVM binary will support every architecture that LLVM supports.
+            If the tool supports modular or pluggable backends, one might imagine specifying a <emphasis>set</emphasis> of target platforms / backends one wishes to support, rather than a single one.
+          </para>
+          <para>
+            The biggest reason for mess, if there is one, is that many compilers have the bad habit a build process that builds the compiler and standard library/runtime together.
+            Then the specifying target platform is essential, because it determines the host platform of the standard library/runtime.
+            Nixpkgs tries to avoid this where possible too, but still, because the concept of a target platform is so ingrained now in Autoconf and other tools, it is best to support it as is.
+            Tools like LLVM that don't need up-front target platforms can safely ignore it like normal packages, and it will do no harm.
+          </para>
+          </listitem>
+      </varlistentry>
+    </variablelist>
+    <note><para>
+      If you dig around nixpkgs, you may notice there is also <varname>stdenv.cross</varname>.
+      This field defined as <varname>hostPlatform</varname> when the host and build platforms differ, but otherwise not defined at all.
+      This field is obsolete and will soon disappear—please do not use it.
+    </para></note>
+  </section>
+
+  <section>
+    <title>Specifying Dependencies</title>
+    <para>
+      As mentioned in the introduction to this chapter, one can think about a build time vs run time distinction whether cross-compiling or not.
+      In the case of cross-compilation, this corresponds with whether a derivation running on the native or foreign platform is produced.
+      An interesting thing to think about is how this corresponds with the three Autoconf platforms.
+      In the run-time case, the depending and depended-on package simply have matching build, host, and target platforms.
+      But in the build-time case, one can imagine "sliding" the platforms one over.
+      The depended-on package's host and target platforms (respectively) become the depending package's build and host platforms.
+      This is the most important guiding principle behind cross-compilation with Nixpkgs, and will be called the <wordasword>sliding window principle</wordasword>.
+      In this manner, given the 3 platforms for one package, we can determine the three platforms for all its transitive dependencies.
+    </para>
+    <note><para>
+      The depending package's target platform is unconstrained by the sliding window principle, which makes sense in that one can in principle build cross compilers targeting arbitrary platforms.
+    </para></note>
+    <warning><para>
+      From the above, one would surmise that if a package is being built with a <literal>(build, host, target)</literal> platform triple of <literal>(foo, bar, bar)</literal>, then its build-time dependencies would have a triple of <literal>(foo, foo, bar)</literal>, and <emphasis>those packages'</emphasis> build-time dependencies would have triple of <literal>(foo, foo, foo)</literal>.
+      In other words, it should take two "rounds" of following build-time dependency edges before one reaches a fixed point where, by the sliding window principle, the platform triple no longer changes.
+      Unfortunately, at the moment, we do <emphasis>not</emphasis> implement this correctly, and after only one round of following build-time dependencies is the fixed point reached, with target incorrectly kept different than the others.
+    </para></warning>
+    <para>
+      How does this work in practice? Nixpkgs is now structured so that build-time dependencies are taken from from <varname>buildPackages</varname>, whereas run-time dependencies are taken from the top level attribute set.
+      For example, <varname>buildPackages.gcc</varname> should be used at build time, while <varname>gcc</varname> should be used at run time.
+      Now, for most of Nixpkgs's history, there was no <varname>buildPackages</varname>, and most packages have not been refactored to use it explicitly.
+      Instead, one can use the four attributes used for specifying dependencies as documented in <link linkend="ssec-stdenv-attributes" />.
+      We "splice" together the run-time and build-time package sets with <varname>callPackage</varname>, and then <varname>mkDerivation</varname> for each of four attributes pulls the right derivation out.
+      This splicing can be skipped when not cross compiling as the package sets are the same, but is a bit slow for cross compiling.
+      Because of this, a best-of-both-worlds solution is in the works with no splicing or explicit access of <varname>buildPackages</varname> needed.
+      For now, feel free to use either method.
+    </para>
+  </section>
+
+</section>
+
+<!--============================================================-->
+
+<section xml:id="sec-cross-usage">
+  <title>Cross-building packages</title>
+  <para>
+    To be written.
+    This is basically unchanged so see the old wiki for now.
+  </para>
+</section>
+
+<!--============================================================-->
+
+<section xml:id="sec-cross-infra">
+  <title>Cross-compilation infrastructure</title>
+  <para>To be written.</para>
+  <note><para>
+    If one explores nixpkgs, they will see derivations with names like <literal>gccCross</literal>.
+    Such <literal>*Cross</literal> derivations is a holdover from before we properly distinguished between the host and target platforms
+    —the derivation with "Cross" in the name covered the <literal>build = host != target</literal> case, while the other covered the <literal>host = target</literal>, with build platform the same or not based on whether one was using its <literal>.nativeDrv</literal> or <literal>.crossDrv</literal>.
+    This ugliness will disappear soon.
+  </para></note>
+</section>
+
+</chapter>
--- a/doc/manual.xml
+++ b/doc/manual.xml
@ -13,6 +13,7 @@
  <xi:include href="quick-start.xml" />
  <xi:include href="stdenv.xml" />
  <xi:include href="multiple-output.xml" />
+  <xi:include href="cross-compilation.xml" />
  <xi:include href="configuration.xml" />
  <xi:include href="functions.xml" />
  <xi:include href="meta.xml" />
--- a/doc/old/cross.txt
+++ b/doc/old/cross.txt
@ -61,7 +61,7 @@ stdenv.mkDerivation {
  builder = ./builder.sh;
  src = fetchurl {
    url = http://ftp.nluug.nl/gnu/binutils/binutils-2.16.1.tar.bz2;
-    md5 = "6a9d529efb285071dad10e1f3d2b2967";
+    sha256 = "1ian3kwh2vg6hr3ymrv48s04gijs539vzrq62xr76bxbhbwnz2np";
  };
  inherit noSysDirs;
  configureFlags = "--target=arm-linux";
@ -81,11 +81,11 @@ Step 2: build kernel headers for the target architecture
 assert stdenv.system == "i686-linux";

 stdenv.mkDerivation {
-  name = "linux-headers-2.6.13.4-arm";
+  name = "linux-headers-2.6.13.1-arm";
  builder = ./builder.sh;
  src = fetchurl {
-    url = http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.13.4.tar.bz2;
-    md5 = "94768d7eef90a9d8174639b2a7d3f58d";
+    url = http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.13.1.tar.bz2;
+    sha256 = "12qxmc827fjhaz53kjy7vyrzsaqcg78amiqsb3qm20z26w705lma";
  };
 }
 ---
@ -152,9 +152,7 @@ stdenv.mkDerivation {
  builder = ./builder.sh;
  src = fetchurl {
    url = ftp://ftp.nluug.nl/pub/gnu/gcc/gcc-4.0.2/gcc-core-4.0.2.tar.bz2;
-    md5 = "f7781398ada62ba255486673e6274b26";
-    #url = ftp://ftp.nluug.nl/pub/gnu/gcc/gcc-4.0.2/gcc-4.0.2.tar.bz2;
-    #md5 = "a659b8388cac9db2b13e056e574ceeb0";
+    sha256 = "02fxh0asflm8825w23l2jq1wvs7hbnam0jayrivg7zdv2ifnc0rc";
  };
  # !!! apply only if noSysDirs is set
  patches = [./no-sys-dirs.patch ./gcc-inhibit.patch];
--- a/doc/stdenv.xml
+++ b/doc/stdenv.xml
@ -194,33 +194,52 @@ genericBuild
    tools.</para></listitem>
  </varlistentry>

+</variablelist>
+
+<variablelist>
+  <title>Variables specifying dependencies</title>
+
+  <varlistentry>
+    <term><varname>nativeBuildInputs</varname></term>
+    <listitem><para>
+      A list of dependencies used by the new derivation at <emphasis>build</emphasis>-time.
+      I.e. these dependencies should not make it into the package's runtime-closure, though this is currently not checked.
+      For each dependency <replaceable>dir</replaceable>, the directory <filename><replaceable>dir</replaceable>/bin</filename>, if it exists, is added to the <envar>PATH</envar> environment variable.
+      Other environment variables are also set up via a pluggable mechanism.
+      For instance, if <varname>buildInputs</varname> contains Perl, then the <filename>lib/site_perl</filename> subdirectory of each input is added to the <envar>PERL5LIB</envar> environment variable.
+      See <xref linkend="ssec-setup-hooks"/> for details.
+    </para></listitem>
+  </varlistentry>
+
  <varlistentry>
    <term><varname>buildInputs</varname></term>
-    <listitem><para>A list of dependencies used by
-    <literal>stdenv</literal> to set up the environment for the build.
-    For each dependency <replaceable>dir</replaceable>, the directory
-    <filename><replaceable>dir</replaceable>/bin</filename>, if it
-    exists, is added to the <envar>PATH</envar> environment variable.
-    Other environment variables are also set up via a pluggable
-    mechanism.  For instance, if <varname>buildInputs</varname>
-    contains Perl, then the <filename>lib/site_perl</filename>
-    subdirectory of each input is added to the <envar>PERL5LIB</envar>
-    environment variable.  See <xref linkend="ssec-setup-hooks"/> for
-    details.</para></listitem>
+    <listitem><para>
+      A list of dependencies used by the new derivation at <emphasis>run</emphasis>-time.
+      Currently, the build-time environment is modified in the exact same way as with <varname>nativeBuildInputs</varname>.
+      This is problematic in that when cross-compiling, foreign executables can clobber native ones on the <envar>PATH</envar>.
+      Even more confusing is static-linking.
+      A statically-linked library should be listed here because ultimately that generated machine code will be used at run-time, even though a derivation containing the object files or static archives will only be used at build-time.
+      A less confusing solution to this would be nice.
+    </para></listitem>
  </varlistentry>
-  
+
+
+  <varlistentry>
+    <term><varname>propagatedNativeBuildInputs</varname></term>
+    <listitem><para>
+      Like <varname>nativeBuildInputs</varname>, but these dependencies are <emphasis>propagated</emphasis>:
+      that is, the dependencies listed here are added to the <varname>nativeBuildInputs</varname> of any package that uses <emphasis>this</emphasis> package as a dependency.
+      So if package Y has <literal>propagatedBuildInputs = [X]</literal>, and package Z has <literal>buildInputs = [Y]</literal>, then package X will appear in Z’s build environment automatically.
+    </para></listitem>
+  </varlistentry>
+
  <varlistentry>
    <term><varname>propagatedBuildInputs</varname></term>
-    <listitem><para>Like <varname>buildInputs</varname>, but these
-    dependencies are <emphasis>propagated</emphasis>: that is, the
-    dependencies listed here are added to the
-    <varname>buildInputs</varname> of any package that uses
-    <emphasis>this</emphasis> package as a dependency.  So if package
-    Y has <literal>propagatedBuildInputs = [X]</literal>, and package
-    Z has <literal>buildInputs = [Y]</literal>, then package X will
-    appear in Z’s build environment automatically.</para></listitem>
+    <listitem><para>
+      Like <varname>buildInputs</varname>, but propagated just like <varname>propagatedNativeBuildInputs</varname>.
+      This inherits <varname>buildInputs</varname>'s flaws of clobbering native executables when cross-compiling and being confusing for static linking.
+    </para></listitem>
  </varlistentry>
-  

 </variablelist>

@ -322,7 +341,7 @@ executed and in what order:
      $preInstallPhases installPhase fixupPhase $preDistPhases
      distPhase $postPhases</literal>.
      </para>
-      
+
      <para>Usually, if you just want to add a few phases, it’s more
      convenient to set one of the variables below (such as
      <varname>preInstallPhases</varname>), as you then don’t specify
@ -706,7 +725,7 @@ makeFlagsArray=(CFLAGS="-O0 -g" LDFLAGS="-lfoo -lbar")
 </variablelist>


-<para> 
+<para>
 You can set flags for <command>make</command> through the
 <varname>makeFlags</varname> variable.</para>

@ -773,7 +792,7 @@ doCheck = true;</programlisting>

 </variablelist>

-  
+
 </section>


@ -840,12 +859,12 @@ install phase.  The default <function>fixupPhase</function> does the
 following:

 <itemizedlist>
-      
+
  <listitem><para>It moves the <filename>man/</filename>,
  <filename>doc/</filename> and <filename>info/</filename>
  subdirectories of <envar>$out</envar> to
  <filename>share/</filename>.</para></listitem>
-      
+
  <listitem><para>It strips libraries and executables of debug
  information.</para></listitem>

@ -1091,13 +1110,13 @@ functions.</para>

 <variablelist>

-  
+
  <varlistentry xml:id='fun-substitute'>
    <term><function>substitute</function>
    <replaceable>infile</replaceable>
    <replaceable>outfile</replaceable>
    <replaceable>subs</replaceable></term>
-    
+
    <listitem>
      <para>Performs string substitution on the contents of
      <replaceable>infile</replaceable>, writing the result to
@ -1125,7 +1144,7 @@ functions.</para>
            <literal>@<replaceable>...</replaceable>@</literal> in the
            template as placeholders.</para></listitem>
          </varlistentry>
-          
+
          <varlistentry>
            <term><option>--subst-var-by</option>
            <replaceable>varName</replaceable>
@ -1134,7 +1153,7 @@ functions.</para>
            <literal>@<replaceable>varName</replaceable>@</literal> by
            the string <replaceable>s</replaceable>.</para></listitem>
          </varlistentry>
-          
+
        </variablelist>

      </para>
@ -1162,7 +1181,7 @@ substitute ./foo.in ./foo.out \

    </listitem>
  </varlistentry>
-  
+

  <varlistentry xml:id='fun-substituteInPlace'>
    <term><function>substituteInPlace</function>
@ -1173,7 +1192,7 @@ substitute ./foo.in ./foo.out \
    <replaceable>file</replaceable>.</para></listitem>
  </varlistentry>

-  
+
  <varlistentry xml:id='fun-substituteAll'>
    <term><function>substituteAll</function>
    <replaceable>infile</replaceable>
@ -1233,7 +1252,7 @@ echo @foo@
    <listitem><para>Strips the directory and hash part of a store
    path, outputting the name part to <literal>stdout</literal>.
    For example:
-    
+
 <programlisting>
 # prints coreutils-8.24
 stripHash "/nix/store/9s9r019176g7cvn2nvcw41gsp862y6b4-coreutils-8.24"
@ -1241,7 +1260,7 @@ stripHash "/nix/store/9s9r019176g7cvn2nvcw41gsp862y6b4-coreutils-8.24"

    If you wish to store the result in another variable, then the
    following idiom may be useful:
-    
+
 <programlisting>
 name="/nix/store/9s9r019176g7cvn2nvcw41gsp862y6b4-coreutils-8.24"
 someVar=$(stripHash $name)
@ -1250,7 +1269,7 @@ someVar=$(stripHash $name)
    </para></listitem>
  </varlistentry>

-  
+
 </variablelist>

 </section>
@ -1607,4 +1626,3 @@ Arch Wiki</link>.
 </section>

 </chapter>
-
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@ -191,6 +191,11 @@ lib.mapAttrs (n: v: v // { shortName = n; }) rec {
    free = false;
  };

+  eupl11 = spdx {
+    spdxId = "EUPL-1.1";
+    fullname = "European Union Public License 1.1";
+  };
+
  fdl12 = spdx {
    spdxId = "GFDL-1.2";
    fullName = "GNU Free Documentation License v1.2";
--- a/lib/maintainers.nix
+++ b/lib/maintainers.nix
@ -27,6 +27,7 @@
  akaWolf = "Artjom Vejsel <akawolf0@gmail.com>";
  akc = "Anders Claesson <akc@akc.is>";
  algorith = "Dries Van Daele <dries_van_daele@telenet.be>";
+  alibabzo = "Alistair Bill <alistair.bill@gmail.com>";
  all = "Nix Committers <nix-commits@lists.science.uu.nl>";
  ambrop72 = "Ambroz Bizjak <ambrop7@gmail.com>";
  amiddelk = "Arie Middelkoop <amiddelk@gmail.com>";
@ -226,6 +227,7 @@
  joko = "Ioannis Koutras <ioannis.koutras@gmail.com>";
  jonafato = "Jon Banafato <jon@jonafato.com>";
  jpbernardy = "Jean-Philippe Bernardy <jeanphilippe.bernardy@gmail.com>";
+  jpierre03 = "Jean-Pierre PRUNARET <nix@prunetwork.fr>";
  jraygauthier = "Raymond Gauthier <jraygauthier@gmail.com>";
  juliendehos = "Julien Dehos <dehos@lisic.univ-littoral.fr>";
  jwiegley = "John Wiegley <johnw@newartisans.com>";
@ -289,6 +291,7 @@
  mbbx6spp = "Susan Potter <me@susanpotter.net>";
  mbe = "Brandon Edens <brandonedens@gmail.com>";
  mboes = "Mathieu Boespflug <mboes@tweag.net>";
+  mbrgm = "Marius Bergmann <marius@yeai.de>";
  mcmtroffaes = "Matthias C. M. Troffaes <matthias.troffaes@gmail.com>";
  mdaiter = "Matthew S. Daiter <mdaiter8121@gmail.com>";
  meditans = "Carlo Nucera <meditans@gmail.com>";
@ -374,6 +377,7 @@
  pmahoney = "Patrick Mahoney <pat@polycrystal.org>";
  pmiddend = "Philipp Middendorf <pmidden@secure.mailbox.org>";
  polyrod = "Maurizio Di Pietro <dc1mdp@gmail.com>";
+  pradeepchhetri = "Pradeep Chhetri <pradeep.chhetri89@gmail.com>";
  prikhi = "Pavan Rikhi <pavan.rikhi@gmail.com>";
  primeos = "Michael Weiss <dev.primeos@gmail.com>";
  profpatsch = "Profpatsch <mail@profpatsch.de>";
--- a/nixos/doc/manual/installation/installing.xml
+++ b/nixos/doc/manual/installation/installing.xml
@ -37,6 +37,11 @@
  first disable network-manager with
  <command>systemctl stop network-manager</command>.</para></listitem>

+  <listitem><para>If you would like to continue the installation from a different
+  machine you need to activate the SSH daemon via <literal>systemctl start sshd</literal>.
+  In order to be able to login you also need to set a password for
+  <literal>root</literal> using <literal>passwd</literal>.</para></listitem>
+
  <listitem><para>The NixOS installer doesn’t do any partitioning or
  formatting yet, so you need to do that yourself.  Use the following
  commands:
--- a/nixos/doc/manual/release-notes/rl-1703.xml
+++ b/nixos/doc/manual/release-notes/rl-1703.xml
@ -30,6 +30,15 @@ has the following highlights: </para>
 following incompatible changes:</para>

 <itemizedlist>
+  <listitem>
+    <para>
+      Cross compilation has been rewritten. See the nixpkgs manual for
+      details. The most obvious breaking change is that derivations absent a
+      <literal>.nativeDrv</literal> or <literal>.crossDrv</literal> are now
+      cross by default, not native.
+    </para>
+  </listitem>
+
  <listitem>
    <para>
      <literal>stdenv.overrides</literal> is now expected to take <literal>self</literal>
@ -124,6 +133,19 @@ following incompatible changes:</para>

    </para>
  </listitem>
+
+  <listitem>
+    <para>
+      Autoloading connection tracking helpers is now disabled by default.
+      This default was also changed in the Linux kernel and is considered
+      insecure if not configured properly in your firewall. If you need
+      connection tracking helpers (i.e. for active FTP) please enable
+      <literal>networking.firewall.autoLoadConntrackHelpers</literal> and
+      tune <literal>networking.firewall.connectionTrackingModules</literal>
+      to suit your needs.
+    </para>
+  </listitem>
+
 </itemizedlist>


--- a/nixos/modules/i18n/input-method/ibus.nix
+++ b/nixos/modules/i18n/input-method/ibus.nix
@ -44,7 +44,7 @@ in
      panel = mkOption {
        type = with types; nullOr path;
        default = null;
-        example = literalExample "${pkgs.kde5.plasma-desktop}/lib/libexec/kimpanel-ibus-panel";
+        example = literalExample "''${pkgs.kde5.plasma-desktop}/lib/libexec/kimpanel-ibus-panel";
        description = "Replace the IBus panel with another panel.";
      };
    };
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@ -284,6 +284,8 @@
      glance = 266;
      couchpotato = 267;
      gogs = 268;
+      pdns-recursor = 269;
+      kresd = 270;

      # When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!

@ -538,6 +540,7 @@
      glance = 266;
      couchpotato = 267;
      gogs = 268;
+      kresd = 270;

      # When adding a gid, make sure it doesn't match an existing
      # uid. Users and groups with the same name should have equal
--- a/nixos/modules/misc/locate.nix
+++ b/nixos/modules/misc/locate.nix
@ -4,10 +4,12 @@ with lib;

 let
  cfg = config.services.locate;
+  isMLocate = hasPrefix "mlocate" cfg.locate.name;
+  isFindutils = hasPrefix "findutils" cfg.locate.name;
 in {
-  options.services.locate = {
+  options.services.locate = with types; {
    enable = mkOption {
-      type = types.bool;
+      type = bool;
      default = false;
      description = ''
        If enabled, NixOS will periodically update the database of
@ -16,8 +18,9 @@ in {
    };

    locate = mkOption {
-      type = types.package;
+      type = package;
      default = pkgs.findutils;
+      defaultText = "pkgs.findutils";
      example = "pkgs.mlocate";
      description = ''
        The locate implementation to use
@ -25,7 +28,7 @@ in {
    };

    interval = mkOption {
-      type = types.str;
+      type = str;
      default = "02:15";
      example = "hourly";
      description = ''
@ -38,11 +41,8 @@ in {
      '';
    };

-    # This is no longer supported, but we keep it to give a better warning below
-    period = mkOption { visible = false; };
-
    extraFlags = mkOption {
-      type = types.listOf types.str;
+      type = listOf str;
      default = [ ];
      description = ''
        Extra flags to pass to <command>updatedb</command>.
@ -50,7 +50,7 @@ in {
    };

    output = mkOption {
-      type = types.path;
+      type = path;
      default = "/var/cache/locatedb";
      description = ''
        The database file to build.
@ -58,7 +58,7 @@ in {
    };

    localuser = mkOption {
-      type = types.str;
+      type = nullOr str;
      default = "nobody";
      description = ''
        The user to search non-network directories as, using
@ -66,31 +66,81 @@ in {
      '';
    };

-    includeStore = mkOption {
-      type = types.bool;
-      default = false;
+    pruneFS = mkOption {
+      type = listOf str;
+      default = ["afs" "anon_inodefs" "auto" "autofs" "bdev" "binfmt" "binfmt_misc" "cgroup" "cifs" "coda" "configfs" "cramfs" "cpuset" "debugfs" "devfs" "devpts" "devtmpfs" "ecryptfs" "eventpollfs" "exofs" "futexfs" "ftpfs" "fuse" "fusectl" "gfs" "gfs2" "hostfs" "hugetlbfs" "inotifyfs" "iso9660" "jffs2" "lustre" "misc" "mqueue" "ncpfs" "nnpfs" "ocfs" "ocfs2" "pipefs" "proc" "ramfs" "rpc_pipefs" "securityfs" "selinuxfs" "sfs" "shfs" "smbfs" "sockfs" "spufs" "nfs" "NFS" "nfs4" "nfsd" "sshfs" "subfs" "supermount" "sysfs" "tmpfs" "ubifs" "udf" "usbfs" "vboxsf" "vperfctrfs" ];
      description = ''
-        Whether to include <filename>/nix/store</filename> in the locate database.
+        Which filesystem types to exclude from indexing
      '';
    };
+
+    prunePaths = mkOption {
+      type = listOf path;
+      default = ["/tmp" "/var/tmp" "/var/cache" "/var/lock" "/var/run" "/var/spool" "/nix/store"];
+      description = ''
+        Which paths to exclude from indexing
+      '';
+    };
+
+    pruneNames = mkOption {
+      type = listOf str;
+      default = [];
+      description = ''
+        Directory components which should exclude paths containing them from indexing
+      '';
+    };
+
+    pruneBindMounts = mkOption {
+      type = bool;
+      default = false;
+      description = ''
+        Whether not to index bind mounts
+      '';
+    };
+    
  };

-  config = {
-    warnings =
-      let opt = options.services.locate.period; in
-      optional opt.isDefined "The ‘services.locate.period’ option in ${showFiles opt.files} has been removed; please replace it with ‘services.locate.interval’, using the systemd.time(7) calendar event format.";
+  config = mkIf cfg.enable {
+    users.extraGroups = mkIf isMLocate { mlocate = {}; };

+    security.setuidOwners = mkIf isMLocate
+      [ { group = "mlocate";
+          owner = "root";
+          permissions = "u+rx,g+x,o+x";
+          setgid = true;
+          setuid = false;
+          program = "locate";
+        }
+      ];
+
+    nixpkgs.config = { locate.dbfile = cfg.output; };
+
+    environment.systemPackages = [ cfg.locate ];
+
+    environment.variables = mkIf (!isMLocate)
+      { LOCATE_PATH = cfg.output;
+      };
+
+    warnings = optional (isMLocate && cfg.localuser != null) "mlocate does not support searching as user other than root"
+            ++ optional (isFindutils && cfg.pruneNames != []) "findutils locate does not support pruning by directory component"
+            ++ optional (isFindutils && cfg.pruneBindMounts) "findutils locate does not support skipping bind mounts";
+  
    systemd.services.update-locatedb =
      { description = "Update Locate Database";
-        path  = [ pkgs.su ];
+        path = mkIf (!isMLocate) [ pkgs.su ];
        script =
          ''
-            mkdir -m 0755 -p $(dirname ${toString cfg.output})
+            install -m ${if isMLocate then "0750" else "0755"} -o root -g ${if isMLocate then "mlocate" else "root"} -d $(dirname ${cfg.output})
            exec ${cfg.locate}/bin/updatedb \
-              --localuser=${cfg.localuser} \
-              ${optionalString (!cfg.includeStore) "--prunepaths='/nix/store'"} \
+              ${optionalString (cfg.localuser != null) ''--localuser=${cfg.localuser}''} \
              --output=${toString cfg.output} ${concatStringsSep " " cfg.extraFlags}
          '';
+        environment = {
+          PRUNEFS = concatStringsSep " " cfg.pruneFS;
+          PRUNEPATHS = concatStringsSep " " cfg.prunePaths;
+          PRUNENAMES = concatStringsSep " " cfg.pruneNames;
+          PRUNE_BIND_MOUNTS = if cfg.pruneBindMounts then "yes" else "no";
+        };
        serviceConfig.Nice = 19;
        serviceConfig.IOSchedulingClass = "idle";
        serviceConfig.PrivateTmp = "yes";
@ -100,7 +150,7 @@ in {
        serviceConfig.ReadWriteDirectories = dirOf cfg.output;
      };

-    systemd.timers.update-locatedb = mkIf cfg.enable
+    systemd.timers.update-locatedb =
      { description = "Update timer for locate database";
        partOf      = [ "update-locatedb.service" ];
        wantedBy    = [ "timers.target" ];
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -212,6 +212,7 @@
  ./services/logging/awstats.nix
  ./services/logging/fluentd.nix
  ./services/logging/graylog.nix
+  ./services/logging/journalbeat.nix
  ./services/logging/klogd.nix
  ./services/logging/logcheck.nix
  ./services/logging/logrotate.nix
@ -332,6 +333,7 @@
  ./services/monitoring/telegraf.nix
  ./services/monitoring/ups.nix
  ./services/monitoring/uptime.nix
+  ./services/monitoring/vnstat.nix
  ./services/monitoring/zabbix-agent.nix
  ./services/monitoring/zabbix-server.nix
  ./services/network-filesystems/cachefilesd.nix
@ -370,6 +372,7 @@
  ./services/networking/dhcpd.nix
  ./services/networking/dnschain.nix
  ./services/networking/dnscrypt-proxy.nix
+  ./services/networking/dnscrypt-wrapper.nix
  ./services/networking/dnsmasq.nix
  ./services/networking/ejabberd.nix
  ./services/networking/fan.nix
@ -396,6 +399,7 @@
  ./services/networking/iodine.nix
  ./services/networking/ircd-hybrid/default.nix
  ./services/networking/kippo.nix
+  ./services/networking/kresd.nix
  ./services/networking/lambdabot.nix
  ./services/networking/libreswan.nix
  ./services/networking/logmein-hamachi.nix
@ -426,6 +430,7 @@
  ./services/networking/pdnsd.nix
  ./services/networking/polipo.nix
  ./services/networking/powerdns.nix
+  ./services/networking/pdns-recursor.nix
  ./services/networking/pptpd.nix
  ./services/networking/prayer.nix
  ./services/networking/privoxy.nix
--- a/nixos/modules/profiles/installation-device.nix
+++ b/nixos/modules/profiles/installation-device.nix
@ -45,8 +45,13 @@ with lib;
            "Type `systemctl start display-manager' to\nstart the graphical user interface."}
      '';

-    # Allow sshd to be started manually through "start sshd".
-    services.openssh.enable = true;
+    # Allow sshd to be started manually through "systemctl start sshd".
+    services.openssh = {
+      enable = true;
+      # Allow password login to the installation, if the user sets a password via "passwd"
+      # It is safe as root doesn't have a password by default and SSH is disabled by default
+      permitRootLogin = "yes";
+    };
    systemd.services.sshd.wantedBy = mkOverride 50 [];

    # Enable wpa_supplicant, but don't start it by default.
@ -66,9 +71,8 @@ with lib;
    boot.kernel.sysctl."vm.overcommit_memory" = "1";

    # To speed up installation a little bit, include the complete
-    # stdenv in the Nix store on the CD.  Archive::Cpio is needed for
-    # the initrd builder.
-    system.extraDependencies = [ pkgs.stdenv pkgs.busybox pkgs.perlPackages.ArchiveCpio ];
+    # stdenv in the Nix store on the CD.
+    system.extraDependencies = with pkgs; [ stdenv stdenvNoCC busybox ];

    # Show all debug messages from the kernel but don't log refused packets
    # because we have the firewall enabled. This makes installs from the
--- a/nixos/modules/programs/environment.nix
+++ b/nixos/modules/programs/environment.nix
@ -17,8 +17,7 @@ in
  config = {

    environment.variables =
-      { LOCATE_PATH = "/var/cache/locatedb";
-        NIXPKGS_CONFIG = "/etc/nix/nixpkgs-config.nix";
+      { NIXPKGS_CONFIG = "/etc/nix/nixpkgs-config.nix";
        PAGER = mkDefault "less -R";
        EDITOR = mkDefault "nano";
      };
--- a/nixos/modules/programs/man.nix
+++ b/nixos/modules/programs/man.nix
@ -11,6 +11,7 @@ with lib;
      default = true;
      description = ''
        Whether to enable manual pages and the <command>man</command> command.
+        This also includes "man" outputs of all <literal>systemPackages</literal>.
      '';
    };

--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@ -18,6 +18,7 @@ with lib;
    (mkRenamedOptionModule [ "services" "elasticsearch" "host" ] [ "services" "elasticsearch" "listenAddress" ])
    (mkRenamedOptionModule [ "services" "graphite" "api" "host" ] [ "services" "graphite" "api" "listenAddress" ])
    (mkRenamedOptionModule [ "services" "graphite" "web" "host" ] [ "services" "graphite" "web" "listenAddress" ])
+    (mkRenamedOptionModule [ "services" "logstash" "address" ] [ "services" "logstash" "listenAddress" ])
    (mkRenamedOptionModule [ "services" "kibana" "host" ] [ "services" "kibana" "listenAddress" ])
    (mkRenamedOptionModule [ "services" "mpd" "network" "host" ] [ "services" "mpd" "network" "listenAddress" ])
    (mkRenamedOptionModule [ "services" "neo4j" "host" ] [ "services" "neo4j" "listenAddress" ])
@ -167,6 +168,10 @@ with lib;
    # dhcpd
    (mkRenamedOptionModule [ "services" "dhcpd" ] [ "services" "dhcpd4" ])

+    # locate
+    (mkRenamedOptionModule [ "services" "locate" "period" ] [ "services" "locate" "interval" ])
+    (mkRemovedOptionModule [ "services" "locate" "includeStore" ] "Use services.locate.prunePaths" )
+
    # Options that are obsolete and have no replacement.
    (mkRemovedOptionModule [ "boot" "initrd" "luks" "enable" ] "")
    (mkRemovedOptionModule [ "programs" "bash" "enable" ] "")
--- a/nixos/modules/security/acme.nix
+++ b/nixos/modules/security/acme.nix
@ -284,6 +284,8 @@ in
            OnCalendar = cfg.renewInterval;
            Unit = "acme-${cert}.service";
            Persistent = "yes";
+            AccuracySec = "5m";
+            RandomizedDelaySec = "1h";
          };
        })
      );
--- a/nixos/modules/services/games/factorio.nix
+++ b/nixos/modules/services/games/factorio.nix
@ -14,6 +14,31 @@ let
    read-data=${factorio}/share/factorio/data
    write-data=${stateDir}
  '';
+  serverSettings = {
+    name = cfg.game-name;
+    description = cfg.description;
+    visibility = {
+      public = cfg.public;
+      lan = cfg.lan;
+    };
+    username = cfg.username;
+    password = cfg.password;
+    token = cfg.token;
+    game_password = cfg.game-password;
+    require_user_verification = true;
+    max_upload_in_kilobytes_per_second = 0;
+    minimum_latency_in_ticks = 0;
+    ignore_player_limit_for_returning_players = false;
+    allow_commands = "admins-only";
+    autosave_interval = cfg.autosave-interval;
+    autosave_slots = 5;
+    afk_autokick_interval = 0;
+    auto_pause = true;
+    only_admins_can_pause_the_game = true;
+    autosave_only_on_server = true;
+    admins = [];
+  };
+  serverSettingsFile = pkgs.writeText "server-settings.json" (builtins.toJSON (filterAttrsRecursive (n: v: v != null) serverSettings));
  modDir = pkgs.factorio-mkModDirDrv cfg.mods;
 in
 {
@ -67,12 +92,68 @@ in
          derivations via nixos-channel. Until then, this is for experts only.
        '';
      };
+      game-name = mkOption {
+        type = types.nullOr types.string;
+        default = "Factorio Game";
+        description = ''
+          Name of the game as it will appear in the game listing.
+        '';
+      };
+      description = mkOption {
+        type = types.nullOr types.string;
+        default = "";
+        description = ''
+          Description of the game that will appear in the listing.
+        '';
+      };
+      public = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Game will be published on the official Factorio matching server.
+        '';
+      };
+      lan = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Game will be broadcast on LAN.
+        '';
+      };
+      username = mkOption {
+        type = types.nullOr types.string;
+        default = null;
+        description = ''
+          Your factorio.com login credentials. Required for games with visibility public.
+        '';
+      };
+      password = mkOption {
+        type = types.nullOr types.string;
+        default = null;
+        description = ''
+          Your factorio.com login credentials. Required for games with visibility public.
+        '';
+      };
+      token = mkOption {
+        type = types.nullOr types.string;
+        default = null;
+        description = ''
+          Authentication token. May be used instead of 'password' above.
+        '';
+      };
+      game-password = mkOption {
+        type = types.nullOr types.string;
+        default = null;
+        description = ''
+          Game password.
+        '';
+      };
      autosave-interval = mkOption {
        type = types.nullOr types.int;
        default = null;
-        example = 2;
+        example = 10;
        description = ''
-          The time, in minutes, between autosaves.
+          Autosave interval in minutes.
        '';
      };
    };
@ -120,8 +201,8 @@ in
          "--config=${cfg.configFile}"
          "--port=${toString cfg.port}"
          "--start-server=${mkSavePath cfg.saveName}"
+          "--server-settings=${serverSettingsFile}"
          (optionalString (cfg.mods != []) "--mod-directory=${modDir}")
-          (optionalString (cfg.autosave-interval != null) "--autosave-interval ${toString cfg.autosave-interval}")
        ];
      };
    };
--- a/nixos/modules/services/logging/journalbeat.nix
+++ b/nixos/modules/services/logging/journalbeat.nix
@ -0,0 +1,76 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.journalbeat;
+
+  journalbeatYml = pkgs.writeText "journalbeat.yml" ''
+    name: ${cfg.name}
+    tags: ${builtins.toJSON cfg.tags}
+
+    journalbeat.cursor_state_file: ${cfg.stateDir}/cursor-state
+
+    ${cfg.extraConfig}
+  '';
+
+in
+{
+  options = {
+
+    services.journalbeat = {
+
+      enable = mkEnableOption "journalbeat";
+
+      name = mkOption {
+        type = types.str;
+        default = "journalbeat";
+        description = "Name of the beat";
+      };
+
+      tags = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        description = "Tags to place on the shipped log messages";
+      };
+
+      stateDir = mkOption {
+        type = types.str;
+        default = "/var/lib/journalbeat";
+        description = "The state directory. Journalbeat's own logs and other data are stored here.";
+      };
+
+      extraConfig = mkOption {
+        type = types.lines;
+        default = ''
+          journalbeat:
+            seek_position: cursor
+            cursor_seek_fallback: tail
+            write_cursor_state: true
+            cursor_flush_period: 5s
+            clean_field_names: true
+            convert_to_numbers: false
+            move_metadata_to_field: journal
+            default_type: journal
+        '';
+        description = "Any other configuration options you want to add";
+      };
+
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    systemd.services.journalbeat = with pkgs; {
+      description = "Journalbeat log shipper";
+      wantedBy = [ "multi-user.target" ];
+      preStart = ''
+        mkdir -p ${cfg.stateDir}/data
+        mkdir -p ${cfg.stateDir}/logs
+      '';
+      serviceConfig = {
+        ExecStart = "${pkgs.journalbeat}/bin/journalbeat -c ${journalbeatYml} -path.data ${cfg.stateDir}/data -path.logs ${cfg.stateDir}/logs";
+      };
+    };
+  };
+}
--- a/nixos/modules/services/logging/logstash.nix
+++ b/nixos/modules/services/logging/logstash.nix
@ -63,7 +63,7 @@ in
        description = "Enable the logstash web interface.";
      };

-      address = mkOption {
+      listenAddress = mkOption {
        type = types.str;
        default = "0.0.0.0";
        description = "Address on which to start webserver.";
@ -77,7 +77,7 @@ in

      inputConfig = mkOption {
        type = types.lines;
-        default = ''stdin { type => "example" }'';
+        default = ''generator { }'';
        description = "Logstash input configuration.";
        example = ''
          # Read from journal
@ -90,7 +90,7 @@ in

      filterConfig = mkOption {
        type = types.lines;
-        default = ''noop {}'';
+        default = "";
        description = "logstash filter configuration.";
        example = ''
          if [type] == "syslog" {
@ -108,11 +108,11 @@ in

      outputConfig = mkOption {
        type = types.lines;
-        default = ''stdout { debug => true debug_format => "json"}'';
+        default = ''stdout { codec => rubydebug }'';
        description = "Logstash output configuration.";
        example = ''
-          redis { host => "localhost" data_type => "list" key => "logstash" codec => json }
-          elasticsearch { embedded => true }
+          redis { host => ["localhost"] data_type => "list" key => "logstash" codec => json }
+          elasticsearch { }
        '';
      };

@ -147,7 +147,7 @@ in
              ${cfg.outputConfig}
            }
          ''} " +
-          ops cfg.enableWeb "-- web -a ${cfg.address} -p ${cfg.port}";
+          ops cfg.enableWeb "-- web -a ${cfg.listenAddress} -p ${cfg.port}";
      };
    };
  };
--- a/nixos/modules/services/misc/apache-kafka.nix
+++ b/nixos/modules/services/misc/apache-kafka.nix
@ -38,7 +38,7 @@ in {

    brokerId = mkOption {
      description = "Broker ID.";
-      default = 0;
+      default = -1;
      type = types.int;
    };

--- a/nixos/modules/services/monitoring/vnstat.nix
+++ b/nixos/modules/services/monitoring/vnstat.nix
@ -0,0 +1,43 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.vnstat;
+in {
+  options.services.vnstat = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Whether to enable update of network usage statistics via vnstatd.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    users.extraUsers.vnstatd = {
+      isSystemUser = true;
+      description = "vnstat daemon user";
+      home = "/var/lib/vnstat";
+      createHome = true;
+    };
+
+    systemd.services.vnstat = {
+      description = "vnStat network traffic monitor";
+      path = [ pkgs.coreutils ];
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      unitConfig.documentation = "man:vnstatd(1) man:vnstat(1) man:vnstat.conf(5)";
+      preStart = "chmod 755 /var/lib/vnstat";
+      serviceConfig = {
+        ExecStart = "${pkgs.vnstat}/bin/vnstatd -n";
+        ExecReload = "kill -HUP $MAINPID";
+        ProtectHome = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        User = "vnstatd";
+      };
+    };
+  };
+}
--- a/nixos/modules/services/network-filesystems/tahoe.nix
+++ b/nixos/modules/services/network-filesystems/tahoe.nix
@ -343,7 +343,7 @@ in
            preStart = ''
              if [ \! -d ${nodedir} ]; then
                mkdir -p /var/db/tahoe-lafs
-                tahoe create-node ${nodedir}
+                tahoe create-node --hostname=localhost ${nodedir}
              fi

              # Tahoe has created a predefined tahoe.cfg which we must now
--- a/nixos/modules/services/networking/dnscrypt-wrapper.nix
+++ b/nixos/modules/services/networking/dnscrypt-wrapper.nix
@ -0,0 +1,187 @@
+{ config, lib, pkgs, ... }:
+with lib;
+
+let
+  cfg     = config.services.dnscrypt-wrapper;
+  dataDir = "/var/lib/dnscrypt-wrapper";
+
+  daemonArgs = with cfg; [
+    "--listen-address=${address}:${toString port}"
+    "--resolver-address=${upstream.address}:${toString upstream.port}"
+    "--provider-name=${providerName}"
+    "--provider-publickey-file=public.key"
+    "--provider-secretkey-file=secret.key"
+    "--provider-cert-file=${providerName}.crt"
+    "--crypt-secretkey-file=${providerName}.key"
+  ];
+
+  genKeys = ''
+    # generates time-limited keypairs
+    keyGen() {
+      dnscrypt-wrapper --gen-crypt-keypair \
+        --crypt-secretkey-file=${cfg.providerName}.key
+
+      dnscrypt-wrapper --gen-cert-file \
+        --crypt-secretkey-file=${cfg.providerName}.key \
+        --provider-cert-file=${cfg.providerName}.crt \
+        --provider-publickey-file=public.key \
+        --provider-secretkey-file=secret.key \
+        --cert-file-expire-days=${toString cfg.keys.expiration}
+    }
+
+    cd ${dataDir}
+
+    # generate provider keypair (first run only)
+    if [ ! -f public.key ] || [ ! -f secret.key ]; then
+      dnscrypt-wrapper --gen-provider-keypair
+    fi
+
+    # generate new keys for rotation
+    if [ ! -f ${cfg.providerName}.key ] || [ ! -f ${cfg.providerName}.crt ]; then
+      keyGen
+    fi
+  '';
+
+  rotateKeys = ''
+    # check if keys are not expired
+    keyValid() {
+      fingerprint=$(dnscrypt-wrapper --show-provider-publickey-fingerprint | awk '{print $(NF)}')
+      dnscrypt-proxy --test=${toString (cfg.keys.checkInterval + 1)} \
+        --resolver-address=127.0.0.1:${toString cfg.port} \
+        --provider-name=${cfg.providerName} \
+        --provider-key=$fingerprint
+    }
+
+    cd ${dataDir}
+
+    # archive old keys and restart the service
+    if ! keyValid; then
+      mkdir -p oldkeys
+      mv ${cfg.providerName}.key oldkeys/${cfg.providerName}-$(date +%F-%T).key
+      mv ${cfg.providerName}.crt oldkeys/${cfg.providerName}-$(date +%F-%T).crt
+      systemctl restart dnscrypt-wrapper
+    fi
+  '';
+
+in {
+
+
+  ###### interface
+
+  options.services.dnscrypt-wrapper = {
+    enable = mkEnableOption "DNSCrypt wrapper";
+
+    address = mkOption {
+      type = types.str;
+      default = "127.0.0.1";
+      description = ''
+        The DNSCrypt wrapper will bind to this IP address.
+      '';
+    };
+
+    port = mkOption {
+      type = types.int;
+      default = 5353;
+      description = ''
+        The DNSCrypt wrapper will listen for DNS queries on this port.
+      '';
+    };
+
+    providerName = mkOption {
+      type = types.str;
+      default = "2.dnscrypt-cert.${config.networking.hostName}";
+      example = "2.dnscrypt-cert.myresolver";
+      description = ''
+        The name that will be given to this DNSCrypt resolver.
+        Note: the resolver name must start with <literal>2.dnscrypt-cert.</literal>.
+      '';
+    };
+
+    upstream.address = mkOption {
+      type = types.str;
+      default = "127.0.0.1";
+      description = ''
+        The IP address of the upstream DNS server DNSCrypt will "wrap".
+      '';
+    };
+
+    upstream.port = mkOption {
+      type = types.int;
+      default = 53;
+      description = ''
+        The port of the upstream DNS server DNSCrypt will "wrap".
+      '';
+    };
+
+    keys.expiration = mkOption {
+      type = types.int;
+      default = 30;
+      description = ''
+        The duration (in days) of the time-limited secret key.
+        This will be automatically rotated before expiration.
+      '';
+    };
+
+    keys.checkInterval = mkOption {
+      type = types.int;
+      default = 1440;
+      description = ''
+        The time interval (in minutes) between key expiration checks.
+      '';
+    };
+
+  };
+
+
+  ###### implementation
+
+  config = mkIf cfg.enable {
+
+    users.users.dnscrypt-wrapper = {
+      description = "dnscrypt-wrapper daemon user";
+      home = "${dataDir}";
+      createHome = true;
+    };
+    users.groups.dnscrypt-wrapper = { };
+
+
+    systemd.services.dnscrypt-wrapper = {
+      description = "dnscrypt-wrapper daemon";
+      after    = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      path     = [ pkgs.dnscrypt-wrapper ];
+
+      serviceConfig = {
+        User = "dnscrypt-wrapper";
+        WorkingDirectory = dataDir;
+        Restart   = "on-failure";
+        ExecStart = "${pkgs.dnscrypt-wrapper}/bin/dnscrypt-wrapper ${toString daemonArgs}";
+      };
+
+      preStart = genKeys;
+    };
+
+
+    systemd.services.dnscrypt-wrapper-rotate = {
+      after    = [ "network.target" ];
+      requires = [ "dnscrypt-wrapper.service" ];
+      description = "Rotates DNSCrypt wrapper keys if soon to expire";
+
+      path   = with pkgs; [ dnscrypt-wrapper dnscrypt-proxy gawk ];
+      script = rotateKeys;
+    };
+
+
+    systemd.timers.dnscrypt-wrapper-rotate = {
+      description = "Periodically check DNSCrypt wrapper keys for expiration";
+      wantedBy = [ "multi-user.target" ];
+
+      timerConfig = {
+        Unit = "dnscrypt-wrapper-rotate.service";
+        OnBootSec = "1min";
+        OnUnitActiveSec = cfg.keys.checkInterval * 60;
+      };
+    };
+
+  };
+}
--- a/nixos/modules/services/networking/firewall.nix
+++ b/nixos/modules/services/networking/firewall.nix
@ -41,7 +41,6 @@ let
  kernelPackages = config.boot.kernelPackages;

  kernelHasRPFilter = kernelPackages.kernel.features.netfilterRPFilter or false;
-  kernelCanDisableHelpers = kernelPackages.kernel.features.canDisableNetfilterConntrackHelpers or false;

  helpers =
    ''
@ -426,7 +425,7 @@ in

    networking.firewall.connectionTrackingModules = mkOption {
      type = types.listOf types.str;
-      default = [ "ftp" ];
+      default = [ ];
      example = [ "ftp" "irc" "sane" "sip" "tftp" "amanda" "h323" "netbios_sn" "pptp" "snmp" ];
      description =
        ''
@ -435,9 +434,11 @@ in

          As helpers can pose as a security risk, it is advised to
          set this to an empty list and disable the setting
-          networking.firewall.autoLoadConntrackHelpers
+          networking.firewall.autoLoadConntrackHelpers unless you
+          know what you are doing. Connection tracking is disabled
+          by default.

-          Loading of helpers is recommended to be done through the new
+          Loading of helpers is recommended to be done through the
          CT target.  More info:
          https://home.regit.org/netfilter-en/secure-use-of-helpers/
        '';
@ -445,7 +446,7 @@ in

    networking.firewall.autoLoadConntrackHelpers = mkOption {
      type = types.bool;
-      default = true;
+      default = false;
      description =
        ''
          Whether to auto-load connection-tracking helpers.
@ -505,15 +506,14 @@ in

    environment.systemPackages = [ pkgs.iptables ] ++ cfg.extraPackages;

-    boot.kernelModules = map (x: "nf_conntrack_${x}") cfg.connectionTrackingModules;
-    boot.extraModprobeConfig = optionalString (!cfg.autoLoadConntrackHelpers) ''
-      options nf_conntrack nf_conntrack_helper=0
+    boot.kernelModules = (optional cfg.autoLoadConntrackHelpers "nf_conntrack")
+      ++ map (x: "nf_conntrack_${x}") cfg.connectionTrackingModules;
+    boot.extraModprobeConfig = optionalString cfg.autoLoadConntrackHelpers ''
+      options nf_conntrack nf_conntrack_helper=1
    '';

    assertions = [ { assertion = (cfg.checkReversePath != false) || kernelHasRPFilter;
                     message = "This kernel does not support rpfilter"; }
-                   { assertion = cfg.autoLoadConntrackHelpers || kernelCanDisableHelpers;
-                     message = "This kernel does not support disabling conntrack helpers"; }
                 ];

    systemd.services.firewall = {
--- a/nixos/modules/services/networking/flannel.nix
+++ b/nixos/modules/services/networking/flannel.nix
@ -149,6 +149,6 @@ in {
      serviceConfig.ExecStart = "${cfg.package}/bin/flannel";
    };

-    services.etcd.enable = mkDefault cfg.etcd.endpoints == ["http://127.0.0.1:2379"];
+    services.etcd.enable = mkDefault (cfg.etcd.endpoints == ["http://127.0.0.1:2379"]);
  };
 }
--- a/nixos/modules/services/networking/kresd.nix
+++ b/nixos/modules/services/networking/kresd.nix
@ -0,0 +1,119 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  cfg = config.services.kresd;
+  package = pkgs.knot-resolver;
+
+  configFile = pkgs.writeText "kresd.conf" cfg.extraConfig;
+in
+
+{
+  meta.maintainers = [ maintainers.vcunat /* upstream developer */ ];
+
+  ###### interface
+  options.services.kresd = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Whether to enable knot-resolver domain name server.
+        DNSSEC validation is turned on by default.
+        You can run <literal>sudo nc -U /run/kresd/control</literal>
+        and give commands interactively to kresd.
+      '';
+    };
+    extraConfig = mkOption {
+      type = types.lines;
+      default = "";
+      description = ''
+        Extra lines to be added verbatim to the generated configuration file.
+      '';
+    };
+    cacheDir = mkOption {
+      type = types.path;
+      default = "/var/cache/kresd";
+      description = ''
+        Directory for caches.  They are intended to survive reboots.
+      '';
+    };
+    interfaces = mkOption {
+      type = with types; listOf str;
+      default = [ "::1" "127.0.0.1" ];
+      description = ''
+        What addresses the server should listen on.
+      '';
+    };
+    # TODO: perhaps options for more common stuff like cache size or forwarding
+  };
+
+  ###### implementation
+  config = mkIf cfg.enable {
+    environment.etc."kresd.conf".source = configFile; # not required
+
+    users.extraUsers = singleton
+      { name = "kresd";
+        uid = config.ids.uids.kresd;
+        group = "kresd";
+        description = "Knot-resolver daemon user";
+      };
+    users.extraGroups = singleton
+      { name = "kresd";
+        gid = config.ids.gids.kresd;
+      };
+
+    systemd.sockets.kresd = rec {
+      wantedBy = [ "sockets.target" ];
+      before = wantedBy;
+      listenStreams = map
+        # Syntax depends on being IPv6 or IPv4.
+        (iface: if elem ":" (stringToCharacters iface) then "[${iface}]:53" else "${iface}:53")
+        cfg.interfaces;
+      socketConfig.ListenDatagram = listenStreams;
+    };
+
+    systemd.sockets.kresd-control = rec {
+      wantedBy = [ "sockets.target" ];
+      before = wantedBy;
+      partOf = [ "kresd.socket" ];
+      listenStreams = [ "/run/kresd/control" ];
+      socketConfig = {
+        FileDescriptorName = "control";
+        Service = "kresd.service";
+        SocketMode = "0660"; # only root user/group may connect
+      };
+    };
+
+    # Create the cacheDir; tmpfiles don't work on nixos-rebuild switch.
+    systemd.services.kresd-cachedir = {
+      serviceConfig.Type = "oneshot";
+      script = ''
+        if [ ! -d '${cfg.cacheDir}' ]; then
+          mkdir -p '${cfg.cacheDir}'
+          chown kresd:kresd '${cfg.cacheDir}'
+        fi
+      '';
+    };
+
+    systemd.services.kresd = {
+      description = "Knot-resolver daemon";
+
+      serviceConfig = {
+        User = "kresd";
+        Type = "notify";
+        WorkingDirectory = cfg.cacheDir;
+      };
+
+      script = ''
+        exec '${package}/bin/kresd' --config '${configFile}' \
+          -k '${cfg.cacheDir}/root.key'
+      '';
+
+      after = [ "kresd-cachedir.service" ];
+      requires = [ "kresd.socket" "kresd-cachedir.service" ];
+      wantedBy = [ "sockets.target" ];
+    };
+  };
+}
--- a/nixos/modules/services/networking/networkmanager.nix
+++ b/nixos/modules/services/networking/networkmanager.nix
@ -174,7 +174,7 @@ in {

    assertions = [{
      assertion = config.networking.wireless.enable == false;
-      message = "You can not use networking.networkmanager with services.networking.wireless";
+      message = "You can not use networking.networkmanager with networking.wireless";
    }];

    boot.kernelModules = [ "ppp_mppe" ]; # Needed for most (all?) PPTP VPN connections.
@ -239,7 +239,8 @@ in {
    # Turn off NixOS' network management
    networking = {
      useDHCP = false;
-      wireless.enable = false;
+      # use mkDefault to trigger the assertion about the conflict above
+      wireless.enable = lib.mkDefault false;
    };

    powerManagement.resumeCommands = ''
--- a/nixos/modules/services/networking/pdns-recursor.nix
+++ b/nixos/modules/services/networking/pdns-recursor.nix
@ -0,0 +1,168 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  dataDir  = "/var/lib/pdns-recursor";
+  username = "pdns-recursor";
+
+  cfg   = config.services.pdns-recursor;
+  zones = mapAttrsToList (zone: uri: "${zone}.=${uri}") cfg.forwardZones;
+
+  configFile = pkgs.writeText "recursor.conf" ''
+    local-address=${cfg.dns.address}
+    local-port=${toString cfg.dns.port}
+    allow-from=${concatStringsSep "," cfg.dns.allowFrom}
+
+    webserver-address=${cfg.api.address}
+    webserver-port=${toString cfg.api.port}
+    webserver-allow-from=${concatStringsSep "," cfg.api.allowFrom}
+
+    forward-zones=${concatStringsSep "," zones}
+    export-etc-hosts=${if cfg.exportHosts then "yes" else "no"}
+    dnssec=${cfg.dnssecValidation}
+    serve-rfc1918=${if cfg.serveRFC1918 then "yes" else "no"}
+
+    ${cfg.extraConfig}
+  '';
+
+in {
+  options.services.pdns-recursor = {
+    enable = mkEnableOption "PowerDNS Recursor, a recursive DNS server";
+
+    dns.address = mkOption {
+      type = types.str;
+      default = "0.0.0.0";
+      description = ''
+        IP address Recursor DNS server will bind to.
+      '';
+    };
+
+    dns.port = mkOption {
+      type = types.int;
+      default = 53;
+      description = ''
+        Port number Recursor DNS server will bind to.
+      '';
+    };
+
+    dns.allowFrom = mkOption {
+      type = types.listOf types.str;
+      default = [ "10.0.0.0/8" "172.16.0.0/12" "192.168.0.0/16" ];
+      example = [ "0.0.0.0/0" ];
+      description = ''
+        IP address ranges of clients allowed to make DNS queries.
+      '';
+    };
+
+    api.address = mkOption {
+      type = types.str;
+      default = "0.0.0.0";
+      description = ''
+        IP address Recursor REST API server will bind to.
+      '';
+    };
+
+    api.port = mkOption {
+      type = types.int;
+      default = 8082;
+      description = ''
+        Port number Recursor REST API server will bind to.
+      '';
+    };
+
+    api.allowFrom = mkOption {
+      type = types.listOf types.str;
+      default = [ "0.0.0.0/0" ];
+      description = ''
+        IP address ranges of clients allowed to make API requests.
+      '';
+    };
+
+    exportHosts = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+       Whether to export names and IP addresses defined in /etc/hosts.
+      '';
+    };
+
+    forwardZones = mkOption {
+      type = types.attrs;
+      example = { eth = "127.0.0.1:5353"; };
+      default = {};
+      description = ''
+        DNS zones to be forwarded to other servers.
+      '';
+    };
+
+    dnssecValidation = mkOption {
+      type = types.enum ["off" "process-no-validate" "process" "log-fail" "validate"];
+      default = "validate";
+      description = ''
+        Controls the level of DNSSEC processing done by the PowerDNS Recursor.
+        See https://doc.powerdns.com/md/recursor/dnssec/ for a detailed explanation.
+      '';
+    };
+
+    serveRFC1918 = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        Whether to directly resolve the RFC1918 reverse-mapping domains:
+        <literal>10.in-addr.arpa</literal>,
+        <literal>168.192.in-addr.arpa</literal>,
+        <literal>16-31.172.in-addr.arpa</literal>
+        This saves load on the AS112 servers.
+      '';
+    };
+
+    extraConfig = mkOption {
+      type = types.lines;
+      default = "";
+      description = ''
+        Extra options to be appended to the configuration file.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    users.extraUsers."${username}" = {
+      home = dataDir;
+      createHome = true;
+      uid = config.ids.uids.pdns-recursor;
+      description = "PowerDNS Recursor daemon user";
+    };
+
+    systemd.services.pdns-recursor = {
+      unitConfig.Documentation = "man:pdns_recursor(1) man:rec_control(1)";
+      description = "PowerDNS recursive server";
+      wantedBy = [ "multi-user.target" ];
+      after    = [ "network.target" ];
+
+      serviceConfig = {
+        User = username;
+        Restart    ="on-failure";
+        RestartSec = "5";
+        PrivateTmp = true;
+        PrivateDevices = true;
+        AmbientCapabilities = "cap_net_bind_service";
+        ExecStart = ''${pkgs.pdns-recursor}/bin/pdns_recursor \
+          --config-dir=${dataDir} \
+          --socket-dir=${dataDir} \
+          --disable-syslog
+        '';
+      };
+
+      preStart = ''
+        # Link configuration file into recursor home directory
+        configPath=${dataDir}/recursor.conf
+        if [ "$(realpath $configPath)" != "${configFile}" ]; then
+          rm -f $configPath
+          ln -s ${configFile} $configPath
+        fi
+      '';
+    };
+  };
+}
--- a/nixos/modules/services/networking/smokeping.nix
+++ b/nixos/modules/services/networking/smokeping.nix
@ -273,7 +273,7 @@ in
        message = "services.smokeping: sendmail and Mailhost cannot both be enabled.";
      }
    ];
-    security.setuidPrograms = [ "fping" ];
+    security.setuidPrograms = [ "fping" "fping6" ];
    environment.systemPackages = [ pkgs.fping ];
    users.extraUsers = singleton {
      name = cfg.user;
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@ -5,7 +5,11 @@ with lib;
 let
  cfg = config.services.nginx;
  virtualHosts = mapAttrs (vhostName: vhostConfig:
-    vhostConfig // (optionalAttrs vhostConfig.enableACME {
+    vhostConfig // {
+      serverName = if vhostConfig.serverName != null
+        then vhostConfig.serverName
+        else vhostName;
+    } // (optionalAttrs vhostConfig.enableACME {
      sslCertificate = "/var/lib/acme/${vhostName}/fullchain.pem";
      sslCertificateKey = "/var/lib/acme/${vhostName}/key.pem";
    })
@ -112,8 +116,9 @@ let
    ${cfg.appendConfig}
  '';

-  vhosts = concatStringsSep "\n" (mapAttrsToList (serverName: vhost:
+  vhosts = concatStringsSep "\n" (mapAttrsToList (vhostName: vhost:
      let
+        serverName = vhost.serverName;
        ssl = vhost.enableSSL || vhost.forceSSL;
        port = if vhost.port != null then vhost.port else (if ssl then 443 else 80);
        listenString = toString port + optionalString ssl " ssl http2"
@ -161,7 +166,7 @@ let
            ssl_certificate_key ${vhost.sslCertificateKey};
          ''}

-          ${optionalString (vhost.basicAuth != {}) (mkBasicAuth serverName vhost.basicAuth)}
+          ${optionalString (vhost.basicAuth != {}) (mkBasicAuth vhostName vhost.basicAuth)}

          ${mkLocations vhost.locations}

@ -178,8 +183,8 @@ let
      ${config.extraConfig}
    }
  '') locations);
-  mkBasicAuth = serverName: authDef: let
-    htpasswdFile = pkgs.writeText "${serverName}.htpasswd" (
+  mkBasicAuth = vhostName: authDef: let
+    htpasswdFile = pkgs.writeText "${vhostName}.htpasswd" (
      concatStringsSep "\n" (mapAttrsToList (user: password: ''
        ${user}:{PLAIN}${password}
      '') authDef)
@ -393,17 +398,20 @@ in
    };

    security.acme.certs = filterAttrs (n: v: v != {}) (
-      mapAttrs (vhostName: vhostConfig:
-        optionalAttrs vhostConfig.enableACME {
-          user = cfg.user;
-          group = cfg.group;
-          webroot = vhostConfig.acmeRoot;
-          extraDomains = genAttrs vhostConfig.serverAliases (alias: null);
-          postRun = ''
-            systemctl reload nginx
-          '';
-        }
-      ) virtualHosts
+      let
+        vhostsConfigs = mapAttrsToList (vhostName: vhostConfig: vhostConfig) virtualHosts;
+        acmeEnabledVhosts = filter (vhostConfig: vhostConfig.enableACME) vhostsConfigs;
+        acmePairs = map (vhostConfig: { name = vhostConfig.serverName; value = {
+            user = cfg.user;
+            group = cfg.group;
+            webroot = vhostConfig.acmeRoot;
+            extraDomains = genAttrs vhostConfig.serverAliases (alias: null);
+            postRun = ''
+              systemctl reload nginx
+            '';
+          }; }) acmeEnabledVhosts;
+      in
+        listToAttrs acmePairs
    );

    users.extraUsers = optionalAttrs (cfg.user == "nginx") (singleton
--- a/nixos/modules/services/web-servers/nginx/vhost-options.nix
+++ b/nixos/modules/services/web-servers/nginx/vhost-options.nix
@ -8,6 +8,15 @@
 with lib;
 {
  options = {
+    serverName = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = ''
+        Name of this virtual host. Defaults to attribute name in virtualHosts.
+      '';
+      example = "example.org";
+    };
+
    serverAliases = mkOption {
      type = types.listOf types.str;
      default = [];
--- a/nixos/modules/services/x11/desktop-managers/kde5.nix
+++ b/nixos/modules/services/x11/desktop-managers/kde5.nix
@ -249,6 +249,11 @@ in

      security.pam.services.kde = { allowNullPassword = true; };

+      # use kimpanel as the default IBus panel
+      i18n.inputMethod.ibus.panel =
+        lib.mkDefault
+        "${pkgs.kde5.plasma-desktop}/lib/libexec/kimpanel-ibus-panel";
+
    })
  ];

--- a/nixos/release.nix
+++ b/nixos/release.nix
@ -273,6 +273,7 @@ in rec {
  tests.mysql = callTest tests/mysql.nix {};
  tests.mysqlReplication = callTest tests/mysql-replication.nix {};
  tests.nat.firewall = callTest tests/nat.nix { withFirewall = true; };
+  tests.nat.firewall-conntrack = callTest tests/nat.nix { withFirewall = true; withConntrackHelpers = true; };
  tests.nat.standalone = callTest tests/nat.nix { withFirewall = false; };
  tests.networking.networkd = callSubTests tests/networking.nix { networkd = true; };
  tests.networking.scripted = callSubTests tests/networking.nix { networkd = false; };
--- a/nixos/tests/bittorrent.nix
+++ b/nixos/tests/bittorrent.nix
@ -11,7 +11,7 @@ import ./make-test.nix ({ pkgs, ... }:
 let

  # Some random file to serve.
-  file = pkgs.nixUnstable.src;
+  file = pkgs.hello.src;

  miniupnpdConf = nodes: pkgs.writeText "miniupnpd.conf"
    ''
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@ -115,8 +115,8 @@ let

      # Did the swap device get activated?
      # uncomment once https://bugs.freedesktop.org/show_bug.cgi?id=86930 is resolved
-      #$machine->waitForUnit("swap.target");
-      $machine->waitUntilSucceeds("cat /proc/swaps | grep -q /dev");
+      $machine->waitForUnit("swap.target");
+      $machine->succeed("cat /proc/swaps | grep -q /dev");

      # Check whether the channel works.
      $machine->succeed("nix-env -iA nixos.procps >&2");
--- a/nixos/tests/nat.nix
+++ b/nixos/tests/nat.nix
@ -3,34 +3,47 @@
 # client on the inside network, a server on the outside network, and a
 # router connected to both that performs Network Address Translation
 # for the client.
-import ./make-test.nix ({ pkgs, withFirewall, ... }:
+import ./make-test.nix ({ pkgs, lib, withFirewall, withConntrackHelpers ? false, ... }:
  let
    unit = if withFirewall then "firewall" else "nat";
  in
  {
-    name = "nat${if withFirewall then "WithFirewall" else "Standalone"}";
-  meta = with pkgs.stdenv.lib.maintainers; {
+    name = "nat" + (if withFirewall then "WithFirewall" else "Standalone")
+                 + (lib.optionalString withConntrackHelpers "withConntrackHelpers");
+    meta = with pkgs.stdenv.lib.maintainers; {
      maintainers = [ eelco chaoflow rob wkennington ];
    };

    nodes =
      { client =
          { config, pkgs, nodes, ... }:
-          { virtualisation.vlans = [ 1 ];
-            networking.firewall.allowPing = true;
-            networking.defaultGateway =
-              (pkgs.lib.head nodes.router.config.networking.interfaces.eth2.ip4).address;
-          };
+          lib.mkMerge [
+            { virtualisation.vlans = [ 1 ];
+              networking.firewall.allowPing = true;
+              networking.defaultGateway =
+                (pkgs.lib.head nodes.router.config.networking.interfaces.eth2.ip4).address;
+            }
+            (lib.optionalAttrs withConntrackHelpers {
+              networking.firewall.connectionTrackingModules = [ "ftp" ];
+              networking.firewall.autoLoadConntrackHelpers = true;
+            })
+          ];

        router =
          { config, pkgs, ... }:
-          { virtualisation.vlans = [ 2 1 ];
-            networking.firewall.enable = withFirewall;
-            networking.firewall.allowPing = true;
-            networking.nat.enable = true;
-            networking.nat.internalIPs = [ "192.168.1.0/24" ];
-            networking.nat.externalInterface = "eth1";
-          };
+          lib.mkMerge [
+            { virtualisation.vlans = [ 2 1 ];
+              networking.firewall.enable = withFirewall;
+              networking.firewall.allowPing = true;
+              networking.nat.enable = true;
+              networking.nat.internalIPs = [ "192.168.1.0/24" ];
+              networking.nat.externalInterface = "eth1";
+            }
+            (lib.optionalAttrs withConntrackHelpers {
+              networking.firewall.connectionTrackingModules = [ "ftp" ];
+              networking.firewall.autoLoadConntrackHelpers = true;
+            })
+          ];

        server =
          { config, pkgs, ... }:
@ -66,7 +79,8 @@ import ./make-test.nix ({ pkgs, withFirewall, ... }:
        $client->succeed("curl -v ftp://server/foo.txt >&2");

        # Test whether active FTP works.
-        $client->succeed("curl -v -P - ftp://server/foo.txt >&2");
+        $client->${if withConntrackHelpers then "succeed" else "fail"}(
+          "curl -v -P - ftp://server/foo.txt >&2");

        # Test ICMP.
        $client->succeed("ping -c 1 router >&2");
--- a/pkgs/applications/audio/quodlibet/default.nix
+++ b/pkgs/applications/audio/quodlibet/default.nix
@ -12,7 +12,7 @@ let
  inherit (python2Packages) buildPythonApplication python mutagen pygtk pygobject2 dbus-python;
 in buildPythonApplication {
  # call the package quodlibet and just quodlibet
-  name = "quodlibet${stdenv.lib.optionalString withGstPlugins "-with-gst-plugins"}-${version}";
+  name = "quodlibet${stdenv.lib.optionalString (!withGstPlugins) "-without-gst-plugins"}-${version}";

  # XXX, tests fail
  doCheck = false;
--- a/pkgs/applications/editors/atom/default.nix
+++ b/pkgs/applications/editors/atom/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "atom-${version}";
-  version = "1.13.0";
+  version = "1.13.1";

  src = fetchurl {
    url = "https://github.com/atom/atom/releases/download/v${version}/atom-amd64.deb";
-    sha256 = "17k4v5hibaq4zi86y1sjx09hqng4sm3lr024v2mjnhj65m2nhjb8";
+    sha256 = "0nkd0nrnnmln5fjs1c97dligzqp744j4y6lqanfbs9vrxms6mnq3";
    name = "${name}.deb";
  };

--- a/pkgs/applications/editors/emacs-modes/melpa-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/melpa-generated.nix
--- a/pkgs/applications/editors/emacs-modes/melpa-stable-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/melpa-stable-generated.nix
@ -20,6 +20,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    aa-edit-mode = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild, navi2ch }:
+    melpaBuild {
+        pname = "aa-edit-mode";
+        version = "0.0.2";
+        src = fetchFromGitHub {
+          owner = "zonuexe";
+          repo = "aa-edit-mode";
+          rev = "2e56f3b627f0f19fbfce4968180b4d736f7afb5d";
+          sha256 = "1rh9n97z1vi7w60qzam5vc025wwm346fgzym2zs1cm7ykyfh3mgd";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/20d00f782f2db87264c7fb1aac7455e44b8b24e7/recipes/aa-edit-mode";
+          sha256 = "00b99ik04xx4b2a1cm1z8dl42hjnb5r32qypjyyx8924n1dhxzgn";
+          name = "aa-edit-mode";
+        };
+        packageRequires = [ emacs navi2ch ];
+        meta = {
+          homepage = "https://melpa.org/#/aa-edit-mode";
+          license = lib.licenses.free;
+        };
+      }) {};
    abc-mode = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "abc-mode";
@ -587,22 +608,22 @@
          license = lib.licenses.free;
        };
      }) {};
-    ace-flyspell = callPackage ({ ace-jump-mode, fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    ace-flyspell = callPackage ({ avy, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "ace-flyspell";
-        version = "0.1.2";
+        version = "0.1.3";
        src = fetchFromGitHub {
          owner = "cute-jumper";
          repo = "ace-flyspell";
-          rev = "a850fa913b3d1bab4c00bacee41da934929cef52";
-          sha256 = "1pzh5l8dybrrmglj55nbff6065pxlbx14501p3a1qx1wvf24g1sv";
+          rev = "044d38fb8eb390ef1f51cf92cfe5c4ffd103044c";
+          sha256 = "0yy7g2903v78a8pavhxi8c7vqbmifn2sjk84zhw5aygihp3d6vf0";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/1ea85eca9cf2df3f8c06709dfb44b339b8bdbc6c/recipes/ace-flyspell";
          sha256 = "0f24qrpcvyg7h6ylyggn4zrbydci537iigshac1d8yywsr0j47gd";
          name = "ace-flyspell";
        };
-        packageRequires = [ ace-jump-mode ];
+        packageRequires = [ avy ];
        meta = {
          homepage = "https://melpa.org/#/ace-flyspell";
          license = lib.licenses.free;
@ -2263,12 +2284,12 @@
    base16-theme = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "base16-theme";
-        version = "1.2";
+        version = "2.0";
        src = fetchFromGitHub {
          owner = "belak";
          repo = "base16-emacs";
-          rev = "97359d48a00b30776c5416ea90735d8302687677";
-          sha256 = "0f0gg5kfzgii0rf75gh48wnwimkc88xzwbifkwdf745jhzkyqn6s";
+          rev = "b50e90a39344402d169b8fdd5d18cc43fb16a256";
+          sha256 = "13b9ccm7yw95zc8v8sri762fgqdp2hp107nj5b40yv90g3y4fwby";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/30862f6be74882cfb57fb031f7318d3fd15551e3/recipes/base16-theme";
@ -2764,6 +2785,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    bshell = callPackage ({ buffer-manage, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    melpaBuild {
+        pname = "bshell";
+        version = "0.1";
+        src = fetchFromGitHub {
+          owner = "plandes";
+          repo = "bshell";
+          rev = "0abd93439895851c1ad3037b0df7443e577ed1ba";
+          sha256 = "1frs3m44m4jjl3rxkahkyss2gnijpdpsbqvx0vwbl637gcap1slw";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/cf0ed51304f752af3e1f56caf2856d1521d782a4/recipes/bshell";
+          sha256 = "1ds8xvh74i6wqswjp8i30knr74l4gbalkb2jil8qjb9wp9l1gw9z";
+          name = "bshell";
+        };
+        packageRequires = [ buffer-manage emacs ];
+        meta = {
+          homepage = "https://melpa.org/#/bshell";
+          license = lib.licenses.free;
+        };
+      }) {};
    buffer-flip = callPackage ({ fetchFromGitHub, fetchurl, key-chord, lib, melpaBuild }:
    melpaBuild {
        pname = "buffer-flip";
@ -3796,12 +3838,12 @@
    cliphist = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild, popup }:
    melpaBuild {
        pname = "cliphist";
-        version = "0.5.1";
+        version = "0.5.2";
        src = fetchFromGitHub {
          owner = "redguardtoo";
          repo = "cliphist";
-          rev = "72a8a92f69b280c347afe2f8b5f5eb57606a9aec";
-          sha256 = "0arilk9msbrx4kwg6nk0faw1yi2ss225wdlz6ycdgqc1531h6jkm";
+          rev = "8aaee153e0561625c35a8c178e57385c2ec92731";
+          sha256 = "0swsvzz20szfcgfaarga9apla1kl0ph0lrpk0ccl6mcf93zbnvby";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/82d86dae4ad8efc8ef342883c164c56e43079171/recipes/cliphist";
@ -4542,12 +4584,12 @@
    company-erlang = callPackage ({ company, emacs, fetchFromGitHub, fetchurl, ivy-erlang-complete, lib, melpaBuild }:
    melpaBuild {
        pname = "company-erlang";
-        version = "0.1";
+        version = "0.1.1";
        src = fetchFromGitHub {
          owner = "s-kostyaev";
          repo = "company-erlang";
-          rev = "3296baf45e354171acfddf33071b0f5af64371b5";
-          sha256 = "00r0rr2c11b8mpis7a64dj6bzpm2jm17lpqmrhjjnc66zpq1vq8y";
+          rev = "bc0524a16f17b66c7397690e4ca0e004f09ea6c5";
+          sha256 = "04wm3i65fpzln7sdcny88hfjfm0n7wy44ffsr3697x4l95d0bnyh";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/ca96ed0b5d6f8aea4de56ddeaa003b9c81d96219/recipes/company-erlang";
@ -6561,12 +6603,12 @@
    dix = callPackage ({ cl-lib ? null, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "dix";
-        version = "0.3.4";
+        version = "0.3.5";
        src = fetchFromGitHub {
          owner = "unhammer";
          repo = "dix";
-          rev = "f9dd686922cf89dc7859c793be84969a2529a14b";
-          sha256 = "02cayawahsa59mkr0f4rhsm9lnpyv8qpx59w3040xmhf8dx95378";
+          rev = "86880826a0cc878e2e5d50bc835eed5c8e2f001a";
+          sha256 = "00qyzpqdw4im7c4bqqpiayv4kr9iqlm6mhsziazjvrjsvvi0p9ij";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/149eeba213b82aa0bcda1073aaf1aa02c2593f91/recipes/dix";
@ -6582,12 +6624,12 @@
    dix-evil = callPackage ({ dix, evil, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "dix-evil";
-        version = "0.3.4";
+        version = "0.3.5";
        src = fetchFromGitHub {
          owner = "unhammer";
          repo = "dix";
-          rev = "f9dd686922cf89dc7859c793be84969a2529a14b";
-          sha256 = "02cayawahsa59mkr0f4rhsm9lnpyv8qpx59w3040xmhf8dx95378";
+          rev = "86880826a0cc878e2e5d50bc835eed5c8e2f001a";
+          sha256 = "00qyzpqdw4im7c4bqqpiayv4kr9iqlm6mhsziazjvrjsvvi0p9ij";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/d9dcceb57231bf2082154cab394064a59d84d3a5/recipes/dix-evil";
@ -6908,8 +6950,8 @@
        version = "0.7";
        src = fetchhg {
          url = "https://bitbucket.com/harsman/dyalog-mode";
-          rev = "4004050a9771";
-          sha256 = "0p7g7sfkdr473gpj2xdgg5fb5d336w2ddvx44i1d6575p6rcs5w6";
+          rev = "9ae0c786e1e7";
+          sha256 = "1a498jkj15vhf2x4an6raghjf9fszrkw0zl617m8pibcn3yrnv62";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/5b7972602399f9df9139cff177e38653bb0f43ed/recipes/dyalog-mode";
@ -7198,12 +7240,12 @@
    ebib = callPackage ({ dash, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild, parsebib, seq }:
    melpaBuild {
        pname = "ebib";
-        version = "2.10";
+        version = "2.10.1";
        src = fetchFromGitHub {
          owner = "joostkremers";
          repo = "ebib";
-          rev = "4c2581ad17a636909e7ed0f46bd813cd6d9c45d3";
-          sha256 = "1ic55fml4ll7pvakcf32ahps4za8mf4q10jgdyi8xj5bccvi3n3r";
+          rev = "d415b91c91581ff39364384fec35c219cb89d43a";
+          sha256 = "13283ymm4av2gk7zj2rsppg6sk0lixy9g4lic4arrm8b5yb0vcsd";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/4e39cd8e8b4f61c04fa967def6a653bb22f45f5b/recipes/ebib";
@ -7532,12 +7574,12 @@
    ein = callPackage ({ cl-generic, fetchFromGitHub, fetchurl, lib, melpaBuild, request, websocket }:
    melpaBuild {
        pname = "ein";
-        version = "0.12.0";
+        version = "0.12.1";
        src = fetchFromGitHub {
          owner = "millejoh";
          repo = "emacs-ipython-notebook";
-          rev = "8e3764044c9bd44fbdab4e870c2fc9a36ce02449";
-          sha256 = "0f5k9bx632xjwj3l03vs0k48xvxq4nbi71039fcjqs0bchg814nj";
+          rev = "b52ccbd46dee2a1ece1dd6bd9be1224c323262ca";
+          sha256 = "1qdznl8z0s2hy3hhls9ccr516wai11qh663630hc0zwv4gwlwp64";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/215e163755fe391ce1f049622e7b9bf9a8aea95a/recipes/ein";
@ -7676,6 +7718,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    el-patch = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    melpaBuild {
+        pname = "el-patch";
+        version = "1.0";
+        src = fetchFromGitHub {
+          owner = "raxod502";
+          repo = "el-patch";
+          rev = "4775dfb0957605308985ce2d2cf73550704137ae";
+          sha256 = "0xdb3l9184lmsabq9ajm7xj47pcg1rn743f24j7vp8r93ac21x5x";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/2f4f57e0edbae35597aa4a7744d22d2f971d5de5/recipes/el-patch";
+          sha256 = "1imijmsni8c8fxjrzprnanf94c1pma3h5w9p75c4y99l8l3xmj7g";
+          name = "el-patch";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://melpa.org/#/el-patch";
+          license = lib.licenses.free;
+        };
+      }) {};
    el-spice = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild, thingatpt-plus }:
    melpaBuild {
        pname = "el-spice";
@ -9481,26 +9544,6 @@
          license = lib.licenses.free;
        };
      }) {};
-    evil = callPackage ({ fetchhg, fetchurl, goto-chg, lib, melpaBuild, undo-tree }:
-    melpaBuild {
-        pname = "evil";
-        version = "1.2.12";
-        src = fetchhg {
-          url = "https://bitbucket.com/lyro/evil";
-          rev = "f2648b841f9b";
-          sha256 = "0gv8b6adaypw3d2brx0lh41yyi3kdf1klahx7kap36a7m652nan6";
-        };
-        recipeFile = fetchurl {
-          url = "https://raw.githubusercontent.com/milkypostman/melpa/5b7972602399f9df9139cff177e38653bb0f43ed/recipes/evil";
-          sha256 = "09qrhy7l229w0qk3ba1i2xg4vqz8525v8scrbm031lqp30jp54hc";
-          name = "evil";
-        };
-        packageRequires = [ goto-chg undo-tree ];
-        meta = {
-          homepage = "https://melpa.org/#/evil";
-          license = lib.licenses.free;
-        };
-      }) {};
    evil-anzu = callPackage ({ anzu, evil, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "evil-anzu";
@ -9984,6 +10027,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    evil-surround = callPackage ({ evil, fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    melpaBuild {
+        pname = "evil-surround";
+        version = "1.0.0";
+        src = fetchFromGitHub {
+          owner = "timcharper";
+          repo = "evil-surround";
+          rev = "7a0358ce3eb9ed01744170fa8a1e12d98f8b8839";
+          sha256 = "1smv7sqhm1l2bi9fmispnlmjssidblwkmiiycj1n3ag54q27z031";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/da8b46729f3bd9aa74c4f0ee2a9dc60804aa661c/recipes/evil-surround";
+          sha256 = "1bcjxw0yrk2bqj5ihl5r2c4id0m9wbnj7fpd0wwmw9444xvwp8ag";
+          name = "evil-surround";
+        };
+        packageRequires = [ evil ];
+        meta = {
+          homepage = "https://melpa.org/#/evil-surround";
+          license = lib.licenses.free;
+        };
+      }) {};
    evil-text-object-python = callPackage ({ emacs, evil, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "evil-text-object-python";
@ -10236,6 +10300,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    eziam-theme = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    melpaBuild {
+        pname = "eziam-theme";
+        version = "0.1.1";
+        src = fetchFromGitHub {
+          owner = "thblt";
+          repo = "eziam-theme-emacs";
+          rev = "794ff00f27c31c7b43b7dc62da6295cd9db36ad4";
+          sha256 = "0j94k3bhynhrigk127b40ljqcdqsqa5gix5ds3b0hb38wfcq8byk";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/4e0411583bd4fdbe425eb07de98851136fa1eeb0/recipes/eziam-theme";
+          sha256 = "0iz3r4r54ai8y4qhnix291ra7qfmk8dbr06f52pgmz3gzin1cqpb";
+          name = "eziam-theme";
+        };
+        packageRequires = [];
+        meta = {
+          homepage = "https://melpa.org/#/eziam-theme";
+          license = lib.licenses.free;
+        };
+      }) {};
    f = callPackage ({ dash, fetchFromGitHub, fetchurl, lib, melpaBuild, s }:
    melpaBuild {
        pname = "f";
@ -11020,6 +11105,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    flycheck-kotlin = callPackage ({ fetchFromGitHub, fetchurl, flycheck, lib, melpaBuild }:
+    melpaBuild {
+        pname = "flycheck-kotlin";
+        version = "0.3";
+        src = fetchFromGitHub {
+          owner = "whirm";
+          repo = "flycheck-kotlin";
+          rev = "cbb9fbf70dbe8efcc3971b3606ee95c97469b1fe";
+          sha256 = "0bxjx7xcpscv6vv4yxll8hh43aabv2dnrvkymb47jm3yvjr9cs1c";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/f158727cc8892aadba0a613dd08e65e2fc791b48/recipes/flycheck-kotlin";
+          sha256 = "0vh4f3ap1ciddf2fvfnjz668d6spyx49xs2wfp1hrzxn5yqpnra5";
+          name = "flycheck-kotlin";
+        };
+        packageRequires = [ flycheck ];
+        meta = {
+          homepage = "https://melpa.org/#/flycheck-kotlin";
+          license = lib.licenses.free;
+        };
+      }) {};
    flycheck-ledger = callPackage ({ fetchFromGitHub, fetchurl, flycheck, lib, melpaBuild }:
    melpaBuild {
        pname = "flycheck-ledger";
@ -12247,12 +12353,12 @@
    fxrd-mode = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild, s }:
    melpaBuild {
        pname = "fxrd-mode";
-        version = "0.6";
+        version = "0.7";
        src = fetchFromGitHub {
          owner = "msherry";
          repo = "fxrd-mode";
-          rev = "eac0b26a2c16197f6b03f7301e6e7858aca9f91e";
-          sha256 = "0vfh4azibv71mj86bgl4rfbm96pw9l95r87mwhzx42j36rxffl73";
+          rev = "f53240c92f80760fbfb2e0dcf2e68064145cec33";
+          sha256 = "0yx4p081960zwgjlw9yiq4jkc7czfvwbsc8z20pg394lx9nkrgr5";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/796eb6b2126ec616c0de6af6abb7598900557c12/recipes/fxrd-mode";
@ -12622,6 +12728,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    git-annex = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    melpaBuild {
+        pname = "git-annex";
+        version = "1.1";
+        src = fetchFromGitHub {
+          owner = "jwiegley";
+          repo = "git-annex-el";
+          rev = "7d41775a1709b5754a7779e9f64f15d336ea5c8c";
+          sha256 = "0fm62lm29wp1ljgyi6pqqkzwzps53cjjbj5j3y0c2013ry7va6c5";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/9c91e16bb9e92db9dc9be6a7af3944c3290d2f14/recipes/git-annex";
+          sha256 = "0194y24vq1w6m2cjgqgx9dqp99cq8y9licyry2zxa5brbrsxi94l";
+          name = "git-annex";
+        };
+        packageRequires = [];
+        meta = {
+          homepage = "https://melpa.org/#/git-annex";
+          license = lib.licenses.free;
+        };
+      }) {};
    git-auto-commit-mode = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "git-auto-commit-mode";
@ -12898,12 +13025,12 @@
    gitattributes-mode = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "gitattributes-mode";
-        version = "1.2.2";
+        version = "1.2.4";
        src = fetchFromGitHub {
          owner = "magit";
          repo = "git-modes";
-          rev = "7ccc5de55fc370c328d7ec08de559e351b1ac94c";
-          sha256 = "0ksqfr0l415ynhxpqpcb84bk2bapvczwnpikp45kmfqq91p61xfc";
+          rev = "af4ff3222f38daa0d352afdf3d20741b4fab2e79";
+          sha256 = "0nn5mj29airjacckzxkh4q12wnk2pq6mp1wlzxzxdwijmkk52dbr";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/4b4e2ddd2a80875afc0fc654052e6cbff2f3777f/recipes/gitattributes-mode";
@ -12940,12 +13067,12 @@
    gitconfig-mode = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "gitconfig-mode";
-        version = "1.2.2";
+        version = "1.2.4";
        src = fetchFromGitHub {
          owner = "magit";
          repo = "git-modes";
-          rev = "7ccc5de55fc370c328d7ec08de559e351b1ac94c";
-          sha256 = "0ksqfr0l415ynhxpqpcb84bk2bapvczwnpikp45kmfqq91p61xfc";
+          rev = "af4ff3222f38daa0d352afdf3d20741b4fab2e79";
+          sha256 = "0nn5mj29airjacckzxkh4q12wnk2pq6mp1wlzxzxdwijmkk52dbr";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/44a37f59b87f59a587f6681e7aadfabf137c98d7/recipes/gitconfig-mode";
@ -13045,12 +13172,12 @@
    gitignore-mode = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "gitignore-mode";
-        version = "1.2.2";
+        version = "1.2.4";
        src = fetchFromGitHub {
          owner = "magit";
          repo = "git-modes";
-          rev = "7ccc5de55fc370c328d7ec08de559e351b1ac94c";
-          sha256 = "0ksqfr0l415ynhxpqpcb84bk2bapvczwnpikp45kmfqq91p61xfc";
+          rev = "af4ff3222f38daa0d352afdf3d20741b4fab2e79";
+          sha256 = "0nn5mj29airjacckzxkh4q12wnk2pq6mp1wlzxzxdwijmkk52dbr";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/44a37f59b87f59a587f6681e7aadfabf137c98d7/recipes/gitignore-mode";
@ -14544,12 +14671,12 @@
    helm = callPackage ({ async, emacs, fetchFromGitHub, fetchurl, helm-core, lib, melpaBuild, popup }:
    melpaBuild {
        pname = "helm";
-        version = "2.4.0";
+        version = "2.5.0";
        src = fetchFromGitHub {
          owner = "emacs-helm";
          repo = "helm";
-          rev = "a1bc339cbdaad200cb947e1e6264e9013322b434";
-          sha256 = "1pjp629xwya55ld6hkys4gmgn0mvnd7qzpzz1qraaympsnymrh3w";
+          rev = "bbdf2c18edc75478e2c7e8ee39b5c30dbb7bf42e";
+          sha256 = "1qqyrqhsy7xacckg5faj45pvs0vpg242sp2073i5grvgb3l9lvqj";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/7e8bccffdf69479892d76b9336a4bec3f35e919d/recipes/helm";
@ -14751,6 +14878,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    helm-cider = callPackage ({ cider, emacs, fetchFromGitHub, fetchurl, helm-core, lib, melpaBuild, seq }:
+    melpaBuild {
+        pname = "helm-cider";
+        version = "0.3.0";
+        src = fetchFromGitHub {
+          owner = "clojure-emacs";
+          repo = "helm-cider";
+          rev = "a24ef274e382c1a158a76eae2570f1f007031cb8";
+          sha256 = "062abfb4sfpcc6fx3nrf3j0bisglrhyrg7rxwhhcqm9jhalksmdl";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/31d3cd618f2ac88860d0b11335ff81b6e2973982/recipes/helm-cider";
+          sha256 = "1fvpq1xi3xhd8w1yasac87incv1w4av5a8vn0birw8pc7a6bxv4w";
+          name = "helm-cider";
+        };
+        packageRequires = [ cider emacs helm-core seq ];
+        meta = {
+          homepage = "https://melpa.org/#/helm-cider";
+          license = lib.licenses.free;
+        };
+      }) {};
    helm-circe = callPackage ({ circe, cl-lib ? null, emacs, fetchFromGitHub, fetchurl, helm, lib, melpaBuild }:
    melpaBuild {
        pname = "helm-circe";
@ -14796,12 +14944,12 @@
    helm-core = callPackage ({ async, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "helm-core";
-        version = "2.4.0";
+        version = "2.5.0";
        src = fetchFromGitHub {
          owner = "emacs-helm";
          repo = "helm";
-          rev = "a1bc339cbdaad200cb947e1e6264e9013322b434";
-          sha256 = "1pjp629xwya55ld6hkys4gmgn0mvnd7qzpzz1qraaympsnymrh3w";
+          rev = "bbdf2c18edc75478e2c7e8ee39b5c30dbb7bf42e";
+          sha256 = "1qqyrqhsy7xacckg5faj45pvs0vpg242sp2073i5grvgb3l9lvqj";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/ef7a700c5665e6d72cb4cecf7fb5a2dd43ef9bf7/recipes/helm-core";
@ -17672,12 +17820,12 @@
    ivy-erlang-complete = callPackage ({ async, counsel, emacs, erlang, fetchFromGitHub, fetchurl, ivy, lib, melpaBuild }:
    melpaBuild {
        pname = "ivy-erlang-complete";
-        version = "0.1.2";
+        version = "0.1.3";
        src = fetchFromGitHub {
          owner = "s-kostyaev";
          repo = "ivy-erlang-complete";
-          rev = "65d80ff0052be9aa65e9a1cd8f6b1f5fb112ee36";
-          sha256 = "05qjpv95xrhwpg1g0znsp33a8827w4p7vl6iflrrmi15kij5imb4";
+          rev = "914dfbeb2d9ccaed2e830637ecc814ac1da2f82f";
+          sha256 = "0a5fmqkasy87vq9x95qavqszmb9jalsi8ihgxx120rbrzfib28ys";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/ac1b9e350d3f066e4e56202ebb443134d5fc3669/recipes/ivy-erlang-complete";
@ -18531,12 +18679,12 @@
    keychain-environment = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "keychain-environment";
-        version = "2.3.0";
+        version = "2.4.0";
        src = fetchFromGitHub {
          owner = "tarsius";
          repo = "keychain-environment";
-          rev = "1ca091f72ad1d1a7620552289ae43484d853e968";
-          sha256 = "0xgm80dbg45bs3k8psd3pv49z1xbvzm156xs55gmxdzbgxbzpazr";
+          rev = "7c08e8c4c3ea4d6eaee12d710a56793771f837c5";
+          sha256 = "1mnqa69f584qzb62nn01bb4nz08gi7ra8b6xr0x7aphfqzk86kzy";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/4382c9e7e8dee2cafea9ee49965d0952ca359dd5/recipes/keychain-environment";
@ -19681,14 +19829,14 @@
        pname = "magit-filenotify";
        version = "0.1";
        src = fetchFromGitHub {
-          owner = "magit";
+          owner = "emacsorphanage";
          repo = "magit-filenotify";
          rev = "575c4321f61fb8f25e4779f9ffd4514ac086ae96";
          sha256 = "1vn6x53kpwv3zf2b5xjswyz6v853r8b9dg88qhwd2h480hrx6kal";
        };
        recipeFile = fetchurl {
-          url = "https://raw.githubusercontent.com/milkypostman/melpa/c6c87a11492f6b6e5159a2a3dc1fe7d9efcc0cde/recipes/magit-filenotify";
-          sha256 = "00a77czdi24n3zkx6jwaj2asablzpxq16iqd8s84kkqxcfiiahn7";
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/41aeebef8ed914fb378fef13ba47572accee332c/recipes/magit-filenotify";
+          sha256 = "0bbw6ay3csbc5zc6wa9p9nxpbxl3k35xz9jwqlw8mgz2b1xq083d";
          name = "magit-filenotify";
        };
        packageRequires = [ emacs magit ];
@ -19847,12 +19995,12 @@
    magit-svn = callPackage ({ emacs, fetchFromGitHub, fetchurl, lib, magit, melpaBuild }:
    melpaBuild {
        pname = "magit-svn";
-        version = "2.1.2";
+        version = "2.2.0";
        src = fetchFromGitHub {
          owner = "magit";
          repo = "magit-svn";
-          rev = "63a47732cc112d24db26052ffad93895319b60cf";
-          sha256 = "1g2isa8n2j8kk0c5iwx8qai8k14sazwkc3dwhcpchm3zs0bfpdm3";
+          rev = "d9e61effc55480694014e5422e8f74f0f17a757a";
+          sha256 = "128ra3habdqk1rsnmy87m0aw2pqi033dqmmjmgsmfblnfvi987p9";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/cec5af50ae7634cc566adfbfdf0f95c3e2951c0c/recipes/magit-svn";
@ -20393,12 +20541,12 @@
    meghanada = callPackage ({ cl-lib ? null, company, emacs, fetchFromGitHub, fetchurl, flycheck, lib, melpaBuild, yasnippet }:
    melpaBuild {
        pname = "meghanada";
-        version = "0.2.4";
+        version = "0.4.0";
        src = fetchFromGitHub {
          owner = "mopemope";
          repo = "meghanada-emacs";
-          rev = "86820f22cd1ebf4c2f8cae5b64bc8ff3964ea221";
-          sha256 = "0nn6p5r760hb3ffrv4lb3ny75np6ps0gscp1a20sdsfrz6fbv6dg";
+          rev = "04112dc5db30a98d2ec1dae41d8c6ed1c7aff0be";
+          sha256 = "0f14b1h6zv0v8hn99bqmidndh36mrsckmcirrrffm591ksf4l0zd";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/4c75c69b2f00be9a93144f632738272c1e375785/recipes/meghanada";
@ -21618,8 +21766,8 @@
          sha256 = "1m3llm87qgd7sr6ci22nd835vdg0qprs5m9lqcx74k689jl89cni";
        };
        recipeFile = fetchurl {
-          url = "https://raw.githubusercontent.com/milkypostman/melpa/00cc4705650157621bb0135cc512d57178496100/recipes/ncl-mode";
-          sha256 = "0hmd606xgapzbc79px9l1q6pphrhdzip495yprvg20xsdpmjlfw9";
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/2eea3936b8a3a7546450d1d7399e0f86d855fefd/recipes/ncl-mode";
+          sha256 = "1niy0w24q6q6j7s0l9fcaqai7zz2gg1qlk2s9sxb8j79jc41y47k";
          name = "ncl-mode";
        };
        packageRequires = [ emacs ];
@ -21820,12 +21968,12 @@
    no-littering = callPackage ({ cl-lib ? null, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "no-littering";
-        version = "0.5.2";
+        version = "0.5.3";
        src = fetchFromGitHub {
          owner = "tarsius";
          repo = "no-littering";
-          rev = "e7d3ebbd12f176707e63766a7a19bcaa08e01331";
-          sha256 = "0y8wvagn4yf7fwvwzqcrx46wigmvyl25fa94kzvkanjl04zid3i1";
+          rev = "e161c328d248f861bb56991492182f20e60b6b41";
+          sha256 = "0ka7gbiarhc1r8rynxq2vf0k5p4044bm1jc92ca1hav34mqfg2xp";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/cf5d2152c91b7c5c38181b551db3287981657ce3/recipes/no-littering";
@ -22620,6 +22768,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    org-alert = callPackage ({ alert, dash, fetchFromGitHub, fetchurl, lib, melpaBuild, s }:
+    melpaBuild {
+        pname = "org-alert";
+        version = "0.1.0";
+        src = fetchFromGitHub {
+          owner = "groksteve";
+          repo = "org-alert";
+          rev = "685c18aa5ce994360c7f9e8bbf49590c412187ac";
+          sha256 = "0gkv2sfl9nb64qqh5xhgq68r9kfmsny3vpcmnzk2mqjcb9nh657s";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/2976b7f9271bc46679a5774ff5f388b81a9f0cf8/recipes/org-alert";
+          sha256 = "0n5a24iv8cj395xr0gfgi0hs237dd98zm2fws05k47vy3ygni152";
+          name = "org-alert";
+        };
+        packageRequires = [ alert dash s ];
+        meta = {
+          homepage = "https://melpa.org/#/org-alert";
+          license = lib.licenses.free;
+        };
+      }) {};
    org-autolist = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "org-autolist";
@ -22709,14 +22878,14 @@
        pname = "org-bullets";
        version = "0.2.4";
        src = fetchFromGitHub {
-          owner = "sabof";
+          owner = "emacsorphanage";
          repo = "org-bullets";
          rev = "b70ac2ec805bcb626a6e39ea696354577c681b36";
          sha256 = "10nr4sjffnqbllv6gmak6pviyynrb7pi5nvrq331h5alm3xcpq0w";
        };
        recipeFile = fetchurl {
-          url = "https://raw.githubusercontent.com/milkypostman/melpa/3ab2169c45aae7fb3373bf5df087d9b626167ce8/recipes/org-bullets";
-          sha256 = "1kxhlabaqi1g6pz215afp65d9cp324s8mvabjh7q1h7ari32an75";
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/fe60fc3c60d87b5fd7aa24e858c79753d5f7d2f6/recipes/org-bullets";
+          sha256 = "0yrfgd6r71rng3qipp3y9i5mpm6510k4xsfgyidcn25v27fysk3v";
          name = "org-bullets";
        };
        packageRequires = [];
@ -23562,12 +23731,12 @@
    orgit = callPackage ({ dash, emacs, fetchFromGitHub, fetchurl, lib, magit, melpaBuild, org }:
    melpaBuild {
        pname = "orgit";
-        version = "1.2.0";
+        version = "1.3.0";
        src = fetchFromGitHub {
          owner = "magit";
          repo = "orgit";
-          rev = "adcfef22dc9bfa6503513d0a937bf4b32ad7ab94";
-          sha256 = "0f3lqw2b9xr0278s7502sa2hkyhml45j8jpssaicyliz2k1kiyzv";
+          rev = "cbce5871fe267fef725631b0b7365952c35ae401";
+          sha256 = "00iwp3bajr9hxs55rj3ka5bymhp5icsq8m44z514sb8h54fwapb7";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/73b5f7c44c90540e4cbdc003d9881f0ac22cc7bc/recipes/orgit";
@ -25865,12 +26034,12 @@
    protobuf-mode = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "protobuf-mode";
-        version = "3.1.0";
+        version = "3.2.0pre2";
        src = fetchFromGitHub {
          owner = "google";
          repo = "protobuf";
-          rev = "a428e42072765993ff674fda72863c9f1aa2d268";
-          sha256 = "0qlvpsmqgh9nw0k4zrxlxf75pafi3p0ahz99v6761b903y8qyv4i";
+          rev = "6eeb5c7d0fc84c9c5d562ae54b3bdc088ec62129";
+          sha256 = "15mb2ybam1pnyig60zlspw0cn9wl5iwywp35fx67qvg9nadln11d";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/b4e7f5f641251e17add561991d3bcf1fde23467b/recipes/protobuf-mode";
@ -26369,12 +26538,12 @@
    quasi-monochrome-theme = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "quasi-monochrome-theme";
-        version = "1.0";
+        version = "1.1";
        src = fetchFromGitHub {
          owner = "lbolla";
          repo = "emacs-quasi-monochrome";
-          rev = "e329a8d55b22151e29df1f81552a4361f85aeafa";
-          sha256 = "0lfmdlb626b3gbmlvacwn84vpqam6gk9lp29wk0hcraw69vaw1v8";
+          rev = "7d3afe41c2696ee25e3e4bcce987af1f589208d6";
+          sha256 = "0bn1yzxzj6r1k3xcp45l04flq4avzlh0sbjfyiw4nglfhliyvwcf";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/a9c8498e4bcca19c4c24b2fd0db035c3da477e2a/recipes/quasi-monochrome-theme";
@ -26453,12 +26622,12 @@
    railscasts-reloaded-theme = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "railscasts-reloaded-theme";
-        version = "1.2.0";
+        version = "1.3.0";
        src = fetchFromGitHub {
          owner = "thegeorgeous";
          repo = "railscasts-reloaded-theme";
-          rev = "cce0e4ae6527e84e2ae3deb8b3c7770dda225853";
-          sha256 = "1li86qpbjg8sm9q4sl8cffc0fni6mwx8180x8zlmsxdnhqic5nvd";
+          rev = "de3fea4fdd32db6cbea124dfeb2fa4f213d79063";
+          sha256 = "1kl3wn35pcyslggy5wxm81bjjsj3smzjsf54iy4y844iyf4mgp5j";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/9817851bd06cbae30fb8f429401f1bbc0dc7be09/recipes/railscasts-reloaded-theme";
@ -27248,6 +27417,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    rg = callPackage ({ cl-lib ? null, fetchFromGitHub, fetchurl, lib, melpaBuild, s }:
+    melpaBuild {
+        pname = "rg";
+        version = "1.0.0";
+        src = fetchFromGitHub {
+          owner = "dajva";
+          repo = "rg.el";
+          rev = "f1af862ba50b344d2f039f18fe83e32b6f0829a9";
+          sha256 = "18i5rspwx48xik8yaw0znsfqarwab7nra6wiiznjkpzm0cgh4av1";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/9ce1f721867383a841957370946f283f996fa76f/recipes/rg";
+          sha256 = "0i78qvqdznh1z3b0mnzihv07j8b9r86dc1lsa1qlzacv6a2i9sbm";
+          name = "rg";
+        };
+        packageRequires = [ cl-lib s ];
+        meta = {
+          homepage = "https://melpa.org/#/rg";
+          license = lib.licenses.free;
+        };
+      }) {};
    rich-minority = callPackage ({ cl-lib ? null, fetchFromGitHub, fetchurl, lib, melpaBuild }:
    melpaBuild {
        pname = "rich-minority";
@ -27885,8 +28075,8 @@
        src = fetchFromGitHub {
          owner = "ensime";
          repo = "emacs-scala-mode";
-          rev = "9b8db623b13fcb0aad9271d1fae73e1257dda13c";
-          sha256 = "0q41dqlhp0cds16inmh7jrvhqrnjsdiv2in6pq3f0srhwms81ff3";
+          rev = "7e6300231143133252e6ed1f3d5c86ea4e625e33";
+          sha256 = "081bw6gkrww7bqi7pwj4sifmqscr5sbpl3zl1rw86npv5fpyjq9j";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/564aa1637485192a97803af46b3a1f8e0d042c9a/recipes/scala-mode";
@ -31001,22 +31191,22 @@
          license = lib.licenses.free;
        };
      }) {};
-    tide = callPackage ({ cl-lib ? null, dash, emacs, fetchFromGitHub, fetchurl, flycheck, lib, melpaBuild, typescript-mode }:
+    tide = callPackage ({ cl-lib ? null, dash, fetchFromGitHub, fetchurl, flycheck, lib, melpaBuild, typescript-mode }:
    melpaBuild {
        pname = "tide";
-        version = "2.0.2";
+        version = "2.1.5";
        src = fetchFromGitHub {
          owner = "ananthakumaran";
          repo = "tide";
-          rev = "170bce9067a6467f190418284377559a9f43c667";
-          sha256 = "0b23d9bi1i00v9ffrdi5ag0q2i149ai1p88klpgl2j9kvdif0zmg";
+          rev = "bd89d93d9803319ba86eff0173821deb978ae2ac";
+          sha256 = "1a736r1igq66hn6ig4l7c5xaxcyk2kxvj26laphakk1xg8j5x52k";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/a21e063011ebbb03ac70bdcf0a379f9e383bdfab/recipes/tide";
          sha256 = "1z2xr25s23sz6nrzzw2xg1l2j8jvjhxi53qh7nvxmmq6n6jjpwg1";
          name = "tide";
        };
-        packageRequires = [ cl-lib dash emacs flycheck typescript-mode ];
+        packageRequires = [ cl-lib dash flycheck typescript-mode ];
        meta = {
          homepage = "https://melpa.org/#/tide";
          license = lib.licenses.free;
@ -32895,6 +33085,27 @@
          license = lib.licenses.free;
        };
      }) {};
+    wolfram = callPackage ({ fetchFromGitHub, fetchurl, lib, melpaBuild }:
+    melpaBuild {
+        pname = "wolfram";
+        version = "1.1.1";
+        src = fetchFromGitHub {
+          owner = "hsjunnesson";
+          repo = "wolfram.el";
+          rev = "6b5dceae3fd6cdb4d7562510deeafa02c93c010b";
+          sha256 = "1ijyjw2793i7n00i30ma8lw4fzi9w63m6k0xgjx6j78r5y7pfj2g";
+        };
+        recipeFile = fetchurl {
+          url = "https://raw.githubusercontent.com/milkypostman/melpa/785b5b1ec73e6376f2f2bb405707a1078398fa3a/recipes/wolfram";
+          sha256 = "02xp1916v9rydh0586jkx71v256qdg63f87s3m0agc2znnrni9h4";
+          name = "wolfram";
+        };
+        packageRequires = [];
+        meta = {
+          homepage = "https://melpa.org/#/wolfram";
+          license = lib.licenses.free;
+        };
+      }) {};
    wonderland = callPackage ({ dash, dash-functional, emacs, fetchFromGitHub, fetchurl, lib, melpaBuild, multi }:
    melpaBuild {
        pname = "wonderland";
@ -33446,8 +33657,8 @@
        version = "1.78";
        src = fetchhg {
          url = "https://www.yatex.org/hgrepos/yatex/";
-          rev = "c2c547e147c7";
-          sha256 = "1khsvzg7ma98ijpj21xmdlnp18wwxf2n9jr2y1xia4a6qgkmlchb";
+          rev = "8871fe9f563b";
+          sha256 = "0bfhf0fhx8znq7xsqwms3n178qpxds93wcznj26k3ypqgwkkcx5x";
        };
        recipeFile = fetchurl {
          url = "https://raw.githubusercontent.com/milkypostman/melpa/04867a574773e8794335a2664d4f5e8b243f3ec9/recipes/yatex";
--- a/pkgs/applications/editors/emacs-modes/org-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/org-generated.nix
@ -1,10 +1,10 @@
 { callPackage }: {
    org = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
        pname = "org";
-        version = "20161224";
+        version = "20170124";
        src = fetchurl {
-          url = "http://orgmode.org/elpa/org-20161224.tar";
-          sha256 = "15fnc65k5mn5ssl53z4f9nlkz5m8a59zkaripcapdcq87ys5imqm";
+          url = "http://orgmode.org/elpa/org-20170124.tar";
+          sha256 = "0zlqb31fkwv74wszfz914agnprnh6jlr60v9dw62y9jyivaxg99k";
        };
        packageRequires = [];
        meta = {
@ -14,10 +14,10 @@
      }) {};
    org-plus-contrib = callPackage ({ elpaBuild, fetchurl, lib }: elpaBuild {
        pname = "org-plus-contrib";
-        version = "20161224";
+        version = "20170124";
        src = fetchurl {
-          url = "http://orgmode.org/elpa/org-plus-contrib-20161224.tar";
-          sha256 = "1pj3h5qllhcqyqvm2kln7056m34k5flipvslnn1rvsk4iwwjlv1a";
+          url = "http://orgmode.org/elpa/org-plus-contrib-20170124.tar";
+          sha256 = "1vgiw9xbh7zcr7gywb021h46idm0k69ifgkmwb9f9wb4snar4yq8";
        };
        packageRequires = [];
        meta = {
--- a/pkgs/applications/editors/idea/default.nix
+++ b/pkgs/applications/editors/idea/default.nix
@ -136,12 +136,12 @@ in
 {
  clion = buildClion rec {
    name = "clion-${version}";
-    version = "2016.3";
+    version = "2016.3.2";
    description  = "C/C++ IDE. New. Intelligent. Cross-platform";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/cpp/CLion-${version}.tar.gz";
-      sha256 = "16nszamr0bxg8aghyrg4wzxbp9158kjzhr957ljpbipz0rlixf31";
+      sha256 = "0ygnj3yszgd1si1qgx7m4n7smm583l5pww8xhx8n86mvz7ywdhbn";
    };
    wmClass = "jetbrains-clion";
  };
@ -172,12 +172,12 @@ in

  idea-community = buildIdea rec {
    name = "idea-community-${version}";
-    version = "2016.3.2";
+    version = "2016.3.3";
    description = "Integrated Development Environment (IDE) by Jetbrains, community edition";
    license = stdenv.lib.licenses.asl20;
    src = fetchurl {
      url = "https://download.jetbrains.com/idea/ideaIC-${version}.tar.gz";
-      sha256 = "0ngign34gq7i121ss2s9wfziy3vkv1jb79pw8nf1qp7rb15xn4vc";
+      sha256 = "1v9rzfj84fyz3m3b6bh45jns8wcil9n8f8mfha0x8m8534r6w368";
    };
    wmClass = "jetbrains-idea-ce";
  };
@ -208,24 +208,24 @@ in

  idea-ultimate = buildIdea rec {
    name = "idea-ultimate-${version}";
-    version = "2016.3.2";
+    version = "2016.3.3";
    description = "Integrated Development Environment (IDE) by Jetbrains, requires paid license";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/idea/ideaIU-${version}.tar.gz";
-      sha256 = "13pd95zad29c3i9qpwhjii601ixb4dgcld0kxk3liq4zmnv6wqxa";
+      sha256 = "1bwy86rm0mifizmhkm9wxwc4nrrizk2zp4zl5ycxh6zdiad1r1wm";
    };
    wmClass = "jetbrains-idea";
  };

  ruby-mine = buildRubyMine rec {
    name = "ruby-mine-${version}";
-    version = "2016.2.5";
+    version = "2016.3.1";
    description = "The Most Intelligent Ruby and Rails IDE";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/ruby/RubyMine-${version}.tar.gz";
-      sha256 = "1rncnm5dvhpfb7l5p2k0hs4yqzp8n1c4rvz9vldlf5k7mvwggp7p";
+      sha256 = "10d1ba6qpizhz4d7fz0ya565pdvkgcmsdgs7b8dv98s9hxfjsldy";
    };
    wmClass = "jetbrains-rubymine";
  };
@ -256,36 +256,36 @@ in

  pycharm-community = buildPycharm rec {
    name = "pycharm-community-${version}";
-    version = "2016.3";
+    version = "2016.3.2";
    description = "PyCharm Community Edition";
    license = stdenv.lib.licenses.asl20;
    src = fetchurl {
      url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "1pi822ihzy58jszdy7y2pyni6pki9ih8s9xdbwlbwg9vck1iqprs";
+      sha256 = "0fag5ng9n953mnf3gmxpac1icnb1qz6dybhqwjbr13qij8v2s2g1";
    };
    wmClass = "jetbrains-pycharm-ce";
  };

  pycharm-professional = buildPycharm rec {
    name = "pycharm-professional-${version}";
-    version = "2016.3";
+    version = "2016.3.2";
    description = "PyCharm Professional Edition";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "1b4ib77wzg0y12si8zqrfwbhv4kvmy9nm5dsrdr3k7f89dqg3279";
+      sha256 = "1nylq0fyvix68l4dp9852dak58dbiamjphx2hin087cadaji6r63";
    };
    wmClass = "jetbrains-pycharm";
  };

  phpstorm = buildPhpStorm rec {
    name = "phpstorm-${version}";
-    version = "2016.3";
+    version = "2016.3.2";
    description = "Professional IDE for Web and PHP developers";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/webide/PhpStorm-${version}.tar.gz";
-      sha256 = "0hzjhwij2x3b5fqwyd69h24ld13bpc2bf9wdcd1jy758waf0d91y";
+      sha256 = "05ylhpn1mijjphcmv6ay3123xp72yypw19430dgr8101zpsnifa5";
    };
    wmClass = "jetbrains-phpstorm";
  };
@ -304,12 +304,12 @@ in

  webstorm = buildWebStorm rec {
    name = "webstorm-${version}";
-    version = "2016.3.1";
+    version = "2016.3.2";
    description = "Professional IDE for Web and JavaScript development";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/webstorm/WebStorm-${version}.tar.gz";
-      sha256 = "10za4d6w9yns7kclbviizslq2y7zas9rkmvs3xwrfw1rdw2b69af";
+      sha256 = "1h3kjvd10j48n9ch2ldqjsizq5n8gkm0vrrvznayc1bz2kjvhavn";
    };
    wmClass = "jetbrains-webstorm";
  };
--- a/pkgs/applications/gis/qgis/default.nix
+++ b/pkgs/applications/gis/qgis/default.nix
@ -5,7 +5,7 @@
 }:

 stdenv.mkDerivation rec {
-  name = "qgis-2.16.2";
+  name = "qgis-2.18.3";

  buildInputs = [ gdal qt4 flex openssl bison proj geos xlibsWrapper sqlite gsl qwt qscintilla
    fcgi libspatialindex libspatialite postgresql qjson qca2 txt2tags ] ++
@ -14,8 +14,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ cmake makeWrapper ];

-  # fatal error: ui_qgsdelimitedtextsourceselectbase.h: No such file or directory
-  #enableParallelBuilding = true;
+  enableParallelBuilding = true;

  # To handle the lack of 'local' RPATH; required, as they call one of
  # their built binaries requiring their libs, in the build process.
@ -25,7 +24,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "http://qgis.org/downloads/${name}.tar.bz2";
-    sha256 = "0dll8klz0qfba4c1y7mp9k4y4azlay0sypvryicggllk1hna4w0n";
+    sha256 = "155kz7fizhkmgc4lsmk1cph1zar03pdd8pjpmv81yyx1z0i4ygvl";
  };

  cmakeFlags = stdenv.lib.optional withGrass "-DGRASS_PREFIX7=${grass}/${grass.name}";
--- a/pkgs/applications/misc/cbatticon/default.nix
+++ b/pkgs/applications/misc/cbatticon/default.nix
@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {

  name = "cbatticon-${version}";
-  version = "1.6.4";
+  version = "1.6.5";

  src = fetchFromGitHub {
    owner = "valr";
    repo = "cbatticon";
    rev = version;
-    sha256 = "0m3bj408mbini97kq0cdf048lnfkdn7bd8ikbfijd7dwfdzv27i5";
+    sha256 = "1j7gbmmygvbrawqn1bbaf47lb600lylslzqbvfwlhifmi7qnm6ca";
  };

  makeFlags = "PREFIX=$(out)";
--- a/pkgs/applications/misc/electrum/default.nix
+++ b/pkgs/applications/misc/electrum/default.nix
@ -2,11 +2,11 @@

 python2Packages.buildPythonApplication rec {
  name = "electrum-${version}";
-  version = "2.7.12";
+  version = "2.7.18";

  src = fetchurl {
    url = "https://download.electrum.org/${version}/Electrum-${version}.tar.gz";
-    sha256 = "0vxdfl208if7mdsnva1jg37bnay2dsz3ww157aqwcv1j6512fi1n";
+    sha256 = "1l9krc7hqhqrm5bwp999bpykkcq4958qwvx8v0l5mxcxw8k7fkab";
  };

  propagatedBuildInputs = with python2Packages; [
--- a/pkgs/applications/misc/exercism/default.nix
+++ b/pkgs/applications/misc/exercism/default.nix
@ -18,6 +18,6 @@ buildGoPackage rec {
   homepage    = http://exercism.io/cli;
   license     = licenses.mit;
   maintainers = [ maintainers.rbasso ];
-   platforms   = platforms.linux;
+   platforms   = platforms.unix;
  };
 }
--- a/pkgs/applications/misc/pcmanfm/default.nix
+++ b/pkgs/applications/misc/pcmanfm/default.nix
@ -1,10 +1,10 @@
 { stdenv, fetchurl, glib, gtk2, intltool, libfm, libX11, pango, pkgconfig }:

 stdenv.mkDerivation rec {
-  name = "pcmanfm-1.2.4";
+  name = "pcmanfm-1.2.5";
  src = fetchurl {
    url = "mirror://sourceforge/pcmanfm/${name}.tar.xz";
-    sha256 = "04z3vd9si24yi4c8calqncdpb9b6mbj4cs4f3fs86i6j05gvpk9q";
+    sha256 = "0rxdh0dfzc84l85c54blq42gczygq8adhr3l9hqzy1dp530cm1hc";
  };

  buildInputs = [ glib gtk2 intltool libfm libX11 pango pkgconfig ];
--- a/pkgs/applications/networking/browsers/firefox-bin/sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/sources.nix
--- a/pkgs/applications/networking/browsers/firefox/default.nix
+++ b/pkgs/applications/networking/browsers/firefox/default.nix
@ -148,8 +148,8 @@ in {

  firefox-unwrapped = common {
    pname = "firefox";
-    version = "50.1.0";
-    sha512 = "370d2e9b8c4b1b59c3394659c3a7f0f79e6a911ccd9f32095b50b3a22d087132b1f7cb87b734f7497c4381b1df6df80d120b4b87c13eecc425cc66f56acccba5";
+    version = "51.0";
+    sha512 = "4406f840a7a2b4e76a74e846d702b717618fb5b677f1c6df864c3428033dd22aad295d656f1fc57e581fd202d894c5483a16691a60b6ca7710315b157b812467";
    updateScript = import ./update.nix {
        name = "firefox";
        inherit writeScript xidel coreutils gnused gnugrep curl ed;
@ -158,8 +158,8 @@ in {

  firefox-esr-unwrapped = common {
    pname = "firefox-esr";
-    version = "45.6.0esr";
-    sha512 = "b96c71aeed8a1185a085512f33d454a1735237cd9ddf37c8caa9cc91892eafab0615fc0ca6035f282ca8101489fa84c0de1087d1963c05b64df32b0c86446610";
+    version = "45.7.0esr";
+    sha512 = "6424101b6958191ce654d0619950dfbf98d4aa6bdd979306a2df8d6d30d3fecf1ab44638061a2b4fb1af85fe972f5ff49400e8eeda30cdcb9087c4b110b97a7d";
    updateScript = import ./update.nix {
        name = "firefox-esr";
        versionSuffix = "esr";
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@ -2,7 +2,7 @@

 ## various stuff that can be plugged in
 , gnash, flashplayer, hal-flash
-, MPlayerPlugin, gecko_mediaplayer, ffmpeg, gst_all, xorg, libpulseaudio, libcanberra_gtk2
+, MPlayerPlugin, ffmpeg, gst_all, xorg, libpulseaudio, libcanberra_gtk2
 , supportsJDK, jrePlugin, icedtea_web
 , trezor-bridge, bluejeans, djview4, adobe-reader
 , google_talk_plugin, fribid, gnome3/*.gnome_shell*/
@ -36,7 +36,6 @@ let
      ++ lib.optional enableAdobeFlash flashplayer
      ++ lib.optional (cfg.enableDjvu or false) (djview4)
      ++ lib.optional (cfg.enableMPlayer or false) (MPlayerPlugin browser)
-      ++ lib.optional (cfg.enableGeckoMediaPlayer or false) gecko_mediaplayer
      ++ lib.optional (supportsJDK && jre && jrePlugin ? mozillaPlugin) jrePlugin
      ++ lib.optional icedtea icedtea_web
      ++ lib.optional (cfg.enableGoogleTalkPlugin or false) google_talk_plugin
--- a/pkgs/applications/networking/browsers/mozilla-plugins/gecko-mediaplayer/default.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/gecko-mediaplayer/default.nix
@ -1,37 +0,0 @@
-{ stdenv, fetchurl, pkgconfig, glib, dbus, dbus_glib, browser, xlibsWrapper
-, GConf, gnome_mplayer, mplayer, gmtk
-}:
-
-stdenv.mkDerivation rec {
-  name = "gecko-mediaplayer-1.0.5";
-
-  src = fetchurl {
-    url = "http://gecko-mediaplayer.googlecode.com/files/${name}.tar.gz";
-    sha256 = "913fd39e70c564cb210c2544a88869f9d1a448184421f000b14b2bc5ba718b49";
-  };
-
-  buildInputs = [ pkgconfig glib dbus dbus_glib browser xlibsWrapper GConf browser gmtk ];
-
-  # !!! fix this
-  preBuild =
-    ''
-      export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -I$(echo ${browser}/include/xulrunner-*) -I${browser.nspr.dev}/include/nspr"
-      echo $NIX_CFLAGS_COMPILE
-    '';
-
-  # This plugin requires Gnome MPlayer and MPlayer to be in the
-  # browser's $PATH.
-  postInstall =
-    ''
-      echo "${gnome_mplayer}/bin:${mplayer}/bin" > $out/${passthru.mozillaPlugin}/extra-bin-path
-    '';
-
-  passthru.mozillaPlugin = "/lib/mozilla/plugins";
-
-  meta = {
-    description = "A browser plugin that uses GNOME MPlayer to play media in a browser";
-    homepage = http://kdekorte.googlepages.com/gecko-mediaplayer;
-    broken = true;
-  };
-}
-
--- a/pkgs/applications/networking/browsers/mozilla-plugins/gmtk/default.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/gmtk/default.nix
@ -1,16 +0,0 @@
-{ stdenv, fetchurl, intltool, pkgconfig, gtk2, GConf, alsaLib }:
-
-stdenv.mkDerivation rec {
-  name = "gmtk-1.0.9b";
-
-  src = fetchurl {
-    url = "http://gmtk.googlecode.com/files/${name}.tar.gz";
-    sha256 = "07y5hd94qhvlk9a9vhrpznqaml013j3rq52r3qxmrj74gg4yf4zc";
-  };
-
-  buildInputs = [ intltool pkgconfig gtk2 GConf alsaLib ];
-
-  meta = {
-    platforms = stdenv.lib.platforms.linux;
-  };
-}
--- a/pkgs/applications/networking/cluster/kubernetes/default.nix
+++ b/pkgs/applications/networking/cluster/kubernetes/default.nix
@ -1,6 +1,7 @@
 { stdenv, lib, fetchFromGitHub, which, go, go-bindata, makeWrapper, rsync
 , iptables, coreutils
 , components ? [
+    "cmd/kubeadm"
    "cmd/kubectl"
    "cmd/kubelet"
    "cmd/kube-apiserver"
--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@ -2,7 +2,7 @@

 buildGoPackage rec {
  name = "terragrunt-${version}";
-  version = "0.9.1";
+  version = "0.9.3";

  goPackagePath = "github.com/gruntwork-io/terragrunt";

@ -10,7 +10,7 @@ buildGoPackage rec {
    rev    = "v${version}";
    owner  = "gruntwork-io";
    repo   = "terragrunt";
-    sha256 = "19im4sazw09854lnzalljwx22qswly8ffyys3yrjkd2l9vfxfly3";
+    sha256 = "0i6sqgyxhi6icp7nps9prc40m9wsbr71v967kgl2865sgb214rdx";
  };

  goDeps = ./deps.nix;
--- a/pkgs/applications/networking/dropbox/default.nix
+++ b/pkgs/applications/networking/dropbox/default.nix
@ -23,11 +23,11 @@
 let
  # NOTE: When updating, please also update in current stable,
  # as older versions stop working
-  version = "17.4.33";
+  version = "18.4.32";
  sha256 =
    {
-      "x86_64-linux" = "0q3afwzd48mdv4mj4zbm6bvafj4hv18ianzhwjxz5dj6njv7s47y";
-      "i686-linux"   = "0wgq94if8wx08kqzsj6n20aia29h1qfn448ww63yn8dvkp6nlpya";
+      "x86_64-linux" = "0rm91gic6qwlvkclhwpw9mhsb1l9qdxqi7kyvn5ij6a978c70k5r";
+      "i686-linux"   = "0xzk4hxykacvrym8ls8q4zv2277adg6b5m7zmncmfwb6igx4ipap";
    }."${stdenv.system}" or (throw "system ${stdenv.system} not supported");

  arch =
--- a/pkgs/applications/networking/instant-messengers/viber/default.nix
+++ b/pkgs/applications/networking/instant-messengers/viber/default.nix
@ -1,20 +1,17 @@
 {fetchurl, stdenv, dpkg, makeWrapper,
 alsaLib, cups, curl, dbus, expat, fontconfig, freetype, glib, gst_all_1, harfbuzz, libcap,
- libpulseaudio, mesa, nspr, nss, systemd, wayland, xorg, zlib, ...
+ libpulseaudio, libxml2, libxslt, mesa, nspr, nss, openssl, systemd, wayland, xorg, zlib, ...
 }:

 assert stdenv.system == "x86_64-linux";

-# BUG: Viber requires running tray application, segfaulting if it's missing
-# FIX: Start something like `stalonetray` if you DE doesn't provide tray
-
 stdenv.mkDerivation rec {
  name = "viber-${version}";
-  version = "6.0.1.5";
+  version = "6.5.5.1481";

  src = fetchurl {
    url = "http://download.cdn.viber.com/cdn/desktop/Linux/viber.deb";
-    sha256 = "026vp2pv66b2dlwi5w5wk4yjnnmnsqapdww98p7xdnz8n0hnsbbi";
+    sha256 = "0gvpaprfki04x66ga2ljksspdxd4cz455h92a7i2dnd69w1kik5s";
  };

  buildInputs = [ dpkg makeWrapper ];
@ -35,9 +32,12 @@ stdenv.mkDerivation rec {
      harfbuzz
      libcap
      libpulseaudio
+      libxml2
+      libxslt
      mesa
      nspr
      nss
+      openssl
      stdenv.cc.cc
      systemd
      wayland
--- a/pkgs/applications/networking/irc/hexchat/default.nix
+++ b/pkgs/applications/networking/irc/hexchat/default.nix
@ -1,20 +1,24 @@
-{ stdenv, fetchurl, pkgconfig, gtk2, lua, perl, python
+{ stdenv, fetchFromGitHub, pkgconfig, gtk2, lua, perl, python
 , libtool, pciutils, dbus_glib, libcanberra_gtk2, libproxy
 , libsexy, enchant, libnotify, openssl, intltool
 , desktop_file_utils, hicolor_icon_theme
+, autoconf, automake, autoconf-archive
 }:

 stdenv.mkDerivation rec {
-  version = "2.12.3";
+  version = "2.12.4";
  name = "hexchat-${version}";

-  src = fetchurl {
-    url = "http://dl.hexchat.net/hexchat/${name}.tar.xz";
-    sha256 = "1fpj2kk1p85snffchqxsz3sphhcgiripjw41mgzxi7ks5hvj4avg";
+  src = fetchFromGitHub {
+    owner = "hexchat";
+    repo = "hexchat";
+    rev = "v${version}";
+    sha256 = "1z8v7jg1mc2277k3jihnq4rixw1q27305aw6b6rpb1x7vpiy2zr3";
  };

  nativeBuildInputs = [
    pkgconfig libtool intltool
+    autoconf autoconf-archive automake
  ];

  buildInputs = [
@ -24,11 +28,15 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

- #hexchat and heachat-text loads enchant spell checking library at run time and so it needs to have route to the path
+  #hexchat and heachat-text loads enchant spell checking library at run time and so it needs to have route to the path
  patchPhase = ''
    sed -i "s,libenchant.so.1,${enchant}/lib/libenchant.so.1,g" src/fe-gtk/sexy-spell-entry.c
  '';

+  preConfigure = ''
+    ./autogen.sh
+  '';
+
  configureFlags = [ "--enable-shm" "--enable-textfe" ];

  meta = with stdenv.lib; {
--- a/pkgs/applications/networking/sniffers/wireshark/default.nix
+++ b/pkgs/applications/networking/sniffers/wireshark/default.nix
@ -12,7 +12,7 @@ assert withQt -> !withGtk && qt4 != null;
 with stdenv.lib;

 let
-  version = "2.2.3";
+  version = "2.2.4";
  variant = if withGtk then "gtk" else if withQt then "qt" else "cli";
 in

@ -21,7 +21,7 @@ stdenv.mkDerivation {

  src = fetchurl {
    url = "http://www.wireshark.org/download/src/all-versions/wireshark-${version}.tar.bz2";
-    sha256 = "0fsrvl6sp772g2q2j24h10h9lfda6q67x7wahjjm8849i2gciflp";
+    sha256 = "049r5962yrajhhz9r4dsnx403dab50d6091y2mw298ymxqszp9s2";
  };

  buildInputs = [
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@ -1,20 +1,19 @@
 { stdenv, lib, fetchFromGitHub, go, pkgs }:
+
 let
  removeExpr = ref: ''
    sed -i "s,${ref},$(echo "${ref}" | sed "s,$NIX_STORE/[^-]*,$NIX_STORE/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee,"),g" \
  '';

-in
-
-stdenv.mkDerivation rec {
-  version = "0.14.19";
+in stdenv.mkDerivation rec {
+  version = "0.14.21";
  name = "syncthing-${version}";

  src = fetchFromGitHub {
    owner  = "syncthing";
    repo   = "syncthing";
    rev    = "v${version}";
-    sha256 = "16wpw9ndx3x37mfnymp2fx9n2az9ibyr61zgq3mh2mszzzl7bkcg";
+    sha256 = "0gxv4r7zg2rxjj0q8iiq3p5s75kwshcy6drjv65k8p2778bbvcjl";
  };

  buildInputs = [ go ];
--- a/pkgs/applications/office/homebank/default.nix
+++ b/pkgs/applications/office/homebank/default.nix
@ -2,10 +2,10 @@
 , hicolor_icon_theme, libsoup, gnome3 }:

 stdenv.mkDerivation rec {
-  name = "homebank-5.1.2";
+  name = "homebank-5.1.3";
  src = fetchurl {
    url = "http://homebank.free.fr/public/${name}.tar.gz";
-    sha256 = "09zsq5l3s8cg4slhsyybsq8v1arnhh07i0rzka3j6ahysky15pfh";
+    sha256 = "0wzv2hkm30a1kqjldw02bzbh49bdmac041d6qybjzvkgwvrbmci2";
  };

  nativeBuildInputs = [ pkgconfig wrapGAppsHook ];
--- a/pkgs/applications/science/logic/coq/8.4.nix
+++ b/pkgs/applications/science/logic/coq/8.4.nix
@ -63,6 +63,7 @@ stdenv.mkDerivation {
  '';

  passthru = {
+    inherit findlib;
    emacsBufferSetup = pkgs: ''
      ; Propagate coq paths to children
      (inherit-local-permanent coq-prog-name "${self}/bin/coqtop")
--- a/pkgs/applications/science/logic/coq/8.6.nix
+++ b/pkgs/applications/science/logic/coq/8.6.nix
@ -1,88 +0,0 @@
-# - coqide compilation can be disabled by setting lablgtk to null;
-# - The csdp program used for the Micromega tactic is statically referenced.
-#   However, coq can build without csdp by setting it to null.
-#   In this case some Micromega tactics will search the user's path for the csdp program and will fail if it is not found.
-# - The patch-level version can be specified through the `pl` argument to
-#   the derivation; it defaults to the greatest.
-
-{ stdenv, fetchurl, writeText, pkgconfig
-, ocaml, findlib, camlp5, ncurses
-, lablgtk ? null, csdp ? null
-, pl ? "1"
-}:
-
-let
-  # version = "8.6pl${pl}";
-  version = "8.6";
-  sha256 = "1pw1xvy1657l1k69wrb911iqqflzhhp8wwsjvihbgc72r3skqg3f";
-  coq-version = "8.6";
-  buildIde = lablgtk != null;
-  ideFlags = if buildIde then "-lablgtkdir ${lablgtk}/lib/ocaml/*/site-lib/lablgtk2 -coqide opt" else "";
-  csdpPatch = if csdp != null then ''
-    substituteInPlace plugins/micromega/sos.ml --replace "; csdp" "; ${csdp}/bin/csdp"
-    substituteInPlace plugins/micromega/coq_micromega.ml --replace "System.is_in_system_path \"csdp\"" "true"
-  '' else "";
-in
-
-stdenv.mkDerivation {
-  name = "coq-${version}";
-
-  inherit coq-version;
-  inherit ocaml camlp5;
-
-  src = fetchurl {
-    url = "http://coq.inria.fr/distrib/V${version}/files/coq-${version}.tar.gz";
-    inherit sha256;
-  };
-
-  buildInputs = [ pkgconfig ocaml findlib camlp5 ncurses lablgtk ];
-
-  postPatch = ''
-    UNAME=$(type -tp uname)
-    RM=$(type -tp rm)
-    substituteInPlace configure --replace "/bin/uname" "$UNAME"
-    substituteInPlace tools/beautify-archive --replace "/bin/rm" "$RM"
-    substituteInPlace configure.ml --replace '"md5 -q"' '"md5sum"'
-    ${csdpPatch}
-  '';
-
-  setupHook = writeText "setupHook.sh" ''
-    addCoqPath () {
-      if test -d "''$1/lib/coq/${coq-version}/user-contrib"; then
-        export COQPATH="''${COQPATH}''${COQPATH:+:}''$1/lib/coq/${coq-version}/user-contrib/"
-      fi
-    }
-
-    envHooks=(''${envHooks[@]} addCoqPath)
-  '';
-
-  preConfigure = ''
-    configureFlagsArray=(
-      -opt
-      ${ideFlags}
-    )
-  '';
-
-  prefixKey = "-prefix ";
-
-  buildFlags = "revision coq coqide bin/votour";
-
-  postInstall = ''
-    cp bin/votour $out/bin/
-  '';
-
-  meta = with stdenv.lib; {
-    description = "Coq proof assistant";
-    longDescription = ''
-      Coq is a formal proof management system.  It provides a formal language
-      to write mathematical definitions, executable algorithms and theorems
-      together with an environment for semi-interactive development of
-      machine-checked proofs.
-    '';
-    homepage = "http://coq.inria.fr";
-    license = licenses.lgpl21;
-    branch = coq-version;
-    maintainers = with maintainers; [ roconnor thoughtpolice vbgl ];
-    platforms = platforms.unix;
-  };
-}
--- a/pkgs/applications/science/logic/coq/default.nix
+++ b/pkgs/applications/science/logic/coq/default.nix
@ -1,26 +1,27 @@
-# - coqide compilation can be disabled by setting lablgtk to null;
+# - coqide compilation can be disabled by setting buildIde to false
 # - The csdp program used for the Micromega tactic is statically referenced.
 #   However, coq can build without csdp by setting it to null.
 #   In this case some Micromega tactics will search the user's path for the csdp program and will fail if it is not found.
-# - The patch-level version can be specified through the `pl` argument to
+# - The patch-level version can be specified through the `version` argument to
 #   the derivation; it defaults to the greatest.

 { stdenv, fetchurl, writeText, pkgconfig
-, ocaml, findlib, camlp5, ncurses
-, lablgtk ? null, csdp ? null
-, pl ? "3"
+, ocamlPackages, ncurses
+, buildIde ? true
+, csdp ? null
+, version ? "8.6"
 }:

 let
-  version = "8.5pl${pl}";
  sha256 = {
-   "1" = "1w2xvm6w16khfn63bp95s25hnkn2ny3w0yqg3lq63gp11aqpbyjb";
-   "2" = "0wyywia0darak2zmc5v0ra9rn0b9whwdfiahralm8v5za499s8w3";
-   "3" = "0fyk2a4fpifibq8y8jhx1891k55qnsnlygglch64sva0bph94nrh";
-  }."${pl}";
-  coq-version = "8.5";
-  buildIde = lablgtk != null;
-  ideFlags = if buildIde then "-lablgtkdir ${lablgtk}/lib/ocaml/*/site-lib/lablgtk2 -coqide opt" else "";
+   "8.5pl1"	= "1w2xvm6w16khfn63bp95s25hnkn2ny3w0yqg3lq63gp11aqpbyjb";
+   "8.5pl2"	= "0wyywia0darak2zmc5v0ra9rn0b9whwdfiahralm8v5za499s8w3";
+   "8.5pl3"	= "0fyk2a4fpifibq8y8jhx1891k55qnsnlygglch64sva0bph94nrh";
+   "8.6"	= "1pw1xvy1657l1k69wrb911iqqflzhhp8wwsjvihbgc72r3skqg3f";
+  }."${version}";
+  coq-version = builtins.substring 0 3 version;
+  camlp5 = ocamlPackages.camlp5_transitional;
+  ideFlags = if buildIde then "-lablgtkdir ${ocamlPackages.lablgtk}/lib/ocaml/*/site-lib/lablgtk2 -coqide opt" else "";
  csdpPatch = if csdp != null then ''
    substituteInPlace plugins/micromega/sos.ml --replace "; csdp" "; ${csdp}/bin/csdp"
    substituteInPlace plugins/micromega/coq_micromega.ml --replace "System.is_in_system_path \"csdp\"" "true"
@ -31,14 +32,18 @@ stdenv.mkDerivation {
  name = "coq-${version}";

  inherit coq-version;
-  inherit ocaml camlp5;
+  inherit camlp5;
+  inherit (ocamlPackages) ocaml;
+  passthru = {
+    inherit (ocamlPackages) findlib;
+  };

  src = fetchurl {
    url = "http://coq.inria.fr/distrib/V${version}/files/coq-${version}.tar.gz";
    inherit sha256;
  };

-  buildInputs = [ pkgconfig ocaml findlib camlp5 ncurses lablgtk ];
+  buildInputs = [ pkgconfig ocamlPackages.ocaml ocamlPackages.findlib camlp5 ncurses ocamlPackages.lablgtk ];

  postPatch = ''
    UNAME=$(type -tp uname)
--- a/pkgs/applications/version-management/cvs/CVE-2012-0804.patch
+++ b/pkgs/applications/version-management/cvs/CVE-2012-0804.patch
@ -0,0 +1,16 @@
+diff --git a/src/client.c b/src/client.c
+index 751406b..b45d89c 100644
+--- a/src/client.c
+++ b/src/client.c
+@@ -3558,9 +3558,9 @@ connect_to_pserver (cvsroot_t *root, struct buffer **to_server_p,
+          * code.
+          */
+ 	read_line_via (from_server, to_server, &read_buf);
+-	sscanf (read_buf, "%s %d", write_buf, &codenum);
+	count = sscanf (read_buf, "%*s %d", &codenum);
+
+-	if ((codenum / 100) != 2)
+	if (count != 1 || (codenum / 100) != 2)
+ 	    error (1, 0, "proxy server %s:%d does not support http tunnelling",
+ 		   root->proxy_hostname, proxy_port_number);
+ 	free (read_buf);
--- a/pkgs/applications/version-management/cvs/default.nix
+++ b/pkgs/applications/version-management/cvs/default.nix
@ -8,7 +8,10 @@ stdenv.mkDerivation {
    sha256 = "0pjir8cwn0087mxszzbsi1gyfc6373vif96cw4q3m1x6p49kd1bq";
  };

-  patches = [ ./getcwd-chroot.patch ];
+  patches = [
+    ./getcwd-chroot.patch
+    ./CVE-2012-0804.patch
+  ];

  hardeningDisable = [ "fortify" "format" ];

--- a/pkgs/applications/version-management/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab-workhorse/default.nix
@ -1,14 +1,14 @@
 { stdenv, fetchFromGitLab, git, go }:

 stdenv.mkDerivation rec {
-  version = "1.2.1";
+  version = "1.3.0";
  name = "gitlab-workhorse-${version}";

  srcs = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-workhorse";
    rev = "v${version}";
-    sha256 = "1z4iyymld3pssf1dwar0hy6c5hii79gk4k59mqj0mgy2k73405y0";
+    sha256 = "06pxnb675c5fwk7rv6fjh0cwbdylrdbjcyf8b0pins8jl0ix0szy";
  };

  buildInputs = [ git go ];
--- a/pkgs/applications/version-management/gitlab/Gemfile
+++ b/pkgs/applications/version-management/gitlab/Gemfile
@ -16,10 +16,12 @@ gem 'default_value_for', '~> 3.0.0'
 gem 'mysql2', '~> 0.3.16', group: :mysql
 gem 'pg', '~> 0.18.2', group: :postgres

+gem 'rugged', '~> 0.24.0'
+
 # Authentication libraries
 gem 'devise',                 '~> 4.2'
 gem 'doorkeeper',             '~> 4.2.0'
-gem 'omniauth',               '~> 1.3.1'
+gem 'omniauth',               '~> 1.3.2'
 gem 'omniauth-auth0',         '~> 1.4.1'
 gem 'omniauth-azure-oauth2',  '~> 0.0.6'
 gem 'omniauth-cas3',          '~> 1.1.2'
@ -49,10 +51,6 @@ gem 'u2f', '~> 0.2.1'
 # Browser detection
 gem 'browser', '~> 2.2'

-# Extracting information from a git repository
-# Provide access to Gitlab::Git library
-gem 'gitlab_git', '~> 10.7.0'
-
 # LDAP Auth
 # GitLab fork with several improvements to original library. For full list of changes
 # see https://github.com/intridea/omniauth-ldap/compare/master...gitlabhq:master
@ -101,18 +99,19 @@ gem 'unf', '~> 0.1.4'
 gem 'seed-fu', '~> 2.3.5'

 # Markdown and HTML processing
-gem 'html-pipeline',      '~> 1.11.0'
-gem 'deckar01-task_list', '1.0.6', require: 'task_list/railtie'
-gem 'gitlab-markup',      '~> 1.5.1'
-gem 'redcarpet',          '~> 3.3.3'
-gem 'RedCloth',           '~> 4.3.2'
-gem 'rdoc',               '~> 4.2'
-gem 'org-ruby',           '~> 0.9.12'
-gem 'creole',             '~> 0.5.0'
-gem 'wikicloth',          '0.8.1'
-gem 'asciidoctor',        '~> 1.5.2'
-gem 'rouge',              '~> 2.0'
-gem 'truncato',           '~> 0.7.8'
+gem 'html-pipeline',        '~> 1.11.0'
+gem 'deckar01-task_list',   '1.0.6', require: 'task_list/railtie'
+gem 'gitlab-markup',        '~> 1.5.1'
+gem 'redcarpet',            '~> 3.3.3'
+gem 'RedCloth',             '~> 4.3.2'
+gem 'rdoc',                 '~> 4.2'
+gem 'org-ruby',             '~> 0.9.12'
+gem 'creole',               '~> 0.5.0'
+gem 'wikicloth',            '0.8.1'
+gem 'asciidoctor',          '~> 1.5.2'
+gem 'asciidoctor-plantuml', '0.0.6'
+gem 'rouge',                '~> 2.0'
+gem 'truncato',             '~> 0.7.8'

 # See https://groups.google.com/forum/#!topic/ruby-security-ann/aSbgDiwb24s
 # and https://groups.google.com/forum/#!topic/ruby-security-ann/Dy7YiKb_pMM
@ -253,10 +252,9 @@ end

 group :development do
  gem 'foreman', '~> 0.78.0'
-  gem 'brakeman', '~> 3.3.0', require: false
+  gem 'brakeman', '~> 3.4.0', require: false

  gem 'letter_opener_web', '~> 1.3.0'
-  gem 'rerun', '~> 0.11.0'
  gem 'bullet', '~> 5.2.0', require: false
  gem 'rblineprof', '~> 0.3.6', platform: :mri, require: false
  gem 'web-console', '~> 2.0'
@ -287,7 +285,7 @@ group :development, :test do
  gem 'minitest', '~> 5.7.0'

  # Generate Fake data
-  gem 'ffaker', '~> 2.0.0'
+  gem 'ffaker', '~> 2.4'

  gem 'capybara',            '~> 2.6.2'
  gem 'capybara-screenshot', '~> 1.0.0'
@ -301,8 +299,8 @@ group :development, :test do
  gem 'spring-commands-spinach',  '~> 1.1.0'
  gem 'spring-commands-teaspoon', '~> 0.0.2'

-  gem 'rubocop', '~> 0.43.0', require: false
-  gem 'rubocop-rspec', '~> 1.5.0', require: false
+  gem 'rubocop', '~> 0.46.0', require: false
+  gem 'rubocop-rspec', '~> 1.9.1', require: false
  gem 'scss_lint', '~> 0.47.0', require: false
  gem 'haml_lint', '~> 0.18.2', require: false
  gem 'simplecov', '0.12.0', require: false
@ -331,11 +329,11 @@ end

 gem 'newrelic_rpm', '~> 3.16'

-gem 'octokit', '~> 4.3.0'
+gem 'octokit', '~> 4.6.2'

 gem 'mail_room', '~> 0.9.0'

-gem 'email_reply_parser', '~> 0.5.8'
+gem 'email_reply_trimmer', '~> 0.1'
 gem 'html2text'

 gem 'ruby-prof', '~> 0.16.2'
@ -350,7 +348,7 @@ gem 'paranoia', '~> 2.2'
 gem 'health_check', '~> 2.2.0'

 # System information
-gem 'vmstat', '~> 2.2'
+gem 'vmstat', '~> 2.3.0'
 gem 'sys-filesystem', '~> 1.1.6'

 gem "activerecord-nulldb-adapter"
--- a/pkgs/applications/version-management/gitlab/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/Gemfile.lock
@ -56,6 +56,8 @@ GEM
      faraday_middleware-multi_json (~> 0.0)
      oauth2 (~> 1.0)
    asciidoctor (1.5.3)
+    asciidoctor-plantuml (0.0.6)
+      asciidoctor (~> 1.5)
    ast (2.3.0)
    attr_encrypted (3.0.3)
      encryptor (~> 3.0.0)
@ -88,7 +90,7 @@ GEM
    bootstrap-sass (3.3.6)
      autoprefixer-rails (>= 5.2.1)
      sass (>= 3.3.4)
-    brakeman (3.3.2)
+    brakeman (3.4.1)
    browser (2.2.0)
    builder (3.2.2)
    bullet (5.2.0)
@ -173,7 +175,7 @@ GEM
      railties (>= 4.2)
    dropzonejs-rails (0.7.2)
      rails (> 3.1)
-    email_reply_parser (0.5.8)
+    email_reply_trimmer (0.1.6)
    email_spec (1.6.0)
      launchy (~> 2.1)
      mail (~> 2.2)
@ -198,7 +200,7 @@ GEM
    faraday_middleware-multi_json (0.0.6)
      faraday_middleware
      multi_json
-    ffaker (2.0.0)
+    ffaker (2.4.0)
    ffi (1.9.10)
    flay (2.6.1)
      ruby_parser (~> 3.0)
@ -268,11 +270,6 @@ GEM
    gitlab-markup (1.5.1)
    gitlab-turbolinks-classic (2.5.6)
      coffee-rails
-    gitlab_git (10.7.0)
-      activesupport (~> 4.0)
-      charlock_holmes (~> 0.7.3)
-      github-linguist (~> 4.7.0)
-      rugged (~> 0.24.0)
    gitlab_omniauth-ldap (1.2.1)
      net-ldap (~> 0.9)
      omniauth (~> 1.0)
@ -412,9 +409,6 @@ GEM
      xml-simple
    licensee (8.0.0)
      rugged (>= 0.24b)
-    listen (3.0.5)
-      rb-fsevent (>= 0.9.3)
-      rb-inotify (>= 0.9)
    little-plugger (1.1.4)
    logging (2.1.0)
      little-plugger (~> 1.1)
@ -454,10 +448,10 @@ GEM
      multi_json (~> 1.3)
      multi_xml (~> 0.5)
      rack (>= 1.2, < 3)
-    octokit (4.3.0)
-      sawyer (~> 0.7.0, >= 0.5.3)
+    octokit (4.6.2)
+      sawyer (~> 0.8.0, >= 0.5.3)
    oj (2.17.4)
-    omniauth (1.3.1)
+    omniauth (1.3.2)
      hashie (>= 1.2, < 4)
      rack (>= 1.0, < 3)
    omniauth-auth0 (1.4.1)
@ -585,9 +579,6 @@ GEM
    rainbow (2.1.0)
    raindrops (0.17.0)
    rake (10.5.0)
-    rb-fsevent (0.9.6)
-    rb-inotify (0.9.5)
-      ffi (>= 0.5.0)
    rblineprof (0.3.6)
      debugger-ruby_core_source (~> 1.3)
    rdoc (4.2.2)
@ -616,8 +607,6 @@ GEM
    redis-store (1.2.0)
      redis (>= 2.2)
    request_store (1.3.1)
-    rerun (0.11.0)
-      listen (~> 3.0)
    responders (2.3.0)
      railties (>= 4.2.0, < 5.1)
    rest-client (2.0.0)
@ -655,14 +644,14 @@ GEM
    rspec-retry (0.4.5)
      rspec-core
    rspec-support (3.5.0)
-    rubocop (0.43.0)
+    rubocop (0.46.0)
      parser (>= 2.3.1.1, < 3.0)
      powerpack (~> 0.1)
      rainbow (>= 1.99.1, < 3.0)
      ruby-progressbar (~> 1.7)
      unicode-display_width (~> 1.0, >= 1.0.1)
-    rubocop-rspec (1.5.0)
-      rubocop (>= 0.40.0)
+    rubocop-rspec (1.9.1)
+      rubocop (>= 0.42.0)
    ruby-fogbugz (0.2.1)
      crack (~> 0.4)
    ruby-prof (0.16.2)
@ -686,9 +675,9 @@ GEM
      sprockets (>= 2.8, < 4.0)
      sprockets-rails (>= 2.0, < 4.0)
      tilt (>= 1.1, < 3)
-    sawyer (0.7.0)
-      addressable (>= 2.3.5, < 2.5)
-      faraday (~> 0.8, < 0.10)
+    sawyer (0.8.1)
+      addressable (>= 2.3.5, < 2.6)
+      faraday (~> 0.8, < 1.0)
    scss_lint (0.47.1)
      rake (>= 0.9, < 11)
      sass (~> 3.4.15)
@ -812,7 +801,7 @@ GEM
      coercible (~> 1.0)
      descendants_tracker (~> 0.0, >= 0.0.3)
      equalizer (~> 0.0, >= 0.0.9)
-    vmstat (2.2.0)
+    vmstat (2.3.0)
    warden (1.2.6)
      rack (>= 1.0)
    web-console (2.3.0)
@ -849,6 +838,7 @@ DEPENDENCIES
  allocations (~> 1.0)
  asana (~> 0.4.0)
  asciidoctor (~> 1.5.2)
+  asciidoctor-plantuml (= 0.0.6)
  attr_encrypted (~> 3.0.0)
  awesome_print (~> 1.2.0)
  babosa (~> 1.0.2)
@ -857,7 +847,7 @@ DEPENDENCIES
  better_errors (~> 1.0.1)
  binding_of_caller (~> 0.7.2)
  bootstrap-sass (~> 3.3.0)
-  brakeman (~> 3.3.0)
+  brakeman (~> 3.4.0)
  browser (~> 2.2)
  bullet (~> 5.2.0)
  bundler-audit (~> 0.5.0)
@ -879,10 +869,10 @@ DEPENDENCIES
  diffy (~> 3.1.0)
  doorkeeper (~> 4.2.0)
  dropzonejs-rails (~> 0.7.1)
-  email_reply_parser (~> 0.5.8)
+  email_reply_trimmer (~> 0.1)
  email_spec (~> 1.6.0)
  factory_girl_rails (~> 4.7.0)
-  ffaker (~> 2.0.0)
+  ffaker (~> 2.4)
  flay (~> 2.6.1)
  fog-aws (~> 0.9)
  fog-core (~> 1.40)
@ -899,7 +889,6 @@ DEPENDENCIES
  gitlab-flowdock-git-hook (~> 1.0.1)
  gitlab-markup (~> 1.5.1)
  gitlab-turbolinks-classic (~> 2.5, >= 2.5.6)
-  gitlab_git (~> 10.7.0)
  gitlab_omniauth-ldap (~> 1.2.1)
  gollum-lib (~> 4.2)
  gollum-rugged_adapter (~> 0.4.2)
@ -937,9 +926,9 @@ DEPENDENCIES
  newrelic_rpm (~> 3.16)
  nokogiri (~> 1.6.7, >= 1.6.7.2)
  oauth2 (~> 1.2.0)
-  octokit (~> 4.3.0)
+  octokit (~> 4.6.2)
  oj (~> 2.17.4)
-  omniauth (~> 1.3.1)
+  omniauth (~> 1.3.2)
  omniauth-auth0 (~> 1.4.1)
  omniauth-authentiq (~> 0.2.0)
  omniauth-azure-oauth2 (~> 0.0.6)
@ -974,16 +963,16 @@ DEPENDENCIES
  redis-namespace (~> 1.5.2)
  redis-rails (~> 5.0.1)
  request_store (~> 1.3)
-  rerun (~> 0.11.0)
  responders (~> 2.0)
  rouge (~> 2.0)
  rqrcode-rails3 (~> 0.1.7)
  rspec-rails (~> 3.5.0)
  rspec-retry (~> 0.4.5)
-  rubocop (~> 0.43.0)
-  rubocop-rspec (~> 1.5.0)
+  rubocop (~> 0.46.0)
+  rubocop-rspec (~> 1.9.1)
  ruby-fogbugz (~> 0.2.1)
  ruby-prof (~> 0.16.2)
+  rugged (~> 0.24.0)
  sanitize (~> 2.0)
  sass-rails (~> 5.0.6)
  scss_lint (~> 0.47.0)
@ -1023,7 +1012,7 @@ DEPENDENCIES
  unicorn-worker-killer (~> 0.4.4)
  version_sorter (~> 2.1.0)
  virtus (~> 1.0.1)
-  vmstat (~> 2.2)
+  vmstat (~> 2.3.0)
  web-console (~> 2.0)
  webmock (~> 1.21.0)
  wikicloth (= 0.8.1)
--- a/pkgs/applications/version-management/gitlab/default.nix
+++ b/pkgs/applications/version-management/gitlab/default.nix
@ -22,7 +22,7 @@ in

 stdenv.mkDerivation rec {
  name = "gitlab-${version}";
-  version = "8.15.4";
+  version = "8.16.1";

  buildInputs = [ env ruby bundler tzdata git nodejs procps ];

@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
    owner = "gitlabhq";
    repo = "gitlabhq";
    rev = "v${version}";
-    sha256 = "1cd6dl8niy1xxifxdrm1kwm8qhy4x4zyvwdsb722kr136rwnxm84";
+    sha256 = "0c6cf8p1xx21xxmlpldhxs0i01myd4ddpjl7vfv932qmw9bw4in7";
  };

  patches = [
--- a/pkgs/applications/version-management/gitlab/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/gemset.nix
@ -143,6 +143,14 @@
    };
    version = "1.5.3";
  };
+  asciidoctor-plantuml = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0rd8yh0by5sxhg1c3cb1mzkp4jp3j8v6vzbyv1mx492s9ml451fx";
+      type = "gem";
+    };
+    version = "0.0.6";
+  };
  ast = {
    source = {
      remotes = ["https://rubygems.org"];
@ -274,10 +282,10 @@
  brakeman = {
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0v2yllqcn2zyi60ahgi8ds8pix6a82703ln25p9pkm1bvrwj3fsq";
+      sha256 = "0kmg55glfnx7jidrl1ivkfqc0zqya78wxk8wf5j37rj8ya3lzxgd";
      type = "gem";
    };
-    version = "3.3.2";
+    version = "3.4.1";
  };
  browser = {
    source = {
@ -607,13 +615,13 @@
    };
    version = "0.7.2";
  };
-  email_reply_parser = {
+  email_reply_trimmer = {
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0k2p229mv7xn7q627zwmvhrcvba4b9m70pw2jfjm6iimg2vmf22r";
+      sha256 = "0vijywhy1acsq4187ss6w8a7ksswaf1d5np3wbj962b6rqif5vcz";
      type = "gem";
    };
-    version = "0.5.8";
+    version = "0.1.6";
  };
  email_spec = {
    source = {
@ -738,10 +746,10 @@
  ffaker = {
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "19fnbbsw87asyb1hvkr870l2yldah2jcjb8074pgyrma5lynwmn0";
+      sha256 = "1rlfvf2iakphs3krxy1hiywr2jzmrhvhig8n8fw6rcivpz9v52ry";
      type = "gem";
    };
-    version = "2.0.0";
+    version = "2.4.0";
  };
  ffi = {
    source = {
@ -944,14 +952,6 @@
    };
    version = "2.5.6";
  };
-  gitlab_git = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0nnr6dlqq30syab2g7yvffgzinj5c8n9q7fvr3d88ix8hsawjrjm";
-      type = "gem";
-    };
-    version = "10.7.0";
-  };
  gitlab_omniauth-ldap = {
    source = {
      remotes = ["https://rubygems.org"];
@ -1312,14 +1312,6 @@
    };
    version = "8.0.0";
  };
-  listen = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "182wd2pkf690ll19lx6zbk01a3rqkk5lwsyin6kwydl7lqxj5z3g";
-      type = "gem";
-    };
-    version = "3.0.5";
-  };
  little-plugger = {
    source = {
      remotes = ["https://rubygems.org"];
@ -1531,10 +1523,10 @@
  octokit = {
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1hq47ck0z03vr3rzblyszihn7x2m81gv35chwwx0vrhf17nd27np";
+      sha256 = "1bppfc0q8mflbcdsb66dly3skx42vad30q0fkzwx4za908qwvjpd";
      type = "gem";
    };
-    version = "4.3.0";
+    version = "4.6.2";
  };
  oj = {
    source = {
@ -1547,10 +1539,10 @@
  omniauth = {
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0vsqxgzkcfi10b7k6vpv3shmlphbs8grc29hznwl9s0i16n8962p";
+      sha256 = "1dp5g3a6jnppy2kriz365p3jf9alrir4fhrj2nff2gm9skci2bk6";
      type = "gem";
    };
-    version = "1.3.1";
+    version = "1.3.2";
  };
  omniauth-auth0 = {
    source = {
@ -1928,22 +1920,6 @@
    };
    version = "10.5.0";
  };
-  rb-fsevent = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1hq57by28iv0ijz8pk9ynih0xdg7vnl1010xjcijfklrcv89a1j2";
-      type = "gem";
-    };
-    version = "0.9.6";
-  };
-  rb-inotify = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0kddx2ia0qylw3r52nhg83irkaclvrncgy2m1ywpbhlhsz1rymb9";
-      type = "gem";
-    };
-    version = "0.9.5";
-  };
  rblineprof = {
    source = {
      remotes = ["https://rubygems.org"];
@ -2056,14 +2032,6 @@
    };
    version = "1.3.1";
  };
-  rerun = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0av239bpmy55fdx4qaw9n71aapjy2myr51h5plzjxsyr0fdwn1xq";
-      type = "gem";
-    };
-    version = "0.11.0";
-  };
  responders = {
    source = {
      remotes = ["https://rubygems.org"];
@ -2187,18 +2155,18 @@
  rubocop = {
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0r2p4v6w5w1zx4skj9i3g3pshg3rykhgswimydrswp6nb8nkaphj";
+      sha256 = "0604qa0s0xcq0avnh9aa6iw58azpz6a7bavcs0ch61xnaz0qfl0c";
      type = "gem";
    };
-    version = "0.43.0";
+    version = "0.46.0";
  };
  rubocop-rspec = {
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "11701iw858vkxmb6khc9apmagz3lmnbdxm8irsxsgg57d0p8bs8p";
+      sha256 = "0h3781f4mz72qz8i30ah4fjfm4i20aqncak6rc9kwsvm5hw48i18";
      type = "gem";
    };
-    version = "1.5.0";
+    version = "1.9.1";
  };
  ruby-fogbugz = {
    source = {
@ -2315,10 +2283,10 @@
  sawyer = {
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1cn48ql00mf1ag9icmfpj7g7swh7mdn7992ggynjqbw1gh15bs3j";
+      sha256 = "0sv1463r7bqzvx4drqdmd36m7rrv6sf1v3c6vswpnq3k6vdw2dvd";
      type = "gem";
    };
-    version = "0.7.0";
+    version = "0.8.1";
  };
  scss_lint = {
    source = {
@ -2779,10 +2747,10 @@
  vmstat = {
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "10hlfam5gvxjvr5p1f4f81wlv5k81mrlg556rc9525290bcz31f0";
+      sha256 = "0vb5mwc71p8rlm30hnll3lb4z70ipl5rmilskpdrq2mxwfilcm5b";
      type = "gem";
    };
-    version = "2.2.0";
+    version = "2.3.0";
  };
  warden = {
    source = {
--- a/pkgs/applications/video/clipgrab/default.nix
+++ b/pkgs/applications/video/clipgrab/default.nix
@ -2,10 +2,10 @@

 stdenv.mkDerivation rec {
  name = "clipgrab-${version}";
-  version = "3.6.1";
+  version = "3.6.2";

  src = fetchurl {
-    sha256 = "1pmsnb9yfyadp8kzxldw09wmv2r0wmg9yza9ariqc27jz1j3kpsc";
+    sha256 = "0n7bhwkzknjpp54h54hxv1s8nsmmb7cwwf1aqpbcsnd7y6cv28nm";
    # The .tar.bz2 "Download" link is a binary blob, the source is the .tar.gz!
    url = "https://download.clipgrab.org/${name}.tar.gz";
  };
--- a/pkgs/applications/video/mkvtoolnix/default.nix
+++ b/pkgs/applications/video/mkvtoolnix/default.nix
@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, pkgconfig, autoconf, automake
-, ruby, file, xdg_utils, gettext, expat, qt5, boost
+, drake, ruby, file, xdg_utils, gettext, expat, qt5, boost
 , libebml, zlib, libmatroska, libogg, libvorbis, flac
 , withGUI ? true
 }:
@ -10,16 +10,16 @@ with stdenv.lib;

 stdenv.mkDerivation rec {
  name = "mkvtoolnix-${version}";
-  version = "9.6.0";
+  version = "9.8.0";

  src = fetchFromGitHub {
    owner = "mbunkus";
    repo = "mkvtoolnix";
    rev = "release-${version}";
-    sha256 = "14v6iclzkqxibzcdxr65bb5frmnsjyyly0d3lwv1gg7g1mkcw3jd";
+    sha256 = "1hnk92ksgg290q4kwdl8jqrz7vzlwki4f85bb6kgdgzpjkblw76n";
  };

-  nativeBuildInputs = [ pkgconfig autoconf automake gettext ruby ];
+  nativeBuildInputs = [ pkgconfig autoconf automake gettext drake ruby ];

  buildInputs = [
    expat file xdg_utils boost libebml zlib libmatroska libogg
@ -27,8 +27,8 @@ stdenv.mkDerivation rec {
  ] ++ optional withGUI qt5.qtbase;

  preConfigure = "./autogen.sh; patchShebangs .";
-  buildPhase   = "./drake -j $NIX_BUILD_CORES";
-  installPhase = "./drake install -j $NIX_BUILD_CORES";
+  buildPhase   = "drake -j $NIX_BUILD_CORES";
+  installPhase = "drake install -j $NIX_BUILD_CORES";

  configureFlags = [
    "--enable-magic"
@ -38,7 +38,6 @@ stdenv.mkDerivation rec {
    "--disable-profiling"
    "--disable-precompiled-headers"
    "--disable-static-qt"
-    "--without-curl"
    "--with-gettext"
    (enableFeature withGUI "qt")
  ];
--- a/pkgs/applications/video/streamlink/default.nix
+++ b/pkgs/applications/video/streamlink/default.nix
@ -1,14 +1,14 @@
 { stdenv, pythonPackages, fetchFromGitHub, rtmpdump }:

 pythonPackages.buildPythonApplication rec {
-  version = "0.0.2";
+  version = "0.3.0";
  name = "streamlink-${version}";

  src = fetchFromGitHub {
    owner = "streamlink";
    repo = "streamlink";
    rev = "${version}";
-    sha256 = "156b3smivs8lja7a98g3qa74bawqhc4mi8w8f3dscampbxx4dr9y";
+    sha256 = "1bjih6y21vmjmsk3xvhgc1innymryklgylyvjrskqw610niai59j";
  };

  propagatedBuildInputs = (with pythonPackages; [ pycrypto requests2 ]) ++ [ rtmpdump ];
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@ -12,6 +12,7 @@ with lib;
 stdenv.mkDerivation rec {
  name = "docker-${version}";
  version = "1.13.0";
+  rev = "49bf474"; # should match the version commit

  src = fetchFromGitHub {
    owner = "docker";
@ -79,7 +80,7 @@ stdenv.mkDerivation rec {
  buildPhase = ''
    patchShebangs .
    export AUTO_GOPATH=1
-    export DOCKER_GITCOMMIT="23cf638"
+    export DOCKER_GITCOMMIT="${rev}"
    ./hack/make.sh dynbinary
  '';

--- a/pkgs/applications/virtualization/lkl/default.nix
+++ b/pkgs/applications/virtualization/lkl/default.nix
@ -13,6 +13,9 @@ stdenv.mkDerivation rec {
    sha256 = "0x1hdjsrj6hfk1sgfw11ihm00fmp6g158sr2q3cgjy2b6jnsr4hp";
  };

+  # Fix a /usr/bin/env reference in here that breaks sandboxed builds
+  prePatch = "patchShebangs arch/lkl/scripts";
+
  installPhase = ''
    mkdir -p $out/{bin,lib}

--- a/pkgs/applications/virtualization/rkt/default.nix
+++ b/pkgs/applications/virtualization/rkt/default.nix
@ -12,7 +12,7 @@ let
  stage1Dir = "lib/rkt/stage1-images";

 in stdenv.mkDerivation rec {
-  version = "1.22.0";
+  version = "1.23.0";
  name = "rkt-${version}";
  BUILDDIR="build-${name}";

@ -20,7 +20,7 @@ in stdenv.mkDerivation rec {
      owner = "coreos";
      repo = "rkt";
      rev = "v${version}";
-      sha256 = "14rp3652awvx2iw1l6mia5flfib9jfkiaic16afchrlp17sdq2ji";
+      sha256 = "0fgvc3s8rb6da3jgrd8jmqv9xky7mq1y184jbm4lgy0rds4zhkf4";
  };

  stage1BaseImage = fetchurl {
--- a/pkgs/applications/window-managers/i3/status.nix
+++ b/pkgs/applications/window-managers/i3/status.nix
@ -2,11 +2,11 @@
  }:

 stdenv.mkDerivation rec {
-  name = "i3status-2.10";
+  name = "i3status-2.11";

  src = fetchurl {
    url = "http://i3wm.org/i3status/${name}.tar.bz2";
-    sha256 = "1497dsvb32z9xljmxz95dnyvsbayn188ilm3l4ys8m5h25vd1xfs";
+    sha256 = "0pwcy599fw8by1a1sf91crkqba7679qhvhbacpmhis8c1xrpxnwq";
  };

  buildInputs = [ confuse yajl alsaLib libpulseaudio libnl pkgconfig ];
--- a/pkgs/applications/window-managers/jwm/default.nix
+++ b/pkgs/applications/window-managers/jwm/default.nix
@ -5,13 +5,13 @@

 stdenv.mkDerivation rec {
  name = "jwm-${version}";
-  version = "1563";
+  version = "1575";
  
  src = fetchFromGitHub {
    owner = "joewing";
    repo = "jwm";
    rev = "s${version}";
-    sha256 = "0xfrsk0cffc0fmlmq1340ylzdcmancn2bwgzv6why3gklxplsp9z";
+    sha256 = "0dw0f29s04jglncavgqr7h9h791f7vw3lb3dcwrgmzk5v50v4nx9";
  };

  nativeBuildInputs = [ pkgconfig automake autoconf libtool gettext which ];
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@ -281,9 +281,6 @@ stdenv.mkDerivation {
  crossAttrs = {
    shell = shell.crossDrv + shell.crossDrv.shellPath;
    libc = stdenv.ccCross.libc;
-    coreutils = coreutils.crossDrv;
-    binutils = binutils.crossDrv;
-    cc = cc.crossDrv;
    #
    # This is not the best way to do this. I think the reference should be
    # the style in the gcc-cross-wrapper, but to keep a stable stdenv now I
--- a/pkgs/build-support/fetchbower/default.nix
+++ b/pkgs/build-support/fetchbower/default.nix
@ -1,4 +1,4 @@
-{ stdenv, lib, bower2nix }:
+{ stdenv, lib, bower2nix, cacert }:
 let
  bowerVersion = version:
    let
@ -9,6 +9,7 @@ let

  fetchbower = name: version: target: outputHash: stdenv.mkDerivation {
    name = "${name}-${bowerVersion version}";
+    SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
    buildCommand = ''
      fetch-bower --quiet --out=$PWD/out "${name}" "${target}" "${version}"
      # In some cases, the result of fetchBower is different depending
--- a/pkgs/data/fonts/gentium/default.nix
+++ b/pkgs/data/fonts/gentium/default.nix
@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
  version = "5.000";

  src = fetchzip {
-    url = "http://software.sil.org/downloads/gentium/GentiumPlus-${version}.zip";
+    url = "http://software.sil.org/downloads/d/gentium/GentiumPlus-${version}.zip";
    sha256 = "0g9sx38wh7f0m16gr64g2xggjwak2q6jw9y4zhrvhmp4aq4xfqm6";
  };

--- a/pkgs/data/fonts/overpass/default.nix
+++ b/pkgs/data/fonts/overpass/default.nix
@ -1,12 +1,14 @@
-{ stdenv, fetchurl, unzip }:
+{ stdenv, fetchFromGitHub, unzip }:

 stdenv.mkDerivation rec {
  name = "overpass-${version}";
-  version = "2.1";
+  version = "3.0.2";

-  src = fetchurl {
-    url = "https://github.com/RedHatBrand/overpass/releases/download/2.1/overpass-fonts-ttf-2.1.zip";
-    sha256 = "1kd7vbqffp5988j3p4zxkxajdmfviyv4y6rzk7jazg81xcsxicwf";
+  src = fetchFromGitHub {
+    owner = "RedHatBrand";
+    repo = "Overpass";
+    rev = version;
+    sha256 = "1bgmnhdfmp4rycyadcnzw62vkvn63nn29pq9vbjf4c9picvl8ah6";
  };

  nativeBuildInputs = [ unzip ];
@ -15,8 +17,8 @@ stdenv.mkDerivation rec {

  installPhase = ''
    mkdir -p $out/share/doc/${name}
-    mkdir -p $out/share/fonts/truetype
-    cp -v *.ttf $out/share/fonts/truetype
+    mkdir -p $out/share/fonts/opentype
+    cp -v "desktop-fonts/"*"/"*.otf $out/share/fonts/opentype
    cp -v LICENSE.md README.md $out/share/doc/${name}
  '';

--- a/pkgs/data/fonts/paratype-pt/sans.nix
+++ b/pkgs/data/fonts/paratype-pt/sans.nix
@ -1,7 +1,7 @@
 { stdenv, fetchurl, unzip }:

 stdenv.mkDerivation rec {
-  name = "paratype-pt-sane";
+  name = "paratype-pt-sans";

  src = fetchurl rec {
    url = "http://www.paratype.ru/uni/public/PTSans.zip";
--- a/pkgs/data/fonts/roboto/default.nix
+++ b/pkgs/data/fonts/roboto/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "roboto-${version}";
-  version = "2.135";
+  version = "2.136";

  src = fetchurl {
    url = "https://github.com/google/roboto/releases/download/v${version}/roboto-unhinted.zip";
-    sha256 = "1ndlh36bcx4mhi58sxfx6ywbib586brh6s5sk3jyji78h1i7j8zr";
+    sha256 = "0yx3q5wbbl1qkxfx1fglzy3rvms98jr8fcfj70vvvz3r3lppv201";
  };

  nativeBuildInputs = [ unzip ];
--- a/pkgs/desktops/enlightenment/terminology.nix
+++ b/pkgs/desktops/enlightenment/terminology.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "terminology-${version}";
-  version = "0.9.1";
+  version = "1.0.0";

  src = fetchurl {
    url = "http://download.enlightenment.org/rel/apps/terminology/${name}.tar.xz";
-    sha256 = "1kwv9vkhngdm5v38q93xpcykghnyawhjjcb5bgy0p89gpbk7mvpc";
+    sha256 = "1x4j2q4qqj10ckbka0zaq2r2zm66ff1x791kp8slv1ff7fw45vdz";
  };

  nativeBuildInputs = [ pkgconfig ];
@ -25,8 +25,8 @@ stdenv.mkDerivation rec {
  meta = {
    description = "The best terminal emulator written with the EFL";
    homepage = http://enlightenment.org/;
-    maintainers = with stdenv.lib.maintainers; [ matejc tstrobel ftrvxmtrx ];
    platforms = stdenv.lib.platforms.linux;
    license = stdenv.lib.licenses.bsd2;
+    maintainers = with stdenv.lib.maintainers; [ matejc tstrobel ftrvxmtrx ];
  };
 }
--- a/pkgs/desktops/lumina/default.nix
+++ b/pkgs/desktops/lumina/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  name = "lumina-${version}";
-  version = "1.1.0-p1";
+  version = "1.2.0-p1";

  src = fetchFromGitHub {
    owner = "trueos";
    repo = "lumina";
    rev = "v${version}";
-    sha256 = "1kkb6v6p6w5mx1qdmcrq3r674k9ahpc6wlsb9pi2lq8qk9yaid0m";
+    sha256 = "0k16lcpxp9avwkadbbyqficd1wxsmwian5ji38wyax76v22yq7p6";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-whiskermenu-plugin.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-whiskermenu-plugin.nix
@ -4,7 +4,7 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
  p_name  = "xfce4-whiskermenu-plugin";
-  version = "1.6.1";
+  version = "1.6.2";

  name = "${p_name}-${version}";

@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
    owner = "gottcode";
    repo = "xfce4-whiskermenu-plugin";
    rev = "v${version}";
-    sha256 = "19hldrrgy7qmrncv5rfsclybycjp9rjfnslhm996h62d2p675qpc";
+    sha256 = "0vfyav01hynjm7p73wwbwnn2l8l9a0hkz755wmjzr6qv06f9019d";
  };

  nativeBuildInputs = [ cmake pkgconfig intltool ];
--- a/pkgs/development/compilers/aspectj/default.nix
+++ b/pkgs/development/compilers/aspectj/default.nix
@ -1,12 +1,12 @@
 {stdenv, fetchurl, jre}:

-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
  name = "aspectj-1.5.2";
  builder = ./builder.sh;

  src = fetchurl {
-    url = http://www.mirrorservice.org/sites/download.eclipse.org/eclipseMirror/technology/aspectj/aspectj-1.5.2.jar;
-    md5 = "64245d451549325147e3ca1ec4c9e57c";
+    url = "http://archive.eclipse.org/tools/aspectj/${name}.jar";
+    sha256 = "1b3mx248dc1xka1vgsl0jj4sm0nfjsqdcj9r9036mvixj1zj3nmh";
  };

  inherit jre;
--- a/pkgs/development/compilers/crystal/default.nix
+++ b/pkgs/development/compilers/crystal/default.nix
@ -1,7 +1,7 @@
 { stdenv, fetchurl, boehmgc, libatomic_ops, pcre, libevent, libiconv, llvm_39, makeWrapper }:

 stdenv.mkDerivation rec {
-  version = "0.20.4";
+  version = "0.20.5";
  name = "crystal-${version}-1";
  arch =
    {
@ -14,15 +14,15 @@ stdenv.mkDerivation rec {
    url = "https://github.com/crystal-lang/crystal/releases/download/${version}/crystal-${version}-1-${arch}.tar.gz";
    sha256 =
      {
-        "x86_64-linux" = "cdc11c30235f8bd3b89e1fc13b56838f99d585715fb66563d6599026f5393e37";
-        "i686-linux" = "93e7df2bea3220728987a49a2f93d1c615e2ccae63843e0259a5d891c53a0b80";
-        "x86_64-darwin" = "3fd291a4a5c9eccdea933a9df25446c90d80660a17e89f83503fcb5b6deba03e";
+        "x86_64-linux" = "fd077c0a727419e131b1be6198a5aa5820ecbdaafd2d2bb38be5716ba75b5100";
+        "i686-linux" = "e3a890f11833c57c9004655d108f981c7c630cd7a939f828d9a6c571705bc3e7";
+        "x86_64-darwin" = "79462c8ff994b36cff219c356967844a17e8cb2817bb24a196a960a08b8c9e47";
      }."${stdenv.system}" or (throw "system ${stdenv.system} not supported");
  };

  src = fetchurl {
    url = "https://github.com/crystal-lang/crystal/archive/${version}.tar.gz";
-    sha256 = "fd099f278b71bbb5cad1927c93933d1feba554fbf8f6f4ab9165f535765f5e31";
+    sha256 = "ee1e5948c6e662ccb1e62671cf2c91458775b559b23d74ab226dc2a2d23f7707";
  };

  # crystal on Darwin needs libiconv to build
--- a/pkgs/development/compilers/ghc/8.0.2.nix
+++ b/pkgs/development/compilers/ghc/8.0.2.nix
@ -4,13 +4,6 @@

 let
  inherit (bootPkgs) ghc;
-
-  fetchFilteredPatch = args: fetchurl (args // {
-    downloadToTemp = true;
-    postFetch = ''
-      ${patchutils}/bin/filterdiff --clean --strip-match=1 -x 'testsuite/*' "$downloadedFile" > "$out"
-    ''; # fix syntax highlighting: */
-  });
 in
 stdenv.mkDerivation rec {
  version = "8.0.2";
--- a/pkgs/development/compilers/ghc/head.nix
+++ b/pkgs/development/compilers/ghc/head.nix
@ -1,5 +1,6 @@
 { stdenv, fetchgit, bootPkgs, perl, gmp, ncurses, libiconv, binutils, coreutils
-, autoconf, automake, happy, alex, python3, crossSystem, selfPkgs, cross ? null
+, autoconf, automake, happy, alex, python3, buildPlatform, targetPlatform
+, selfPkgs, cross ? null
 }:

 let
@ -68,9 +69,9 @@ in stdenv.mkDerivation (rec {

  passthru = {
    inherit bootPkgs;
-  } // stdenv.lib.optionalAttrs (crossSystem != null) {
+  } // stdenv.lib.optionalAttrs (targetPlatform != buildPlatform) {
    crossCompiler = selfPkgs.ghc.override {
-      cross = crossSystem;
+      cross = targetPlatform;
      bootPkgs = selfPkgs;
    };
  };
--- a/pkgs/development/compilers/go/1.4.nix
+++ b/pkgs/development/compilers/go/1.4.nix
@ -77,6 +77,29 @@ stdenv.mkDerivation rec {
    # fails when running inside tmux
    sed -i '/TestNohup/areturn' src/os/signal/signal_test.go

+    # unix socket tests fail on darwin
+    sed -i '/TestConnAndListener/areturn' src/net/conn_test.go
+    sed -i '/TestPacketConn/areturn' src/net/conn_test.go
+    sed -i '/TestPacketConn/areturn' src/net/packetconn_test.go
+    sed -i '/TestConnAndPacketConn/areturn' src/net/packetconn_test.go
+    sed -i '/TestUnixListenerSpecificMethods/areturn' src/net/packetconn_test.go
+    sed -i '/TestUnixConnSpecificMethods/areturn' src/net/packetconn_test.go
+    sed -i '/TestUnixListenerSpecificMethods/areturn' src/net/protoconn_test.go
+    sed -i '/TestUnixConnSpecificMethods/areturn' src/net/protoconn_test.go
+    sed -i '/TestStreamConnServer/areturn' src/net/server_test.go
+    sed -i '/TestReadUnixgramWithUnnamedSocket/areturn' src/net/unix_test.go
+    sed -i '/TestReadUnixgramWithZeroBytesBuffer/areturn' src/net/unix_test.go
+    sed -i '/TestUnixgramWrite/areturn' src/net/unix_test.go
+    sed -i '/TestUnixConnLocalAndRemoteNames/areturn' src/net/unix_test.go
+    sed -i '/TestUnixgramConnLocalAndRemoteNames/areturn' src/net/unix_test.go
+    sed -i '/TestWithSimulated/areturn' src/log/syslog/syslog_test.go
+    sed -i '/TestFlap/areturn' src/log/syslog/syslog_test.go
+    sed -i '/TestNew/areturn' src/log/syslog/syslog_test.go
+    sed -i '/TestNewLogger/areturn' src/log/syslog/syslog_test.go
+    sed -i '/TestDial/areturn' src/log/syslog/syslog_test.go
+    sed -i '/TestWrite/areturn' src/log/syslog/syslog_test.go
+    sed -i '/TestConcurrentWrite/areturn' src/log/syslog/syslog_test.go
+    sed -i '/TestConcurrentReconnect/areturn' src/log/syslog/syslog_test.go

    # remove IP resolving tests, on darwin they can find fe80::1%lo while expecting ::1
    sed -i '/TestResolveIPAddr/areturn' src/net/ipraw_test.go
--- a/pkgs/development/compilers/go/1.6.nix
+++ b/pkgs/development/compilers/go/1.6.nix
@ -89,7 +89,7 @@ stdenv.mkDerivation rec {
    sed -i '/TestChdirAndGetwd/areturn' src/os/os_test.go
    sed -i '/TestRead0/areturn' src/os/os_test.go
    sed -i '/TestNohup/areturn' src/os/signal/signal_test.go
-    sed -i '/TestSystemRoots/areturn' src/crypto/x509/root_darwin_test.go
+    rm src/crypto/x509/root_darwin_test.go src/crypto/x509/verify_test.go

    sed -i '/TestGoInstallRebuildsStalePackagesInOtherGOPATH/areturn' src/cmd/go/go_test.go
    sed -i '/TestBuildDashIInstallsDependencies/areturn' src/cmd/go/go_test.go
--- a/pkgs/development/compilers/jikes/default.nix
+++ b/pkgs/development/compilers/jikes/default.nix
@ -4,7 +4,7 @@ stdenv.mkDerivation {
  name = "jikes-1.22";
  src = fetchurl {
    url = mirror://sourceforge/jikes/jikes-1.22.tar.bz2;
-    md5 = "cda958c7fef6b43b803e1d1ef9afcb85";
+    sha256 = "1qqldrp74pzpy5ly421srqn30qppmm9cvjiqdngk8hf47dv2rc0c";
  };

  meta = {
--- a/pkgs/development/compilers/meta-environment/meta-build-env/default.nix
+++ b/pkgs/development/compilers/meta-environment/meta-build-env/default.nix
@ -2,7 +2,7 @@
  name = "meta-build-env-0.1";
  src = fetchurl {
    url = http://www.meta-environment.org/releases/meta-build-env-0.1.tar.gz ;
-    md5 = "827b54ace4e2d3c8e7605ea149b34293";
+    sha256 = "1imn1gaan4fv73v8w3k3lgyjzkcn7bdp69k6hlz0vqdg17ysd1x3";
  };

  meta = {
--- a/pkgs/development/compilers/ocaml/4.04.nix
+++ b/pkgs/development/compilers/ocaml/4.04.nix
@ -0,0 +1,6 @@
+import ./generic.nix {
+  major_version = "4";
+  minor_version = "04";
+  patch_version = "0";
+  sha256 = "1d2nk3kq4dyzz8dls45r13jprq5by3q8kshc8kvxzm8n4fnnvvb4";
+}
--- a/pkgs/development/compilers/ocaml/generic.nix
+++ b/pkgs/development/compilers/ocaml/generic.nix
@ -41,7 +41,7 @@ stdenv.mkDerivation (args // rec {
  buildFlags = "world" + optionalString useNativeCompilers " bootstrap world.opt";
  buildInputs = [ncurses] ++ optionals useX11 [ libX11 xproto ];
  installTargets = "install" + optionalString useNativeCompilers " installopt";
-  preConfigure = ''
+  preConfigure = optionalString (!stdenv.lib.versionAtLeast version "4.04") ''
    CAT=$(type -tp cat)
    sed -e "s@/bin/cat@$CAT@" -i config/auto-aux/sharpbang
  '';
@ -56,7 +56,7 @@ stdenv.mkDerivation (args // rec {

  meta = with stdenv.lib; {
    homepage = http://caml.inria.fr/ocaml;
-    branch = "4.03";
+    branch = versionNoPatch;
    license = with licenses; [
      qpl /* compiler */
      lgpl2 /* library */
--- a/pkgs/development/compilers/zulu/default.nix
+++ b/pkgs/development/compilers/zulu/default.nix
@ -0,0 +1,67 @@
+{ stdenv, pkgs, fetchurl, unzip, makeWrapper, setJavaClassPath, swingSupport ? true }:
+
+with pkgs;
+
+let
+  version = "8.19.0.1";
+  openjdk = "8.0.112";
+
+  sha256_linux = "1icb6in1197n44wk2cqnrxr7w0bd5abxxysfrhbg56jlb9nzmp4x";
+  sha256_darwin = "0kxwh62a6kckc9l9jkgakf86lqkqazp3dwfwaxqc4cg5zczgbhmd";
+
+  platform = if stdenv.isDarwin then "macosx" else "linux";
+  hash = if stdenv.isDarwin then sha256_darwin else sha256_linux;
+  extension = if stdenv.isDarwin then "zip" else "tar.gz";
+in stdenv.mkDerivation rec {
+  inherit version openjdk platform hash extension;
+
+  name = "zulu-${version}";
+
+  src = fetchurl {
+    url = "https://cdn.azul.com/zulu/bin/zulu${version}-jdk${openjdk}-${platform}_x64.${extension}";
+    sha256 = hash;
+  };
+
+  buildInputs = [ makeWrapper ] ++ stdenv.lib.optional stdenv.isDarwin [ unzip ];
+
+  installPhase = ''
+    mkdir -p $out
+    cp -r ./* "$out/"
+
+    jrePath="$out/jre"
+
+    rpath=$rpath''${rpath:+:}$jrePath/lib/amd64/jli
+    rpath=$rpath''${rpath:+:}$jrePath/lib/amd64/server
+    rpath=$rpath''${rpath:+:}$jrePath/lib/amd64/xawt
+    rpath=$rpath''${rpath:+:}$jrePath/lib/amd64
+
+    # set all the dynamic linkers
+    find $out -type f -perm -0100 \
+        -exec patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+        --set-rpath "$rpath" {} \;
+
+    find $out -name "*.so" -exec patchelf --set-rpath "$rpath" {} \;
+
+    mkdir -p $out/nix-support
+    echo -n "${setJavaClassPath}" > $out/nix-support/propagated-native-build-inputs
+
+    # Set JAVA_HOME automatically.
+    cat <<EOF >> $out/nix-support/setup-hook
+    if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out; fi
+    EOF
+  '';
+
+  libraries = [ stdenv.cc.libc glib libxml2 libav_0_8 ffmpeg libxslt mesa_noglu xorg.libXxf86vm alsaLib fontconfig freetype gnome2.pango gnome2.gtk cairo gdk_pixbuf atk ]
+      ++ (if swingSupport then [ xorg.libX11 xorg.libXext xorg.libXtst xorg.libXi xorg.libXp xorg.libXt xorg.libXrender stdenv.cc.cc ] else [ ]);
+
+  rpath = stdenv.lib.strings.makeLibraryPath libraries;
+
+  meta = with stdenv.lib; {
+    homepage = https://www.azul.com/products/zulu/;
+    license = licenses.gpl2;
+    description = "Certified builds of OpenJDK";
+    longDescription = "Certified builds of OpenJDK that can be deployed across multiple operating systems, containers, hypervisors and Cloud platforms";
+    maintainers = with maintainers; [ nequissimus ];
+    platforms = [ "x86_64-linux" "x86_64-darwin" ];
+  };
+}
--- a/pkgs/development/coq-modules/mathcomp/default.nix
+++ b/pkgs/development/coq-modules/mathcomp/default.nix
@ -1,39 +1,22 @@
 { callPackage, fetchurl, coq }:

-if coq.coq-version == "8.4" then
-
-callPackage ./generic.nix {
-
-  name = "coq-mathcomp-1.6-${coq.coq-version}";
-  src = fetchurl {
+let param =
+  let v16 = {
+    version = "1.6";
    url = http://ssr.msr-inria.inria.fr/FTP/mathcomp-1.6.tar.gz;
    sha256 = "0adr556032r1jkvphbpfvrrv041qk0yqb7a1xnbam52ji0mdl2w8";
-  };
-
-}
-
-else if coq.coq-version == "8.5" then
-
-callPackage ./generic.nix {
-
-  name = "coq-mathcomp-1.6-${coq.coq-version}";
-  src = fetchurl {
-    url = http://ssr.msr-inria.inria.fr/FTP/mathcomp-1.6.tar.gz;
-    sha256 = "0adr556032r1jkvphbpfvrrv041qk0yqb7a1xnbam52ji0mdl2w8";
-  };
-
-}
-
-else if coq.coq-version == "8.6" then
-
-callPackage ./generic.nix {
-
-  name = "coq-mathcomp-1.6.1-${coq.coq-version}";
-  src = fetchurl {
+  }; v161 = {
+    version = "1.6.1";
    url = https://github.com/math-comp/math-comp/archive/mathcomp-1.6.1.tar.gz;
    sha256 = "1j9ylggjzrxz1i2hdl2yhsvmvy5z6l4rprwx7604401080p5sgjw";
-  };
+  }; in
+{
+  "8.4" = v16;
+  "8.5" = v16;
+  "8.6" = v161;
+}."${coq.coq-version}"; in

+callPackage ./generic.nix {
+  name = "coq${coq.coq-version}-mathcomp-${param.version}";
+  src = fetchurl { inherit (param) url sha256; };
 }
-
-else throw "No ssreflect package for Coq version ${coq.coq-version}"
--- a/Show More
+++ b/Show More