Merge branch 'master' into staging-next

Hydra: ?compare=1473892
2024-11-20 00:53:12 +03:00 · 2018-08-17 13:44:40 +02:00 · 2018-08-17 13:44:40 +02:00 · cbabebcc2e
commit cbabebcc2e
parent 7a22083e12 93147d737d
263 changed files with 5922 additions and 4627 deletions
--- a/doc/languages-frameworks/rust.section.md
+++ b/doc/languages-frameworks/rust.section.md
@ -59,6 +59,11 @@ all crate sources of this package. Currently it is obtained by inserting a
 fake checksum into the expression and building the package once. The correct
 checksum can be then take from the failed build.

+When the `Cargo.lock`, provided by upstream, is not in sync with the
+`Cargo.toml`, it is possible to use `cargoPatches` to update it. All patches
+added in `cargoPatches` will also be prepended to the patches in `patches` at
+build-time.
+
 To install crates with nix there is also an experimental project called
 [nixcrates](https://github.com/fractalide/nixcrates).

--- a/lib/attrsets.nix
+++ b/lib/attrsets.nix
@ -384,11 +384,12 @@ rec {
  recursiveUpdateUntil = pred: lhs: rhs:
    let f = attrPath:
      zipAttrsWith (n: values:
+        let here = attrPath ++ [n]; in
        if tail values == []
-        || pred attrPath (head (tail values)) (head values) then
+        || pred here (head (tail values)) (head values) then
          head values
        else
-          f (attrPath ++ [n]) values
+          f here values
      );
    in f [] [rhs lhs];

--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@ -210,6 +210,11 @@ lib.mapAttrs (n: v: v // { shortName = n; }) rec {
    fullName = "Common Public License 1.0";
  };

+  curl = {
+    fullName = "MIT/X11 derivate";
+    url = "https://curl.haxx.se/docs/copyright.html";
+  };
+
  doc = spdx {
    spdxId = "DOC";
    fullName = "DOC License";
@ -613,6 +618,12 @@ lib.mapAttrs (n: v: v // { shortName = n; }) rec {
    fullName = "Vim License";
  };

+  virtualbox-puel = {
+    fullName = "Oracle VM VirtualBox Extension Pack Personal Use and Evaluation License (PUEL)";
+    url = "https://www.virtualbox.org/wiki/VirtualBox_PUEL";
+    free = false;
+  };
+
  vsl10 = spdx {
    spdxId = "VSL-1.0";
    fullName = "Vovida Software License v1.0";
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@ -213,6 +213,30 @@ runTests {
  };


+# ATTRSETS
+
+  # code from the example
+  testRecursiveUpdateUntil = {
+    expr = recursiveUpdateUntil (path: l: r: path == ["foo"]) {
+      # first attribute set
+      foo.bar = 1;
+      foo.baz = 2;
+      bar = 3;
+    } {
+      #second attribute set
+      foo.bar = 1;
+      foo.quz = 2;
+      baz = 4;
+    };
+    expected = {
+      foo.bar = 1; # 'foo.*' from the second set
+      foo.quz = 2; #
+      bar = 3;     # 'bar' from the first set
+      baz = 4;     # 'baz' from the second set
+    };
+  };
+
+
 # GENERATORS
 # these tests assume attributes are converted to lists
 # in alphabetical order
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -534,6 +534,11 @@
    github = "bodil";
    name = "Bodil Stokke";
  };
+  boj = {
+    email = "brian@uncannyworks.com";
+    github = "boj";
+    name = "Brian Jones";
+  };
  boothead = {
    email = "ben@perurbis.com";
    github = "boothead";
@ -1382,6 +1387,11 @@
    github = "fps";
    name = "Florian Paul Schmidt";
  };
+  freepotion = {
+    email = "freepotion@protonmail.com";
+    github = "freepotion";
+    name = "Free Potion";
+  };
  Fresheyeball = {
    email = "fresheyeball@gmail.com";
    github = "fresheyeball";
@ -1679,6 +1689,11 @@
    github = "ikervagyok";
    name = "Balázs Lengyel";
  };
+  illegalprime = {
+    email = "themichaeleden@gmail.com";
+    github = "illegalprime";
+    name = "Michael Eden";
+  };
  ilya-kolpakov = {
    email = "ilya.kolpakov@gmail.com";
    github = "ilya-kolpakov";
@ -2867,6 +2882,11 @@
    github = "nocoolnametom";
    name = "Tom Doggett";
  };
+  noneucat = {
+    email = "andy@lolc.at";
+    github = "noneucat";
+    name = "Andy Chun";
+  };
  notthemessiah = {
    email = "brian.cohen.88@gmail.com";
    github = "notthemessiah";
@ -3237,6 +3257,11 @@
    github = "qoelet";
    name = "Kenny Shen";
  };
+  qyliss = {
+    email = "hi@alyssa.is";
+    github = "alyssais";
+    name = "Alyssa Ross";
+  };
  ragge = {
    email = "r.dahlen@gmail.com";
    github = "ragnard";
@ -3271,6 +3296,11 @@
    email = "ravloony@gmail.com";
    name = "Tom Macdonald";
  };
+  rawkode = {
+    email = "david.andrew.mckay@gmail.com";
+    github = "rawkode";
+    name = "David McKay";
+  };
  razvan = {
    email = "razvan.panda@gmail.com";
    github = "razvan-panda";
--- a/nixos/doc/manual/release-notes/rl-1809.xml
+++ b/nixos/doc/manual/release-notes/rl-1809.xml
@ -278,6 +278,8 @@ inherit (pkgs.nixos {
     <literal>lib.traceCallXml</literal> has been deprecated. Please complain
     if you use the function regularly.
    </para>
+   </listitem>
+   <listitem>
    <para>
     The attribute <literal>lib.nixpkgsVersion</literal> has been deprecated in
     favor of <literal>lib.version</literal>. Please refer to the discussion in
@ -285,6 +287,13 @@ inherit (pkgs.nixos {
     for further reference.
    </para>
   </listitem>
+   <listitem>
+    <para>
+     <literal>lib.recursiveUpdateUntil</literal> was not acting according to its
+     specification. It has been fixed to act according to the docstring, and a
+     test has been added.
+    </para>
+   </listitem>
   <listitem>
    <para>
     The module for <option>security.dhparams</option> has two new options now:
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -247,6 +247,7 @@
  ./services/desktops/gnome3/tracker-miners.nix
  ./services/desktops/profile-sync-daemon.nix
  ./services/desktops/telepathy.nix
+  ./services/desktops/zeitgeist.nix
  ./services/development/bloop.nix
  ./services/development/hoogle.nix
  ./services/editors/emacs.nix
@ -407,6 +408,7 @@
  ./services/monitoring/cadvisor.nix
  ./services/monitoring/collectd.nix
  ./services/monitoring/das_watchdog.nix
+  ./services/monitoring/datadog-agent.nix
  ./services/monitoring/dd-agent/dd-agent.nix
  ./services/monitoring/fusion-inventory.nix
  ./services/monitoring/grafana.nix
--- a/nixos/modules/profiles/installation-device.nix
+++ b/nixos/modules/profiles/installation-device.nix
@ -31,7 +31,8 @@ with lib;
    #services.rogue.enable = true;

    # Disable some other stuff we don't need.
-    security.sudo.enable = false;
+    security.sudo.enable = mkDefault false;
+    services.udisks2.enable = mkDefault false;

    # Automatically log in at the virtual consoles.
    services.mingetty.autologinUser = "root";
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@ -256,6 +256,7 @@ with lib;
    (mkRemovedOptionModule [ "fonts" "fontconfig" "forceAutohint" ] "")
    (mkRemovedOptionModule [ "fonts" "fontconfig" "renderMonoTTFAsBitmap" ] "")
    (mkRemovedOptionModule [ "virtualisation" "xen" "qemu" ] "You don't need this option anymore, it will work without it.")
+    (mkRemovedOptionModule [ "boot" "zfs" "enableLegacyCrypto" ] "The corresponding package was removed from nixpkgs.")

    # ZSH
    (mkRenamedOptionModule [ "programs" "zsh" "enableSyntaxHighlighting" ] [ "programs" "zsh" "syntaxHighlighting" "enable" ])
--- a/nixos/modules/services/desktops/accountsservice.nix
+++ b/nixos/modules/services/desktops/accountsservice.nix
@ -32,15 +32,21 @@ with lib;

    environment.systemPackages = [ pkgs.accountsservice ];

+    # Accounts daemon looks for dbus interfaces in $XDG_DATA_DIRS/accountsservice
+    environment.pathsToLink = [ "/share/accountsservice" ];
+
    services.dbus.packages = [ pkgs.accountsservice ];

    systemd.packages = [ pkgs.accountsservice ];

-    systemd.services.accounts-daemon= {
+    systemd.services.accounts-daemon = {

      wantedBy = [ "graphical.target" ];

-    } // (mkIf (!config.users.mutableUsers) {
+      # Accounts daemon looks for dbus interfaces in $XDG_DATA_DIRS/accountsservice
+      environment.XDG_DATA_DIRS = "${config.system.path}/share";
+
+    } // (optionalAttrs (!config.users.mutableUsers) {
      environment.NIXOS_USERS_PURE = "true";
    });
  };
--- a/nixos/modules/services/desktops/geoclue2.nix
+++ b/nixos/modules/services/desktops/geoclue2.nix
@ -4,6 +4,10 @@

 with lib;

+let
+  # the demo agent isn't built by default, but we need it here
+  package = pkgs.geoclue2.override { withDemoAgent = config.services.geoclue2.enableDemoAgent; };
+in
 {

  ###### interface
@ -21,21 +25,42 @@ with lib;
        '';
      };

+      enableDemoAgent = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Whether to use the GeoClue demo agent. This should be
+          overridden by desktop environments that provide their own
+          agent.
+        '';
+      };
+
    };

  };


  ###### implementation
-
  config = mkIf config.services.geoclue2.enable {

-    environment.systemPackages = [ pkgs.geoclue2 ];
+    environment.systemPackages = [ package ];

-    services.dbus.packages = [ pkgs.geoclue2 ];
-
-    systemd.packages = [ pkgs.geoclue2 ];
+    services.dbus.packages = [ package ];

+    systemd.packages = [ package ];
+  
+    # this needs to run as a user service, since it's associated with the
+    # user who is making the requests
+    systemd.user.services = mkIf config.services.geoclue2.enableDemoAgent { 
+      "geoclue-agent" = {
+        description = "Geoclue agent";
+        script = "${package}/libexec/geoclue-2.0/demos/agent";
+        # this should really be `partOf = [ "geoclue.service" ]`, but
+        # we can't be part of a system service, and the agent should
+        # be okay with the main service coming and going
+        wantedBy = [ "default.target" ];
+      };
+    };
  };

 }
--- a/nixos/modules/services/desktops/zeitgeist.nix
+++ b/nixos/modules/services/desktops/zeitgeist.nix
@ -0,0 +1,26 @@
+# Zeitgeist
+
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+{
+  ###### interface
+
+  options = {
+    services.zeitgeist = {
+      enable = mkEnableOption "zeitgeist";
+    };
+  };
+
+  ###### implementation
+
+  config = mkIf config.services.zeitgeist.enable {
+
+    environment.systemPackages = [ pkgs.zeitgeist ];
+
+    services.dbus.packages = [ pkgs.zeitgeist ];
+
+    systemd.packages = [ pkgs.zeitgeist ];
+  };
+}
--- a/nixos/modules/services/logging/syslog-ng.nix
+++ b/nixos/modules/services/logging/syslog-ng.nix
@ -85,9 +85,11 @@ in {
      after = [ "multi-user.target" ]; # makes sure hostname etc is set
      serviceConfig = {
        Type = "notify";
+        PIDFile = pidFile;
        StandardOutput = "null";
        Restart = "on-failure";
        ExecStart = "${cfg.package}/sbin/syslog-ng ${concatStringsSep " " syslogngOptions}";
+        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
      };
    };
  };
--- a/nixos/modules/services/misc/synergy.nix
+++ b/nixos/modules/services/misc/synergy.nix
@ -83,20 +83,20 @@ in

  config = mkMerge [
    (mkIf cfgC.enable {
-      systemd.services."synergy-client" = {
-        after = [ "network.target" ];
+      systemd.user.services."synergy-client" = {
+        after = [ "network.target" "graphical-session.target" ];
        description = "Synergy client";
-        wantedBy = optional cfgC.autoStart "multi-user.target";
+        wantedBy = optional cfgC.autoStart "graphical-session.target";
        path = [ pkgs.synergy ];
        serviceConfig.ExecStart = ''${pkgs.synergy}/bin/synergyc -f ${optionalString (cfgC.screenName != "") "-n ${cfgC.screenName}"} ${cfgC.serverAddress}'';
        serviceConfig.Restart = "on-failure";
      };
    })
    (mkIf cfgS.enable {
-      systemd.services."synergy-server" = {
-        after = [ "network.target" ];
+      systemd.user.services."synergy-server" = {
+        after = [ "network.target" "graphical-session.target" ];
        description = "Synergy server";
-        wantedBy = optional cfgS.autoStart "multi-user.target";
+        wantedBy = optional cfgS.autoStart "graphical-session.target";
        path = [ pkgs.synergy ];
        serviceConfig.ExecStart = ''${pkgs.synergy}/bin/synergys -c ${cfgS.configFile} -f ${optionalString (cfgS.address != "") "-a ${cfgS.address}"} ${optionalString (cfgS.screenName != "") "-n ${cfgS.screenName}" }'';
        serviceConfig.Restart = "on-failure";
--- a/nixos/modules/services/monitoring/datadog-agent.nix
+++ b/nixos/modules/services/monitoring/datadog-agent.nix
@ -0,0 +1,236 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.datadog-agent;
+
+  ddConf = {
+    dd_url              = "https://app.datadoghq.com";
+    skip_ssl_validation = "no";
+    api_key             = "";
+    confd_path          = "/etc/datadog-agent/conf.d";
+    additional_checksd  = "/etc/datadog-agent/checks.d";
+    use_dogstatsd       = "yes";
+  }
+  // optionalAttrs (cfg.logLevel != null) { log_level = cfg.logLevel; }
+  // optionalAttrs (cfg.hostname != null) { inherit (cfg) hostname; }
+  // optionalAttrs (cfg.tags != null ) { tags = concatStringsSep ", " cfg.tags; }
+  // cfg.extraConfig;
+
+  # Generate Datadog configuration files for each configured checks.
+  # This works because check configurations have predictable paths,
+  # and because JSON is a valid subset of YAML.
+  makeCheckConfigs = entries: mapAttrsToList (name: conf: {
+    source = pkgs.writeText "${name}-check-conf.yaml" (builtins.toJSON conf);
+    target = "datadog-agent/conf.d/${name}.d/conf.yaml";
+  }) entries;
+
+  defaultChecks = {
+    disk = cfg.diskCheck;
+    network = cfg.networkCheck;
+  };
+
+  # Assemble all check configurations and the top-level agent
+  # configuration.
+  etcfiles = with pkgs; with builtins; [{
+    source = writeText "datadog.yaml" (toJSON ddConf);
+    target = "datadog-agent/datadog.yaml";
+  }] ++ makeCheckConfigs (cfg.checks // defaultChecks);
+
+  # Apply the configured extraIntegrations to the provided agent
+  # package. See the documentation of `dd-agent/integrations-core.nix`
+  # for detailed information on this.
+  datadogPkg = cfg.package.overrideAttrs(_: {
+    python = (pkgs.datadog-integrations-core cfg.extraIntegrations).python;
+  });
+in {
+  options.services.datadog-agent = {
+    enable = mkOption {
+      description = ''
+        Whether to enable the datadog-agent v6 monitoring service
+      '';
+      default = false;
+      type = types.bool;
+    };
+
+    package = mkOption {
+      default = pkgs.datadog-agent;
+      defaultText = "pkgs.datadog-agent";
+      description = ''
+        Which DataDog v6 agent package to use. Note that the provided
+        package is expected to have an overridable `python`-attribute
+        which configures the Python environment with the Datadog
+        checks.
+      '';
+      type = types.package;
+    };
+
+    apiKeyFile = mkOption {
+      description = ''
+        Path to a file containing the Datadog API key to associate the
+        agent with your account.
+      '';
+      example = "/run/keys/datadog_api_key";
+      type = types.path;
+    };
+
+    tags = mkOption {
+      description = "The tags to mark this Datadog agent";
+      example = [ "test" "service" ];
+      default = null;
+      type = types.nullOr (types.listOf types.str);
+    };
+
+    hostname = mkOption {
+      description = "The hostname to show in the Datadog dashboard (optional)";
+      default = null;
+      example = "mymachine.mydomain";
+      type = types.uniq (types.nullOr types.string);
+    };
+
+    logLevel = mkOption {
+      description = "Logging verbosity.";
+      default = null;
+      type = types.nullOr (types.enum ["DEBUG" "INFO" "WARN" "ERROR"]);
+    };
+
+    extraIntegrations = mkOption {
+      default = {};
+      type    = types.attrs;
+
+      description = ''
+        Extra integrations from the Datadog core-integrations
+        repository that should be built and included.
+
+        By default the included integrations are disk, mongo, network,
+        nginx and postgres.
+
+        To include additional integrations the name of the derivation
+        and a function to filter its dependencies from the Python
+        package set must be provided.
+      '';
+
+      example = {
+        ntp = (pythonPackages: [ pythonPackages.ntplib ]);
+      };
+    };
+
+    extraConfig = mkOption {
+      default = {};
+      type = types.attrs;
+      description = ''
+        Extra configuration options that will be merged into the
+        main config file <filename>datadog.yaml</filename>.
+      '';
+     };
+
+    checks = mkOption {
+      description = ''
+        Configuration for all Datadog checks. Keys of this attribute
+        set will be used as the name of the check to create the
+        appropriate configuration in `conf.d/$check.d/conf.yaml`.
+
+        The configuration is converted into JSON from the plain Nix
+        language configuration, meaning that you should write
+        configuration adhering to Datadog's documentation - but in Nix
+        language.
+
+        Refer to the implementation of this module (specifically the
+        definition of `defaultChecks`) for an example.
+
+        Note: The 'disk' and 'network' check are configured in
+        separate options because they exist by default. Attempting to
+        override their configuration here will have no effect.
+      '';
+
+      example = {
+        http_check = {
+          init_config = null; # sic!
+          instances = [
+            {
+              name = "some-service";
+              url = "http://localhost:1337/healthz";
+              tags = [ "some-service" ];
+            }
+          ];
+        };
+      };
+
+      default = {};
+
+      # sic! The structure of the values is up to the check, so we can
+      # not usefully constrain the type further.
+      type = with types; attrsOf attrs;
+    };
+
+    diskCheck = mkOption {
+      description = "Disk check config";
+      type = types.attrs;
+      default = {
+        init_config = {};
+        instances = [ { use-mount = "no"; } ];
+      };
+    };
+
+    networkCheck = mkOption {
+      description = "Network check config";
+      type = types.attrs;
+      default = {
+        init_config = {};
+        # Network check only supports one configured instance
+        instances = [ { collect_connection_state = false;
+          excluded_interfaces = [ "lo" "lo0" ]; } ];
+      };
+    };
+  };
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ datadogPkg pkgs.sysstat pkgs.procps ];
+
+    users.extraUsers.datadog = {
+      description = "Datadog Agent User";
+      uid = config.ids.uids.datadog;
+      group = "datadog";
+      home = "/var/log/datadog/";
+      createHome = true;
+    };
+
+    users.extraGroups.datadog.gid = config.ids.gids.datadog;
+
+    systemd.services = let
+      makeService = attrs: recursiveUpdate {
+        path = [ datadogPkg pkgs.python pkgs.sysstat pkgs.procps ];
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          User = "datadog";
+          Group = "datadog";
+          Restart = "always";
+          RestartSec = 2;
+          PrivateTmp = true;
+        };
+        restartTriggers = [ datadogPkg ] ++ map (etc: etc.source) etcfiles;
+      } attrs;
+    in {
+      datadog-agent = makeService {
+        description = "Datadog agent monitor";
+        preStart = ''
+          chown -R datadog: /etc/datadog-agent
+          rm -f /etc/datadog-agent/auth_token
+        '';
+        script = ''
+          export DD_API_KEY=$(head -n 1 ${cfg.apiKeyFile})
+          exec ${datadogPkg}/bin/agent start -c /etc/datadog-agent/datadog.yaml
+        '';
+        serviceConfig.PermissionsStartOnly = true;
+      };
+
+      dd-jmxfetch = lib.mkIf (lib.hasAttr "jmx" cfg.checks) (makeService {
+        description = "Datadog JMX Fetcher";
+        path = [ datadogPkg pkgs.python pkgs.sysstat pkgs.procps pkgs.jdk ];
+        serviceConfig.ExecStart = "${datadogPkg}/bin/dd-jmxfetch";
+      });
+    };
+
+    environment.etc = etcfiles;
+  };
+}
--- a/nixos/modules/services/monitoring/dd-agent/dd-agent.nix
+++ b/nixos/modules/services/monitoring/dd-agent/dd-agent.nix
@ -114,13 +114,22 @@ let
 in {
  options.services.dd-agent = {
    enable = mkOption {
-      description = "Whether to enable the dd-agent montioring service";
+      description = ''
+        Whether to enable the dd-agent v5 monitoring service.
+        For datadog-agent v6, see <option>services.datadog-agent.enable</option>.
+      '';
      default = false;
      type = types.bool;
    };

    api_key = mkOption {
-      description = "The Datadog API key to associate the agent with your account";
+      description = ''
+        The Datadog API key to associate the agent with your account.
+
+        Warning: this key is stored in cleartext within the world-readable
+        Nix store! Consider using the new v6
+        <option>services.datadog-agent</option> module instead.
+      '';
      example = "ae0aa6a8f08efa988ba0a17578f009ab";
      type = types.str;
    };
@ -188,48 +197,41 @@ in {

    users.groups.datadog.gid = config.ids.gids.datadog;

-    systemd.services.dd-agent = {
-      description = "Datadog agent monitor";
-      path = [ pkgs."dd-agent" pkgs.python pkgs.sysstat pkgs.procps pkgs.gohai ];
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        ExecStart = "${pkgs.dd-agent}/bin/dd-agent foreground";
-        User = "datadog";
-        Group = "datadog";
-        Restart = "always";
-        RestartSec = 2;
+    systemd.services = let
+      makeService = attrs: recursiveUpdate {
+        path = [ pkgs.dd-agent pkgs.python pkgs.sysstat pkgs.procps pkgs.gohai ];
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          User = "datadog";
+          Group = "datadog";
+          Restart = "always";
+          RestartSec = 2;
+          PrivateTmp = true;
+        };
+        restartTriggers = [ pkgs.dd-agent ddConf diskConfig networkConfig postgresqlConfig nginxConfig mongoConfig jmxConfig processConfig ];
+      } attrs;
+    in {
+      dd-agent = makeService {
+        description = "Datadog agent monitor";
+        serviceConfig.ExecStart = "${pkgs.dd-agent}/bin/dd-agent foreground";
      };
-      restartTriggers = [ pkgs.dd-agent ddConf diskConfig networkConfig postgresqlConfig nginxConfig mongoConfig jmxConfig processConfig ];
-    };

-    systemd.services.dogstatsd = {
-      description = "Datadog statsd";
-      path = [ pkgs."dd-agent" pkgs.python pkgs.procps ];
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        ExecStart = "${pkgs.dd-agent}/bin/dogstatsd start";
-        User = "datadog";
-        Group = "datadog";
-        Type = "forking";
-        PIDFile = "/tmp/dogstatsd.pid";
-        Restart = "always";
-        RestartSec = 2;
+      dogstatsd = makeService {
+        description = "Datadog statsd";
+        environment.TMPDIR = "/run/dogstatsd";
+        serviceConfig = {
+          ExecStart = "${pkgs.dd-agent}/bin/dogstatsd start";
+          Type = "forking";
+          PIDFile = "/run/dogstatsd/dogstatsd.pid";
+          RuntimeDirectory = "dogstatsd";
+        };
      };
-      restartTriggers = [ pkgs.dd-agent ddConf diskConfig networkConfig postgresqlConfig nginxConfig mongoConfig jmxConfig processConfig ];
-    };

-    systemd.services.dd-jmxfetch = lib.mkIf (cfg.jmxConfig != null) {
-      description = "Datadog JMX Fetcher";
-      path = [ pkgs."dd-agent" pkgs.python pkgs.sysstat pkgs.procps pkgs.jdk ];
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        ExecStart = "${pkgs.dd-agent}/bin/dd-jmxfetch";
-        User = "datadog";
-        Group = "datadog";
-        Restart = "always";
-        RestartSec = 2;
+      dd-jmxfetch = lib.mkIf (cfg.jmxConfig != null) {
+        description = "Datadog JMX Fetcher";
+        path = [ pkgs.dd-agent pkgs.python pkgs.sysstat pkgs.procps pkgs.jdk ];
+        serviceConfig.ExecStart = "${pkgs.dd-agent}/bin/dd-jmxfetch";
      };
-      restartTriggers = [ pkgs.dd-agent ddConf diskConfig networkConfig postgresqlConfig nginxConfig mongoConfig jmxConfig ];
    };

    environment.etc = etcfiles;
--- a/nixos/modules/services/network-filesystems/samba.nix
+++ b/nixos/modules/services/network-filesystems/samba.nix
@ -214,12 +214,10 @@ in
            }
          ];
        # Always provide a smb.conf to shut up programs like smbclient and smbspool.
-        environment.etc = singleton
-          { source =
-              if cfg.enable then configFile
-              else pkgs.writeText "smb-dummy.conf" "# Samba is disabled.";
-            target = "samba/smb.conf";
-          };
+        environment.etc."samba/smb.conf".source = mkOptionDefault (
+          if cfg.enable then configFile
+          else pkgs.writeText "smb-dummy.conf" "# Samba is disabled."
+        );
      }

      (mkIf cfg.enable {
--- a/nixos/modules/services/networking/dhcpcd.nix
+++ b/nixos/modules/services/networking/dhcpcd.nix
@ -161,8 +161,8 @@ in
      { description = "DHCP Client";

        wantedBy = [ "multi-user.target" ] ++ optional (!hasDefaultGatewaySet) "network-online.target";
-        after = [ "network.target" ];
        wants = [ "network.target" ];
+        before = [ "network.target" ];

        # Stopping dhcpcd during a reconfiguration is undesirable
        # because it brings down the network interfaces configured by
--- a/nixos/modules/services/system/localtime.nix
+++ b/nixos/modules/services/system/localtime.nix
@ -22,14 +22,8 @@ in {
  config = mkIf cfg.enable {
    services.geoclue2.enable = true;

-    security.polkit.extraConfig = ''
-     polkit.addRule(function(action, subject) {
-       if (action.id == "org.freedesktop.timedate1.set-timezone"
-           && subject.user == "localtimed") {
-         return polkit.Result.YES;
-       }
-     });
-    '';
+    # so polkit will pick up the rules
+    environment.systemPackages = [ pkgs.localtime ];

    users.users = [{
      name = "localtimed";
--- a/nixos/modules/services/web-servers/hydron.nix
+++ b/nixos/modules/services/web-servers/hydron.nix
@ -16,10 +16,10 @@ in with lib; {

    interval = mkOption {
      type = types.str;
-      default = "hourly";
+      default = "weekly";
      example = "06:00";
      description = ''
-        How often we run hydron import and possibly fetch tags. Runs by default every hour.
+        How often we run hydron import and possibly fetch tags. Runs by default every week.

        The format is described in
        <citerefentry><refentrytitle>systemd.time</refentrytitle>
@ -137,9 +137,13 @@ in with lib; {

    systemd.timers.hydron-fetch = {
      description = "Automatically import paths into hydron and possibly fetch tags";
-      after = [ "network.target" ];
+      after = [ "network.target" "hydron.service" ];
      wantedBy = [ "timers.target" ];
-      timerConfig.OnCalendar = cfg.interval;
+      
+      timerConfig = {
+        Persistent = true;
+        OnCalendar = cfg.interval;
+      };
    };

    users = {
--- a/nixos/modules/services/x11/desktop-managers/gnome3.nix
+++ b/nixos/modules/services/x11/desktop-managers/gnome3.nix
@ -97,6 +97,8 @@ in {
    services.udisks2.enable = true;
    services.accounts-daemon.enable = true;
    services.geoclue2.enable = mkDefault true;
+    # GNOME should have its own geoclue agent
+    services.geoclue2.enableDemoAgent = false;
    services.dleyna-renderer.enable = mkDefault true;
    services.dleyna-server.enable = mkDefault true;
    services.gnome3.at-spi2-core.enable = true;
--- a/nixos/modules/services/x11/display-managers/lightdm.nix
+++ b/nixos/modules/services/x11/display-managers/lightdm.nix
@ -15,7 +15,7 @@ let

  inherit (pkgs) lightdm writeScript writeText;

-  # lightdm runs with clearenv(), but we need a few things in the enviornment for X to startup
+  # lightdm runs with clearenv(), but we need a few things in the environment for X to startup
  xserverWrapper = writeScript "xserver-wrapper"
    ''
      #! ${pkgs.bash}/bin/bash
@ -209,9 +209,12 @@ in
    services.dbus.enable = true;
    services.dbus.packages = [ lightdm ];

-    # lightdm uses the accounts daemon to rember language/window-manager per user
+    # lightdm uses the accounts daemon to remember language/window-manager per user
    services.accounts-daemon.enable = true;

+    # Enable the accounts daemon to find lightdm's dbus interface
+    environment.systemPackages = [ lightdm ];
+
    security.pam.services.lightdm = {
      allowNullPassword = true;
      startSession = true;
--- a/nixos/modules/services/x11/redshift.nix
+++ b/nixos/modules/services/x11/redshift.nix
@ -116,6 +116,9 @@ in {
      }
    ];

+    # needed so that .desktop files are installed, which geoclue cares about
+    environment.systemPackages = [ cfg.package ];
+
    services.geoclue2.enable = mkIf (cfg.provider == "geoclue2") true;

    systemd.user.services.redshift = 
--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@ -11,17 +11,29 @@ let
  checkLink = checkUnitConfig "Link" [
    (assertOnlyFields [
      "Description" "Alias" "MACAddressPolicy" "MACAddress" "NamePolicy" "Name"
-      "MTUBytes" "BitsPerSecond" "Duplex" "WakeOnLan"
+      "MTUBytes" "BitsPerSecond" "Duplex" "AutoNegotiation" "WakeOnLan" "Port"
+      "TCPSegmentationOffload" "TCP6SegmentationOffload" "GenericSegmentationOffload"
+      "GenericReceiveOffload" "LargeReceiveOffload" "RxChannels" "TxChannels"
+      "OtherChannels" "CombinedChannels"
    ])
-    (assertValueOneOf "MACAddressPolicy" ["persistent" "random"])
+    (assertValueOneOf "MACAddressPolicy" ["persistent" "random" "none"])
    (assertMacAddress "MACAddress")
-    (assertValueOneOf "NamePolicy" [
-      "kernel" "database" "onboard" "slot" "path" "mac"
-    ])
    (assertByteFormat "MTUBytes")
    (assertByteFormat "BitsPerSecond")
    (assertValueOneOf "Duplex" ["half" "full"])
-    (assertValueOneOf "WakeOnLan" ["phy" "magic" "off"])
+    (assertValueOneOf "AutoNegotiation" boolValues)
+    (assertValueOneOf "WakeOnLan" ["phy" "unicast" "multicast" "broadcast" "arp" "magic" "secureon" "off"])
+    (assertValueOneOf "Port" ["tp" "aui" "bnc" "mii" "fibre"])
+    (assertValueOneOf "TCPSegmentationOffload" boolValues)
+    (assertValueOneOf "TCP6SegmentationOffload" boolValues)
+    (assertValueOneOf "GenericSegmentationOffload" boolValues)
+    (assertValueOneOf "UDPSegmentationOffload" boolValues)
+    (assertValueOneOf "GenericReceiveOffload" boolValues)
+    (assertValueOneOf "LargeReceiveOffload" boolValues)
+    (range "RxChannels" 1 4294967295)
+    (range "TxChannels" 1 4294967295)
+    (range "OtherChannels" 1 4294967295)
+    (range "CombinedChannels" 1 4294967295)
  ];

  checkNetdev = checkUnitConfig "Netdev" [
@ -31,16 +43,21 @@ let
    (assertHasField "Name")
    (assertHasField "Kind")
    (assertValueOneOf "Kind" [
-      "bridge" "bond" "vlan" "macvlan" "vxlan" "ipip"
-      "gre" "sit" "vti" "veth" "tun" "tap" "dummy"
+      "bond" "bridge" "dummy" "gre" "gretap" "ip6gre" "ip6tnl" "ip6gretap" "ipip"
+      "ipvlan" "macvlan" "macvtap" "sit" "tap" "tun" "veth" "vlan" "vti" "vti6"
+      "vxlan" "geneve" "vrf" "vcan" "vxcan" "wireguard" "netdevsim"
    ])
    (assertByteFormat "MTUBytes")
    (assertMacAddress "MACAddress")
  ];

  checkVlan = checkUnitConfig "VLAN" [
-    (assertOnlyFields ["Id"])
+    (assertOnlyFields ["Id" "GVRP" "MVRP" "LooseBinding" "ReorderHeader"])
    (assertRange "Id" 0 4094)
+    (assertValueOneOf "GVRP" boolValues)
+    (assertValueOneOf "MVRP" boolValues)
+    (assertValueOneOf "LooseBinding" boolValues)
+    (assertValueOneOf "ReorderHeader" boolValues)
  ];

  checkMacvlan = checkUnitConfig "MACVLAN" [
@ -49,15 +66,41 @@ let
  ];

  checkVxlan = checkUnitConfig "VXLAN" [
-    (assertOnlyFields ["Id" "Group" "TOS" "TTL" "MacLearning"])
+    (assertOnlyFields [
+      "Id" "Remote" "Local" "TOS" "TTL" "MacLearning" "FDBAgeingSec"
+      "MaximumFDBEntries" "ReduceARPProxy" "L2MissNotification"
+      "L3MissNotification" "RouteShortCircuit" "UDPChecksum"
+      "UDP6ZeroChecksumTx" "UDP6ZeroChecksumRx" "RemoteChecksumTx"
+      "RemoteChecksumRx" "GroupPolicyExtension" "DestinationPort" "PortRange"
+      "FlowLabel"
+    ])
    (assertRange "TTL" 0 255)
    (assertValueOneOf "MacLearning" boolValues)
+    (assertValueOneOf "ReduceARPProxy" boolValues)
+    (assertValueOneOf "L2MissNotification" boolValues)
+    (assertValueOneOf "L3MissNotification" boolValues)
+    (assertValueOneOf "RouteShortCircuit" boolValues)
+    (assertValueOneOf "UDPChecksum" boolValues)
+    (assertValueOneOf "UDP6ZeroChecksumTx" boolValues)
+    (assertValueOneOf "UDP6ZeroChecksumRx" boolValues)
+    (assertValueOneOf "RemoteChecksumTx" boolValues)
+    (assertValueOneOf "RemoteChecksumRx" boolValues)
+    (assertValueOneOf "GroupPolicyExtension" boolValues)
+    (assertRange "FlowLabel" 0 1048575)
  ];

  checkTunnel = checkUnitConfig "Tunnel" [
-    (assertOnlyFields ["Local" "Remote" "TOS" "TTL" "DiscoverPathMTU"])
+    (assertOnlyFields [
+      "Local" "Remote" "TOS" "TTL" "DiscoverPathMTU" "IPv6FlowLabel" "CopyDSCP"
+      "EncapsulationLimit" "Key" "InputKey" "OutputKey" "Mode" "Independent"
+      "AllowLocalRemote"
+    ])
    (assertRange "TTL" 0 255)
    (assertValueOneOf "DiscoverPathMTU" boolValues)
+    (assertValueOneOf "CopyDSCP" boolValues)
+    (assertValueOneOf "Mode" ["ip6ip6" "ipip6" "any"])
+    (assertValueOneOf "Independent" boolValues)
+    (assertValueOneOf "AllowLocalRemote" boolValues)
  ];

  checkPeer = checkUnitConfig "Peer" [
@ -66,10 +109,11 @@ let
  ];

  tunTapChecks = [
-    (assertOnlyFields ["OneQueue" "MultiQueue" "PacketInfo" "User" "Group"])
+    (assertOnlyFields ["OneQueue" "MultiQueue" "PacketInfo" "VNetHeader" "User" "Group"])
    (assertValueOneOf "OneQueue" boolValues)
    (assertValueOneOf "MultiQueue" boolValues)
    (assertValueOneOf "PacketInfo" boolValues)
+    (assertValueOneOf "VNetHeader" boolValues)
  ];

  checkTun = checkUnitConfig "Tun" tunTapChecks;
@ -79,67 +123,121 @@ let
  checkBond = checkUnitConfig "Bond" [
    (assertOnlyFields [
      "Mode" "TransmitHashPolicy" "LACPTransmitRate" "MIIMonitorSec"
-      "UpDelaySec" "DownDelaySec" "GratuitousARP"
+      "UpDelaySec" "DownDelaySec" "LearnPacketIntervalSec" "AdSelect"
+      "FailOverMACPolicy" "ARPValidate" "ARPIntervalSec" "ARPIPTargets"
+      "ARPAllTargets" "PrimaryReselectPolicy" "ResendIGMP" "PacketsPerSlave"
+      "GratuitousARP" "AllSlavesActive" "MinLinks"
    ])
    (assertValueOneOf "Mode" [
      "balance-rr" "active-backup" "balance-xor"
      "broadcast" "802.3ad" "balance-tlb" "balance-alb"
    ])
    (assertValueOneOf "TransmitHashPolicy" [
-      "layer2" "layer3+4" "layer2+3" "encap2+3" "802.3ad" "encap3+4"
+      "layer2" "layer3+4" "layer2+3" "encap2+3" "encap3+4"
    ])
    (assertValueOneOf "LACPTransmitRate" ["slow" "fast"])
+    (assertValueOneOf "AdSelect" ["stable" "bandwidth" "count"])
+    (assertValueOneOf "FailOverMACPolicy" ["none" "active" "follow"])
+    (assertValueOneOf "ARPValidate" ["none" "active" "backup" "all"])
+    (assertValueOneOf "ARPAllTargets" ["any" "all"])
+    (assertValueOneOf "PrimaryReselectPolicy" ["always" "better" "failure"])
+    (assertRange "ResendIGMP" 0 255)
+    (assertRange "PacketsPerSlave" 0 65535)
+    (assertRange "GratuitousARP" 0 255)
+    (assertValueOneOf "AllSlavesActive" boolValues)
  ];

  checkNetwork = checkUnitConfig "Network" [
    (assertOnlyFields [
-      "Description" "DHCP" "DHCPServer" "IPForward" "IPMasquerade" "IPv4LL" "IPv4LLRoute"
-      "LLMNR" "MulticastDNS" "Domains" "Bridge" "Bond" "IPv6PrivacyExtensions"
+      "Description" "DHCP" "DHCPServer" "LinkLocalAddressing" "IPv4LLRoute"
+      "IPv6Token" "LLMNR" "MulticastDNS" "DNSOverTLS" "DNSSEC"
+      "DNSSECNegativeTrustAnchors" "LLDP" "EmitLLDP" "BindCarrier" "Address"
+      "Gateway" "DNS" "Domains" "NTP" "IPForward" "IPMasquerade"
+      "IPv6PrivacyExtensions" "IPv6AcceptRA" "IPv6DuplicateAddressDetection"
+      "IPv6HopLimit" "IPv4ProxyARP" "IPv6ProxyNDP" "IPv6ProxyNDPAddress"
+      "IPv6PrefixDelegation" "IPv6MTUBytes" "Bridge" "Bond" "VRF" "VLAN"
+      "IPVLAN" "MACVLAN" "VXLAN" "Tunnel" "ActiveSlave" "PrimarySlave"
+      "ConfigureWithoutCarrier"
    ])
-    (assertValueOneOf "DHCP" ["both" "none" "v4" "v6"])
+    # Note: For DHCP the values both, none, v4, v6 are deprecated
+    (assertValueOneOf "DHCP" ["yes" "no" "ipv4" "ipv6" "both" "none" "v4" "v6"])
    (assertValueOneOf "DHCPServer" boolValues)
+    (assertValueOneOf "LinkLocalAddressing" ["yes" "no" "ipv4" "ipv6"])
+    (assertValueOneOf "IPv4LLRoute" boolValues)
+    (assertValueOneOf "LLMNR" ["yes" "resolve" "no"])
+    (assertValueOneOf "MulticastDNS" ["yes" "resolve" "no"])
+    (assertValueOneOf "DNSOverTLS" ["opportunistic" "no"])
+    (assertValueOneOf "DNSSEC" ["yes" "allow-downgrade" "no"])
+    (assertValueOneOf "LLDP" ["yes" "routers-only" "no"])
+    (assertValueOneOf "EmitLLDP" ["yes" "no" "nearest-bridge" "non-tpmr-bridge" "customer-bridge"])
    (assertValueOneOf "IPForward" ["yes" "no" "ipv4" "ipv6"])
    (assertValueOneOf "IPMasquerade" boolValues)
-    (assertValueOneOf "IPv4LL" boolValues)
-    (assertValueOneOf "IPv4LLRoute" boolValues)
-    (assertValueOneOf "LLMNR" boolValues)
-    (assertValueOneOf "MulticastDNS" boolValues)
    (assertValueOneOf "IPv6PrivacyExtensions" ["yes" "no" "prefer-public" "kernel"])
+    (assertValueOneOf "IPv6AcceptRA" boolValues)
+    (assertValueOneOf "IPv4ProxyARP" boolValues)
+    (assertValueOneOf "IPv6ProxyNDP" boolValues)
+    (assertValueOneOf "IPv6PrefixDelegation" boolValues)
+    (assertValueOneOf "ActiveSlave" boolValues)
+    (assertValueOneOf "PrimarySlave" boolValues)
+    (assertValueOneOf "ConfigureWithoutCarrier" boolValues)
  ];

  checkAddress = checkUnitConfig "Address" [
-    (assertOnlyFields ["Address" "Peer" "Broadcast" "Label"])
+    (assertOnlyFields [
+      "Address" "Peer" "Broadcast" "Label" "PreferredLifetime" "Scope"
+      "HomeAddress" "DuplicateAddressDetection" "ManageTemporaryAddress"
+      "PrefixRoute" "AutoJoin"
+    ])
    (assertHasField "Address")
+    (assertValueOneOf "PreferredLifetime" ["forever" "infinity" "0" 0])
+    (assertValueOneOf "HomeAddress" boolValues)
+    (assertValueOneOf "DuplicateAddressDetection" boolValues)
+    (assertValueOneOf "ManageTemporaryAddress" boolValues)
+    (assertValueOneOf "PrefixRoute" boolValues)
+    (assertValueOneOf "AutoJoin" boolValues)
  ];

  checkRoute = checkUnitConfig "Route" [
-    (assertOnlyFields ["Gateway" "Destination" "Metric"])
+    (assertOnlyFields [
+      "Gateway" "GatewayOnlink" "Destination" "Source" "Metric"
+      "IPv6Preference" "Scope" "PreferredSource" "Table" "Protocol" "Type"
+      "InitialCongestionWindow" "InitialAdvertisedReceiveWindow" "QuickAck"
+      "MTUBytes"
+    ])
    (assertHasField "Gateway")
  ];

  checkDhcp = checkUnitConfig "DHCP" [
    (assertOnlyFields [
-      "UseDNS" "UseMTU" "SendHostname" "UseHostname" "UseDomains" "UseRoutes"
-      "CriticalConnections" "VendorClassIdentifier" "RequestBroadcast"
-      "RouteMetric"
+      "UseDNS" "UseNTP" "UseMTU" "Anonymize" "SendHostname" "UseHostname"
+      "Hostname" "UseDomains" "UseRoutes" "UseTimezone" "CriticalConnection"
+      "ClientIdentifier" "VendorClassIdentifier" "UserClass" "DUIDType"
+      "DUIDRawData" "IAID" "RequestBroadcast" "RouteMetric" "RouteTable"
+      "ListenPort" "RapidCommit"
    ])
    (assertValueOneOf "UseDNS" boolValues)
+    (assertValueOneOf "UseNTP" boolValues)
    (assertValueOneOf "UseMTU" boolValues)
+    (assertValueOneOf "Anonymize" boolValues)
    (assertValueOneOf "SendHostname" boolValues)
    (assertValueOneOf "UseHostname" boolValues)
-    (assertValueOneOf "UseDomains" boolValues)
+    (assertValueOneOf "UseDomains" ["yes" "no" "route"])
    (assertValueOneOf "UseRoutes" boolValues)
-    (assertValueOneOf "CriticalConnections" boolValues)
+    (assertValueOneOf "UseTimezone" boolValues)
+    (assertValueOneOf "CriticalConnection" boolValues)
    (assertValueOneOf "RequestBroadcast" boolValues)
+    (assertRange "RouteTable" 0 4294967295)
+    (assertValueOneOf "RapidCommit" boolValues)
  ];

  checkDhcpServer = checkUnitConfig "DHCPServer" [
    (assertOnlyFields [
      "PoolOffset" "PoolSize" "DefaultLeaseTimeSec" "MaxLeaseTimeSec"
-      "EmitDNS" "DNS" "EmitNTP" "NTP" "EmitTimezone" "Timezone"
+      "EmitDNS" "DNS" "EmitNTP" "NTP" "EmitRouter" "EmitTimezone" "Timezone"
    ])
    (assertValueOneOf "EmitDNS" boolValues)
    (assertValueOneOf "EmitNTP" boolValues)
+    (assertValueOneOf "EmitRouter" boolValues)
    (assertValueOneOf "EmitTimezone" boolValues)
  ];

@ -461,6 +559,36 @@ let
      '';
    };

+    bridge = mkOption {
+      default = [ ];
+      type = types.listOf types.str;
+      description = ''
+        A list of bridge interfaces to be added to the network section of the
+        unit.  See <citerefentry><refentrytitle>systemd.network</refentrytitle>
+        <manvolnum>5</manvolnum></citerefentry> for details.
+      '';
+    };
+
+    bond = mkOption {
+      default = [ ];
+      type = types.listOf types.str;
+      description = ''
+        A list of bond interfaces to be added to the network section of the
+        unit.  See <citerefentry><refentrytitle>systemd.network</refentrytitle>
+        <manvolnum>5</manvolnum></citerefentry> for details.
+      '';
+    };
+
+    vrf = mkOption {
+      default = [ ];
+      type = types.listOf types.str;
+      description = ''
+        A list of vrf interfaces to be added to the network section of the
+        unit.  See <citerefentry><refentrytitle>systemd.network</refentrytitle>
+        <manvolnum>5</manvolnum></citerefentry> for details.
+      '';
+    };
+
    vlan = mkOption {
      default = [ ];
      type = types.listOf types.str;
@ -619,6 +747,9 @@ let
          ${concatStringsSep "\n" (map (s: "Gateway=${s}") def.gateway)}
          ${concatStringsSep "\n" (map (s: "DNS=${s}") def.dns)}
          ${concatStringsSep "\n" (map (s: "NTP=${s}") def.ntp)}
+          ${concatStringsSep "\n" (map (s: "Bridge=${s}") def.bridge)}
+          ${concatStringsSep "\n" (map (s: "Bond=${s}") def.bond)}
+          ${concatStringsSep "\n" (map (s: "VRF=${s}") def.vrf)}
          ${concatStringsSep "\n" (map (s: "VLAN=${s}") def.vlan)}
          ${concatStringsSep "\n" (map (s: "MACVLAN=${s}") def.macvlan)}
          ${concatStringsSep "\n" (map (s: "VXLAN=${s}") def.vxlan)}
--- a/nixos/modules/tasks/filesystems/zfs.nix
+++ b/nixos/modules/tasks/filesystems/zfs.nix
@ -23,12 +23,8 @@ let

  kernel = config.boot.kernelPackages;

-  packages = if config.boot.zfs.enableLegacyCrypto then {
-    spl = kernel.splLegacyCrypto;
-    zfs = kernel.zfsLegacyCrypto;
-    zfsUser = pkgs.zfsLegacyCrypto;
-  } else if config.boot.zfs.enableUnstable then {
-    spl = kernel.splUnstable;
+  packages = if config.boot.zfs.enableUnstable then {
+    spl = null;
    zfs = kernel.zfsUnstable;
    zfsUser = pkgs.zfsUnstable;
  } else {
@ -117,27 +113,6 @@ in
          '';
      };

-      enableLegacyCrypto = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Enabling this option will allow you to continue to use the old format for
-          encrypted datasets. With the inclusion of stability patches the format of
-          encrypted datasets has changed. They can still be accessed and mounted but
-          in read-only mode mounted. It is highly recommended to convert them to
-          the new format.
-
-          This option is only for convenience to people that cannot convert their
-          datasets to the new format yet and it will be removed in due time.
-
-          For migration strategies from old format to this new one, check the Wiki:
-          https://nixos.wiki/wiki/NixOS_on_ZFS#Encrypted_Dataset_Format_Change
-
-          See https://github.com/zfsonlinux/zfs/pull/6864 for more details about
-          the stability patches.
-          '';
-      };
-
      extraPools = mkOption {
        type = types.listOf types.str;
        default = [];
@ -350,12 +325,12 @@ in
      virtualisation.lxd.zfsSupport = true;

      boot = {
-        kernelModules = [ "spl" "zfs" ] ;
-        extraModulePackages = with packages; [ spl zfs ];
+        kernelModules = [ "zfs" ] ++ optional (!cfgZfs.enableUnstable) "spl";
+        extraModulePackages = with packages; [ zfs ] ++ optional (!cfgZfs.enableUnstable) spl;
      };

      boot.initrd = mkIf inInitrd {
-        kernelModules = [ "spl" "zfs" ];
+        kernelModules = [ "zfs" ] ++ optional (!cfgZfs.enableUnstable) "spl";
        extraUtilsCommands =
          ''
            copy_bin_and_libs ${packages.zfsUser}/sbin/zfs
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@ -156,9 +156,6 @@ let
            --partition-guid=2:970C694F-AFD0-4B99-B750-CDB7A329AB6F \
            --hybrid 2 \
            --recompute-chs /dev/vda
-          . /sys/class/block/vda2/uevent
-          mknod /dev/vda2 b $MAJOR $MINOR
-          . /sys/class/block/vda/uevent
          ${pkgs.dosfstools}/bin/mkfs.fat -F16 /dev/vda2
          export MTOOLS_SKIP_CHECK=1
          ${pkgs.mtools}/bin/mlabel -i /dev/vda2 ::boot
--- a/nixos/modules/virtualisation/virtualbox-host.nix
+++ b/nixos/modules/virtualisation/virtualbox-host.nix
@ -6,7 +6,8 @@ let
  cfg = config.virtualisation.virtualbox.host;

  virtualbox = cfg.package.override {
-    inherit (cfg) enableExtensionPack enableHardening headless;
+    inherit (cfg) enableHardening headless;
+    extensionPack = if cfg.enableExtensionPack then pkgs.virtualboxExtpack else null;
  };

  kernelModules = config.boot.kernelPackages.virtualbox.override {
@ -28,6 +29,17 @@ in
      '';
    };

+    enableExtensionPack = mkEnableOption "VirtualBox extension pack" // {
+      description = ''
+        Whether to install the Oracle Extension Pack for VirtualBox.
+
+        <important><para>
+          You must set <literal>nixpkgs.config.allowUnfree = true</literal> in
+          order to use this.  This requires you accept the VirtualBox PUEL.
+        </para></important>
+      '';
+    };
+
    package = mkOption {
      type = types.package;
      default = pkgs.virtualbox;
@ -45,8 +57,6 @@ in
      '';
    };

-    enableExtensionPack = mkEnableOption "VirtualBox extension pack";
-
    enableHardening = mkOption {
      type = types.bool;
      default = true;
--- a/nixos/tests/hydra/default.nix
+++ b/nixos/tests/hydra/default.nix
@ -2,14 +2,11 @@ import ../make-test.nix ({ pkgs, ...} :

 let
   trivialJob = pkgs.writeTextDir "trivial.nix" ''
-     with import <nix/config.nix>;
-
     { trivial = builtins.derivation {
         name = "trivial";
         system = "x86_64-linux";
-         PATH = coreutils;
-         builder = shell;
-         args = ["-c" "touch $out; exit 0"];
+         builder = "/bin/sh";
+         args = ["-c" "echo success > $out; exit 0"];
       };
     }
   '';
@ -27,7 +24,7 @@ let
 in {
  name = "hydra-init-localdb";
  meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ pstn lewo ];
+    maintainers = [ pstn lewo ma27 ];
  };

  machine =
@ -50,6 +47,8 @@ in {
          hostName = "localhost";
          systems = [ "x86_64-linux" ];
        }];
+
+        binaryCaches = [];
      };
    };

@ -74,5 +73,5 @@ in {
      $machine->succeed("create-trivial-project.sh");

      $machine->waitUntilSucceeds('curl -L -s http://localhost:3000/build/1 -H "Accept: application/json" |  jq .buildstatus | xargs test 0 -eq');
-     '';
+    '';
 })
--- a/nixos/tests/virtualbox.nix
+++ b/nixos/tests/virtualbox.nix
@ -293,6 +293,11 @@ let
    "--hostonlyadapter2 vboxnet0"
  ];

+  # The VirtualBox Oracle Extension Pack lets you use USB 3.0 (xHCI).
+  enableExtensionPackVMFlags = [
+    "--usbxhci on"
+  ];
+
  dhcpScript = pkgs: ''
    ${pkgs.dhcp}/bin/dhclient \
      -lf /run/dhcp.leases \
@ -323,13 +328,17 @@ let
    headless.services.xserver.enable = false;
  };

-  mkVBoxTest = name: testScript: makeTest {
+  vboxVMsWithExtpack = mapAttrs createVM {
+    testExtensionPack.vmFlags = enableExtensionPackVMFlags;
+  };
+
+  mkVBoxTest = useExtensionPack: vms: name: testScript: makeTest {
    name = "virtualbox-${name}";

    machine = { lib, config, ... }: {
      imports = let
        mkVMConf = name: val: val.machine // { key = "${name}-config"; };
-        vmConfigs = mapAttrsToList mkVMConf vboxVMs;
+        vmConfigs = mapAttrsToList mkVMConf vms;
      in [ ./common/user-account.nix ./common/x11.nix ] ++ vmConfigs;
      virtualisation.memorySize = 2048;
      virtualisation.virtualbox.host.enable = true;
@ -337,6 +346,8 @@ let
      users.users.alice.extraGroups = let
        inherit (config.virtualisation.virtualbox.host) enableHardening;
      in lib.mkIf enableHardening (lib.singleton "vboxusers");
+      virtualisation.virtualbox.host.enableExtensionPack = useExtensionPack;
+      nixpkgs.config.allowUnfree = useExtensionPack;
    };

    testScript = ''
@ -353,7 +364,7 @@ let
        return join("\n", grep { $_ !~ /^UUID:/ } split(/\n/, $_[0]))."\n";
      }

-      ${concatStrings (mapAttrsToList (_: getAttr "testSubs") vboxVMs)}
+      ${concatStrings (mapAttrsToList (_: getAttr "testSubs") vms)}

      $machine->waitForX;

@ -363,11 +374,11 @@ let
    '';

    meta = with pkgs.stdenv.lib.maintainers; {
-      maintainers = [ aszlig wkennington ];
+      maintainers = [ aszlig wkennington cdepillabout ];
    };
  };

-in mapAttrs mkVBoxTest {
+in mapAttrs (mkVBoxTest false vboxVMs) {
  simple-gui = ''
    createVM_simple;
    $machine->succeed(ru "VirtualBox &");
@ -473,4 +484,22 @@ in mapAttrs mkVBoxTest {
    destroyVM_test1;
    destroyVM_test2;
  '';
+} // mapAttrs (mkVBoxTest true vboxVMsWithExtpack) {
+  enable-extension-pack = ''
+    createVM_testExtensionPack;
+    vbm("startvm testExtensionPack");
+    waitForStartup_testExtensionPack;
+    $machine->screenshot("cli_started");
+    waitForVMBoot_testExtensionPack;
+    $machine->screenshot("cli_booted");
+
+    $machine->nest("Checking for privilege escalation", sub {
+      $machine->fail("test -e '/root/VirtualBox VMs'");
+      $machine->fail("test -e '/root/.config/VirtualBox'");
+      $machine->succeed("test -e '/home/alice/VirtualBox VMs'");
+    });
+
+    shutdownVM_testExtensionPack;
+    destroyVM_testExtensionPack;
+  '';
 }
--- a/pkgs/applications/audio/mimic/default.nix
+++ b/pkgs/applications/audio/mimic/default.nix
@ -0,0 +1,35 @@
+{ stdenv, autoreconfHook, fetchFromGitHub, pkgconfig
+, alsaLib, libtool, icu
+, pulseaudioSupport ? true, libpulseaudio }:
+
+stdenv.mkDerivation rec {
+  name = "mimic-${version}";
+  version = "1.2.0.2";
+
+  src = fetchFromGitHub {
+    rev = version;
+    repo = "mimic";
+    owner = "MycroftAI";
+    sha256 = "1wkpbwk88lsahzkc7pzbznmyy0lc02vsp0vkj8f1ags1gh0lc52j";
+  };
+
+  nativeBuildInputs = [ 
+    autoreconfHook
+    pkgconfig
+  ];
+
+  buildInputs = [
+    alsaLib
+    libtool
+    icu 
+  ] ++ stdenv.lib.optional pulseaudioSupport libpulseaudio;
+
+  meta = {
+    description = "Mycroft's TTS engine, based on CMU's Flite (Festival Lite)";
+    homepage = https://mimic.mycroft.ai/; 
+    license = stdenv.lib.licenses.free;
+    platforms = stdenv.lib.platforms.linux;
+    maintainers = [ stdenv.lib.maintainers.noneucat ]; 
+  };
+}
+
--- a/pkgs/applications/audio/pulseeffects/default.nix
+++ b/pkgs/applications/audio/pulseeffects/default.nix
@ -29,6 +29,7 @@
 , zam-plugins
 , rubberband
 , mda_lv2
+, hicolor-icon-theme
 }:

 let
@ -42,13 +43,13 @@ let
  ];
 in stdenv.mkDerivation rec {
  name = "pulseeffects-${version}";
-  version = "4.2.6";
+  version = "4.2.8";

  src = fetchFromGitHub {
    owner = "wwmm";
    repo = "pulseeffects";
    rev = "v${version}";
-    sha256 = "1b5h760bb1wgn4avirjjri5fcfqvnsr076qnhrdiqcic3vgircsm";
+    sha256 = "0ckl0640n6lhk0gcmnmwngajkf46rrd8bxfh7xy5sq6qmm01dhdd";
  };

  nativeBuildInputs = [
@ -79,6 +80,7 @@ in stdenv.mkDerivation rec {
    boost
    fftwFloat
    zita-convolver
+    hicolor-icon-theme
  ];

  postPatch = ''
--- a/pkgs/applications/audio/snd/default.nix
+++ b/pkgs/applications/audio/snd/default.nix
@ -4,11 +4,11 @@
 }:

 stdenv.mkDerivation rec {
-  name = "snd-18.5";
+  name = "snd-18.6";

  src = fetchurl {
    url = "mirror://sourceforge/snd/${name}.tar.gz";
-    sha256 = "1m2rw1p9xr9428p9drd3w5irsi12lz23m605lzgk9gjamq9paywy";
+    sha256 = "1jyqkkz2a6zw0jn9y15xd3027r8glkpw794fjk6hd3al1byjhz2z";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/applications/display-managers/lightdm/gtk-greeter.nix
+++ b/pkgs/applications/display-managers/lightdm/gtk-greeter.nix
@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ lightdm exo intltool makeWrapper ]
+  buildInputs = [ lightdm exo intltool makeWrapper hicolor-icon-theme ]
    ++ (if useGTK2 then [ gtk2 ] else [ gtk3 ]);

  configureFlags = [
--- a/pkgs/applications/editors/emacs/default.nix
+++ b/pkgs/applications/editors/emacs/default.nix
@ -1,11 +1,12 @@
 { stdenv, lib, fetchurl, ncurses, xlibsWrapper, libXaw, libXpm, Xaw3d
 , pkgconfig, gettext, libXft, dbus, libpng, libjpeg, libungif
 , libtiff, librsvg, gconf, libxml2, imagemagick, gnutls, libselinux
-, alsaLib, cairo, acl, gpm, AppKit, GSS, ImageIO
+, alsaLib, cairo, acl, gpm, AppKit, GSS, ImageIO, m17n_lib, libotf
+, systemd ? null
 , withX ? !stdenv.isDarwin
 , withGTK2 ? false, gtk2 ? null
 , withGTK3 ? true, gtk3 ? null, gsettings-desktop-schemas ? null
-, withXwidgets ? false, webkitgtk24x-gtk3 ? null, wrapGAppsHook ? null, glib-networking ? null
+, withXwidgets ? false, webkitgtk ? null, wrapGAppsHook ? null, glib-networking ? null
 , withCsrc ? true
 , srcRepo ? false, autoconf ? null, automake ? null, texinfo ? null
 }:
@ -16,7 +17,7 @@ assert withGTK2 -> withX || stdenv.isDarwin;
 assert withGTK3 -> withX || stdenv.isDarwin;
 assert withGTK2 -> !withGTK3 && gtk2 != null;
 assert withGTK3 -> !withGTK2 && gtk3 != null;
-assert withXwidgets -> withGTK3 && webkitgtk24x-gtk3 != null;
+assert withXwidgets -> withGTK3 && webkitgtk != null;

 let
  toolkit =
@ -52,14 +53,14 @@ stdenv.mkDerivation rec {

  buildInputs =
    [ ncurses gconf libxml2 gnutls alsaLib acl gpm gettext ]
-    ++ lib.optionals stdenv.isLinux [ dbus libselinux ]
+    ++ lib.optionals stdenv.isLinux [ dbus libselinux systemd ]
    ++ lib.optionals withX
      [ xlibsWrapper libXaw Xaw3d libXpm libpng libjpeg libungif libtiff librsvg libXft
-        imagemagick gconf ]
+        imagemagick gconf m17n_lib libotf ]
    ++ lib.optional (withX && withGTK2) gtk2
    ++ lib.optionals (withX && withGTK3) [ gtk3 gsettings-desktop-schemas ]
    ++ lib.optional (stdenv.isDarwin && withX) cairo
-    ++ lib.optionals (withX && withXwidgets) [ webkitgtk24x-gtk3 glib-networking ];
+    ++ lib.optionals (withX && withXwidgets) [ webkitgtk ];

  propagatedBuildInputs = lib.optionals stdenv.isDarwin [ AppKit GSS ImageIO ];

--- a/pkgs/applications/editors/vscode/default.nix
+++ b/pkgs/applications/editors/vscode/default.nix
@ -2,7 +2,7 @@
  gtk2, makeWrapper, libXScrnSaver, libxkbfile, libsecret }:

 let
-  version = "1.25.1";
+  version = "1.26.0";
  channel = "stable";

  plat = {
@ -12,9 +12,9 @@ let
  }.${stdenv.system};

  sha256 = {
-    "i686-linux" = "1qljnajk4h9ki5gvydh1b557fvhvcryvkrvypvz0pr804lpdqsmg";
-    "x86_64-linux" = "0f1lpwyxfchmbymzzxv97w9cy1z5pdljhwm49mc5v84aygmvnmjq";
-    "x86_64-darwin" = "1dgda1drij1c114xzv4hs44k7rx4x1vzghlxgii0h2rg641n6pbn";
+    "i686-linux" = "fd150bee8e1be4f5461013b8fee19f855200d046643e4ea5387aad170ad5f12b";
+    "x86_64-linux" = "618ca429e23777ef6b512c0cbd78bc711a7cf6f58752d9f805ced1dc62abb8f0";
+    "x86_64-darwin" = "07c2d678596e4e1f0bdf35b7d72a6d46851bf169d89f134fa73ff4f9007efbc3";
  }.${stdenv.system};

  archive_fmt = if stdenv.system == "x86_64-darwin" then "zip" else "tar.gz";
--- a/pkgs/applications/graphics/darktable/default.nix
+++ b/pkgs/applications/graphics/darktable/default.nix
@ -3,7 +3,7 @@
 , ilmbase, gtk3, intltool, lcms2, lensfun, libX11, libexif, libgphoto2, libjpeg
 , libpng, librsvg, libtiff, openexr, osm-gps-map, pkgconfig, sqlite, libxslt
 , openjpeg, lua, pugixml, colord, colord-gtk, libwebp, libsecret, gnome3
-, ocl-icd
+, ocl-icd, pcre, gtk-mac-integration
 }:

 stdenv.mkDerivation rec {
@ -18,24 +18,32 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ cmake ninja llvm pkgconfig intltool perl desktop-file-utils wrapGAppsHook ];

  buildInputs = [
-    cairo curl exiv2 glib gtk3 ilmbase lcms2 lensfun libX11 libexif
+    cairo curl exiv2 glib gtk3 ilmbase lcms2 lensfun libexif
    libgphoto2 libjpeg libpng librsvg libtiff openexr sqlite libxslt
    libsoup graphicsmagick json-glib openjpeg lua pugixml
-    colord colord-gtk libwebp libsecret gnome3.adwaita-icon-theme
-    osm-gps-map ocl-icd
-  ];
-    
+    libwebp libsecret gnome3.adwaita-icon-theme osm-gps-map pcre
+  ] ++ stdenv.lib.optionals stdenv.isLinux [
+    colord colord-gtk libX11 ocl-icd
+  ] ++ stdenv.lib.optional stdenv.isDarwin gtk-mac-integration;
+
  cmakeFlags = [
    "-DBUILD_USERMANUAL=False"
+  ] ++ stdenv.lib.optionals stdenv.isDarwin [
+    "-DUSE_COLORD=OFF"
+    "-DUSE_KWALLET=OFF"
  ];

+
  # darktable changed its rpath handling in commit
  # 83c70b876af6484506901e6b381304ae0d073d3c and as a result the
  # binaries can't find libdarktable.so, so change LD_LIBRARY_PATH in
  # the wrappers:
-  preFixup = ''
+  preFixup = let
+    libPathEnvVar = if stdenv.isDarwin then "DYLD_LIBRARY_PATH" else "LD_LIBRARY_PATH";
+    libPathPrefix = "$out/lib/darktable" + stdenv.lib.optionalString stdenv.isLinux ":${ocl-icd}/lib";
+  in ''
    gappsWrapperArgs+=(
-      --prefix LD_LIBRARY_PATH ":" "$out/lib/darktable:${ocl-icd}/lib"
+      --prefix ${libPathEnvVar} ":" "${libPathPrefix}"
    )
  '';

@ -43,7 +51,7 @@ stdenv.mkDerivation rec {
    description = "Virtual lighttable and darkroom for photographers";
    homepage = https://www.darktable.org;
    license = licenses.gpl3Plus;
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
    maintainers = with maintainers; [ goibhniu rickynils flosse mrVanDalo ];
  };
 }
--- a/pkgs/applications/graphics/meshlab/default.nix
+++ b/pkgs/applications/graphics/meshlab/default.nix
@ -1,10 +1,13 @@
-{ stdenv, fetchFromGitHub, libGLU, qtbase, qtscript, qtxmlpatterns }:
+{ fetchFromGitHub, libGLU, llvmPackages, qtbase, qtscript, qtxmlpatterns }:

 let
-  meshlabRev = "5700f5474c8f90696a8925e2a209a0a8ab506662";
-  vcglibRev = "a8e87662b63ee9f4ded5d4699b28d74183040803";
+  meshlabRev = "d596d7c086c51fbdfb56050f9c30b55dd0286d4c";
+  vcglibRev = "6c3c940e34327322507c703889f9f1cfa73ab183";
+  # ^ this should be the latest commit in the vcglib devel branch at the time of the meshlab revision
+
+  stdenv = llvmPackages.stdenv; # only building with clang seems to be tested upstream
 in stdenv.mkDerivation {
-  name = "meshlab-2016.12";
+  name = "meshlab-20180627-beta";

  srcs =
    [
@ -12,31 +15,32 @@ in stdenv.mkDerivation {
        owner = "cnr-isti-vclab";
        repo = "meshlab";
        rev = meshlabRev;
-        sha256 = "0srrp7zhi86dsg4zsx1615gr26barz38zdl8s03zq6vm1dgzl3cc";
+        sha256 = "0xi7wiyy0yi545l5qvccbqahlcsf70mhx829gf7bq29640si4rax";
        name = "meshlab-${meshlabRev}";
      })
      (fetchFromGitHub {
        owner = "cnr-isti-vclab";
        repo = "vcglib";
        rev = vcglibRev;
-        sha256 = "0jh8jc8rn7rci8qr3q03q574fk2hsc3rllysck41j8xkr3rmxz2f";
+        sha256 = "0jfgjvf21y9ncmyr7caipy3ardhig7hh9z8miy885c99b925hhwd";
        name = "vcglib-${vcglibRev}";
      })
    ];

  sourceRoot = "meshlab-${meshlabRev}";

-  patches = [ ./fix-2016.02.patch ];
-
  hardeningDisable = [ "format" ];
  enableParallelBuilding = true;

+  patches = [ ./fix-20180627-beta.patch ];
+
  buildPhase = ''
    # MeshLab has ../vcglib hardcoded everywhere, so move the source dir
    mv ../vcglib-${vcglibRev} ../vcglib

    cd src
    export NIX_LDFLAGS="-rpath $out/opt/meshlab $NIX_LDFLAGS"
+    export QMAKESPEC="linux-clang"

    pushd external
    qmake -recursive external.pro
@ -53,7 +57,7 @@ in stdenv.mkDerivation {
    ln -s $out/opt/meshlab/meshlabserver $out/bin/meshlabserver
  '';

-  buildInputs = [ libGLU qtbase qtscript qtxmlpatterns ];
+  buildInputs = [ libGLU llvmPackages.openmp qtbase qtscript qtxmlpatterns ];

  meta = {
    description = "A system for processing and editing 3D triangular meshes.";
@ -61,6 +65,5 @@ in stdenv.mkDerivation {
    license = stdenv.lib.licenses.gpl3;
    maintainers = with stdenv.lib.maintainers; [viric];
    platforms = with stdenv.lib.platforms; linux;
-    broken = true; # 2018-04-11
  };
 }
--- a/pkgs/applications/graphics/meshlab/fix-2016.02.patch
+++ b/pkgs/applications/graphics/meshlab/fix-2016.02.patch
@ -1,88 +0,0 @@
-From 0fd17cd2b6d57e8a2a981a70115c2565ee076d0f Mon Sep 17 00:00:00 2001
-From: Marco Callieri <callieri@isti.cnr.it>
-Date: Mon, 9 Jan 2017 16:06:14 +0100
-Subject: [PATCH 1/3] resolved ambiguity for abs overloads
-
-
-diff --git a/src/meshlabplugins/edit_quality/eqhandle.cpp b/src/meshlabplugins/edit_quality/eqhandle.cpp
-index 364d53bf..ef3d4a2d 100644
--- a/src/meshlabplugins/edit_quality/eqhandle.cpp
-+++ b/src/meshlabplugins/edit_quality/eqhandle.cpp
-@@ -83,7 +83,7 @@ void EqHandle::mouseMoveEvent(QGraphicsSceneMouseEvent *event)
- 	setCursor(Qt::OpenHandCursor);
- 
- 	QPointF newPos = event->scenePos();
-	qreal handleOffset = abs(newPos.x()-pos().x());
-+	qreal handleOffset = std::fabs(newPos.x()-pos().x());
- 
- 	if (handleOffset >= std::numeric_limits<float>::epsilon())
- 	{
-- 
-2.15.0
-
-
-From 33cfd5801e59b6c9e34360c75112e6dcb88d807b Mon Sep 17 00:00:00 2001
-From: Marco Callieri <callieri@isti.cnr.it>
-Date: Tue, 10 Jan 2017 10:05:05 +0100
-Subject: [PATCH 2/3] again, fabs ambiguity
-
-
-diff --git a/src/meshlabplugins/edit_quality/eqhandle.cpp b/src/meshlabplugins/edit_quality/eqhandle.cpp
-index ef3d4a2d..d29f8c45 100644
--- a/src/meshlabplugins/edit_quality/eqhandle.cpp
-+++ b/src/meshlabplugins/edit_quality/eqhandle.cpp
-@@ -30,6 +30,7 @@ FIRST RELEASE
- #include "eqhandle.h"
- #include <QMouseEvent>
- #include <QGraphicsSceneMouseEvent>
-+#include <math.h>
- 
- EqHandle::EqHandle(CHART_INFO *environment_info, QColor color, QPointF position, 
- 				   EQUALIZER_HANDLE_TYPE type, EqHandle** handles, qreal* midHandlePercentilePosition, QDoubleSpinBox* spinbox,
-@@ -83,7 +84,7 @@ void EqHandle::mouseMoveEvent(QGraphicsSceneMouseEvent *event)
- 	setCursor(Qt::OpenHandCursor);
- 
- 	QPointF newPos = event->scenePos();
-	qreal handleOffset = std::fabs(newPos.x()-pos().x());
-+	qreal handleOffset = fabs(newPos.x()-pos().x());
- 
- 	if (handleOffset >= std::numeric_limits<float>::epsilon())
- 	{
-- 
-2.15.0
-
-
-From d717e44f4134ebee03322a6a2a56fce626084a3c Mon Sep 17 00:00:00 2001
-From: Patrick Chilton <chpatrick@gmail.com>
-Date: Mon, 4 Dec 2017 21:27:23 +0100
-Subject: [PATCH 3/3] io_TXT -> io_txt
-
-
-diff --git a/src/meshlab_full.pro b/src/meshlab_full.pro
-index 6ea7f1db..2a95c127 100644
--- a/src/meshlab_full.pro
-+++ b/src/meshlab_full.pro
-@@ -16,7 +16,7 @@ SUBDIRS       = common \
-                 meshlabplugins/io_x3d \
-                 meshlabplugins/io_expe \
-                 meshlabplugins/io_pdb \
-                plugins_experimental/io_TXT \
-+                plugins_experimental/io_txt \
- # Filter plugins
-                 meshlabplugins/filter_aging \
-                 meshlabplugins/filter_ao \
-diff --git a/src/plugins_experimental/io_TXT/io_txt.cpp b/src/plugins_experimental/io_txt/io_txt.cpp
-similarity index 100%
-rename from src/plugins_experimental/io_TXT/io_txt.cpp
-rename to src/plugins_experimental/io_txt/io_txt.cpp
-diff --git a/src/plugins_experimental/io_TXT/io_txt.h b/src/plugins_experimental/io_txt/io_txt.h
-similarity index 100%
-rename from src/plugins_experimental/io_TXT/io_txt.h
-rename to src/plugins_experimental/io_txt/io_txt.h
-diff --git a/src/plugins_experimental/io_TXT/io_txt.pro b/src/plugins_experimental/io_txt/io_txt.pro
-similarity index 100%
-rename from src/plugins_experimental/io_TXT/io_txt.pro
-rename to src/plugins_experimental/io_txt/io_txt.pro
-- 
-2.15.0
-
--- a/pkgs/applications/graphics/meshlab/fix-20180627-beta.patch
+++ b/pkgs/applications/graphics/meshlab/fix-20180627-beta.patch
@ -0,0 +1,25 @@
+diff --git a/src/meshlabplugins/edit_paint/paintbox.cpp b/src/meshlabplugins/edit_paint/paintbox.cpp
+index 2097a5b..6bcd1a4 100644
+--- a/src/meshlabplugins/edit_paint/paintbox.cpp
+++ b/src/meshlabplugins/edit_paint/paintbox.cpp
+@@ -23,6 +23,7 @@
+ 
+ #include "paintbox.h"
+ #include <QFileDialog>
+#include <QAction>
+ 
+ Paintbox::Paintbox(QWidget * parent, Qt::WindowFlags flags) : QWidget(parent, flags)
+ {
+diff --git a/src/meshlabplugins/render_gdp/shaderDialog.h b/src/meshlabplugins/render_gdp/shaderDialog.h
+index a62d3b5..7eb1594 100644
+--- a/src/meshlabplugins/render_gdp/shaderDialog.h
+++ b/src/meshlabplugins/render_gdp/shaderDialog.h
+@@ -32,6 +32,8 @@
+ #include "shaderStructs.h"
+ #include "ui_shaderDialog.h"
+ #include <QMap>
+#include <QSlider>
+#include <QLineEdit>
+ 
+ class QGLWidget;
+ 
--- a/pkgs/applications/graphics/rapid-photo-downloader/default.nix
+++ b/pkgs/applications/graphics/rapid-photo-downloader/default.nix
@ -6,11 +6,11 @@

 python3Packages.buildPythonApplication rec {
  pname = "rapid-photo-downloader";
-  version = "0.9.9";
+  version = "0.9.10";

  src = fetchurl {
    url = "https://launchpad.net/rapid/pyqt/${version}/+download/${pname}-${version}.tar.gz";
-    sha256 = "193l55wdxwxmammyxwzp90sg0qw5r316443la3m9611sdpcmy8w3";
+    sha256 = "1i0lfj9gnfya49gxx59ls364z651fqagd4krnz9jhg9m0l48ljdf";
  };

  # Disable version check and fix install tests
--- a/pkgs/applications/misc/eureka-editor/default.nix
+++ b/pkgs/applications/misc/eureka-editor/default.nix
@ -0,0 +1,39 @@
+{ stdenv, fetchzip, fltk, zlib, xdg_utils, xorg, libjpeg, libGL }:
+
+stdenv.mkDerivation rec {
+  name = "eureka-editor-${version}";
+  version = "1.21";
+  shortver = "121";
+
+  src = fetchzip {
+    url = "mirror://sourceforge/eureka-editor/Eureka/${version}/eureka-${shortver}-source.tar.gz";
+    sha256 = "0fpj13aq4wh3f7473cdc5jkf1c71jiiqmjc0ihqa0nm3hic1d4yv";
+  };
+
+  buildInputs = [ fltk zlib xdg_utils libjpeg xorg.libXinerama libGL ];
+
+  enableParallelBuilding = true;
+
+  preBuild = ''
+    substituteInPlace src/main.cc \
+      --replace /usr/local $out
+    substituteInPlace Makefile \
+      --replace /usr/local $out \
+      --replace "-o root " ""
+  '';
+
+  preInstall = ''
+    mkdir -p $out/bin $out/share/applications $out/share/icons $out/man/man6
+    cp misc/eureka.desktop $out/share/applications
+    cp misc/eureka.ico $out/share/icons
+    cp misc/eureka.6 $out/man/man6
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = http://eureka-editor.sourceforge.net;
+    description = "A map editor for the classic DOOM games, and a few related games such as Heretic and Hexen";
+    license = licenses.gpl2;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ neonfuz ];
+  };
+}
--- a/pkgs/applications/misc/evilvte/default.nix
+++ b/pkgs/applications/misc/evilvte/default.nix
@ -31,5 +31,8 @@ stdenv.mkDerivation rec {
    license = licenses.gpl2;
    maintainers = [ maintainers.bodil ];
    platforms = platforms.linux;
+    knownVulnerabilities = [
+      "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854585"
+    ];
  };
 }
--- a/pkgs/applications/misc/gxmessage/default.nix
+++ b/pkgs/applications/misc/gxmessage/default.nix
@ -1,4 +1,4 @@
-{stdenv, fetchurl, gnome3, intltool, pkgconfig, texinfo}:
+{ stdenv, fetchurl, gnome3, intltool, pkgconfig, texinfo, hicolor-icon-theme }:

 stdenv.mkDerivation rec {
  name = "gxmessage-${version}";
@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ intltool gnome3.gtk texinfo ];
+  buildInputs = [ intltool gnome3.gtk texinfo hicolor-icon-theme ];
+
  meta = {
    description = "A GTK enabled dropin replacement for xmessage";
    homepage = "http://homepages.ihug.co.nz/~trmusson/programs.html#gxmessage";
--- a/pkgs/applications/misc/nnn/default.nix
+++ b/pkgs/applications/misc/nnn/default.nix
@ -4,13 +4,13 @@ with stdenv.lib;

 stdenv.mkDerivation rec {
  name = "nnn-${version}";
-  version = "1.8";
+  version = "1.9";

  src = fetchFromGitHub {
    owner = "jarun";
    repo = "nnn";
    rev = "v${version}";
-    sha256 = "0sd8djig56163k0b0y4a7kg3malxlg08gayjw4zmvqaihvbbkc6v";
+    sha256 = "0z7mr9lql5hz0518wzkj8fdsdp8yh17fr418arjxjn66md4kwgpg";
  };

  configFile = optionalString (conf!=null) (builtins.toFile "nnn.h" conf);
--- a/pkgs/applications/misc/overmind/default.nix
+++ b/pkgs/applications/misc/overmind/default.nix
@ -1,4 +1,4 @@
-{ stdenv, buildGoPackage, fetchFromGitHub, tmux, makeWrapper }:
+{ stdenv, buildGoPackage, fetchFromGitHub, tmux, which, makeWrapper }:

 buildGoPackage rec {
  name = "overmind-${version}";
@ -8,7 +8,7 @@ buildGoPackage rec {
  nativeBuildInputs = [ makeWrapper ];

  postInstall = ''
-    wrapProgram "$bin/bin/overmind" --prefix PATH : "${stdenv.lib.makeBinPath [ tmux ]}"
+    wrapProgram "$bin/bin/overmind" --prefix PATH : "${stdenv.lib.makeBinPath [ tmux which ]}"
  '';

  src = fetchFromGitHub {
--- a/pkgs/applications/misc/ptask/default.nix
+++ b/pkgs/applications/misc/ptask/default.nix
@ -12,7 +12,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ pkgconfig makeWrapper ];

-  patches = [ ./tw-version.patch ];
+  patches = [ ./tw-version.patch ./json_c_is_error.patch ];

  preFixup = ''
    wrapProgram "$out/bin/ptask" \
@ -25,5 +25,6 @@ stdenv.mkDerivation rec {
    description = "GTK-based GUI for taskwarrior";
    license = licenses.gpl2;
    maintainers = [ maintainers.spacefrogg ];
+    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/misc/ptask/json_c_is_error.patch
+++ b/pkgs/applications/misc/ptask/json_c_is_error.patch
@ -0,0 +1,13 @@
+diff --git a/src/tw.c b/src/tw.c
+index 602f7b3..ca601cd 100644
+--- a/src/tw.c
+++ b/src/tw.c
+@@ -163,7 +163,7 @@ static struct json_object *task_exec_json(const char *opts)
+ 
+ 	free(cmd);
+ 
+-	if (o && is_error(o))
+	if (!o)
+ 		return NULL;
+ 
+ 	return o;
--- a/pkgs/applications/misc/qradiolink/default.nix
+++ b/pkgs/applications/misc/qradiolink/default.nix
@ -0,0 +1,57 @@
+{ stdenv, fetchFromGitHub, alsaLib, boost
+, qt4, libpulseaudio, codec2, libconfig
+, gnuradio, gnuradio-osmosdr, gsm
+, libopus, libjpeg, protobuf, qwt, speex
+} :
+
+let
+  version = "0.5.0";
+
+in stdenv.mkDerivation {
+  name = "qradiolink-${version}";
+
+  src = fetchFromGitHub {
+    owner = "kantooon";
+    repo = "qradiolink";
+    rev = "${version}";
+    sha256 = "0xhg5zhjznmls5m3rhpk1qx0dipxmca12s85w15d0i7qwva2f1gi";
+  };
+
+  preBuild = ''
+    cd ext
+    protoc --cpp_out=. Mumble.proto
+    protoc --cpp_out=. QRadioLink.proto
+    cd ..
+    qmake
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp qradiolink $out/bin
+  '';
+
+  buildInputs = [
+    qt4
+    alsaLib
+    boost
+    libpulseaudio
+    codec2
+    libconfig
+    gsm
+    gnuradio
+    gnuradio-osmosdr
+    libopus
+    libjpeg
+    protobuf
+    speex
+    qwt
+  ];
+
+  meta = with stdenv.lib; {
+    description = "SDR transceiver application for analog and digital modes";
+    homepage = http://qradiolink.org/;
+    license = licenses.agpl3;
+    maintainers = [ maintainers.markuskowa ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/misc/redshift/default.nix
+++ b/pkgs/applications/misc/redshift/default.nix
@ -61,6 +61,15 @@ stdenv.mkDerivation rec {

  postFixup = "wrapPythonPrograms";

+  # the geoclue agent may inspect these paths and expect them to be
+  # valid without having the correct $PATH set
+  postInstall = ''
+    substituteInPlace $out/share/applications/redshift.desktop \
+      --replace 'Exec=redshift' "Exec=$out/bin/redshift"
+    substituteInPlace $out/share/applications/redshift.desktop \
+      --replace 'Exec=redshift-gtk' "Exec=$out/bin/redshift-gtk"
+  '';
+
  enableParallelBuilding = true;

  meta = with stdenv.lib; {
--- a/pkgs/applications/misc/rtv/default.nix
+++ b/pkgs/applications/misc/rtv/default.nix
@ -2,14 +2,14 @@

 with python3Packages;
 buildPythonApplication rec {
-  version = "1.23.0";
+  version = "1.24.0";
  pname = "rtv";

  src = fetchFromGitHub {
    owner = "michael-lazar";
    repo = "rtv";
    rev = "v${version}";
-    sha256 = "0i6iqj3ly1bgsfa9403m5190mfl9yk1x4ific3v31wqfja985nsr";
+    sha256 = "0vzhnqys8nr6ymsi1mnv092z3i7nwyhgnj4jv6mjifak9j3164fw";
  };

  # Tests try to access network
--- a/pkgs/applications/misc/translate-shell/default.nix
+++ b/pkgs/applications/misc/translate-shell/default.nix
@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
  name = "${pname}-${version}";
  pname = "translate-shell";
-  version = "0.9.6.7";
+  version = "0.9.6.8";

  src = fetchFromGitHub {
    owner = "soimort";
    repo = "translate-shell";
    rev = "v${version}";
-    sha256 = "0krcidjh32xwybr1v4nykgf0jjnffjqx125bvn3jh2a44cikyq3n";
+    sha256 = "17fc5nlc594lvmihx39h4ddmi8ja3qqsyswzxadbaz7l3zm356b8";
  };

  buildInputs = [ makeWrapper ];
--- a/pkgs/applications/misc/urlscan/default.nix
+++ b/pkgs/applications/misc/urlscan/default.nix
@ -2,13 +2,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "urlscan";
-  version = "0.8.7";
+  version = "0.8.9";

  src = fetchFromGitHub {
    owner = "firecat53";
    repo = pname;
    rev = version;
-    sha256 = "1jxjcq869jimsq1ihk2fbjhp5lj7yga0hbp0msskxyz92afl1kz8";
+    sha256 = "18wvfayib79lylv3g9ay3f85qanhrljvnfarwl9snfzklj4gkf2v";
  };

  propagatedBuildInputs = [ python3Packages.urwid ];
--- a/pkgs/applications/misc/viking/default.nix
+++ b/pkgs/applications/misc/viking/default.nix
@ -1,6 +1,6 @@
 { fetchurl, stdenv, makeWrapper, pkgconfig, intltool, gettext, gtk2, expat, curl
 , gpsd, bc, file, gnome-doc-utils, libexif, libxml2, libxslt, scrollkeeper
-, docbook_xml_dtd_412, gexiv2, sqlite, gpsbabel, expect }:
+, docbook_xml_dtd_412, gexiv2, sqlite, gpsbabel, expect, hicolor-icon-theme }:

 stdenv.mkDerivation rec {
  name = "viking-${version}";
@ -13,7 +13,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ pkgconfig ];
  buildInputs = [ makeWrapper intltool gettext gtk2 expat curl gpsd bc file gnome-doc-utils
-    libexif libxml2 libxslt scrollkeeper docbook_xml_dtd_412 gexiv2 sqlite
+    libexif libxml2 libxslt scrollkeeper docbook_xml_dtd_412 gexiv2 sqlite hicolor-icon-theme
  ];

  configureFlags = [ "--disable-scrollkeeper --disable-mapnik" ];
--- a/pkgs/applications/misc/xterm/default.nix
+++ b/pkgs/applications/misc/xterm/default.nix
@ -3,14 +3,14 @@
 }:

 stdenv.mkDerivation rec {
-  name = "xterm-333";
+  name = "xterm-335";

  src = fetchurl {
    urls = [
     "ftp://ftp.invisible-island.net/xterm/${name}.tgz"
     "https://invisible-mirror.net/archives/xterm/${name}.tgz"
   ];
-    sha256 = "0y7gl26mxw6kwqx9j9mi6lx1lp1v3nrlga19ddn07j2m9q0l479g";
+    sha256 = "15nbgys4s2idhx6jzzc24g9bb1s6yps5fyg2bafvs0gkkcm1ggz0";
  };

  buildInputs =
--- a/pkgs/applications/networking/browsers/chromium/plugins.nix
+++ b/pkgs/applications/networking/browsers/chromium/plugins.nix
@ -98,11 +98,11 @@ let

  flash = stdenv.mkDerivation rec {
    name = "flashplayer-ppapi-${version}";
-    version = "30.0.0.134";
+    version = "30.0.0.154";

    src = fetchzip {
      url = "https://fpdownload.adobe.com/pub/flashplayer/pdc/${version}/flash_player_ppapi_linux.x86_64.tar.gz";
-      sha256 = "1g6695w1ijqs8jbkbrb403ca1vvrf298ayvxslrvk70x6l7lp2ys";
+      sha256 = "0bi9b6syx7x2avixgjwanrvynzanf89xm2g3nxazw9qgxxc1cp48";
      stripRoot = false;
    };

--- a/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
--- a/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@ -43,6 +43,9 @@ let

      plugins =
        assert !(jre && icedtea);
+        if builtins.hasAttr "enableVLC" cfg
+        then throw "The option \"${browserName}.enableVLC\" has been removed since Firefox no longer supports npapi plugins"
+        else
        ([ ]
          ++ lib.optional enableAdobeFlash flashplayer
          ++ lib.optional (cfg.enableDjvu or false) (djview4)
--- a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
@ -73,7 +73,7 @@ let
 in
 stdenv.mkDerivation rec {
  name = "flashplayer-${version}";
-  version = "30.0.0.134";
+  version = "30.0.0.154";

  src = fetchurl {
    url =
@ -84,14 +84,14 @@ stdenv.mkDerivation rec {
    sha256 =
      if debug then
        if arch == "x86_64" then
-          "1xa2mcbcxpfrqdf37a98nvvsvyp0bm3lsv21ky3ps9cba8a13z80"
+          "04hfh0vn1n70gdpfydq0sj94d6rkbk80h4pmy3rsfvhg0x540wx8"
        else
-          "1jgl57ggcszdim51dcr0gsjmrdb2kdvxl0lv5zl83cvxcyz0z4p6"
+          "073327sszbvkglh5b18axmwv40sy2vyacdhcd1fx82qskv44sfda"
      else
        if arch == "x86_64" then
-          "0331r5af4zrvwc4h7dp5qyy91dfam5z03yjggls3x04i10nz5myw"
+          "03ypgzy88ck5rn1q971v0km9yw3p10ly1zkxh239v6nx0hs35w84"
        else
-          "011cf0kycs4ih45l23bp6rr2vm7w7jaj4pjvmqwjax4xrb5pzkic";
+          "0rld7i659ccp4gvcvdkqkc1lajvlss5d4qndzf9aqiksvdknv62x";
  };

  nativeBuildInputs = [ unzip ];
--- a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
@ -49,7 +49,7 @@

 stdenv.mkDerivation rec {
  name = "flashplayer-standalone-${version}";
-  version = "30.0.0.134";
+  version = "30.0.0.154";

  src = fetchurl {
    url =
@ -59,9 +59,9 @@ stdenv.mkDerivation rec {
        "https://fpdownload.macromedia.com/pub/flashplayer/updaters/30/flash_player_sa_linux.x86_64.tar.gz";
    sha256 =
      if debug then
-        "1plmhv1799j0habmyxy7zhvilh823djmg4i387s6qifr5iv66pax"
+        "133zhgc5fh6s0xr93lv70xcrgvaj7lhjxk5w7xz79h3mp185p3g4"
      else
-        "13cb7sca5mw5b1iiimyxbfxwpmdh7aya8rnlhkv3fgk5a1jwrxqr";
+        "1xz1l5q0zahalh0l4mkrwhmfrmcli3sckg3rcfnllizq9rbfzcmr";
  };

  nativeBuildInputs = [ unzip ];
--- a/pkgs/applications/networking/cluster/hadoop/default.nix
+++ b/pkgs/applications/networking/cluster/hadoop/default.nix
@ -11,10 +11,15 @@ let
          inherit sha256;
        };

+        postUnpack = stdenv.lib.optionalString (tomcat != null) ''
+          install -D ${tomcat.src} $sourceRoot/hadoop-hdfs-project/hadoop-hdfs-httpfs/downloads/apache-tomcat-${tomcat.version}.tar.gz
+          install -D ${tomcat.src} $sourceRoot/hadoop-common-project/hadoop-kms/downloads/apache-tomcat-${tomcat.version}.tar.gz
+        '';
+
        # perform fake build to make a fixed-output derivation of dependencies downloaded from maven central (~100Mb in ~3000 files)
        fetched-maven-deps = stdenv.mkDerivation {
          name = "hadoop-${version}-maven-deps";
-          inherit src nativeBuildInputs buildInputs configurePhase;
+          inherit src postUnpack nativeBuildInputs buildInputs configurePhase;
          buildPhase = ''
            while mvn package -Dmaven.repo.local=$out/.m2 ${mavenFlags} -Dmaven.wagon.rto=5000; [ $? = 1 ]; do
              echo "timeout, restart maven to continue downloading"
@ -48,11 +53,6 @@ let
        '';
        configurePhase = "true"; # do not trigger cmake hook
        mavenFlags = "-Drequire.snappy -Drequire.bzip2 -DskipTests -Pdist,native -e";
-        # prevent downloading tomcat during the build
-        preBuild = stdenv.lib.optionalString (tomcat != null) ''
-          install -D ${tomcat.src} hadoop-hdfs-project/hadoop-hdfs-httpfs/downloads/apache-tomcat-${tomcat.version}.tar.gz
-          install -D ${tomcat.src} hadoop-common-project/hadoop-kms/downloads/apache-tomcat-${tomcat.version}.tar.gz
-        '';
        buildPhase = ''
          # 'maven.repo.local' must be writable
          mvn package --offline -Dmaven.repo.local=$(cp -dpR ${fetched-maven-deps}/.m2 ./ && chmod +w -R .m2 && pwd)/.m2 ${mavenFlags}
@ -123,8 +123,8 @@ let

 in {
  hadoop_2_7 = common {
-    version = "2.7.6";
-    sha256 = "0wmg0iy0qxrf43fzajzmx03gxp4yx197vxacqwkxaj45clqwl010";
+    version = "2.7.7";
+    sha256 = "1ahv67f3lwak3kbjvnk1gncq56z6dksbajj872iqd0awdsj3p5rf";
    dependencies-sha256 = "1lsr9nvrynzspxqcamb10d596zlnmnfpxhkd884gdiva0frm0b1r";
    tomcat = tomcat_6_0_48;
  };
@ -147,9 +147,9 @@ in {
    tomcat = null;
  };
  hadoop_3_1 = common {
-    version = "3.1.0";
-    sha256 = "0lig25jkffkzc2bfgyrnm3wymapgyw9fkai8sk9fnmp7cljia314";
-    dependencies-sha256 = "1ri6a7lrijh538vy7v0fzgvkw603pf8jkh3ldl1kl7l0dvszd70d";
+    version = "3.1.1";
+    sha256 = "04hhdbyd4x1hy0fpy537f8mi0864hww97zap29x7dk1smrffwabd";
+    dependencies-sha256 = "1q63jsxg3d31x0p8hvhpvbly2b07almyzsbhwphbczl3fhlqgiwn";
    tomcat = null;
  };
 }
--- a/pkgs/applications/networking/cluster/kontemplate/default.nix
+++ b/pkgs/applications/networking/cluster/kontemplate/default.nix
@ -2,7 +2,7 @@

 buildGoPackage rec {
  name          = "kontemplate-${version}";
-  version       = "1.6.0";
+  version       = "1.7.0";
  goPackagePath = "github.com/tazjin/kontemplate";
  goDeps        = ./deps.nix;

@ -10,7 +10,7 @@ buildGoPackage rec {
    owner  = "tazjin";
    repo   = "kontemplate";
    rev    = "v${version}";
-    sha256 = "06qcf2cxs686kd7iqccmqd5chdzxgbkav95byjim7sgvq9qjajfi";
+    sha256 = "0vzircajhrfq1nykwpl52cqgzyhy51w4ff7ldpgi95w3a4fz1hzz";
  };

  meta = with lib; {
--- a/pkgs/applications/networking/cluster/kontemplate/deps.nix
+++ b/pkgs/applications/networking/cluster/kontemplate/deps.nix
@ -5,8 +5,8 @@
    fetch = {
      type   = "git";
      url    = "https://github.com/Masterminds/semver";
-      rev    = "517734cc7d6470c0d07130e40fd40bdeb9bcd3fd";
-      sha256 = "1625b5sxpmlz60jw67j1ljfcc09d4lhxg3z6gc4am8s2rrdgwij6";
+      rev    = "c84ddcca87bf5a941b138dde832a7e20b0159ad8";
+      sha256 = "1dcfdr018a0yszjpvr3wshvq9cc3kvy95l55si556p617wsn1wan";
    };
  }
  {
@ -14,8 +14,8 @@
    fetch = {
      type   = "git";
      url    = "https://github.com/Masterminds/sprig";
-      rev    = "e039e20e500c2c025d9145be375e27cf42a94174";
-      sha256 = "1yhpyzq6ghwl0242phjpbc9358fcw63pxrcxsyv9n4dm0w15va3m";
+      rev    = "77bb58b7f5e10889a1195c21b9e7a96ee166f199";
+      sha256 = "0q4g12f3nvda1skz33qzbbdd2vj3gjfwf361hyzlx20s71brk3bk";
    };
  }
  {
@ -50,8 +50,17 @@
    fetch = {
      type   = "git";
      url    = "https://github.com/ghodss/yaml";
-      rev    = "0ca9ea5df5451ffdf184b4428c902747c2c11cd7";
-      sha256 = "0skwmimpy7hlh7pva2slpcplnm912rp3igs98xnqmn859kwa5v8g";
+      rev    = "e9ed3c6dfb39bb1a32197cb10d527906fe4da4b6";
+      sha256 = "07cf0j3wbsl1gmn175mdgljcarfz4xbqd6pgc7b08a5lcn7zwhjz";
+    };
+  }
+  {
+    goPackagePath = "github.com/google/uuid";
+    fetch = {
+      type   = "git";
+      url    = "https://github.com/google/uuid";
+      rev    = "dec09d789f3dba190787f8b4454c7d3c936fed9e";
+      sha256 = "1hc4w67p6zkh2qk7wm1yrl69jjrjjk615mly5ll4iidn1m4mzi4i";
    };
  }
  {
@ -59,8 +68,8 @@
    fetch = {
      type   = "git";
      url    = "https://github.com/huandu/xstrings";
-      rev    = "3959339b333561bf62a38b424fd41517c2c90f40";
-      sha256 = "0f1jyd80grpr88gwhljx2x0xgsyzw07807n4z4axxxlybh5f0nh1";
+      rev    = "7bb0250b58e5c15670406e6f93ffda43281305b1";
+      sha256 = "1fc8q65xvsxpa12p8hcjqap2pf72zqlwpm165js9kwbgm2sf977c";
    };
  }
  {
@ -68,17 +77,8 @@
    fetch = {
      type   = "git";
      url    = "https://github.com/imdario/mergo";
-      rev    = "d806ba8c21777d504a2090a2ca4913c750dd3a33";
-      sha256 = "12n3lfbfxvnag916c6dpxl48j29s482zwsqjc6wk4vb68qbz2nl3";
-    };
-  }
-  {
-    goPackagePath = "github.com/satori/go.uuid";
-    fetch = {
-      type   = "git";
-      url    = "https://github.com/satori/go.uuid";
-      rev    = "5bf94b69c6b68ee1b541973bb8e1144db23a194b";
-      sha256 = "0l782l4srv36pj8pfgn61996d0vjifld4a569rbjwq5h14pd0c07";
+      rev    = "9f23e2d6bd2a77f959b2bf6acdbefd708a83a4a4";
+      sha256 = "1lbzy8p8wv439sqgf0n21q52flf2wbamp6qa1jkyv6an0nc952q7";
    };
  }
  {
@ -86,8 +86,8 @@
    fetch = {
      type   = "git";
      url    = "https://go.googlesource.com/crypto";
-      rev    = "ab89591268e0c8b748cbe4047b00197516011af5";
-      sha256 = "1cbg8wlv1hmdps9ksa4kym5zy0mb2yjykw4ns7yqv7nmz4s5xajr";
+      rev    = "de0752318171da717af4ce24d0a2e8626afaeb11";
+      sha256 = "1ps1dl2a5lwr3vbwcy8n4i1v73m567y024sk961fk281phrzp13i";
    };
  }
  {
@ -95,8 +95,8 @@
    fetch = {
      type   = "git";
      url    = "https://gopkg.in/alecthomas/kingpin.v2";
-      rev    = "1087e65c9441605df944fb12c33f0fe7072d18ca";
-      sha256 = "18llqzkdqf62qbqcv2fd3j0igl6cwwn4dissf5skkvxrcxjcmmj0";
+      rev    = "947dcec5ba9c011838740e680966fd7087a71d0d";
+      sha256 = "0mndnv3hdngr3bxp7yxfd47cas4prv98sqw534mx7vp38gd88n5r";
    };
  }
  {
@ -104,8 +104,8 @@
    fetch = {
      type   = "git";
      url    = "https://gopkg.in/yaml.v2";
-      rev    = "eb3733d160e74a9c7e442f435eb3bea458e1d19f";
-      sha256 = "1srhvcaa9db3a6xj29mkjr5kg33y71pclrlx4vcwz5m1lgb5c7q6";
+      rev    = "5420a8b6744d3b0345ab293f6fcba19c978f1183";
+      sha256 = "0dwjrs2lp2gdlscs7bsrmyc5yf6mm4fvgw71bzr9mv2qrd2q73s1";
    };
  }
 ]
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@ -104,8 +104,8 @@ in rec {
  terraform_0_10-full = terraform_0_10.withPlugins lib.attrValues;

  terraform_0_11 = pluggable (generic {
-    version = "0.11.7";
-    sha256 = "0q5gl8yn1f8fas1v68lz081k88gbmlk7f2xqlwqmh01qpqjxd42q";
+    version = "0.11.8";
+    sha256 = "1kdmx21l32vj5kvkimkx0s5mxgmgkdwlgbin4f3iqjflzip0cddh";
    patches = [ ./provider-path.patch ];
    passthru = { inherit plugins; };
  });
--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@ -2,7 +2,7 @@

 buildGoPackage rec {
  name = "terragrunt-${version}";
-  version = "0.14.6";
+  version = "0.16.6";

  goPackagePath = "github.com/gruntwork-io/terragrunt";

@ -10,7 +10,7 @@ buildGoPackage rec {
    owner  = "gruntwork-io";
    repo   = "terragrunt";
    rev    = "v${version}";
-    sha256 = "14zg1h76wfg6aa78llcnza7kapnl5ks6m2vg73b90azfi49fmkwz";
+    sha256 = "0fzn2ymk8x0lzwfqlvnry8s6wf3q0sqn76lfardjyz6wgxl8011i";
  };

  goDeps = ./deps.nix;
--- a/pkgs/applications/networking/dropbox/default.nix
+++ b/pkgs/applications/networking/dropbox/default.nix
@ -7,7 +7,7 @@ assert lib.elem stdenv.system platforms;
 # Dropbox client to bootstrap installation.
 # The client is self-updating, so the actual version may be newer.
 let
-  version = "52.3.56";
+  version = "55.4.171";

  arch = {
    "x86_64-linux" = "x86_64";
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@ -55,11 +55,11 @@ let

 in stdenv.mkDerivation rec {
  name = "signal-desktop-${version}";
-  version = "1.15.4";
+  version = "1.15.5";

  src = fetchurl {
    url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "02k64hnfzq8d5g805n4bjm2x8xazskp8fwbmcbl2s2rshdwil1jz";
+    sha256 = "1a63kyxbhdaz6izprg8wryvscmvfjii50xi1v5pxlf74x2pkxs8k";
  };

  phases = [ "unpackPhase" "installPhase" ];
--- a/pkgs/applications/networking/instant-messengers/wavebox/default.nix
+++ b/pkgs/applications/networking/instant-messengers/wavebox/default.nix
@ -0,0 +1,66 @@
+{ stdenv, fetchurl, makeDesktopItem, makeWrapper, autoPatchelfHook
+, xorg, gtk2, gtk3 , gnome2, gnome3, nss, alsaLib, udev, libnotify, xdg_utils }:
+
+with stdenv.lib;
+
+let
+  bits = "x86_64";
+
+  version = "3.14.10";
+
+  desktopItem = makeDesktopItem rec {
+    name = "Wavebox";
+    exec = name;
+    icon = "wavebox";
+    desktopName = name;
+    genericName = name;
+    categories = "Network;";
+  };
+
+  tarball = "Wavebox_${replaceStrings ["."] ["_"] (toString version)}_linux_${bits}.tar.gz";
+
+in stdenv.mkDerivation rec {
+  name = "wavebox-${version}";
+  src = fetchurl {
+    url = "https://github.com/wavebox/waveboxapp/releases/download/v${version}/${tarball}";
+    sha256 = "06ce349f561c6122b2d326e9a1363fb358e263c81a7d1d08723ec567235bbd74";
+  };
+
+  # don't remove runtime deps
+  dontPatchELF = true;
+
+  nativeBuildInputs = [ autoPatchelfHook makeWrapper ];
+
+  buildInputs = with xorg; [
+    libXScrnSaver libXtst
+  ] ++ [
+    gtk3 nss gtk2 alsaLib gnome2.GConf
+  ];
+
+  runtimeDependencies = [ udev.lib libnotify ];
+
+  installPhase = ''
+    mkdir -p $out/bin $out/opt/wavebox
+    cp -r * $out/opt/wavebox
+
+    # provide desktop item and icon
+    mkdir -p $out/share/applications $out/share/pixmaps
+    ln -s ${desktopItem}/share/applications/* $out/share/applications
+    ln -s $out/opt/wavebox/Wavebox-linux-x64/wavebox_icon.png $out/share/pixmaps/wavebox.png
+  '';
+
+  postFixup = ''
+    paxmark m $out/opt/wavebox/Wavebox
+    makeWrapper $out/opt/wavebox/Wavebox $out/bin/wavebox \
+      --prefix PATH : ${xdg_utils}/bin
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Wavebox messaging application";
+    homepage = https://wavebox.io;
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ rawkode ];
+    platforms = ["x86_64-linux"];
+    hydraPlatforms = [];
+  };
+}
--- a/pkgs/applications/networking/instant-messengers/weechat-xmpp/default.nix
+++ b/pkgs/applications/networking/instant-messengers/weechat-xmpp/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, xmpppy }:
+{ stdenv, fetchFromGitHub, xmpppy, pydns, substituteAll, buildEnv }:

 stdenv.mkDerivation {
  name = "weechat-jabber-2017-08-30";
@ -15,15 +15,14 @@ stdenv.mkDerivation {
    cp jabber.py $out/share/jabber.py
  '';

-  buildInputs = [ xmpppy ];
-
-  postPatch = ''
-    substituteInPlace jabber.py \
-      --replace "__NIX_OUTPUT__" "${xmpppy}/lib/python2.7/site-packages"
-  '';
-
  patches = [
-    ./libpath.patch
+    (substituteAll {
+      src = ./libpath.patch;
+      env = "${buildEnv {
+        name = "weechat-xmpp-env";
+        paths = [ pydns xmpppy ];
+      }}/lib/python2.7/site-packages";
+    })
  ];

  meta = with stdenv.lib; {
--- a/pkgs/applications/networking/instant-messengers/weechat-xmpp/libpath.patch
+++ b/pkgs/applications/networking/instant-messengers/weechat-xmpp/libpath.patch
@ -8,7 +8,7 @@ index 27006a3..e53c2c0 100644
 
 +import sys
 +
-+sys.path.append('__NIX_OUTPUT__')
+sys.path.append('@env@')
 +
 +
 import_ok = True
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@ -13,11 +13,11 @@ assert pulseaudioSupport -> libpulseaudio != null;
 let
  inherit (stdenv.lib) concatStringsSep makeBinPath optional;

-  version = "2.2.128200.0702";
+  version = "2.3.128305.0716";
  srcs = {
    x86_64-linux = fetchurl {
      url = "https://zoom.us/client/${version}/zoom_x86_64.tar.xz";
-      sha256 = "0n9kyj94bj35gbpwiz4kq7hc8pwfqwnfqf003g4c8gx5pda3g56w";
+      sha256 = "1jpw5sclr5bhif559hmnyiggjh6gkm1smiw34y3ad4k8xhag9dkh";
    };
  };

--- a/pkgs/applications/networking/msmtp/default.nix
+++ b/pkgs/applications/networking/msmtp/default.nix
@ -10,11 +10,11 @@ let
 in stdenv.mkDerivation rec {
  pname = "msmtp";
  name = "${pname}-${version}";
-  version = "1.6.6";
+  version = "1.6.8";

  src = fetchurl {
-    url = "mirror://sourceforge/msmtp/${name}.tar.xz";
-    sha256 = "0ppvww0sb09bnsrpqnvlrn8vx231r24xn2iiwpy020mxc8gxn5fs";
+    url = "https://marlam.de/msmtp/releases/${name}.tar.xz";
+    sha256 = "1ysrnshvwhzwmvb2walw5i9jdzlvmckj7inr0xnvb26q0jirbzsm";
  };

  patches = [
@ -52,7 +52,7 @@ in stdenv.mkDerivation rec {

  meta = with stdenv.lib; {
    description = "Simple and easy to use SMTP client with excellent sendmail compatibility";
-    homepage = http://msmtp.sourceforge.net/;
+    homepage = https://marlam.de/msmtp/;
    license = licenses.gpl3;
    maintainers = with maintainers; [ garbas peterhoeg ];
    platforms = platforms.unix;
--- a/pkgs/applications/networking/p2p/qbittorrent/default.nix
+++ b/pkgs/applications/networking/p2p/qbittorrent/default.nix
@ -10,13 +10,13 @@ with stdenv.lib;

 stdenv.mkDerivation rec {
  name = "qbittorrent-${version}";
-  version = "4.1.1";
+  version = "4.1.2";

  src = fetchFromGitHub {
    owner = "qbittorrent";
    repo = "qbittorrent";
    rev = "release-${version}";
-    sha256 = "09bf1jr2sfdps8cb154gjw7zhdcpsamhnfbgacdmkfyd7qgcbykf";
+    sha256 = "1756hr92rvh4xlf6bk2wl24ypczhwf1rv1pdq05flk118jciqb05";
  };

  # NOTE: 2018-05-31: CMake is working but it is not officially supported
--- a/pkgs/applications/networking/protonmail-bridge/default.nix
+++ b/pkgs/applications/networking/protonmail-bridge/default.nix
@ -6,7 +6,9 @@ let

  description = ''
    An application that runs on your computer in the background and seamlessly encrypts
-    and decrypts your mail as it enters and leaves your computer
+    and decrypts your mail as it enters and leaves your computer.
+
+    To work, gnome-keyring service must be enabled.
  '';

  desktopItem = makeDesktopItem {
--- a/pkgs/applications/science/astronomy/gildas/default.nix
+++ b/pkgs/applications/science/astronomy/gildas/default.nix
@ -7,13 +7,13 @@ let
 in

 stdenv.mkDerivation rec {
-  srcVersion = "jul18a";
-  version = "20180701_a";
+  srcVersion = "aug18a";
+  version = "20180801_a";
  name = "gildas-${version}";

  src = fetchurl {
-    url = "http://www.iram.fr/~gildas/dist/archive/gildas/gildas-src-${srcVersion}.tar.gz";
-    sha256 = "0kl3zf6b1kv8hgsfrarsnm2gnrdax3vi8f856249y4nxsa7lbv2i";
+    url = "http://www.iram.fr/~gildas/dist/gildas-src-${srcVersion}.tar.gz";
+    sha256 = "0mg3wijrj8x1p912vkgrhxbypjx7aj9b1492yxvq2y3fxban6bj1";
  };

  enableParallelBuilding = true;
@ -22,7 +22,7 @@ stdenv.mkDerivation rec {

  buildInputs = [ gtk2-x11 lesstif cfitsio python27Env ];

-  patches = [ ./wrapper.patch ./return-error-code.patch ./clang.patch ./mod.patch ./aarch64.patch ];
+  patches = [ ./wrapper.patch ./return-error-code.patch ./clang.patch ./aarch64.patch ];

  configurePhase=''
    substituteInPlace admin/wrapper.sh --replace '%%OUT%%' $out
--- a/pkgs/applications/science/astronomy/gildas/mod.patch
+++ b/pkgs/applications/science/astronomy/gildas/mod.patch
@ -1,17 +0,0 @@
-diff -ruN gildas-src-jul18a/admin/Makefile.build gildas-src-jul18a.mod/admin/Makefile.build
--- gildas-src-jul18a/admin/Makefile.build	2018-06-14 14:36:54.000000000 +0200
-+++ gildas-src-jul18a.mod/admin/Makefile.build	2018-07-06 13:31:46.000000000 +0200
-@@ -291,6 +291,13 @@
- 	win-$(LIB_IDENTITY)-und.def -o $@ $(FLDLIBS) $(LIB_DEPENDS) $(ADD_LIBS) $(SYS_LIBS))
- endif
- 
-+# Dummy rules for modules just so that make consider the module a
-+# valid dependency when first parsing the makefiles. This rule should
-+# never be applied as the modules are a by-product of the compilation
-+# of the object
-+$(builddir)/%.mod:
-+	echo "dummy" > /dev/null
-+
- # Fortran executables
- $(bindir)/% : $(builddir)/%.o | $(bindir)
- 	$(FC) $(ALL_FLDFLAGS) $< $(OBJECTS) -o $@ \
--- a/pkgs/applications/science/biology/picard-tools/default.nix
+++ b/pkgs/applications/science/biology/picard-tools/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "picard-tools-${version}";
-  version = "2.18.10";
+  version = "2.18.11";

  src = fetchurl {
    url = "https://github.com/broadinstitute/picard/releases/download/${version}/picard.jar";
-    sha256 = "1px5ar6iizm4czpc66hyyafandw6g9x9s1abj8klc78alvihciw4";
+    sha256 = "03wkyz3bjx3n8bwambhz9lr09271r1wxycmx4p7m2naqs4afxb89";
  };

  buildInputs = [ jre makeWrapper ];
--- a/pkgs/applications/science/logic/aiger/default.nix
+++ b/pkgs/applications/science/logic/aiger/default.nix
@ -13,18 +13,15 @@ stdenv.mkDerivation rec {

  configurePhase = ''
    # Set up picosat, so we can build 'aigbmc'
-    echo $(pwd)
-    ls ..
    mkdir ../picosat
    ln -s ${picosat}/include/picosat/picosat.h ../picosat/picosat.h
    ln -s ${picosat}/lib/picosat.o             ../picosat/picosat.o
    ln -s ${picosat}/share/picosat.version     ../picosat/VERSION
-    ls ..
    ./configure.sh
  '';

  installPhase = ''
-    mkdir -p $out/bin
+    mkdir -p $out/bin $dev/include $lib/lib

    # Do the installation manually, as the Makefile has odd
    # cyrillic characters, and this is easier than adding
@ -41,8 +38,13 @@ stdenv.mkDerivation rec {
    for x in ''${BINS[*]}; do
      install -m 755 -s $x $out/bin/$x
    done
+
+    cp -v aiger.o $lib/lib
+    cp -v aiger.h $dev/include
  '';

+  outputs = [ "out" "dev" "lib" ];
+
  meta = {
    description = "And-Inverter Graph (AIG) utilities";
    homepage    = http://fmv.jku.at/aiger/;
--- a/pkgs/applications/science/logic/boolector/default.nix
+++ b/pkgs/applications/science/logic/boolector/default.nix
@ -1,41 +1,50 @@
-{ stdenv, fetchurl, writeShellScriptBin }:
+{ stdenv, fetchFromGitHub
+, cmake, lingeling, btor2tools
+}:

 stdenv.mkDerivation rec {
  name    = "boolector-${version}";
-  version = "2.4.1";
-  src = fetchurl {
-    url    = "http://fmv.jku.at/boolector/boolector-${version}-with-lingeling-bbc.tar.bz2";
-    sha256 = "0mdf7hwix237pvknvrpazcx6s3ininj5k7vhysqjqgxa7lxgq045";
+  version = "3.0.0";
+
+  src = fetchFromGitHub {
+    owner  = "boolector";
+    repo   = "boolector";
+    rev    = "refs/tags/${version}";
+    sha256 = "15i3ni5klss423m57wcy1gx0m5wfrjmglapwg85pm7fb3jj1y7sz";
  };

-  prePatch =
-    let
-      lingelingPatch = writeShellScriptBin "lingeling-patch" ''
-        sed -i -e "1i#include <stdint.h>" lingeling/lglib.h
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ lingeling btor2tools ];

-        ${crossFix}/bin/crossFix lingeling
-      '';
-      crossFix = writeShellScriptBin "crossFix" ''
-        # substituteInPlace not available here
-        sed -i $1/makefile.in \
-          -e 's@ar rc@$(AR) rc@' \
-          -e 's@ranlib@$(RANLIB)@'
-      '';
-    in ''
-    sed -i -e 's@mv lingeling\* lingeling@\0 \&\& ${lingelingPatch}/bin/lingeling-patch@' makefile
-    sed -i -e 's@mv boolector\* boolector@\0 \&\& ${crossFix}/bin/crossFix boolector@' makefile
-  '';
+  cmakeFlags =
+    [ "-DSHARED=ON"
+      "-DUSE_LINGELING=YES"
+      "-DBTOR2_INCLUDE_DIR=${btor2tools.dev}/include"
+      "-DBTOR2_LIBRARIES=${btor2tools.lib}/lib/libbtor2parser.so"
+      "-DLINGELING_INCLUDE_DIR=${lingeling.dev}/include"
+      "-DLINGELING_LIBRARIES=${lingeling.lib}/lib/liblgl.a"
+    ];

  installPhase = ''
-    mkdir $out
-    mv boolector/bin $out
+    mkdir -p $out/bin $lib/lib $dev/include
+
+    cp -vr bin/* $out/bin
+    cp -vr lib/* $lib/lib
+
+    rm -rf $out/bin/{examples,test}
+
+    cd ../src
+    find . -iname '*.h' -exec cp --parents '{}' $dev/include \;
+    rm -rf $dev/include/tests
  '';

-  meta = {
-    license = stdenv.lib.licenses.unfreeRedistributable;
+  outputs = [ "out" "dev" "lib" ];
+
+  meta = with stdenv.lib; {
    description = "An extremely fast SMT solver for bit-vectors and arrays";
-    homepage    = "http://fmv.jku.at/boolector";
-    platforms   = stdenv.lib.platforms.linux;
-    maintainers = [ stdenv.lib.maintainers.thoughtpolice ];
+    homepage    = https://boolector.github.io;
+    license     = licenses.mit;
+    platforms   = platforms.linux;
+    maintainers = with maintainers; [ thoughtpolice ];
  };
 }
--- a/pkgs/applications/science/logic/btor2tools/default.nix
+++ b/pkgs/applications/science/logic/btor2tools/default.nix
@ -0,0 +1,33 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  name = "btor2tools-${version}";
+  version = "pre55_8c150b39";
+
+  src = fetchFromGitHub {
+    owner  = "boolector";
+    repo   = "btor2tools";
+    rev    = "8c150b39cdbcdef4247344acf465d75ef642365d";
+    sha256 = "1r5pid4x567nms02ajjrz3v0zj18k0fi5pansrmc2907rnx2acxx";
+  };
+
+  configurePhase = "./configure.sh -shared";
+
+  installPhase = ''
+    mkdir -p $out $dev/include/btor2parser/ $lib/lib
+
+    cp -vr bin $out
+    cp -v  src/btor2parser/btor2parser.h $dev/include/btor2parser
+    cp -v  build/libbtor2parser.* $lib/lib
+  '';
+
+  outputs = [ "out" "dev" "lib" ];
+
+  meta = with stdenv.lib; {
+    description = "Fast SAT solver";
+    homepage    = http://fmv.jku.at/lingeling/;
+    license     = licenses.mit;
+    platforms   = platforms.linux;
+    maintainers = with maintainers; [ thoughtpolice ];
+  };
+}
--- a/pkgs/applications/science/logic/lingeling/default.nix
+++ b/pkgs/applications/science/logic/lingeling/default.nix
@ -0,0 +1,49 @@
+{ stdenv, fetchFromGitHub
+, aiger
+}:
+
+stdenv.mkDerivation rec {
+  name = "lingeling-${version}";
+  # This is the version used in satcomp2018, which was
+  # relicensed, and also known as version 'bcj'
+  version = "pre1_03b4860d";
+
+  src = fetchFromGitHub {
+    owner  = "arminbiere";
+    repo   = "lingeling";
+    rev    = "03b4860d14016f42213ea271014f2f13d181f504";
+    sha256 = "1lw1yfy219p7rrk88sbq4zl24b70040zapbjdrpv5a6i0jsblksx";
+  };
+
+  configurePhase = ''
+    ./configure.sh
+
+    # Rather than patch ./configure, just sneak in use of aiger here, since it
+    # doesn't handle real build products very well (it works on a build-time
+    # dir, not installed copy)... This is so we can build 'blimc'
+    substituteInPlace ./makefile \
+      --replace 'targets: liblgl.a' 'targets: liblgl.a blimc'      \
+      --replace '$(AIGER)/aiger.o'  '${aiger.lib}/lib/aiger.o'     \
+      --replace '$(AIGER)/aiger.h'  '${aiger.dev}/include/aiger.h' \
+      --replace '-I$(AIGER)'        '-I${aiger.dev}/include'
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin $lib/lib $dev/include
+
+    cp lglib.h  $dev/include
+    cp liblgl.a $lib/lib
+
+    cp lingeling plingeling treengeling ilingeling blimc $out/bin
+  '';
+
+  outputs = [ "out" "dev" "lib" ];
+
+  meta = with stdenv.lib; {
+    description = "Fast SAT solver";
+    homepage    = http://fmv.jku.at/lingeling/;
+    license     = licenses.mit;
+    platforms   = platforms.linux;
+    maintainers = with maintainers; [ thoughtpolice ];
+  };
+}
--- a/pkgs/applications/science/math/caffe/darwin.patch
+++ b/pkgs/applications/science/math/caffe/darwin.patch
@ -0,0 +1,47 @@
+diff --git a/Makefile b/Makefile
+index c823f66e..65b90c5e 100644
+--- a/Makefile
+++ b/Makefile
+@@ -32,9 +32,9 @@ SRC_DIRS := $(shell find * -type d -exec bash -c "find {} -maxdepth 1 \
+ LIBRARY_NAME := $(PROJECT)
+ LIB_BUILD_DIR := $(BUILD_DIR)/lib
+ STATIC_NAME := $(LIB_BUILD_DIR)/lib$(LIBRARY_NAME).a
+-DYNAMIC_VERSION_MAJOR 		:= 1
+-DYNAMIC_VERSION_MINOR 		:= 0
+-DYNAMIC_VERSION_REVISION 	:= 0
+DYNAMIC_VERSION_MAJOR		:= 1
+DYNAMIC_VERSION_MINOR		:= 0
+DYNAMIC_VERSION_REVISION	:= 0
+ DYNAMIC_NAME_SHORT := lib$(LIBRARY_NAME).so
+ #DYNAMIC_SONAME_SHORT := $(DYNAMIC_NAME_SHORT).$(DYNAMIC_VERSION_MAJOR)
+ DYNAMIC_VERSIONED_NAME_SHORT := $(DYNAMIC_NAME_SHORT).$(DYNAMIC_VERSION_MAJOR).$(DYNAMIC_VERSION_MINOR).$(DYNAMIC_VERSION_REVISION)
+diff --git a/cmake/Dependencies.cmake b/cmake/Dependencies.cmake
+index c48255c8..cf4c580e 100644
+--- a/cmake/Dependencies.cmake
+++ b/cmake/Dependencies.cmake
+@@ -105,7 +105,6 @@ if(USE_OPENCV)
+ endif()
+ 
+ # ---[ BLAS
+-if(NOT APPLE)
+   set(BLAS "Atlas" CACHE STRING "Selected BLAS library")
+   set_property(CACHE BLAS PROPERTY STRINGS "Atlas;Open;MKL")
+ 
+@@ -123,17 +122,6 @@ if(NOT APPLE)
+     list(APPEND Caffe_LINKER_LIBS PUBLIC ${MKL_LIBRARIES})
+     list(APPEND Caffe_DEFINITIONS PUBLIC -DUSE_MKL)
+   endif()
+-elseif(APPLE)
+-  find_package(vecLib REQUIRED)
+-  list(APPEND Caffe_INCLUDE_DIRS PUBLIC ${vecLib_INCLUDE_DIR})
+-  list(APPEND Caffe_LINKER_LIBS PUBLIC ${vecLib_LINKER_LIBS})
+-
+-  if(VECLIB_FOUND)
+-    if(NOT vecLib_INCLUDE_DIR MATCHES "^/System/Library/Frameworks/vecLib.framework.*")
+-      list(APPEND Caffe_DEFINITIONS PUBLIC -DUSE_ACCELERATE)
+-    endif()
+-  endif()
+-endif()
+ 
+ # ---[ Python
+ if(BUILD_python)
--- a/pkgs/applications/science/math/caffe/default.nix
+++ b/pkgs/applications/science/math/caffe/default.nix
@ -1,27 +1,39 @@
-{ stdenv, lib
+{ stdenv, lib, runCommand
 , fetchFromGitHub
+, fetchurl
 , cmake
 , boost
 , google-gflags
 , glog
 , hdf5-cpp
-, leveldb
-, lmdb
 , opencv3
 , protobuf
-, snappy
 , doxygen
 , openblas
-, cudaSupport ? true, cudatoolkit
+, Accelerate, CoreGraphics, CoreVideo
+, lmdbSupport ? true, lmdb
+, leveldbSupport ? true, leveldb, snappy
+, cudaSupport ? stdenv.isLinux, cudatoolkit
 , cudnnSupport ? false, cudnn ? null
 , ncclSupport ? false, nccl ? null
 , pythonSupport ? false, python ? null, numpy ? null
 }:

+assert leveldbSupport -> (leveldb != null && snappy != null);
 assert cudnnSupport -> cudaSupport;
 assert ncclSupport -> cudaSupport;
 assert pythonSupport -> (python != null && numpy != null);

+let
+  toggle = bool: if bool then "ON" else "OFF";
+
+  test_model_weights = fetchurl {
+    url = "http://dl.caffe.berkeleyvision.org/bvlc_reference_caffenet.caffemodel";
+    sha256 = "472d4a06035497b180636d8a82667129960371375bd10fcb6df5c6c7631f25e0";
+  };
+
+in
+
 stdenv.mkDerivation rec {
  name = "caffe-${version}";
  version = "1.0";
@ -44,19 +56,27 @@ stdenv.mkDerivation rec {
           "-DCUDA_ARCH_NAME=All"
           "-DCUDA_HOST_COMPILER=${cudatoolkit.cc}/bin/cc"
         ] else [ "-DCPU_ONLY=ON" ])
-      ++ lib.optional ncclSupport "-DUSE_NCCL=ON";
+      ++ ["-DUSE_NCCL=${toggle ncclSupport}"]
+      ++ ["-DUSE_LEVELDB=${toggle leveldbSupport}"]
+      ++ ["-DUSE_LMDB=${toggle lmdbSupport}"];

-  buildInputs = [ boost google-gflags glog protobuf hdf5-cpp lmdb leveldb snappy opencv3 openblas ]
+  buildInputs = [ boost google-gflags glog protobuf hdf5-cpp opencv3 openblas ]
                ++ lib.optional cudaSupport cudatoolkit
                ++ lib.optional cudnnSupport cudnn
+                ++ lib.optional lmdbSupport lmdb
                ++ lib.optional ncclSupport nccl
-                ++ lib.optionals pythonSupport [ python numpy ];
+                ++ lib.optionals leveldbSupport [ leveldb snappy ]
+                ++ lib.optionals pythonSupport [ python numpy ]
+                ++ lib.optionals stdenv.isDarwin [ Accelerate CoreGraphics CoreVideo ]
+                ;

  propagatedBuildInputs = lib.optional pythonSupport python.pkgs.protobuf;

  outputs = [ "bin" "out"];
  propagatedBuildOutputs = []; # otherwise propagates out -> bin cycle

+  patches = [ ./darwin.patch ];
+
  preConfigure = lib.optionalString (cudaSupport && lib.versionAtLeast cudatoolkit.version "9.0") ''
    # CUDA 9.0 doesn't support sm_20
    sed -i 's,20 21(20) ,,' cmake/Cuda.cmake
@ -71,6 +91,9 @@ stdenv.mkDerivation rec {
    # Internal static library.
    rm $out/lib/libproto.a

+    # Install models
+    cp -a ../models $out/share/Caffe/models
+
    moveToOutput "bin" "$bin"
  '' + lib.optionalString pythonSupport ''
    mkdir -p $out/${python.sitePackages}
@ -78,6 +101,16 @@ stdenv.mkDerivation rec {
    rm -rf $out/python
  '';

+  doInstallCheck = false; # build takes more than 30 min otherwise
+  installCheckPhase = ''
+    model=bvlc_reference_caffenet
+    m_path="$out/share/Caffe/models/$model"
+    $bin/bin/caffe test \
+      -model "$m_path/deploy.prototxt" \
+      -solver "$m_path/solver.prototxt" \
+      -weights "${test_model_weights}"
+  '';
+
  meta = with stdenv.lib; {
    description = "Deep learning framework";
    longDescription = ''
@ -88,6 +121,6 @@ stdenv.mkDerivation rec {
    homepage = http://caffe.berkeleyvision.org/;
    maintainers = with maintainers; [ jb55 ];
    license = licenses.bsd2;
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
  };
 }
--- a/pkgs/applications/science/math/cplex/default.nix
+++ b/pkgs/applications/science/math/cplex/default.nix
@ -0,0 +1,82 @@
+{ stdenv, makeWrapper, openjdk, gtk2, xorg, glibcLocales, releasePath }:
+
+# To use this package, you need to download your own cplex installer from IBM
+# and override the releasePath attribute to point to the location of the file.  
+#
+# Note: cplex creates an individual build for each license which screws
+# somewhat with the use of functions like requireFile as the hash will be
+# different for every user.
+
+stdenv.mkDerivation rec {
+  name = "cplex-${version}";
+  version = "128";
+  
+  src =
+    if builtins.isNull releasePath then
+      throw ''
+        This nix expression requires that the cplex installer is already
+        downloaded to your machine. Get it from IBM: 
+        https://developer.ibm.com/docloud/blog/2017/12/20/cplex-optimization-studio-12-8-now-available/ 
+
+        Set `cplex.releasePath = /path/to/download;` in your
+        ~/.config/nixpkgs/config.nix for `nix-*` commands, or
+        `config.cplex.releasePath = /path/to/download;` in your
+        `configuration.nix` for NixOS.
+      ''
+    else
+      releasePath;
+
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ openjdk gtk2 xorg.libXtst glibcLocales ];
+
+  unpackPhase = "cp $src $name";
+
+  patchPhase = ''
+    sed -i -e 's|/usr/bin/tr"|tr"         |' $name
+  '';
+
+  buildPhase = ''
+    sh $name -i silent -DLICENSE_ACCEPTED=TRUE -DUSER_INSTALL_DIR=$out
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    ln -s $out/opl/bin/x86-64_linux/oplrun\
+      $out/opl/bin/x86-64_linux/oplrunjava\
+      $out/opl/oplide/oplide\
+      $out/cplex/bin/x86-64_linux/cplex\
+      $out/cpoptimizer/bin/x86-64_linux/cpoptimizer\
+      $out/bin
+  '';
+
+  fixupPhase = 
+  let 
+    libraryPath = stdenv.lib.makeLibraryPath [ stdenv.cc.cc gtk2 xorg.libXtst ];
+  in ''
+    interpreter=${stdenv.glibc}/lib/ld-linux-x86-64.so.2
+
+    for pgm in $out/opl/bin/x86-64_linux/oplrun $out/opl/bin/x86-64_linux/oplrunjava $out/opl/oplide/oplide;
+    do
+      patchelf --set-interpreter "$interpreter" $pgm;
+      wrapProgram $pgm \
+        --prefix LD_LIBRARY_PATH : $out/opl/bin/x86-64_linux:${libraryPath} \
+        --set LOCALE_ARCHIVE ${glibcLocales}/lib/locale/locale-archive;
+    done
+
+    for pgm in $out/cplex/bin/x86-64_linux/cplex $out/cpoptimizer/bin/x86-64_linux/cpoptimizer $out/opl/oplide/jre/bin/*; 
+    do
+      if grep ELF $pgm > /dev/null;
+      then
+        patchelf --set-interpreter "$interpreter" $pgm;
+      fi
+    done
+  '';
+  
+  meta = with stdenv.lib; {
+    description = "Optimization solver for mathematical programming";
+    homepage = "https://www.ibm.com/be-en/marketplace/ibm-ilog-cplex";
+    license = licenses.unfree;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ bfortz ];
+  };
+}
--- a/pkgs/applications/science/math/gfan/default.nix
+++ b/pkgs/applications/science/math/gfan/default.nix
@ -9,15 +9,20 @@ stdenv.mkDerivation rec {
    sha256 = "02pihqb1lb76a0xbfwjzs1cd6ay3ldfxsm8dvsbl6qs3vkjxax56";
  };

-  makeFlags = ''PREFIX=$(out) CC=cc CXX=c++ cddnoprefix=1'';
-  buildInputs = [gmp mpir cddlib];
+  patchPhase = stdenv.lib.optionalString stdenv.isDarwin ''
+    substituteInPlace Makefile --replace "-fno-guess-branch-probability" ""
+  '';
+
+  buildFlags = [ "CC=cc" "CXX=c++" "cddnoprefix=1" ];
+  installFlags = [ ''PREFIX=$(out)'' ];
+  buildInputs = [ gmp mpir cddlib ];

  meta = {
    inherit version;
    description = ''A software package for computing Gröbner fans and tropical varieties'';
    license = stdenv.lib.licenses.gpl2 ;
    maintainers = [stdenv.lib.maintainers.raskin];
-    platforms = stdenv.lib.platforms.linux;
+    platforms = stdenv.lib.platforms.unix;
    homepage = http://home.math.au.dk/jensen/software/gfan/gfan.html;
  };
 }
--- a/pkgs/applications/science/math/qalculate-gtk/default.nix
+++ b/pkgs/applications/science/math/qalculate-gtk/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  name = "qalculate-gtk-${version}";
-  version = "2.6.1";
+  version = "2.6.2";

  src = fetchFromGitHub {
    owner = "qalculate";
    repo = "qalculate-gtk";
    rev = "v${version}";
-    sha256 = "19jw1w29x0r1qq5r8gmqrqr00ml2pfi2w433723vjzxpfg2pp70r";
+    sha256 = "1yzw6avhka7bbi071z9d8cipcghyjq2bg9x3arv1cf395xlnrmb9";
  };

  patchPhase = ''
--- a/pkgs/applications/science/math/ratpoints/default.nix
+++ b/pkgs/applications/science/math/ratpoints/default.nix
@ -1,20 +1,36 @@
-{stdenv, fetchurl, gmp}:
+{ stdenv, fetchurl, fetchpatch, gmp }:
 stdenv.mkDerivation rec {
  name = "ratpoints-${version}";
-  version = "2.1.3";
+  version = "2.1.3.p4";
+
  src = fetchurl {
    url = "http://www.mathe2.uni-bayreuth.de/stoll/programs/ratpoints-${version}.tar.gz";
    sha256 = "0zhad84sfds7izyksbqjmwpfw4rvyqk63yzdjd3ysd32zss5bgf4";
  };
-  buildInputs = [gmp];
-  makeFlags = "INSTALL_DIR=$(out)";
+
+  enableParallelBuilding = true;
+
+  patches = [
+    (fetchpatch {
+      url = "https://git.sagemath.org/sage.git/plain/build/pkgs/ratpoints/patches/sturm_and_rp_private.patch?id=1615f58890e8f9881c4228c78a6b39b9aab1303a";
+      sha256 = "0q3wajncyfr3gahd8gwk9x7g56zw54lpywrl63lqk7drkf60mrcl";
+    })
+  ];
+
+  buildInputs = [ gmp ];
+
+  makeFlags = [ "CC=cc" ];
+  buildFlags = stdenv.lib.optional stdenv.isDarwin ["CCFLAGS2=-lgmp -lc -lm" "CCFLAGS=-UUSE_SSE"];
+  installFlags = [ "INSTALL_DIR=$(out)" ];
+
  preInstall = ''mkdir -p "$out"/{bin,share,lib,include}'';
+
  meta = {
    inherit version;
    description = ''A program to find rational points on hyperelliptic curves'';
    license = stdenv.lib.licenses.gpl2Plus;
    maintainers = [stdenv.lib.maintainers.raskin];
-    platforms = stdenv.lib.platforms.linux;
+    platforms = stdenv.lib.platforms.unix;
    homepage = http://www.mathe2.uni-bayreuth.de/stoll/programs/;
    updateWalker = true;
  };
--- a/pkgs/applications/science/math/symmetrica/default.nix
+++ b/pkgs/applications/science/math/symmetrica/default.nix
@ -5,20 +5,15 @@
 stdenv.mkDerivation rec {
  name = "symmetrica-${version}";
  version = "2.0";
+
  src = fetchurl {
    url = "http://www.algorithm.uni-bayreuth.de/en/research/SYMMETRICA/SYM2_0_tar.gz";
    sha256 = "1qhfrbd5ybb0sinl9pad64rscr08qvlfzrzmi4p4hk61xn6phlmz";
    name = "symmetrica-2.0.tar.gz";
  };
+
  sourceRoot = ".";
-  installPhase = ''
-    mkdir -p "$out"/{lib,share/doc/symmetrica,include/symmetrica}
-    ar crs libsymmetrica.a *.o
-    ranlib libsymmetrica.a
-    cp libsymmetrica.a "$out/lib"
-    cp *.h "$out/include/symmetrica"
-    cp README *.doc "$out/share/doc/symmetrica"
-  '';
+
  patches = [
      # don't show banner ("SYMMETRICA VERSION X - STARTING)
      # it doesn't contain very much helpful information and a banner is not ideal for a library
@ -34,13 +29,34 @@ stdenv.mkDerivation rec {
        url = "https://git.sagemath.org/sage.git/plain/build/pkgs/symmetrica/patches/int32.patch?id=07d6c37d18811e2b377a9689790a7c5e24da16ba";
        sha256 = "0p33c85ck4kd453z687ni4bdcqr1pqx2756j7aq11bf63vjz4cyz";
      })
+
+      (fetchpatch {
+        url = "https://git.sagemath.org/sage.git/plain/build/pkgs/symmetrica/patches/return_values.patch?id=1615f58890e8f9881c4228c78a6b39b9aab1303a";
+        sha256 = "0dmczkicwl50sivc07w3wm3jpfk78wm576dr25999jdj2ipsb7nk";
+      })
  ];
+
+  postPatch = ''
+    substituteInPlace makefile --replace gcc cc
+  '';
+
+  enableParallelBuilding = true;
+
+  installPhase = ''
+    mkdir -p "$out"/{lib,share/doc/symmetrica,include/symmetrica}
+    ar crs libsymmetrica.a *.o
+    ranlib libsymmetrica.a
+    cp libsymmetrica.a "$out/lib"
+    cp *.h "$out/include/symmetrica"
+    cp README *.doc "$out/share/doc/symmetrica"
+  '';
+
  meta = {
    inherit version;
    description = ''A collection of routines for representation theory and combinatorics'';
    license = stdenv.lib.licenses.publicDomain;
    maintainers = [stdenv.lib.maintainers.raskin];
-    platforms = stdenv.lib.platforms.linux;
+    platforms = stdenv.lib.platforms.unix;
    homepage = http://www.symmetrica.de/;
  };
 }
--- a/pkgs/applications/science/misc/simgrid/default.nix
+++ b/pkgs/applications/science/misc/simgrid/default.nix
@ -1,11 +1,11 @@
-{ stdenv, fetchFromGitHub, cmake, elfutils, perl, python3, boost, valgrind
+{ stdenv, fetchFromGitHub, cmake, perl, python3, boost, valgrind
 # Optional requirements
 # Lua 5.3 needed and not available now
 #, luaSupport ? false, lua5
 , fortranSupport ? false, gfortran
 , buildDocumentation ? false, transfig, ghostscript, doxygen
 , buildJavaBindings ? false, openjdk
-, modelCheckingSupport ? false, libunwind, libevent # Inside elfutils - , libelf, libevent, libdw
+, modelCheckingSupport ? false, libunwind, libevent, elfutils # Inside elfutils: libelf and libdw
 , debug ? false
 , moreTests ? false
 }:
@ -18,20 +18,20 @@ in

 stdenv.mkDerivation rec {
  name = "simgrid-${version}";
-  version = "3.19.1";
+  version = "3.20";

  src = fetchFromGitHub {
    owner = "simgrid";
    repo = "simgrid";
    rev = "v${version}";
-    sha256 = "0vpgcp40xv20hcpslx5wz2mf2phaq41f7x8yr0bm7mknqd3zwxih";
+    sha256 = "0xb20qhvsah2dz2hvn850i3w9a5ghsbcx8vka2ap6xsdkxf593gy";
  };

-  nativeBuildInputs = [ cmake perl elfutils python3 boost valgrind ]
+  nativeBuildInputs = [ cmake perl python3 boost valgrind ]
      ++ optionals fortranSupport [ gfortran ]
      ++ optionals buildJavaBindings [ openjdk ]
      ++ optionals buildDocumentation [ transfig ghostscript doxygen ]
-      ++ optionals modelCheckingSupport [ libunwind libevent ];
+      ++ optionals modelCheckingSupport [ libunwind libevent elfutils ];

  #buildInputs = optional luaSupport lua5;

@ -83,13 +83,15 @@ stdenv.mkDerivation rec {
  '';

  doCheck = true;
-  
+
  checkPhase = ''
    runHook preCheck
-    ctest --output-on-failure -E smpi-replay-multiple
+
+    ctest -j $NIX_BUILD_CORES --output-on-failure -E smpi-replay-multiple
+
    runHook postCheck
  '';
-    
+
  enableParallelBuilding = true;

  meta = {
--- a/pkgs/applications/version-management/cvs/default.nix
+++ b/pkgs/applications/version-management/cvs/default.nix
@ -32,9 +32,10 @@ stdenv.mkDerivation {

  doCheck = false; # fails 1 of 1 tests

-  meta = {
+  meta = with stdenv.lib; {
    homepage = http://cvs.nongnu.org;
    description = "Concurrent Versions System - a source control system";
-    platforms = stdenv.lib.platforms.all;
+    license = licenses.gpl2; # library is GPLv2, main is GPLv1
+    platforms = platforms.all;
  };
 }
--- a/pkgs/applications/version-management/git-and-tools/tig/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/tig/default.nix
@ -4,14 +4,14 @@

 stdenv.mkDerivation rec {
  pname = "tig";
-  version = "2.4.0";
+  version = "2.4.1";
  name = "${pname}-${version}";

  src = fetchFromGitHub {
    owner = "jonas";
    repo = pname;
    rev = name;
-    sha256 = "1d5clkdgj0ip1j0k335pr4dabcnap6jr016q90i49p1jxixy96pb";
+    sha256 = "0i26yfn2vjgsg1kdvhhv55jwzds7ih7cnad1xqvilqm83zh47ksd";
  };

  nativeBuildInputs = [ makeWrapper autoreconfHook asciidoc xmlto docbook_xsl docbook_xml_dtd_45 findXMLCatalogs pkgconfig ];
--- a/pkgs/applications/version-management/gitkraken/default.nix
+++ b/pkgs/applications/version-management/gitkraken/default.nix
@ -12,11 +12,11 @@ let
 in
 stdenv.mkDerivation rec {
  name = "gitkraken-${version}";
-  version = "3.6.6";
+  version = "4.0.1";

  src = fetchurl {
    url = "https://release.gitkraken.com/linux/v${version}.deb";
-    sha256 = "01ir325ls1fb6ml79c02c7dyi910lxw0avlwc0nzv8fy4aqavl6p";
+    sha256 = "0y4r5d21mxwnwla9ggy9c4pm3zbz67yi9z06znkdz9x2chv1ci3n";
  };

  libPath = makeLibraryPath [
--- a/pkgs/applications/video/mpv/scripts/mpris.nix
+++ b/pkgs/applications/video/mpv/scripts/mpris.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  name = "mpv-mpris-${version}.so";
-  version = "0.1";
+  version = "0.2";

  src = fetchFromGitHub {
    owner = "hoyon";
    repo = "mpv-mpris";
-    rev = "v${version}";
-    sha256 = "0rsbrbv5q7vki59wdlx4cdkd0vvd79qgbjvdb3fn3li7aznvjwiy";
+    rev = version;
+    sha256 = "06hq3j1jjlaaz9ss5l7illxz8vm5bng86jl24kawglwkqayhdnjx";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/applications/video/obs-studio/linuxbrowser.nix
+++ b/pkgs/applications/video/obs-studio/linuxbrowser.nix
@ -10,12 +10,12 @@

 stdenv.mkDerivation rec {
  name = "obs-linuxbrowser-${version}";
-  version = "0.4.0";
+  version = "0.5.0";
  src = fetchFromGitHub {
    owner = "bazukas";
    repo = "obs-linuxbrowser";
    rev = version;
-    sha256 = "1nqi04ici9n1xjliy1gaqy2bq8zj1z32dffk890x2hi7ml688y9h";
+    sha256 = "0jgh377yv69wbcqg7m7axi22x2p9jmcirws1pgrz22vaw7zbbdzl";
  };
  nativeBuildInputs = [ cmake ];
  buildInputs = [ obs-studio ];
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@ -22,8 +22,8 @@

 with stdenv.lib;
 let
-  version = "2.12.0";
-  sha256 = "17377xxbmwbrnh895a108z944pqi39hzrbw4jzgj8pcipi3s3x69";
+  version = "2.12.1";
+  sha256 = "1jp5y56682bgpfjapagxjfrjdvqkal34pj9qzn6kj8fqaad80l21";
  audio = optionalString (hasSuffix "linux" stdenv.system) "alsa,"
    + optionalString pulseSupport "pa,"
    + optionalString sdlSupport "sdl,";
@ -71,8 +71,10 @@ stdenv.mkDerivation rec {

  outputs = [ "out" "ga" ];

-  patches = [ ./no-etc-install.patch ]
-    ++ optional nixosTestRunner ./force-uid0-on-9p.patch
+  patches = [
+    ./no-etc-install.patch
+    ./fix-qemu-ga.patch
+  ] ++ optional nixosTestRunner ./force-uid0-on-9p.patch
    ++ optional pulseSupport ./fix-hda-recording.patch
    ++ optionals stdenv.hostPlatform.isMusl [
    (fetchpatch {
--- a/pkgs/applications/virtualization/qemu/fix-qemu-ga.patch
+++ b/pkgs/applications/virtualization/qemu/fix-qemu-ga.patch
@ -0,0 +1,22 @@
+diff --git a/qga/commands-posix.c b/qga/commands-posix.c
+index 0dc219d..9d020d3 100644
+--- a/qga/commands-posix.c
+++ b/qga/commands-posix.c
+@@ -102,6 +102,8 @@ void qmp_guest_shutdown(bool has_mode, const char *mode, Error **errp)
+         reopen_fd_to_null(1);
+         reopen_fd_to_null(2);
+
+        execle("/run/current-system/sw/bin/shutdown", "shutdown", "-h", shutdown_flag, "+0",
+               "hypervisor initiated shutdown", (char*)NULL, environ);
+         execle("/sbin/shutdown", "shutdown", "-h", shutdown_flag, "+0",
+                "hypervisor initiated shutdown", (char*)NULL, environ);
+         _exit(EXIT_FAILURE);
+@@ -189,6 +191,8 @@ void qmp_guest_set_time(bool has_time, int64_t time_ns, Error **errp)
+
+         /* Use '/sbin/hwclock -w' to set RTC from the system time,
+          * or '/sbin/hwclock -s' to set the system time from RTC. */
+        execle("/run/current-system/sw/bin/hwclock", "hwclock", has_time ? "-w" : "-s",
+               NULL, environ);
+         execle("/sbin/hwclock", "hwclock", has_time ? "-w" : "-s",
+                NULL, environ);
+         _exit(EXIT_FAILURE);
--- a/pkgs/applications/virtualization/singularity/default.nix
+++ b/pkgs/applications/virtualization/singularity/default.nix
@ -19,7 +19,7 @@

 stdenv.mkDerivation rec {
  name = "singularity-${version}";
-  version = "2.5.2";
+  version = "2.6.0";

  enableParallelBuilding = true;

@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
    owner = "singularityware";
    repo = "singularity";
    rev = version;
-    sha256 = "09wv8xagr5fjfhra5vyig0f1frfp97g99baqkh4avbzpg296q933";
+    sha256 = "0bi7acgppbkfbra8r29s1ldq02lazdww0z2h1rfvv8spr8dzzi94";
  };

  nativeBuildInputs = [ autoreconfHook makeWrapper ];
--- a/pkgs/applications/virtualization/virtualbox/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/default.nix
@ -6,7 +6,7 @@
 , xorriso, makeself, perl
 , javaBindings ? false, jdk ? null
 , pythonBindings ? false, python2 ? null
-, enableExtensionPack ? false, requireFile ? null, fakeroot ? null
+, extensionPack ? null, fakeroot ? null
 , pulseSupport ? false, libpulseaudio ? null
 , enableHardening ? false
 , headless ? false
@ -19,30 +19,9 @@ with stdenv.lib;
 let
  python = python2;
  buildType = "release";
-  # Manually sha256sum the extensionPack file, must be hex!
-  # Do not forget to update the hash in ./guest-additions/default.nix!
-  extpack = "d90c1b0c89de19010f7c7fe7a675ac744067baf29a9966b034e97b5b2053b37e";
-  extpackRev = "123301";
+  # Remember to change the extpackRev and version in extpack.nix as well.
  main = "ee3af129a581ec4c1a3e777e98247f8943e976ce6edd24962bcaa5c53ed1f644";
  version = "5.2.14";
-
-  # See https://github.com/NixOS/nixpkgs/issues/672 for details
-  extensionPack = requireFile rec {
-    name = "Oracle_VM_VirtualBox_Extension_Pack-${version}-${toString extpackRev}.vbox-extpack";
-    sha256 = extpack;
-    message = ''
-      In order to use the extension pack, you need to comply with the VirtualBox Personal Use
-      and Evaluation License (PUEL) available at:
-
-      https://www.virtualbox.org/wiki/VirtualBox_PUEL
-
-      Once you have read and if you agree with the license, please use the
-      following command and re-run the installation:
-
-      nix-prefetch-url http://download.virtualbox.org/virtualbox/${version}/${name}
-    '';
-  };
-
 in stdenv.mkDerivation {
  name = "virtualbox-${version}";

@ -174,7 +153,7 @@ in stdenv.mkDerivation {
        ln -s "$libexec/$file" $out/bin/$file
    done

-    ${optionalString enableExtensionPack ''
+    ${optionalString (extensionPack != null) ''
      mkdir -p "$share"
      "${fakeroot}/bin/fakeroot" "${stdenv.shell}" <<EXTHELPER
      "$libexec/VBoxExtPackHelperApp" install \
--- a/pkgs/applications/virtualization/virtualbox/extpack.nix
+++ b/pkgs/applications/virtualization/virtualbox/extpack.nix
@ -0,0 +1,20 @@
+{stdenv, fetchurl, lib}:
+
+with lib;
+
+let extpackRev = "123301";
+    version = "5.2.14";
+in
+fetchurl rec {
+  name = "Oracle_VM_VirtualBox_Extension_Pack-${version}-${toString extpackRev}.vbox-extpack";
+  url = "http://download.virtualbox.org/virtualbox/${version}/${name}";
+  sha256 = "d90c1b0c89de19010f7c7fe7a675ac744067baf29a9966b034e97b5b2053b37e";
+
+  meta = {
+    description = "Oracle Extension pack for VirtualBox";
+    license = licenses.virtualbox-puel;
+    homepage = https://www.virtualbox.org/;
+    maintainers = with maintainers; [ flokli sander cdepillabout ];
+    platforms = [ "x86_64-linux" "i686-linux" ];
+  };
+}
--- a/pkgs/build-support/rust/default-crate-overrides.nix
+++ b/pkgs/build-support/rust/default-crate-overrides.nix
@ -1,6 +1,6 @@
 { stdenv, pkgconfig, curl, darwin, libiconv, libgit2, libssh2,
  openssl, sqlite, zlib, dbus, dbus-glib, gdk_pixbuf, cairo, python3,
-  libsodium, postgresql, ... }:
+  libsodium, postgresql, gmp, ... }:

 let
  inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
@ -58,6 +58,10 @@ in
  gdk-pixbuf = attrs: {
    buildInputs = [ gdk_pixbuf ];
  };
+  rink = attrs: {
+    buildInputs = [ gmp ];
+    crateBin = [ {  name = "rink"; path = "src/bin/rink.rs"; } ];
+  };
  cairo-rs = attrs: {
    buildInputs = [ cairo ];
  };
--- a/Show More
+++ b/Show More